Proceedings of the 41St Annual International Seminar

Volume 14

Publisher ISASI (Frank Del Gandio, President) Editorial Advisor Air Safety Through Investigation Richard B. Stone Editorial Staff Susan Fager Esperison Martinez Design William A. Ford Proceedings of the ISASI Proceedings (ISSN 1562-8914) is published annually by the International Society of Air Safety Investigators. Opinions

41st Annual ISASI 2010 PROCEEDINGS expressed by authors are not necessarily endorsed or represent official ISASI position or policy. International Seminar Editorial Offices: 107 E. Holly Ave., Suite 11, Sterling, VA 20164-5405 USA. Telephone: (703) 430-9668. Fax: (703) 450-1745. E-mail address: [email protected]. Internet website: http://www.isasi.org. ‘Investigating ASIA in Notice: The Proceedings of the ISASI 41th annual international seminar held in Sap- Mind–Accurate, Speedy, poro, Japan, features presentations on safety issues of interest to the aviation community. The papers are presented herein Independent, and in the original editorial content supplied by the authors. Authentic’ Copyright © 2011—International Society of Air Safety Investigators, all rights reserved. Publication in any form is prohibited with- Sept. 7–9, 2010 out permission. Permission to reprint is available upon application to the editorial Sapporo, Japan offices. Publisher’s Editorial Profile: ISASI Proceed- ings is printed in the United States and published for professional air safety investigators who are members of the International Society of Air Safety Investigators. Content emphasizes accident investigation findings, investigative techniques and experiences, and industry accident-prevention developments in concert with the seminar theme “Investigating ASIA in Mind—Accurate, Speedy, Independent, and Authentic.” Subscriptions: Active members in good standing and corporate members may acquire, on a no-fee basis, a copy of these Pro- ceedings by downloading the material from the appropriate section of the ISASI website at www.isasi.org. Further, active and corporate members may purchase the Proceedings on a CD-ROM for the nominal fee of $15, which covers postage and handling. Non- ISASI members may acquire the CD-ROM for a $75 fee. A limited number of paper copies of Proceedings 2010 are available at a cost of $150. Checks should accompany the request and be made payable to ISASI. Mail to ISASI, 107 E. Holly Ave., Suite 11, Sterling, VA 20164-5405 USA ISSN 1562-8914

ISASI 2010 Proceedings • 1 ISASI 2010 PROCEEDINGS 2

• Government AirSafety, Government MarcusCosta General Aviation, Flight Recorder, M ErinCarroll([email protected]) Corporate Affairs, Cabin Safety, JoannE.Matley([email protected]) ladislavMika(Co-Chair)([email protected]) Air Traffic ScottDunham(Chair) Services, W Seminar, BarbaraDunn([email protected]) Reachout, JohnGuselli([email protected]) Nominating, Tom McCarthy([email protected]) Membership, Tom McCarthy([email protected]) Code ofEthics,JeffEdwards([email protected]) Bylaws, DarrenT. Gaines([email protected]) Board ofFellows,LudiBenner([email protected]) TomBallot Certification, McCarthy([email protected]) Award, GaleE.Braden([email protected]) Audit, Dr. C Alaska, CraigBledsoe C U United States,Toby Carroll([email protected]) SESA-France Chapter, Vincent Fave Russian, VsvolodE.Overharov ([email protected]) New Zealand,AlanMoselen([email protected]) Latin American,GuillermoJ.Palacia(Mexico) European, DavidKing([email protected]) Canadian, BarbaraM.Dunn([email protected]) Australian, LindsayNaylor([email protected]) S N United States,Toby Carroll([email protected]) New Zealand,PeterWilliams([email protected]) CajFrostell([email protected]) International, European, AnneEvans([email protected]) Canadian, BarbaraDunn([email protected]) Australian, LindsayNaylor([email protected]) C Treasurer, Tom McCarthy([email protected]) ChrisBaum([email protected]) Secretary, Vice-President, PaulMyers([email protected]) Executive Advisor, RichardStone([email protected]) President, FrankDelGandio([email protected]) O Unmanned AerialSystems,Tom Farrier (T.Farrier@ Investigators Training & Education, Human Factors,RichardStone([email protected]) RobertRendzio([email protected]) Southeastern, San Francisco,Peter Axelrod Rocky Mountain,DavidHarper KevinDarcy([email protected]) Pacific Northwest, Inactive Northeast, Mid-Atlantic, RonSchleede([email protected]) Los Angeles, Inactive Great Lakes,MatthewKenner([email protected]) Tim Logan([email protected]) Dallas-Ft. Worth, Arizona, BillWaldock ([email protected]) ISASI 2010 ISASI OCIETY OMMITTEE HAPTER OUNCILLORS ATIONAL AND NITED ([email protected]) ([email protected]) ([email protected]) ([email protected]) earthlink.net) ([email protected]) Graham R. Braithwaite ([email protected]) ([email protected]) ([email protected]) ([email protected]) FFICERS ORKING M ichael K. Hynes P S ichael R. Poole pen Open Proceedings TATES P G RESIDENTS RESIDENTS ROUP

C HAIRMEN R

R EGIONAL EGIONAL

EGIONAL

HAIRMEN

ISASI Information

Flight SafetyFoundation Ltd.,UnitedKingdom Flight DataServices Flight AttendantTraining Institute atMelvilleCollege Aviation Authority Finnish Military Finnair Oyj FedEx xpress Federal Aviation Administration Exponent, Inc. EVA Corporation Airways European Aviation SafetyAgency Era Aviation, Inc. Emirates Airline AeronauticalUniversity Embry-Riddle Embraer-Empresa BrasileiradeAeronauticaS.A. EL ALIsraelAirlines Dutch Transport SafetyBoard Dutch AirlinePilotsAssociation Dombroff GilmoreJaques&FrenchP.C. Directorate ofFlyingSafety—ADF Directorate ofFlightSafety(CanadianForces) Directorate ofAircraftAccidentInvestigations—Namibia Delta AirLines,Inc. Defence ScienceandTechnology Organization(DST) DCI/Branch AIRCO Curt Lewis&Associates,LLC Cranfield Safety&AccidentInvestigationCentre COPAC/Colegio Continental Express Continental Airlines Comair, Inc. Colegio DePilotosAviadores DeMexico,A.C. Civil Aviation SafetyAuthorityAustralia Cirrus Design China Airlines Charles Taylor Aviation, Singapore Centurion, Inc. Cavok Group,Inc. Limited Cathay PacificAirways CAE-Flightscape, Inc. Bundesstelle furFlugunfalluntersuchung—BFU Bombardier Aerospace Boeing CommercialAirplanes Board ofAccidentInvestigation—Sweden BEA-Bureau D’nquetesetD’Analyses AVISURE, Australia Avions deTransp ortRegional(ATR) Aviation SafetyInvestigations,UK Aviation SafetyCouncil Australian and International Pilots AssociationAtlantic SoutheastAirlines—DeltaConnection (AIPA), Association ofProfessionalFlightAttendants ASPA deMexico Aramco AssociatedCompany AmSafe Aviation Search&Survey,American Underwater Ltd. American EagleAirlines Allied PilotsAssociation CompanyLimited All NipponAirways Allianz Aviation Managers,LLC,USA Alitalia Airlines—FlightSafetyDept. Alaska Airlines Airways New Zealand AirTran Airways Australia Airservices Aircraft MechanicsFraternalAssociation Aircraft AccidentInvestigationBureau—Switzerland Airclaims Limited Airbus S.A.S. Air NewZealand,Ltd. Air LinePilotsAssociation Air CanadaPilotsAssociation Air Astana(Kazakhstan) Air AccidentsInvestigationBranch—U.K. Air AccidentInvestigationUnit—Ireland Air AccidentInvestigationBureauofSingapore Aerovias DeMexico,S.A.DeC.V. AeroVeritas Aviation SafetyConsulting,Ltd. Aeronautical &MaritimeResearchLaboratory Administration desEnquêtesTechniques (Luxembourg) Accident Investigation&PreventionBureau Accident InvestigationBoard/Norway Accident InvestigationBoard,Finland ofTransportAAIU Ministry Bulgaria C ORPORATE Australia AustralianTransport SafetyBureau Oficial de Pilotos de la Aviacion Comercial M EMBERS WestJet ◆ Volvo AeroCorporation University ofSouthernCalifornia University ofNSWAviation UND Aerospace U.K. CivilAviation Authority Transportation SafetyBoardofCanada Transport Canada State ofIsrael Star Navigation Systems Group, Spanish AirlinePilots’Association Southwest AirlinesPilots’Association Southwest AirlinesCompany Southern CaliforniaSafetyInstitute South AfricanCivilAviation Authority South AfricanAirways SNECMA oteurs Singapore Airlines,Ltd. Airlines, Ltd. Skyservice Sikorsky AircraftCorporation SICOFAA/SPS Saudi ArabianAirlines SAS Braathens Sandia NationalLaboratories RTI Group, LLC Royal NewZealandAirForce Royal NetherlandsAirForce Rolls-Royce, PLC Republic ofSingaporeAirForce Raytheon Company Qwila Air(Pty),Ltd. Qatar Airways Limited Qantas Airways Pratt &Whitney Phoenix International,Inc. Nova Aerospace,AustraliaParkerAerospace Northwest Airlines ofAviation andAccident Nigerian Ministry NAV Canada National Transportation SafetyBoard National BusinessAviation Association National AirTraffic ControllersAssn. National AerospaceLaboratory, NLR MyTravel Airways Lufthansa GermanAirlines Lockheed MartinCorporation Learjet, Inc. L-3 CommunicationsAviation Recorders Kreindler &Kreindler, LLP Korea Aviation&RailwayAccidentInvestigationBoard Korea AirForceSafetyCtr. KLM RoyalDutchAirlines Jones Day JetBlue Airways Jeppesen Japan Transport SafetyBoard Japanese Aviation InsurancePool Japan AirlinesDomesticCo.,L Irish Aviation Authority Irish AirCorps Interstate Aviation Committee Int’l Assoc.ofMach.&AerospaceWorkers Independent PilotsAssociation IFALPA Hong KongCivilAviation Department Hong KongAirlinePilotsAssociation Honeywell Hellenic Air Accident Investigation Hall &Associates,LLC Gulf FlightSafetyCommittee,Azaiba,Oman Global Aerospace,Inc. GE Transportation/Aircraft Engines General Aviation M anufacturers Association Galaxy ScientificCorporation Flight SafetyFoundation—Taiwan Investigation Bureau & Aviation SafetyBoard TD L td.

Table of Contents

76 Mental Health Aspects of Aircraft Accident Investigation: 2 ISASI Information Protecting the Investigator 3 Table of Contents By Brian Dyer, Nevis Disaster Management Department, and Anthony 4 Preface: ISASI 2010: Konichiwah Brickhouse, Assistant Professor of Aviation Safety, Embry Riddle By Frank Del Gandio, President, ISASI Aeronautical University 6 Keynote Address: A Japan Transport Safety Board 82 Investigating Accidents Related to Errors of Aeronautical Air Safety View Decision-Making in Flight Operations By Norihiro Goto, Chairman, JTSB By Wen-Chin Li, Head of the Graduate School of Psychology, National Defense 10 Lederer Award: Mike Poole: University, Taiwan; Don Harris, Managing Director of HFI Solutions Ltd., United Kingdom; Lun-Wen Li, Industrial Engineering and Engineering ISASI 2010 PROCEEDINGS 2010 Jerome F. Lederer Award Recipient Management, Tsing Hua University, Taiwan; Yueh-Ling Hsu, Professor in the By Esperison Martinez, Editor, ISASI Forum Department of Air Transportation, Kainan University, Taiwan; and Thomas Wang, Acting Managing Director and the Head of the Flight Safety Division, TUESDAY, SEPTEMBER 7 Aviation Safety Council, Taiwan Authentic Investigations 14 How Can We Have an Authentic Investigation? THURSDAY, SEPTEMBER 9 By Guo Fu, Deputy Director, Aviation Safety Office, East China Regional Investigative Tools and Lessons Administration, Civil Aviation Administration, China 19 A Quarter Century and Still Learning—Lessons 89 The Use of Commercial Satellite Imagery in Aircraft Accident Investigation: Results from Recent Trials From the JAL123 Accident Investigation By Matthew Greaves and Graham Braithwaite, Safety and Accident By John Purvis and Ron Schleede, Former Directors of Accident Investigation Centre, Cranfield University Investigation at Boeing and NTSB. 94 Close Cooperation in Investigations has Improved Asia—Trends and Issues Technical Partnership 25 Leading ‘Just Culture’ Toward Pragmatic By Michael Guan, Director of the Investigation Lab, Aviation Safety Council, Application in Japan Taiwan, and Christophe Menez, Head of the Engineering Department, By Hiromitsu Mizutani, Japan Aircraft Pilot Association, Bureau d`Enquêtes et d`Analyses, France (Recipients of the Award of Excellence ANA Corporate Safety Captain for Best Seminar Paper) 34 Accident Trends in Asia: Major Improvements and 99 Terrain Profile Analysis Using Radar Altimeter Data from FDR By Frederico Moreira Machado and Umberto Irgang, Remaining Challenges Embraer Air Safety Department By Robert Matthews, Senior Analyst, Accident Investigation and Prevention, FAA 104 Useful Human Factors Investigative Techniques: A Case Study of a Fatal King Air Accident in Canada WEDNESDAY, SEPTEMBER 8 By David Ross, Operations Investigator, TSB, Canada Innovative Uses of Data and Intellectual Models 109 Effects of Mental Stressors During Flight on Prosodic 42 AAIB’s Use of Data Mining in the Investigation of the Features of Speech and Autonomic Nervous Response 777 Fuel-Icing Accident: Innovative Outcomes and By Hiroto Kikuchi, Japan Air Self Defense Force Challenges Faced By Mark Ford, Senior Inspector of Air Accidents, AAIB UK Recent Accidents: Lessons, Techniques, and Challenges 48 The Contribution of Safety Reporting and Investigations to 116 Heathrow 777: Challenges in Understanding Unusual Safety Management Systems Properties in Aviation Fuel and Problems in Conducting By Paul E. Mayes, Investigation and Analysis, Safety Risk and Environment, Tests to Determine the Vulnerability of an Aircraft’s Fuel Cobham Aviation Services, Australia System to the Accumulation and Release of Ice Applying Intellectual Models By Brian McDermid, Air Accident Investigation Bureau, United Kingdom 52 Limitations of ‘Swiss Cheese’ Models and the 120 Undersea Search Operations: Lessons and Recommendations from Flight 447 Need for a Systems Approach By Alain Bouillard, Head of Safety Investigations, and Olivier Ferrante, By John Stoop, Delft University of Technology, and Sidney Decker, Head of Recovery Group, BEA, France Lund University 60 Was It Really Pilot Error? A Case Study of an Indian 125 Colgan Flight 3407: Achieving the Delicate Balance Military Helicopter Accident Between Timely and Thorough While Staying True By Capt. Samir Kohli, Head of Safety, Saudi Aviation Flight Academy To the Investigative Process By Lorenda Ward, Accident Investigator, NTSB, USA Preparing for Investigation 130 ISASI 2010 Pictorial Review 63 Planning for Sea Search and Recovery Operations— Photos by Esperison Martinez A Small Investigation Agency Perspective The following papers were presented, but no text is available for publication. By the Air Accident Investigation Bureau of Singapore A Review of Aviation Recorder Development and Challenges in China, By Yang Lin, Senior 72 Hazards at Aircraft Accident Sites: Training Investigators in Engineer for Aviation Recorders, Civil Aviation Safety Technical Center, CAAC China Line with the ICAO Circular 315 Guidelines Social-Technical Systems and Proactive Accident Prevention, By Yu-Hsing Huang, Assist- By Nathalie Boston, Safety and Accident Investigation Centre, ant Professor, National Pintung University of Science and Technology, Taiwan Cranfield University, Graham Braithwaite,Cranfield University, Boeing Airways 777 Accident Investigation: What We Don’t Know About Ice and Jet and Sid Hawkins, AAIB Fuel, By Mark H. Smith, Air Safety Investigations, Boeing Commercial Airplanes

ISASI 2010 Proceedings • 3 ISASI 2010 PROCEEDINGS 4

• ESPERISON Martinez the Ham Fighters play baseball this week. the HamFightersplaybaseballthisweek. the Yahoo Dome in Kyushu in southern Japan if thatyou youwish will to have see to travel to the Seibu Dome near TokyoJapan’s or to Pacific sculptures atthisfestivalaretrulystunning. suggest you search the Internet because you will see that the snow “Yuki whySapporo theishomeworld aof famous SnowFestival, explain or mountains same The Games. Winter 1972 the hosted an as status Sapporo’s explain mountains seminar. It is a city known for its parksJapanese colleaguesandbeautifulselectedthis havesetting aforits mountains. Those since 2002 in Asia and our fourth in the Asia-Pacific region. 8,000 milesaway. Sheisatalentedandgraciousperson. Dr. Kakimoto showed great patience when dealing with us from TechnicalCommittee. the co-chaired who Kakimoto, YukiDr. especially and Board, Safety TransportationJapan’s hosts, our K ISASI 2010 ISASI Instead of baseball, you will be treated to a seminar that is full of Fighters Ham Nippon the of home the is also Sapporo This is ISASI’s first seminar in Japan, but it is the third seminar atsuri.” If you are not familiar with the Snow Festival, I I Festival, Snow the with familiar not are you If Matsuri.” trip to Japan and this beautiful city. I will start by thanking and welcome to Sapporo. I hope everyone had a pleasant 2010, ISASI to welcome and morning, good onichiwah, Proceedings L eague. The bad news for visiting baseball fans is ISASI 2010:Konichiwah lympic city, having city,having Olympic By FrankDelGandio,President Preface ur Our accidents and therefore is not in the public interest. accidents andthereforeisnotinthepublicinterest. fluence in an investigation damages our ability to prevent future Criminalization of accidents or, for that matter, overt political in- advocate for the universal decriminalization of aviation accidents. organizationsinternationalto aviationother several joined we endorsement, that In policy. public a of endorsement formal first our issuing by this emphasized recently We investigations. prevent futureaccidents. help to is investigation the from gained knowledge the if and ible cred- be to are they if criminalization of free and pressure political threatening thetechnicalintegrityofinvestigation. They also need to be accomplished as quickly as possible, but accurate. without and sound technically be to need indeed Investigations ASIA. or Authentic, Speedy,and Accurate, Independent, tigation: inves- accident any for objectives basic defining of job nice very a agree thatthisyear’s strong. technicalprogramwasvery exception. By the close of the seminar onour annual Thursday,seminar gets better and better. I ISASI thinkSapporo will be youno will presentations. high‑quality of Finally,be investigationsauthentic.toneedbe They to need accident of independence the for advocated always has ISASI Integrity also requires that investigations remain independent of The theme that our Japanese hosts selected for the seminar does ach year the technical program at at program technical the year Each more than accurate; they need to be thorough, with all possibly • The ensuing crash led to “multiple passenger fatalities.” pertinent issues examined, and with the use of all techniques neces- All of this, of course, was wrong. The aircraft was an MD-11, sary to ensure that we fully understand an accident. This is a good not a 747; it was a cargo flight with just two pilots onboard, not prescription for the standards by which we can judge the quality of a passenger flight; it involved a hard and bounced landing with investigations. You will hear multiple presentations this week that no inflight fire; no emergency was declared; and, finally, rather directly address those requirements. than “multiple passenger fatalities,” the only injury was a non- For example, several presentations will address recovery tech- life-threatening injury to the first officer.

nologies and innovative tools and techniques for understanding Though this accident produced an unusual amount of misin- ISASI 2010 PROCEEDINGS what happened and why. Other papers will explore the analysis of formation early on, we often receive wildly inaccurate information operational data and confidential reporting systems that apply the knowledge gained in order to prevent future accidents. Other papers will focus more narrowly on aviation issues, trends, and challenges in Prevention obviously is Asia. I am confident that you will not be disappointed in the topics the reason we investigate nor in the quality of the presentations. In my description of the presentations and the theme of ISASI accidents. Otherwise, our 2010, I mentioned the idea of prevention several times. Prevention investigations would have no point. We will obviously is the reason we investigate accidents. Otherwise, our never reach a level of zero risk, and we investigations would have no point. We will never reach a level of know that although the system continues zero risk and we know that although the system continues to get safer year after year in most of the world, recent experience tells us to get safer year after year in most of the that we still have work to do. world recent experience tells us that we Actually, the recent accident record has been somewhat mixed. still have work to do. In 2009, the world aviation community had the fewest hull losses, by far, in the history of civil aviation. Measured by hull losses, the immediately after an accident, whether the accident occurred in world accident rate in 2009 was 30 percent lower than the previously the United States or elsewhere. best year on record. Yet fatal hull losses rose slightly in 2009, and the The fatal accidents I mentioned here, plus the non-fatal case number of fatalities increased significantly compared to 2008. So, in Riyadh, make two simple points that I always note at ISASI when measured by hull loss rates, 2009 was the safest year ever. Yet, seminars: again, accident investigators still have work to do, and we had more fatal hull losses in 2009 than in 2008, and the number we need to remain professional, with open minds that are not of fatalities exceeded 2008 by more than 200. biased in any way by early reports. This seminar will help all of At this point, 2010 appears to be developing with a similar story. us here to do our jobs just a little bit better. We can expect the number and rate of hull losses to be even lower I will close with my usual recommendation. Please take ad- than in 2009. However the number of fatal hull losses and the vantage of all the knowledge that is in this room. We have real number of fatalities both are likely to be higher than in 2009. By expertise from all over the world on all kinds of aviation and the end of August, we already had Ethiopian Airlines in Beirut with investigative issues. If you want a better understanding of some 82 fatalities, Afriqiyah in Libya with 103 fatalities, Pamir Airways in aircraft system, of an operational issue, of some safety process, Afghanistan with 44 Fatalities, Air India Express with 158 fatalities, or a particular accident, someone in this room can help you. If 12 fatalities on an Antonov 24 in Russia, Airblue near Islamabad with you cannot find the person, we can try to help to find the right 152 fatalities, 42 fatalities in the recent Henan Airlines accident in person to answer your question. Please take advantage of the northeastern China, plus several fatal cargo hull losses that killed knowledge that is all around you, and please share your own almost 20 crewmembers. knowledge with others in this room. We also had a non-fatal hull loss in late July at Riyadh that illus- Finally, enjoy yourself while you are in Sapporo. It really is a trates why everyone in aviation safety needs to be cautious about beautiful city in a beautiful part of Japan. Find some time to walk preliminary information. The early information we received at FAA around the city and consider staying for an extra day or two so on this accident included the following: you can see some of the mountains and parks and so you can • The airplane was a Boeing 747. enjoy the city. • The flight was a scheduled passenger service. Again, my thanks to our Japanese hosts, and I hope and expect • The aircraft had suffered a severe inflight fire. that each of you will help to make this seminar a success. • The flight crew had declared an emergency. Thank you. ◆

ISASI 2010 Proceedings • 5 ISASI 2010 PROCEEDINGS 6

• G serious incident. a or accident an of causes found the and mitigations are addressed based on unfortunately recurs. These preventionsdamage caused by an accident even if it incidentandisalso aiming tomitigate serious a or accident an of recurrence preventaimingtheto BoardJTSB)is tive of ISASI, the Japan Transport Safety vestigation. And together with this objec- pursuing air safety through accident in- ISASI members. We have eight regional offices across Japan: from north to south mode. each in example accident recent a shows 1 Figure rine. lished in1949,intothecurrent system,theJTSB. Japan then the of Portion Finding Cause the with merging by reorganized October 2001. and Railway Accidents Investigation Commission (ARAIC) in serious incidents, and the AAIC eventually became the Aircraft then AAIC to include the investigation of railway accidents and twoserious railway accidents in 1991 and 2000 motivated the 1974. before years several the during occurred collision, midair a including accidents, aircraft serious very of couple a more than because then urged was AAIC the of establishment This 1974. in established was which (AAIC), Commission Investigation Accidents Aircraft the from originated It 2008. on established was JTSB The The JTSB Japan.—Editor) seminar investigation delegates accident on September air 7 2010 in Sapporo,ISASI keynotehisopeningaddressthein Goto to Norihiro Chairman by presented (Remarks the Safety of into function, disciplinary the and finding cause the separating prescribes which Code, Investigation Casualty the adopted ISASI 2010 ISASI It is well known that ISASI is ever is ISASI that known well is It The JTSB deals with three modes—aviation, railway, and ma- International the 2010, January In M note address to our colleagues, colleagues, our to address note honor to be able to deliver a key- my is It everyone. morning ood A JapanTransport SafetyBoard eanwhile,railwayaccidents continuedoccur. to And arine Accident Inquiry Agency, which was estab- was which Agency, Inquiry Accident Marine Proceedings L ife at Sea (S OL AS) Convention. The ARAIC was ct. 1, 1, Oct. Air SafetyView KEYNOTE Address Maritime

ESPERISON Martinez and keynotespeakeratISASI2010. Author Norihiro Goto, chairman, JTSB, By NorihiroGoto,Chairman,JTSB rganization Organization Figure 1.Recentaccidents inJapanthree modes. quite difficult to handle in terms of specialty and field. A particular ous accidents, and there may be some that present investigators find However,vari- specialties. are of there number a with investigators of number a has commission or committee or board investigation among these three duties. That is with regard to the third duty.

other modes. in investigations supply,to logistic as such help, offer to responsibility the have also they but incidents, and accidents marine seen in Figure 2. These regional offices treat Hiroshima, Kobe, Yokohama, Sendai, Hakodate, at working for. There is one problem, though, cancorrelate themwith what each oneis and mean, they what understands here the above-mentionedduties. conducts3. research studiesandfulfill to to mitigatedamagecausedbyaccidents. the recurrence of accidents/incidents and cerning the measures to be taken to prevent to relevant ministers or parties involved con- based on the findings of the investigations, 2. provides recommendations or opinions, caused bytheaccidents. damage and incidents accidents/serious marine and railway, aircraft, of causes the determine to investigations conducts 1. The JTSB Regarding these three duties, everyone everyone duties, three these Regarding oji, Nagasaki, and Naha as as Naha and Nagasaki, Moji,

ach Each Accident Rates 1974–2008 Aircraft with a certificated maximum takeoff mass of more than 5,700kg operated by a Japanese carrier ISASI 2010 PROCEEDINGS

Figure 2. JTSB regional offices.

Figure 4. Domestic accident rates in Japan. specialty is needed sometimes, and at other times especially deep ing on the boundaries that each country has. This is a very professionalism is required to look into the cause of an accident. complicated problem, which continues to be addressed in Every once in a while, we do not find appropriate investigators, or terms of culture and the judicial system of a country. I hope we do not have research facilities capable of a particular analysis. For discussion will take place here regarding this issue. such a case, we have to rely on the cooperation of research institutes and/or universities. In our case, the cooperation of national research Tasks for the institutes is encouraged by law in the phase of tests and research. Causes of Accidents future In addition, we have to pay attention to the attributes that Figure 3 shows accompany a so-called public investigation in order to carry out 1.1 Pilot Error the accident rates those duties. As the NTSB chairman mentioned at the previous Includes pilot incapacitation of the worldwide ISASI meeting in Orlando, Fla., there are three critical attributes: 1.2 Pilot Error (weather related) commercial jet transparency, accountability, and integrity. We want to raise the Pilot error brought about by weather-related fleet from 1959 bar in all three of these important areas. But we also have to phenomena through 2008. Boe- consider the extent to which the bar could be raised, depend- 1.3 Pilot Error (mechanical related) ing compiled these Pilot error brought about by some type of me- statistics for jet air- chanical failure craft heavier than 1.4 Other Human Error 60,000 pounds, Includes air traffic controller errors, improper load- and they do not ing of aircraft, fuel contamination, fuel starvation, include non-fatal and improper maintenance procedure injuries resulting 2 Weather from atmospheric Includes lightning turbulence. You can see that the 3 Mechanical Failure annual accident Includes design flaws and cargo hold/cabin fires rate, accidents 4 Sabotage per million depar- Includes explosive devices, shoot downs, and tures, is converg- hijackings Figure 3. Worldwide accident rates (http://www.boeing.com/ ing to a certain aboutus/govt_ops/reports_white_papers/commercial_jet_airplane_ 5 Other Causes constant. On the accidents_statistical_summary.pdf). Figure 5. Causes of accidents. other hand, Figure

ISASI 2010 Proceedings • 7 ISASI 2010 PROCEEDINGS 8

• be modeledandclassifiedinto threelevelsasseeninFigure6. leading causeofaircraftaccidents. the remains 1.4 through 1.1 from factors human of category our interesttothecausesofaircraft accidents. direct to want we So accidents. aircraft of number absolute the departures theabsolutenumberofaccidentsisincreasing. we take into consideration the tendency for increases in annual both are converging to certain constants. This points out that if for the past 20 years looks the same as the worldwide statistics: ofadifferent treatment of the population, the average trend composed handlingofthesituations. passengers’crews’andfatalitiesandthecalm nobecause of in resulted fortunately accidents These 2007. 20, August on Airport Naha at 737-800 Boeing a of accident fire aircraft the Bombardier-8-402onAirport Kochi at a of accident landing belly the including period, this during have been very fortunate because we’ve had serious accidents aircraft included in Figure 4. It shouldcommercial thebe emphasizedfor 1986that sincewefatalities any been not have turbulence. pounds and include non-fatal injuries resulting from atmospheric Thesestatistics are for commercial aircraft heavier than 2008. 12,700through 1974 for statistics Japanese domestic the shows 4 Figure 6.Hierarchical pilotbehavioralmodel(J.Rasmussen,1986). ISASI 2010 ISASI As a result of J. Rasmussen’s work, pilots’ control behavior can Causes of accidents are diverse as seen in Figure 5. The broad in decrease the be should challenging keep to have we What Although these Japanese statistics looks quite bumpy because JapaneseasfarAs domestic statistics concerned,are there Proceedings M arch 13, 2007, and 2007, 13, arch real exampletotalkaboutthis topic.Take alook atFigure7. a use to like I’d accident. an of causes the out find to countries especially international cooperation and coordination of related tant to an accident investigation: cooperation and coordination, impor topic thatisvery a different to move Now Iwouldliketo Cooperation andcoordination we’d liketodiscussatISASI. one be might question This way? another there Is automation? pilot’s charge. But is this the only way to realize human-centered in operation is disengaged so that the control isto returneda controlto the column or wheel, when aa pilot relevantexerts a control force greater than automatica certain amount control systemthe so-called human-centered of automation. idea the to led conflict This trouble. the with cope Anto action example of this is pilot’s the counteracts AFCS the then working, not is AFCS the situation. situational awareness, the pilot determines acquired howwith the help of tocrew resource management. copeBased on with the and creatively. intellectually more Situational behave to awareness required is is pilot most the important,normally, and it is cannotexpectflight a management computer system workto pilot a which in situation KBB a In required. is (KBB) behavior knowledge-based environments, flight in changes expected equipment, includingcomputersandsensorsonboard. a flight with RBB relies on the normal operation of all the flight cial flightcan be carried out smoothly.But note that thesuccess of If a pilot has trouble with flight systems or experiences un- experiences or systems flight with trouble has pilot a If ne problem a pilot faces in such a situation is that if if that is situation a such in faces pilot a problem One together with engaging the AFCS, a commer correctly, RBB employs pilot a If (RBB). landing phase. and, flare, approach, the at accident an to led which downdraft, and/or turbulence as such effects other of because cessful suc- not was control manual such which trol skillswithinacertainlevel. training in order to keep their manual con- for SBB employ and intentionally AFCSs disengagetimesinterviewsatthey in that planes, for instance, pilots sometimes report effectsasturbulence. But for freight cargo such of because disengaged are (AFCSs) automaticwhich flight incontrol systems takeoffand landing phases or in the phase manualby control, observedandis the in essentiallyrepresentedis SBB(SBB). ior Asanupper level isrule-based behavior in cases been have there that seems It behav- skill-based shows level lowest The - - On board the aircraft were the captain, seven crewmembers, and 157 passengers, including two infants. All evacuated safely, and no one suffered fatal or serious injuries. However, the air-

craft was consumed by fire ISASI 2010 PROCEEDINGS leaving only a part of the airframe intact. The fire started around the No. 2 engine, but because of the wind direction from right to left, the left side of the aircraft suffered the greatest damage. An investigation was started. Because the aircraft was manufactured in the U.S., the operator was Taiwanese, and the accident happened in Japan, the investigation team inevitably had an international make-up, just like many other aircraft accident investigations. Figure 7. An aircraft fire accident, Aug. 20, 2007, Naha, The Aviation Safety Council (ASC) of Taiwan investigators Okinawa, Japan. joined the on-site investigation on the second day, and the U.S. NTSB joined the investigation on the third day. This accident occurred on Aug. 20, 2007, at Naha Airport in As the result of this international investigation, the cause of Okinawa, Japan. China Airlines scheduled Flight 120, a Boeing the accident was determined. A downstop assembly of the slat 737-800, landed at Naha Airport (from Taiwan Taoyuan Interna- deployment mechanism escaped from the aft end of the main tional Airport). Immediately after the engine shut down, fuel that track, falling off to the base of the can. Due to the slat retraction, was leaking from the right wing caught fire and the aircraft was the assembly was pressed against the track can wall, which pro- engulfed in flames. truded into a wing fuel tank, eventually creating a hole through which fuel leaked. This fuel leak was finally ignited by the hot engine exhaust gas. Figure 8 illustrates the probable causes. Contributing to this finding were the knowledge and experience of each of the teams that consisted of the international investigation party. As shown in this example, international cooperation and coordination are very important factors in carrying out a successful investigation. The JTSB is developing such international coordination by signing written agreements with the BEA (France), the ATSB Figure 8. Probable causes (Australia), the KARAIB (Korea), the CAAC-AS (China), the ASC of the fire accident (http:// (Taiwan), and the AAIB (Singapore). We hope that the number www.mlit.go.jp/jtsb/ of countries will increase in the future. eng-air_report/B18616. I hope that through this presentation air safety will be enhanced pdf). further. ◆

ISASI 2010 Proceedings • 9 ISASI 2010 PROCEEDINGS 10 P seminar. I got to talk to him every day. It was an enduring and and enduring an was day.It every him to talk to got seminar.I the at officer Society only the and secretary Society was I ’86 In enough.” be would that hand, his shake to heard the old guys, like I am now, talk about Jerry. I thought, “Just hadthat effectonyou. exciting pointoftheirlives.Jerry the chance to sit and talk to him. remember the time when some students attending a seminar got can I him. met never and Jerry about know don’t room this in recountedsome recipient of the Jerome F. “flew west”atage101in2004. ironmenand forward toNASA andmanned space flight. He His aviation lore stretches back to the time of wooden wings and 1965 and was long recognized as the “Father of Aviation Safety.” in ISASI joined called, be to preferred he as Jerry, techniques. investigation accident air of improvement and development dedicated to enhancing aviation organization safetyan is throughISASI objectives. Society theachieving continuingand tion investiga- accident aviation furthering in excellence technical to contributionslifetime outstanding for Award F.Jerome annual Lederer Award.” give away the coveted Jerry “Thisis the time when we said: Gandio Del Frank President when away dab servedmealnapkinwasa peer respect. The elegantly friendships, and abundant tin-kicking of rekindling ning was filled with gaiety, was no exception. The eve- banquet Sapporo 2010 ISASI the And seminar. the of close the marking banquet awards the of event main the and nar semi- annual Society’s the • ISASI 2010 ISASI “I know, because that’s the way I was touched. Way back in ’82 I In calling ISASI member its presents Society The Jerome F. AwardRecipient Lederer major highlight of of highlight major a is Award Lederer the of resentation Proceedings L ederer Lederer edererlore. Hesaid, “I’m sure many ofyou Lederer Award, President Del Gandio M Award from President Frank DelGandio. Michael Poole, right,acceptstheISASI2010Jerome F. Lederer ichael Poole forward as this year’s Later they said it was the most Mike Poole: 2010 By EsperisonMartinez,ditor, ISASIForum Lederer A unich, Germany,Munich, on how to to how on ICAO within standard international the is and 1986 study. dynamics impact in ISASI to presented was research This several international accidents. as well as 111 Swissair including Canada, in accidents major all on TSB the of behalf on chairman Group Recorder Flight the head of the flight recorder and performancelast laboratory. 15 years of his He career was at the TSB, he developed and standingwas the of the issues involved with flight data analysis.under better a to contributed Foraccomplishments his Board, the the at years his During Canada. Transportationof the Board Safety with years 20 than more for worked and 1977 in investigation of flight data analysis. He started his career in the field of field accident the in expert an as internationally recognized is and with Michael’s background. to and with a broad smile said, “It is my pleasure to introduce you Poole, amemberoftheCanadianSociety. of selection with ended process review The Braden. “Mike was the researcher and author of the light bulb filament pilot’scurrent a with engineer professional a is “Mike license Del Gandio then turned to the recipient standing by his side M ichaelPoole,our ward L edererAwardwinner.” continuedHe

mittee, chaired by Gail Gail by chaired mittee, Com- Award 12-member the by consideration for tions garnered five entries nomina- 2010 the that President Del Gandio said kiss.” Sheobliged. say, “I would rather have a overhear funsterever to the only plaque, a Jerry presented seminar, ciety So - a at speaking Blakey, FAA Administrator then when time the ing with “Jerry” stories, includ- to regale the dinner group alive.” still was he suremake to month,foracalled I him didn’tIhimfromhear if often.And calledme He connection. everlasting Remembrances over,Remembrances continuedGandioDel ichael Michael M arion - analyze light bulb turer all used the same flight data analysis software supplied filaments to deter- by Mike’s company, significantly improving the investigation mine if they were on progress and trust. Mike assisted several countries with the or off during impact development of their lab capabilities both from when he was at forces. He then shift- the TSB and in the private sector. He has represented Canada ed gears to flight at ICAO on the FLIREC (Flight Recorder Panel) where he recorders and was succeeded in establishing FOQA as an ICAO standard. He has

responsible for ini- also represented the TSB at EUROCAE for international flight ISASI 2010 PROCEEDINGS tiating and driving recorder standards. the development of “Mike is a long-time member of ISASI and has presented the Recovery Analy- papers at many seminars. He is a long-time friend of mine and sis and Presentation System (RAPS) for

t ine z flight data analysis “Mike’s innovative and unique in his early days at approach to using software to decode the TSB. the black box instead of relying on

OS: ESPERISON Ma r “Mike’s innova- T

PHO tive and unique the recorder manufacturer’s interface approach to using was the first system in the world that software to decode the black box instead of relying on the recorder manufacturer’s interface was the first system in the world that en- enabled investigators to accurately abled investigators to accurately recover data dropouts. In 1986, recover data dropouts. In 1986, he he became the first person worldwide to use flight data to develop an interactive 3-D flight animation on a mini-computer. He was a became the first person worldwide to leader in the use of animation systems and the ethics of how they use flight data to develop an interactive should be used objectively so as not to be misleading since ‘seeing is believing.’ 3-D flight animation on a mini- “The software developed under his leadership was used to recover computer. He was a leader in the use data on Tornados for the German Air Force in 1989 as prior to of animation systems and the ethics this data were lost every time the aircraft executed a high ‘g’ turn. This technology was also used for the first time on a major civil ac- of how they should be used objectively cident—1991 Bangalore, India A320—to recover data initially lost so as not to be misleading since during the first impact. This radically changed the outcome of the investigation as the investigators initially suspected engines to be a ‘seeing is believing.’” factor, which was subsequently discounted when the missing data were recovered. He was also a pioneer in applying digital audio of this organization. Mike, it is my great pleasure to present you analysis techniques to cockpit voice recordings. the 2010 ISASI Jerry Lederer Award. Congratulations!” “Ever creative in business solutions, Mike created a ‘specific pur- When the thunderous applause had quieted, Poole, standing at pose account’ in Canada whereby Germany, the U.S., France, and the lectern, looked out at the audience and said, “This is indeed a Australia contributed to co-fund the development of the unique TSB surprise and an honor.” He then looked down at his tropical stark software replay system culminating in international collaboration white linen vested suit and said, I want to start off by explaining on the software development and its eventual commercialization why I am dressed like this! He went on, “I wasn’t planning on to Flightscape in late 2001 to enable other countries to use the being here. I was on my way to Nigeria….” He, of course, was TSB technology. Mike was a co-founder of Flightscape and is a now unaware that he had been selected to receive the Lederer Award. a member of the executive management team at CAE Flightscape, But Barbara Dunn, president of the Canadian Society, knew and after CAE acquired Flightscape in August 2007. when she discovered he was going elsewhere on a business trip “The Flash Air accident in Egypt was the first accident in history she e-mailed him this message: “You have to come. You have to in which the state of occurrence (investigating authority), state come. You HAVE to come.” But she didn’t tell him why. of manufacturer, state of passengers, and the aircraft manufac- Mike, always independent minded, ignored her plea and

ISASI 2010 Proceedings • 11 ISASI 2010 PROCEEDINGS 12 y father was a fighter pilot, pilot, fighter a was father “My said: He aviation? into get I did suit was explained, packing for very hot weather in Nigeria. him. Thus he had not packed a traditional business suit, instead coming to Japan after all.” But he still did not know what awaited inSapporo. manofthe AIB, Dr. Sam France, he discovered the person he was to meet in In Nigeria meetings. (chair informal some for France via Nigeria for headed • ISASI 2010 ISASI spread over any three nominees. When there are3is worth three1point. orThus, moreeach member’s vote is worth 9points number and points, 3 worth is 2 number points, 5 worth is vote on theballot. vote for three nominees by placing to them reminding member each ato letter cover 1,a and criteria, 2, or 3 beside their name along with a ballot listing each nominee, a copy of the selection it mail then I consideration. 3rd or 2nd, 1st, a is it if indicating it to notation a add and letter each copy I closes, season nating Six are from the and makeitacceptable. letter the rewrite often will tor nomina the Award, the of focus gation activity. After explaining that accident investigation is the investi- accident of degree any discuss to fail letters rejected the nominator and explain the reason for the rejection. respondthe torejectI it,I criteria rejectIf acceptit. andor submit nominees. to opportunity the of membership the reminds he Forum, the is also available on the ISASI website. From time to time, through procedure in the March January- issue of the ISASI Forum, which consideration now and to watch for the nomination submission prestigious Award. He urges members to begin their nomination hope that it will entice a greater number of nominations for the goes throughMay31ofanygivenyear. period,which begins with the close of the annual seminar and that begin with an early announcement of the open nomination The selection task is not taken lightly Braden. Gale by chaired Committee, Awards ISASI member 12 and involves multiple steps of a thorough consideration of a nominee’s experiencesPresentation of bythe Jerome F. the “The votes are weighted in the following manner, a number 1 “Our Committee consists of 12 members, including the chair. “WhenI receive a nomination letter, I evaluate it against the ChairmanBradensharesselectionthe process thestepsin M Proceedings ikecontacted Dunn and said, “It looks like Iam Mike answered the proverbial question: How USA and six are international. When the nomi- O duselu)wanted toalso goto ISASI Lederer Award is the culmination Lederer AwardSelectionProcessLederer Once the white tropical ost often Most often - ceeded to advance the throttle and then came that magic moment pro- then He be?’ it can hard How sun). the see could (we miles million 93 is visibility light, are winds ‘the him fly.’ to to said how I to him and I asked, ‘Are you going to fly it?’ He said, ‘I don’t know parking lot. I couldn’t believe it—it was just amazing. I started talking a young man who was taxiing a radio-controlled airplane around the in extractsfromhisacceptancespeech: and it’s in the blood.” Then he added the real story, which follows “When I was about 15 years old…, I was in a school yard and met The • responsible.) ments,it is often- develop difficult many of to determine case (in an individual nominated group who is associated or could beappliedtotheaviationfield. that one endeavor, safety of field another from if or safety, Selection• members follows: andallowedthemultiplepresentations.” ties weredeserving which a tie vote occurred, the president determined both par prerogative of casting a tie-breaking vote. In both instances in nees, a tie can occur. In suchnominees, a tie is almost impossible; but with only two nomi- cases, the ISASI president has the In • creed, sex,orraceshallnotbeconsidered. popularity.of Nationality,lack of because eliminated be not standing among peers shall be considered. A nominee shall the duration and persistence of his (her) efforts, and his (her) accident investigation. The nominee’s manner of operating, shouldconsideredbe foranyoutstanding contributions to administrativetopotherstheandatnot researchor levels requirements. duty normal beyond on original and remarkable contribution and personal effort The • own initiative.Theseeffortsmaybemultifaceted. his (her) efforts to safety and accident investigation on his (her) in working beyond the requirements of his (her) job to direct investigation is a guiding criteria, such as his (her) imagination has improvedaccidentinvestigation.◆ it as long so origin recent of be not need contribution The fective manner of pursuing accident investigation objectives. ef- particularly a from stem may and area investigative the to Advancement should be clearly attributable to the person Committee by used selection for criteria scoring The general,

dedication contributions

of the

award contribution of

the should

recipient:

nominee have should

Emphasis to relatively

safety be echanics, engineers, engineers, Mechanics, important

and

broad should aircraft application

to be

accident aviation

placed -

when an airplane takes off. I say a ‘moment’ because it literally was a ‘moment’ as 8 seconds later we had what is called in our industry Past Lederer Award Winners a major hull loss! I got my first taste of accident investigation due to this accident. I was the investigator, I was the primary witness, and 1977: Samuel M. Phillips as it turns out, I was also a primary cause, having persuaded him to 1978: Allen R. McMahan fly when he should not have!” 1979: Gerard M. Bruggink His interest never waned. His college years were dedicated to aero- 1980: John Gilbert Boulding space engineering study and an internship with the Canadian Avia- 1981: Dr. S. Harry Robertson ISASI 2010 PROCEEDINGS tion Safety Bureau. The internship didn’t come easy, and it wasn’t 1982: C.H. Prater Houge glamorous. “But I got exposed to many cool things. One of them 1983: C.O. Miller 1984: George B. Parker Mike received a standing ovation and 1985: Dr. John Kenyon Mason 1986: Geoffrey C. Wilkinson enjoyed the personal thanks that 1987: Dr. Carol A. Roberts followed from the many people who 1988: H. Vincent LaChapelle 1989: Aage A. Roed have had the pleasure of his friendship 1990: Olof Fritsch over the years. 1991: Eddie J. Trimble 1992: Paul R. Powers was the ground work in light bulb filament study.”U nbeknownst to 1993: Capt. Victor Hewes him, that exposure was his career grail. 1994: U.K. Aircraft Accidents Investigation Branch Down that career road, the exposure led to winning a light bulb 1995: Dr. John K. Lauber filament impact study contract that required heavy research looking 1996: Burt Chesterfield at light bulb filaments with a scanning electron microscope. That 1997: Gus Economy work led to development of a paper presented at an ISASI seminar 1998: A. Frank Taylor in the mid 80s. The subject created a lot of interest and he caught 1999: Capt. James A. McIntyre the attention of the then executive director of the Canadian Avia- 2000: Nora C. Marshal tion Safety Bureau (now the TSB) who was at the ISASI meeting 2001: John W. Purvis and The Transportation where Mike presented. “Before I left for the ISASI conference, I Safety Board of Canada asked about a job at the Bureau, but I was told that it didn’t look 2002: Ronald L. Schleede too good—hiring freezes. When I got back home, I had a letter that 2003: Caj Frostell told me I won a competition, which I never remember applying for, 2004: Ron Chippindale and that was the start of my TSB career.” And that opened the doors 2005: John D. Rawson to all his achievements and outstanding service to aviation that was 2006 : Richard H. Wood outlined by President Del Gandio. 2007: Thomas McCarthy Mike also spoke to his association with ISASI: “In 1985 in Phoenix, 2008: C. Donald Bateman my first ISASI, I was 25 years old and what did I see: I saw an oppor- 2009: Capt. Richard B. Stone tunity to learn from a lot of experts. I saw an opportunity to hear 2009: Australian Transport Safety Bureau a lot of diverse views. And I saw a truly multicultural, international organization. Mostly, I saw a community that I wanted to be part of. Since ’85 I think I have missed maybe four seminars. Many people has given me a very valuable and broad perspective, and ISASI in aviation are really dedicated, and that’s what I really like about has significantly influenced the way I think professionally and in ISASI. ISASI exemplifies this quality.” my personal life. For that, I’m very thankful…. I stand before you Throughout his shared recollections, Mike kept his narrative light, wiser and older. But it’s about you, the members of ISASI whom causing eruptions of laughter at some of his more humorous descrip- I deeply respect. Having received this award from my peers and tions, especially when he took a few moments to poke fun at some of colleagues is quite rewarding. I do thank you very much.” the highlights of the seminar. But he also had his serious moments, Mike received a standing ovation and enjoyed the personal such as when he spoke of his award. “It’s a great honor, but it also thanks that followed from the many people who have had the means I’m getting older and I would like to think wiser. Maturity pleasure of his friendship over the years. ◆

ISASI 2010 Proceedings • 13 ISASI 2010 PROCEEDINGS 14 investiga- Safety correct. and precise, exact, are synonyms its and truth, or fact to conforming error, from free means “Accurate” 1. “Accurate” is the key to a successfulDiscussion investigation investigation activities. our and interpretation my on based investigation authentic the on perspective my community the in colleagues with share to like the recommendations will be just like shooting at random. I would difficult challenges most isthe of one and howinvestigation, the of soul tothe is authentic the find or access the rootAuthentic.” causes,and pendent, otherwise in ASIA “Investigating seminar year bearscertain features investigation that havesuccessful been A hinted it. bythe theme achieve ofthiscan we how and means tion investiga- successful a what myself ask I Sometimes event. an from recommendations based on causes or contributingmission is to promote aviation safety by way of factorsproviding preventive revealed as the aviation safety investigators we all clearly understand that our but features, unique own its has and different is event unsafe Each Introduction investigation andwaysofdoingso. with colleagues in the community my perspective on the authentic just by chance or by luck. In my presentation I would like tothat the shareauthentic investigation is very hard and sometimes is made the attitude toward cooperation. We have examples demonstrating technology,and knowledge, the mainly are constraints the which of investigation, authentic the getting from us hinder that tations cases. to aviation safety. However, there are still some other undetermined We have successful investigations,investigator.safety the for issue tough a still is goal that whichachieve we in turn make contributions Therefore, the “authentic” is the soul of investigation. But how can investigation. after adopted remedies related or cause-targeted prevention is of way best the and event, similar the of occurrence re- prevent to is investigation safety the of purpose ultimate The Abstract University, earnedin2005. holds amastersdegree inpublicadministrationfrom ShanghaiJiaotong University withamajorincomputertechnologyapplication.Healso major in avionics and in 2000 from Shanghai No. 2 Polytechnic • ISASI 2010 ISASI My investigation practices told me that we do have some limi- How Can We Have an Authentic from theCivilAviation UniversityofChinawitha of incident investigations. He was graduated in 1982number of major accident investigations and hundredsfor more than13years,andhasparticipatedina HehasbeenanaccidentinvestigatorofCAAC CAAC. Office of the East China Regional Administration of Guo Fu isthedeputydirector oftheAviation Safety Proceedings By GuoFu,DeputyDirector, Aviation SafetyOffice,EastChinaRegionalAdministration, y investigation practices tell me that that me tell practices investigation My ind–Accurate, Speedy,Mind–Accurate, Inde- Investigation? Civil Aviation Administration, China

laboratory investigation as well. Technical expertise will bring the the bring will Technicalexpertise well. as investigation laboratory and field for equipment suitable the but investigation, for tise exper the have to investigators the requires only not preparation conduct a successful investigation if not technically never technologically.Wecould complicated and advanced prepared.more The technologiesare wide applied inour new aircraft and itbecomes ive elements to an accurate investigation. Nowadays the state-of-art comprehensive abilitieswillmaketheinvestigationaccurate. an investigator must have. His or her experience, analytical skills, and “never follow a ‘hear-say’ without checking” shows an important trait it intherunwayvicinity. verified and video the in runway the on moving aircraft other with comparing after flashes light strobe wingtip the was “fire” the that the engine” only appeared at a constant interval, and finally realized the low pixel of the camera, but they still could find that the “fireon very small due to the distance from the runway tothe scene. He told me thelater that the accident aircraft in the monitor video is and with it checked and assistant, his with carefully video the reviewed investigation. We then arranged a senior investigatorthat towe couldcheck. never He narrow our attention at the early stage of the the playback of the video themselves, watched they after engines the on focus should butwe that suggested one didn’t agree and said got popular within the investigation quickly story Their crashed. it before team.exploded have might engine Some of the investigators gatorsthatthey sawfire one engineon before crashed,it theor investi- our of some told they and flight, accident the of segment accident,the airport staff screened recorded video and found therunway.the on aircraft accident the of ment the after Immediately move- the recorded had cameras security airport The Shanghai. theinvestigation. toperform traits andexperiencenecessary the analytic abilities for in-depthQualified means he or she has both the technical competence and investigation; he or etc. aircraft, shethe of knowledge self-protection, on-scene collection, has personal evidence of means procedures, investigative including vestigation, in- the for knowledge necessary the mastered has she or he means willfinally determine the quality of the investigation. qualification Their investigation. accurate Well-trainedthe of component sible investigation, andsometimesluck. technical expertise and appropriate the equipment,following components: well trained and qualified investigators, attitude toward the the root causes of an event. The accurate investigation depends on identify accurately can we if effective surely be will prevention the and target-oriented, and precise more be will recommendations butpreventing reoccurrence as well. investigation. It is not merely the need for understanding the causes our in first things first the as event an of causes put always will tors Technical expertise and appropriate equipment are the support- Thespirit“never of letanytrace withoutgo questioning” and An accident occurred to a foreign cargo flight last November in Well-trained and qualified investigators are the first and indispen- O urfollow-up remedies and

- couldn’t find any evidence from the CVR since it didn’t have any recording track for the main rotor speed and furthermore it didn’t work at the accident flight. There are 25 security cameras on the ship, of which 3 cameras have recorded different phases of the accident flight from helicopter liftoff to falling into water in different positions. One video clip shows the whole process of the main rotor rotation from blade starting to turn to the helicopter leaving the deck. Our lab staff used his machine and software to count the number of blades within each frame at a fixed time frame, a special algorithm to calculate the blade rotational speed. His research precisely revealed the main rotor speeds at takeoff phase, 2010 7, SEPT. TUESDAY, and it reduced to below the underspeed aural warning threshold just 2 seconds after liftoff Diagram 1: Main rotor speed chart of the accident flight based on security video from the deck, which means what the captain camera recording. heard is an underspeed warning rather than overspeed (see Diagram 1). investigator’s knowledge, experience, and insightful judgment into We have reasons to believe that expertise equipped with technol- the investigation in a qualitative approach while the equipments ogy and suitable equipment will be a great assistance to the investiga- will assist the investigators through a quantitative method that will tion in revealing or accessing the causes in an accurate way. provide with accurate measurement. The integration of the qualita- Attitude toward the investigation means the attitude of individuals, tive and quantitative methods will make the in-depth and accurate organizations, or authorities involved toward the investigation, which investigation a reality. is another important factor concerning the accurate investigation. On April 12, 2009, a helicopter on a ferry flight crashed into The attitude varies sometimes in the investigation even though the water immediately after lifting off from a ship deck. The survival standards2 in Annex 13 have clearly stated the responsibilities of captain told us that he heard an aural warning of the engine over- related the State to provide relevant information. speed during his maneuver approach to the portside of the ship, I once experienced an unwillingness to cooperate in our investiga- and then the helicopter descend into water no matter how hard he tion. It was a cargo crash accident; it’s my first participation (1999) had lifted his collective level. Theoretically speaking, the scenario in the major accident investigation. The only recorded information described by the captain was not correct, and we know that the theory we had collected were CVR, air-ground communication, and radar can disprove his explanation. But it will be better if we can collect plot. We soon got the transcriptions of CVR and air-ground com- physical evidence to prove the theory in this accident. We should munication, but had difficulty making a complete trajectory chart have gotten main rotor speed from the CVR because our regulation of the accident flight due to our technical incompetence to retrieve requires that helicopters shall at least record main rotor speed on all the data recorded in radar. We know that the radar should have one track of the CVR1 if the FDR is not equipped. The investigation recorded some other points of the accident flight according to the flight time and radar rotation. We contacted with the representatives of radar manufacture in Shanghai for their assistance. They at first refused to provide the software to download the raw data from the radar by a number of excuses. With the help of the investigation authorities and several contacts, the manufacturer finally offered a means (special software) of extracting the data and told us that the radar had recorded two other targets of the accident flight but did not show on the plot for it took them as false data due to high descent rate at the time of recording though it still kept them in the memory. We could accurately make the complete chart at last (see Diagram 2). Coordination difficulties in some of our investigations left cases unclosed—those are rare though compared to what we have Diagram 2: Accident flight trajectory chart from second surveillance radar. finished, which reflected the consequence of

ISASI 2010 Proceedings • 15 ISASI 2010 PROCEEDINGS 16 what believed never nearby.He were vehicles emergency the why runway and asked copilot why he put his hand on the throttles and regainedhis consciousness soon after the aircraft returned tothe the runway from the side and then back to the runway. The captain before touchdown), then the aircraft touched down and veered off stinct (the FDR revealed the copilot control input at 38 ft, 2 seconds synchronizer.in- by left the toward stick the back pulled hardly He abnormalan highdescent ratejustafter“100” called wasthe by alerted, the copilot felt the aircraft had dipped toward his side with instruction was given by the captain after an aural “minimum”phasestheflightof were uneventfulwas except landing. “landing” A landing. It concerned a modern jumbo jet passenger flight, and all pedal hadn’t been found. of snap off could be heard if the captain hadn’t survived and/or the never tell what had happened from the CVR though a weak sound could You control. quality and processing, design, by caused was ship.Further investigation the on containers top disclosed the of thatone ruptureon pedal ofrudder the left left the pedal found rescuehelicopter.himself,a savedtobywas and Fortunately we came he water the in was It afterwards. happened what remember floor,the couldn’t through he went foot left his after immediately spun fiercely and right to quickly turned helicopter His tainers. con- the above lift to maneuver his during floor deck flight the to survived that accident, and he told me that his left foot went straight ship. container outgoing an from pilots marine the up pick to mission its during water into crash to helicopter the events. reviewed alltherecordings. hadn’t we thoroughly if accident the of causes the find to luck the if we hadn’t carefully searched the ship deck, and we wouldn’t have with the security cameras. We wouldn’t find the luck in the cameras mation containing the accident process if by thethe cameras. We shipcouldn’t have the luck wasn’tto get all the video infor equipped passenger compartment overloaded condition were revealed as well and hover without liftoff the of process whole the but case, water rotorrotation was recorded in the previous helicopter falling ample of intothe lucky investigation. The luck is that not only the main outcome ofanoccurrencemakesyourinvestigationeasier. evidencechance.”“by Sometimes luckyareyoujustbecause the find to luck the have will you conscientious and observant are you if and expertise, technical and knowledge her his/ to addition in one’s analytic skills, comprehensive judgment ability, and experience event. It’s not a windfall, but the capability that is dependent upon or evidence and make your “luck” to find or access the causes of an playing the slot while machine,777 have to enough lucky are butyou that mean doesn’tit it and does mean you never let slip any clue don’t knowatwhattimeitwillappearagain. sequently you will neverCon- knowyou. give howothers what toaccept preventor take to fromhave you repeating,Sometimes and are all satisfactory, you just don’t understand the failure mechanism. and the post-event mechanical and functional examination and test issues, systems control software-related like failure non-traditional problem is that when some thing occurred, mainly those concerning requirementsand standards to investigate an occurrence; own its has nation but each thethat We understand attitude. negative the Another “lucky” investigation is about pilot incapacitation at at incapacitation pilot about is investigation “lucky” Another “lucky”investigationstwoother The consequence-related are ex- an is ship the on camera security the with investigation The Here “luck” has nothing to do with the lucky numbers for lottery, • ISASI 2010 ISASI ne is a general aviation accident in 2005, which caused caused which 2005, in accident aviation general a is One Proceedings nly the captain captain the Only - any stage of the investigation the of stage any recommendations ifsomethingisfoundobviouslysafetyrelated at 26 hours. through went it before time elapsed its aircraft another on DFDR couldhavereestablished thescenario easily hadweifgotten the in this case it is not as important as the causes of the incident. We by the crew and “stop takeoff” instruction by the controller, though still couldn’t exactly describe the sequence of abort action initiated on different airplanes. We used available recorded information but sequence according event to the statements precise a from reconstruct controllers hardly and could pilots We radar. surveillance aircraft, air-ground communication record, and ground movement roll. We only seized the FDR, the CVR from the intruder (foreign) airport, which caused an abort of another aircraft during Pudong its Shanghai takeoff in airline foreign a to occurred incursion way memory, etc. people’s or information, recorded systems, aircraft the from fluids grassland, or ground the on left marks the instance, For ronment. those that will perish quickly or easily with time or in a certain envi- delay,especially any without examination lab the in or there, still is memory fresh the while interview eyewitness including search investigation,we will collect and secure any evidence in the scene actioncollectto anytraceable evidence allbymeans. During the definitions. dictionary investigator’s safety a from point meanings of view, different three which with mayvary “speedy” from the interpret conventional I 2. “Speedy” reflects efficiency of the investigation tainty. uncer including factors some by affected easily be can but success but wewillneverrefuse“luck”whenitcomestohelpus. some way. period of time. We have to admit sometimes that luck will help us in if his incapacitation was at high altitude and recovered within a short wouldn’t know the captain has a tiny insula cavernous hemangioma happened if the copilot didn’t history of hypertension for 5 years. We pullmight never know what had the stick and the cavernous hemangioma. aircraftHis medical record revealed that he had a crash. We ing from a petit mal epilepsy (absence seizure) due to a tiny insula at low altitude was caused by a transient loss of consciousness result- aminations were conducted and found the captain’s incapacitation ex- medical thorough and careful Several copilot. the not himself the copilot told him and was 100% sure that he landed the aircraft even for the incidents due to workload. We investigate incidents in as well as ourselves but public, superiors, the from only not report final early an for sometimes pressures have still Actually,we time. our of waste will we imply doesn’t that But understood. gradually acase. Safety investigations are time-consuming activities; doesn’tthey are mean wewill jump tothe conclusion orhaste towrap up investigation, thoughitisseldomthecaseinourinvestigation. necessarytakenbetopromptly enhanceto aviation safetythe in mind that we in should keep We finished. recommend was investigation our any before preventiveflight accident action considered track for recording the main rotor speed, and it didn’t industry when we found the accident workhelicopter’s CVR atwithout any the The second explanation of “speedy” is to immediately issue safety I learned lessons from an incident investigation. In 2007, a run- Accuracythekeyiselement thatdetermines investigation’san The third interpretation of “speedy” is the efficiency, but this this but efficiency, the is “speedy” of interpretation third The Our investigation can never only wait for or rely on “luck,” y first description of “speedy” is a timely timely a is “speedy” of description first My 3 . We once issued a safety alert to the the to alert safety a issued Weonce . - accordance with the provisions of our regulations and Annex 13, rized department, usually the State Administration of Work Safety which count for the majority of our safety investigation. For us, some (SAWS). SAWS is an affiliated organization of the State Council and incident investigations, such as engine inflight shut down (IFSD), it acts as the executive office of Work Safety Committee of the State will take as long as almost an accident. It’s not about the investiga- Council. One of its major functions is to supervise the national work tion itself, but several other factors will influence the progress.O ne safety and conduct or coordinate investigation into significant major is the priority getting lower as outcomes of new events that need accidents, and major accidents that occurred within the territory our immediate response. The other influencing factor is the coor- of mainland China. As for civil aviation safety investigation, it will dination between the manufacturers, the authorities of the State of mainly investigate Significant major air transport accident, while manufacturer, even the visa application, factors like expertise and CAAC investigates and major air transport accident, accidents, and languages will also count. Incidents. Actually, SAWS has the authority to investigate all the In fact, our investigation revealed most of IFSDs have much to unsafe events, from incident to accident including general aviation do with the design, manufacture and overhaul, certain remedies, accident and ground aviation accident if it has interest. I myself have improvement or redesigns have been adopted by the manufacturers experienced its supervision and involvement in the investigation. after investigation. It could be quickly finished if we completed our SAWS will conduct all types of investigation when it has its own avia- report just by filling out a simple format titled with IFSD without tion sector and enough professionals in the future. So right now we further examination and analysis. The problems won’t be solved if adopt a so-called two-leg investigation system in my point of view. 2010 7, SEPT. TUESDAY, the investigation finished in a hurry. The majority of our investigation is incidents. This year up to Efficiency concerns about the time spent, but what is more the now we have collected, processed and reported 585 unsafe events, quality of output, which means less time with greater accuracy. of which 11 incidents we have investigated, some of them haven’t finished yet. We also investigate so-called typical “other unsafe 3. “Independent4” is the guarantee of an objective investigation events,” which means the unsafe event is not so serious as those The main purpose of an “independent” investigation is to find or of incident but still need our close attention. We have benefited access the causes of an event by means of preventing any interested a lot in improving aviation safety from the incident investigation. parties from interfering or pressure to the most extent during Our safety recommendations are issued not only to the operators, the investigation. Some elements, such as law, organization, and service providers, manufacturers, but also to regulator in terms of investigator’s traits, are the basic requirements for ensuring an regulation revision or strengthening front line oversight. My inves- objective investigation. The independent investigation will be tigation practices tell me that we rarely have outside pressure or legally guaranteed if the relevant rules are set up in law or regula- interference, in fact our investigators enjoy a healthy environment tion. They will dominate and protect the investigative activities and for the investigation in addition to legal protection. We are always people who conduct the investigation. It is better if we can have an told to follow the four principles and stick to the standards by our “independent organization” since it is the carrier of the investiga- superiors. The only pressure we have is the time. tive activities, which is the second layer of protection from external I have two examples for your information. One case is about an interferences. It is the investigators who perform the investigation. incident that occurred to a flight which was far away from the local- They are the decisive factors, and their personal traits have a great izer and below the published minimum safe altitude, and trigged influence over the investigation at last. Independence and integrity the terrain warning during approach. The investigation revealed will act as the third layer of prevention and will further guarantee that the copilot was the PF and he wanted to perform a visual flight the independence of investigation. in good weather. A conflicting traffic made it difficult for him, and We have many rules to follow if we conduct an air safety inves- it was too late for the captain to take the flight. It was an incident tigation in China, which include both international and domestic according to our incident classification. One of my colleagues standards. In addition to Annex 13, provisions of our regulation list received a short message from the captain, asking to downgrade four basic principles that must be abided by if an investigation is the nature of the event to avoid a bad record. We didn’t change conducted. They are Independent: Investigation shall be conducted our judgment, and the conclusion of the event in the final report independently; no any other organization or individual is allowed is classified as an incident. to interfere. Objective: Investigation shall be fact driven, objective, Another case is about one of our inspectors; he is a captain and fair, and scientific and cannot have any intent of subjectivity. De- flies for a cargo airline in our region. He recently encountered tailed: Investigation shall analyze and determine the causes of the a low-altitude windshear event during takeoff, and immediately accident or incident and contributing factors, including any defect reported to us after he returned. Before takeoff the crew found concerning aircraft design, manufacture, operation, maintenance, weather to the right alongside the runway centerline, and two air- personnel training, company’s management policies, and regula- planes, one jumbo and one regional jet, just departed without any tor’s rules and regulations and their implementation. Thorough: weather report. They then decided to takeoff. A “windshear ahead” Investigation shall not only analyze and determine the cause of the warning was displayed and a thunderstorm was detected soon after accident and contributing factors, but also analyze and determine takeoff since the weather was moving toward the runway. To avoid factors that are not directly related the accident but have potential the windshear and the thunderstorm they asked a detour, and then impact to flight safety and related issues. descend from 1,300 ft to 700 ft. We issued a notice to the airline that According to our regulations (National Work Safety Accident the crew member must be treated equally in addition to the safety Report and Investigation, or China Civil Aviation Regulation 395), recommendations. the investigation function is conducted by different organizations “Independence” is the basic guarantee to find the root causes depending on the consequences of an event. To be more specific, without outside manipulating. It is very difficult to have an absolute it is shared between the CAAC and the State Council or its autho- “Independence” due to different national institutions and tradi-

ISASI 2010 Proceedings • 17 ISASI 2010 PROCEEDINGS 18 support will safeguard the investigation conducted in an indepen- “speedy,” and “independent.” The legal protection/the structural is the soul of the investigation, which is on the basis of “accurate,” “authentic” that comprehend may we discussion, above the From Conclusion reasons the of Some sometimes. reoccur does event similar of investigation and further to promote safety. In reality, the same or way by event similar the of recurrence prevent to is saying popular When talking about the purposes of the safety investigation, the most 4. “Authentic” is the soul of the investigation different cornerseventhoughtheyhavethelegalprotection. from influences internally.of investigated kinds all have may They the critical force for an independent investigation if an event will be independent investigation. The investigators who have integrity are as law thethe prerequisite, have shall which we provides that legala is framework thing toprotect important themost The tions. of the investigation. of theinvestigation. and independence, and comprehensively represent them as the soul accuracy,efficiency,on relies mainly “Authentic” investigation. the of value true the shows which “authentic,” is combination their of less time; “independent” relates to finding root causes, and the result “Accurate” means fact, truth, precise; “speedy” implies accuracy with describe the requirements for the investigation from different aspects. understandthat“accurate, speedy, andindependent” areused to thorough;meansit“factual” fromthetheme thisof seminar. We thy of trust. Here I interpret it as data driven, no bias, detailed, and identify hazardsorrootcauses. correctly can we if repeating from event the prevent effectively will Thefirst two reasons are cause-relatedway. motivating more a in issues.others inform It is obviousto Failure 4) that we and causes, the to appropriately act to Failure 3) depth, in causes root identify Failure to recognize and identify the hazards correctly, 2) Failure to Authentic has the meaning of conforming to fact or origin, wor origin, or fact to conforming of meaning the has Authentic • ISASI 2010 ISASI Proceedings 5 are 1) 1) are - extend possible.◆ greatest the people’sto save properties and and environment lives travelling safe a with public the provide finally and system, reliable a industry our make related, or targeted cause remedies or tions recommenda- our make can we then and way, proper a in unsafe event an of causes root the accessing or revealing and hazards will follow the path to a successful investigation through identifying the abilityoffactfindinginadditiontoefficiency. effective prevention; and cooperative with time attitudeless in accuracy greater achieve to order willin accordingly help to promote guarantee the prompt evidence collectioncisely examined andand comprehensively analyzed; thetimely reaction remedywill issuance will ensure that the evidence gathered is carefully reviewed or pre- equippedwith advanced and necessary equipments and facilities conclusions will be objective; well-traineddent environment and away from the andexternal influencequalified so that the investigators adislav 5 L 4 3 2 1 Endnotes

ISASI Forum (July–September 2003); 11-13. Awareness Training, Germany; “Go-Arounds: A Problem for Certain Pilots?” consistent withtheprovisionsofthisAnnex;Annex13. conduct of the investigation and have unrestricted authority over its conduct, theaccidentinvestigationindependence haveTheinauthorityshall 5.4 to enhanceaviationsafety;Annex13. States, any preventive action to that be it taken considers promptly necessary shallrecommendappropriatethe to authorities, includingother thosein orincident investigation authority of the State conducting 6.8the investigationAt any stage of the investigation of an accident or incident, such informationtotheStateconductinginvestigation;Annex13. the accident dent, and which has information pertinent would tonormally have been, theused by an aircraft investigation,prior to an accident or an inci- shall provide available to it; 5.15 Any State, of the which facilities, have or been, services or an accident or an incident, provide5.14 Any State shall, thaton request from Statethe State conducting the withinvestigation of all the relevanttrack oftheCVR;Annex6). information equippedwith anFDR, atleast main rotor speed shall berecorded onone aural environment on the flight deck during flightshall time.be equipped For helicopters with a CVR, the not objective of which iscertificated the recording takeoff of the mass of more than 3 180Similar to kgthat uprequirement in toAnnex and6 (4.3.5.2 includingAll helicopters of a maximum 7 000 kg In so doing, our safety investigation, as part of safety management, Mika (MO4226), Czech Republic, and Thomas Fakoussa O3366), (F A Quarter Century and Still Learning—Lessons From the JAL 123 Accident Investigation By John Purvis (LW3002) and Ron Schleede (WO0736) John Purvis is an internationally recognized expert understandable when trying to establish time lines and recreating in large aircraft accident investigations. He has been scenarios 25 years after the fact with fading memories. in the aviation field for 54 years, concentrating on Throughout the paper we will highlight lessons learned from airplane safety for the last 28. The last 17 years of his our experiences. 2010 7, SEPT. TUESDAY, long Boeing career were spent directing the commercial Part 1 of our paper describes the accident and the investigation, airplane investigation organization, and he led the both the on-site portion and some of the early follow-on work. It will Boeing team during the JAL 123 investigation. He is illustrate the different perspectives that individual professionals and currently an aviation safety consultant. John holds ISASI’s prestigious their respective organizations bring to an accident investigation. Jerome F. Lederer Award for outstanding contributions to technical excel- Part 2 describes issues that affected the investigation process posi- lence in accident investigation. He is an ISASI Fellow, AIAA Distin- tively or negatively. Some issues were technical in nature, some were at guished Lecturer, professional engineer, and a pilot. He is a docent at a personal level, and some involved important institutional challeng- Seattle’s Museum of Flight and a member of its Board of Trustees. es. For example, Japan’s JAAIC (as it was known then) was pushed to its limit, yet the JAAIC did an extraordinary job. The JAAIC also chose Ron Schleede has spent more than 42 years involved to permit the U.S. delegation to participate fully in the investigation, in aviation safety, particularly international accident though ICAO Annex 13 did not require it at the time. This was a brave investigation and prevention. He spent more than 28 decision on the part of the JAAIC, and it is to be commended for it. years with the U.S. NTSB and has worked worldwide Part 3 concludes by emphasizing the importance of building and as a consultant since he retired in July 2000. Before he maintaining relationships and trust. The authors learned, and will retired, Ron was the director of investigations for air at illustrate in this presentation, how building and maintaining relation- the Canadian TSB. He has been a member of ISASI ships can affect the successful outcome of a particular investigation, since 1975 and was named an ISASI Fellow in 2009. He was awarded but also how it can and should influence professional investigators the ISASI Jerome F. Lederer Award in 2002. During most of his career, throughout their careers. Ron specialized in major aircraft accident investigation management and From this point onward the story will be related from John’s per- international aviation safety affairs. He also represented NTSB senior spective, and Ron’s perspective will be noted as indicated. management during the JAL 123 investigation. Background Introduction Twenty-five years ago, on Aug. 12, 1985, a Japan Airlines 747SR-100 This paper is a joint effort between John Purvis and Ron Schleede. (registration JA8119) took off from Haneda on a short internal The authors were the lead investigators into the JAL 123 accident Japan flight to Osaka. It eventually crashed at Osutaka Ridge, in for their respective organizations, the U.S. NTSB for Ron and the mountainous territory approximately 100 km northwest of Tokyo, Boeing Company for John. killing 520 of the 524 occupants. Even though Ron will not be in Sapporo for this presentation, After taking off and during climb out from Haneda, while ap- he contributed to it and reviewed its contents. The contents of proaching 24,000 feet about 12 minutes after takeoff, a loud bang this paper and the associated PowerPoint presentation are primar- was heard on board and the airplane lost cabin pressurization. About ily John’s viewpoints and his responsibility. This presentation will 4 minutes later, the crew reported the airplane to be uncontrollable. focus on the challenges posed by this accident and the personal It continued flying for 32 minutes in phugoid and Dutch roll oscil- lessons learned about the profession of accident investigation, ul- lations with heading and altitude being “controlled” essentially by timately stressing the need to build and maintain relationships. engine thrust. All of the primary hydraulically powered controls So readers will be treated to two perspectives of the investigation. had been disabled. Ron was doing more investigation management, interacting with Ultimately, the primary cause of the accident was determined to the Japanese authorities for the NTSB, while John was often at the be an improperly repaired aft pressure bulkhead in the airplane. accident site or in the labs on behalf of Boeing. They saw things The repair, accomplished by Boeing some 7 years earlier, had in- from different perspectives so their stories, and those of some oth- cluded replacing the lower half of the bulkhead. This necessitated ers, may not always be in perfect harmony. The authors, obviously, splicing the upper and lower bulkhead halves. During the repair, approached events from different angles, especially during the it was found there was inadequate edge margin in which to install early days of the on-scene investigation, and, even today, they do the usual double row of rivets in the connection between the up- not always agree on how the inquiry progressed. This is especially per and lower bulkhead sections. A splice plate insert was deemed

ISASI 2010 Proceedings • 19 ISASI 2010 PROCEEDINGS 20 his subsequentdispatch toJapan.Here ishisperspective: JAL 123,thelinebetweentwo was perhaps somewhatblurred. ample, you need to do that to send the correct experts. In the case of informed decisions based on your best technical knowledge. For ex- head, lestitleadyoutosomepoor judgmentsupfront. your inside speculate not to means also it speculation; of sources open mind. This lesson goes beyond blindly agreeing with current others, definedmycareer. the better part of 2 years of my time and it, along with two or three Japan for 6 weeks out of 7 weeks. This accident ultimately consumed at a time. In the early days, on one pair of back-to-back trips, I was in back and forth across the Pacific, sometimes being away fortraveling still was I later year A Ha! week? A take? investigation this weeks our finally launching. How complicated could it be? How long could talking to, including the NTSB, in those chaotic hours leading up to direction, This was a common opiniontors, including reports amongradioed from the airplane, allpointed us ofin that the people I in wasone of the aft lavatories. The common opinion from early indica- reports that indicated the accident was probably caused by a bomb team toJapanthateveningofAugust12,Seattletime. Boeing the of rest the with myself launched I So that.” done and won’tcut it—you really need tobe able tosay you’ve “been there sitting Just inannually. theaccident onsite officeone least toat “manage”do to orplanned I attendpeers, a periodic ISASI seminar order to lead well, I needed to interact on a level playing field with in that believed firmly I because but job; the on year fourth my in magnitude of the accident was not apparent at the time. I was only not have been launching on an accident as our team leader, but the commercial jet aircraft. In hindsight, as manager, I probably should investigation group. We covered all events that occurred on Boeing At the time of the accident, I was the manager of Boeing’s accident 1:Avoidspeculation. Lesson some ofthe“softer”lessonscanstillbenefittoday’s investigators. but applied, successfully since long been have lessons “technical” today.The applicable still are accident that in learned lessons the terms of fatalities. It holds that tragic distinction even now. Some of airplane directional controlwasessentiallygone. and lost also were systems hydraulic four All lost. were rudder entire the and fin the of half top The open. it splitting fin, vertical the into escaped some and air of volume this for sized not aftpotion of the airplane. The fuselage pressure relief doors the were passenger cabin into the tail of the airplane over-pressurized the eventual rupturingofthebulkhead. and cracking fatigue site multiple to lead rivets of row single this joints had been hidden by sealant material. installed, the incorrect repair could not be detected because all the being After bulkhead.) the of part load-carrying the through went does not indicate a “missing” row of rivets; it says that only one row onlyone row of rivets where two should have existed. (Note: This resulted in a section of the bulkhead splice joint being fastened with the splice plate into the structure, it was cut by the repair team. This to necessary accommodate the short edge margin. In order to “fit” Ron’s recollections begin with his memories of the notification, launch, and However,there is adifference between speculating and making an Keep speculation. Avoid learned: lesson first the is Herein early was accident this lead to choosing for reasons the of One in accident single-airplane world’sworst the be to out turned It Seven years later, this sudden release of the pressurized air from • ISASI 2010 ISASI Proceedings Eventually, the loads in effort—supportthe two-prong a provide to engineers of group a sending was Boeing dispatched, being was team FAA and NTSB the time same the At behalf. our on coordinate to Tokyo in personnel Department information to deal directly with the JAAIC. We relied on our State At that time, the NTSB did not have direct relationships or contact Accident Investigation Commission (JAAIC) with the investigation. small team of NTSB and FAA personnel to assist the Japanese Aircraft .S. team to determine the cause of both accidents. the U.S.teamtodeterminecause ofbothaccidents. may have led to both accidents. This placed tremendous pressure on that 747 Boeing the in flaw airworthiness other or structural generic a of possibility the to attention media news growing was There crash. wreckage recover to from Canada the Air by India conducted aircraft being effort todetermine recovery and thesearch cause ofthe In fact, at the time of the JAL 123 crash, there was a major underwater was strongly suspected in that case; however, it had not been verified. crashed into the Atlantic and flight in up broke 747 India Air an 123, JAL of crash the before Boeing, etc.Moreaboutthismatterlater. and FAA, the NTSB, the from assistance include to JAAIC the by to invite participation. This factor delayed the formation of the team to participate in the investigation and the JAAIC had no obligation aircraft, Annex 13 did not a Japanese-registered apply. Thus, the of flight domestic a was flight 123 JAL the Because accident.” “international an State, another in accident an plied to accidents involving an aircraftparticular accident. The reason for this was that Annex 13 only ap- registered in one State betweenhavingStates during investigations, was“notapplicable” thisto cooperation for procedures as well as investigations, accident tion fies the rights and obligations of States involved in international avia- Chicago Convention was written at the time. Annex 13, which speci the to 13 Annex which in manner the was JAAIC the by assistance the of acceptance the and investigation the in participate to criminal act.Moreaboutthismatterlater. a on focused were they Basically investigation. the approached some degree. It also influenced the manner in which the Japanese to be wrong; however, proved soon itspeculation slowedThat necessary. be thenot responsewould team tion by the investiga- safety traditional the and event terrorist another had we by speculation strong was there occurrence, 123 JAL the surrounding circumstances notification similar involvement. Based on that prior occurrence and the initial or NTSB requiring not event, terrorist a been have to investigators safely and the cause was clearly bomb had determinedexploded in the aft a lavatory area. which byThat in aircraft thehad event landed Airbus JapaneseJAL earlier an involved criminalfactor important factors in play that influenced the its customer, Japan Airlines. 123, we coordinated with the with coordinated we 123, JAL It would have been easy for air safety investigators and their manag- Ron continues: Each accidentisunique.You needtoinvestigate. you intothinkingtheyhave thesamecauses. 2:Don’tLesson let“coincidentallytimed”eventslull The third factor involved was the fact that in April 1985, only months secondfactorA thatcomplicated dispatchthea of several were there dispatch, and notification the of time the At When the NTSB received notification of the accident involving involving accident the of notification received NTSB the When U .S.team led by the NTSB and to respond to Ocean off the coast of Cork, Ireland. Sabotage .S. aviation senior managers that that managers senior aviation U.S. U U.S. .S. team decision-making. mbassy in Tokyoin Embassy a send to U.S. NTSB had no right

U .S. experts to U .S. team.S.

O .S. U.S. ne - ers to “assume” that the two accidents were the result of sabotage evaluate any continuing airworthiness matters that may be involved, and therefore the investigations would be conducted by criminal in accordance with Annex 8. investigators, who operate differently than safety investigators. We Besides Lesson 1 of “don’t speculate,” John learned another early didn’t let that happen with JAL 123; however, this factor did influ- lesson. Some of these lessons are (unfortunately) learned by making ence the manner in which the investigation of JAL 123 was initially mistakes and such was the case in this Lesson 4. conducted by most parties. Basically, the criminal investigators were “in charge,” and this situation hampered the expeditious safety Lesson 4: Be prepared to talk to the news media. investigations. After hearing about the accident in the morning and during a very Because of the above factors, the JAAIC was reluctant to grant busy day, we assembled a team, got our technical material together, access to the accident site by the NTSB team. The lack of “rights” made travel arrangements, got money, went home and packed, and in Annex 13 for the NTSB team to participate and the leadership of made it to SeaTac Airport in Seattle in time for an 11 p.m. departure the investigation by criminal authorities in Japan hampered access on a Northwest Airlines 747 to Tokyo. My Boeing team consisted of to the accident information, including CVR and FDR data, and to five people including me. Our first news media confrontation oc- the wreckage site by the NTSB’s team of experts. Because of this curred at the airport lounge. There was a big disturbance up front situation, high-level diplomatic discussions took place, and I was when a local television crew forced its way in looking for us. The dispatched to Japan to deliver a letter from the chairman of the crew was adamant about talking to us, using the line “the public has 2010 7, SEPT. TUESDAY, NTSB to the chairman of the JAAIC requesting permission to join a right to know.” As the melee ensued, the airline staff helped us the Japanese team to assist with the investigation. The NTSB team’s escape via a back door and allowed us to board early to the sanctu- main theme was its concern about determining if airworthiness ary of the aircraft. factors were involved in the accident, which is an obligation on the So here is Lesson 4: Expect to be pursued by the local members part of the U.S. according to Annex 8, Continuing Airworthiness. of the press and be prepared to talk to them. Unfortunately at the Basically, as the State of Manufacture of the Boeing 747, the U.S. time, I had had no news media training and was woefully unprepared was obligated under Annex 8 to determine if airworthiness matters to deal with the passion and furor this tragic crash had caused. In were involved. preparation for launch, you must take time with your public rela- The U.S. Embassy in Tokyo arranged a meeting between me and tions experts to develop a key statement and have it memorized. If the JAAIC chairman at which I delivered the letter from the NTSB it turns out that you must launch without it, get a local expert to at chairman. We discussed the need for the NTSB team, including FAA least give you a quick briefing and help you prepare a statement, and Boeing experts, to be part of the investigation to assist the JAAIC even over the phone if necessary. Don’t get blindsided by the news in determining the causes and factors involved in the accident for media. Our answer to the news media was to flee—a very bad re- accident prevention purposes. sponse in every way. After lengthy discussions, it was initially agreed that NTSB and Also, avoid putting identifying stickers on your hand-carry lug- FAA government investigators could visit the site; however, they did gage. It only serves to identify you as a target for the press and with not want Boeing experts to be at the site. After we explained the your fellow passengers. It only serves to identify you as a target and need for the expertise of the Boeing engineers, who designed and acts as flags saying, “Talk to me, I’m your guy!” built the airplane, to be on site to identify parts, etc., the chairman agreed to let Boeing personnel accompany the team; however, they Lesson 5: Appreciate cultural differences had to be accompanied at all times by NTSB personnel. The NTSB and learn to apply them. team members would also have to be accompanied by JAAIC inves- Lesson 5 presented itself when our flight arrived in Japan. In those tigators at all times, which was logical and acceptable. The meeting days, the press and news media in Japan seemed to have free reign was adjourned, and the NTSB team members made several trips to of the airport, even airside—that is, where the airplanes land and the accident site, which eventually led to the determination of the the passengers disembark before customs procedures. When the causes of the accident, which was not sabotage. airplane landed in Tokyo, it was parked at a hard stand, away from the gates. Since we were riding first class, we could have exited at Lesson 3: Plan ahead. Work to ensure all any time; but for some reason, we decided to wait until all the other regulations, agreements, MOUs, etc., are in good passengers deplaned. This left us coming down the air stairs alone order and reflect the real world. as a group, an easy and visible target. In hindsight, I should have Ron continues: had the other team members disembark the aircraft one at a time The NTSB, the FAA, and Boeing senior managers should have antici- amongst the other passengers where they could have gotten to the pated the flaw in Annex 13 provisions for domestic flights well before terminal safely. this accident. In fact, there were other similar domestic accidents in Our local technical rep had made arrangements for a private which the State of Manufacture of the airframe was precluded from transport bus to get us to the terminal. participating in on-scene investigations that involved airworthiness We were besieged by the press and news media as soon as we hit matters. As a consequence of the JAL 123 experience and other the ground at the foot of the air stairs. This group was super ag- cases involving aircraft manufacturing States, in 1992, at the ICAO gressive. We got to our “private” bus where we expected to be safe, AIG/92 meeting held in Montreal, Annex 13 was amended to be but the crews forced their way on board, and we made the trip to applicable to all accidents involving aircraft over a specified mass, the terminal with TV camera lenses literally inches from our faces wherever they occurred, whether on domestic or international and questions coming from all directions. With my lack of news flights. These revisions permitted States of Design/Manufacture media training, my reaction was to clam up and say nothing. On to participate in all accidents, domestic or international flights, to TV, I looked scared and dumb as I sat there, in stoic silence. That

ISASI 2010 Proceedings • 21 ISASI 2010 PROCEEDINGS 22 pilot made an autorotation to an emergency landing in a dry creek a red light dealing with the main rotor transmission gearbox. then and light amber an was there first, At difficulties. mechanical The both John Purvis and I were on, the crew began to experience some us. found they before set nearly had accident site, they had difficulty finding the landing site and the sun sion,when the helicopters returned to pick up the team from the and had to return to base to refuel, wasting time. enroute to the accident site became disoriented about the location mountain. the helicopters had to land on a make-shift pad on the side ofwas the not an easy one. Visibility and navigational to aidstransport the wereNTSB team poor,members to the mountain and accident site officials in day, VFR conditions, locally around Tokyo. The mission and were used primarily for VIP transportlearned. The helicopters were ofold Huey’s based in downtown Tokyo wreckage difficultandrequiredmultiplevisitstothesite. ruggednature of the terrain, made progress on documenting the factor,This overnight. mountain the on stuck being avoid the plus an early sunset behind the mountain, the team had to leave early to of because and morning the Tokyoin the area from come to had conditions were difficult at best. The flights carrying the NTSB team tigations stayed at the accident site in makeshiftsearch-and-rescue personnel and perhapstents; some of the JAAIC inves- however, the terrain. rugged extremely in and remote was site accident used team NTSB the transport the NTSB team experts to and from the accident site. Thus, legal or other reasons, the Japanese could not provide assistance to Another factor that hampered the NTSB team was Ron relates: the fact that for transportation. Cheap is not always better.Lesson 6: Be confident in the safety and quality of your get themuptoandbackfromthesite. else’s, anyone to than newer and nicer helicopters, of fleet own its wreckage itself, they were kept away. The news media seemed to have were there They as authorities. we landedon-site the eachby day;well-controlled butwas oncebut wenumbers were at work on the the unwanted intrusions. stopped somehow they and management hotel called I point that the first one, but a minute later another reporter was at the door. At in. were we rooms which learned the door, but outside was a newspaper reporter who had somehow on knock polite a be would There rooms. their in media news the by approached were team my in people the of all rooms, our into However,settling trouble. after further shortly without in checked we got to our hotel, followed by the news media in their own cars, we ing again, but we managed to escape to some waiting minivans. Japanese people. to Boeingandtheaccidentinvestigationcommunity, aswellthe newsmedia training didn’t. I was greata But ready.hindrance, both had and didI disserviceahave I should Japan, in United States would have been quite different from the one required message preparedandmemorizedfortheJapanendoftrip. was another mistake. Regarding the Army helicopter support, there are other lessons newsmediaThealsopresentwasaccidentthe at huge site in Once we got through immigration and customs, the press was wait- the in press the for statement the that here noted be should It • ISASI 2010 ISASI On one occasion a flight of three Proceedings Once again, I should have had a separate key .S. Army helicopters to reach the site. The The site. the reach to helicopters Army U.S. nce again, I declined to talk to to talk to declined I again, Once astly, on a return flight that that flight return a Lastly,on U U.S. Army helicopters .S. military and other On another occa- y lack of of lack My ilitary Military O nce overheat. caused the emergency, when fluid bypassed the filter,overfly one of its routine inspection items and a plugged filter had causing it to was sent to retrieve us. bed in very rugged, mountainous terrain. A replacement helicopter 747s flyingaroundtheworld. Boeing plus 700 the in flaw generic no was there that clear was it completed correctly by Boeing. been not had repair the Thisthat determined quickly was it findingbulkhead, was significant because led to the accident. to determine if the repair had been completed incorrectly and had had been repaired. Therefore, the NTSB team focus was on this area the lower aft fuselage, the APU area, and the aft pressure bulkhead years before that involved a tail strike. Subsequent to the tail strike, incident serious a incurred had aircraft accident the that known became it detail, in empennage and bulkhead pressure aft the wreckage. area. This delayed the NTSB and JAAIC team from examining the three-dimensional color drawings of the entire aft pressure bulkhead swabsto test for bomb residue taking andwere they employedThey wreckage. artists the to make documenting were investigators pressure aft the bulkhead of location during critical the the first at visit not however, to wreckage; the handle site because criminal full control. The safety investigators were in were investigators criminal able the flight, the in toearly off takefallen had pictures and that wreckage and statements survivor of because area suspect the to reach the location of the aft fuselage and empennage, which was When the NTSB team first arrived at the accidentRon continues: site and was able or judicialinvestigation—itchangestherulesdramatically. Lesson 7: Be prepared for the complications of a criminal because of cultural matters and the criminal investigation ongoing, However,members. team JAAIC the to clearly relayed was mation infor that determined, was accident the of cause actual the Once Ron continues: Leaks are inevitable and can hurt your credibility. onthe investigation. public, andthefamiliesup-to-date 9:Beprepared tokeepLesson thenewsmedia, was nil. Although the English language capability and NTSB Japanese language capability dent involved language. At that time, JAAIC personnel had limited Another factor that impacted the investigation of the JAL 123 acci- hire qualifiedtechnicalinterpreters. need to be addressed. Have the ability and fundsLesson to8: Linguistic hurdles can be daunting but support to the JAAIC. support totheJAAIC. technical interpreters to assist its team to enable it to provide better The NTSB should have had the ability and funds to hire qualifiedmembers on scene; however, he did not understand technical terms. assistedwho withinterpretation between JAAICNTSBandteam interpreter,an provide did JAAIC The support. such for allocated funds no had NTSB The meetings. group routine during or scene Embassy provided no support for the NTSB team members while on the JAAIC interpreters during high-level meetings in Tokyo, the It turns out that the Army had permitted the helicopter to to helicopter the permitted had Army the that out turns It Before the NTSB team experts had an opportunity to examine examine to opportunity an had experts team NTSB the Before Once we were able to examine the aft pressure U.S. Embassy provided interpreters to support

.S. U.S. - the factual findings that clearly showed the causes of the accident relationships within your own organization or company. Good re- were not disseminated to the news media by the JAAIC. In accor- lationships foster respect and internal support, qualities you need dance with international protocols (Annex 13), the State conducting to do your job. During this process you may speak at employee the investigation was the only entity that could release the findings meetings, write articles for internal publications, and support off- and progress of the investigation to the news media. The NTSB hour gatherings. pressured for a release of information by the JAAIC, but it was not The important part of all of this is to do it before you need to—by forthcoming. then it is too late. Over the years, Ron and I have collected some of Because of the worldwide concern about the safety of the Boe- the processes and qualities needed to develop and nurture relation- ing 747 fleet and the lack of news releases about the facts by the ships. This list includes the following: JAAIC, the facts eventually were leaked in the U.S. and became • Be a communicator. known around the world. Annex 13 was eventually amended to • Be motivated in your task. allow States participating in investigations to release information • Be a source, not a vacuum; be ready with timely, reliable data to support safety recommendations to prevent future accidents, as whenever you are asked. long as it is coordinated with the State conducting the investigation. • Truly like people and enjoy pleasing them. Annex 13 still prohibits anyone other than the State of Occurrence • Have common sense. conducting the investigation from releasing routine factual findings • Always be yourself (who better than you can do that?). 2010 7, SEPT. TUESDAY, and progress of the investigation. It was clear in this case that the • Be trustworthy, credible, and have integrity (integrity is not NTSB team had information that needed to get out to the world trainable; it is inherent in the person.). and when the JAAIC did not release it in a timely manner, the in- • Be willing to help people. formation was leaked. • Within various cultures you should consider the following: languages are important; have empathy with other cultures; understand Lesson 10: Building and maintaining relationships and multiple cultures and ethnic origins; understand their history, food, trust are key to a successful investigation, especially in current events, politics, and what is in vogue now. countries foreign to your own. Ron and I have worked together many times in the past, teach- Conclusions ing accident investigation management and various other things. Many excellent “technical lessons” were learned during this JAL Whenever we teach or work together on these jobs, one major 123 investigation. Many of them led to significant aviation safety theme permeates our entire presentation. It is that of building and improvements, changes to Annex 13, and revisions to operating maintaining relationships and trust. policies and procedures of many organizations, including the JAAIC, Relationships and trust are absolutely critical to doing a success- the NTSB, Boeing, and ICAO. ful job. Establishing and maintaining them takes work and plan- You may ask: Do technical lessons get learned or applied widely ning. Attending industry meetings, giving papers, leading panels, enough in the industry? Our answer is mot always—we may be able participating in industry working groups, and in general being a to prevent more accidents by doing a better job. friendly, positive, and action-oriented person are some of the ways As Ron points out: to do this. You should plan on making periodic visits to the major For example, the structural repair that led to the loss of control investigative authorities around the world, and especially in your of JAL123 highlighted a design feature that placed all four hydraulic own country. You can never cover all possible scenarios, but having systems in a single location. None of the 747’s four hydraulic systems contacts within the government authorities will pay major dividends were protected by fuses or standpipes. The rupture of the pressure in the long run. bulkhead led to the loss of the aft portion of the vertical fin, which Once the basic contacts are established, be sure to maintain them severed the lines for all hydraulic systems, rendering the airplane by keeping in touch via e-mail, phone, and more visits. If you receive virtually uncontrollable. Those design items were fixed to prevent requests, act on them promptly and positively—be a source, not a a similar accident in the future. vacuum. In other words, get to know as many people as possible in However, a few years later a DC-10 experienced a fan disk sepa- the industry and strive to maintain your friendships. ration that ruptured all three hydraulic systems, and the airplane Include in this process people who may be your commercial eventually crashed on landing at Sioux City. competitors. Remember that when it comes to safety, you need to Similarly, several years later, a China Air Boeing 747 broke up in cooperate. Safety should not have any business barriers. To build flight near Taiwan because of structural damage in the aft fuselage. relationships and trust, especially with government agencies, you That investigation revealed that a tail strike occurrence 20 years must always come across as a safety person or an investigator first, before had severely damaged the lower aft fuselage area, which with company loyalty a distant second. was eventually repaired. The repair was done improperly by the Building relationships does not have to be an expensive process, airline and fatigue occurred, under circumstances not unlike the especially with today’s communications systems. Face-to-face meet- bulkhead situation on JAL 123. A program had been put in place ings are always best, especially during the first contact, but you can to inspect airplanes that had major structural repairs over the past use your travels to meetings, seminars, or training as ways to visit several years to ensure the integrity of the repairs; however, it had these agencies and companies. not been implemented in time to identify the improper repair of Your range of contacts should go from local to international. On the China Air airplane. the local level, get to know your NTSB (or equivalent) or FAA. Also Another thought to ponder is whether “soft” lessons learned consider joining your local or regional ISASI chapter. should be more closely scrutinized and perhaps find their way into In building these relationships, don’t forget about internal reports or some other vehicle of record. Ron and I believe they are

ISASI 2010 Proceedings • 23 ISASI 2010 PROCEEDINGS 24 training, formal of lack and time the at experience of lack my on “soft lessons.” is yes, and this paper is our attempt to document just a few of those lessonsfrom an accident, beyond the technical ones? shortcomingsduringinvestigation.the learnmoreevenweCan own our of some confessed also us of Both 1985. in accident 123 Ron and I have given you a brief look at our involvement in the JAL Summary lead tosmotherandbetterinvestigationsoverall. difficult to discover and document, but they can be useful. They can years and clearly lead to improvedinvestigations. Technicalsafety. lessons have been our Thebread and butter “soft” for lessons arecal ones and the soft ones—can lead to improved safety and better more techni- the lessons—both all of application Better operations. own their improve to investigators current for as well as use, to erations gen- future for available having and documenting worth definitely Perhaps some of my own problems could be justifiably blamed blamed justifiably be could problems own my of some Perhaps • ISASI 2010 ISASI Proceedings O uranswer

in thefuture.◆ productsand the aviation system aswe strive toprevent accidents passengers andcrew. ourheartfelt sympathy thetosurvivors andthetofamilies theof eventually led to this accident. We would like to convey once again 123 25 years ago that we profoundly regret the incorrect repair that saryyear, tosaytothe families ofthose lost inthetragedy ofJA anniver 25th this in like, Together,would event. I the and of Ron time and at this seminar is that last month was the 25th anniversary the samewayabouthisexperience. a key message statement in my head for the news media. Ron feels hour intensive course before departing for Japan. I should have had have had some cultural sensitivity training, even if it had been a one- Japanese people and to the bereaved families was surely one. I should especially onmattersdealingwiththenewsmedia. Our obligation to you is to continue to improve the safety of our O M fcourse, the significance of talking about this accident at this y unintentionaly providinglackof publiccondolences theto L - Leading ‘Just Culture’ Toward Pragmatic Application in Japan By Hiromitsu Mizutani, Member of the Flight Safety Committee, Japan Aircraft Pilot Association, B-767 Captain Hiromitsu Mizutani graduated from the College lenge the persistent problems at that time. of San Mateo in 1984. He holds an FAA ATPL/ • The UK issued the guidelines for SMS in the early 1990s. A&P and JCAB FE. He is currently a captain of • In Canada in 2005, SMS was signed into law. an ANA B-767 and serves as the corporate safety • In 2003, IATA started the IOSA (IATA Operational Safety Audit) auditor of ANA. He is a member of the Aviation program of which criteria is based on ICAO SMS. Safety Committee for the Japan Aircraft Pilot • The U.S. was not using the term SMS; but in 1995, the FAA 2010 7, SEPT. TUESDAY, Association. mandated appointing an accountable safety director for the airline and issued an advisory circular in 2006, which consisted of many Abstract elements of SMS. This paper examines the present condition of so-called “just culture” • In Japan in 2006, SMS was signed into law. in an organization in Japan. According to Dr. Reason (1997), the • In Australia in 2008, SMS was signed into law. components of a safety culture include just, reporting, learning, The reason why I have come to the question of “Has SMS been informed, and flexible cultures. Dr. Reason further describes a “just integrated in our organization yet?” is as follows. I am neither the culture” as an atmosphere of trust in which people are encouraged management pilot nor involved in the management of the com- (even rewarded) for providing essential safety-related information, pany. The present duty at my position is to safely operate B-767 as a but in which they are also clear about where the line must be drawn captain, as well as to perform internal safety audit as an auditor for between acceptable and unacceptable behavior. the company I belong to. In other words, I’m one of the frontline As we all know, the latest approach to mitigate aircraft accidents workers who is in direct contact with daily hazard. and incidents in sophisticated aviation system is the concept of safety Through interviews with my colleagues and the overwhelming management system (hereafter, SMS), which has been introduced in atmosphere which I felt during the internal safety audit, I shall not a state and in an organization all around globe. Here in Japan, SMS say all, but many of the frontline workers either do not know about became law in 2006. SMS shall never be more than just pie in the sky SMS or they may know SMS but they do not feel direct relationship but shall be practically functional for the purpose of proactively pre- between their everyday work and SMS. venting aircraft accidents and incidents. In this sense, “just culture” Effective building of SMS depends on the degree of cultivation of plays a crucial role in terms of positively gathering bare safety-related the “safety culture” in the organization. Assuming my working field information that is provided by the people who are willing to report is still far from understanding the idea of SMS, it can be said that for the sake of aviation safety. Therefore, an intention of this paper the reality of SMS is still in the framework stage, and the priority is is to lead “just culture in Japan” toward the environment in which to gear “safety culture” into the organization. Therefore this paper the practical application of a reporting system which in turn makes is centered the view from a frontline workforce to present what is true integration of SMS possible. the current condition in terms of understanding SMS within the I believe among many components that structures SMS, changing organization, which is based on some interesting surveys conducted someone’s culture, especially the culture like “just culture,” is the by ANA. most time consuming process because it requires people’s trust, and most probably the challenging theme of which many countries are 2. ANA safety culture assessment facing under diversity of cultural issue today. In order to assess the state of “safety culture,” Japanese airline ANA Group has made an interesting effort with a collaboration of “Re- 1. Introduction search Institute for Social Safety (RISS).” “Has SMS been integrated in our organization yet?” Many of you know that ISO9000 QMS has become the prototype for the concept 2-1-1. Purpose of the assessment of SMS. QMS is to ensure certain quality or manufacturing processes ANA Group has adopted this term to express the “corporate culture of the product versus SMS, which manages what is “organizational that gives priority to safety,” and the group companies are striving for tolerance or resistance” from the human errors and environmental safety improvement efforts using it as the key term. However, further changes that may cause an accident or an incident. advancement in these efforts cannot be expected without determin- The safety thinking has evolved its interest from the technical to ing the degree to which the safety culture has been cultivated within human factors and to the organizational factors as ICAO designs the ANA Group. As a measure of knowing the state of achievement the concept of SMS. of these safety efforts in a tangible form, ANA corporate safety and Back in 1984, it was the prototype of SMS, ICAO Accident Preven- audit carried out its first corporate-wide survey using a questionnaire tion Manual has been issued to systematically present the accident on the safety culture (hereinafter, a “safety culture assessment”) in prevention, and many countries had introduced this idea to chal- October 2007 and July 2009.

ISASI 2010 Proceedings • 25 ISASI 2010 PROCEEDINGS 26 Figure 1.Conceptofsafetyculture andquestionnaire-based survey. taking asafety-consciousattitudeandaction. conviction that place primary importance on safety while constantly educating systems,etc.)arefunctioning. and instructing, ordering, systems; execution business structure; checking thefollowingtwopoints. by culture safety the determine indirectly can we but cultivated, sibletodirectly measure thedegree towhich thesafety culture is founded. is Group ANA entire the which on safety principles whilespontaneouslyassumingresponsibility.Group ANA the of conviction the and values the of ment integration of attitude and action taken by everyone toward achieve- The safety culture as applicable to the ANA Group members is the “Definition ofthesafetyculture inANAGroup” ing definitionbasedonthesuggestionofanexpertiseorganization. culture currently existing, ANA Group has decided to adopt the follow- safety of the definition official any Without culture. safety the define to important is it assessment, culture safety a on embarking Before 2-1-3. ANAGroup definitionof“safetyculture” introduced inanefforttocultivatethem. grams for regularly assessing the companies’ safety cultures are being particular, in pro- industries chemical and power nuclear of fields awareness that takes root in the ground of an organization. safety adequate words, other activities—in safety toward employee In the attitudes of the organization’s entire workforce and each individual accidentsgoodaisatmosphere climateaor thatreflects positive is believed to be of major significance in preventing organizational cidents occurring as a result of organization-dwelling problems. What organization systemswhentrackedtotheirrootcauses. als than problems lurking in today’sthat is, more-complex,these cases are less attributable to more-immensesimple mistakes by individu- However, the real causes are most often in organizational systems— and technical hitches were the causes of these accidents and mishaps. making news. At first sight, it would appear that personnel problems power generation, food processing, health care, and other fields are Of late, accidents and mishaps relating to rail transportation, nuclear 2-1-2. Whyisthesafetyculture assessmentisimportant? In the safetytheInculture assessment,questionnaire-based ause we and values share organization an of members the Whether 2. and size (organization elements organizational the well How 1. framework a constitutes culture safety the 1, Figure in shown As ac- describe to used often is accident” “organizational term The • ISASI 2010 ISASI members organization Action of Attitude, and Consciousness Interaction Mutual Proceedings Providing air transportation service Providing airtransportation

Safety Culture Elements Organizational f course it is impos- is it course Of

in tasks not directly related to flight operations and, therefore, therefore, and, operations flight to related directly not tasks in for the ANA Group also covers those employees who are engaged assessment However, culture operations. safety flight the of safety Whenaskedaboutsafety, willyouprobably first think about the 2-1-5. Definitionofsafetyforthepurposesurvey “questions” isshowninFigure2. and “scales,” axes,” “evaluation among relationship The sheets. set “questions” for these scales to be answered on the questionnaire audit has defined a number of “scales” for each evaluation axis and gauges arecalled“evaluationaxe,”whichdetailedinTable 1. rial elements that are all closelyand audit, therefore, relatedsets up gauges representing withthe eight manage- the safety culture. safety corporate ANA marks; bad and good the only with yardstick These safetyculture simplenotsoismeasurablebeto as usingsinglea suresthe safety culture using the questionnaire-based survey. The This section explains the way ANA corporate safety and audit mea- 2-1-4. Measurement ofsafetyculture vanced safetyculture. ad- more a have to organization an for measures plan and system safety the with problems any identified we obtained, results the on Based indirectly. culture safety Group’s ANA the of state current surveyofemployee tocheck the above two points toevaluate the Table 1.Eightaxesofassesssingsafetyculture. In order to measure the safety culture, ANA corporate safety and based survey questionaire- assessed by Contents Safety Culture Cultivation of

below. other than flight operation’s safety as listed questionnairethe mustcoversafety issues against crimeandterrorism). muting). com- while disaster preventing and work hazardous goods). compliance. Aeronautical • Passengers’safety. • Freight • CSR • Informationsecurity. • Foodsafety. • Employees’ • (corporate

safety safety

(safety security social (ensuring

in responsibility)

(protection transporting safety at

in 2009, which showed a 3.9% increase. The data were collected from 41 ANA group companies, which consists of approximately 27,600 employees.

2-2-2. Total score As mentioned before, the answers were rated in five levels from 0 to 100; 0 for “not true at all” to 100 for “particularly true.” The graph below shows the total points for entire employee classification (100 points per axis, total maximum of 800 points for eight axes) has increased by 11.2 points to 534.8 points compared to 523.6 points in 2007. The points of each category increased by the following: CAT A, 17.7 points; CAT B, 20.5 2010 7, SEPT. TUESDAY, points; and CAT C, 9.0 points.

Figure 2. The relationship among evaluation axes, scales, and questions.

2-1-6. Employees classification For the purpose of this questionnaire-based survey, all employees are classified into the following three categories according to their positions in an organization: • Category A (positions relating to overall management of the organization). • Category B (positions that carry what is decided by the Category A into effect). • Category C (all positions other than Categories A and B). There are three different types of questionnaires, each having a set of questions matched to a specific category. 2-2-3. Trend of evaluation axis 2-1-7. Period of the survey As shown in the left bottom cobweb chart, compared to 2007, an al- The questionnaire-based survey was conducted within a one-month most identical trend was apparent and there was no obvious change. period. However, when looking closer, there were statistically significant increases in all evaluation axes except for “Communication.” The 2-1-8. How the questions were answered level of increase in “Resource Management” and “Commitment” There are a total of 42 questions. For each, there is a bar marked axes are particularly significant. with five options including “yes” and “no” and those in between. The right bottom graph indicates the relationship between point And they are rated in five levels from zero to 100; zero for “not true differences (difference between highest and lowest classifications at all” to 100 for “particularly true.” Besides these questions, the of the categories, indicated as “classification gap”) in the 2007 format of the questions also has a blank space for the employee to comparison of every evaluation axis of all classifications and point make free entry of comments and opinions related to safety issues. differences among employee classifications. Including the time for writing these, it takes approximately 15 The evaluation scale is indicated in four levels 1, 2, 3, and 4, with minutes to complete the questionnaire. And those questions are 1 being the best. In the entire ANA Group evaluation. Most evalu- anonymously answered. ation axes were either in the 1 or 2 areas, which can be translated as a relatively good result. 2-1-9. Scope for the assessment Furthermore, by separately analyzing answers to questions other Targeted organizations were ANA and ANA Group airlines. However, to make an effective evaluation, the organization needs to have a minimum number of employees, such as 25 to 30 for Category A, and 250 to 300 for whole group. At the time of the assessment, there were 41 ANA group companies, including seven airlines in ANA Group.

2-2. Result of analysis 2007 and 2009 2-2-1. Response rate The answering rate in the 2007 survey was 78%, and 81.9%

ISASI 2010 Proceedings • 27 ISASI 2010 PROCEEDINGS 28 tion of the safety culture in the organization. And since “Informed ANA group efforts so far have been presented in terms of the cultiva- 2-3-1. Hypothesis which hopetoanswertheexpectations. to assess the level of safety culture in the organization every 2 years, effort an continue will Group ANA state. desirable the toward step gradually will Rather,it overnight. change not will workers 30,000 ture, not just safety culture, of a company group that has more than was no obvious change between the two surveys. The corporate cul- there but observed, trend improvement slight a was there general, In evaluations. 2-2-4 and 2-2-3 on be to considered is 2007 in ment The outcome of the 2-year effort after the first safety culture assess- 2-2-7. Further developingsafety culture related,” “Opinionsfromnon-Japanesecrews,”etc. “Safety related,” “Environment related,” work “Frontline related,” “Communication related,” questions “Survey related,” assessment ment. There were enhance- varieties of safety comments classifiedfor as “Safetyorganization culture the into back fed be to overall) (20.5% collected were opinions free 4,421 of total a Group, ANA 2-2-6. Free opinionson questionnaire points toremainthesame. of communication” at each workplace, which probably causedarenotyetresulting the theinactual feeling “adequateof exchange companies. within departments, among workplaces, and between divisions and people, frontline and management top between interaction and which resultedinthepointincrease. channels gained understanding from the entire company structure, communication various using level management by made ments Education Center), reviewing of turn-around time and safety - invest penetration of safety education conducted by the ASEC (ANA Safety classifications, employee all almost at occurred increase point the edgementsafetyof investment andmanpower positioning. Since the point increase. of causes the be to thought are documents wellasfurtheras developing manuals and ning with “frontline department”plan- activity exercising and Disseminating employees manuals. various of observance and action, safety planning, activity in participation of 1“Commitment” measures the actual level 2-2-5. Analysisoffeatures special featuresofresultsareasfollows. Comparison against the 2007 result and results2007.almostsameThethehadtheas conclusive second safety culture assessment theevaluation andeachaxis, in orscore lyzedevaluation levels (right table) in total ana- the to changes obvious no were There 2-2-4. Evaluation mitment,” therewerenoobviouschanges. “Resource than 3 “Communication” measures the actual level of intercommunion 2 “Resource • ISASI 2010 ISASI Each division is conducting various efforts; however, they Management” measures the actual level of acknowl- ngmn” n “Com- and Management” Proceedings Cobweb chartforCAT A/B/C(2007survey) (Article 1) was revised and the wording became explicit that ensur a result, in ous expert committees to secure public safety ofInfrastructure, Transporttransportation. and Tourism (MLIT) has As established vari- Bureau, Aviation Civil Japan the this, of Because damage to the confidence in public transportation in terms of safety. and airlines involved in many accidents and incidents causing great probably “no.”Let’s lookattheimplementationofS MS inJapan. safetyculture notiscultivated theinorganization? Theanswer is Thequestion is only the above two hypothesis represents that the 2-3-2. Analysisoftwohypotheses organization. thismayalso indicate that organization, “safety the culture” within isnotcultivated workers the inthe between trust requires ing) safety-related information. essential providing for rewarded) (even encouraged are people which in trust of atmosphere an is culture just such—A as preted to Dr. James Reason, a safety culture based on information is inter workers. seen in2007resultthecobwebchartbelow.) identified and criticized.” was lower toward frontline workers (as workplace is not one where employees who have made mistakes are Furthermore, the points for the question “The environment in your to scorelowpoints. incidents and close calls of your own without hesitation” turned out other hand the question “In your workplace, you can report minor mistakes are identified and criticized” scored high points, but on the ment in your workplace is not one where employees who have made and foundaninterestingcontradiction. organization, I have further analyzedculture” plays the a crucial questionnaires role when building an effectiveand S answers ntil 2005, public transport in Japan, such as national railway railway national as such Japan, in transport public 2005, Until Hypothesis 2: Since two-way communication (mutual understand- Secondly, Axis 3 “Communication” scored low points. According Hypothesis1: “Safety culture” has not yet cultivated at frontline The score of these two questions should ideally be synchronized. Firstly, Axis 5 “Learning,” on one hand the question “The environ - October 2006, the purpose of the Civil Aeronautics inistry of Ministry M S in the and, Land, aw Law - - ing the safety of transportation is the first priority over anything hazards, however, the system is applied mechanically. Staff and man- else. Therefore, MLIT and airlines in Japan together introduced agement follow the procedures but do not necessarily believe those SMS under the concept to disclose safety-related information to procedures are critically important to their jobs or the operation. the public. • Proactive: The organization has systems in place to manage haz- In addition ICAO emphasized that SMS shall be understood ards, and staff and management have begun to acquire beliefs that first by top management then to frontline workers. To do so, ANA safety is genuinely worthwhile. issued many company newsletters about SMS, launched a homepage • Generative: Safety behavior is fully integrated into everything regarding safety, established so-called e-learning for employees to be the organization does. The value system associated with safety and able to receive training regarding SMS and risk management, also safe working is system associated with safety and safe working is of ANA carried out an annual event, “Talk Safe,” to discuss any safety invisibility. related issue. However the survey result speaks for itself—fewer On this basis, in order to categorize my working environment, I start- workers understand SMS as it moves toward the frontline. ed out asking the following simple questions to my colleagues. Only 4 years have passed since the first introduction of SMS in • What is safety to you? Japan, and given the conditions that airlines are still trying to pro- • How safe are we? mote understanding of SMS within the organization, my hypothesis • How do you think your organization maintains and promote stated above, “safety culture” is not cultivated in the organization,” safety? 2010 7, SEPT. TUESDAY, is not because of the degree of cultivation of safety culture in the • Do you know anything about the safety management system? organization but because of the promotion of SMS, especially to • What does the safety management system do? the frontline workforce. • Does a safety management system have anything to do with your Once the purpose of SMS is understood by the people working everyday work? at frontline, they will be able to think the reason why the gearing The typical answer was as follows. Answers from flight crews— the just culture is desirable, is not because he/she wants to escape Safety means organizational tolerance, or resistance not to go from responsibility nor to limit the liability of individuals, but rather beyond the limit at which cases an accident or incident. The law/ involved in improving safety by reporting slips/lapses, mistakes, company regulations/standards must be complied as we sharpen our violations, and omissions-type human errors and feel a part of the competency to operate aircraft. However, the exception for those organization in contributing to the safety issue. who engage in IFALPA activities, many of my colleagues either do not know about SMS or know very little about SMS, but even if they 3. “The evolution of safety culture” (case study in Japan) knew about SMS they did not know what it does. Readily find model on the evolution of safety culture was developed A case happened during internal safety audit a few years ago— in collaboration with Leiden University (the Netherlands) Profes- The auditee whose working section is the forefront of flight safety, sor Patrick Hudson and Westrum (Philadelphia). According to the it was a jaw-dropping case. The individual talked about IOSA as model, the evolution of the safety culture seems to be divided into simply filling the check box to meet the requirements. Thus it will five stages as follows; not drastically promote safety. From worst to best: Organizations can be distinguished along a These were the unofficial interviews of those who are around me, line from pathological to generative. thus this answer does not apply to everybody within the organization • Pathological: The organization cares less about safety than about but at least true statement, which means even through SMS was not being caught. introduced to our organization, not many people recognize that • Reactive: The organization looks for fixes to accidents and inci- there is a direct relationship with their work. dents after they happen. The following are cases that occurred in Japan, extracted from • Calculative: The organization has systems in place to manage news clipping for the past few years.

Case 1: In March 2010: The flight crew exceeded the specified value of BAC (blood alcohol content) during the test before the flight. After several attempts, he passed the BAC test but the flight was delayed for 22 minutes.

Case 2: In December 2008: The captain was taking pictures (filming?) landscape during takeoff and landing. As a result, the JCAB suspended his license for 20 days.

Case 3: This happened to me a few years ago at Kansai International Airport. It was a typical calm day and everything went absolutely without a prob- It’s a long way to the top: The evloution of a safety culture. lem. The weather was just fine, and it seemed we

ISASI 2010 Proceedings • 29 ISASI 2010 PROCEEDINGS The • leaves his/herstationforsomereason. 30 Maintenance • the operationalimprovementrecommendationsasfollows. Management Department, which Safety resulted in the the include also to audit special a launched Tourism and to workonaflight. wrong to replace a captain who ordered a sick cabin attendant not and received a written warning. The president admitted that he was and the president for the acts that may threaten the safe operation company canceledthecaptain’s contractonthesameday. Furthermore, despite 2 years remaining on the contract period, the captain was replaced and the flight attendant continued her flight. dent of the airline company came to an intervention. This time the able to perform safety duty on the flight. For this decision, the presi- being not as judged was health) (poor voice lost her because dant atten- flight the replace to ordered captain The 2010; February In Case 4: culative. Cal- of category the into fall cases these thus SMS, of importance S was Itheinternalsafetyauditoratthattime. nor SM about anything know not did I that Note etc. interviews, even if I made a report I did not want to be involved in subsequent and wrong nothing done I’ve since thought I didn’t. I but not, or tower.” information just to confirm. It was then that ATC told us, “Contact because therewasnoothertraffic. wereactive.thelongstilltowaythoughta IBut ATC cleared us wasrather unusual circumstances toclear usfortakeoff while we It takeoff.” Rwy...clearedfor at...knots “Wind...degrees ATCsaying active runway. Approximately halfway down on the parallel, I heard clearance from ground control to taxi via parallel taxiway toward the were the only traffic at that time and ATC was quiet. I received taxi ment of the ABC general aviation company receives the order, and Depart- Sales company.The aviation general ABC to order survey major surveying company (sometimes consultancy)company receives the order to survey.gives The executive authority or a the aerial survey aerial the how is here first, But condition. working his me to confessed bravely pilot, survey aerial as works who friend, My flights. survey aerial in happening case the of example an is This Case 5: fixes toaccidentsandincidentsaftertheyhappen). about not being caught) and Reactive (The organizationbetween Pathological looks(The organization forcares less about safety than to the organization; therefore this falls into the category somewhere Japanese cabincrewduetopoorEnglishproficiency. The • exceeds acertainlevel. Inadequate • demonstrate safetyinstructionbeforetakeoff. M Later that month, the chairman company the of executives top called ministry The In all the cases above, the organizations had already introduced a report make Ishould whether I wondered flight, the After Just prior to entering the active runway, I requested current wind S SM introduced perfunctory has management the case, this In • S a few years ago, but the frontlinethethefeelbutyearsago,workers notfew did a S ISASI 2010 ISASI pilot flight is must required communication is Proceedings required have to a inistry Ministry of wear minimum if the an between oxygen aircraft Land, Infrastructure, Transport, number mask runs non-Japanese of into when flight inistry Ministry ordering turbulence the attendants other pilots pilot that and to

4. Safetycultureonflightdeck als.” (INSAG-4) as well as structural and relates to both organizations and individu- significance.” INSAG-4 also states, “Safety their by warranted attention the receive issues safety plant nuclear culture priority, is overriding both an attitudinal as that, establishes which individuals and following arethedefinitionsforotherindustries. The aviation. in culture” “safety for definition explicit no is There 4-1. Definitionofsafetyculture of generalaviation. aviation company. He added this is the typicalaerial mechanism survey. and fateAnd no flight means noauthority or work,a major surveying company will nonever give the payorder of for ABC general ifABCgeneral aviation company refuses theflight, the executive dination is unsuccessful, there is no way to stop the flights. Because Operation Department does this coordination; but even if the coor control zone, airport traffic area, and training area, etc. The Flight be flown. In many cases this requires coordination with ATC for the should altitude what and where of plan the draws surveyor air the in theirmind.It isthebalancedculture. security a have to justice and fairness of level certain feel to needs To enhance cultivating a safety culture in an organization, workers 4-2. Howdowedealwiththe organization? all levels,donotforgethaving tofalloverit. at people, which in one is culture informed an short, In bypassed. or breached be can defenses system’s the which in ways many the respectandhazardsthe facing their operations alert toare and That is, one in which the members of culture. informed an theto equated be could culture organizationsafe a purposes, understand practical all For environment? an such achieve us makes what But and control systems to produce the way we do things around here. and how things work that interact with an organization’s structures responsibility ofcontributiontowardimprovedsafety.” ofthe ANA group safety principles while spontaneously assuming taken by everyone toward achievement of the values and conviction to the ANA Group members is the integration of attitude and action organization’s healthandsafetymanagement.” determine the commitment to, and the style and proficiency of, an that behavior of patterns and competencies, perceptions, titudes, at- values, group and individual of product “The as culture safety describes which culture, safety of definitions used commonly most must flyinordertokeeptheirbusiness. management personnel of ABC company prefers safety or not, they than aboutnotbeingcaught)? safety about less cares organization (The Pathological of category the management. for safety over priority the is business the that obvious is It safety. aviation to adhere to how understand to seem not does company general ABC of management The seats. passenger 30 than more have or weight takeoff maximum kg 15,000 than more are aircraft The organizations in attitudes and characteristics of assembly “That In Japan, civil aeronautics law requires S Common elements in these definitions are what is important isimportant what are definitions these in elements Common ANA defined “safety culture” as “The safety culture as applicable I donotI think this isnecessarily thecase. Because whether the Does this mean this ABC general aviation company falls into the U K HealthK andSafety Commission developed theoneof M S for operators whose - According to Dr. James Reason, just culture as an atmosphere of cockpit is the “trust” to be able to assert an error without any doubt trust in which people are encouraged (even rewarded) for providing and without any fear. essential safety-related information, but in which they are also clear about where the line must be drawn between acceptable and unac- 5. How “just culture” and “voluntary reporting of ceptable behavior. Effective reporting culture depends on how the safety issues and events” are linked organization handles blame and punishment. A “no blame” culture In Japan, the words “just culture” have an extremely low profile. As is neither feasible nor desirable. Most people desire some level of ANA’s survey reveals, SMS is still not recognized at frontline workers. accountability when a mishap occurs. So what is the reason why “just culture” is necessary in order to build Again I’ve asked my colleague pilots if they would report to the effective SMS. ICAO states SMS can be likened to a toolbox. It is a safety officer in charge in case slips/lapses, omissions, mistakes, viola- toolbox that contains the tools that an aviation organization needs tion types of errors were committed.” The majority of the answers in order to be able to control the safety risks of the consequences were “no” except for the events, which leaves evidence. This is how of the hazards it must face during the delivery of the services for we deal with our organization, at least for now. which the organization is in business. In many cases, the organization itself generates the hazards during service delivery. It is important 4-3. In a cockpit to acknowledge that an SMS itself is neither a tool nor a process. What about the relationship between the cockpit crew? The relation- An SMS is the toolbox where the actual tools employed to conduct 2010 7, SEPT. TUESDAY, ship of the cockpit crew can be termed appropriate as long as proper the two basic safety management processes (hazard identification TAG (trans-cockpit authority gradient) is maintained. The role of and safety risk management) are contained and protected. What each crewmember is very clear—in this case utilizing the skill such an SMS does for an organization is to provide a toolbox that is ap- as TEM (threat and error management) to be able to cut the chain propriate, in size and complexity, to the size and complexity of the of errors before lead to an accident or incident. The question is how organization. the pilots have courage to speak up and admit an error. ANA defines SMS as “A mechanism involving all activities to This figure is a conceptual diagram of CRM SKILL. As is men- continuously maintain and improve the safety level and ensure tioned at the top, “Communication” plays a crucial role to dem- safety as expected by customers through coordinated efforts of the onstrate CRM SKILL. In other words, building trust and a mutual company’s departments; by defining the company’s course of safety understanding between the pilots is essential. keeping flight operations through the establishment of the safety policy and objective; establishing and implementing safety systems, including standards and means; and evaluating the results of system implementation.” The basis of SMS is to identify hazards and conduct risk management based on the collected data to take corrective action as necessary, which creates the state that the hazards are maintained below acceptable level. Aggregation of safety-related data (latent hazard) relies very much on the workers who are in direct contact with the hazard. In an aviation organization, there are air traffic controllers, pilots, flight crews, maintenance personals, and other who can provide key information about aviation safety problems and potential solutions. SMS will not function without safety-related information from those people. The followings are the typical examples of safety-related infor- The ANA operation policy manual sets the policy about “asser- mation tion” in the cockpit, “The flight crew shall assert to the other crew • Mandatory reporting items as per Japan civil aeronautics law. for any deviations from SOP, or any doubts about the actions.” In • Voluntary reporting of near misses events (ANA has a reporting addition, it is the PIC’s duty to establish appropriate TAG in the program called “experience can help others.”). cockpit so that the flight crew who is asserted will receive it sincerely • FOQA. with modesty. • LOSA. The ICAO human factors training manual pointed Risk Management Cycle out that an Asian crew has a tendency to weigh heavily on their authorities or superiors so that they are passive about speaking up and asking things. Japanese culture also respects the harmony in human relationships; therefore, it requires little courage to assert someone, especially the captain. But our asset in the

ISASI 2010 Proceedings • 31 ISASI 2010 PROCEEDINGS 32 report. voluntary of this statement is unclear and inadequate to convince us to make may be given by the JCAB. For the frontline workers, the legal basis sanction administrative the to applied only is policy of exemption however,sources; the of the information the and reporter the tect pro- to sources the to access direct no has authority the addition, In authority. the by penalize to used be not will and confidential sociation ofAirTransport EngineeringandResearch). tion Network), which is operated by judicial foundation ATEC (As- by Japanese authority except for ASI-N ET (Aviation Safety Informa- In Japan, there is no voluntary reporting program that is established 6-2. Voluntary reporting program inJapan a coverupareclearlyexempted. intentional negligence, crime, drug abuse (including alcohol), and that prerequisite a with unacceptable or acceptable was event the launched in order for the FAA/UAL/pilots’ union to assess whether the report is submitted, a so-called “event review committee” will be theevent takes place, and the report must be a sole source. Program), is first the report must be submitted within 24 hours after The way it works, using, for example, who submit a voluntary report are protected from being penalized. Mandatory has the Aviation Safety Reporting System (ASRS), CAA (UK) has a NASA (ASAP), Program Action Safety Aviation the has FAA The in othercountries 6-1. Examplesofvoluntaryreporting program ity laterthisyear. program and aggregation of accident/incident data to an author reporting voluntary mandate will 13 Annex ICAO organization. the in culture safety of level the comprehend to benchmark a become can reporting voluntary how explained 5 Chapter 6. Voluntary reportingprograminJapan Figure onpreviouspage). “Risk (see organization the in culture safety the of level the comprehend to benchmark a become can report/audit formation. That is why voluntary encouraged for providing the in- are people which in trust of atmosphere an require truly ly collected, but the other itemsFOQA/LOSA are - automatical items/ reporting mandatory a safety-relatedinformationfor IOSA ifregistered. and JCAB, the conductedby MIL by conductedtransportation of evaluation management safety a as such program dit au- external an from dation Findings • program. audit internal an from tion Findings • C, the anonymous report is treated as strictly strictly as treated is report anonymous ATthe to EC, According above, listed these Among • T and a safety inspection inspection safety a and T ISASI 2010 ISASI Occurrence Reporting (MOR) under the law and those and and recommenda- Proceedings recommen- Number ofvoluntaryreports forlarge aircraft peryear. UAL (Flight Safety Awareness

anagement Management O nce - people whoare engagedinairportmanagement. attendants, mechanics but also to include voluntary reporting scheme shall be subject to not just airpilots, flight traffic controllers, and voluntaryareporting national programthedesirablelevel.at A making toward research to group working expert an established is, butonwhathascausedthem. Unsafe occurrences are not judged based on how gross the outcome cealment actions, by intentional rash actions or by excessive idleness. have that been caused by intentional unsafe action, by false or con- be treatedunfairlyagainsthis/herinterest. accusedby the company’s disciplinary sanctions, nor shall he/she of unavoidable human error(s), the person concerned shall not be result a as determined is occurrence unsafe the of cause the when reporting, mandatory required occurrences unsafe of case in And in the past, so “people concerned will never be treated unfavorably.” including Hitari-hatto (thrilling/chilling) events will be handled as policy onhowtohandlein-housesafetyreportsisasfollows. big step toward making an in-house non-punitive environment. The program that is based on the national law. In April 2009, ANA took a for theorganizationtocollectsafety-relatedinformation. workers,what obstructs workers tobuild faira and justice culture S from Aside culture. safety of importance the promote to endeavor management top the while organization, ANA the to SM of tion organization, but it has already been 4 years since the first introduc- benchmarkcomprehendto levelthesafetytheofculture the in safety culture. As I stated earlier, voluntary reporting can be a good a cultivated organization the that say to early too still is it revealed which (2009), survey second the and (2007) survey first the tween be- trust”) of “atmosphere as equated (if communication in scores quantitative data. zation, which has approximately 27,600 employees, left the certain organi- the for ANA by conducted assessment” culture “safety The 7. Conclusion M O However, the above policy does not preclude such cases matters Amongreports on flight safety, voluntary reported occurrences Somecountries have begun a non-punitive voluntary reporting surveytheAsshowed, thereweremanynot differences theof S promotionS tothe employees from management tofrontline utsidehouse,theJCABofthe E ngineeringDepartment has It means thousand of people are involved in this activity and there captain of Japanese defense force acrobatic team “Blue Impulse.” are so many obstructions to overcome, such as the society that tends The team drew a perfect Olympic symbol in a cloudless blue sky on to pursue criminal liability, sometime the event will not be reported the day of the Opening Ceremony of the Tokyo Olympics in 1964. or treated fairly (e.g., the typical title of the newspaper says “the According to the captain, the most important thing in an airplane incident occurred by pilot’s mistake or air traffic controller’s error” operation is the “trust.” To be trusted, the man needs to have a virtue. even before the investigation begins.) The Kanji (Chinese character in Japanese writing) of “trust” “ ” is I would like to emphasize that in order to tackle those challenge, structured from two parts. One part of the structure has the meaning one administrative office should not undertake to solve the problems of “people,” the other is “language.” In other words, there should but with the collaboration of other administrative office(s) as well as not be a lie or betrayal when people speak. “Trust” is realized based the representative of people who are in direct contact with a safety on the virtue, as it will be gained by his/her actions and attitude hazard shall be included. through many years of assiduous effort. The first step to cultivate a safety culture in an organization (from Making a policy on the voluntary reporting program shall also management to frontline workers) is to establish the reporting be based on the “trust” of everyone involved in the operation of the program, which is free from fear. aviation industry. Again at this stage in Japan, it is no exaggeration to Culture, in general in a society, is often described as the ideas, say that the integration of effective SMS in an organization depends beliefs, and customs that are shared and accepted by people in a on the rulemaking of a voluntary reporting program, which will be 2010 7, SEPT. TUESDAY, society (e.g., Superman and Batman have become a part of popular accepted by people who will make a report. ◆ culture). So does the voluntary reporting program. The people who are engaged with everyday safety conduct must accept the policy and References the mechanism of the program. Once it is accepted, then the new ANA Safety Information for Group Networking No. 9, 10, 17, 20, 21 issues. buds called “trust” will begin to appear. “Achieving a safe culture, theory and practice” Dr. James Reason. ICAO SMM DOC9858 2nd Edition. “A Roadmap to a Just Culture: Enhancing the Safety Environment” FSF Flight Harmony is “trust” Safety Digest Vol. 24 No. 3 March 2005. Finally, I had an opportunity to speak to the former team leader ATEC Homepage: http://www.atec.or.jp/.

ISASI 2010 Proceedings • 33 S ISASI 2010 PROCEEDINGS assistant professor, since1987. adjunctattheUniversityofMaryland Center forPublic AdministrationandPolicy Analysis,andhehasbeenan credentials include a Ph.D. in political tion analystfortheOfficeofSecretaryeconomy attheU.S.DOT. Hisacademic from Virginia Tech’s Cooperation andDevelopmentinParis, andseveralyearsasanavia- 34 Northin America, while others putCentralinit America, theor more regions than any other country. Some speakers include Aviation officials in well. point the makes country non-Asian A speakers. different by Terms differently slightly defined are often “Europe” or “Asia” like Defining “Asia” achieved dramatic improvement. achieved dramaticimprovement. have that countries those in rates accident high with struggle to comments some on with remainingconcludes paper The challenges,systems. aviation national Asia’s both in countries that among change continueof degrees different the understand help to nance gover and performance economic broader of measures common examines also paper The Asia. in occurred not has or has change positive degree what to and where document to measures aviation direction in a few countries. less impressive, while recent trends, in fact,has been uneven. haveIn a gonenumber of countries, inimprovement has the been wrong expect with a geopolitical region as large as Asia, the pace of change might we As countries. all by shared not is news good the but tell, Korea, and Vietnam. South China, include improvements impressive most The level. that approaching are countries Asian other several and world, the and now have long-term accident rates that are among the lowest in of countries in Asia have achieved enormous gains in aviation safety number A case. the longer no is That America. North and Europe to the four countries noted above, or compared to rates in Western compared high fantastically were Asia of rest the in rates accident drawn, The paper uses accident data, exposure data, and other standard to story good a become has Asia in Osafety aviation balance, n • Singapore, Hong Kong, and, depending on where the linerates is for decades, including our host country, Japan,everal butaviation alsosystems in Asia have had low air carrier accident ISASI 2010 ISASI alaysia. However, as recently as the early and mid-1990s, mid-1990s, and early the as recently However,as Malaysia. European Union and the Organization of Economicment of Transportation, 2 years as a consultanttional transportationlegislationwiththeU.S.Depart- with the previous professional experienceincludes9yearsinna- of Accident Investigation for the past 15 whereyears. Hishe has been the senior safety analystBob MatthewshasbeenwiththeFAA since1989, in the Office Proceedings By RobertMatthews,Ph.D.,SeniorSafetyAnalyst,FederalAviation Administration,USA Mexico often joke that their country belongs to Major Improvements and Accident Trends in Asia: Remaining Challenges exico Mexico - the rate of a “control group” Table 1 compares 5-year hull-loss rates for the 29 countries of Asia to Changes inAsia’saccidentrecord well asNewZealandandthePacificstates. Finally, for the sake of clarity,it excludes what some define as southwestit Asia (or “the excludes the continentJapanese islands further ofeast. Though Australia,this is a fairly standard definition, as the south by Indonesia, and in the east by the Philippines and several stan, Turkmenistan and Afghanistan, the northwest by Japan, countries at the other end of the scale. It is bordered from northeast largest world’sfour to the of three to scale the of end one at small very from range that populations national and wealth, of range broad a includes 29 countries with a variety of political and economic systems, sometimes areincludedin“Asia”andnotincluded. of several other groupings. The same is true of certain countries that Caribbean, or “Latin America,” or ing Central and South America, Africa, the Africa, America, South and Central ing a safety standard for the world, and then the rest of the world, includ - the rest of Asia exceeded the hull-loss rate of the control group by by group control the of rate hull-loss the exceeded Asia of rest the systems, three those Without systems. safe established already had which of three all Singapore, and Kong Hong plus Asia, in system far,by was, then which Japan, largest includes the 1990-94 for data group and 38% higher than the rest of the world. Note that Asia’sa hull-loss rate that was nearly 8 times greater than that of the control central southwest Asia(“MiddleEast”). Figure 1.DefinitionofAsiaforthispaper:29systems—excludes Figure 1 illustrates the definition of “Asia” used in this paper. It It paper. this in used “Asia” of definition the illustrates 1 Figure Europe, plus Australasia. From 1990 through 1994, Asia had Mongolia, and Kazakhstan, on the west by 1 of countries long recognized as setting OECD countries (or not), or any Maldives in the southwest, in

Middle

ast, much of of much East, Middle Uzbeki- ast).” East).” more than 10 times and nearly doubled the hull-loss rate in the rest Over the next decade, their combined rate was slightly lower than of the world. By 2005-1009, just 15 years later, the ratio for Asia was the rate for the control group. That is a very impressive change. just a bit more than four times the rate for the control group and, Vietnam had a very high hull-loss rate in the 1990s, followed by no instead of exceeding the rate for the rest of the world by nearly 40%, hull losses the following decade. The high rate of the 1990s involved it was just less than half the rate for the rest of the world. three hull losses produced by a very small system. Though the system remains relatively small, it has grown from fewer than 15,000 flights 1990-94 1995-99 2000-04 2005-09 in 1990 to nearly 100,000 flights today. That rapid growth coincided Asia 4.61 2.91 1.42 1.52 with a sharp improvement in safety. Control Group 0.61 0.51 0.33 0.35 Much of that improvement came partly from upgrading the Rest of World 3.35 3.90 3.70 3.07 fleet, but some of it came as one benefit of opening up to foreign Control Group consists of Canada, USA, and the EU-15. investment. Though Vietnam continues to struggle with the policy issues related to foreign investment and “foreign” brand names, the Table 1. Hull Losses per Million Aircraft Departures 5-Year Rates, infusion others’ experience has contributed. Asia Compared to Control Group and the Rest of the World The improvement achieved by South Korea may be even more dramatic than Vietnam’s. From June 1991 through December 1999, Though the improvement indicated above is dramatic, the aggre- South Korean operators had eight hull losses in a system that then 2010 7, SEPT. TUESDAY, gate data presented for all 29 countries obscures several great success averaged fewer than 200,000 flights per year. Most of the eight ac- stories. Figure 2 consolidates the data shown above into two 10-year cidents could qualify as egregious accidents, including three fatal period for selected groups of countries. The figure presents a telling accidents that killed a total of 304 people. story, supported by the data in Table 2. Figure 3 presents a similar South Korea’s Civil Aviation Safety Authority (CASA), along with decade-to-decade comparison for selected, individual countries. its major carriers, KAL and Asiana, undertook an active effort to Table 2 shows that in the 1990s, the four countries identified ensure appropriate training and the establishment of and adherence earlier as having long established good safety records (Hong Kong, to good standard operating procedures. The government and the Japan, Malaysia, and Singapore) already had combined hull-loss industry also moved away from relying on punishment as a response rates that were only about half those of the control group. Over to incidents or accidents, such as transferring authority in selected, the next decade, those four countries compiled a hull-loss rate that lucrative markets from one airline to another after an incident. was just 30% of the rate for the control group. In short, these four Instead, CASA upgraded its own staff and implemented more con- countries already had set the world’s standard for aviation safety in temporary analytical procedures to improve safety throughout the the 1990s, only to extend the margin that the standard already had system. enjoyed compared to the rest of the world. A closely related factor was pressure from the market. Both the U.S. FAA and the European Union, particularly the United King- 1990-99 2000-09 dom, restricted Korea’s access to their markets until safety improved. Hong Kong, Japan, Malaysia, and Singapore 0.29 0.10 Simply put, the loss of access to the world’s biggest markets will get China, RO, and Vietnam 3.68 0.287 the attention of most companies. Simultaneously, international al- India, Taiwan, and Thailand 4.00 1.53 liance and code-share partners pressed Korean carriers to upgrade Indonesia, Pakistan, and Philippines 4.78 3.66 safety and actively participated in the effort. Central Asia (six Countries) 10.59 5.20 The results have been dramatic. After eight hull losses in just 9 Control Group 0.55 0.34 years, South Korea has had no hull losses for the past 11 years, despite system growth of more than a third over that period. To everyone’s Table 2. 10-Year Rates for Selected Groups of Countries Per Mil- credit, Korea’s CASA and its carriers continue to invest resources lion Aircraft Departures, 1990-99 and 2000-09 and their administrative energies to ensure that the improvement is permanent. Japan, in fact, has not had a major fatal accident since 1985. With Finally, China is perhaps the best recognized success story. Avia- the world’s sixth largest system measured by aircraft departures, Japan’s tion and aviation safety have changed so dramatically in the past two only hull loss in 25 years occurred in 1993 when a DC-9-41, operated decades or so that the change is hard to overstate. The early signs of by the former Japan Air Systems, landed hard at Morioka-Hanamaki change occurred in the 1970s when China first purchased a small Airport. In that accident, all 76 occupants evacuated without injury, but number of Western-built aircraft, starting with Vickers and a small a fuel leak led to a fire that eventually destroyed the aircraft. During number of Tridents, followed by larger purchases of Boeing aircraft the same two decades, Hong Kong had zero hull losses, and Singapore and more Tridents, and eventually Airbus aircraft. By the early 1990s, had one major accident at Taipei in October 2000, which was the lone China had undertaken a conscious effort to retire most or all of its fatal accident since 1972 from either Hong Kong or Singapore.2 Each older, Soviet-era fleet and upgrade the fleet, again with Boeing and of those systems is considerably smaller than Japan’s but they produced Airbus products and, later, Embraer and Canadair products. All these nearly 4 million flights over the 20 years. changes were accompanied or followed by significant investments in satellite-based air traffic control technology and a major effort to The most dramatic changes construct new airports throughout the country. The story is perhaps most dramatic for the second group displayed Different people may offer somewhat different time lines, but the in Figure 1 and Table 2 (China, South Korea, and Vietnam). Those profound change arguably began with a major structural change in three countries combined for a hull-loss rate in the first decade that the 1980s, when China’s government reorganized the airline services was nearly seven times higher than the rate for the control group. operated by the Civil Aviation Administration of China into region-

ISASI 2010 Proceedings • 35 ISASI 2010 PROCEEDINGS 36 through 2009, China’s hull-loss rate was slightly lower than the rate rate among the control group. However, thoughin theits hull-losspast China, in decade rate substantially still of improved was2000 safety six times 1990s, greater the in thanHowever, the hull-loss imagine the reaction if the the in exposure of week 1 about of per year in an era when annual volume in China was the equivalent into the very early 1990s, China averaged two air carrier hull losses ics, etc. modernization, which introduced state-of-the-art automation, avion- fleet its accelerated simultaneously China procedures. operating proper training ensure to and action the strong establishment took also did, of and Korea adherence South like to good standard turing. In addition to restructuring its airline industry, China, much that marketandabsorbedChinaSouthwestAirlines. structured as China’s long-haul overseas carrier, remained based been in had already which Airlines, China Airlines. Wall Great and Airlines, Yuan China Airlines, Northwest China absorbed Eastern controlling interest in Xiamen Airlines. In the same period, China a has it and carriers, former those of subsidiaries several as well as and Airlines, Xinjiang China Northern, China China Southern, which is China’s largest airline, eventually absorbed again by consolidating the industry around three successful carriers. ally based carriers. By the late 1990s, China restructured its industry 1990-1999 (left)and2000-2009(right). Figure 3. Change in hull loss rates, selected groups of systems, “Middle East,” Australia, Africa, New Zealand,andRussia. includes South and Central America, Caribbean,*Control central-eastern group consists Europe, of EU-15 plus USA and Canada.All ofAsiaVersus Rest Control Group*of world Figure 2. Hull Losses Per Million Aircraft Departures, The net results have been dramatic. Throughout the 1980s and and 1980s the Throughout dramatic. been have results net The Safety was a significant part of the rationale for the latter restruc- • ISASI 2010 ISASI Proceedings .S. were having a hull loss every week. U.S. were having a week. hull loss every .S. At that pace, we can only only can we pace, that At U.S. rumqui Airlines, Airlines, Urumqui

more thanalittle envy, and certainlyafairamountofrespect. an embarrassment to one that, today, many countries must view with noted above, and the net result is a hull-loss rate that once was simply improvement in safety. Add the other efforts that China undertook, of-the-art avionics and automation. That alone ensured a significant it continued to accelerate the introduction of ever advancing state- safety. Not only did China retire its older, mostly Soviet-built fleet, but the rapid growth in fact is part of the explanationin safety. That combination is forthe truly theimpressive achievement. improvedYet, growth while simultaneously achieving nothing short of a revolution lenges. Yet China’s aviation system has sustained a blistering rate of measure. By 2005, China’s system was the second largest in the world by either figures made China the 16th largest system in the world at that time. fewer than 300 aircraft and generated about 250,000growth flights.has been These in China’s aviation system. In 1990, the system had two decades,averaging12.1%peryear. past the over pace comparable a at increased has flights revenue of number the expect, might one As years. 6 every doubling fleet the rate of increase averaged a comparable 11.9% per year, with the which the fleet would double every at 5.5 pace years. In year, a the per following 13.3% decade, of average an by increased fleet airline selected countries. Through the 1990s, Figure 4 shows that China’s 4 and 5 show changes in national fleets and total revenue flights for Figuressystem. the in growth rapid very during achieved been has simply stunning.SeeTable 2andFigures3. amongcontrolthe group.magnitudeThe thatturnaroundof is 1990-2009 (inmillions). Figure 5.Airlinerevenue flightsbyselectedcountries turboprops ofmore than50seatsinselectedcountries,1992- Figure 4.Fleetexpansionandrenewal, in-serviceairlinejets.and Rapid growth in any nation’s aviation system can pose safety chal- Figures 4 and 5 illustrate visually how sustained and how rapid the it that is safety in improvement this of part impressive truly The

Taiwan also established its Aviation Safety Council (ASC). The ASC was responsible for regulation and accident investigation, but it also significantly upgraded the role of analysis and monitoring of trends. However, Taiwan’s improvement also was influenced by pressure from other aviation regulators. Much like South Korea, Taiwan’s carriers found themselves either excluded from major markets or found that future growth was precluded due to their high accident rates of the 1980s and mid-1990s. Those restrictions in major markets helped to focus attention. This did not prevent the takeoff accident at Singapore in October 2000, which killed 83 people. However, that is Taiwan’s most recent fatal passenger accident. As Figure 6 illustrates, Taiwan’s hull-loss rate has improved in each 5-year period on the chart. The rate for 2005-2009, at 0.8 hull losses per million revenue flights, was 83% Sources: Departures from JOS; Accidents from Airclaims-Ascend, Aviation Safety Network, and lower than in 1990-1994. If Taiwan sustains its steady improvement, 2010 7, SEPT. TUESDAY, National Investigative Authorities. it soon will approach the very low rates enjoyed by the seven Asian Figure 6. Hull losses per million aircraft departures, countries noted above. by national system 1990-1999 (left) and 2000-2009 (right). The hull-loss rate in India improved sharply through the early 2000s, leading to glowing commentaries similar to those about China’s improvement. As with China, some of the improvement was explained by fleet modernization, with the government seeking to establish a 5-year cap on the age of passenger aircraft. India’s system has expanded rapidly since 2003. Prior to that, its system, measured by aircraft departures, doubled from 1990 to 2003. The pace of growth in that period, which averaged about 5.3% per year, was not dramatically higher than the increase experienced in much of the world in that era. However, since 2003, the system has expanded rapidly, averaging about 13.8% per year. Yet, despite this growth, India still generates just 4 million passengers per year in its domestic system, or about 2 days’ of passenger traffic in the USA. Growth in supply has outstripped demand, creating excess capacity Sources: Departures from JOS; Accidents from Airclaims-Ascend, Aviation Safety Network, & National Investigative Authorities. in many domestic markets, yet while leaving other markets under- served. Figure 7. Hull losses per million flights, countries where India’s growth has created other challenges as well. New carriers accident rates remain high. have entered the market, some of which were short-lived, while others prospered and then encountered hard times, such as Kingfisher Countries with more modest improvement and Jet Airways, who now cooperate through a rather close alliance. India, Taiwan, and Thailand constitute a third group within Asian In the meantime, India’s former domestic trunk carrier, Indian where hull-loss rates registered significant but more modest improve- Airlines, has been absorbed by Air India, with many of the normal ment than the successes noted above. Combined, India, Taiwan difficulties of any large airline merger. and Thailand achieved a 62-percent reduction in their hull-loss Though a cause-and-effect relationship may or may not exist, the rate in 2000-2009 compared to the 1990s. However, even with such improvement in India’s accident rate has been reversed in recent a substantial decrease, since they started with very high rates, their years. A spike in non-fatal hull losses in just more than 4 years began combined rate for 2000-2009 remains well above either the control in October 2005. That spike was followed shortly by the India Air group or the seven Asian states noted above. In addition, though Express accident in May 2010, in which 158 people died. Though Figure three shows all three countries achieved significant gains that accident is not part of the rates computed for this paper, it decade to decade, Figure 6 shows that hull-loss rates increased in dramatically makes the point that the sharp improvement in rates two of the three countries in the past 5 years (2005-2009). has reached at least a temporary interruption. Taiwan achieved the most sustained improvement among these The good news is that India has responded by developing com- three countries, and for reasons similar to those that help to explain prehensive aviation legislation and by reorganizing its regulatory the positive changes in China and South Korea. Beginning around structure to ensure a more independent and stronger regulator. 1997, Taiwan’s authorities accelerated its active oversight of the Nevertheless, judgment on long-term improvement needs to wait. industry. Regional airlines, such as Formosa Airlines, were among In Thailand, the system expanded rapidly in the early 1990s, the early targets, but China Airlines quickly followed. Aircraft and stagnated briefly, and then expanded rapidly again from 2000 selected crewmembers were grounded or suspended for various through early 2007. Since then the system has contracted by about periods, and the authorities initiated a sustained effort to improve 15%. Like other countries, Thailand has had several new carriers crew training and the establishment of good standard operating enter and exit the system, and had to cope with the Asian financial procedures. crisis of the late 1990s and then the SARS scare. However, political

ISASI 2010 Proceedings • 37 ISASI 2010 PROCEEDINGS 38 1990 and for 2009. The correlation with the accident trends discussed Figure 8 shows GDP for 18 Asian countries in constant mass. economic of measure basic most the is (GDP) product mestic the basic resources required to invest in aviation and safety. Gross do- wealth and governance. aviation systems. Simply put, aviation safety depends first on national safety sustain and establish to capacity the have countries which us are well outside our domain may be more influential and mayanother.to country one from safety of tellHowever, that factors broad level the in differences explain to try we when domain our within aviationAsprofessionals, reasonablyweissuesarethat focuson explain these trends Remaining challenges and broader factors that help isgood. somewhat uneven,buttheoverallstory been has change of pace the short, In negative. been has it cases improvementpacetheof beenhasslowerelsewhere some inor Taiwan/ChineseTaipei However,level. this approaching rapidly is achieveddramatic improvement andhave joined this club, while andSingapore. China, theRepublic ofKorea, andVietnam have Kong, Hong Japan, include They world. the in lowest the among be to continue rates accident fatal their and time, long a for records safety good had have Asia in systems national Several Summary oftrends 2009, accompaniedbythereemergenceofaccidents. followed by the reemergence of limited civil aviation activity in 2005- disappearance of aviation activity in Afghanistan from 2000 to 2004, virtual the reflects pattern that degree large Toa years. 5 past the in again once increase sharp a with chart, the on shown periods rate for 2000-2004 is only a small fractionother of factorsthe rate help tofor explain the the 3 erratic other pattern. For example,significantly affect the the computed rates for this region. Nevertheless, numbers. A single accident or the avoidance of a single accident will small of problem the is that of Part decades. two the over rates for and remains very high. 6 years (1995 through 2000), but its rate inflated again in 2000-2004 to all the countries discussed above. Pakistan hadcreased in nothe hullpast 5 lossesyears. But the forrate remains very high compared 1990s but increased again in 2000-2004, albeit marginally, then de- past 5 years. In the Philippines, the rate also increased in the latter the over again increased then and 1990s, the of half second the in rates for these countries in 5-year periods. Indonesia’s rates increased level of10.6hulllossespermillionflightsto5.3million. high very a from half, exactly by improved rate the Asia, central of jumped from 2.7 to 8.15 per million ofdepartures. 5.4 per In themillion six countriesdepartures Indonesia’s tohull-loss rate increased 5.8slightly from an inalready high level 2000-2009, while per million departures Pakistan’sto a still very high 3.8 per million. rate ginally. The hull-loss rate in the Philippines improved slightly from 4.5 years in significant parts of Asia in recent years or improved only mar Figure 3 shows that the accident rate actually deteriorated in recent No improvementormarginal patterns intheindustry. uncertainty probably is the greatest current source of erratic growth Without some minimal level of economic mass, a country will lack pattern erratic an show Asia central of countries six Finally,the showing by rates these into insight more bit Figurea provides 7 • ISASI 2010 ISASI Proceedings U.S. dollars for lsewhere, Elsewhere, alaysia Malaysia - remain modest. remain modest. In those States, GDPs remainFigure 8 modest,illustrate what happens when a country andlacks the resources. overall resources therefore resources todedicateaviation safety. terms compared to 1990. Again, suddenly these economies had the category,same real in greater times three nearly 2009 in GDP with earlier.so Taiwan’s the in it puts activity economic total in increase sions about the “economic miracle,” as Japan had been a decade or discus- worldwide of subject the was Korea South 1970s, and 1960s SouthKorea, andTaiwan. Wecaneasily forget todaythat, thein the economicresourcestodedicateaviationsafety. relation with accident rates is not a coincidence,cor the Again, stunning. record: safety asChina’saviation in change China now has been nothing short of stunning. The same adjective has growth economic applies1980s, early and 1970s late the in beginning to the years.20 Since China began implementing itseconomic reforms was alreadyamongthesafestinworld1990,andbefore. in the region in 1990 and in 2009. above Notis visually coincidentally,obvious. For example, Japan’s was the largest economy Japan’s system Dollars”). (left) and 2009 (right) (thousands of constant 2009Figure “International 9. GDP per capita in purchasing power parity: 1990 2009 US$,orthousandmillions). Figure 8.GDP, 1990and2009(inbillionsofconstant Figure 9 adds a dimension to notions of national wealth by show- However, countries further to the right on the horizontal axis in India, for GDP in growth significant shows 8 Figure same The Figure 8 illustrates the stunning growth in China’s GDP over the

- Source: World Bank. Scores in this chart represent the mean of 5 indices (Political Stability, Govern- ment Effectiveness, Regulatory Quality, Rule of Law, & Control of Corruption). Figure 10. Maternal mortality per 100,000 live births, 1990 (left) Figure 12. World Bank Governance Index 1990 (left) and and 2005 (right) (women who die in child birth). 2008 (right). 2010 7, SEPT. TUESDAY,

(i.e., the rate at children die before reaching one year of age). Ini- tially, an observer might ask what maternal death rates and infant mortality have to do with aviation safety. The answer, at the most fundamental level, is “everything.” Of all the various social indicators available from international organizations such as the World Bank and the United Nations, maternal death rates, over the long term, always correlate more strongly with accident rates than any other measure, followed closely by infant mortality. The bottom line is that, if a country lacks the economic capacity or the social infrastructure to prevent the death of their women in childbirth or the death of large numbers of infants, the same countries will lack resources and infrastructure to ensure a safe or even a viable aviation industry. For example, in Figure 11. Infant mortality per 100,000 births 1988 (left) and Afghanistan, maternal death rates, plus the fecundity rate, suggest 2008 (right) (infants fail to survive 1 year). that one in eight women of child-bearing age is likely to die giving birth. Similar rates apply to countries like Sierra Leone and Niger. ing GDP per capita, adjusted for purchasing power parity, which Figure 11 shows a similar measure, with the United Nations’ accounts for differences in prices as well as exchange rates. This Human development Index. The Index combines measures of measure begins to indicate the level of competition from other per capita income, wealth distribution (Gini coefficient), infant socioeconomic demands for resources within a country. Even this mortality, life expectancy, and education. Again, the correlation measure, however, does not indicate the distribution of real wealth. to accident rates, in this case an inverse correlation, is visually ap- Rather, it provides only the mean of GDP per person. Conceivably, parent. Consistent with hull-loss rates, several countries established a country could have a substantial GDP and a substantial GDP per good rates on the measure a generation or more in the past, while capita, but a large majority of the wealth might be concentrated other countries like China and South Korea made great progress. among a small elite. If so, competition for resources could still be Conversely, more than a few countries with high accident rates made severe. Combining GDP with the so-called Gini coefficient addresses more modest progress or even lost ground on these measures. that level of precision but GDP per capita is a convenient and more Finally, Figure 12 shows the World Bank’s Governance Index. easily understood measure. However, this measure does not ask about a particular government Figure 9 paints only a slightly different picture from Figure 8. The or administration. Instead it asks broader questions about the state six highest measures of GDP per capita (Singapore, Hong Kong, of the state. The chart combines scores from five otherU N indices, Japan, Taiwan, Korea, and Malaysia) all have been shown to have including the following: very safe systems over the past decade or two. Conversely, most of • Political stability. This measure asks about the basic stability of the the countries on the right side of the horizontal axis continue to regime, not the stability of a particular government or administra- have high hull-loss rates. tion. Essentially the measure estimates the likelihood that the basic However, Figure 9 indicates that, despite its stunning growth of structure of the state tomorrow will be much the same as the basic the past 20 to 30 years, China remains a relatively poor country. The structure of the state today. Without some reasonable minimum same is even more apparent for India and Vietnam. This creates a on this score, aviation or any other industrial activity lacks the most possible long-term challenge for aviation’s ability to compete for basic level of predictability that such activities require. relatively limited resources. • Government effectiveness. Again, this measure does not neces- Figures 10 and 11 are common measures of social well-being. sarily reflect on any particular administration but asks about the Figure 10 shows maternal death rates (i.e., the rate at which women degree to which a country has a bureaucracy that is professional, die during child birth), while Figure 11 shows infant mortality rates educated, well trained, and based on merit and the degree to which

ISASI 2010 Proceedings • 39 ISASI 2010 PROCEEDINGS 40 rapid of possibility volatility,the overall of level some implies also the safety.Nevertheless, for implications inherent implies nothing more than a business model that need not have any it model, business alternative an than more nothing suggests ently • or newlyemerginginothers. chronic are but countries, some in resolved been have or are sues • opment needsaregreat. • and accesstotheeconomyenjoyedbyentirepopulation. demographics, systems, educational by affected be or on demands pilots, controllers, mechanics, systems andwill have to managers,meet an equally rapid increase in whichthe demand for in turn • will place one ormoreofthefollowing. Themix and severity of challenges will vary, but most systems able to face act upon some challenges, but others are external to aviation. economy.broader be the will from community come aviation The occur within the domain of the aviation community,challenges. some without come butnot some will will safer.However,this increasingly becomes that system aviation civil a of benefits the enjoy to continue will generally so or decade and those countries that have achieved impressive gains in the past systems aviation civil safety enjoyed long have that countries Asian Remaining challenges Rule • structure. fective regulatory ef- and functional a operate to resources human the lacks simply that country a indicates certainly almost extreme opposite the but of this measure is an ideal that probably no quite country achieves, end high the At manipulation. political of free is bureaucracy the Control • the securityofoperationisissueforaviation. the whim of a single ruler or a small elite. Again, predictability and on maid are decisions which to degree the versus predictable are depends onnationalwealthandgovernance. the bottom lone is that aviation safety generally is a luxury item that However,engine. economic an be can Aviation you. have what or aviation as a tool of economic development, or to develop tourism, it canentertaindedicatingseriousresourcestoaviationsafety. a poor country that is well governed has many other priorities before has no hope of establishing a safe aviation system. At the same time, romantic. A country that is both very poor and very badly governed but whichhasthebenefitofacompetentstate. challenges, many faces that country a of example best the be may can be poor despite having a competent and honest state. Botswana are badly governed. For any number of historical reasons, a country governed usually are also very poor. However, not all poor countries badly very are that countries put, Simply etc. rates, death maternal useful resources. of country the strips simply that kleptocracy a identify can scores low extreme, the At governance. of components above the all in cracy,scoresVeryetc.usuallylowherecorrelate scoreslow with bureau- effective merit, to speaks also It done. something gets one Adequate domestic workforces. Countries with rapidly expanding Rapid expansion of low-cost carriers (LCC). Though is - These stability. and governance basic of challenges National Competing demands for national resources where human devel - Some middle or lower income countries may choose to develop very not though straightforward, is safety aviation for point The Low scores on governance generally correlate with poverty, high • ISASI 2010 ISASI

law. of

corruption. This Proceedings

measure This

asks measure

about any of those challenges will will challenges those of Many

the speaks

degree directly

CC expansion expansion LCC which LCC inher to

decisions just how -

nextdecade notifmore, China couldchallenged be produceto when ChinaSouthernabandoned nightflightsintotheairport. for that airport had become controversial months before the accident, India The recent accident in China is a case in point as is the recentdifficulty keepingAir pace with the demands on aviation infrastructure. whicheveryone expects will be the case, some countries may have • capacities,plusashiftinoperatingenvironments. new regulatory basically of development the requires opportunity,also an it is but and a promising market for corporate aviation in China. Again, this such as a small but rapidly growing civil helicopter market in India • capacity indesign,productionandcontinuedairworthiness. regulatory new basically a of development the requires also it but and (Singapore industry cantly expanding their presence in the maintenanceaircraft and overhaul • number ofoperatorsexpands. pansion, and a general sense of scale for the regulatorreallocate those resources quickly in response to entry, exit asand ex- the sheer challengesresourceofallocation regulator, the on ability theto growth for some successful rapid of possibility industry,the the and from exit rapid and entry an lines accident at YichunAir Henan recent the into investigation on-going the of part be will with serious doubts about some airport locations. Those doubts likely are preparingtoenterthatmarket. challenge will not be unique to China, as other Asian countries also That airworthiness. continued and production design, in capacity that market requires the development of a basically new regulatory economy, are clearly an opportunity for China. However, entry into regionaljets, andthe spin-off technological benefits to the entire aircraft manufacturing. New domestically produced turboprops and ing onthetimeanddistancebetweencities. will become a major modal challenge within certain markets, depend- also eventually Roads markets. those in capacity airline in reductions travel from air to rail in some interurban markets, with corresponding investment in rapid rail and roads. Rapid intercity rail already is shifting short of dramatic, it nothing pales compared to been China’s has recent and continuing investment airport Though transport. of modes will flatten out as the industry faces increasedeventually competition fromso, other or decade another for rates impressive at expanding continue to certain though travel, airline First, interact. might lenges place, may provide the best single example of how many of these chal- have produced158fatalities. not would likely it fast, so and long so landing after benign been runwayend. Though theresult richerina country maynot have and with an overrun area or at least the absence of obstacles at the touchdown after remaining runway longer am with occurred have would likely countries richer many in accident same runway.The speedandtraveled high steepdownaembankment at overran thetheendatof runway, 8,000-foot an down feet 5,000 landed Aviation infrastructure. As or if systems continue rapid expansion, Getting ready in some countries for growth in general aviation, general in growth for countries some in ready Getting Entry by several countries into the manufacturing of air transport Conversely, with continued rapid growth ensured for at least the Even the recent boom in airport construction has introduced risk, China, like several other countries, also is entering the field of civil taken has improvement dramatic most the of some where China, Embraer pes ciet at accident Express (China, Japan, and India), while some countries are signifi- 190 flew into terrain in heavy night fog. Site selection selection Site fog. night heavy in terrain into flew E190 L indu Airport in northeastern china, where alaysia). All this is a great opportunity, great a is this All Malaysia). LCC operators. All this, in turn, imposes naoe At Mangalore. angalore, the aircraft aircraft the Mangalore, - the broad range of professionals that any large, modern aviation would benefit from an increase in the share of the overall population who system requires, from pilots and air traffic controllers, to managers, could then afford to fly. In short, the aviation industry in many countries mechanics, etc. China soon will have to meet this challenge just as might envy China for having such “problems.” In the end, despite real its working-age population begins to decrease. Most demographic challenges, the next decade or two should continue to be an impressive projections cite 2014 or 2015 as the watershed year when that period for aviation in China. The same may be true of Asia’s aviation decrease is likely to begin. Total population could decrease by as system in general over the next decade or two. ◆ much as one-third on the following several decades, as India, with the opposite demographic future approaching in the next couple Conclusions of decades, likely surpasses China as the most populous country by Asia has achieved dramatic improvement in aviation safety over the about 2030 or sooner. past decade to 15 years. However, like any other region, improve- China’s aviation system also could face challenging demands for re- ments in Asia have been uneven. Yet, despite different challenges sources in other sectors of the economy. As Figure 9 showed, despite the that face different countries, Asia has a good story to tell and the truly impressive gains in national wealth, China in fact remains a fairly story should continue to get better for the foreseeable future. poor country, with a GDP per capita that ranked 102nd. The challenge, of course, will be to expand the benefits of the recent growth further down Endnotes into the population, especially the rural population. 1 The control group, or comparison group, includes Canada, the United States, 2010 7, SEPT. TUESDAY, and the “EU 15,” which constituted the European Union prior to its recent Yet, if China succeeds in this challenge, and few concrete reasons exist expansion. to suggest China will not succeed at least somewhat, the aviation industry 2 The count of fatal accidents excludes criminal actions and suicides.

ISASI 2010 Proceedings • 41 ISASI 2010 PROCEEDINGS 42 QinetiQ, from statisticians of formed was team A mining. data of wasbestsupported toolsby specifically designed for the purpose sample size. Analysis of a much largerplace a statistical datasignificance on theseset findings alone duewas to the required, small to difficult andwas However, it conditions. atmospheric thissimilar under and route same the on operated having flights of number small a to compared when unique or unusual were features temperature of the accident flight data identified that certain fuel flow and fuel incident flight, but not the other thousands of flights. Initial analysis N862DA later the flight, accident G-YMMM the on occurred had flight and to understand further the reason why the engine rollbacks accident the to unique were parameters of combination a or eters the rightenginehadbecomerestrictedwithice. on FOHE the that were NTSB the by issued conclusions liminary Pre- cruise. the during power engine in reduction uncommanded an suffered it when Atlanta, to Shanghai from operated being was engines, Rolls-Royce by powered also N862DA registration 200ER a criticalstageoftheflight. a restriction at the engine fuel oil caused that pipes heat delivery fuel aircraft the in ice of release sudden exchangers (F Branch determined that the probable cause was the formation and the by undertaken investigation The 1). Figure (see runway the of surface paved the of short metres 330 approximately down touching aircraft the in resulted which engines, both to power of loss a experienced row) engines, registered G-YMMM, whilst on approach to Rolls-Royce by powered 777-236E R Boeing a 2008, 17, Jan. the On Introduction and istheholderofaprivatepilot’slicense. Department. Mark hasworkedonmore than100investigations todate air accidents,workingwithintheFlightDataRecording andAnalysis Investigation Branch in 2003, where he is now technical director ofengineering,before leavingtojointheAirAccidents The intent of the data-mining activity was to identify if any param- A second incident occurred on Nov. 26, 2008, when a Boeing 777- • ISASI 2010 ISASI Accident: Innovative Outcomes and AAIB’s Use of Data Mining in the AAIB’s UseofDataMininginthe Investigation of the Fuel-Icing Mark Flight OperationsQualityAssuranceDepartment. systems, workingwithintheFlightDataMonitoring/ engineer specializing in data acquisition and recording university education,hewastobecomeadevelopment following a4-yearavionics apprenticeship and Mark Ford joined Proceedings nited Kingdom Air Accidents Investigation Investigation Accidents Air Kingdom United

also

worked as ngineering), By MarkFord,SeniorInspectorofAirAccidents(Engineering), Air AccidentsInvestigationBranch,DepartmentforTransport

British Airways in 1987, where

communications manager for Challenges Faced

a senior inspector of London (Heath- O H E ) during

the 777’s, so we were reliant on a smaller detailed subset equalling about In our case, data were not available for of everydata, the flightdata may not be madefully representative byof the Boeingwhole domain. data formarketresearchpurposes. umes of data such as airline passenger trip records, census data, and vol - through sift to governments and scientists businesses, by years intention of uncovering hidden patterns. It has been used for many miningistheprocess ofapplying these methods todata with the decision trees (1960s), and support vector machines (1980s). Data (1950s), algorithms genetic clustering, networks, neural as such ing. This has been aided by other discoveries in computer science, increasingly been augmented with indirect, automatic data process- have grown in size and complexity, direct hands-on data analysis has resulted in the increased collection and storage of data. As data sets The proliferation (1800s). analysis regression and and increasing(1700s) theorem Bayes’ powerinclude of computer technology has tomated approaches. increasing volume of data in modern times has called for more au- the but centuries, for data from patterns extracting “manually” undershoot shortlyaftertheaccident. Figure 1. G-YMMM at Runway 27L An unavoidable fact of data mining is that when analysing subsets Early methods of identifying patterns in data

uas ae been have Humans new. relatively is tion investiga- accident aircraft to plication ap- its but opment, devel new a not is itself in mining Data Data mining faced. issues and results, process, data-mining the discusses paper the investigation. This of course the during flights were analysed million a half than more from points Data AAIB. the and operator the turer, and engine manufac- aircraftthefromists together with special- - 5% of the total flights (~4 million). Certain critical relationships and behaviours may only become apparent when analysing the whole domain. The investigation was confident of being able to identify unique or unusual features from the accident flight, although the difficulty was then demonstrating the features were contributory or causal to the accident. Where only subsets of data have been available, data-mining results has been augmented with other approaches, such as experiments. In our case, the decision, independent of the data mining, was to conduct an exhaustive series of tests on the fuel itself and the associated fuel system to understand the principles of ice formation and its release. These tests are covered in more detail in papers presented to this conference by Brian McDermid from the AAIB and Mark Smith from Boeing.

The team The investigation benefited from having an aircraft that remained

relatively intact, all the persons on board survived, there were many was especially important that the data group remained appraised 8, 2010 SEPT. WEDNESDAY, witnesses to the accident and data was available from several sources. of the fuels system testing so that analysis models could be progres- However, it was not possible to determine the most likely cause sively modified. without an extensive test and research programme. Early in the investigation it became apparent that the reason for the rollbacks of Tools for the job both engines had been due to a restriction of the fuel flow, but the There have been some efforts to define standards for data mining, lack of physical evidence, apart from cavitation marks on the outlet for example the 1999 European Cross Industry Standard Process ports of the engine high pressure fuel pumps, made the determina- for Data Mining (CRISP-DM 1.0) and the 2004 Java Data Mining tion of the cause particularly challenging. standard (JDM 1.0). These are evolving standards; later versions of In the weeks immediately following the accident, data from the these standards are under development. Independent of these stan- engine health monitoring program identified that both the takeoff dardisation efforts, freely available open-source software systems like fuel temperature (-2°C) and cruise fuel temperature (-34°C) were the R Project, Weka, KNIME, RapidMiner, and others have become at the lower end of the distribution when compared to other flights an informal standard for defining data-mining processes. Notably, made by Rolls-Royce powered Boeing 777 aircraft. A second-by- all these systems are able to import and export models in PMML second evaluation of QAR (quick access recorder) data from the (Predictive Model Markup Language), which provides a standard operator of G-YMMM for about 50 flights also indicated that the fuel way to represent data-mining models so that these can be shared flows and temperatures were unusual in having low temperatures between different statistical applications. and flow rates during the cruise, accompanied with a series of high Boeing and Rolls-Royce utilised the MATLAB application fuel flow rates peaking at 12,288 pph immediately before the restric- produced by MathWorks (http://www.mathworks.com) with the tion of fuel flow had occurred to both engines. operator using SAS (http://www.sas.com). QinetiQ predominantly Although useful, the engine health database consisted of a series used SPSS (http://www.spss.com/uk), although supplemented by of data snapshots taken at various phases of flight, such as takeoff in-house developed applications. and whilst in the cruise. The trigger for the snapshots was not predicated on fuel temperature being at its minimum and although The data the snapshots providing a good indication of cold routes flown by The data sets analysed consisted of the Boeing 777, it could not be guaranteed that the minimum fuel • takeoff fuel temperature snapshots—610,000 flights (11 operators temperature had been captured. The practicable solution was to globally based). evaluate QAR data1, which leant themselves to being manipulated • QAR data from 13,500 flights provided by the operator ofG- by data-mining tools. YMMM ~1,100 parameters. A data group was formed within the existing group system. The • min fuel temperature snapshots from 191,000 flights (mix of group consisted of a team of statisticians from QinetiQ (contracted northern, tropics, and southern-hemisphere-based operators). to the AAIB), together with specialists from the aircraft and engine • fuel flow and fuel temp snapshots at various phases of flight from manufacturer, the operator and the AAIB. The core team of ten was 178,000 flights (mix of northern, tropics, and southern-hemisphere- chaired by the AAIB. In the weeks immediately following the accident, based operators). staff from the AAIB and aircraft and engine manufacturer collocated The takeoff fuel temp was one of the initial data sets analysed. to the operator’s engineering facility at London Heathrow. The team then analysed the QAR data before moving to obtain data from other operators. Strategy The concept of the group was to be able to sit within the existing The analysis process investigation group structure, with the aim of being able to not The process of data mining is well documented, from the initial only identify unique or unusual features of the accident flight, but stages of cleaning the data, selection of analysis techniques to final to explore the data based on requirements from other groups. It processing. When applied to flight data, the process is similar to

ISASI 2010 Proceedings • 43 ISASI 2010 PROCEEDINGS 44 some of the more time and resource hungry techniques, which use to need the circumvent and progressively, data the about of the more complex techniques. This would enable us to learn some to moving before approach simplistic a with start should degrees of complexity. Data-mining experts advised that thein varying options, analysis of number a provided teammining Data Analysis techniquesandresults to engineeringunitsbythedata-miningteam. converted then and format undecoded raw its in taken be to need may data the or processing, and requirements storage of overhead associated the with parameters) 1,100 (all entirety its in taken be to need would data available, been not facility the Had beneficial. was data the pre-processing of capable operator an Having drives. hard portable on distributed continuously.were running data week The a than more took process extraction the data), of columns 350 and rows million 400 than more containing file excel an data to (equivalent of quantity the to Due team. data-mining the with agreed format a in it provide and parameters 350 selected the systems, extracting mining data the for data QAR the prepare to ability the Data (Flight FDM its of support its in data flight of analysis the to dedicated department a had operator The flights. 12,900 remaining the preparing was to erroneousresults. lead may data the of mining before techniques cleaning include to Failure applied. and tested rigorously was filtering parameter analysis, the impair not did excursions parameter random these ing Function) system that provided data to the QAR. To ensure that defect in the QAR itself or the ACMF (Aircraft Condition the parameter. It was unclear if the erroneous data was a result of a of limits practicable the exceeded that value a to instantaneously changed parameters where data of sections demonstrated flights of number small a that was significant most The data. QAR the of quality the with identified were issues Several set. data 13,500 tify potential problems with the data, before analysis of the larger overhead inprocessingtime. to add parametersatalaterdateisbestavoidedifpossibleduetothe set data main the to return to having added, also was systems other from selection a parameters, system fuel and powerplant to addition In available. 1,100 the from parameters 350 about of set sub- a select to team the enabled this and occurred had restriction fuel a that identified had investigation The routes. different some as well as route, same the operated had that aircraft of selection a and flight accident the of consisted and set” “training the termed that forotherdatatypes. Whilst analysis of the initial 600 flights was ongoing, the operator The training set was then used to develop algorithms and iden- An initial 600 QAR flights were selected from the 13,500; this was • ISASI 2010 ISASI Proceedings onitoring program). The department had had department The program). Monitoring Monitor - Boeing 777, as do many other modern aircraft, calculates andcalculatesaircraft, modern other many do as 777, Boeing separately. analysed be could phase each so phases flight or The detect. To this end, the solution was to cut each to flight difficult flight into sections the in later flows fuel peak determinationof make would again which takeoff, at occur normally rates flow contained higher or lower maximum fuel flows. The highest fuel flight other or one if determine to combined be to need would evidentcalculation.besucha in numberanalysisAof methods fuel temperatures ofbelow-20°C. with pph 12,000 and 11,000 10,000, below flows fuel with periods prolonged for operated having flights other few a only of one ing be- flight accident the with results, interesting some provided also similarfeatures. Sometheof work based wholeon flight analysis in itself not unique but sat within a small minoritying the of investigation,flights having where a parameter or statistical measuresimplistic spreadsheet programs. wasThe term outlier was also used dur relevant data sets, which could be extract to readily used be could tools manipulated data-mining The phase. flight each using during more unique perhaps or unusual were that flight accident the by thedata-miningtools. run then and team the by developed later was algorithm robust inaccuracies due to the data having been incorrectly cut. A more containing analysis early with sufficientlythough, accurate not proach phases. It was found that ap- the and descent, aircraft-generated cruise, climb, takeoff, phase into flight was each cut and top of climb, cruise etc. The team took a more simplistic approach climb, climb, initial takeoff, roll, takeoff initial taxi, start, engine pre-start, as such aircraft, modern for defined be may phases 14 to 10 between QAR. Typically the on flight of phase its records nce the data had been cut, it was easier to identify features of of features identify to easier was it cut, been had data the Once high and low fuel flow which would not not would which flow fuel low and high very a both experienced uniquely have both may have been similar, but one may flights, two of flows fuel average paring com- when example, For entirety. its in flight a analysing when features unusual or uniquedetection of theautomate to difficult was It techniques. data-mining available the of some only on touched could beemployedlaterifnecessary. During the investigation, the team team the investigation, the During - with the aim of establishing the uniqueness of features believed to have been contributory to the formation of ice and its subsequent release. A total of approximately 178,000 flights were obtained, being a mixture of Rolls-Royce (35,000), General Electric (1,000), and Pratt and Whitney (142,000) powered aircraft. The process of how the investigation obtained this additional data is discussed later. Initial analysis of a combination of takeoff, cruise, and approach fuel temperatures and flows identified that the accident flight was unique among the Rolls-Royce powered aircraft flights, with 32 Pratt and Whitney powered flights having the same features: • Fuel temperature in the main tanks below 0°C at takeoff. • Fuel flow from the main fuel tanks less than 10,000 pph, and Fuel delivered at less than -20°C and max fuel flow of 10,000 pph. fuel temperature in the main tanks remaining below 0°C during the cruise. • Fuel flow from the main tanks greater than 10,000 pph, and fuel temperature in the main tanks at or below -10°C during the approach.

Further laboratory testing confirmed that adding warm fuel to 8, 2010 SEPT. WEDNESDAY, cold fuel, as would have occurred during the accident flight refuel- ling at Beijing, or taking off with fuel below 0°C, would have had little or no bearing on whether ice was later formed on the inside of fuel feed pipes. The criterion of takeoff fuel was subsequently removed. Removal of this feature left the accident flight among a group of 66 Rolls-Royce powered aircraft flights. Modification of the features based on the accident flight fuel flows Fuel delivered at less than -20°C and max fuel flow of 11,000 pph. and fuel temperature at the time of the restriction having occurred, which for N862DA had also been the same at -22°C, identified that the accident flight was unique among the 35,000 Rolls-Royce powered aircraft flights and only two flights from 142,000 Pratt and Whitney powered aircraft flights had the same features. • Fuel flow from the main fuel tanks less than 8,897 pph, and fuel temperature in the main tanks remaining below 0°C during the cruise. • Fuel flow from the main tanks greater than 12,287 pph, and fuel temperature in the main tanks at or below -22°C during the approach.

Flights having both features Fuel delivered at less than -20°C and max fuel flow of 12,000 pph. • Accident flight • Two Pratt and Whitney powered flights Although analysis tended to focus on fuel flow and fuel temperature features, each of the 350 parameters was also analysed for Flights having similar features as the N862DA incident flight unusual or unique features. Some parameters were identified as During the incident flight of N862DA, fuel temperatures did not re- outliers, but sound engineering knowledge was able to confirm that duce below 0°C until about 3 hours into the flight, when the aircraft they were not contributory or causal to the accident. was in the cruise. Fuel temperatures then progressively reduced to a Test observations indicated that ice could form at flow rates and minimum of -23°C. Unlike the accident flight, N862DA had made temperatures similar to those experienced during the accident four step climbs at fuel flows in excess of 11,000 pph prior to the re- flight. Ice could then be released at a higher flow rate, similar to striction occurring. The third and fourth step climbs both occurred that which occurred during the approach, shortly before the fuel at fuel temperatures below 0°C. The third occurred shortly after the flow had been restricted. Testing also established that water, when fuel temperature had reduced below 0°C and the fourth, just more introduced into the fuel flow at the boost pump inlet at extremely than 3 hours later when the fuel temperature was approaching -15°C. high concentrations, could form sufficient ice to restrict fuel flow The fuel then continued to reduce to its minimum temperature. through the FOHE. During these tests it was concluded that it was About 3 hours later the aircraft carried out a further step climb, with not possible to restrict the fuel flow through the FOHE when the a maximum fuel flow of just more than 11,000 pph. It was during temperature of the fuel in the main tank was above -10°C and the this engine acceleration that engine oil temperature was observed fuel flow was less than 12,000 pph. Fuel temperature at the time of to rise due to a loss of FOHE efficiency. The restriction gradually the restriction had been -22°C. increased over a number of minutes. Fuel temperature at the time Following analysis of the initial 13,500 flights, the investigation was -22°C. Approximately 20,000 Rolls–Royce powered flights were sought to obtain additional data from other Boeing 777 operators, analysed for a combination of a maximum fuel flow of 11,000 pph

ISASI 2010 Proceedings • 45 ISASI 2010 PROCEEDINGS 46 2,000 pph discrepancy (the accident flight had a mismatch of over a than less in resulted had that mismatches detecting of incapable meant that the FMV position and expected fuel flow algorithm was shouldnotedthoughItbethatparameter recording limitations flow. to identify a mismatch between the commandedF maximum fuel flow. An algorithmthe of cases for conducted was G‑YMMM of tor was also developed flight couldbeestablished. accident the of that to temperatures and flow fuel in similarities as be carried out. If other events could be identified, information such mined that a search for previous occurrences of fuel flow restrictions was alsorecordedalbeitonlyontheQAR. valve) which directly controls the fuel flow metering delivered(fuel FMV the of position The QAR. and recorder) data to the engine Control as to (referred command This engine. respective its to flow fuel EE Following the reduction in fuel flow during the accident flight, the The searchforpreviousoccurrencesoffuelflowrestriction flights shared of (0.3%) the percentage same small features. relatively a only although flows, fuel not unique with respect to its combinationincident of fueland subsequenttemperature data and mining N862DA the of identified However, analysis features. same these had thatflights this flight was aircraft powered Whitney and Pratt 142,000 from flights two Just flow during approach while at the lowest temperature on approach. nation of the lowest cruise fuel flow,unique among 35,000 combinedRolls‑Royce powered flights in with having a combi- the highest fuel Analysis178,000offlights identified accidentthat the flight was Unique features maximum fuelflowreached12,288pph. to those attained during the final stages of the approachreleased from the whenfuel feed the pipes at higher levels of fuel flow, similar within the fuel feed pipes. Testing also demonstrated that ice may be showed that at similar temperatures and flow rates, ice can be formed for the stepnormal) was climbs,(which pilot fuelauto the flowsof mode hadspeed notvertical the exceededof 8,897 pph. Testing fueltemperatures had remained below -20°C and, due tothe use at an average fuel flow of about 7,000 pph. During the same period, The accident flight had operated for more than 8 hours in the cruise, Engine fuelflow contribute tothelowfueltemperatureof-22°Conapproach. the accident flight was notconsidered a causal factor; however,it did on experienced temperature fuel minimum the Therefore, flight. in experienced minimum the toward further drops temperature -5°C-20°C.andrateThethataccumulates ice willreducetheas accumulates on the inside of fuel feed pipes at temperatures between identified was -34°C as being of unusual, temperature although fuel minimum testing flight’s accident showedThe that most ice Fuel temperature inflight below. Sixtyflightswereidentified. or -22°C of temperatures fuel and cruise the in when greater and A retrospective analysis of the 13,500 flights provided by the opera- Prior to the N862DA incident on Nov. 26, 2008, it had been deter C ( C • Other than the accident flight, no occurrences were detected. ISASI 2010 ISASI E lectronic oop 17) was recorded on both the DFDR (digital flight flight (digital DFDR the both on recorded was 17) Loop Proceedings E ngineControl) system commanded maximum M V position and expected fuel C system having having system EEC - tion thatcouldnotbedetected. out that other aircraft experienced a lower level of fuel flow restric- ruled be not could it discovered, not were N862DA and G‑YMMM less thana2,000pphmismatch. in resulting restriction initial the to due was This restrict. to started detected by the algorithm until several minutes after the FOHE had not was restriction The occurred. having restriction instantaneous almost than rather progressive a with G‑YMMM, of that to ferent dif- were N862DA on FOHE the to restriction the of characteristics The algorithm. flow fuel expected and position FMV the through processed also was flight incident The found. were anomalies no but analysed manually was flights of subset small A implemented. ship, an automated search of the 13,500 flights could not be readily relation - FOHE and pressure oil engine the of complexities to Due ous occurrences of anomalous oil pressure behaviour was evaluated. relevant totheaccidentG‑YMMM. available for all of the occurrences and they were all for reasons not fuel flow, triggering the of Controlsix occurrences of the program. Nofurtheroccurrencesweredetected. monitoring fleet ongoing its of part as G‑YMMM of operator the by implemented also were methods detection Both pph). 20,000 Where an engineering-based investigation is established, operators, Discussion engine typeswasnotcriticalduring thistypeofanalysis. how frequent certain features could occur, the significance of different and some using different manufacturers. As the team were looking at fied. The AAIB approached all ofmethod was that some of thethe FDM systems could not Rolls-Roycebe readily modi- powered operatorsflights could be 13,500 initial the compared that so information sufficient provided points data directly with the enablednew data.operators A that produced downside was tospecification a data, extractQAR second by second vide ofdata this points using theirToaircraft. powered (142,000) pro- to operators for need the negate FD Rolls-Royce (35,000), General of mixture a being obtained, were flights 178,000 approximately of total A identified. features the of some of uniqueness the determine sought to obtain additional data from other Boeing 777 operators, to QAR datawasreturned. the investigation, the of end the At protected. remained data the and inplace, but were ensured through combinationa ofagreements team. The protocols for protection of the data took some time to put additional data and operator was also included within the data-mining To this end the AAIB was able to demonstrate the need to mine the “Why do you require this much data” and “How can it be protected.” waskeen to assist, but initial questions posed by the operator operator, but data from across its fleet of Boeing 777. The operator were only asked for historical not had team the datainvestigation the of course the During operators. relating to the accident most for one sensitive especially an is data type QAR of release The aircraft from the data fromotheroperators Provision ofQARdataandsourcing Although other flights having similar levels of fuel restriction to to restriction fuel of levels similar having flights other Although Following the incident to N862DA, retrospective analysis for previ- For the previous 10 years, the aircraft manufacturer had records Following analysis of the initial 13,500 flights, the investigation investigation the flights, 13,500 initial the of analysis Following K laws. The measures put in place by the AAIB ensured that that ensured AAIB the by place in put measures The laws. UK EEC system having commanded maximum Electric (1,000), and Pratt and Whitney L oop 17 message.

E xplanations were M systems. The in general, support the provision of QAR type data to accident in- within an aircraft, rather than a laboratory environment, may also vestigators (at least in the UK). Where operational issues are being have different characteristics. explored, the release of data is perhaps more tightly controlled. As the G-YMMM investigation was engineering based, the issue of Lessons learned analysing the data for operational issues was less of a concern. It • Collocation of the team. In the weeks immediately following the may be suggested that if the need to explore operational issues is accident, AAIB, Boeing, and Rolls-Royce data group staff collocated required, the need for a data-mining program as utilised during the at the operator’s engineering facility. This proved to be extremely G-YMMM investigation may be negated by using the operators own beneficial for the following reasons: FDM/FOQA system with oversight from the investigator. Where an --close proximity to the data ensured prompt and easy access. operator does not have an FDM system, it would be more likely that --removed the difficulties of remote working, UK/U.S. time zone. an archive of QAR data would not be available in the first place, as --enabled the exploration of ideas. one of the main drivers for retaining QAR data is that of a FDM/ --number of areas expediently explored, with work being shared. FOQA program. --daily debrief of progress. --negated IT issues of inter company data transfer. Summary --time to build working relationships. The investigation considered the possibility that the rollback on --used operator software to quickly view and analyse data. each engine occurred for a different reason. The fuel feed systems • Team selection. The team consisted of a mix of data-mining

on each side of the aircraft are almost identical and were exposed experts, subject-matter experts (fuel systems and powerplant), and 8, 2010 SEPT. WEDNESDAY, to the same fuel, environmental factors, and motion of the aircraft. flight recording specialists. Moreover, there was a high level of repeatability during the tests to --mix of expertise proved successful, with subject matter experts be- restrict the fuel flow through the OF HE and some consistency in the ing able to steer the work of the data mining experts. ice accumulation and release tests. Therefore the scenario that ice • Duplication of work accumulated within the fuel feed system and subsequently released --AAIB, Boeing, and Rolls-Royce had access to the QAR data, and and restricted the fuel flow through the FOHE is consistent with the each had the ability to process the data independently. rollback on both engines occurring almost simultaneously. --The team had a limited resource and so had to work smartly with The investigation, including the data mining activity of 178,000 regards to unnecessary duplication of work. flights, only demonstrated two engine rollbacks (G-YMMM right --Did not want to constrain the exploration of the data. It was important engine and N862DA) which were positively identified as consistent to remain flexible and allow the exploration of data, not constrain it. with ice releasing from the fuel system and forming a restriction at --Regular progress meetings meant that as wide an area of the data the FOHE. No other mechanism was identified throughout the test- could be explored in the shortest time frame. ing that would have caused a restricted fuel flow elsewhere in the fuel • IT issues system and the subsequent engine response on the accident flight. --E-mail was restrictive in transportation of flight data due to file These occurrences are thus very rare and, therefore, although the size limitations. data for the left engine ceased before it was possible to determine --IT policies regarding usage of non-company-approved software with certainty that its FOHE had become restricted, the likelihood applications. of a separate restriction mechanism occurring within 7 seconds of --WebEx used for dissemination of information. that for the right engine is very low. --Data transfer, portable hard drives and encrypted data. The data mining was successful in its remit of identifying unusual • Program set up—the initial planning phase proved to be time and unique features. Through laboratory testing it was demonstrated consuming. that fuel temperatures at the beginning of the flight were not causal --Agreement for release of data by operator. to the accident, but that other features were conducive to the for- --Selection of data, parameters, flights, etc. mation and subsequent release of ice. It was not fully understood --Elapsed time to prepare the data. why other Rolls‑Royce powered Boeing 777 flights having similar --Data distribution. features to the G-YMMM accident flight, and perhaps more so the --Contract of support by third parties. N862DA incident flight, did not experience similar fuel restrictions. --Cleaning of the data. Laboratory testing did offer some explanation, with the observation --Initial processing. of “randomness” in the formation of ice, indicative that there may --Results analysis. also be a variance in the quantity of ice generated during similar --Subsequent algorithms development and evolution. ◆ flights. Similarly, differences between the G-YMMM accident flight and N862DA incident flight, with one experiencing a more rapid Endnote onset and the other a more progressive restriction, indicate that 1 Parameters recorded on the QAR were available at data rates of up to eight samples per second. The sample rate used during the majority of the data factors other than flow rate and temperature may affect the release mining analysis was set at one sample per second, which was the maximum of ice from within fuel feed pipes. The properties of ice generated recorded rate of the engine and fuel system parameters.

ISASI 2010 Proceedings • 47 ISASI 2010 PROCEEDINGS T safety advisorfor8years. where heheldseniorsafetymanagementpositions,includingaviation analysis, andwaswithAirNewZealandinAuckland, NewZealand, including headofairsafetyinvestigations,systemsand 48 ground proximity warning systems, enhanced GPWS. So the GPWS in 2004weretherenorecorded CFITaccidents. occur. only but average, 5-year declining a shows right, figure, The accidents. CFIT accidents involving commercial turbojet aircraft still tends to dehumanise what are usually complex human performance it as inadequate term this find personally I accident. of “class” a as terrain” into accident.flight “controlled classic Thea was termthis that CFITand hasserviceable fully been used been now had aircraft for the many that was years conclusion obvious The difficulty. without proceeded analysis and playback initial the There ington. Wash- in laboratories NTSB the to taken were they recorders, the with the DFDR and CVR. Zealand New to returned hours few a after and accident) the after Accidents Investigation Washington, together in Board withSafety Transportation National the from Grossi Dennis undamaged. almost recovered were recorder voice cockpit and recorder data flight digital the because straightforward relatively cident site on the slopes of such problems. with confronted not was investigation the aircraft, modern very a considered still was DC-10 the although 1979, in nology.However later-generationtech - involving and systems advanced with aircraft accidents of investigation the for problem a of more even become tional issues requiring technical expertise. This is an aspect that has analyse accidents. and investigate we way the in changes to impetus major a also was the DC-10 impacted the slopes of The Contribution of Safety Reporting One of the advances since 1979 is the development of improved As New Zealand did not have the facilities to play back and analyse ac- the to due difficult course, of was, site on investigation The opera- or engineering by complicated are investigations Many • nvironment, Cobham Aviation Services, Australia By PaulE.Mayes,InvestigationandAnalysis,SafetyRisknvironment,CobhamAviation Services, ISASI 2010 ISASI in the Australasian region—257 people lost their lives when safety.aviation accident aviation worst the of date the was It November28thofhe veryauspicious 1979awas datefor Fellow oftheRoyal Aeronautical SocietyandaChar in Australia andPapua, NewGuinea.Heisalsoa tions and analysis for the Cobham Group Operations Paul Mayesiscurrently managerofsafetyinvestiga- with theBureau ofAirSafetyInvestigation,Australia, He served for 21 years as an air safety investigator tered Engineer, aflightinstructor, andholdsan ATPL. Proceedings And Investigations to Safety Office, arrived on site on December 1 (2 days Mount M ilton Wylie from the New Zealand Air Management Systems Mount Erebus. But the investigation was Erebus in the Antarctic. It - last 5yearshaveinvolvedaircraftwithoutanEGPWSfitted. advanced terrain awareness features. All the CFIT accidents over the the of 1979 that only gave an inadequate 6-second warning to impact in to misinterpretation. open and difficult often was said being was what of determination recordingallthe sounds from thecockpit-area microphone, The the investigations would rely optimum. onAs radio transmissions theare not a recordingsfactor in many accidents, from the that time, onethis arrangement of recording channelhad proved to be less than of case the In stations. channels record the ratio transmissions from each of the three pilot three other The deck. flight the on centrally located microphone cockpit-area remote the by up picked audio the records channel cockpit audio signals in accordance with the FAA specifications. questions, even ifthecrew survives theaccident. aptly called the cockpit audio recorder, is often the key to answering these man beings and human performance. they because answer involve to questions difficult most the often are hu- into rising terrain. DFDR. the evidencefrom the on based without doubt. determination of what was said by which individual was not entirely onthe progress of the passengers flight the and the to sightsinformation to be seen. relayed Hence who the commentator flight one there were five people on the flight deck, four flight crew and So the investigationof the So In the the In In the case of the DC-10, the CVR was configured to record the E rebus case has been replaced by the E eu cs, lhuh h bcgon nie a low, was noise background the although case, rebus The question or questions were why, why, why? rebus and many other investigations up to to up investigations other many and Erebus what happenedwas relatively straightforward The cockpit voice recorder, or more serviceable aircraft had flown had aircraft serviceable A E GPWS of today with its hese These ne One station has been around for a while. Certain maintenance data are transmitted now, and was in the Air France case. However, technology does not currently allow large quantities of data to be transmitted due to bandwidth and cost. When considering that flight recorders have hundreds of parameters recording each second, to transmit that data to a ground station becomes very problematic. One suggestion is to send basic flight information such as the heading, altitude, speed, and geographical location to a ground station on a regular basis. This is an interesting suggestion as it mirrors the original flight data recording requirements introduced in the 1960s, which were for a basic five or six parameters. These proved to be too limited for useful accident analysis. The easiest development would be to lengthen the duration of the locator signals. It has been suggested that the specification should be increased to 3 months. Other options for satellite tracking such as EPIRBs should be considered. Alaska Airlines Flight 261 CVR recovery. Despite ongoing studies for the potential for streaming data to

a ground station during flight, the traditional onboard flight data 8, 2010 SEPT. WEDNESDAY, Although this occurred long before the concept of an integrated recorder will still be the essential tool for air safety investigation. The safety management system, there were elements of SMS already in reasons are the high costs of data streaming and the massive amounts place. One of these was an internal reporting system. The captain of data currently recorded and often needed to understand the of the previous sightseeing flight to the Antarctic on November 14, complexity of aircraft systems. A recent study found that even with 14 days before the accident flight, compared the coordinates of the a 50% reduction in current satellite transmission costs, the price tag navigation beacon at McMurdo and the waypoints that the flight for streaming data could be millions of dollars. Obviously in today’s crew had been given by the Navigation Department. He discovered financial environment this is not the most economic solution to the that there was a significant distance between the two tracks, almost problem. However the technology is available, and there are some 30 nautical miles. He advised the navigation section, which during military and commercial applications already in operation. So like the night prior to the accident flight, “corrected” the waypoints. many of the advances in aviation safety this may well become an Unfortunately the captain of the accident flight was not advised of accepted practice in the future. this change and was expecting the track to take them into the area of Let’s return now to November 1979 and the implications for air the McMurdo sound rather than directly toward Mount Erebus. safety investigation. The investigation was conducted in the estab- As was demonstrated at Erebus in 1979 and many subsequent lished manner, collecting all available factual information, utilising accident investigations, the prompt recovery and analysis of the the resources of the U.S. NTSB, the British AAIB, the equipment recorders are essential for the successful outcomes of complex in- and aircraft manufacturers, the CAA, and the various organisations vestigations. But many accidents occur over water, and the recovery representing the company and the staff. This resulted in a standard of the recorders from the seabed becomes a major exercise. The ICAO Annex 13 report and included a probable cause of the ac- location of the recorders, and in many cases also the location of air- cident. For that time there was nothing unusual in this approach. craft wreckage, depends upon the underwater locator device, which However a royal commission was appointed to enquire into the emits a sonar signal for 30 days when activated by water. Since the Erebus accident. This commission had the advantage of not only mid-1970s missing or damaged recorders have only prevented a full the evidence from the investigation report but also the mandate to analysis of the accident in a small number of major accidents. Out call witnesses from all areas associated with the aircraft, the aircraft of more than 3,000 accidents involving Western-built commercial operation, and the public. With the assistance of counsel: “By the aircraft, fewer than a dozen CVRs and FDRs have not been found time the hearings of the commission had concluded every aspect of according to the International Air Transport Association. And the disaster and its surrounding circumstances had been explored in most cases enough wreckage was retrieved to piece together a by counsel in considerable detail.” However the circumstances of probable scenario, although this could have taken many months the final stages of the approach without the advantage of the CVR and probably did not result in a definitive conclusion of why the and DFDR would never have been known at all. accident happened. The airline witnesses who appeared were intent on establish- Underwater searches were required for 26 aviation accidents ing pilot error as the effective cause of the accident. This was not over the last 30 years. The searches lasted anywhere from 3 days in unusual even in 1979 and late in the 1980s. A review of reports the case of Alaska Airlines Flight 261, which crashed in the Pacific from that time, for example, will show that “pilot error” was still a in January 2000, to 77 days to find the recorders in the Pacific in common conclusion. However, the Erebus Commission went much April 2008. further looking into the company decisions, policies, and proce- Air France 447 is the only commercial aircraft accident in which dures as well as the actions of the board and the middle-manager neither recorder has been found despite an estimated $40 million levels. This was perhaps one of the first applications of the “Reason spent on the initial two searches. model,” which did not come into practice for another 10 years or The research emphasis resulting from the Air France accident is more. But it certainly began the advances in air safety investigation on satellite technology to transmit critical safety information from where we looked back into the sequence of decisions, the training, the aircraft. The idea of sending real-time safety data to a ground and the basic human factors and human performance. Later this

ISASI 2010 Proceedings • 49 ISASI 2010 PROCEEDINGS regarding Airbus aircraft operations.this. These reports were Theonly a small criticalpart of the total reports received step is toprompt corrective action. There may determinehave been several reasons for not appear to have been recognised and certainlythe historydid not ofgenerate the probe issues, yetand Airbus SMS? The interim BEA theinvestigation report documents high risk of these failuresturer does of the pitot probes. France Whathad reported problems to Airbus and Thales, the manufac- are the implications Air fleet. long-range Airbus the on known well were forfailures pitot the Air France reducing accidentsistooccur. staff about safety issues. This must change if the promise of SM in ofthe reasons include cost, and reluctancea tobe open with the 50 S of someincases supplied externalby consultants. Buttheelements have met the letter of the legislation by constructing a SM manual, so easy. However, it has been reported that many smaller operators investigators after an accident. Determining why the SM failed is not ment recommendations. An operator’s SM is an easy target for the line operations safety audits, and safety actions from system improve- finish ofaflightathomeorinthehotel. isstill widespread andeffective. They canbecompleted after the example. for phase, cruise the during report safety a submit to able being as assisted if the reporting process is simple and greatly readily also accessible is such It successful. be to is SM if essential is mindset the benefitfrom reporting something“that did not happen.” Changing verylittle timefor non-operational tasks andnotdoperceive the veryishardachieveto operationalas staffmembers usually have safety.proactive or preventive of utopia the this is practice, This In taken to address these before they become an incident or accident. is action and reported is concern safety or hazard safety any that is situation ideal The ignored. be cannot that occurs event serious a and supervisors will be in blissful ignorance of the real situation until levels. safety improve and risk reduce to improvements the flightline or in the hangar, then we cannot make the necessary “safety” is almost impossible. If we do not know what is happening on be argued that without a good reporting culture, the management of occurrence and hazard reporting and safety investigations. It could safety press and publications. The the classic SM includes elements of safety in read we everything in days these systems” agement the needforadocumentedSMS. and elements various the defined 2009, in 82.5 CAO as Authority Safety Aviation Civil Australian the by introduced eventually tions, regula- The us. of many for place common relatively become had what realised we that 2005 in systems management safety defined management systems have been a way of life. It was not until ICAO development of improved safety of operations. For many of us safety managementsystems” couldconsideredbe thenextstage thein cheese analogy. Swiss so-called the and model Reason the with familiar are most interesting that in talking to flight crews from various backgrounds, iswell known andhas become basica tool forinvestigations. Itis James ReasonandPatrickHudson,amongstothers. of work the through investigation safety for standard the became If we return to the Air France accident, it has been reported that Safety Safety assurance is accomplished through flightdata monitoring, It seems we are bombarded with information about “safety man- If James Reason was the innovation of the 1980s and 1990s, “safety model his of development the and causation on Reason’swork • M ISASI 2010 ISASI S havebeennotrolledSday-to-day toout operations. Some E lectronicreporting is ideal, but the use of paper forms Proceedings anagers Managers

those advances have become entrenched. And while safety today today safety while And entrenched. become have advances those but 2000, year the around place took in performance better safety the airline for change step A needed. are ideas new that and safetymanagementstrategies1990/2000s latedevelopedthe in craft operators have exhausted the advances offered by the earlier investigation sothatsafetylessons canbelearned. unbiased and full a out carries operator the that ensure to systems is also concentrating on auditing the operator’s safety management rely on the ATSB to investigate many serious or significant events. It a greater role in the process of safety investigation as it can no longer indicative of a significant risk. The Civileffective Aviation Authorityanalysis is takingsystemrobust A reports. two or one from obvious isalways not are but essentialtion to filter out the reports that can be and published. factual reports where the operators investigation reports are edited as published is 0.2% Another investigated. are reports of ries out approximately 30 investigationscar ATSBonly the However recorded., get not perdo which of year.many So less than 0.2% average, 8,000 of which are accidents, serious incidents or incidents. result is the ATSB receives around 15,000 notifications per year on performance,weather, aircraft to loading, related andair definitions traffic broad system events.other Theseveral and incursion, runway alert, system warning proximity ground a damage, serious be reported. These include injuries, other than serious, other than to have which reportable, routine called events reportable of class a has also ATSB The types. event other several amongst runway a exhaustion, undershooting, over running or running of the side of fuel failures, engine uncontained runways, occupied or closed on things as airprox, violation of controlled airspace, takeoff or landing has a list of further immediately reportable events that include such injury, serious damage , or missing aircraft. However, the ATSB also Annex 13, are immediately reportable including a death or serious requirement. Any accidents or serious incidents, as defined by ICAO ernment safety investigation agency that has a mandatory reporting as theywerelackinginNovember1979. were not followed or were incomplete. Communications are the key, The investigation often finds that change management procedures are related to changes in procedures, processes, or documentation. becomes a difficult judgement issue.The concern of a line pilot may be an isolated instance and then it Very often these safetytive (pre-emptive) safety concerns can be much concernsharder to risk rate. proac- consistently.However,other reasonably rated are and risks be essential in this process. Some types of occurrences have obvious interpretation. to open ofresponse. Risk ratings areused asthemain level tool, butappropriate these the are with treated are circumstances, right the in ensure that the reports that could be indicative of a critical failure, sidered other than minor, low risk. The most difficult task is how to year.per reports safety tional opera- 1,000 expect could aircraft jet 40 of operator an example, safety concern, it is not always successful. any of reporting open encourage we From Although staff. my by experience,identified for a safety management system. potential for a catastrophic outcome. This is a fundamental step in and reports more or one with associated level risk and severity the Analysis of serious accidents indicates that many established air established many that indicates accidents serious of Analysis investiga- warrant that issues be will there reports, many so With gov- the is Bureau TransportSafety Australian the Australia, In Thereshortagenois occurrenceof reports andsafety hazards xperience and corporate knowledge can can knowledge corporate and Experience f these less than 5% would be con- be would 5% than less these Of evel 5 5 Level - - is at an al-time high, improvements in the safety rate stopped in that they should really have been able to handle successfully. The the mid 2000s. The plateau marked a departure from a century year 2009 was no exception. Examples last year include the Turkish of aviation safety that had shown a steady improvement since the Airline Boeing 737-800 at Amsterdam, the Colgan Air Bombardier Wright Brothers. Q400 at Buffalo, New York, the FedEx Boeing MD-11F landing A review of serious accidents in 2009 shows that most were pre- accident at Narita, Tokyo. Notice that we are not using the term ventable. If accidents are analysed by broad category, then runway “pilot error” but rather looking at the human performance issues, excursions and incursions, and loss of control, are the main types of the system designs, the training, and lack of understanding of the accidents in recent years. If we look at runway excursions, the major- degraded states of the automation. Hence the lessons from Erebus ity can be linked to poor decision-making, breakdown in SOPs, and in 1979 are still very much part of safety investigation today. poor CRM. Most occur off an unstabilised approach, which results in In aviation we are very proud of our safety record and the advances landing long and fast. If we look back 10, 20, or 30 years, we see the in safety over the years through technology and improving human same symptoms and the same results. Why didn’t the crew execute a performance. We are often compared with other modes of travel, missed approach rather than persevering with a bad approach? The and depending how you analyse the statistics, aviation comes out as investigations have not had the optimal outcome of safety actions the model for safety. However, as many analysts have commented to prevent these reoccurrences. we may have reached a plateau, and further improvements may be Dr. Tony Kern believes there is a need for check and training organ- very hard. isations to reinforce basic flying skills so that pilots fly accurately and In conclusion, in the 30 years since the worst accident in the

do not accept deviations from target speeds, localiser and glide slopes, Australasian region, there have been many important advances in 8, 2010 SEPT. WEDNESDAY, and the required stabilised approach criteria—basic flying skills we technology, in systems, in understanding, and influencing human were all taught during our training. There is a train of thought that behaviours and in safety assurance. However, it appears that we we are not as diligent in our aircraft operations in an automated flight have reached a plateau in the quest for improved safety. We still deck as we were in the previous technology flight decks. have accidents that have the same elements of many previous ones What is beginning to evolve is the complexity of flying highly and should therefore have been preventable. There is no shortage automated aircraft when the automation starts to fail. What is ap- of reports, but the challenge for safety investigators is to have ef- parent from some situations is that the failure modes and degraded fective investigation findings and actions so that we can eliminate status of some automated flight decks can be very confusing. It would accidents such as runway excursions, loss of control, and CFIT once appear that the designs do not provide as much help or guidance and for all. ◆ to the flight crew as they should. With multiple failures or erroneous data inputs generating various confusing, opposing signals, the References automated systems should ideally review and advise the flight crew Office ofA ir Accidents Investigation, New Zealand Ministry of Transport, McDonnell on the most optimum response. Also although modern flight decks Douglas DC-10-30 ZK-NZP Ross Island, Antarctica, Nov. 28, 1979. Report of the Royal Commission to Inquire into the Crash on Mount Erebus, Verdict make a positive contribution to safety performance, pilots are not as on Erebus, Peter Mahon. practised at manual flying as they used to be so that flying aircraft Flight Safety Foundation Aerosafety World. that have reverted to raw flight and navigational conditions becomes Australian Transport Safety Bureau Level 5 Factual Investigations, Issue 1. Civil Aviation Safety Authority CAO 82.5. too demanding in difficult situations. Since the year 2000 serious Transport Safety investigation Act 2003 and Regulations. accidents have frequently involved pilot failure to manage situations Flight Discipline, Anthony Kern.

ISASI 2010 Proceedings • 51 ISASI 2010 PROCEEDINGS Working Party Follow-up onLessonsfrom Accidents. Safety andReliabilityDataAssociation)ischairmanoftheESReDA 2000. HeisamemberoftheBoard ofDirectors ofESReDA (European the secretary ofITSA(InternationalTransport SafetyAssociation)since eral coursesinaccidentinvestigationandforensic medicine.Hehasbeen School ofAviation ofLund UniversityinSweden.Stoophastakensev- University ofTechnology andholdsapositionasguestprofessor atthe an associateprofessor onthefacultyofaerospace engineeringattheDelft 52 of limitstatescenarios. testing and simulation, model system virtual prototyping, requires Third, designing safer solutions in a multi-actor systems environment space. solution design the of expansion on focusing interventions interventions within the existing design envelope and second order two design in classes distinction a is required. Second, modeling. systems A distinction and modeling isevent made between linear investigation methodology. First, disengagement is required between should beappliedinamission-specificoperatingenvelope. approach design engineering systems full a perspective, multi-actor a in interactions socio-technological with cope to order In solutions. linear to limited is practice in potential intervention their pretations, their conceptual limitations. Due to their simplifications and lay inter revealed has industry aviation the in Application sector. energy the hierarchy. system on model Rasmussen the or model causation Cheese Swiss suchmodels, the majority reviewing proves In models. of diversity wide a to to exposed be is factors a human derivate from the Reason’s particular,of In investigation aspects. the investigation and domains, applications, industrial specific to dedicated models of variety wide a show models investigation accident existing on surveys of series A Abstract Sidney DekkerCriticalThinkingAward. Boeing 737NGasan airlinepilot.TheOSUFoundationawards ayearly and JustCulture:BalancingSafetyAccountability. He flies the And theNeedforaSystemsApproach Such an approach is submitted to three paradigmatic shifts in in shifts paradigmatic three to submitted is approach an Such Limitations of ‘Swiss Cheese’ Models • available Photo Photo ISASI 2010 ISASI not not

By JohnStoop,DelftUniversityofTechnology, LundUniversity, andSidneyDekker, LundUniversity ost of the models origin from the process industry and and industry process the from origin models the of Most

establishing the safety board in the Netherlands. dent multimodalsafetyboards He andwasinvolvedin is the developmentofaconceptualmodelforindepen- methodology. HecooperatedwithRAND Europe on focusing onthedevelopmentofaccidentinvestigation relation toengineeringdesignandsafetymanagement, John Stoopisinterested inaccidentinvestigations Proceedings Field Guide to Singapore, andEngland.Hisrecent booksincludeThe the UnitedStates,NewZealand,Netherlands, and Systems Thinking. He has worked in Australia, forComplexity of theLeonardo DaVinciLaboratory a professor atLundUniversityinSwedenanddirector Sidney Dekker(Ph.D., Ohio State University, 1996) is U nderstanding Human E rror - investigations. investigations. and institutional conditions for independent and qualified accident systemsengineering designapproach, analytical forensic abilities This framework is based on a new view on humanis described, error,derived from experiences in a the dynamicaviation industry itself. 1991; Sklet,2004;Katsakioriet al,2008). investigation methods should be explicitly taken into account. (Kletz, limitations and mutual dependence between causationpragmatic modelobjections, and during the conduct ofaninvestigation, the accident models in existing programs (Benner, 1985). Due to these are conceptually flawed because of the inadequaciesmethods. analytical formal from results of underlying the on than more judgment, practical and experience on analysis their base to need deal great a to investigation, accident their in regulators and government on focusing investigators, that means and development of the inherent hazards. Sklet concludes that this andtechnical systems levels and exclude the technological nature tions (Sklet, 2004). apply, resulting in an increasing amount of varieties and simplifica- accident modeling based on the Reason model proved difficultof the whole system to (Roelen et al, 2009). In practice, however, such representation a toward events sequencing from investigation the models (Katsakiori et al, 2008). The evolution expands the scope of accident systemic toward models accident processing information man error modeling, from a sequential accident model, via human development of accident modeling shows three generations of hu- accidentserrorswhichandcontextoccur.fullgradualin the A Hollnageltakennextstepwasbya identified who systemthe as Reason developed his model on organizational accident causation, observable elements of the system: perceptions and decisions. While non- the on focused They events. of causality the determining in information process people how about concerned were Glendon top management is needed. Based on attribution theory, Hale and of involvement proactive a interaction, such avoid to order in and failures; active and latent between interaction an as accident ing deviation concept. and Iceberg Principle and Domino Theory. In a second generation, Bird by Heinrich, referred to accident analysis by metaphors, such as the 2004; tion of models by lay people (Benner, 1975, 1985, 1996, 2009; Sklet, cal basis, absence of a systems approach, and a focus on the applica- indicate consecutive generations of models, their poor methodologi and deficiencies reveals several schools scope, assumptions, methodological their on reflection a practice, of modeling. in scale large Severala on applied surveysbeen have models accident Although Accidents and causation Based on these constraints, a framework for safety enhancement Over a period of about 20 years, the Swiss Cheese model of Reason L ESReDA, 2005). The first accident causation models as derived oftusapplied a linear causality, while Kjellen introduced the Most of the models restrict themselves to the work Multi-causality was introduced by Reason, defin- uch of the accident data data accident the of Much - particular significance that hypotheses can be validated and falsified during the investigation process. If not, it requires additional losses to validate hypotheses and to permit a pattern recognition or statistical analysis (Benner, 1975, 1985). Finally, such modeling and accident phenomenon perceptions do not comply with the needs of investigators: a translation of human error models to practical investigation tools is still in its early phase of development (Benner, 1996; Strauch, 2002; Dekker, 2006). Investigation methods should support the visualization Figure 1. Reason’s “Swiss Cheese” model of organizational accidents. of the accident sequence, providing a structured collection, organization, and has gained popularity among many accident investigators and has integration of collected evidence, identification of information become a benchmark of investigation practices. In particular, the gaps in order to facilitate communication among investigators

transformation of the concept of hazards, mitigation strategies, and (Sklet, 2004). 8, 2010 SEPT. WEDNESDAY, managerial intervention capabilities into a communication meta- Developing such methods in the domain of human behavior will phor has supported the dissemination, providing transparency into require a shift of focus from inferred and uncertain states of mind risk management for lay people and practitioners (see Figure 1). toward characteristics of human factors (Dekker and Hollnagel, 2004). Rather than allocating the cause of an accident to human The Reason model error by complacency, loss of situation awareness or loss of control, The widespread application of the metaphor however, also has raised the analysis could focus on falsifiable and traceable assertions, concern from a scientific perspective and has raised questions on linked to features of the situation and measurable and demon- the application as an analytic tool dur ing accident investigations strable aspects of human performance (Dekker and Hollnagel, (Dekker and Hollnagel, 2004; Leveson, 2004; Young, Braithwaite, 2004). Rather than focusing on hypothetical intervening variables, Shorrock. and Faulkner, 2005; Dekker 2006). Also Reason and more manifest aspects of behavior should be recorded during an Wreathall, who created the metaphor, have some concerns about investigation. While accuracy and comprehensiveness are rarely the practical application as an analytic tool. criteria for explanations, plausibility and credibility are. In addition, Concerns of the Swiss Cheese metaphor applied as an investiga- it becomes a necessity to shift the focus from the performance of tion model can be categorized as an individual toward the performance of a joint system, according • Remote factors have little causal specificity, are mostly intractable, to the principles of systems engineering. The analysis should look and have no predictive potential. Their impact is shared by many at the orderliness of performance rather than the mental states of systems and shift error up the ladder and do not discriminate be- operators. If such an orderliness of performance breaks down, this tween normal and deviant system states or take system dynamics can be the start of further hypothesizing and investigations. This into account. raises questions about the rationale of why the performance seemed • There are no stop rules in the expansion of the scope. The more reasonable to the operator at the time of the event (Dekker, 2006). exhaustive the inquiry, the more likely it is to identify remote factors. Such a shift toward the systems level in identifying new knowledge As such, it is a representative of the epidemiological school of think- during air crash investigations has been proposed by Benner, ap- ing, dealing with a linear agent-host-environment model. plying an event-based analysis, defined in terms of relations among • It assumes technology as a constant, and focuses on barriers, rather events, set in a process and operating context. Such an approach than hazards, reducing risk management to a control issue, not a permits a distinction between knowledge of systems processes and systems adaptation and redesign issue. It lacks resilience and adapta- their operation and knowledge of the accident process. Such an tion on the level of systems architecture and configuration. event-based analysis should be favored because of the amount of • It does not deal with uncertainty and knowledge deficiencies, nor new knowledge discovered, the relative efficiency of the search, and does it take into account the variety of operational conditions and the timely availability of corrective action guidance. Such knowledge systems states expressed in an encompassing operating envelope. can provide more valid indications of comparative performances As such, the model is linear and single-actor based in its control and events (Benner, 1985). potential, not taking into account a systems perspective and a multi- actor environment. The Rasmussen model • The model is normative and deals with implicit standards of per- Rasmussen takes this modeling issue one step further (Rasmussen, formance by compliance with rules and regulations and a norma- 1997). He distinguishes the stable conditions of the past versus the tive concept of failure instead of recovery and reliance on human present dynamic society, characterized by a very fast change of tech- performance capabilities. nology, the steadily increasing scale of industrial installations, the Similar to a technical toolkit for repairing technical systems, an rapid development of information and communication technology, accident investigator has to be able to choose proper methods, and the aggressive and competitive environment that influence the analyzing different problem areas (Sklet, 2004). This raises the is- incentives of decision-makers on short-term financial and survival sue of ethics involved in selecting an investigative method. It is of criteria. In answering the basic question: Do we actually have ad-

ISASI 2010 Proceedings • 53 ISASI 2010 PROCEEDINGS 54 recognized from free is that employment of place a employees his workers. protect to ability tiontheof“general dueclause” andhasenhanced theregulator of the system. The fast pace of technology has lead to the introduc- capability,control state actual the about available information and criteria performance objectives, their controllers, including tified, For a particular hazard source, the control structure must be iden- and by giving opportunities to develop coping skills at boundaries. the focus should be on making the boundaries explicit and known nisms. Rather than striving to control behavior by fighting deviations, has to dig deeper to understand the basic behavior-shaping mecha- errors is considered not effective for understanding behavior. control. cognitive of concept logical psycho- the and management concept social the decision-making, and value system, a convergence occurs of the economist concept of context social the from separated be cannot and rational only not are environment dynamic and complex a in made decisions Since control structure, embedded in an adaptive socio-technical system. a is concept management risk His concepts. theoretic control on based approach systems-oriented a by top-down, but disciplines, individualthe researchin fromderivedmodels aggregation of tion to change. System models should be built not by a and subjective bottom-upcriteria guiding adapta- of acceptable performance, shaping mechanisms in termsbe should errors human of terms work system in constraints,deviation occasional and sequences action on boundariesfocused analysis task Therefore, decomposition. structural than rather abstraction he argues, requires a system-oriented approach based on functional involving all levels of society for each particular hazard category. This, be a control problem and serving to represent the control structure to management risk considering studies, cross-disciplinary by eled mod- be should management Risk sources. hazard particular their and systems across generalizing by done is modeling that states he equate models of accident causation in the present dynamic society, Figure 2. Rasmussen’s systems hierarchy modeling. • ISASI 2010 ISASI Proceedings ach employer “shall furnish to each of of each to furnish “shall employer Each by a model of behavior- of model a by replaced odeling task sequences and and sequences task Modeling ne One protection • sources andaccidentprocesses. particular,focusedoncontrolis reasonably well-defined hazard Safety accident. major latest individual, the of analysis to response in improvements design from evolve systems Safety accidents. evidence from pastevidence. is work low.extremely be operations even if the probability of a stochastic during coincidence has to empirically verified be will and can individually defenses defenses.Theassumption thatistheprobability failureof the of designed the all of violations simultaneous involves then accident accidentof processes probabilityand occurrences.of full-scaleA Design and operation must be based on reliable predictive models accidents. between mean-time large very the to due accidents past empiricalguidedbyevidencedesigncannot cases,bethefrom assumptionsthepredictionof thenbecome specifications theof and preconditions, the model, process the accepted, been has risk onstrating an acceptable overall risk dem- toanalysis risk predictive a of basis the on accepted society.only is riers When the predicted based on a stable system, then the protection of structure functional the againstby bounded well is anatomy majorthe When accidents can be material. hazardous of containment of loss material, inflammable of large accumulations of energy, from ignition of accumulations of Rasmussen identifies only a limited series of hazards: loss of control accidents. of anatomy the and source hazard the of nature the on depend classification for taxonomy a of dimensions The system. information and policy management proper a select to order in riskmanagement strategies classificationanda hazardof sources of the hazard. be oneliminationofthecausesrelease ofthehazard. particular circumstances are at stake, the basis for protection should It therefore should be useful to develop more focused analytical Defenses can be based on predictive analysis. The design of bar derived from the system design assumptions, not from empirical empirical from not assumptions, design system the from derived termination termination of the flow of events after release of the hazard. against onitoring the performance of the staff during during staff the of performance the Monitoring protection • logical studies of past accidents. typically controlled empirically from epidemio- smallaccidents. averageThesafetylevel of is occupational • individual accident: connectedthemagnitudeloss totheof and characterizedtheirfrequencyby accidents of sources, three different categories are defined, (See Figure2.) formally“ethicalconsideredaccounting.”by relevant stakeholders are to be adequately all of values and andobjectives the on decisions of through society and organizations. The impact down values of communication of means tive explicit formulation of value criteria and effec- position during the assessment. This requires an the line organization and loses its independent this way, the safety organization is merged with part of normal operational decision-making. In decisionintegratedbecomesmakinganand becomes just another criterion of a multi-criteria objectives, safety By stating safety performance hazards that may cause death or serious harm.” very Depending on the nature of the hazard hazard the of nature the on Depending

rare and against unacceptable safety, medium-sized, focusing accidents. on frequent infrequent In When When such but -

parameters of risk management. Preconditions and assumptions ing have seen different points of departure. On one hand there is a must be explicitly stated in a Probabilistic Risk Assessment. In this bottom-up approach in occupational risk and road safety: preven- view, fortunately, it is not necessary for this purpose to predict per- tion of accidents, separating process safety from personal safety. formance of operators and management. When a plant is put in Focus on isolated causational factors and single-actor strategies operation, data on human performance in operation, maintenance, (corporate management or the three E’s of engineering, education, and management can be collected during operations and used for and enforcement. On the other hand, a top-down approach is ap- a “live” risk analysis. Thus, predictive risk analysis for operational plied in aviation, railways, and shipping aiming at systems change management should be much simpler than the analysis for a priory and learning without separation between personal safety, process acceptance of the design. Such performance data can be collected safety, external safety, or rescue and emergency handling (ETSC, through other sources than accident investigations; incident analysis 2001). Modeling accidents by decomposing accidents into a limited and expert opinion extraction may compensate for the lack of abun- category of hazards and a predefined set of generic failure types dant accident data. According to Rasmussen, the models required deprives the analysis of three major components. to plan effective risk management strategies cannot be developed by First, learning lessons for prevention of similar events. Prescriptive integrating the results of horizontally oriented research into different fea- modeling of accidents forces the decomposition and description of tures of hazard sources and systems configurations. Instead,vertical the event into the format of the model. It also forces the event into studies of the control structure are required for well bounded categories an assessment of the correctness of the event in terms of compliance of hazard sources, characterized by uniform control strategies (Ras- with the models normative assumptions and notions. In particular

mussen and Svedung, 2000). with human error modeling, such normative assessment remains 8, 2010 SEPT. WEDNESDAY, implicit and obscures an explanation of the behavior, based on Expansion toward “real” models motives, conditions, constraints, and context. Prescriptive modeling In accordance with the desire to create more encompassing models denies local rationality at the operator level. In particular where in a dynamic environment, the Reason and Rasmussen model are pilots, mariners, and drivers have their discretionary competence, superseded by a new series of risk management models. In shifting such modeling rather obscures than clarifies human behavior in from accident investigation to other system performance indicators high-tech operating tasks. Their adaptive potential to new situations and their data on a daily basis, there is a need for modeling all pos- and ability to respond and recover in a flexible manner is the basis sible causal event sequence scenarios in order to understand what of their learning. It is a part of their internalization process of pro- is happening. Such an analysis should include technical, human, cessing experience into knowledge. In a normative assessment, the and organizational factors, deeming the Reason model to be insuf- operator is assumed to have a timely and full transparent oversight ficient, due to its theoretical and partial modeling and the amount over all the available information, systems properties, and of all his of occurrences that have to be processed every day (Roelen et al, actions and their consequences. Such an investigator hindsight bias 2009). There is a need for “real” models, covering every aspect and obscures the decision-making in uncertainty, which the operator systems level, requiring a substantial mathematical background and is submitted to in practice (Kletz, 1991; Dekker, 2006). Such an user friendly software tools. Such models should incorporate fault analysis in which operator performance is assessed against normative trees, event trees and influence diagrams, which were adopted in the behavior is in contradiction with learning theory. In particular, in nuclear power industry in 1975. Sophisticated PRA methods should complex high-tech systems, such a assumptions of full and transpar- provide establishing a relation between cause and effect, while influ- ent information supply is not realistic and hence in conflict with ence diagrams should represent the influence of the context. Since bounded and local rationality theory. airline safety analysts, safety managers, and chief pilots have detailed Second, cross-corporate dissemination of lessons learned. In the knowledge but fail to identify systemic shortcomings, a framework Durkheimian and Weberian tradition, social sciences copied the no- is needed to help them to see the whole picture. Most of the effort tions of the most prominent scientific domain of the 19th century, the is in classification of the data entry, with relatively little effort spent natural sciences, to mirror themselves to their merits and to surpass on analysis (Roelen et al, 2009). Such a “real” model should be them by adapting their methodology (Matthews, 1978). This mecha- integrated in order to represent the complexity and interdependen- nism in establishing scientific esteem seems to be repeated in the 20th cies, should be quantitative and transparent, and should provide century, by mirroring management control modeling against engi- reproducible results, covering the whole aviation system. neering design principles. In 1972, the psychologist Edwards claims This approach does not favor the introduction of new concepts or a more prominent role for the behavioral sciences in the integral models. The concepts of Dekker to see socio-technical complexity design of aircraft and postulates the HELS model (Edwards, 1972). as a web of dynamic, evolving relationships and transactions or the A “traditional” focus on technical components should be unjustified, Leveson concept of systems as interrelated components that are in the “linear” design method an anachronism. This claim is even more a state of equilibrium by feedback and control are not considered interesting because it is stated at the very moment of the development useful (Roelen et al, 2009). The aviation industry should be too and roll-out of the major aviation innovation at the time: the first of conservative and too slow responding in accepting new ideas, while the widebody generation of commercial jet aircraft, the Boeing 747. Reason’s Swiss Cheese model is still relatively new. An event model In his plea for involving psychology into aircraft engineering design, that fits current practice should make more sense than develop new Edwards also criticizes accident investigation in aviation: the value models with a completely different concept, however correct these should be limited, the frequency too low to draw useful conclusions, concepts might be (Roelen et al, 2009). while the complexity should prevent an adequate analysis. Edwards follows the criticisms of Frank Lees in 1960, who did not se an added Modeling accidents value for accident investigation in the process industry (Lees, 1960). Across the various domains, accident investigation and event model- Frank Lees shift a preference toward incidents, loss control, and risk

ISASI 2010 Proceedings • 55 ISASI 2010 PROCEEDINGS continuous • entities inthetransportmodesareinternationalbynature. structure in the process is industry of a multinational nature, while spective, dealing with fixed sites on a stand-alone basis. A company is allocated to the corporate level from a top-down managerial per pendent actors and stakeholders. In the process industry, risk control de- mutually of network dynamic a in managed value, governance catastrophic failure isdifferent. of consequences the Consequently,managing mass. and speed to inherent releases energy kinetic to exposure creating occur, will a wide variety of events in a rapidly evolving operating environment loss of containment, and health problems. In the transport modes, explosion, fire, as such events, critical and hazards of set limited a velopment, while the conversion of material properties produce only process industry, there is a more restricted pace of technological de of the network, interoperability, and reliabilityharmonization forand standardization allcreates actors.the basis for Inaccessibility the aptation. In the transport modes, rapid adaptation by technological the • requirements ofapermanentavailabilityproductioncapacity. reconfiguration, adaptationand specific of products without the shutdown, temporary for room creating organization, production process industry operates on a supply basis, facilitating intermittent individualand globalservicesleveltheofnetworks,at while thedirect providing basis, demand 24/7 a on operating are dustries 56 Aviation at the level of international institutes suchon technological improvements asand theopen exchange of International information Civil focused is learning supply.This power nuclear or industry process and sectorial level, not on national or corporate level, such as in the international the at place takes therefore, aviation, in accident an network. global the to access open and demands, mutual harmonization and standardization, high-level performance open transport network that can function exclusively on the basis of global, a is aviation international However, potential. explanatory lack and descriptive be only should investigations Accident well. as only be based on negative management.experiences, According insteadto of positive experiences there • to beallocatedthevariouscontrollevelsofsystem. of operations are required andsuch asintheprocessindustry. Consequently, variouscognitivelevels various delegated responsibilitiesplaceable for decades, if full automation is ever desirable and feasible, have irre- be will operations human-centered of concept the modes, port closed • in systemarchitectureandcharacteristicsbetweenthesectorsare and the various transport modes. The most prominent differences the transportationsector. high-technology and knowledge-intensive industrial sectors, such as other in applicable generically are industry process the of teristics a legitimate question, however, to see whether the inherent charac- elaborated by Reason and Rasmussen for the process industry. It is by defined as paradigm the from derived been transport system. public a as existence its to due community transport international the for prerequisite a is value company.societal national a as Safety multi- private, the of level the to learning limiting and inspection There are fundamental differences between the process industry Third,itsspecific analytic potential. • ISASI 2010 ISASI role are versus O of rganization(ICA differences the versus open human Proceedings systems. intermittent in operator the E O dynamics dwards, accident investigations should In ) insteadnational)of governmental public is fundamentally operations. and transport M odelingofaccidents has pace of The ees and initially initially and Lees different. safety technological earning from from Learning transport is a In public trans- ad- in- - - simulation environment. Complex • stand-alone systems simple, to applicable deviations, of elimination regulations, and reallocationby factors,ofstringentmore compliance ruleswith space design the reinforce interventions Such variables. of set limited the among aspects of sacrificing with values have limited ranges, and optimizing within these values deals their small, is variables design of number the small, is solutions of allowrestricting the design space. This is valid only if the number test • developprototypes ofnewsolutions. • change variables. make • evidence andscientificresearch. statistical and empirical undisputed on based variables, planatory provide • ible scenarios. • causal relations. • (Stoop, 1990;DymandLittle,2004): methodology design engineering an applying by place first the in a redesignofthesystembecomesnecessary. When first order solutions have failed and did not prevent an event, prototypes, applicabletocomplexandembeddedsystems. the functional design phase by developing conceptual alternatives and and simulation. Such an expansion of the design space occurs space design the of expansion an Such simulation. and involvement of actors, aspects, teamwork, communication, testing, sub-solutions, of synthesizing and reconfiguration components, to lutions focus on concepts and morphology, reallocation of functions dynamic problems demands expansion of the design space. Such so systems perspective,thelattermightbecase. socio-technical a toward strategies control managerial from shift a modes andshouldbereplacedbyanotherconcept. transport of investigation accident for inappropriate is such as ing for accident investigation and should replace metaphors or model- managerial level of safety decision-making processes are appropriate Linear • classes: specifications basedonforensicengineeringprinciples. space and the use of empirical evidence as an input for safety design solution design the of identification account: into taken be to are resilience engineering in practice (Hollnagel et al, 2008)? Two steps investigation methodology? How do we substantiate the concept of we substantiate such an engineering design approach in the accident what does this mean for the accident investigation process? How do level, socio-technical the at safety to approach design engineering an applying toward strategies control managerial from shift we If Toward newconcepts about raised are questions fundamental two solutions, safer designing In Designing safersolutions recompose the event by synthesizing safety critical variables into cred- to identifycontributingto theirvariables and event the decompose Inorder to achieve such redesign, the event must be redefined In overcoming present limitations and the necessity to achieve achieve to necessity the and limitations present overcoming In It therefore is a legitimate question whether formal models on a Safety-enhancing interventions can be categorized in two main main two in categorized be can interventions Safety-enhancing the the

interventions prototypes to the scenarios by identifying their ex- their identifying by scenarios the to rigor analytical

interventions transition by

fromexplanatoryvariables toward control and and in a virtual virtual a in scenarios accident the to exposure and

first second

order

solutions. order in the detailed design phase phase design detailed the in

solutions.

Simple

problems Complex in -

• how to design safer solutions? • a technical perspective dealing with a reconstruction of the physical • how to generate the requirements for such a design? system performance. In contrast with linear interventions and first order solutions, in • a behavioral perspective dealing with the reenactment of decisions complex systems there is no direct relation between a single con- and discernable actions. tributing factor and its remedy. In redesigning safer solutions, there • a systems perspective dealing with the reconfiguration of the systems are three different focus groups for communication of the safety state and operating environment. solutions: operators and actors within the system able to achieve In order to create a common understanding among actors a a safe performance, knowledge providers for a better understand- common language and common notions are necessary. In risk ing of the system behavior, and change agents, able to govern and discussions, the perception and acceptance of risk varies across control the system. Each of these parties has a specific set of com- actors, dependent on their position and interest. They may apply munication means, applying respectively metaphors, models, or either a frequentistic or a scenario approach, dealing with either prototypes. Each of these parties applies its own vocabulary and the frequency or the consequences of an event, a technological reference frameworks but should share a common notion in the or a sociological approach, or may apply a rationalist or an em- end by a common means of communication. Applying a “barrier” pathic approach (Hendrickx, 1991). These different approaches notion is a powerful communication metaphor but does not help in each have developed their own notions and language. In order the case of a scientific modeling of the issue or applying a prototype to be able to communicate, there is a need for either a common in testing a solution. language or a translation between these languages. This implies

Synthesizing solutions is necessary in order to establish a shared an understanding of each of the languages in the first place with 8, 2010 SEPT. WEDNESDAY, solution, based on the credibility, feasibility, compatibility, and respect to its linguistics, syntaxes, grammar, and vocabulary. De- selection of preferred alternatives in order to create consensus composing such a language identifies the elements and building among all parties involved in accepting the solution. Synthesizing blocks of the language and facilitates analysis of their meaning is about recreating interdependencies into a new concept, network, and usefulness. For communication purposes, however, a language or configuration based on shared values. Complexity then can be cannot be spoken at such a decomposed level. A recomposition defined as the interdependences of variables, choices, and design of these elements and building block takes place into a more assumptions. To deal with this complexity, it is not sufficient to complex communication structure to facilitate meaningful con- decompose a system or event into its contributing variables and versation. In an analogy with music, poetry, and literature, such a explanatory variables within its existing solution space, but also the communication language is also applicable for accident analysis. design variables must be identified in order to serve as input for the The scenario concept provides such a common language, creating systems engineering design process. event narratives that form the basis for common understanding In addition, dealing with complexity and context is not adding and agreement on the description of accident phenomena in more detail and levels to an event by increasing the decomposi- their context (Stoop, 1990). Achieving consensus on such action, but providing transparency at higher systems levels with respect cident scenarios provides a basis for a common risk assessment to its functioning and primary processes, and clarification of the and shared solution space. conceptual properties, its configuration and composition. Increas- ingly complex accident modeling such as Accimap or STAMP do not Shared solutions, redesign and prototyping make the transition from the event toward systems characteristics In complex interventions, the focus is on events in a systems context (Rasmussen and Svedung, 2000; Leveson, 2004). If the inherent rather than on isolated factors and generic aspects, such as is the case properties of a system are not identified during design, they will with linear interventions. The reconstruction of events takes place manifest themselves as emergent properties during operations. Such by identifying and synthesizing explanatory variables into scenarios properties are to be specified by stakeholders, actors, and other par- in their specific operating environment and constraints. Such syn- ties that are to be exposed to the systems operational consequences thesizing is primarily evidence based. The redesign of the systems is and formulated in an overall Program of Requirements, leading to conducted along the lines of engineering principles by generating design specifications. design alternatives in the enlarged design space into the form of To assess the integral performance of the system, a synthesis a limited set of prototypes. These prototypes contain a relocation should take place of all aspects in an encompassing Program of Re- and addition of functions, changing the morphology and configura- quirements. Such a Program of Requirements becomes a consensus tion and incorporate additional actors and aspects. The testing of document, in which all actors involved have had the opportunity to these prototypes is conducted by running scenario tests, definition express and incorporate their requirements, constraints, and condi- of limit state loads and simulation of complex, dynamic systems in tions during the assignment phase of the redesign. virtual reality. Analyzing system responses, before they are put into practice, are based on First Time Right and Zero Defect strategies. A language issue, creating scenarios The responses of a system can be determined by a gradual enlarge- In reconstructing an event sequence, we easily refer to the mechani- ment of the disruptions which are inflicted upon the system, until cal reconstruction from an engineering perspective. In unraveling oscillation and instability occur. Responses of systems may become the event sequence from a psychological or sociological perspective, visible by a gradual or sudden transition to another system state by we might prefer the phrasing of reenactment of the event or recon- passing a bifurcation point. After such a transition, the safety of the figuration of the system state and operating environment. systems can be assessed according to the acceptability of the new Recomposition of an event enables event analysis. In order to safety integrity level. communicate, a common reference framework is required, clarify- Technology in itself contains many forms, incorporating invis- ing the various perspectives in recomposing the event: ible knowledge, notions, principles, and decisions from previous

ISASI 2010 Proceedings • 57 ISASI 2010 PROCEEDINGS 58 Although stability,control. avionics, and structures, propulsion, as creating specialist approaches in many technological domains such matured, has investigator technical the technology, of velopment de- the with Initially, decades. past the over gradually developing can beexpressedintheDCPdiagram (seeFigure3). to cover the architecture of the overall socio-technical system. This nizational/managerial, or governance/control perspective in order and analytical skills from a technological/engineering design, orga- should be supplied with a counterpart, each qualified with diagnostic 2004; ESReDA,2009). (Stoop, environment operating and context socio-technical the ability. Such ability should also incorporate the ability to recompose accept- their to respect with assessed and account into taken been knowledge, assumptions, decisions andonly reproduce the physical, reality,safety-critical but also should encompass the issues that haveredesign requirements. However, a recomposition ability should not of drafting the facilitated recomposition Such practice. in designs ing conditions and context, the factual technical functioning of the recomposing the actual and factual sequence of events, the operat- of capable investigator, technical a needed designers Historically, Forensic engineering engineers playsucharole. assessing the safety of their design; Design accidentmethodologies. Designers need an investigatorsintellectual counterpart in as forensic the Japanese design philosophy of with as such processes their havior,into designed however,be can be- Such Carper,2001). 1991; (Petroski, designs their of behavior unforeseen and uncertainties all into oversight gain to position a in not are and performance optimizing with deal Designers level. design envelope should reduce the uncertainty again to an accepted probability assessment, consequence analysis, and identification ofa margins and design standards, identification of failure mechanisms, uncertainty.Safety high of conditions under made frequently are decisions Design environment. operational their in end-users to disclosedoesnot inherent properties, principles, interactionsor lifecycle phases. The physical appearance of a product and process Figure 3.Stoop’ssystemsarchitecture DCPdiagram. These three design-counterpart roles for investigators have been From an investigator perspective, three kinds of systems designers • ISASI 2010 ISASI Proceedings Limit State Design or Critical Sate introduce • performance. apply • accident scenarios. focus • rather thanonfactors. facilitate • characteristics. create • developprototypesofsafer solutions. • developeventscenariosseparated fromsystemsmodels. • tion environment. deal • emergent properties. Such aroleisprovidedbyaccidentinvestigators. designs. their of assessment the for counterparts need Designers developed. fully yet not is level systems a at investigations accident identify • solutions requiresto technical level. socio- a at systems complex of performance safety the improving for alternative an provide may methodology design engineering industry.Consequently,aviation the in needs design engineering needsaccidentof investigation theory andpractices andsystems systems context. Consequently, both accident modelsinvestigation by management control in a dosocio-technical not comply with the towardhumanerroranalysis, whileRasmussen’s modelreplaces Reason’sgrounds, causation accident from focus the shifts model dards for generating generic, linear solutions. erence metaphors for the benefit of risk communication and stan- industry. asref- Inpractice,theyareexposedtotheriskofserving aviation the toward generalization their about doubts are there supply, power nuclear and industry, process the in management AlthoughtheReason andRasmussen models maywell serve risk Conclusions real system.◆ Therefore, it is necessary to Therefore, itisnecessary The potential for systems engineering design in providing safer

with on a dedicated proof

inherent

design testing

complexity systems of

principles concept virtual and

properties dynamics of investigation methods for conductingfor investigation methodsof toolbox and frameworkConsequently, a control. and governance systems of tions no- and concepts general developing of schemes on failure, but is classification not developing yet is in domain a this phase phase: earlier even an in is development the domain of governance and control,In design. organisational in theresilience and organisations, reliability high error, man hu- on view blame-free a theories, making decision naturalistic rationality, local and gressing,developing notionsboundedon pro- is tools investigation into factors man Dekker,hu- Translatingon 2006). theories 2002; (Strauch, purposes investigation for thisdomain arenotyetreadily applicable in developed been have that notions the decades, two last the over progress major seen has factors human of domain the validation

and systems by

and

testing dynamics

before by

models, properties in synthesizing solutions these

they

by representing

models,

manifest focusing rather in On methodological interrelations a

dynamic than parallel

themselves on their

optimizing

functions specific simula- to into the

References Katsakiori, Sakellaropoulos and Manatakis (2008). Toward an Evalua- Benner (1975). Accident theory and accident investigation. Proceedings of the So- tion of Accident Investigation Methods in Terms of Their Alignment ciety of Air safety Investigators annual seminar, Ottawa, Canada, Oct. 7-9, 1975. with Accident Causation Models. Paper accepted for Safety Science, Benner (1985). Rating Accident Models and Investigation Methodologies. November 2008. Journal of safety research, Vol. 16, pp. 105-126, 1985. Kletz (1991). An engineer’s view of human error. Second Edition. Institution of Benner (1996). Accident Investigations: A Case for New Perceptions and Meth- Chemical Engineers. Warwickshire, UK. odologies. National Transportation Safety Board. Washington, USA. The Lees (1960). Loss Prevention in the Process Industry. Vol. 1, Oxford Butterworth Investigation Process Research Resource Site. Heinemann. Benner (2009). Five Accident perceptions: Their implications for Accident Inves- Leveson (2004). A New Accident Model for Engineering Safer Systems. Safety tigators. Journal of System Safety, pp. 17-23 September-October 2009. Science 42 (2004) 237-270. Carper (2001). Forensic Engineering. Second Edition. CRC Press LLC. Matthews (1978). Max Weber, Selections in Translations. Cambridge Uni- Dekker and Hollnagel (2004). Human Factors and Folk Models. Cogn. Tech. versity Press. Work (2004) 6: 79-86. McIntyre (2000). Patterns in safety Thinking. Ashgate. Dekker (2006). The Field Guide to Understanding Human Error. Ashgate. Petroski (1992). To Engineer Is Human. The Role of Failure in Successful Design. Dym and Little (2004). Engineering Design. A Project Based Introduction. Vintage Books, New York. Second Edition. Wiley International Edition. Rasmussen (1997). Risk management in a dynamic society: a modeling problem. Edwards (1972). Man and Machine: Systems for Safety. Loughborough University Safety Science Vol. 27, No. 2/3, pp. 183-213, 1997. of Technology. United Kingdom. Roelen, Lin and Hale (2009). Accident Models and Organizational Factors in ESReDA (2005). Roed-Larsen, Stoop and Funnemark 2005. Shaping Public Safety Air Transport. The Need for Real Models. In press. Investigations of Accidents in Europe. An ESReDA Working Group Report. Rasmussen and Svedung (2000). Proactive Risk Management in a Dynamic DNV, Oslo, February 2005. Society. Karlstad, Sweden, Swedish Rescue Services Agency. ESReDA (2009). Guidelines for Safety Investigations of Accidents. ESReDA Sklet (2004). Comparison of Some Selected Methods for Accident Investigation. Working Group on Accident Investigation. Oslo, June 2009. Journal of Hazardous Materials 111 (2004) 29-37. ETSC (2001). Transport Accident and Incident Investigations in the European Stoop (1990). Safety and the Design Process. Doctoral Thesis, Delft University 8, 2010 SEPT. WEDNESDAY, Union. European Transport Safety Council. Brussels 2001. of Technology. Universiteitsdrukkerij, April 1990. Hendrickx (1991). How Versus How Often. The Role of Scenario Information Stoop (2004). Independent Accident Investigation: A Modern Safety Tool. and Frequency Information in Risk Judgment and Risky Decision-Making. Journal of Hazardous Materials 111 (2004) 39-44. Doctoral Thesis Rijksuniversiteit Groningen, the Netherlands. Strauch (2002). Investigating Human Error: Incidents, Accidents, and Complex Hollnagel, Pieri and Rigaud (2008). Proceedings of the Third Resilience Engi- Systems. Ashgate. neering Symposium. Oct. 28-30, 2008, Antibes-Juan-les- Pins. MINES, Paris, Young, Braithwaite, Shorrock and Faulkner (2005). The (R)Evolution of Human Collection Sciences Economiques. France. Factors in Transport Safety Investigations, ISASI Forum, July-September 2005.

ISASI 2010 Proceedings • 59 ISASI 2010 PROCEEDINGS the shiptofleetcommander. of readiness” “operational demonstrate to and this exercise was possibly his last chance Expected • over command. First • Possiblyhislastyearincommand. • 4 years. ficer had been in command for 3 of those of- commanding The years. 4 last for tion contributed to them. contributed tothem. therecurrentto identify humanfactors andorganizational issuesthat study 120fatalaircraft accidentsthatoccurred between1960and1990 was alsoinvolvedastheteamleaderinastudyprogram commissionedto pilots charged with pilot errort (acquittal was for “defenseattorney”)won inthree courtmarshalsconvenedtotry military in two of these). He term and hasstoodinas“friendoftheaccused”(whichismilitary Generallyconfusedseasanderraticwaves. • Long,lowswellwithanoccasionalviolentmotion. • Constantlyshiftingwinddirection. • >30knotswinds. • 10-to15-feet-highwaves. • 60 Rank • The pilot Ship • The commandingofficer (See Figure3). Note the obstructions behind the helicopter as it comes in to land. The ship The shipandthehelicopter Sea • The sea (See Figure1). Exercise Somewhere intheIndianOcean,July2006. • ISASI 2010 ISASI

state

A Case Study of an Indian Military lieutenant time had bjective: To demonstrate combat readiness of the fleet fleet the of readiness combat Todemonstrate Objective:

4 to

been sailing to be

5. He has investigated 12 military aircraft accidents management systemsandairaccidentinvestigations. dedicated thelast15yearsofhislifetoaviationsafety with more than 21 years of flying experience. He Arabia. Heisanex-IndianNavyhelicopterpilot has Aviation FlightAcademy, Riyadh,KingdomofSaudi Capt. SamirKohli istheheadofsafetywithSaudi

Proceedings commander. transferred undergoing

with Was It Really Pilot Error? fleet

By Capt.SamirKohli,HeadofSafety, SaudiAviation FlightAcademy out since moderniza- very Helicopter Accident

shortly taking

The • commanders. An • Elevenyears’flyingexperience,9yearsascaptain. • Figure 2 Figure 1 experienced CFI in his basic pilot training at sea and noted, well trusted “Tendency

and to respected

pull Figure 3 back by and his

cabin protruding outside the ship over water. Figure 4 • Two persons on deck received splinter injuries—one a minor splinter in the eye, the second two large pieces in his arm and chest (that was later extracted from his back, fortunately without damage to heart and lungs).

What happened? • First report from the pilot: “The helicopter was unstable due to turbulence and deck movement. I maintained hover at 10 feet to try and synchronise with deck movement. Suddenly there was a violent movement of deck and as I tried to pull back my tail rotor struck something. get into a nose-up attitude on landing and warned for the same.” I lost directional control and spun. I slammed down the collective • Involved in two “tail touch” incidents in the past with minor dam- pitch control to contain on deck. The landing was very hard, col- age to the tail rotor on each occasion. lapsing the right oleo and causing the machine to tip over (see

Figures 4 and 5). 8, 2010 SEPT. WEDNESDAY, The copilot • Young and serving his first afloat deployment post qualification What happened? to land on deck. The tail rotor was found separated from the helicopter but still at- • Considered the pilot as a “role model” and had a lot of admiration tached to the tail gear box, found functional in factory. for his achievements. • Unquestioning obedience of the pilots orders at every stage dur- What happened? ing the deployment. • The copilot insisted that the helicopter swung in three complete • Witnesses reported a “master-dog” type relationship between circles through left and that he saw the rear of the ship “at least the two. thrice.” • Three witnesses insisted that the helicopter “swung to the right, The mission • At 0400 hours, message received for ship to launch helicopter 0700 to pickup the fleet Figure 5 commander (rank rear admiral) + five from another ship in fleet. • The pilot’s first reaction when told of mission—“These guys must be out of their minds!” • At 0600, ship signaled, “Flight commander recommends weather not suitable.” • At 0655, ship signaled, “Helo ready for launch.” • Helicopter airborne at 0701.

The accident • First trip uneventful. • As it lifted for second trip, the fleet aviation officer asked pilot if he will accept four passengers. • The pilot expressed his dissatisfaction, stating high all up weight and bad weather indicating need to have a higher reserve of power. • Pilot objections overruled and ordered to prepare to accept four passengers as fighter aircraft were expected overhead any minute for a simulated strike. • Helicopter arrived over landing area with four passengers, hovered for a few minutes, reportedly “danced at hover,” swung vio- lently, and crashed on its right side with the

ISASI 2010 Proceedings • 61 ISASI 2010 PROCEEDINGS Red • found. and gomissing? of the tail rotor drive shaft. of thetailrotordriveshaft. Why • launch under combat conditions? 62 actionforrefusaltofly.—…I wouldhaveordereddisciplinary Yes, thecircumstanceswerechallenging. have to take risks. —“…This was a war-like exercise. In Fleetcommander: military• combat operations we As themessunraveled… Why • The questionsunanswered Recommended • strike andconsequentlossofthehelicopter. —mishandlingcontrolsof leading losstotheoftail rotor dueto —operating thehelicopteroutsidelimitsofflightenvelope. fault for The • The enquiryandverdict Two • Oneredpitchchangerodfoundbroken. • in theair”anddidnotseeitcrash. The • in complete circle. swung Never deck. on crashing before again” right then left, then What • the helicopterwasstillinair? also theprevioustwoincidentsoftailrotordamage. What • his staff)? and commander (fleet management senior the of responsibility Both • traced toredblade. formed a complete balance weight with serial number injured legiblethe of one of chest and arm the from extracted pieces two and identified to be parts of “main rotor blade balance weights.” The • ISASI 2010 ISASI rotor

splinters blade enquiry did was

stated would caused

the the blade spacer they be

main in launch conducted one Proceedings consequences had the withdrawal were

cables

blade rotor eye, a

ordered semicircular injured

arm, blade found spacer over of and

while in for 45 balance pilot

broken, cable

the chest days the indentation helicopter

from given

pilot to found weight of of

break

the flying

which in weather? event injured the of break was

from cadre, exact one pilot still of

What’s away both personnel was refusal diameter “dancing to quoting never

when be ends

the to at

Caused • Thepitchchangerodrupturedathoverduetoloading. • red pitchchangerod. life! ◆ • • of accuracyisnotjustified. verdict followed by detailed examination of evidence. Speed at cost • believes. mind the what sees eye human The wrong. be statementscan Splinters • Themainrotortipoftheredbladebroke. • Theredbladeflappeddowntostrikethetaildriveshaft. • What actuallyhappened A • What actuallyhappened Electron • What actuallyhappened given conditions. personalmy—…Itwas decision launch tohelicopterthe thein • Investigating ASIA The • two personnel. the sea. the sea. and the cable flew off under centrifugal force (353 RPM), lost into preted as“highturbulence”bypilot. The • spacing cables. Pilots • never spun. deck. Weakened • wrong. was problem the of diagnosis his if even stage, that at action sible I S A A If the action was wrong, I alone am responsible for it.” ndependent. Influenced by rank of the fleet commander? Forty-five days to deliver an incorrect verdict? Interim Interim verdict? incorrect an deliver to days Forty-five peedy. Weighevidence,ccurate. the don’tcount it! Cost of error is another accident and more loss of of loss more and accident another is error of Cost uthentic.

flapping cable helo action asymmetric

microscope from yawed

posts tail blade of drive the slamming of

side also balance red cyclic shaft

examination

to lags and side sheared down pitch

causing weight blue during change collective blades

in off

revealed excessive the this most of broke tip process. pitch red

likely fatigue

of strain rotor the under was E on ven eyewitnessven

blade

It on failure the blade. impact most

this the best

injured

of strain blade Inter likely with pos-

the -

Planning for Sea Search and Recovery Operations—A Small Investigation Agency’s Perspective Prepared by the Air Accident Investigation Bureau of Singapore Presented by Pang Min Li Pang Min Li (Ms) graduated from the National University of Singapore in 2006 specializing in material engineering design. She worked for Singapore Technologies Aerospace and was involved in the de-

sign and production support on the Boeing 757-200 8, 2010 SEPT. WEDNESDAY, passenger-to-freighter conversion. She was posted to ST Mobile Aerospace in Alabama, USA, to serve as a liaison engineer for the prototyping of the converted B-757-200 freighter. Min Li gained experience in analyzing structure defects and verifying repair schemes. In May 2009, she joined the Air Accident Investigation Bureau of Singapore as an accident investigator.

Introduction AES’s hovercraft 1 Singapore is a small country in Southeast Asia. It is surrounded (above) and fire boat by waters, and its only land link is with its neighbour Malaysia to the (left). north in the form of two causeways. However, Singapore has very significant air carrier activities. Some 90 scheduled airlines operate at the Singapore Changi Airport, providing air connections to 200 cities in nearly 60 countries. 2 Among the 90 airlines, the seven national airlines of Singapore fly to more than 65 overseas destinations. Virtually all their flight routes involve flying over waters. response agencies such as the Police Coast Guard and the Maritime and Port Authority. The search and rescue and firefighting asset of the Changi Airport Emergency Service (AES) also includes two hovercrafts and a fire boat. 5 The depth of the sea water around Changi Airport is about 60 metres. Such shallow water should not present too much of a problem for the Airport Emergency Service in the search and rescue operation. While the Air Accident Investigation Bureau of Singapore (AAIB) does not have a lot of experience in the search and recovery of flight recorders and aircraft wreckage/debris, we believe that, with the assistance, if necessary, of the more experienced investigation agencies around the world, such search and recovery operation in 3 In fact, the departure and arrival routes for Singapore Changi Airport shallow water will also not be too problematic. are over water as the airport is 6 The Air France Flight 447 crash in the Atlantic Ocean on June 1, built on land reclaimed from 2009, highlighted a new concern for us. The unsuccessful attempts the sea. by the French Bureau d’Enquêtes et d’Analyses pour la Sécurité de 4 Thus, a sea crash around l’Aviation Civile (BEA) provided an impetus for the AAIB to review Changi Airport of an aircraft the way its investigators ready themselves for a sea crash. during takeoff or landing is 7 Arising from the Air France accident, we asked ourselves the fol- a distinct possibility. Changi lowing questions: Airport has taken this into • Are we able to direct and manage a search and recovery opera- Changi Airport, located on re- account in its emergency tion for an aircraft that has crashed into a deep ocean far away from claimed land on the eastern tip of response plan, in coordina- Singapore? Singapore. tion with other government • Do we have enough investigators to be deployed in the high seas

ISASI 2010 Proceedings • 63 ISASI 2010 PROCEEDINGS a sea crash. a seacrash. of challenges the meet to preparation its enhances AAIB the how 8 This paper aims to share AAIB’s considerations in the review and endeavour? such aseasearchandrecovery Do • bility thatwemayneed? Do • or todeviseasearchpattern? Do • operations? such seasearchandrecovery Do • operation? recovery Will • extended period? Do • operation? resources toconductaseasearchandrecovery 64 that were equipped with floats appeared to be a versatile machineisland. Seaplanes used to anchor off Selatar. At that time, seaplanes foraerial defence for the built naval was base Airport Seletar on the island. northern main Singapore the shore of of north the the to Seletar at 1929 in completed was airport civil and military first 11After that, Singapore’s civil aviation began toflourish and the Singapore fromoverseas. in landed aircraft an time first the was This Australia. to England his Vickers Vimy in Singapore, as part of hisPark). pioneering flight from British-built Bistrol Box-Kite biplane at the Race Course (now Farrer the first person in Singapore to perform a demonstration flight of a as a sport. In M 10 In the early years of the 20th century, flying was often regarded SeletarAirport(1928–Present) • KallangAirport(1931–1955) • PayaLebarAirport(1951–1981) • had threeothercivilairports: Singapore 1981, 1, July on operational became Changi at airport interesting history in airport development. Before the international an had nevertheless has Singapore island, small a being Despite 9 Airport developmentinSingapore Are • operation? for asearchandrecovery •

ISASI 2010 ISASI we we our we we Eight years later on Dec. 4, 1919, Australian Ross Smith landed our we

know have know be already investigators investigators able the beforehand arch 1911, Frenchman Joseph Christiaens became which Proceedings to

knowledge have muster

other have the able

the which basic sufficient to investigation and necessary survive

equipment experience salvage training working manpower companies agencies

to for and use in

high and sea the can knowledge have

search equipment equipment seas help the for capa- us

and for an in

end of the war, being replaced in 1955 by Paya needed. Thus, Kallang Airport was abandoned just 10 years after the was city the from away further airport An too. aircraft, noisier And aircraft. civil faster and bigger of development the for foundation 13 The advent of huge machinesSeaplanes landedandtookoff ontheadjacentKallangRiver. developed for World War 1937. 12, June on completed was Airport IIKallang the and 1932, in laid the seaplanes. for anchorage provide a river, and could accommodate an aerodrome for landplanes and airport. The location was near the the CityStraits Settlements, ofselected the Kallang SingaporeBasin as the site andfor a new adjacent to aircraft grew larger and heavier. Sir Cecil Clementi, the governor of 12 However, the runways at Seletar Airport proved inadequate when Batavia, nowJakarta)landedinSeletaronFeb.11,1930. aircraft with wheels, not floats, and the first commercial flight (from world’s international flying pioneers were flying intoon Singapore completionof Seletar’s landing facilities on dry land, more of the where land-based aerodrome facilities were not available. With the Box-Kite biplaneattheRaceCourse(nowFarrer Park, below). pore to perform a demonstration flight of a British-builtFrenchman JosephChristiaensbecamethefirstpersoninSinga- Bistrol overseas. Australia—the firsttimeanaircraft landedinSingapore from in Singapore as part of his pioneering flight fromOn EnglandDec. 4, to 1919, Australian Ross Smith landed his Vickers Vimy assive reclamation work began began work reclamation Massive Lebar Airport located Kallang Airport on reclaimed land (highlighted in white). The first day of dredging the crash site at the Musi River pro- at the northeastern part of the Singapore main Island. Although the duced 100 bags of debris. (Picture by Tan Lai Hock of Lainhe airport was not immediately close to the Johor Straits to the north, Zaobao. it did have a water obstacle in the form of a river (Serangoon River) to the north of its single runway. 14 Paya Lebar Airport received heavier aircraft such as the Fokker

F-27, Comet IV, Convair 880, Lockheed Electra, DC-8, and Boeing 8, 2010 SEPT. WEDNESDAY, 707. Despite optimism that this would be Singapore’s airport answer to the jet age, the single-runway Paya Lebar Airport had to cope with the pressure from new aircraft types and increasing traffic. Within a matter of years, there were numerous runway extensions, as well as additions and alterations to the arrival and departure halls. 15 By the mid-1970s, Paya Lebar Airport’s capacity was already being stretched to the limit, and a decision was made in 1975 to construct a new civil airport at Changi on the eastern tip of the Singapore main island, where the new airport would be easily expandable through land reclamation. The Changi location is away from the densely populated areas and would entail arrival and departure flight paths An aerial view of the search efforts on Musi River. over the sea. As such, complaints against aircraft noise would not be an issue, and ground casualties in the event of a crash during an on the aircraft parts and reduce evidence loss. aircraft’s takeoff or landing would be very much mitigated. Again 18 Singapore investigators had to climb a very steep learning curve massive reclamation work had to be undertaken to build the Changi in underwater search operation when they represented Singapore Airport, which became operational on July 1, 1981. as the State of Registry and the State of the Operator to participate 16 Thus, because the Singapore island is so small, the airports in the Indonesian investigation of the plunging of the SilkAir Boeing in use in Singapore in different periods all involve or involved 737 into the Musi River, near Palembang in the Indonesian island operations over water. It was inescapable that air crash response of Sumatra, on Dec. 19, 1997. had always to take into account a sea or underwater search and 19 The Indonesian investigation was led by the National Transpor- rescue scenario. tation Safety Committee (NTSC). The crash site, at the mouth of the Musi River, was challenging, as there was strong tidal currents Earlier sea accident investigation experience to contend with and the water was murky. Compounding this, the 17 We did not research into whether there were any aircraft that aircraft had virtually been pulverised during its impact with the had ditched or crashed into the Johor Straits or Kallang River water. Wreckage pieces were small, and they settled and got buried in the early days of aviation in Singapore. But as early as 1975, in the mud at the bottom of the river. Visibility underwater was so Singapore had an experience in responding to aircraft ditch- poor that divers searching for bodies or aircraft debris practically ing. On Sept. 17, 1975, a Convair CV-240 ditched into the Johor had to do so by touch. Straits, some 400 metres off the end of Runway 03 of Seletar 20 At the Singapore end, the agencies and organisations that were Airport, when both of its engines lost power consecutively. The mobilised in the aftermath of the crash included the Ministry of depth of the water was about 8 metres. The warm tropical water Transport, Ministry of Health, Ministry of Defence, Ministry of allowed the corrosion process to set in quickly. When the aircraft Foreign Affairs, Civil Aviation Authority of Singapore, Singapore wreckage was recovered a few days later, extensive corrosion was Airlines (parent company of SilkAir), Singapore Airlines Engineer- noted. For example, localised corrosion of deep pits was found ing Company, etc. Singapore deployed two naval vessels, a Fokker on the magnesium aircraft parts. For the propeller dome, the 50, a Hercules C130 and two Super Puma helicopters to support materials under the paint had corroded into a powder-like tex- NTSC’s search operation. More than 90 divers from the Singapore ture. The pressurised piston mechanism within the propeller Navy also took part in the underwater search. After a 2-week search dome also posed a hazard, especially when its integrity had been attempt, a dredging company had to be called in to dredge out the compromised by the corrosion. One of the lessons learnt from debris. About 73% (by weight) of the aircraft debris was eventually the recovery operation is the importance to recover the aircraft recovered. wreckage as quickly as possible, in order to minimise corrosion 21 The Musi River search and recovery operation involved many

ISASI 2010 Proceedings • 65 ISASI 2010 PROCEEDINGS corders usingULBdetectors. AAIB investigatorssearching fortheAdam AirB-737flight re- 66 control or maintain the stability of the rubberquitedifficultcurrentswas strong,theto wereAlso,when it 26dinghy. The drifting task of listening for the signals. their on concentrate to investigators the for difficult very it made feeling of nausea caused by the rocking motion of the sea currents The overcome. and endure to learn to had investigators the that torture a was sickness motion The endure. to have may searchers that sickness sea the mention to not exercise, time-consuming environment, etc., could make listening for signalsappear.would it as straightforward as not noise condition, sea The a daunting and 25 assigned bytheNTSC. of seven detection missions were conducted at multiple locations as For the detection missions, they had to use rubber dinghies. A total vessel). research scientific Indonesia (an IV Jaya Baruna the ship, TheyandtheSingapore Navydivers wereoperating basefroma the from emitted been tors to to listen try for the 37.5 kHz pinger signals that should have the flight recorders using underwater locator beacon (ULB) detec- 24 For a week, the AAIB investigators were on the sea searching for the search. in join to invited also was Navy Singapore the from divers of team the over missing gone had that 737 Boeing Air Adam the for search help to (NTSC) Committee Safety Transportation National Indonesian the by invited were they when search sea of taste first their had investigators AAIB 23 salvageoperationfortheinvestigators. would needtoperform they what and capabilities their understand to companies salvage the tasks involved in a sea search operation. The AAIB also met with 611 and helicopter crashes in the tionsNorthofTWA 800, Sea),Swissair 111,in Flash Airlinesorder 604, Chinato Airlines appreciate investiga- the leading through (e.g., recorders flight and wreckage the Taiwan,France, Canada, in agencies investigation the the 22 After its formation in AAIB seasearchcapabilityenhancement coverage fortheiraircraft. insurance the example, for through, cost such absorb to capability case.Nevertheless, we believe 111 Swissair airlinesor 800 TWA the would of cost do well the toof secure fraction tiny the a dollars, suchoperation. The salvage cost was only a few million support to funding of sources adequate Singapore having of importance the priorinteragency coordination of and cooperation. the importance of The operation believer also firm drilled a into us us made aspects, e.g., logistics, accommodation, salvage. The SilkAir accident • L .S., which have a lot of experience in sea search of aircraft aircraft of search sea in experience of lot a have which U.S., istening for the 37.5 kHz pingersignalskHzistening37.5thefromthe for ISASI 2010 ISASI Proceedings October 2002, the AAIB contacted or visited Bs associated with the flight recorders. recorders. flight the with associated ULBs akassar Strait on Jan. 1, 2007. A A 2007. 1, Jan. on Strait Makassar UL K, and and UK, B was B suit thecircumstances. investigator’s training. fore, honing of of use the in prowess investigators’ French off the Comoros Islands on June 30, 2009, a demonstration ofmetres using the 1,000 than more of depth a at recorders locating in succeed did investigators BEA French the that remember should one case, Air 29 Although the use of the operationscommandcentrelocatedonland. to stay in communication with each other, with the base ship or with personnel search the for alternative good a be could walkie-talkies As there may be areas that mobile cannot services reach, the use of areas. remote in use for equipment communication appropriate 28 The Adam Air search exercise also emphasised the need to have an appropriatelevel. to resources and capabilities recovery and search underwater our invaluable to the AAIB and strengthenedusing more sophisticated equipment. AAIB’sHowever, the experience was resolve to build up were eventually located by the detector is generally limited to shallow water search. The recorders using dinghy a being about 2,000 metres, it was not surprising that the search from lenges involved. With the depth of the waters in the chal- the firsthand witnessed they and sea, at operating of rigours the to investigators our exposed mission search Air Adam The 27 direction ofthesignalsmightberecorded. of the dinghy could affect the accuracy with which the location and To • 33 investigators andavailabilityof trainingopportunities. needed for sea search and recovery, as well as the training needs of relevant domestic agencies and organisations, the types of resource tion, resources availability, and training. The task force identified the a sea search endeavour. It considered three main aspects: coordina- capabilities. The task force reviewed the way the AAIB would tackle operational search sea AAIB’s enhance and develop to 2009 July in force task a up set AAIB the accident, 447 AF the after Soon 32 sea crashsiteisfarfromthehomebase. anteed.Furthermore, there will belogistical difficulties when the fairly accurately. Thus, success of the search is not necessarily guar be difficult to determine if the point of impact cannot be established for a straightforward search. The starting point for a sea search may water depth) can be costly. resourcesThe (includingsea bed the rightterrain equipment maycommensurate not31 withThe challenge bearose thefrom a multitude conduciveof factors. e.g., international waters. cannot be definitely established as being in the territory of any State, that location a at crashed has aircraft its if Registry of State the on International Civil Aviation places the responsibility of investigation would recall that Paragraph 5.3 of Annex 13 to the Convention on Singapore’s emergency responders and accident investigators. for challenge tremendous a present will Singapore, from faraway A sea crash of a Singapore aircraft, especially in international waters recorders. flight and wreckage aircraft for search sea any in volved in- difficulties inherent the of AAIB the remind to serves 2009, 1, 30The Air France Flight 447 crash in the Atlantic Review post-AF 447 The review identifiedthefollowing approaches:

draw

up ULB detectors in the case of the Yemenia A310 crash

a B detectors was not fruitful as the use of a of use the as fruitful not was detectors ULB ULB detection skills can be an important part of an

deployment UL B detectors was not fruitful in the Adam

U.S. Navy ocean survey ship plan

that

can

readily B detectors. There- detectors. ULB

O be Mobilisation of Makassar Strait ceanon June

modified ary Mary Sears B ULB ne One

to - • To strengthen coordination with relevant domestic agencies and 41 Some of the resources needed for a search operation in the event organisations to enhance cooperation in the use of their resources of a crash in Singapore waters or international waters can be of a very and personnel in times of need. specialised nature, e.g., towed pinger locator, trained divers, surveying • To acquire all the necessary sea charts. sonar, etc. The AAIB has been identifying and establishing contacts with • To acquire the necessary search equipment (e.g., ULB detector, providers of salvage and hydrographic services. Through meetings with GPS, compass) and train investigators in their use. them, the AAIB now understands better the capabilities and resources of • To enhance the proficiency of Airport Emergency Service’s divers these service providers and has also had a chance to peruse in advance a in the use of ULB detectors. typical salvage contract. The AAIB has also looked into where wreckage • To take part in realistic sea search exercises. may be stored, and talked to hangar owners and tentage companies to see if they have suitable facilities that can accommodate aircraft wreckage Sea search deployment plan and protect it from the elements. 34 No two accidents are the same. It will be difficult to have a one- size-fits-all plan to address all situations. Nevertheless, a basic plan Mobilisation exercise will at least provide a framework to deal with the dynamic situation 42 It is important to find ways to validate the coordination plans that and enable more detailed plans o be derived quickly to suit a specific have been devised. The aerodrome operator in Singapore regularly critical situation. organises aircraft crash response exercise to test the readiness of 35 At this stage, the AAIB envisages dispatching and deployment the various agencies and organisations involved and to identify two teams to respond to a sea search situation: a search and recovery shortcomings in the coordination procedures in the AEP. Typically 8, 2010 SEPT. WEDNESDAY, team (SRT) and an investigation support team (IST). Each team a total of two to three exercises are held every year, one of which has its own specific roles and responsibilities. would correspond to a sea crash scenario. 36 The SRT will be at the crash site to direct and oversee the sea 43 Typically, 300-400 participants will be involved in such an exercise, search activities such as devising search patterns, on-site coordina- which gives the AAIB investigators an opportunity to interact with tion with salvage companies on recovery of wreckage from waters, the Airport Emergency Service, the police, and the aerodrome and etc. The SRT will be comprised of the AAIB representatives and airline representatives. their advisers (who may include technical specialists of the airline 44 For future sea crash response exercises, the AAIB plans to expand concerned, hydrographic experts, etc.), divers, sea search advisers on the portion of the exercise dealing with search and recovery of from a foreign investigation agency, etc. flight recorders. Recorders will be dropped into the sea and inves- 37 The IST will be in charge of a land-based operations command tigators and divers will have to fish them out. This will add realism centre, and its main duties are to provide logistical support to the to the exercise and let other exercise participants gain a real ap- SRT, to coordinate with other agencies, and to arrange for wreck- preciation of the coordination and time required for such search age storage, identification, and reconstruction. The IST will be and recovery activities. comprised of the AAIB representatives and their advisers (who may include technical specialists of the airline concerned, search and Acquisition of charts rescue specialists, pathologists, etc). 45 The AAIB wants to be able to, when it is informed of a crash of a Singapore aircraft in international waters, determine quickly which Coordination with relevant domestic states are or will be involved in the search and rescue operation. For agencies and organisations this purpose, the AAIB needs to have a data system that can provide 38 Effective coordination with relevant domestic agencies and organisations is an essential factor to the success of any emergency response operation that a state has to mount. Communications and prearranged arrangements between the AAIB and other agencies will ensure smooth execution of plans and harmonise the ways in which the various parties respond and operate. Resources deployed for crash exercise. 39 The roles and actions by the parties responding to an emer- at least some preliminary information. The data system is comprised gency event in Singapore (which include government ministries of flight information region (FIR) charts, hydrographic charts, and and departments, aerodrome operator, etc.) are embodied in an a simple contacts database. Airport Emergency Plan (AEP). For the AEPs of the Changi Airport 46 The FIR charts will be useful to the investigators to determine and Seletar Airport in Singapore, the AEP includes a chapter on the search and rescue (SAR) authority with respect to the known or accident investigation that serves as a multilateral agreement on suspected crash location. These charts will also show the countries how these parties shall support the AAIB. around the crash that may serve or as operational bases for the field 40 From the Maritime and Port Authority of Singapore, one of the investigation or for the search and recovery operations. The AAIB emergency responding parties, the AAIB obtained hydrographic will contact the investigation authorities of these countries to solicit charts that cover the Singapore territorial waters, which are relatively their support where necessary. shallow. The charts provide basic information such as water depth 47 The hydrographic charts in respect of the crash area will provide and sea bed features. maritime information of the area concerned and of the adjacent

ISASI 2010 Proceedings • 67 ISASI 2010 PROCEEDINGS 68 operators now fly: all the sea areas over which Singapore the Bay of Bengal region with together which shouldregions, lowing cover fol- the for data include to database the expand to continue will AAIB The organised. been have region 50So far, data for the Bay of Bengal assets). ties and assets, and thecapabili- bases, locationoperational their on of the information (including companies foreign missions, as well as theSingapore’s agencies,investigationsalvage solidate all the contact information with respect to SAR authorities 49 The contacts database is a simple one. The database aims to con- thus ordered. chartsthe foronly pay will Wequickly. charts tor can deliver to us the distribu- local the and operation, search its for select the charts needed available. The AAIB will charts hydrographic of catalogue electronic hydrographicchartsan of distributor local a from obtaining of tive alterna- the for opted has AAIB The substantial. quite be can The cost basis. subscription fee a on available are form, softcopy or hardcopy in world, entire the covering charts Hydrographic 48 equipment tobemobilisedandmovedthecrasharea. recovery and search the for needed time the of estimation an low al- will turn in This needed. be may that equipment recovery and search of types the anticipate thus can Investigators area. crash sea investigators can quickly charts, the From gaintopography,etc. seabed currents, anand tides ideaters, of the terrain and depth of wa- the of depth the include may information The regions. coastal the • ISASI 2010 ISASI Proceedings codes. taining worldwidehydrographic maps Hydrographic cataloguesoftware con- (GMDSS) publication. Distress andSafetySystem The Global Maritime 1 , North • pan) Ja- and Taiwan tween East • Taiwan) and Singapore tween South • Ocean North • of sets two also acquired AAIB the detectors, gaporehasNavy example, while the Sin- some search effort. For launch least at can it equipment, the have that agencies other from assistance for waits AAIB the while that so is This bility. capa- investigation its operation,affordable,theyareeffortenhanceifits to partof as 51 The AAIB aims to own some basic equipment needed for search Acquisition of searchequipment some stage, especially when a probable recorder location cations, areawill search hasfor pinger signals from the of surface the sea. At 54 The AAIB investigators, who do not necessarily have diver qualifi- Training ofdiversintheuseULBdetectors ULB detectors. to go search for the beacon by listening to the acoustic signals using beacon was dropped into the sea53 Further andtraining was also theconducted at sea investigatorswhere an actual pinger were required by theULBdetectors. ciateandunderstand thetype offeedback andsignals picked up appre- to investigators the allowed training The (SAA).Academy Aviation Singapore the of pool training the at investigators its for training organised AAIB The them. using in proficient are tors investiga- its that sure Having52 acquired the Training AAIBinvestigatorsintheuseofULBdetectors at sea. addition, the AAIB acquired a ruggedised laptop that can be used Tasman Sea(betweenAustraliaandNewZealand) • IndianOcean(betweenSingaporeandPerth) • tween SingaporeandSouthAfrica) Indian • ArabianSea • United States) and Japan (between UL B detectors. In detectors. B China China Pacific Ocean

Atlantic Sea Sea Ocean UL (be- (be- (be- B

UL SAA trainingpool. locater. AAIB’s handheldunderwateracoustic B detectors,B theAAIBwants maketo current conditions, and the accidental adjustment of the frequency knob during the dive in low visibility. 56 Through the training session, the AAIB is able to understand the difficulties of locating the pinger in choppy sea conditions and the operational difficulties faced by divers in the use of handheld acoustic hydrophone to search for pinger signals underwater. Such training allows the AAIB to fine-tune its search procedures and explore other methods of listening for acoustic signal.

Improving search technology for recorders 57 The search difficulties in the case of the AF447 accident have raised questions about the adequacy of existing search technology for flight recorders installed on aircraft that crashed into deep water. Many of suggestions to improve the probability of a successful search AAIB investigators in training session. for recorders have been surfaced, such as • continuous or triggered air-ground transmission of data in the flight recorders.

• deployable recorders. 8, 2010 SEPT. WEDNESDAY, • extra lightweight recorders for installation in the vertical stabi- lizer. • extension of the life of the battery on and the signal range of the ULB. 58 Another possible improvement in search technology is in the way the detection of signals using ULB detector and recording of coordinates/direction of the signals can be automated. Operating the acoustic hydrophone of the ULB detector is not as easy as it may Training session at sea with ULB and ruggedised PDA computer. seem. The hydrophone operator’s task of listening for pinger signals is already made difficult by the many environmental factors.O n top of this, he has to multitask, as he has to rotate the extension staff attached to the hydrophone, has to adjust the knob on the handheld receiver to increase/decrease the hydrophone’s sensitivity, and also has to record the GPS location and bearing data when a signal is picked up. Therefore, it makes sense to automate the detection and recording of coordinates/direction of signals. 59 We understand that at least two investigation agencies are embarking on projects to use modern sound spectrum technology to help Familiarisation and practical training with the AES divers identify a valid 37.5 kHz signal. This will reduce the dependence on on the use of ULB detector. an investigator’s listening skills, as visual monitoring of sound spectrum would appear to be easier. The hydrophone operator can then been determined, it may be necessary to deploy divers underwater pay more attention to adjusting the orientation of the hydrophone, to try to locate the exact recorder location using ULB detectors. while keeping an eye on the spectrum display. When the spectrum 55 The Changi Airport Emergency Service (AES) has divers among suggests that there is a valid signal, then with possibly the click of its ranks to carry out search and rescue tasks who can also support a button by himself or by an assistant, the GPS location and signal the AAIB in searching for recorders underwater. Their proficiency bearing data can be recorded automatically. This will greatly increase in the use of ULB detec- the efficiency of the search process, and the hydrophone operator tors will of course be can work longer hours thanks to reduced workload. of importance to the AAIB. The AES divers Sea search exercises are also eager to know 60 Even with a decent operational sea search plan and with the more about the ULB acquisition of some basic equipment and the training of relevant detectors acquired by personnel on the use of such equipment, the AAIB remains a strong the AAIB. Thus, the believer of the need to gain practical experience in the mobilisa- AAIB organised train- tion and organisation of a sea search and in the use of search and ing session with the Changi Airport Emergency Service recovery equipment. The AAIB spares no opportunities to send AES divers to enable divers in training. its investigators to attend workshops and exercises on underwater them to practise using search of recorders conducted by other investigation agencies in the detectors. The divers provided valuable feedback on the practical order to appreciate the tasks involved in a sea search operation. problems encountered, such as the acoustic signal being received These workshops and exercises will enable its investigators to learn from all directions when they were very near the target pinger, strong more about sea search and recovery of wreckage, and to tap others’

ISASI 2010 Proceedings • 69 ISASI 2010 PROCEEDINGS 70 of accident, appointment of investigator-in-charge, organisation of notification initial as such investigation accident air an of phases investigation simulation exercise. The exercise simulated the main accident air an organised (CAAC) China of Administration tion In 64 in ordertoboxupaprobable locationoftherecorders. a laptop display, how the search pattered was modified or adjusted the search pattern was devised, how the search was monitored from for deployment. The participantspreparing thetowfishandcables to the 63 During a previous visit workshop’s exercise. the of purpose the for the cidents Investigation Branch and was transported the to belongs fish) alltowed a (called thearray hydrophone way from the towed hydrophone array to detect the of deployment the observe to able were participants AAIB The 62 water recovery exercise. under realistic very a attend to opportunity the had AAIB the that time first the is This exercise. search sea a included which Croatia, shop on underwater recovery operations off the coast of Dubrovnik, the of investigation accident on experts of group the 2009, June In 61 in China,Croatia,andTaiwan. opportunitiestotake part recently inthe foreign had have sea to search fortunate exercisesis AAIB The experience. and expertise ing togounderwater. covering ofwreckage from thesea,Croatian Navydiversprepar ECAC seasearch exercise inCroatia inJune2009.From left:Re- witness firsthand how the tow fish and cables were deployed, how how deployed, were cables and fish tow the how firsthand witness howthe tow fish and cables were actually used. They were able to valuableexposure for the AAIB participants tosee for themselves the So configuration). assembly couldreachdeptha 300-500of metres (depending thecableon andreelscablesof that fish tow the of pictures viewed had AAIB the Branch, Investigation • European Civil Aviation Conference (ECAC) organised a work- t Dubrovnik to UK ISASI 2010 ISASI ctober 2009, the 2009, October U K Air Accidents Proceedings ffice of Aviation Safety of the Civil Avia- Civil the of Safety Aviation of Office Towed hydrophone array(towedfish). CAC exercise was an extremely extremely an was exercise ECAC UL B signals. The towed

K Air Ac- Air UK - - for landexercise. the ULBsinalake.AAIBinvestigatorsrecording GPSpositions CAAC exercise inOctober2009.From left:Attempting tolocate 67 The AAIB team experienced motion sickness after a while de- while a after sickness motion experienced team AAIB The 67 and obtainaprecisebearingtothesourceofsignals. and the drifting made it very difficultthe boat would still drift towhen hit by searchstrong waves. The engine fornoise the pinger signalsrunning in order to maintain course. operation. As the sea was rough, the engine of the boat had to be kept AAIB investigators appreciate the difficulties in performing a search Beaufort scale, on the day of the exercise. The rough sea made the Council. The sea condition was rather rough, measuring six on the Safety Aviation Taiwan the by organised exercise recorders flight In 66 technologies. equipment, investigation on information shared and discussed also participants, other with for listening in and opportunityto practise their skills in rowing in inflatable that dinghieshad been dropped into the lake. The AAIB investigators had the 65 The search exercise entailed finding the location of four and includedaULBsearchexerciseinlake. etc., conference, press management, site crash team, investigation all accidents are similar, the checklist checklist the similar, are accidents all not Although search. sea a planning in aid to checklist a have and hand To • exercises include 68 Some of the lessons learnt from the the search. of productivity the affected thus and performance humandegraded ness sick - motion earlier.The pills sickness anti-motion some taken having spite retrieving flight recorder from thesea. Listening forpingersignalsandrecording positioninformation, Taiwan underwater search exercise in May 2010. From left: work ay 2010, the AAIB attended an underwater recovery for for recovery underwater an attended AAIB the 2010, May out an initial B signals. The AAIB investigators, together together investigators, AAIB The signals. ULB plan B detection techniques and latest latest and techniques detection ULB before- Even with the engine running, part oftheULB detector. Attaching arope toa UL Bs will serve as a base line for the development of a better plan that to assist us as advisers. In view of the possibly large expanse of sea would suit the situation. area to be searched, more than a few ULB detection teams will be • To plan for contingency funding and be prepared for a lengthy needed. The AAIB will invite additional teams from the Singapore sea operation. Navy and other investigation agencies. • To train investigators in ULB detection in different water condi- 71 The experience from participating in others’ underwater search tions and environment (open sea, lake, swamp, salinity, etc.) as these and recovery exercises convinced the AAIB that besides devising a can compound the difficulties for the pinger signal detection. sea search deployment plan, it is important to gain as much practical • To tie the hydrophone part of the ULB detector to a structure experience as possible. The AAIB will continue to look for opportuni- on the boat with a string. This will prevent losing the hydrophone ties of practical training. A realistic sea search exercise can demand in the event that the staff holding the hydrophone is broken by the substantial planning efforts and resources. Nevertheless, the AAIB strong sea current. looks forward to more regional cooperation and interaction in sea • To be prepared for motion sickness and not to drink or eat too search planning and operation, and perhaps also in the joint organisa- much before going out to sea. tion of sea search exercises for flight recorders, so that investigation 69 Some training in investigation techniques need not be done at sea. agencies in the region can help one another to enhance expertise For example, investigators can hone their skills on land in the use and resources in sea search and underwater recovery efforts. ◆ of tools like GPS, compass with in-built clinometers, range finders, etc., before applying such skill in a real search endeavour. References 1. “Wings Over Singapore, The Story of Singapore Changi Airport,” Singapore,

1981, pp. 10-11. 8, 2010 SEPT. WEDNESDAY, Conclusion 2. “Singapore Fly-Past,” Singapore, 1982, p. 53. 70 Being a small investigation agency, the AAIB knows the difficul- 3. “Changi by Design, Architecture of the World’s Best Airport,” Singapore, 2002, pp. 17-20. ties that a small agency faces. With only limited resources, the AAIB may not be able to handle alone a major sea search operation for Illustration credits the flight recorders.M anpower and resources need to be roped in 1 http://mapsof.net/singapore/static-maps/png/singapore-outline. 2 http://satokaz.seesaa.net/archives/200705-1.html. to ensure an efficient operation. Besides putting in place an intra- 3 The Straits Times, Friday, 2 January 1998. agency coordination and cooperation framework within Singapore, 4 “Singapore Fly-Past”, Singapore, 1982, p. 15-16. the AAIB will continue to learn from other air accident investigation agencies that have vast experience in underwater search and recov- Endnote 1 A publication by the United Kingdom Hydrographic Office, titled “Global ery of aircraft wreckage and flight recorders experience. The AAIB Maritime Distress and Safety System (GMDSS),” contains contacts for the SAR will tap their expertise and experience and enlist their specialists authorities.

ISASI 2010 Proceedings • 71 ISASI 2010 PROCEEDINGS 72 edgeable about potential aircraft-specific hazards such as composite knowl- less are and fire, and location accident such hazards, safety tors are more concerned with the risk posed by general health and accident investigators that has shown that inexperienced investiga- collecting evidenceinasafetraining environment. practice the skills needed to identify and mitigate site hazards while been previously demonstrated. A simulation allows investigators to training using a simulated accident site, the benefitsshould ofbe whicha mix have of classroom-based education and ancedpractical with onsite the key investigation need to collecta complex task, evidence.as the need for investigator protection must be bal- Training ICAO of guidance the with line in sponders for accidentsitesafety. Guidelines for Aircraft Accident Investigators (2003) regarding training ICAO of guidance training the on It builds years. 3 to 2 every provided be should training recurrent that training safety tobeprovided and health toaccident of site responders standards minimum and stipulates the on guidance vides pro- (2008) Sites Accident Aircraft at Hazards 315: Circular ICAO Abstract Sid Hawkinsphotoandbionotavailable focused onissuesofsafety, culture, andinvestigatortraining. safety managementfrom Loughborough University, andhisresearch has on aircraft accident sites. Cranfield Safetyand Accident InvestigationCentre inhazards assessment Cranfield University. Nathalieiscurrently completingaPh.D.from the of scienceinhumanfactorsandsafetyassessmentaeronautics from Training InvestigatorsinLinewiththe This paper will outline the results of a pre-training survey of novice re- accident for course training safety and health a Developing By NathalieBoston(CranfieldUniversity),GrahamBraithwaiteandSidHawkins(AAIB) • ISASI 2010 ISASI Hazards at Aircraft Accident Sites: ICAO Circular 315Guidelines Proceedings Wales, Sydney. GrahamholdsaPh.D.inaviation worked as a lecturer at the University of New South and accidentinvestigationin2006.Prior tothis,he gation Centre in2003andawarded achairinsafety appointed director oftheSafetyandAccident Investi- Air Transport at Cranfield University, UK.Hewas Graham Braithwaite is head of the Department of exams. In 2005, Nathalie graduated with a masters ment rating.ShealsocompletedtheATPL theory for multiengineaircraft andacommandinstru- mercial pilot’slicense(fixedwing)withendorsements (Australia). Duringherstudiesshegainedacom- (Honors) from the University of New South WalesNathalie Bostonhasabachelor’sdegree inaviation iclr 9: Training 298: Circular Circular 315 Circular (2008)is safety record. Inevitably, this can mean that experience dealing with less complete. As an industry, we pride ourselves on our excellentand other aiders, voluntary their knowledge is likely to be even workers airline / airport For current. less or complete less be Red Cross, their specific knowledgeof aircraft hazardswill likely voluntary medical organisations such as St John’s Ambulance and emergency services that come from local municipal agencies or which may well lead to a higher level of risk acceptance. For the deal with aircraft specific hazards, their priority is to preserve life, dedicated “on-airport” service personnel may well be trained to especially if the accident is outside the airport perimeter. Whilst teers and airport/airline workers. Spectators are also common, rescue and firefighting (ARFF), paramedics and police, to volun- responders, from trained emergency responders such as aviation partially drainedbeforesiteworkcouldcontinue. be to had then which lake, man-made a of wall retaining the in ter cra- a formed impact The isotopes. radioactive including products powder, pharmaceutical and and fluids corrosive seats, ejector for components explosive rods, fishing fibre carbon ammunition, ing includ- hazards, potential became that cargo mixed a carried UK, Airport, Stansted near crashed that B-747F Airlines Korean 1999 uranium on the depleted site as well as by the possible effects on posed the cargo. The risk suspected the for known widely became hazards that can exist. The 1992 evidence, butisthisenough? ing hazards on site without consequence to either themselves or the suggests that experienced investigators are identifying and manag- helicopter accidents” online modules [2010]). Anecdotal evidence andsafety” [2007]; FAA “First responder safety at small aircraft other or site responders (e.g., ATSB, “Fibre composite aircraft-capability and investigators accident to problem a pose may site on hazards particular that concern is there However, sites. accident on ill or running history of aircraft accident investigators that can threaten becoming their own welfare. There injured is no extensive list or long- rence,investigators frequently finds themselves working site a on recur prevent to is investigation accident of focus main the Whilst 1. Background developing trainingcourseandsimulationcontent. when considered be should results These extended. be to needs held by novice accident investigators or infrequentoften thansiteaircraft respondersspecific hazards, the knowledge all hazardsof safety hazards may be encountered on aircraft and health general While accidentsystems. recovery ballistic and sitesmaterials more Accident sites will inevitably be attended by a wide range of first of thevariety highlight accidents aircraft high-profile Several l-Al El-Al B747F accident in Amsterdam - “real” accidents can be somewhat limited. the hazards that have always been present on a site, or they may be As the rescue phase moves to recovery and investigation, so the players changing as the composition and operation of aircraft are chang- on site will change, along with the level of acceptable risk. Investiga- ing. The number and types of people responding to a site may be tors will generally inherit a site where hazards have been evaluated in limited through guidance and regulation, such as ICAO Annex the context of life-saving and where the hazards will change over time, 13 and the Australian Transport Safety Investigation Act 2003; but perhaps as wreckage is moved or weather conditions change. Taking other than this, there is little chance for ensuring the competency “ownership” of an accident site brings responsibilities for themselves of responders to the site. and the wide range of people who may need to access the site as part of Experienced investigators who have attended many sites may be the investigation effort. able to immediately identify and assess potential hazards, and miti- In 1999, ICAO commissioned the Hazards at Accident Sites Study gate their consequences while still collecting all perishable and vul- Group to “...compile a list of hazards peculiar to aircraft accident nerable evidence. In contrast, inexperienced accident investigators, sites, develop relevant guidance materials and determine the as- or infrequent site responders, may not attend many sites, or a wide sociated training requirements for rescue personnel and accident variety of non-comparable sites, and as a result their hazards identi- investigators”. The group was comprised of specialist health and fication and management skills may not be at the same level as that safety professionals working within accident investigation organisa- of the experienced investigators. This may result in inexperienced tions. The resulting work of this study group is ICAO Circular 315: site responders becoming injured, or experienced site responders Hazards at Aircraft Accident Sites (2008). wasting time in supervising others on the site. With the decreasing

accident rate, the number of sites to attend become fewer. 8, 2010 SEPT. WEDNESDAY, 2. ICAO Circular 315 The best way to ensure safety and efficiency on the accident site, The intended purpose of ICAO Circular 315 is “...to assist individu- for all responders to the site, is to educate the responders in all als to consider and apply effective occupational safety management aspects of investigation skills, including hazards identification and practices both to their own activities and to the activities of the teams management. The form that this education and training takes is they work with or for which they are responsible.” The circular speci- the focus of the research. fies that “often, a balance must be struck between the requirements of the tasks and the need to make the performance of the task safe 4. Heath and safety training of aircraft for the investigation and response personnel.” Within the circular, an accident site responders overview is provided of different types of hazards potentially present The health and safety training aims identified in ICAO Circular 315 on site, and general risk management methods are discussed. (2008) include The Circular categorises onsite hazards into five overarching • “detailing the potential variable nature and scale of occupational categories: health hazards experienced at aircraft accident sites; 1. environmental hazards: accident location, fatigue, insects/wildlife, • outlining any applicable State occupational health and safety climate, security and political situation; legislation and its applicability to accident investigation activities 2. physical hazards: fire and flammable substances, stored energy undertaken by the state’s aircraft accident investigators; components, pressurised gases, military and ex-military aircraft, • providing an understanding of the occupational health risk man- recent safety equipment, pyrotechnics and explosives, and damaged agement, risk assessment, and risk control processes associated with and unstable structures; aircraft accident investigation operations; 3. biological hazards: general biological hazards and pathogens, and • providing an understanding of the hazards and means of preven- the local state of hygiene; tion of exposure to blood-borne pathogens that meet the require- 4. material hazards: metals and oxides, composite materials, chemi- ments of state training standards; cals and other substances; and • providing an awareness of the selection and use of personal 5. psychological hazards. protective equipment to meet the risks posed in aircraft accident investigation tasks; and 3. Historical perspective • providing an awareness of the effects and symptoms of psychologi- Investigators have long been aware of the presence of hazards on cal hazards associated with aircraft accident response activities.” site, but the exact nature of the hazards present, the extent of their The direct topics to be covered in a ICAO Circular 315 compliant presence on site, and the precise dangers that each hazard may pose training course include “risk management, hazards associated with to investigators collecting evidence is largely unknown. aircraft accident response, blood-borne pathogens, psychological One particular hazard that has been widely recognised on ac- reactions to aircraft accident response operations, site safety manage- cident sites is blood-borne pathogens. Completion of blood-borne ment, preservation of evidence, and protective clothing.” pathogen training prior to site entry is mandated in the USA by Training of accident investigators and other site responders may OSHA regulations, and some other nations also have similar re- be completed internally within organisations, or through the use quirements. The Canadian SASI blood-borne pathogen training of external training providers. Training should specifically consider programme is an example of how this particular area of hazards the job function that each individual will complete on a site so that training can be tailored for aircraft accident investigator needs. the specific exposure they may have to particular hazards may be However, the training guidelines in ICAO Circular 315 suggest that especially considered. the training for investigators is extended beyond simply considering All investigators and responders coming to Cranfield complete blood-borne pathogens. Biological hazards are just one of the five 2 days of accident site hazards awareness training, whether part of categories of hazards identified within the Circular. an accident investigation course, or as a stand-alone Hazards and The hazards present on a modern accident site may be similar to Evidence Awareness for Air Accident Responders course. Cranfield

ISASI 2010 Proceedings • 73 ISASI 2010 PROCEEDINGS 74 potentialtowardbiasteachingaofrisk aboutparticular of ness aware- be to needs There operations.” site accident to applied it as subject their in experienced and knowledgeable are who “trainers Circular 315. valid for a 2-year period, which is within the standards suggested in ancewith compli- (including training hazards of completion their stating just reusableequipment. not equipment, single-use wearing include should practice This site. accident real a attending when focus the become can ment, equip- the than rather collection, evidence the that so equipment, wearingresponderstheallowthebecometoment,willused to whether on a simulated site or within their own daily work environ- equipment, of levels different with Practicing changes. climate encounter they as or breaks, take they as site, of areas different in throughout the day, whether to gatorsprotect a better against idea of how theythe may needdifferent to change levelshazards of PP as cameras become apparent. such equipment non-disposable used, decontaminating with lems prob- potential and equipment, protective of level high a in once photography and taking notes, may become harder than expected stressestheyfeel.Standard evidence collectionadditional the methods,on suchascomment often PPE wearing investigators site, ornot. site entry respirators, which seems to create dust disposable issueswearing correctly whetheris area practicedproblem particular One before themselves. equipment the with practiced having when improved greatly are and demonstration, practical a watched having slightly equipment on this using the of simulatedperformance delegates the explained, siteonly are isPPE poor. Their actions are improvedprocedures for putting on clean PP classroom training only is using the PPE they have selected. When the risk assessments. giveinvestigators theinformation can education theyneedconducttohazards effectiveclassroom-based of method simple a that ouslyattendedaccidentanconducted site, is well.suggests This previ- not have they if even selection, PPE or measures mitigation appropriateandhazards siteinvestigators’ passed, appraisalof has excitement” “initial the when However, over. takes evidence collecting and preserving begin to instinct the and site, on arrive many delegates rapidly forget everything they learn the instant they having just received classroom education on potential site hazards, equipment. enceinselecting andworking inappropriate personal protective experi- practical and simulations, site and tabletop using teaching, to otherrespondersaroundthem. site and the specialist knowledge thatgroup’s each (possibly organisation competing) canpriorities provide each understanding in other andeach assist and site taskson experience of to achieve on the firefighters, and police. Delegates on the courses have a wide variety cident investigators, airframe and engine manufacturers, operators, has trained a wide variety of site responders, including national ac- also recommends that training be conducted by by conducted be training that recommends also 315 Circular card a with provided is delegate each course, the of end the At investi- gives Wearingalso exercise an through PPE appropriate accident aircraft simulated the from evidence collecting When following well particularly do not do delegates course the What O Training is provided as a combination of classroom and practical • bservationscoursedelegatessuggestthethat,despiteofon ISASI 2010 ISASI O SHAblood-borne pathogen regulations). This card is Proceedings E and taking off contaminated E management andaccidentinvestigationtechniques. safety and health, hazards, of knowledge wide a with professional safety a be ideally should trainer The hazards. site emerging and hazards; training should give a balanced view of all potential current fireandflammablesubstances • equipment, or the local state of hygiene. equipment, orthelocalstateof hygiene. sives, radioactive hazard, cargo, psychological hazards, recent safety explo- and gases pressurised by posed hazards of examples many composite• damagedandunstablestructures, • biologicalhazards, • aircraftlocation, • the aircraft-specifichazardsthatmayoccuronanaccidentsite. would affect a person in any workplace, but they are not as aware of investigators are well aware of general health and safety hazards that was identifiedfewerthan10times. duringthe survey of novice investigators, each of these categories and military aircraft. ex-military and hygiene, of state local etc.), systems, recovery ballistic as (such nents, fatigue, security, metals and oxides, recent safety equipment compo- energy stored by posed hazards the regarding knowledge accident sites. chemicals• accidentlocation,and • fireandflammablesubstances, • biologicalhazards, • damagedandunstablestructures, • categorised inthesameway. tion agency on accident and incident sites over a 6-year period were experienced investigators from a national aircraft accident investiga- by identified hazards The 2). Section (see analysis for used total in ICAO in identified categorised were according investigators these to the hazard by identified categories hazards and The sub-categories place. taken surveywasconducted prioranyotherto hazards training having hazards they thought posed the most risk on an accident site.[2003])298 Theat Cranfield ICAO by defined (as courses investigation accident basic identification ofhazardsonsitestheyhadattended. hazards posed a risk on a site and the expert accident investigator’s what of investigator’sperception novice the sites: accident aircraft The research considered two aspects of the awareness of hazards on recognition ofsitehazards hazards versusexperienced accidentinvestigators 5. Novice accident investigator perception of site damaged and unstable structures, biological hazards, and fire and and fire and hazards, biological structures, unstable and damaged novice investigators perceive as most risky on site (aircraft location, that hazards five the of four order, different a in given Although 6. Implicationoftheseresults ontrainingcoursedesign Experienced accident investigators did not report encountering as thefivemostcommonhazardsidentifiedonsites. Experienced aircraftaccidentinvestigatorsidentified The indication from these results is that novice aircraft accident O aircraft on risk most pose to perceived they hazards five the as The noviceaccidentinvestigatorsidentified O ne hundredne andtwenty oneaccident investigators attending f the other 15 hazards categories, the group showed littleshowed group categories,the hazards 15 other the f

and materials,

other (2008). There were 20 categories categories 20 were There (2008). 315 Circular

substances and

U niversitywere asked to identify the five Of the total 604 hazards identified

Circular Circular flammable substances) are the ones experienced investigators • Hazard management and mitigation measures should be trialed identify most commonly on a site. while completing simulated evidence collection tasks (or other tasks Novice accident investigators included risks from chemicals and conducted by particular responders to the site). This will give site other substances within their five perceived highest risk hazards, where responders an opportunity to become familiar with some of the experienced investigators identified it as only the seventh most com- equipment they may use and identify any problems they may have monly found on sites. Hazards associated with composite materials completing their job on a site. were reported by experienced investigators as the fourth most common • How the threats on a site may change, with aircraft type, opera- hazard, but only seventh by the novice accident investigators. tion, location, etc. The particular threats should be considered for The risk arising from cargo is identified by novices as quite high, different areas, tailoring the information to the needs of particular but identified by experienced investigators infrequently. Conversely, responders. Also potential theoretical hazards should be considered, novice investigators did not identify any risk associated with military even if they have not necessarily been documented as having oc- and ex-military aircraft, whereas experienced investigators identified curred on any accident sites yet. this in equal 11th ranking out of 20 hazards categories. The hazards • Broaden the range of those responders being trained to posed by metals and oxides are listed by experienced investigators identify and manage hazards on the accident site. Experienced as the 8 most common hazard, while novice investigators responses investigators do not need to spend their time on sites teaching rank these hazards as 15th most hazardous. novice investigators about hazards and supervising them on site. The hazards included as recent safety equipment and local state There is benefit in training other potential responders, possibly

of hygiene are not recognised as greatly significant by either novice including emergency services, volunteer support organisations, 8, 2010 SEPT. WEDNESDAY, or experienced accident investigators. as knowledgeable first responders may then be preserve perish- By identifying the hazards that novice accident investigators are able evidence earlier than investigators can get to it, without aware of, and perceive as a risk on an accident site, we can gather damaging other evidence on the site, or placing themselves in better knowledge about the general hazard identification skills that unnecessary danger. investigators have, and what hazards would be identified without • Finally, also give some consideration to the hazards that exist away further training. This can be used to optimise training time during from the accident site, both while conducting the accident (such the classroom education phase. as fatigue, personal security, and travel arrangements) and when Within each of the categories, the hazards identified by novice analysing evidence away from the site. investigators were quite general, where the hazards identified by Hazards are an inevitable part of every accident site, but they can experienced investigators were quite specific. It is suggested that be managed and all available evidence collected. With thorough training be tailored to include details about specific hazards within consideration of the training aims of ICAO Circular 315 (2008) each of the categories that would provide better awareness of the and capturing the hazards identification and management skills range of hazards that may be encountered. and knowledge of experienced accident investigators, novice site responders can be trained to successfully manage hazards from the 7. Conclusions first time on site. ◆ The results of this research suggest that to optimise the time and efficiency of an ICAO Circular 315 compliant training course, five References particular factors should be considered: ATSB (2007); AR-2007-021: Fibre composite aircraft-capability and safety. Australian Transport Safety Bureau, Canberra, Australia. • After an overview of the general health and safety concerns from FAA (2010); First responder safety at small aircraft or helicopter accidents. a site, a focus should be placed on reviewing aircraft-specific haz- http://www.faa.gov/aircraft/gen_av/first_responders/. ards. These will be the hazards that infrequent or inexperienced ICAO (2008); Circular 315: Hazards at Aircraft Accident Sites. International Civil Aviation Organisation, Montreal, Canada. accident investigators are unaware of and could potentially catch ICAO (2003); Circular 298: Training Guidelines for Aircraft Accident Investigators. them unaware on a site. International Civil Aviation Organisation, Montreal, Canada.

ISASI 2010 Proceedings • 75 ISASI 2010 PROCEEDINGS 76 and amasterofscience degree inaeronautical sciencewithaspecializa- gree inaerospace engineering withminorsinmathematics/aviationsafety cident investigation.Professor Brickhouseholdsabachelorofsciencede- ance (FOQA),airportground safety, andthe useofflight recorders inac- been involvedinresearch surrounding flightoperationalqualityassur and safetyevents.Sinceentering academia, Professor Brickhousehas the spanofhiscareer, hehasinvestigatednumerous aircraft accidents tion SafetyBoard (NTSB)inWashington, DistrictofColumbia. During of theOfficeResearch andEngineeringattheNational Transporta- safety staffatERAU, hewasassignedtotheVehicle Performance Division Scholarship in2009. tors (ISASI).Dyeralsoreceived theISASIRudyMemorial Kapustin a studentmemberoftheInternationalSocietyAirSafetyInvestiga- a memberoftheInternationalSocietySafetyEngineers(ISSE),and Executives (AAAE),theAmericanSocietyofSafetyEngineers(ASSE), Dyer hasbeenanaffiliatememberoftheAmericanAssociationAirport aircraft accidentinvestigationatCranfieldUniversity. Duringhiscareer, from 1999-2005. In 2001, he obtained training in thethe Aerodrome techniquesSafety Officer at the Vance of International Airport W. Amory meteorological technicianattheseairports.Healsoperformedduties as During this same period, he also functioned in the island federationofSt.KittsandNevis,duringtheperiod1990-2005. capacity of a class IV International andVance W. InternationalAirportsinthetwin Amory asanairtrafficcontrolR.L. Bradshaw served specialistatboththe advancement, Dyer, anativeoftheislandNevisinCaribbean, management, andsafetyscience(MSA)in2009.Prior tohiseducational 2008, andamastersofscienceinaeronautics withdualspecialization in tion businessadministration(BSABA)withaminorinsafetyscience Daytona Beachcampus,where hereceived abachelorsofscienceinavia- in 2010,Dyergraduatedfrom Aeronautical Embry–Riddle University, agencies. Prior tojoiningtheNevisDisasterManagementDepartment • By BrianR.Dyer, ProjectOfficer, NevisDisaster Management Department,St.KittsandNevis,AnthonyT. ISASI 2010 ISASI Mental Health Aspects of Aircraft Brickhouse, AssistantProfessor, Aeronautical University, Embry-Riddle DaytonaBeach,Fla. Proceedings Daytona Beachcampus.Before joiningtheaviation assistant aviation safety program manager for the Before joining the faculty of ERAU, he served Aeronautical as University.campus ofEmbry-Riddle the ences intheCollegeofAviation attheDaytonaBeach assigned totheDepartmentofAppliedAviation Sci- Anthony T. Brickhouse is an assistant professor local, regional, andinternationalorganizations and department provides support services to associate programs, and risk management. In addition, his disaster management,formulatingpoliciesand bilities incorporate the principles of comprehensiveManagement Department(NDMD).Hisresponsi- Brian Dyer is project officer in the Nevis Disaster Protecting theInvestigator Accident Investigation: - Introduction andhistoricalbackground and UnmannedAircraft SystemsWorking Groups. onitsGeneralAviation Safety of AirSafetyInvestigators(ISASI),serving Society Safety Engineers(ASSE)andisafullmemberoftheInternational Professor Brickhouseisaprofessional memberoftheAmericanSociety associated withthedegree andisinthefinalstagesofhisdissertation. education leadership in aviation. He has completed Universityall coursework pursuing the doctor of education degreeFischler atNovaSoutheastern SchoolofEducationandHumanServices with a focus on higher tion in aviation/aerospace safety systems. He is currently enrolled at the traumatic stress disorder. This table described post-traumatic stress post- and trauma psychological of symptoms common of table a stress disorder(PTSD). post-traumatic to changed is diagnosis sufferer,the the to distress significant or impairment functional with associated are features the acute stress disorder persist for more than a month, and if these murder, and combat. If the symptoms and behavioral disturbances of a witnessing accidents, in experiences near-death assault, physical trauma. Such extreme traumatic eventsan acute stress includedisorder usually begin during or rapeshortly following the or other of severesymptoms The trauma. extreme to exposure of month a within develop that disturbances behavioral and anxiety the as disorder and Rockwood,1993). diagnosis and to provide timely mitigation measures (Coarsey-Rader for important is stressor traumatic a become to event an allow tors challenge. a pose empiricalevidence that the exposure tothese critical events does aboutnegative reactions in aircraft accident investigators, bring always not does stressors psychological thereextreme to exposure is traumatic, and emotional situations at the chaotic, scene of the accidents. to While exposed are investigators the where instances are there However, personnel. services emergency the after accident health andresilienceareproventoolsforsurvival. air accident investigator. littleattention, and that is the mental health very andreceived resiliencyhas one challenges, these ofAmong the 1995). Sweginnis, borne pathogens, parachute systems, and aviation fluids (Wood and rials, serrated edged metals, environmental hazards, wild life, blood- include, but are not challenges limited to, these hazardous materials, of composite mate- Some established. be must points entry/exit and hazard, of degree the determine to surveyed be must site The The crash site possesses many challenges for air safety investigators. In1994, the American Psychiatric Association (APA) published M Aircraft accident investigators generally arrive at the scene of an edicalauthorDryden- nderstanding the cases in which the investiga- the which in cases the Understanding ssery Ussery and Waters, 2006 noted that mental E dwards(2004)described acutestress

disorder as an emotional illness that develops as a result of a terribly that persons who experience a major disaster and concomitant frightening, life-threatening, traumatic, catastrophic life experience acute stress reactions are at an elevated risk for the subsequent or otherwise highly unsafe experience. Individuals affected by post- development of post-traumatic stress disorder. Smith, North, Mc- traumatic stress disorder re-experience the traumatic event or events Cool, and Shea (1990) reported that over half of the primary victims in some way and are likely to practice avoidance. This occurs when developed a psychiatric disorder within 4 to 6 weeks as a result of the individual tends to avoid places, people, or other things that re- a jet crashing into a hotel. Chung, Easthope, Eaton, and McHugh mind them of the event. Sufferers may also experience hyper-arousal, (1999), and Taylor and Frazer (1982) noted that among secondary a state of being highly sensitive to normal life experiences. Some victims involved in the Mount Erebus air crash in 1981, one third may experience intrusive recollections of the event via flashbacks, experienced transient problems initially. One-fifth experienced dreams, or recurrent thoughts or visual images. Research suggests transient problems after three months. Lopez, Piffaut, and Seguin the circumstances of why some people develop post-traumatic stress (1992) indicated that a history of trauma may itself be a risk factor disorder, while others are more resilient and able to cope and move for depression. on, is complicated and poorly understood. Research from the International Critical Incident Stress Founda- Recently, the awareness of the psychological impacts of traumatic tion (ICISF) indicated that more than 90% of individuals involved and critical events has increased and post-traumatic treatments have in a traumatic event would develop some type of adverse psychologi- received considerable attention. This attention has brought greater cal effect. Kessler, Sonnega, Bromet, Hughes, and Nelson (1995) interests in the events that are likely to lead to post-traumatic stress estimated that PTSD occurs in around 14% of those exposed to

symptoms. Empirical evidence has found that post-traumatic stress traumatic events. Raphael (1986) estimated that 30-40% of those 8, 2010 SEPT. WEDNESDAY, symptoms may develop after a single exposure to a critical event. who experienced a significant stressful event would go on to develop Coarsey-Rader (1995) posited that clinical procedures have been a significantly distressing reaction by one year post-impact. Bisson, developed primarily for assisting first responders, military personnel Brayne, Ochberg, and Everly (2007) indicated PTSD rates tended and public safety employees, i.e., police, emergency management to be higher among individuals more directly exposed to traumatic technicians (EMT), and firefighters with symptoms of acute distress. events. However, they also indicated that recent research suggested However, there is currently no specific program developed for inter- lower rates of problematic reactions than imagined as a result of vention and prevention of distress experienced by aircraft accident marked human resilience in the wake of traumatic events. investigators (Coarsey-Rader, 1995). Bledsoe (2003) posited that in general, through years of training and experience, mental health professionals learn to isolate their Purpose of research feelings and emotions from their professional work. However, it The purpose of this research was to assess the traumatic effects of would be a difficult request to ask volunteers and non-mental health aircraft accidents on aircraft accident investigators. This has received professionals not to become emotionally involved. Notwithstand- very little attention since the primitive days of early aviation enthu- ing this consensus, empirical evidence has shown that on-scene siast and the Wright Brothers. Additionally, Coarsey-Rader (1995) traumatic stressors have indicated significant psychological distress found that there was no specific program developed to address among air accident investigators. Bilal, Rana, Rahim, and Ali (2007) the distress experienced by aircraft accident investigators. Ursano indicated that denial of the impact of work on their well being and and McCarroll (1990), Raphael (1986), and Coarsey-Rader (1995) functioning may serve well until it fails. Then they must face up to highlighted that aviation accidents are sometimes fatal and that their vulnerability. Coarsey-Rader and Rockwood (1993) found that aircraft accident investigators often experience graphic exposure to more than 50% of accident investigators consistently ranked fatal severe injuries, mutilated bodies, mass destruction, and the stench accidents as producing above-average stress. In accidents where of burnt flesh. children are injured or fatally wounded, Cotter (2004) found that This research examined the feasibility of an annual mental con- 70% of the respondents reported above average stress 50% reported ditioning program for personnel involved in aircraft accident inves- being very stressed, and 20% reported these accidents as excessively tigation. A methodical program may provide educational awareness stressful. Cotter (2004) attributed the above-average stress to identi- topics that include (1) improving coping skills; (2) expectations at fication with the victims, as many of the investigators were parents. an accident site; (3) common stress related symptoms (disturbed On the other hand, in accidents where the investigators knew the sleep, headaches, fear, decreased appetite and anxiety); (4) changes deceased or injured crewmembers, Cotter (2004) found 62% of in routine to avoid fatigue; (5) importance of teamwork, social and the respondents reported above-average stress, 40% reported the family life (Bilal et al., 2007); (6) importance of seeking assistance; accidents being very stressful, and 22% reported the accidents as (7) effective communication; and (8) understanding acute stress and excessively stressful. These results were attributed to the investiga- post-traumatic stress disorder, and the risk factors and prevalence tors associating the similarities between their own lives and that of following exposure to trauma (Smith, Tremethick, and Clocklin, the victims. 2005). Strengthening the initial defense of the investigators may Barboza (2005) highlighted that many people experience acute reduce the effects of exposure and stress. stress-related symptoms in the wake of traumatic events. However, only a few will develop acute stress disorder (ASD), post-traumatic Brief review of relevant literature stress disorder (PTSD), or both. Milano (2005) estimated that pro- Post-traumatic stress disorder is not the only pathological outcome ductivity typically decreases by 80% for 2 weeks after a crisis. Of the following traumatic events. Ursano, McCaughey, and Fullerton affected individuals, 8% required additional ongoing care. In cases (1994), and Weisaeth (1994) posited that psychological responses where personnel may experience harmful or negative effects from to traumatic events vary depending on the types of disasters and vic- exposure to traumatic and other critical events, structured and indi- tims. Birmes, Arrieu, Payen, Warner, and Schmitt (1999) suggested vidualized professional clinical treatment should be administered.

ISASI 2010 Proceedings • 77 ISASI 2010 PROCEEDINGS 78 of needs specific meet to designed interventions, group and individual of continuum a as to referred (CC)is counseling Crisis Crisis counseling(CC) a criticalincidentoraccident(Tompkins, 1997). following crewmembers and pilots among PTSD of onset the vent pre- help to and stress incident critical about members educate to the critical incident stress program into their organizations.acute human crisis (Flannery, 1999). Some Thisairlines have is also adopted with acute stress disorder (ASD), PTSD, and other manifestations of mitigate any potentially adverse post traumatic symptoms associated lize and mitigate acute psychological distresscritical incidents (Everly andand to also prevent or comprehensive,multi-component crisis intervention approach to departments, fire departments, and hospitals. CISM is an integrated utilized in a number of first responder organizations such as police method that is designed to reduce trauma symptoms and has been short-term another is (CISM ) management stress incident Critical Critical incidentstressmanagement(CISM) Slawinski, 2004). ethical,effectiveand post-crisis defensible, intervention with practitioners services (Blythe provides and employed is that method evidence-based The support. of relationships and mechanisms recovery natural encourage to designed approaches with replaced componentsindividualswherethe relivegraphicdetails. isThis debriefingtraditional the of elimination the of exception with the CISD to similar is It (RM). management resiliency is stress post-traumatic of element the handling of method alternative An Resiliency management(RM) within a team (Potter, n.d.). canminimize theeffect ofthedisaster experience onindividuals that maintenance team for activity an as used is PASSmodel This model. (ICISF) Foundation Stress Incident Critical International Remind phasecorrelates The Teaching/Reentrythe to performance. the their phaseof about have may they concerns any and works to elicit comments on the perception of the team memberscombining the Reaction/Symptom phase of the regular CISD and activities management stress and incident their critical the participation. discuss and about think The Response phase is describedReview,the questionsmembershavedesignedthephase areasto In CISD. regular the of phases Introduction/Fact/Thought the Response, and Remind/Review phases are described as combining cident stress-debriefing model and consists of three phases. Review, The post action staff support (PASS) is a variation of the critical in- Post actionstaffsupport(PASS) Teaching, and Reentry. Symptom, Reaction, Thought, finding, Fact Introduction, include incident,cal disaster, traumaticor experience. criti- to sevenThephasespertaining discussion group seven-phased formalized a is aviation of disasters.aftermath the Thisin model, intervention referredhealth mental topreventative as a the “ as and Yasuhara Pace, Cigrang, (1995) incident. indicated traumatic a that from this recover model quickly has also to beeners used respond- emergency assist to 1970s late the during model (CISD) T. Jeffery Critical incidentstressdebriefing(CISD) • ISASI 2010 ISASI itchell developed the critical incident stress-debriefing stress-debriefing incident critical the developed Mitchell Proceedings Mitchell, 1996). Its purpose is to stabi- M itchell M odel,” A, 1993, p. 9). (FEMA, 1993,p.9). may help survivors recover to their pre-disaster level of functioning that agencies and individuals other with linkages encourages and survivors in reviewing their options. It provides emotional support understandingin theircurrent situation, reactions, andassisting assistingdisastersurvivorscounselingof goalstheinvolve tions - interven These disasters. large-scale to stress psychological ing experienc- groups and individuals with interventions short-term defined the crisis counseling program as an initiativeNationalThe that 2005). supports (Milano, impact of levels different experiencing people Ph.D., of Ph.D., Bradshaw, Amy Professor was counselor health mental industry Frank Taylor now retired, formerly of the Cranfield Cranfield Ph.D., Braithwaite, Graham Professor Branch; Investigation Accident Aircraft Ireland the of air safety investigator of the Transport Safety Institute; research. The air safety investigators included Troy Jackson, senior following professionals who were instrumental to the success of this the from obtained was information Invaluable counseling. health background in aircraft accident investigation, psychology, or mental Contact was made via e-mail with several industry professionals with a Research design (Ruzeketal.,2007). and linkagewithcollaborativeservices support, coping on information supports, social with connection assistance, practical gathering, information stabilization, comfort, and safety engagement, and contact actions: core eight around ofacomprehensive disaster/trauma response, PFA is constructed component initial an as Designed functioning. adaptive long-term actions aimed at initial post-trauma distress and supporting short-and helping of set systematic a of (PFA) consists aid first Psychological Psychological firstaid(PFA) investigation population. investigation population. critical events represented a broad spectrum of the aircraft accident to exposures of number the and experience, their participants, of number The seminar. 2009 ISASI the of attendees and serve, list Curt the through contacted well associalsupportfollowing investigations. Somequestions also obtained information about coping skills, as ence or behavioral responses of the investigators pre/post accident. Likert Scale data based on the attitudes, opinions, and actual experi- that required a “yes” or “no” response. The second category collected employmentaffiliation. There were some closed-ended questions category collected demographics such as gender, marital status, and survey questions were categorized into two distinct formats. The first in seminar 2009 ISASI the attending delegates Associates and utilizingthedailyflight safety information mail electronic services via Curtof disseminated was It items. 13 contained ment and utilized as the primary research instrument. The refined instru- created was survey A duties. their of discourse the during trauma and events critical to exposed individuals to applicable are that of theHigherResources,Inc. Readiness Group International includedBrendaTillman,TaniaPh.D.,theand Ph.D.,Glen,of The survey consisted of 233 participants (n = 233) that werethat233) participants consisted233 =survey Theof(n Thisresearch examined the primary clinical treatment options mbry-Riddle Aeronautical Embry-Riddle M C. The instrument was also administered to the the to administered also was instrument The LLC. entalHealthInformation Center(N ewis and Associates flight safety mail mail safety flight Associates and Lewis LLC, and Carolyn V. Coarsey, Ph.D., University. psychologists The niversity; and Professor Professor and University; rlando, Fla. The The Fla. Orlando, University. The ary Cotter Cotter Mary M HIC) hasHIC) L ewis convenient to confide in a colleague. In response to a question dealing with voluntarily seeking assistance, 16.4% stated that they were very unlikely to voluntarily seek assistance, while 19.15% of the participants reported that they were unlikely to do so. On the other hand, 32% were likely to voluntarily seek assistance while 13.8% were very likely to do so. There were 18.7% who were undecided to seek voluntary assistance. These results indicate that there is significant resistance among the air safety investigators to voluntarily seek assistance even after experiencing the ill effects. Of those who sought assistance, 50% did so within 1-3 weeks after the event, 27.8% did so between 1-6 months and 5.6% did so between

Figure 1. Symptoms experienced by participants. 7-12 months post impact. There were 12.5% 8, 2010 SEPT. WEDNESDAY, who reported seeking assistance one-year Discussion of results post impact. This indicates that some individuals may have been There was sufficient evidence in medical and psychological journals hesitant in seeking assistance while the distress remained persistent, to demonstrate that a strong relationship exists between stressful life problematic, or a limiting factor in the individual’s performance. events and the emergence of a broad range of physical and mental Others may have ignored the side effects and relied on their natural health disorders (Ussery and Waters, 2006). Likewise, aircraft acci- resilience before being overwhelmed by the psychological distress. dent investigation is inherently psychologically stressful. The effects In response to a question on how the exposure to trauma affected of unresolved stressors were manifested in a variety of symptoms ex- the way the safety investigators related to their families, the options pressed by the participants. This study was conducted with a sample available were fear, anger, eating, caring, a change in routine and of 233 participants of which 97.9% returned completed surveys and other symptoms. Participants were also given an opportunity to 2.1% returned incomplete surveys. Of the 228 completed surveys, provide a brief explanation. Some participants expressed other 10.1% were females and 89.9% were males. These participants symptoms that included the following: difficulty sleeping or sleep- submitted responses to a 13-question survey instrument. ing disorders, reduced patience with others, valued time with others The results of the analysis indicated that the level of experience more, compartmentalization, depression, withdrawal, and lack of of the participants did not preclude them from the ill effects of ex- interest from fatigue. (See Figure 2.) posure to trauma. The symptoms of anxiety, difficulty concentrating, One participant reported, “Fear of death of family members or fatigue, and multiple symptoms of anxiety/fatigue were reported myself.” Another participant reported that they “lost interest in in every experience category. Additionally, there were participants committed relationships,” while another reported that “no effect who reported experiencing all four symptoms simultaneously, in that I noticed. Perhaps you should also ask partners!” This was an four of the five experience categories. The group with 15-19 years’ important statement as 78.1% of the participants were married, experience was the only exception. 12.3% were single, 0.9% was engaged, and 2.6% were separated Fatigue, anxiety, and difficulty concentrating were the dominant while 5.7% were divorced. Only one individual mentioned that the symptoms manifested in the participants. The analysis revealed that job might have been a contributory factor in their divorce. This 64.5% were fatigued, 53.5% experienced anxiety, and 32.5% experienced a difficulty concentrating. Among the other symptoms, 19.7% experienced fear, and 12.7% experienced guilt. (See Figure 1.) Flannery (1999) also noted that individuals have a tendency to feel that asking for support is a sign of weakness and results in that person ignoring the side effects, which may have irreversible effects. This behavior may have contributed to the extent of the symptoms experienced among the participants. The results show that 31.6% confided in a colleague or sought professional assistance while 68.4% of the participants did not. One respondent indicated that other problems existed that contribute to the high percentage of individuals who did not find it Figure 2. How participants related to their family post exposure.

ISASI 2010 Proceedings • 79 ISASI 2010 PROCEEDINGS 80 af- of behaviors in differences recognized who friends close and distresses. their natural resilience before being overwhelmedvidual’s performance. by psychologicalindi- the in factor limiting a or problematic, persistent, remained individualshesitantseekingwereassistancein distress whilethe anxiety, and difficulty concentratingdent investigation is inherently psychologically stressful with beingfatigue, rampantacci- aircraft that found symptoms.research This investigators. protect better Some ultimately to effort an in investigation safety air of aspects health The purpose of this study was to take a deeper look into the mental Conclusions disagreed, and8%disagreed.(SeeFigure3.) agreed. strongly 23% and agreed 40% that showed responses the grams, cident stresstrainingmaynotbeofferedatsomeorganizations. One participant underscored constraints budgetary why pre/post ac- continued and implemented across all air accident investigation units. trauma. conditioning or being capable of mitigating the ill effects of secondary training programs must be evaluated for their effectiveness at providing 38.4%provided neither “pre”nor “post” accidentrevealed also results training.The training. accident Thesepre/post both provided 42% while accident, “post” provided 16.1% training, accident “pre” provided 3.6% that indicated results The investigators. safety air the for training incident stress/critical accident pre/post of form some another expressed that “I wanted to quit my job!” who reported, “It caused me to get extreme-chronic PTSD.” While up, but I rather just say I am used to getting shot at.” There was one wall constant a have I say might I toll.... their take course of ments flesh at accident sites. sociation of barbeque meats with the stench and sight of the burnt as- the confirms This awhile.” for persons burnt with dealing after eatingwhentheyreported, “Nobarbeques ported that they encountered problems with re- who another was There investigators.” accident and crewmembers fellow of being well- the of caring the response, incident involved in accident investigation via critical increased whenthedustsettled.” “Appreciation stated, individual Another family.”and life own my of appreciation my the death of a parent and child strengthened reported,severalwereTherewho“Seeing eating problems, but those have gone away.” investigated have been couples. At first etyI due had to the fact that accidents that I have husband, I have difficulties with fear and anxi- my with fly I “When expressed, individual withactivities theypreviously enjoyed. trauma inrelationships. of effects ill the determine to investigators safety air of partners or spouses the among research additional for avenue an creates In the area of mandatory annual critical incident training pro- training incident critical annual mandatory of area the In provided have and initiative the taken have organizations Some amcommented, who“I one was There struggled who individuals were There • ISASI 2010 ISASI O n the other hand, 22% remained neutral, 7% strongly strongly 7% neutral, remained 22% hand, other the On nceproven adequate, these training programs should be O therswere forced into different programs byspouses Proceedings One individual expressed, “Constant deploy- Others ignored the side effects and relied on O ne Figure 3. LikertScaleresponse toannualtrainingprogram. durance during the execution of their duties. durance during theexecutionoftheirduties. en- and focus, conditioning, mental promote would This content. mentalhealth aspects and coping skills assubjects intheir course als for aircraft accident investigative techniques should incorporate Universities • are proposed: recommendations following the whole, a on organizations and als individu- affected the by action remedial encourage to and events, events.Inaneffort tomitigate thetraumatic ill effects to ofexposureexposure and tothese investigators safety air among distress It was determined that there is a correlation between psychological fects attributed to the exposure to trauma on air safety investigators. This research was conducted to increase the awareness of the ill ef- Recommendations tigators mayreducetheeffectsofexposureandacutestress. correct the ill effects. Strengthening the initial defense of the inves- or mitigate to priority given be should individuals these of health psychological and emotional the for Concerns ASIs. to harmful is trauma secondary events, critical to exposures of number the or neither “pre”nor“post”accidenttraining. 42% provided both pre/post accident training while 38.4% provided incidenttrainingsafetyair forinvestigators. resultsTherevealed stress/critical accident pre/post of form some provided have and was the only exception. Some organizationsfour symptoms simultaneously. The have15-19 years’ experience takencategory the all initiativeexperiencing reported who participants were there categories, experiencecategory. Additionally, every experiencefive in theoffour in reported were anxiety/fatigue symptoms multiple and trauma. Symptoms such as anxiety, difficulty concentrating, fatigue, posures did not preclude an ASI from the ill effects of exposure to experiencing the ill effects. after even assistance seek voluntarily to population ASI the among fected individuals. This confirmed that there is significant resistance This research concluded that regardless of the level of experience ex- of number the and experience of level the of comparison A and other educational institutions preparing individu- • Build resiliency in current and future air safety investigators by 2, p. 125-37. Retrieved April 22, 2009, from Health Module database. (Docu- helping them to master stress, build vitality, engage in emotion and ment ID: 43276537). Cigrang, J.A., Pace, J.V., and Yasuhara, T.T. (1995). Critical Incident Stress In- focus of the mind through continuous education, training, good tervention following fatal aircraft mishap. Aviation, Space, & Environmental practices, and modifications in workplace culture. Medicine, 66, 880-882. • Air safety investigators should be encouraged to monitor their Coarsey-Rader (1995). Effects of Investigation of a Fatal Air Crash on 13 Govern- ment Investigators. Washington State University at Spokane 601 West First stress levels prior to, during and post accidents. In addition, ASIs Avenue Spokane, WA 99202-0399. Retrieved Oct. 29, 2008, from http://www. should be encouraged to seek the appropriate care in a timely man- colorado.edu/hazards/research/qr/qr80.html. ner to minimize the ill effects. Coarsey-Rader, C.V., and Rockwood, T. (1993) “Secondary Trauma and the Air Safety Investigator.” Paper presented at the 14th annual seminar of the Interna- • There were 178 married participants in this study. A follow-up tional Society of Air Safety Investigators. Ottawa, Manitoba, Canada; October. study should be conducted among the spouses of the air safety Cotter, M. (2004). The Air Accident Investigator, “Sometimes The Hidden investigators to determine the impact of the secondary trauma in Victims.” Research Study presented at the 2005 International Society of Air Safety Investigators (ISASI) Conference, Forth Worth, Texas. their relationships. This could be accomplished by implementing Dryden-Edwards, R. (2004). Definition of Acute stress disorder. Medicine Net. a program for the spouses of air safety investigators to share infor- Retrieved July 23, 2009, from http://www.medterms.com/script/main/art. mation concerning the stress-related issues experienced and the asp?articlekey=38856. Federal Emergency Management Agency (FEMA) (1993). Crisis Counseling mitigation measures that were applicable. Assistance and Training Program Guidance. Version 1.1. U.S. Department of • Annual critical incident training program similar to the annual Health and Human Services, Substance Abuse and Mental Health Services blood-borne pathogens training should be developed to provide Administration, Center for Mental Health Services. Retrieved Aug. 23, 2009, from http://download.ncadi.samhsa.gov/ken/pdf/cmhs/CCP_Program_

standard mental conditioning for air safety investigators. ◆ Guidance_ver1.1.pdf. 8, 2010 SEPT. WEDNESDAY, Flannery, Jr., R.B. (1999). Psychological Trauma and Post-traumatic Stress Dis- References order: A Review of Psychological Trauma and PTSD. American Psychiatric Association (1994). Diagnostic and statistical manual of Kessler, R.C., Sonnega, A., Bromet, E., Hughes, M., Nelson, C.B. (1995). Post- mental disorders. Fourth Edition. Washington, D.C.: The author. traumatic stress disorder in the National Comorbidity Survey. Archives of Barboza, K. (2005). Critical Incident Stress Debriefing (CISD): Efficacy in General Psychiatry, 52, 1048-1060. Question. The New School Psychology Bulletin NSPB: 2005–Vol. 3, No. 2. Lopez, G., Piffaut, G., and Seguin, A. (1992). Psychological treatment of victims Retrieved May 2, 2009, from http://www.newschool.edu/nssr/bulletin/pdfs/ of rape. Psychologie Medicale, 24, 286-288. vol03no02/Barboza.pdf. Milano, C. (2005). The Benefits of Post-Crisis Counseling. Risk Manage- Bilal, M.S., Rana, M.H., Rahim, S., and Ali, S. (2007). Psychological Trauma in a ment, 52(5), 12-17. Retrieved Oct. 10, 2008, from ABI/INFORM Global da- Relief Worker–A Case Report from Earthquake-Struck Areas of North Pakistan. tabase. (Document ID: 835690911). Pre-hospital and Disaster Medicine Vol.22, No. 5. Raphael, B., Meldrum, L., and McFarlane, A.C. (1995). Does debriefing after Birmes, P., Arrieu, A., Payen, A., Warner, B.A., and Schmitt, L. (1999). Traumatic psychological trauma work? Time for randomized controlled trials. British stress and depression in a group of plane crash survivors. Journal of Nervous Medical Journal, 310, 1479-1480. and Mental Disease, 187, 754-755. Tompkins, M. (1997). Critical Incident Stress Management: Preparing for the Bisson, J.I., Brayne, M., Ochberg, F.M., and Everly, Jr. G.S. (2007). Early Psycho- Aftermath. The International Society of Women Airline Pilots. social Intervention Following Traumatic Events. The American Journal of Ursano, R.J., and McCarroll, J.E. (1990). The nature of a traumatic stressor: Psychiatry, 164(7), 1016-9. Retrieved October 21, 2008, from Research Library Handling dead bodies. Journal of Nervous and Mental Disease (1990) Core database. (Document ID: 1301548601). 178:396-8. Bledsoe, B. (2004). CISM debunk. Retrieved May 26, 2009, from http://www. Ursano, R.J., McCaughey, B.G., and Fullerton, C.S. (1994). Individual and bryanbledsoe.com/cismdebunk.htm. Community Responses to Trauma and Disaster. Cambridge university Press, Bledsoe, B. (2003). Critical Incident Stress Management (CISM): Benefit or risk 1994. for emergency services? Pre-hospital Emergency Care, 7, 272-279. Ussery, J.W., and Waters, A.J. (2006). COP-2-COP Hotlines: Programs to Address Blythe, B.T., Slawinski, T.T. (2004). An Alternative to Stress Debriefings. Risk the Needs of First Responders and Their Families. Brief Treatment and Crisis Management, 51(5), 48. Retrieved Oct. 9, 2008, from ABI/INFORM Global da- Intervention, 6(1), 66. Retrieved Oct. 10, 2008, from Psychology Module database. (Document ID: 637027871). tabase. (Document ID: 1006476701). Chung, M.C., Easthope, Y., Eaton, B., and McHugh, C. (1999). Describing trau- Wood, R.H., and Sweginnis, R.W. (1995). Aircraft Accident Investigation. Protec- matic responses and distress of community residents directly and indirectly tion of Investigators pg. 156-157. Endeavor Books 7307 6WN Road, Casper, exposed to an aircraft crash. Psychiatry. New York: Summer 1999. Vol. 62, Iss. WY 82604.

ISASI 2010 Proceedings • 81 ISASI 2010 PROCEEDINGS 82 errors at results show clearly defined, statistically described paths that decision pilots’ decision-making, ultimately leading for of unsafe acts and hence indirectly impairing the performance to 68% of accidents. The visorypractices, therebysuper creatingaffect directly thepsychological to found were preconditions levels management upper in their observations. Statistical relationships linking fallible decisions the categorization of an accident, the raters convened and resolved narrative of each accident report. Where there were discrepancies in ence or the absence pres- ofThe 2003). eachShappell, and (Wiegmann HFACSframework (HFACS) category was evaluated from analyzed the using the Human Factors Analysis and Classification System 2008. and 1999 between reports obtained from RO C Aviation Safety Council (ASC) published accident 51 analyzes research This accidents. military of 53% and proposed that decision errors contributed to 56% of airline accidents general fatal aviation accidents in the all of 52% and nonfatal all of 35% to contributed likely towork.JensenandBenel(1977)foundthatdecisionerrors responseoption conductingby mentala simulation isitsee ifto wide-ranging considerations, her or she will evaluate the dominant making for time sufficient is there recognizes pilot a if decision, a requiring problem a with faced When circumstances.” of set given to consistently determine the best course of action in response to a as “a systematic approach to Aeronautical thedecision-making (ADM) is mentaldefined by the FAA (1991) process used by aircraftAbstract pilots Safety Division,Aviation SafetyCouncil,Taiwan. (Photonotavailable.) Thomas Wang istheactingmanagingdirector andheadoftheFlight University,Kainan Taiwan. (Photonotavailable.) Yueh-Ling Hsuisaprofessor intheDepartmentofAirTransportation, Tsing HuaUniversity, Taiwan. (Photonotavailable.) Lun-Wen Liisinindustrialengineeringandmanagement, Kingdom. (Photonotavailable.) Don Harrisisthemanagingdirector ofHFISolutionsLtd.,theUnited Don Harris,ManagingDirectorofHFISolutionsLtd.,UnitedKingdom;un-Wen Li,IndustrialEngineeringand • Department ofAirTransportation, KainanUniversity, Taiwan; andThomasWang, ActingManagingDirector ISASI 2010 ISASI Level-1 with inadequacies at both the immediately adjacent Investigating Accidents Related to Errors of Aeronautical Decision- Errors ofAeronautical By Wen-Chin Li,HeadoftheGraduateSchoolPsychology, NationalDefense University, Taiwan; E Proceedings ngineering University, Taiwan. Graduate School of Psychology, National Defense Wen ChinLi,topic presenter, is the head of the Making inFlightOperations United States. Furthermore, Diehl (1991) and theHeadofFlightSafetyDivision,Aviation SafetyCouncil,Taiwan ach accident report was independently independently was report accident Each M anagement, Tsing Hua U niversity, Taiwan; Yueh- - man Errors,HumanFactorsAnalysisandClassificationSystem Keywords: Accident Prevention, Aeronautical Making, Decision- Hu- tional andhumanfactorsmustbeaddressed. flight operations these “paths to failure” relating to these organiza- accidents. To reduce the accident rate regarding decision errors in aircraft result in decision errors on the flight deck and subsequent decisions at higher managerial levels in the operation of commercial understanding, based upon empirical evidence, of how actions and an provides study This organization. the in levels higher also and conclusion that “it is difficult toO’Hare (2003) thinkreviewed aeronautical decision-making and ofmade a any single topic novices. than problems thatof models complex more have and iscauses more speed and accuracy of problem solving. information is used, their memory for critical information, and the what devised, are strategies what interpreted, are problems how in studies show fundamental differences between novices and experts McDermott, Simon, and Simon (1980) advised that problem-solving actions that appear contrary to those prescribed by checklist. situation assessments, and under rienced certaindecision-makers consider a large number specificof cues in building circumstances, take all of these cases rests in correctly understanding the situation. military accidents. decision errors contributed to 56% of airline accidents and 53% of between 1970 and 1974. Furthermore, Diehl (1991) proposed that and 52% of all fatal general aviation accidents in the (1977) found that decision Benel and errorssafety.However,Jensen aviation promotes that process contributed to 35% of all nonfatal decision-making aeronautical the of part key a be should agement man- risk and awareness situation Pilots’ 1984). Diehl, and (Buch viewed as an intrinsic quality or as a by-product of flying experience aircraft. Aeronautical decision-making (ADM) has traditionally been sion performance in addition to those decisions related to flying the must learn to make decisions and develop judgment related to mis- to getting the aircraft from oneaddition in pointtasks of array wide toa another. perform must Pilots 1993). Salas, As a result, pilots risk within a limited-time frame situation ( awareness, choice amongst alternatives and assessment of chomotor performance but also real-time decision-making involving psy- skilled of issue an only not is aircraft high-technology a Flying Introduction Endsley (1997) suggested the key to effective decision-making in L ing Hsu, Professor in the E ndsley, 1993 and 1997; Prince and Experts can see underlying

nited States United States

arkin, Larkin, - Expe central to the question of effective human performance in aviation their aircraft safely. Their primary task may be to intercept offensive than that of decision-making.” Current FAA regulations require that aircraft or to deliver weapons, troops, or equipment. Often the act decision-making be taught as part of the pilot-training curriculum of flying the aircraft per se in a hostile environment becomes a sec- (FAA, DOT 61.125); however, little guidance is provided as to how ondary task. As a result, military pilots must learn to make decisions that might be accomplished, and none is given as to how it might related to mission performance in addition to those related to flying be measured, outside of the practical test. the aircraft per se (Kaempf and Orasanu, 1997). Flying advanced fighter aircraft has made increasing demands on pilots’ cognitive Literature review abilities as the complexity of cockpit systems and the tactical situation Aeronautical decision-making is defined by the FAA (1991) as “a has grown. There is now a requirement for decision-making training systematic approach to the mental process used by aircraft pilots to be incorporated into tactical training programs. Furthermore, to consistently determine the best course of action in response to a many accidents are either wholly or partially attributable to poor given set of circumstances” (Hunter, 2003). Jensen’s (1997) defined decision-making (Li, Harris, and Yu, 2005). However, at the pres- pilot judgment as “the mental process that pilots use in making deci- ent time, there is no formal training program available for military sion.” Both definitions implicitly include both process and outcome. pilots making effective decisions under high pressure and in a Fischer, Orasanu, and Wich (1995) suggested that risk and time time-limited situation. pressure are situational variables that further constrain the decision Automated aids in the aviation industry are designed specifically process, as risk and time pressure may call for an immediate response to decrease pilots’ workload by performing many cognitive tasks, not

whether or not the problem was fully understood. Minimal risk levels only including information processing, system monitoring, diagno- 8, 2010 SEPT. WEDNESDAY, and fewer time constraints, in contrast, permit additional diagnostic sis, and prediction, but also controlling the physical placement of the actions or the deliberation of options. Jensen, Guilke and Tigner aircraft. Flight management systems (FMS) are designed not only (1997) suggested that risk management should be a key part of the to keep the aircraft on course, but also to assume increasing control decision-making process. Risk assessment feeds into decision-making of the cognitive flight task, such as calculating fuel-efficient routes, in two ways: during the assessment of the precipitating threats and navigating, or detecting and diagnosing system malfunctions. An in evaluating potential courses of action. Janis and Mann (1977) inevitable facet of these automated aids is that they change the way proposed that a good decision-making process is one in which the pilots perform tasks and make decisions. However, the presence of decision-maker successfully accomplishes the collection of informa- automated cues also diminishes the likelihood that decision makers tion about a wide range of alternatives, carefully assessed the risks will either make the cognitive effort to process all available informa- and benefits of each course of action, and prepares contingency tion in cognitively complex ways. Parasuraman and Riley (1997) plans for dealing with known risks. describe this tendency toward overreliance as “automation misuse.” The processes of decision-making center around two elements— In addition, automated cues increase the probability that decision- situation assessment, which is used as a precursor to generate a makers will cut off situation assessment prematurely when prompted plausible course of action, and mental simulation to evaluate that do take a course of action by automated aids. Automation commis- course of action for risk management. If a pilot recognizes there is sion errors are errors made when decision-makers inappropriately sufficient time for making wide-ranging considerations, her or she follow automated information or directive (e.g., when other infor- will evaluate the dominant response option by conducting a mental mation in the environment contradicts or is inconsistent with the simulation to see if it is likely to work. If there is not adequate time, automated cue) that have begun surfacing recently as by-products of the pilot will tend to implement the course of action that experience automated systems. Experimental evidence of automation-induced (if any) dictates is the most likely to be successful. Klein (1993) found commission errors was provided by a full-mission simulation in the that whereas experts use a recognition-primed or perception-based NASA Ames Advanced Concepts Flight Simulator (Mosier, Skitka, decision process to retrieve a single likely option, novices were more Heers, and Burdick, 1998). likely to use an analytical approach, systematically comparing multi- Orasanu and Fisher (1997) investigated the five highest perfor- ple options, and experience affects the processes of decision-making mance pilots and the five lowest performance pilots and found a by improving the accuracy of situation assessment, increasing the tendency for high performance pilots to use low workload situa- quality of the courses of action considered and by enabling the deci- tions to make plans and collect more relevant information when sion maker to construct a mental simulation. Furthermore, Endsley compared with the poorer performing pilots. High performance (1997) defines situation awareness (SA) as “the perception of the pilots also demonstrated greater situation awareness. The key issues elements in the environment within a volume of time and space, of a pilot’s decision-making are time pressure and risk. For more the comprehension of their meaning, and the projection of their than 30 years, the importance of aeronautical decision-making has status in the future.” In the dynamic tactical environment, effective been recognized as critical to the safe operation of aircraft. Jensen decision-making is highly dependent on situation awareness, which and Benel (1977) reported that the majority of fatal general aviation has been identified as a critical decision component (Endsley and accidents was associated with decision errors. More recent studies Bolstad, 1994). Situation assessment is the process by which the state (Shappell and Wiegmann, 2004) have also found decision errors of situation awareness is achieved and is a fundamental precursor have contributed to 45% of accidents in the USAF, and 55% in the to situation awareness, which is itself the precursor for all aspects of U.S. Navy. Orasanu and Connolly (1993) have suggested that much decision-making (Nobel, 1993; Prince and Salas, 1997). decision-making occurs in an organizational context and that the Tactical flight training has many aspects that challenge the qual- organization influences decisions directly by stipulating standard op- ity and processes of pilots’ inflight decision-making. In addition to erating procedures and indirectly through the organization’s norms the tasks and situations faced by the pilot of a civil aircraft, military and culture. Maurino et al. (1995) suggested that it is important to pilots must perform a wide range of other tasks in addition to flying understand how decisions made by people at the sharp-end (pilots)

ISASI 2010 Proceedings • 83 ISASI 2010 PROCEEDINGS detailed description of the content of the 18 individualdetailed18descriptionthe HFACScontenttheof of the definitions of the four different levels of HFACS, and a further included an introduction to the HFACS framework, explanation of aviationdeliveredpsychologist.anules by trainingThesyllabus mod- half-day three of consisted training This it. of understanding frameworkensure categorization tothattheyachieveddetailed and aaccurate and analysis the of use the on together trained been previously had analysts The independently. report accident design: Research and “organizationalprocess.” climate,” “organizational management,” “resource sub-categories: three of is comprised and influences” “organizational labeled is violation.” “supervisory inappropriate operation,” “failure to correct known problem,” and “planned supervision,” “inadequate categories: four the includes which supervision,” “unsafe with concerned is HFACS of Level-3 ness,”“physical environment,” “technologicaland environment.” mental limitations,” “crew resource management,” “personal readi- it: “adverse mental states,” “adverse physiological states,” “physical/ “preconditions for unsafe acts.” This has seven sub-categories within “violations.” and errors,” tual four sub-categories of “decision errors,” “skill-based errors,” “percep- safe acts of operators” that can lead to an accident. This comprises Level-1 of the HFACS categorizes events under the headings of “un- scribed in Wiegmann and Shappell (2003) was utilized in this study. framework: Classification (http://www.asc.gov.tw/asc_en/accident_list_1.asp). accident reports may be found on the ROC Aviation Council website 206, and 430; Boeing 234; DASH-8-300, Fokker 50) and commercial helicopters (Bell Canada Havilland De 72-200, (ATR aircraft turboprop-powered 84 11, A320, and A330; Boeing B-737 and B-747; accidents analysed, including commercial jets airliners (Airbus A300, time period. There were 24 different cidents occurred and typeshad been completed investigation within this of ac- aircraft51 of total A involved2008. and 1999 between in Council theSafety Aviation Data: Method accidents. that human decisions and actions are implicated in all organizational maintained,and managed by human beings, so it is no surprising As Reason (1997) noted, complex systems are designed, operated, management. of aspects other and/or regulation, manufacturing, upper management levels of the organization and may be related to nizationalenvironment. Theseorga- latent and failures operational arespawned their therecently,in more acknowledged as and tasks and tools peoples’ of features to connected systematically Johnson,1988). Dekker (2001) proposed that and human errors Bettman, are (Payne, conditions environmental and situational by affected is and process cognitive complex a is Decision-making pre-cursors of accidents, and the actual errors committed by pilots. psychological structures, organizational between relationship the describing formally work empirical little is there However, tions. organiza- their in levels managerial higher the worlds, operating are influenced by the actions of the people at the blunt-end of their • MD-82, ISASI 2010 ISASI Theaviation accident reports were obtained from the R D-83, and MD-83, Two aviation human factors specialists coded each each coded specialists factors human Twoaviation Proceedings Level-4, the highest level in the framework, The version of the HFACS framework de- framework HFACS the of version The D90): private jets (Bombardier BD700): BD700): (Bombardier jets private MD90): Eurocopter BK117). Full copies of all these evel-2 of HFACS is concerned with with concerned is HFACS of Level-2 McDonnell-Douglas H-1H, UH-1H, MD- O C Statistical analysis: Chi-square (χ accident, theratersconvenedandresolvedtheirobservations. accident. Where there were discrepancies in the categorization of an of the presence or absence of each of the 18 categories within a given only once per accident, thus this count acted simply as an indicator accident report. each of narrative the from evaluated was HFACScategory each of Harris, 2006, 2008). The presence (coded 1) or absence (coded 0) and (Li reports accident 523 of total a analysis the undertook also categories.undertakingPriorto present thestudythese analysts of agreementtoindicateacceptablereliabilitybetweenraters. reliabilities were assessed using Cohen’s Kappa and percentage rate HFACS cannot adversely affect higher levels. Finally, the inter-rater value for lambda. From a theoretical standpoint, lower levels in the only really theoretically meaningful when associated with a non-zero benoted that asodds ratios are anasymmetric measure, they are with the presence of a factor in another category. However, it must factor in one tory HFACS being associated concomitantly category provided an estimate of the likelihood of the presence of a contribu- between categories. Also, odds ratios were applied to calculate which going beyond what may be deemed a simple test of co-occurrenceto influence (cause) changes at thethe lowerrelationship, with the higher organizationallevels in the HFACS being deemed levels, thus underlying HFACS. The value for Tau (t framework,congruentwhichis theoretical withthe assumptions asbeing dependent upon the categories at the higher level in the est level categories of decision error in the HFACS was designatedTau(t (PRE). error in reduction proportional the calculate to used was with further analyses using Goodman and Kruskal’s Tau (t test is a simple test of association these analyses were supplemented wereassessed usingCohen’s Kappa.categoriesThere 10are the the inter-rater reliabilities, calculated on a category-by-category, basis raters, the between coding in discrepancies of resolution to Prior Inter-rater reliability section asawhole. results the across 100% than more to sum quoted percentages the just a single factor were implicated in an accidenting up to an accident. However, sequence, in most instances many more than hence lead- events of sequence the in implicated HFACSwas an category that times of percentage the to refer quoted percentages the that 57 (17.7 %) of instances. It must be noted in the following analyses ences” level in the HFACS model (Level-4) was involved as a factor in influ- “organizational the and instances; of (23.1%) 74 in involved (25.2%)ofinstances; the“unsafe 81 supervision” in factor causal levela ( as was (Level-2) level acts” unsafe for ditions “precon- the instances; of (33.9%) 109 in involved were (Level-1) Initial results found that acts at the level framework. of HFACS “unsafe of acts of category operators” highest the as (68.6%) accidents of 35 in involved were errors” Table“Decision (see 1). framework HFACSthe using recorded were accidents, 51 the of factors causal underlying the describing error, human of instances 321 total In Sample characteristics Results in the higher and lower levels of the HFACS were used. As the As used. were HFACS the of levels lower and higher the in measure the statistical strength of association between the categories ) has the advantage of being a directional statistic. The low- The statistic. directional a being of advantage the has ) Each HFACS category was counted a maximum of 2 ) analyses of the cross-tabulations to ) indicates the strength of ) indicates the strength of L evel-3)was ), which ), which χ 2 supervision” indicated that of a possible 12 relationships, three pairs of associations were significant (p<0.05). “Organizational process” was significantly associated with “inadequate supervision,” “planned inappropriate operations,” and “supervisory violations” at Level-3. Inadequate supervision is more than 27 times more likely to occur when there are organizational level issues associated with poor “organizational process.” The strength of association between categories at Level-3 “unsafe supervision” versus Level-2 “preconditions for unsafe acts” indicated that of a possible 28 relationships, six pairs of associations were significant (p<0.05). These were “inadequate supervision” at Level-3 versus “CRM,” “adverse mental states,” and “personal readiness” at

Level-2; “planned inappropriate operations” 8, 2010 SEPT. WEDNESDAY, with the “physical environment” and “CRM,” and “supervisory violation” versus “personal readiness.” Of these comparisons, it can be seen that poor “personal readiness” was more than 11 times more likely to occur in the presence of “inadequate supervision” at the higher level. Similarly, CRM was more than 9 times more likely to occur in the presence of “inadequate supervision” at the higher level.

Direct path of association between upper categories and decision errors Analysis of the strength of association between Table 1. Frequency, Percentage, Ordinal, and Inter-rater Reliabilities of each HFACS Category categories at Level-4 “organizational influ- for All 51 Accidents Between 1999 and 2008 ences,” Level-3 “unsafe supervision,” and Level-2 “preconditions for unsafe acts” versus Kappa values in excess of 0.40, which is regarded as being accept- “decision errors” at Level-1 “unsafe acts of operators” directly indi- able (Landis and Koch, 1977). For the remainder of the categories, cated that of a possible 14 relationships, 9 pairs of associations were though, the Kappa value failed to achieve this level. Below 0.40 is significant (p<0.05). The following categories: “organizational pro- regarded as a poor level of inter-rater reliability. However, Cohen’s cess” (Level-4); “inadequate supervision,” “planned inappropriate Kappa has several weaknesses as an index of inter-rater reliability. operations,” and “supervisory violations” (Level-3); “adverse mental Low observed frequencies can distort Kappa values, deflating its states,” “physical/mental limitations,” “crew resource management,” value where there is actually a very high level of agreement. Cohen’s “personal readiness,” and “physical environment” (Level-2) were Kappa becomes unreliable when the vast majority of observations significantly associated with “decision errors” at Level-1. Of these fall into just one of the categories, and there is also a high percent- comparisons, it can be seen that “decision errors” were more than age of agreement between raters in this category. In such a case, 15 times more likely to occur in the presence of “CRM,” more than Cohen’s Kappa will be low as the statistic is based upon expected 13times more likely to occur in the presence of “planned inappropri- probabilities calculated from the marginal observed totals. Kappa ate operations,” and more than 4 times more likely to occur in the does not take in to account raters’ sensitivity and specificity and presence of “organizational process” at the higher level. becomes unreliable when raters’ agreement is either very small or very high (Huddlestone, 2003). As a result, inter-rater reliabilities Discussion were also calculated as a simple percentage rate of agreement. These It can be seen from the data presented in Table 1 that “decision er- showed reliability figures of between 56.9% and 96.1%, indicating rors” is the key point of human factors in flight operations related to acceptable reliability between the raters (see Table 1). Decision error the highest percentage (68.6%) of accidents among 18 categories, has 0.52 of Kappa value, and 80.4% percentage rate of agreement and the majority of HFACS categories had large enough numbers for inter-rater reliabilities. of instances of occurrence in the data set to allow reasonable confidence in the pattern of results obtained. The findings are accord Indirect path of association between latent failure and active failure with previous researches conducted by Jensen and Benel (1977), Analysis of the strength of association between categories at Diehl (1991), Li and Harris (2006 and 2008). All categories also HFACS Level-4 “organizational influences” versus Level-3 “unsafe exhibited good levels of inter-rater reliability calculated by percent-

ISASI 2010 Proceedings • 85 ISASI 2010 PROCEEDINGS 86 and 2008. Kruskal’s Tau the significantassociationswith decisionerror usingChi-square (χ Figure 1. and procedures operating standard of ment establish- the including organization, an within activities everyday process” “Organizational framework. HFACS in factor key the was Level-4 pilots’ decision-making(seeFigure1). with influence direct a have supervision” “unsafe Level-3 HFACS at categories also at 2007). 523 of ROC air analysis force accidents the previously reported in by found also was results of pattern similar A study provides statistical support for this hypothesized relationship. and hencethesubsequentactionsoffront-lineoperators.This visorylevel, which inturn affects thepsychological super the preconditions at practices and personnel the influence adversely can management upper-level by decision-making inappropriate that hypothesized (2003) Shappell and Wiegmann and (1990) Reason ultimately at the root of decision errors resulting in accidents. Both tions”at the level of “unsafe supervision” and hence directly viola- “supervisory wereand operations,” inappropriate “planned sion,” “organizational processes” were associated with “inadequate - supervi particularly important factor at this highest organizational level. Poor a is process” “organizational of category The supervision.” “unsafe ences” had associations with further inadequacies at HFACS HFACS at inadequacies that show clearly paper this in analyses The system. the of parts operational arguments but such inequities can create safety problems in other, organization may originally have been based on sound commercial on sion deci- original The systems. all in present inevitably are acts unsafe Gaur, 2005;LiandHarris,20052008). 2003; Shappell, and Wiegmann (e.g., studies previous in reported ageagreement. These weregoodas as, excessinor of,thelevels Figure 1 reveals that the category of “organizational process” at at process” “organizational of category the that reveals 1 Figure Reason (1990, 1997) proposed that latent conditions promoting evel-2 have a direct influence on pilots’ decision-making, but but decision-making, pilots’ on influence direct a have Level-2 • ISASI 2010 ISASI M how to allocate resources made at the highest levels in the the in levels highest the at made resources allocate to how refers to corporaterefersto decisions rulesgovernthat andthe oreover,thisresearch proposes thatonlynotcategories Paths betweencategoriesatthefourlevelsin HFACS framework showing ( t ) Proceedings

for thedataderivedfrom 51accidentsreports byASCbetween1999 evel-4 “organizational influences” and and influences” “organizational Level-4 vl4 ognztoa influ- “organizational Level-4 methodsformal for Li and Harris (2006, evel-1 Level-1 evel-3 Level-3 - Goodman and 2) andGoodman support personnel; “personal readiness” refers to when individuals ATC,with as well as aircraft, the within and other or maintenance, poor coordination among personnel, such as coordination between of occurrences for account to created was management” resource incompatible physical capabilities and a lack of aptitude to fly; “crew visual limitations, insufficient reaction time, information overload, exceedcapabilitiesthe individual thecontrols,ofthe at assuch limitations” refers to those instancestion, distraction, when operationaland mental fatiguerequirementsfixa- task awareness, situational of loss as such dueperformance, affect to stress; that conditions “physical/mentalmental for account to created was states” mental influence regarding pilots’ decision errors. at environment” “physical and readiness,” “personal management,” verse mental states,” “physical/mental limitations,” “crewpilots’ decision-making, resourcebut also have significant association with “ad- categoriesat dures, and inadequate documentation. for flight, failure to enforce rules and regulations, violation of proce- disregarded by supervisors, such willfully as authorizing are an unqualified regulations crew and rules existing when instances those for reserved are violations” “supervisory workload; excessive and failure to provide adequate briefing time, risk outweighing benefit, ated as a category to account for failures such as poor crew pairing, cre- was operation” inappropriate “planned awareness; situational accountability, of lack qualifications, the track supervisory loss and professional guidance, failure to provide proper training, failure to provide to failure supervisor’s a to refers supervision” “inadequate and provide their personnel with the facilities at violations” and“supervisory capability to succeed inadequate “planned supervision,” inappropriate operations,” and have particularly influenced pilots’ decision-makingInappropriatemanagement. at in“organizational and process” workforce practicesthe between balances and checks maintaining Level-2. Finally, all of these five categories at to ensure the job is done safely and efficiently. and safely done is job the ensure to L evel-3not only have a direct influence regarding to mapping of the psychological precursors of of precursors psychological the of mapping one” to “many a is there that suggested has 1). Figure (see Level-1 at errors decision pilots’ of failures active the with relationships statistical strong a readiness,” and “physical environment” “personal had management,” resource “crew mental states,” “physical/mental limitations,” at categories five shows study this of finding situationalThepsychologicalfactors. and between interplay the by governed is havior and toxinsinthecockpit. weather, altitude, terrain, lighting, vibration, ment and the ambient environment, such as ment” refers to both the operational environ- “physical training; inadequate and off-duty,when overexertion self-medicating, requirements, rest crew adhere to failures breakdown in “personal A readiness”levels. optimal at includes perform to ready work individualsas expectedareforshowup to fail to prepare physically or mentally for duty, Reason (1990) suggested that human be- human that suggested (1990) Reason L evel-2(latent/active failures), “adverse Level-3. The role of supervisors is to supervisorsis of role The Moreover, all of these three The category of “adverse Reason (1990, 1997) 1997) (1990, Reason Level-2 have a direct The category category The L evel-1 and environ- unsafe acts and the actual errors themselves, making it difficult to “organizational process.” In terms of ignoring the PVD message, predict which actual errors will occur as a result of which precondi- which corresponds to Level-1, the pilot’s decision errors are directly tions. The results of this study using the HFACS framework support connected to the company’s policy. In the company’s document, this assertion. There are statistically significant associations between there is no regulation about PVD, which is verified in the B-747- causal factors at the higher organizational levels, psychological 400 flight handbook by Singapore Civil Aviation Administration, contributory factors and decision errors made by pilots (see Figure and there is no relevant PVD procedure to guide pilots regarding 1). It can even be suggested that poor organizational processes at how to confirm runway position with PVD under low visualization the highest levels in the organization result in poor supervisory condition. Besides, there is no handling procedure, training, and oversight, which themselves lead to inappropriate preconditions supervision for pilots by airlines while PVD is malfunctioning. These for unsafe acts resulting in making inappropriate decision in flight factors are related to Level-4 “organizational process” and Level-3 operations. However, some prudent considerations need to be taken “inadequate supervision” across Level-2. Therefore, refer to SQ-006, when interpreting the statistical relationships presented within it illustrates that events at Level-1 can be directly affected by events Figure 1. In a few categories, the frequency counts are moderately at Level-2; moreover, it is also possible that they are directly affected small. Furthermore, the frequency counts within categories were by Level-3 and Level-4 without Level-2 or Level-3. This research is all derived from accidents. It is unknown (and unknowable) how aimed at providing a new direction for flight safety administration often instances within the various HFACS categories have occurred and the investigation unit for future reference in developing ac- in day-to-day operations that have not resulted in an accident. Thus, cident prevention strategies for flight operations.

the relationships between HFACS levels and categories should not The causal factors of accidents relevant to decision errors are usu- 8, 2010 SEPT. WEDNESDAY, be interpreted outside the accident causal sequence. Nevertheless, ally underestimated and even misunderstood, as there were many the results of this study of civil aviation accidents occurring in the accidents caused by inadequate decision-making of pilots are attrib- ROC show a remarkable similarity to the study of military accidents uted to pilots’ violations (Li and Harris, 2008). “Decision-making” conducted in the air force of the same country. is a rather complicated cognitive process that not only affects by Although there is no relevant research regarding direct influence physical, mental, flying condition, and technical environment, but on cross levels of HFACS so far, this research indeed shows the strong also is affects by organizational management and supervisory class. association of cross level influence between categories atL evel-4 and In fact, “decision-making” is like any other flying skill that can be Level-3 to decision errors at Level-1. Aviation accidents always caused learn and promote flying safety (Jensen and Hunter, 2002; Klein, by a series of human factors and these factors from organizational 1993; Prince and Salas, 1997). Therefore, designing the relevant influence to unsafe acts of pilots are closely connected to each other. training strategy according to these factors to enhance the quality The results of this study reveal further discovery comparing with the of a pilot’s decision-making is the top priority for flight safety ad- HFACS theory proposed by Wiegmann and Shappell (2003) “each ministration and airlines. higher level in framework will directly affect the events in the lower level.” For example, Oct. 31, 2000, a Singapore airlines B-747-400 Conclusions (SQ-006) crashed on Runway 05-R, which is partially closed, while Aeronautical knowledge, skill, and judgment have always been taking off from Taoyuan International Airport. In the meantime, regarded as the three basic faculties that pilots must possess. The the airport is hit by the skirt of a typhoon and covered in a strong requisite knowledge and skills have been imparted in academic downpour. The airline had 20 flight crews and 159 passengers. The and flight training programs and have subsequently been evalu- following fire damaged the whole aircraft and caused 83 deaths and ated as part of the pilot certification process. In contrast, judgment 39 serious injuries. According to the accident investigation report, has usually been considered to be a trait that good pilots innately the pilot should have been be able to tell the physical environment possess (Buch and Diehl, 1984). The advent of improved accidents from runway and taxiway light, central light (the middle line of N1 investigation technology, such as cockpit voice recorders, along glide sign and Left 05 Runway), and the different light structure, with a more systematic review of accident statistics, has produced a PVD (para-visual display) that the aircraft was not on the centerline growing realization of the significance of pilots’ decision errors in of Runway 05-L. However, the pilot’s decision-making ability and aviation mishaps (Diehl, 1991; Li and Harris, 2006, 2007 and 2008). situation awareness are potentially affected by the time pressure of The introduction of new technology has motivated the military and taking off before striking typhoon, strong wind, low visualization, and airline to put greater emphasis on the role of the pilot as a manager wet and slide runway condition. And all these potential factors led and decision-maker. Thus, an attempt has been to improve decision the pilot to taxi to Runway 05-R, which is maintaining and caused the skills and to better understand the underlying causes of judgment accident. Classify this accident by HFACS. Level-1 “decision error” is errors. However, “decision-making” in training program is short comprised of many issues, such as entering the wrong runway, ignor- of relevant research and regarded as a by-product of flying experi- ing the PVD message, and adopting 30/hr crosswind limit (adopted ence. This study provides an understanding, based upon empirical wet runway standard instead of slough one). “Decision errors” of evidence, of how actions and decisions at higher managerial levels pilot taxiing onto wrong runway and taking off are directly affected in the operation of commercial aircraft result in decision errors on by the strong wind, heavy rain, low visualization with typhoon, the flight deck and subsequent accidents. The results show clearly time pressure of taking off before being hit by typhoon, attention defined, statistically described paths that relate errors atL evel-1 (the on central light of taxiway, sign and light facility; HFACS lEvel-2 operational level) with inadequacies at both the immediately adja- consisted of “physical environment,” “adverse mental states,” and cent and also higher levels in the organization. This research draws “crew resource management.” Besides, the accident was also affected a clear picture that supports Reason’s (1990) model of active failures by company’s procedure, rule, training, and supervision, which resulting from latent conditions in the organization. To reduce the belongs to HFACS Level-3 “inadequate supervision,” and Level-4 accident rate regarding decision errors in flight operations, these

ISASI 2010 Proceedings • 87 ISASI 2010 PROCEEDINGS Diehl, A. (1991), “The 88 Fischer, Federal Aviation Administration (1991), E Endsley, Human of Re-invention “The (2001), S. Dekker, Buch,G.,and Diehl, A.(1984), “AnInvestigation ofthe References of humanfactorsmustbeaddressed. “paths to failure” relating to these organizational and preconditions Endsley, Janis, I.L., and Hunter, D.R. (2003), “Measuring General Aviation Pilot Judgment Huddlestone, J.A. (2003), to Applied System Classification Gaur,and Analysis Factors “Human (2005), D. Jensen, R.S., Guilke, J., and Tigner, R. (1997), “Understanding (1997), Tigner,R. and J., Guilke, R.S., Jensen, Jensen,R.S. (1997), “The Boundaries of Aviation Psychology, Human Factors, Jensen, R., and Hunter, D. (2002), Jensen, R., and Benel, R. (1977), Klein,(1993),G.A.Recognition-Primed“A Decision(RPD) Kaempf, G.L., and ndsley, M Aerospace Safety, Vol. 1(3),p.247-266. Problem Situations,” in Jensen, R.S. and Rakovan, and R.S. Jensen, in Situations,” Problem Advisory Circular60-22,U.S.DepartmentofTransportation,Advisory Washington. Awareness,” (2), p.157-168. Fighters,” Combat to-Air Judgment Training,” HumanFactors,Vol. 26(5),p.557-564. L Making,” in Zsambok, C.E. and Klein, G. ( ogy, Vol. 2,Columbus,Ohio,U.S.A.,ThehioStateniversity, p.640-655. E Vol. 13(4),p.373-386. Technique,”Judgment ational Multi-Player SimulatorforAirCombatTraining, CranfieldUniversity, England . Vol.76 (5),p.501-505. India,” in Accidents Aircraft Civil Ohio StateUniversity, p.777-782. national Symposium on Aviation Psychology, Vol. 2, Columbus, Decision Salas, R., Flin, in Judgment,” 259-268. Management,” Decision Aeronautical FAA, Washington, D.C. Training, FederalAviation Administration,Washington, D.C. Choice, andCommitment,FreePress,NewYork. New Jersey, p. 138-147. C.E. (Editor), ahwah, p. 81-90. Decision Making,LawrenceErlbaum,Mahwah,p.81-90. ralistic Decision E Applications, and Themes Emerging Stress: Under Making • rror,” in Jensen, R.S. (E awrence ngland, pp. 233-242. ISASI 2010 ISASI U M.R. (1997), “The Role of Situation Awareness in Naturalistic Decision .R. (1993), “A survey of Situation Awareness Requirements in Air- in Requirements Awareness Situation of survey “A (1993), M.R. ., .R. and Bolstad, C.A. (1994), “Individual Differences in Pilot Situation M O E aking,” in Klein, G.A., rlbaum, Mann, rasanu,Wich,andJ., The International Journal of Aviation Journal The International Psychology, Vol. 4, (3), p. 241-264. Decision Making in Action: Models and Methods, Ablex, Norwood, Vol. 7 (4), p.(4), Vol.7 Psychology, Aviation of Journal International The Orasanu, J. (1997), “Current and Future Applications of Natu- Making,” in Zsambok, C.E. and Klein, G. (Editor), Proceedings L. (1977), E M ffectiveness of Training Programs for Preventing Aircrew ahwah, p. 269-284. An An Evaluation of the Training Effectiveness of a Low-Fidelity, ditor), ditor), aking, Situation Awareness, and Crew Resource Resource Crew and Awareness, Situation Making, The International Journal of Aviation Psychology,Aviation of Vol. Journal International The 3 Decision Making: A Psychological Analysis of Conflict, ., Strub, E., Judgment Evaluation and Instruction in Civil Pilot Sixth Sixth International Symposium on Aviation Psychol The International Journal of Aviation Psychology,Aviation of Journal International The General Aviation Aeronautical Decision-Making, O Aviation, Space, and Environmental Medicine, Environmental and Aviation,Space, M rasanu, J., Calderwood, R., and Zsambok, . (1995),.“ Aeronautical Decision-Making, Report no. ., and M., Editor), ◆ E Martin, xpertPilots’Perceptions of Error,” Naturalistic Decision Making, .A. (Editor), L.A. Ashgate,Aldershot, E . (Editor), L. ffectivenessofPilot Human FactorsHumanand O M hio, xpert Aviator Aviator Expert odel of Rapidofodel Using a Situ- U Eighth Inter- Eighth Naturalistic Naturalistic .S.A., The Decision Decision -

L L Li, W-C., and Harris, D. (2005), “Aeronautical Decision-Making: Instructor-Pilot Li, W-C., and Harris, D. (2006), “Pilot error and its relationship with higher orga- “Eastern (2007), W-C.,A. Li, Chen, and D., Harris, “The (2008), D. Harris, and W-C., Li, O “A (1993), D. Noble, ., Reason, J., Johnston, N., and N., Johnston, J., Reason, D.E., Maurino, M Wiegmann, D.A. and Shappell, S.A. (2003), S.A. Shappell, and D.A. Wiegmann, Shappell,S.A., andWiegmann, D.A. (2004), “HFACS Analysis of (1997), J. Reason, Reason, J.(1990),HumanError, CambridgeUniversity, NewYork. Prince,C.,andSalas Salas, and C., Prince, Payne, J.W., Bettman, J.R., and Johnson, Parasuraman,R., and Riley, V. (1997), “Humans and automation: use, misuse, O Orasanu, J., and Connolly, T. (1993), “The Reinvention of Decision arkin, J., andis, J.R., and Koch, G.G. (1977). “The rasanu, J., and Fischer, ’Hare,(2003),D. “Aeronautical Decision osier,K. for CategoricalData,”Biometrics,33,p.159-174. Evaluation of Five Medicine, Vol. 77(10),p.1056-1061. nizational levels: HFACS analysis of 523 accidents,” and EnvironmentalMedicine,Vol. 78(4),p.420-425 Meta-analysis of human factors in mishaps from three nations,” Aviation Space ofAviationJournal Psychology, Vol. 18(2),p.135-152. TrainingDecision-Making nautical for Program inSolvingPhysicsProblems.Science20,p.1335-1342. Performance p. 287-305.Jersey, New Norwood, Ablex, Methods, and Models Action: in Making Decision Aids,” in Klein, G.A., ofAviationJournal Psychology, 8,p.47-63. Decision Vol. 76(12),p.1156-1161. Human Factors,AshgatePublishing,England. Aldershot, England. System, Classification and Analysis Factors Human The Analysis: Accident Ashgate, Society ofAirSafetyInvestigators,Australia,Queensland,p.2-8. Comparison,” American North A Accidents: Aviation Civilian shot, England. Cockpit Resource Management, Academic Press, San Diego, Military Aircrew,” in Wiener, 315-324. Decision Cognition, Vol. 14,p.534-552. Decision-Making,” in disuse, abuse,”HumanFactors,Vol. 39,p.230-253. ralistic DecisionMaking,LawrenceErlbaum,Mahwah,p.343-358. The View From the Cockpit,” in Zsambok, C.E. and Klein, G. Editor), ( Making inAction:ModelsandMethods, Ablex, Norwood, New Jersey, p. 3-20. Klein, G.A., Jersey, p. 201-237. Transportation,in Factors Human Psychology: Aviation Tsang,in Methods,” P.S. Vidulich, and M L .,Skitka, aking and Performance in High-Techin Cockpits. Performance and Making cDermott, J., Simon, D.P. and Simon, H.A. (1980). Making,” Orasanu, J., Calderwood, R., and Zsambok, C.E. (Editor), Ashgate, Alder Ashgate, Accidents, Organizational of Risks the Managing Mnemonic L E odel to Support Development of Situation Assessment Assessment Situation of Development Support to Model Vol.(4),Ergonomics, p.1 Cognitive of Journal International . (1997), “Situation Assessment for Routine Flight and and Flight Routine for Assessment “Situation (1997), E. .J.,Heers, S., and Burdick, O . (1993),. “Training andResearch forTeamwork thein U Journal of Experimental Psychology: Learning, Memory and and Memory Learning, Psychology: Experimental of Journal rasanu, rasanu, J., Calderwood, R., and Zsambok, C. . (1997), “Finding Decisions in Natural E.L., Kanki, B.G., and Helmreich, R.L. (Editor), Methods,” valuation of the of Evaluation .J. E.J. (1988), “Adaptive Strategy Selection M .A. (Editor), M.A. Aviation Space Environmental Medicine, easurement of A Human Error ApproachAviation to Error Human A M ee, R.B. (1995), R.B. Lee, aking: M ilitary Pilots,” Military inds in Westernin Minds Cockpits: . (1998),. Automation Bias: Aviation Space Environmental L M awrence etaphors, Principles and Practice of ffect of a short Aero- short a of Effect O bserver Agreement E xpert and Novice TheInternational Beyond Aviation Beyond E E nvironments: rlbaum,New M M International International International International Making,” in . E. ( odels,and ilitaryand E Decision Decision ditor), ditor), Natu- -

The Use of Commercial Satellite Imagery in Aircraft Accident Investigation: Results from Recent Trials By Dr. Matthew Greaves (AO7700) and Professor Graham Braithwaite (MO3644), Cranfield Safety and Accident Investigation Centre, Cranfield University, Beds, MK43 0AL, UK

Matthew Greaves is a lecturer in the Safety and Commercial satellite imaging 9, 2010 SEPT. THURSDAY, Accident Investigation Centre at Cranfield University. The availability and use of commercial satellite imagery has grown Prior to joining Cranfield, he worked for the science markedly in recent years with no better demonstrator than the ubiq- and technology organisation QinetiQ. He holds an en- uitous Google Earth. However, acquiring this imagery on demand is gineering degree and a Ph.D. in aircraft engine noise not cheap, and therefore it is useful for investigators to know what and vibration. His research deals with the application of can potentially be achieved by this technology. For example, it would technology to the accident investigation process. be helpful to know whether, say, a flight data recorder can be identified by a particular satellite before spending many thousands of Graham Braithwaite is head of the Department of pounds acquiring the image to order. Whilst the published specifica- Air Transport at Cranfield University, UK. He was tions of the imaging satellite can provide some of this information, appointed director of the Safety and Accident Investi- they are not the whole picture! gation Centre in 2003 and awarded a chair in safety There is a wide range of satellites offering images in the visible and accident investigation in 2006. Prior to this, he spectrum, all with different resolutions and characteristics. Table 1 worked as a lecturer at the University of New South shows some of the higher resolution satellites and the best resolu- Wales, Sydney. Graham holds a Ph.D. in aviation tion available from each. This indicates the smallest dimension that safety management from Loughborough University, and his research has can be resolved and hence a lower number is better. Resolutions focused on issues of safety, culture, and investigator training. are shown for both panchromatic images (black and white) and multispectral (colour and other bands). Clearly, the panchromatic Introduction resolutions are much greater than the multispectral. One useful In the majority of aircraft accidents, the wreckage is easily located and concept when dealing with satellite imagery is that of ground sample is accessible to investigators; however, there are notable exceptions. distance (GSD), which is the size of area on the ground represented The loss of Air France Flight 447 over the Atlantic Ocean in 2009 and as a pixel at nadir (i.e., overhead). As the viewing angle changes Adam Air Flight 574, which crashed near Indonesia in 2007, show from directly overhead, i.e., increasing off-nadir angle (ONA), the the difficulty that can be experienced in locating aircraft wreckage. available resolution reduces. Similarly, the RAF Nimrod, which crashed in Afghanistan in 2006, and UTA Flight 772, which broke up over the Sahara Desert in 1989, Satellite Panchromatic (m) Multispectral (m) both show that wreckage can be difficult or even impossible to access OrbView-3 1 4 due to either political or geographical constraints. IKONOS 0.82 4 For these reasons, there has been an increasing interest in the use EROS-B 0.7 - of general aerial imagery for the location and subsequent analysis of QuickBird 0.61 2.44 aircraft accidents. In more populated areas, this may come from police, WorldView-1 0.5 - air ambulance, or even news helicopters, but again, this will be absent WorldView-2 0.46* 1.84* in more remote regions. Some agencies and organisations may have GeoEye-1 0.41* 1.64* arrangements that allow access to imagery from military satellites, which may have different capabilities than commercial satellites. Following the Table 1. Available Resolutions of Commercial Satellites loss of Flight 447, a request was made for the U.S. government to use *Subject to restrictions, see below. satellite technology to assist in the search for wreckage. However, there are often issues surrounding the priority of acquiring this imagery and Satellite Resolution (m) its subsequent access and use in the civilian domain. As a result, atten- RADARSAT-2 3 tion has turned to the use of commercial satellite imagery for accident COSMO-SkyMed 1 location and investigation. This paper evaluates the current state of the TerraSAR-X 1 art focusing on the needs and priorities of an accident investigation and reporting upon live als conducted in Cyprus in 2009. Table 2. Available resolutions of Commercial Radar Satellites

ISASI 2010 Proceedings • 89 ISASI 2010 PROCEEDINGS is produced. image an resembling anything before required is post-processing software may be required to view the image. In some cases, further chain should also be considered when acquiring imagery as specialist processing the that means This JPEG. or TIFF common more the say, the National Imagery Transmission Format (NITF) rather than be, can format default the format, delivered the specify to possible additional complication arises from the file format. Whilst it is often of currenthandhelddeviceswillnotdealwithafilethissize. An majority The handling. file to respect with implications has which image, km 10 x km 10 a for 1GB e.g., significant, be can involved digital file. Dependent upon the size of the imaged area, the file size in resolution. reduction a to lead often will area in increase an that but etc.) km, satellites can image a range of areas (e.g., 5k m x 5k m, 10 km x 10 most camera, a on lens zoom the like just that noted be should It etc. range, dynamic post-processing, projection, and datum tion), include file type, imaging mode (related to imaged area and resolu- the specifics of acquiring discuss to anpaper this of scope the image,beyond is it Whilst image. the of parameters that can be adjusted modes and settings, some of which will drastically affect the outcome many are there where cameras SLR with drawn be can analogy An image. an acquiring before specified be to need that parameters the image,wouldgenerallybebetween1and2days. having to request of point from image, specific a task to take would satellite orbit. However, as a general guideline, the minimum time it done depends on a number of factors including budget, priority, and satellite to acquire specific imagery. The speed with which this can be imagery of the accident site is portrequired, the itprocess will ofbe necessaryinvestigating useful for planning, torecovery, visualisation, etc., it offers tasklittle to sup- the the accident. Therefore, theif satellite up-to-date to acquire a new image. it Clearly,is possible either to purchase a whilstpre-existing “library” image libraryor to task imagery is considering thatpoorweatherisafactorinmanyaccidents. when relevant particularly is This limitation. same the from suffer not does radar whereas cloud, thick through image to unable are radar satellites available and their associated resolutions. commercial the of three shows Table2 resolutions. lower slightly at albeit imagery, radar commercial of availability the in increase sentially yieldingahigh-resolutioncolourimage. es- image, panchromatic the from information geometric the with involves fusing the colour information from a multispectralwhichspecifiedoftencanbe image when requesting imagery.the This pan-sharpening, of that is imagery (EO) electro-optical from able be availableinthenearfuture. feasible that resolutions better than those currently offered will not least at is it improve, to continue will resolutions and investigation accident of case the in granted be may approval this Whilst lution. reso- m 0.5 give to resampled be will m 0.5 than better resolutions approval by the GSD panchromatic and 2.0 m GSD multispectral and use isof imagery from subject to prior 90 These points are not raised to discourage the investigator, but but investigator, the discourage to raised not are points These a as delivered usually is it acquired, been has image an Once Imaging satellites are scientific instruments with a wide range of In general when obtaining satellite imagery of a particular location, in growth this with Commensurate One useful technique aimed at maximising the information avail- Whilst satellite resolutions continue to improve, the distribution • ISASI 2010 ISASI U.S. government. Without this approval, images at Proceedings U.S.-owned satellites at better than 0.50 m satellites has been an an been has satellites EO EO satellites region of£10,000. ing level and relatively narrow acquisition window, would be in the task- assured the given image, this tasking of cost commercial The GeoGenesis using viewed was other two “orange” squares are unpainted and not raised!) The file the and completed three-quarters only is square orange m 4 x m 4 10:00 GMT; comparison of Figures 1a and approximately 1b show that the orange at completed was target the of painting because was acquired on at “assured” tasking level for a time window of Aug. 17-21, 2009, and NITF 2.1 format with a file size ofdistance 960at an average off-nadir angle of 3°. The file was supplied in a 0.6 m (panchromatic) and 2.4 m (multispectral) ground sample synthetic apertureradarsatellite(courtesyofinfoterraGmbH). from the QuickBird satellite and a radar image from the TerraSAR-X differential GPSmapping. Joint Aircraft Recovery and Transportation Squadron (JARTS) using a 4 m x 4 m square panel. All three sites were also surveyed byplotting. theClearly, finding an intact 50 m fuselage will be easier than and location wreckage of end challenging more the at problems of array an offered sites These satellite. the for “testcard” a as use ranging from 0.5 m x 0.5 m to 4 m x 4 m and real wreckage, all for objectsvariousofofmaterialssizes and including metalsquares grid consisted third site a floatingThe boomsea. tail of andat door helicopter a used second the and terrain, representative in materials) mixed and fibre, carbon (metallic, components aircraft due tothegenerallyclearskiesandavailabilityofopenspace. ogy Investigation Branch (AAIB), and the Defence Science and Technol- anger. in needed is it before workflow processing a and parameters of set to engage with a satellite imagery provider to establish a “standard” a lost aircraft. Therefore, it may be appropriate for a representative ferent satellite parameters should not be done whilst searching for dif- the understand to Attempting future. the in imagery utilise to rather to highlight the need to prepare for the possibility of a need withthe were setoutandimaged.Thetrialwasconductedincollaboration accident investigation, a trial was conductedIn order to assess the potential utility of satellite in imagery aircraft in which known targets Trial configuration Figure 1a.Handheldimagefrom helicopter ofthegrid. The QuickBird image was of a 10 km x 10 km area, taken with with taken area, km 10 x km 10 a of was image QuickBird The Twoimages were acquired ofthesite; anelectro-optical image accident-damaged used first the up: set were sitestest Three aboratory (dstl). Cyprus was chosen as a location for the trial trial the for location a as chosen was Cyprus (dstl). Laboratory U K M inistryDefenceof ( Monday, August 17, at 08:42 GMT. (This is relevant ite, a free NITF viewer from IAVfrom viewer NITF O. free a Lite, MO M B. The image was requested D),the U K AirAccidents K Figure 1b. Commercial satellite image (left). Figure 1c. Radar im- 9, 2010 SEPT. THURSDAY, age of the of the grid (radar reflectors circled) (right).

Figure 3a. Handheld image from helicopter of the sea site.

Figure 2a. Handheld image from helicopter of the Harrier site. Figure 3b. Commercial satellite image of the sea site (left). Figure (Both wings and tailplane circled.) 3c. Radar image of the Harrier and sea sites (sea site circled) (right).

The TerraSAR-X image was acquired of a 10 km x 10 km area in “spotlight” mode giving a 1m GSD. However, by the nature of its operation, the preferred range of acquisition angles for this satellite is 20° to 55° with the trial image being acquired at 48°. This acquisition angle results in a reduction in resolution to approximately 1.5 m. The file was delivered as a Complex SAR image and was approximately 220MB in size. Analysis was performed using Radar Tools, an open source application. The commercial cost of tasking this image would be in the region of £7,000. Figures 1-3 show handheld imagery of the three sites taken from a helicopter, corresponding pan-sharpened electro-optical images extracted from the QuickBird image and two images extracted from the TerraSAR-X image.

Analysis Each of the items in the grid was analysed for interpretability by examining the image and deciding whether it was distinct from the background, i.e., whether there was “something there.” No attempt was made to interpret the detail of the item. Of the 50 targets that were in the grid, 20 were clearly visible, 7 Figure 2b. Commercial satellite image of the Harrier site. were marginal, and 23 were undetectable. The clearly visible tar-

ISASI 2010 Proceedings • 91 ISASI 2010 PROCEEDINGS 92 one of the panels in the grid was highlighted by the software as the detection, change the performing After change. detect to attempt usingstandardparameters. performed was detection change the Therefore, unknown. is it where change detect to is technology this using of point the change, known of toadjust the detection parameters in order to highlight the areas reference from which to detect change. Whilst it would be possible the providing satellite GeoEye the from image an with grid, the of automated change detection was the attemptedlikelihood of matched imagery being available onis low. the Therefore, QuickBird imageinterest present. Clearly, since the next accident location is unknown, the same resolution, with the same geometry with only differences of using “matched” images, i.e., images taken from the same sensor, at when effectively most works technique However,this image. after intensive, itcanbeextremelyeffective. labour is method this Whilst anomalies. or differences for looking way synchronised a in them around moving and simultaneously approach may be as simple as viewing the two images on the screen ences. This can either be done manually or in software. The manual differ any highlight to order in image “after” the to it comparing that of change detection. This involves taking a “before” image and for wreckageplottingfromadistance. maximumerror of 20 cm would be deemed more than accurate typical above,a interpretability enough of issues the Notwithstanding ceptional. ex- are accuracies these estimation, centre and pixellation to due errors 1.05 mand0.23m,respectively. of error maximum a with northing the for m 0.08 and easting the for m 0.20 was error average the items) between distance the (i.e., of 10.80 m and 3.7 5 m, respectively. Assessing the relative accuracy for the easting and 3.56 m for the northing with inga maximummerely the error precise coordinates) the average error was 10.25 m data. These coordinateswerethencomparedwiththesurveyed based on the geographical information embedded within the image. was estimated and the coordinates noted, as displayed by the software 20 items were chosen from the grid, the location of the item’s centre a blackpixel,makingitmoreprominent. in the surrounding area, a white pixel is much higher contrast than black square is considered marginal. Because of the colours present mwhite square occupying 2 pixels by 1 2 pixels, x m 1 the is whilst also but pixels, 4 the by pixels 1m 4 x approximately 1m cupying oc- visible clearly is square black m 2 x m 2 the that example, for area,object colour, viewing surrounding geometry, the as such etc.factors Itother is interesting by affected heavily also tonote are gives an indication of the results that might be available, the results interpretability of an image. Whilst the panchromatic GSD of 0.6 m a flightdatarecorder. and blade, rotor helicopter a square, Perspex m 4 x m 4 a square, thatweredeemedblackundetectable m0.5 x includedm0.5 a m white square, a canopy section 0.5 x andm 0.5 a asquare, pairblack m 1 ofx m seats.1 a included targets marginal Those targets The approximately). m 1 x m 2 (each bulkhead a and panel tail a square; white m 1 x m 1 a square; black m 2 x m 2 a included gets A piece of software called The software approach uses algorithms to compare the before and O potential the and object to sensor involvedfrom distances the Given compar (i.e., accuracy absolute for coordinates the Comparing In order to test the geolocational accuracy of the satellite image, the upon impinge that factors other the highlight results These • ne techniqueneoftenimageryreferred isanalysisthatin to is ISASI 2010 ISASI Proceedings Matisse, written by dstl, was used in an - - identify thelocalgeography. even to difficult and wreckage any identify to impossible it make 3c, coupled with the noise and returns from the surrounding area, sea.Similarly, the resolution offered by the radar image in Figure to distinguish any of the wreckage from the surrounding land or the in the water and a red door on the beach. However, it is not possible sea site. The handheld image shows a helicopter tailboom floating are notvisibleonthesatelliteimage. these are only visible from the but helicopterleg, gear nose a and pipes as such images, the in imageparts smaller when other many zoomedalso andare There Harrier. a from tanks drop both and wreckage visible in this image includes both wings, the rear fuselage distinguishing the wreckage from the surrounding scrubland. The in difficulties the highlights clearly images two the of comparison parachute in the top left hand corner of the image is clearly visible, difficulttointerprettheimage. in size.Thismakesitvery pixel one than more no occupies item each that such is resolution some of the other components including the tail plane. However the out like the face of a die) are visible and circledthe difficulties in Figure 1c, of as working are with radar. The five radar reflectors (laid it willbefoundbytheanalystearlyinprocess. possible detections, the more highly ranked a find is, the more likely say, a 10 km x 10 km scene in a day although as the algorithm ranks in, highlighted changes the process to able be may analyst an that to an imagery analyst. Therefore, process, but givenrather as a way theof highlighting possible areas resultsof interest above, it is feasible changes inthescene. highlighting the same panel as being one of the 50 most prominent grid. mostprominent change in an area of 700 mx700 maround the Figure 4a.Wreckage trail andsurrounding area. Worldthe from acquired was site accident the of imagery Satellite - Russia, killing all 96 people onboard including the Polish president. Smolensk, near crashed Tupolevaircraft a 154 2010, 10, April On Practical example Figures 3a and 3b show the helicopter and satellite image of the blue bright the Whilst site. Harrier the show 2b and 2a Figures of some highlights grid the of image radar the of Examination automated totally a as used be not will technique this Clearly, E xpanding this to a 4 km x 3 km area resulted in the software in length, which is consistent with the number of pixels depicting it. However, unfortunately, this is clearly a high-energy accident resulting in significant destruction of the aircraft, and hence it is difficult to distinguish many other parts of the aircraft. Although satellite imagery had no role to play in the analysis of this specific accident, it provides a valuable proof of concept, particularly because it uses one of the highest resolution commercial satellites available, WorldView-2.

Concluding remarks The growth in commercial satellite imagery means that access to imagery is widely available. However, as the discussion has outlined, the tasking and acquisition of this imagery is not trivial, with a wide range of factors and parameters to be taken into account. It would be prudent for organisations who may wish to acquire commercial satellite imagery to make contact with an imagery provider in Figure 4b. Wreckage trail enlarged. order to establish their typical requirements in advance of request- 9, 2010 SEPT. THURSDAY, ing imagery. This is particularly important if imagery is required View-2 satellite and archived. This imagery was then provided to quickly, say, in response to an accident at sea where buoyancy may Cranfield courtesy of DigitalGlobe for research purposes. be time-limited. WorldView-2 is a high-resolution multi-spectral satellite and is one Commercial satellite imagery is not yet of a quality to replace of the most recent commercial satellites available. It was launched in ground imagery or handheld imagery taken from a helicopter. October 2009 and is capable of producing high-quality images with However, the results of this trial and example have shown that there a resolution 0.46 m for panchromatic and 1.84 m for multispectral. is potential utility in commercial satellite imagery for both wreckage In addition to the traditional red, green, and blue bands, it also of- location and wreckage plotting in specific situations. However, there fers two near-infrared bands, a red-edge band, a yellow band, and a are a wide range of factors affecting performance that are outside coastal band. Using the latter band, WorldView-2 has the ability to the control of the investigator including wreckage and scene colour, perform bathymetry (measurement of depth in water). wreckage size, acquisition geometry, etc. The perceived risk of a The image in Figure 4a clearly shows the wreckage trail in the wasted collection posed by these factors will obviously depend upon top right corner. It also shows the vehicles, tents, and access routes the situation faced by the investigator. being used by emergency services and investigators. It is clear from Future plans for research in this area include further trials into this figure that at this resolution, a trained analyst could easily higher resolution multispectral satellites and the possible use of radar identify this wreckage trail as the location of an accident. However, and hyperspectral sensors for detection of fuel and oil patches for this image represents an area of approximately 150 m by 100 m. location of accidents at sea. Clearly, at this magnification, the analyst time taken to manually search, say, 20 km by 20 km would be considerable, although not Acknowledgements completely impractical. The authors would like to gratefully acknowledge the support Figure 4b shows the same image zoomed on the wreckage trail provided by the UK Ministry of Defence, the UK Air Accidents with the rear section of the aircraft in the centre of the image. Other Investigation Branch (AAIB), the Defence Science and Technology footage of the accident site suggests this piece is of the order of 10m Laboratory (dstl), and infoterra (UK and GmbH). ◆

ISASI 2010 Proceedings • 93 ISASI 2010 PROCEEDINGS charge of providing technical support to aviation occurrence aviation to support technical providing of charge difficulties andchallenges. 94 aircraft transport large involving cases 33 these among occurrences, 68 investigatedhas ASCcreation, theitsSince followingup. them well as issuing safety recommendations directly to the premier and serious incidents (Aviation investigation of civil, public, and microlight aircraft accidents and pendent government agency in Taiwan, ROC, responsible for the in established was (ASC) AviationCouncil Security The ago. years 20 about past, recent relatively the in safety investigations and safety studies in Taiwan started to develop Australia, to Compared About theASCanditslaboratory Introduction is alsoinvolvedinEuropean workinggroups suchasEASA’s EFRPG. AirbusA320(May2006,Sochi,Russia).He Sheikh, Egypt)andtheArmavia el 2004,Sharm investigations, includingtheFlashAirlinesB-737(January onsiteinanumberofinternational beginning of2006.Hehasparticipated allovertheworld. at variousseminars/forums about 60technicalpaperstoshare hisexperienceininvestigationtechniques inTaiwan. excursion)thatoccurred GE536-runway Hehaspublished (SQ006-runway incursion, CI611-inflight breakup, GE791-inflight icing, infourmajorinvestigations 12-year career withASC,hehas participated as well as leading the site survey and weather hazard research teams. In his responsible forthereadout studies, offlight recorders, airplaneperformance ASC. Currently, Dr. Guanisthedirector oftheinvestigationlaboratory, Dr. Guan was responsible for setting up the investigation laboratory at the undertaken internships at the ATSB, the BEA, the NTSB, and the TSB. tion at the Southern California Safety Institute in April 1999. He has ASC, hereceived a4-weektrainingprogram onaircraft accidentinvestiga- for civil aviation accident investigation. In the early stage of his career with The ASC investigation lab, with a staff of six persons, is in in is persons, six of staff a with lab, investigation ASC The Has ImprovedTechnical Partnership • By MichaelGuan,DirectoroftheInvestigationLab,Aviation Safety Council, Taiwan, andChristophe Menez, ISASI 2010 ISASI Close Cooperation in Investigations (MTOW (ASC). ASC is Taiwan’s investigation agency responsible time of the establishment of the Aviation Safety Council Guan started his investigation career in July 1998, at the Engineering ofTamkang UniversityinTaiwan. Dr. In addition, he also holds a BSc from the Aeronautical and Astronautics of Cheng-Kung University in Taiwan. degree and a Ph.D. from the Institute of Aeronautics Dr. GuanWen-Lin (Michael) holds a master of science where he became head of the Engineering Department at the atthe where hebecameheadoftheEngineering Department torate (DGAC) for 3 years and joined the BEA in 2003,University. HeworkedfortheFrench CivilAviation Direc - (ENAC) in2000afteraone-yearexchangewithSydney aeronautics from the French National Civil AviationInstitute School of Technology. He received a mastersthe degreeEcole Polytechnique in after an internship at the Christophe Menezgraduatedin1998asanengineerfrom California Proceedings > 15,000 Head oftheEngineeringDepartment,Bureaud`nquêtesetd`Analyses,France urope, and North America, aviation aviation America, North and Europe, kg) Occurrence Investigation Act 1, 2), as (Recipients oftheAward ofExcellenceforbestseminarpaper) and encountered ay 1998 as an inde- an as 1998 May many technical

metallurgic examinations. E and analysis, performances and the Structure data, radar systems, avionic recorders, flight on work takes under which Division, Systems Avionic and Recorders the to divisions: two of up made is support It fields. various in investigations technical providing of charge in is people, 25 of investigation. to the status of the BEA and confirmed the independence of safety tions, a French law ( ICAO Annex 13 and the of dispositions the Following II. War World after shortly created originally was it incidents; and accidents aviation civil of tigations l’aviation civile) is the French body responsible for technical inves- B The About theBEAanditslaboratory Figure 1. in shown is list detailed The superposition. map satellite and data CVR and 35 FDR/QAR, 7 animation sets, and 21 sets of GPS/radar otheragencies. 2009,IntheASCinvestigation labworked10 on readout and analysis, recorder flight thein experience ASCbuild to alsoorder providesin addition, In technicaltives. assistance for investigations, for which the ASC appointed accredited representa- examinations, andfailureanalysis. structural wreckage, of location underwater undertakes also lab The visualization. and analysis, performance processing, data GPS and data radar reconstruction, path flight reaout, recorder investigation. This includes but is not limited to site survey, flight Figure 1.Summaryofflightdata readouts. ngines Division, which is in charge of wreckage, engine and and engine wreckage, of charge in is which Division, ngines The foreign several in involved been has lab investigation ASC The E Engineering Department of the BEA, comprising a staff A (Bureaud’ A L aw 99-243 of E nquêtes et d’Analysesnquêtessécuritéetlade pour European directive for accident investiga- M arch 29, 1999) brought changes

Equipment and

- The Engineering Department is usually involved in investigations conducted by the BEA, as well as investigations abroad for which the BEA has appointed an accredited representative as per Annex 13 requirements. It also provides technical assistance to other states conducting an investigation, when, for example, they do not have the capacity to read out flight recorders. In 2009, theE ngineering Department worked on 75 flight recorders, 97 electronic devices (half of these being certified avionics equipment), 33 sets of ATC data (radar and communications), 40 wreckage examinations, and 27 metallurgical examinations. Investigators from the Department also take part in examinations performed outside of the BEA’s facilities.

Common issues which both agencies face Any state willing to conduct investigations under the SARPs of ICAO Annex 13 shall [standard 5.4] have independence in the conduct of the investigation and have unrestricted authority over its conduct, consistent 9, 2010 SEPT. THURSDAY, with the provisions of Annex 13. The state must be well prepared to manage the conduct of accident investigations, which by their very Figure 2. F800 readout principles. nature always occur in different contexts, require qualified staff with experience, significant financial resources, the ability to ensure coor- technical assistance to the ASC regarding some of the technical issues dination between participants, most of the time on an international encountered during the investigation: the retrieval of the flight data level, the status to ensure independence, and clear rules regarding from the damaged magnetic FDR (Loral F800), icing performance interactions with the judicial authorities. analysis, and the identification of audio warnings. Among these requirements, the agency conducting the investiga- The flight recorders were both recovered 22 days after the action should have enough technical capacity and knowledge to per- cident and transported to the ASC investigation laboratory for form examinations or supervise them so that it can comply with the disassembly and readout. The CVR readout required careful clean- standard 5.6 stating that the investigator-in-charge shall have unhampered ing because of water penetration in the protected module of the access to the wreckage and all relevant material, including flight recorders recorder, but the tape was read out successfully. For the FDR tape, and ATS records, and shall have unrestricted control over it to ensure that from whose casing a lot of water flowed out during opening, a de- a detailed examination can be made without delay by authorized personnel tailed examination showed some discolorations and wrinkles on the participating in the investigation. tape, especially the portions exposed to the outside or in contact The provisions of Annex 13, which relate to participants in an with the mechanism, including some severe wrinkles near the end. investigation, often result in having several states working together, The ASC used a modified NAGRA-T recorder to play back the FDR though they may have very different experience in conducting an tape and then used the Recovery Analysis and Presentation System investigation, different resources, and be faced with the challenge (RAPS) to translate the original wave signal into engineering data. of overcoming cultural differences and language barriers. The However, due to the severe wrinkle damage on the tape, the last ASC and the BEA have had to work together in such contexts and 7 seconds of the accident flight recording could not be retrieved in doing so tried to make an efficient and complementary use of using RAPS. each others experience and capabilities. However cooperation, In order to recover this important data, the BEA proposed to read forced on us by circumstances, has been extended to a longer out the tape again, using a dedicated tape reader associated with term technical partnership, which is presented in the next part decoding software, both developed by the BEA investigators (see of the paper. Figure 3). In magnetic FDRs, the data are recorded by transforming the binary signal coding for the parameter’s values into an analog Cooperation and technical partnership signal, since the magnetic tape cannot directly record a binary signal; Investigation into an ATR 72-200 accident in Taiwan in 2002 during the readout the signal waveforms recorded on the tape are On Dec. 21, 2002, an ATR 72-200, a cargo flight number EG 791 to converted back into the binary coding for the parameter values. In Macau, departed from Taipei at 01:05 local time (UTC+8). During addition to that, for the Loral F800 model, before being converted cruise at FL180 with autopilot engaged and airspeed around 200 to analog, the binary signal is first modified with a code called GCR knots, prolonged exposure to severe icing conditions forced the crew to transform a series of four bits into corresponding series of five to continually activate the airframe deicing. Ice accretion caused a bits, therefore increasing the size of the file. When the recorders are loss of control of the aircraft, which crashed into the Taiwan Strait read (see Figure 2), errors in the readout of the tape result in creat- near Penghu Islands, with both pilots missing (see Reference 1). ing series of bits that do not exist in the GCR system, thus enabling The ASC immediately formed a team to conduct the investigation investigators to locate problems on the magnetic tape and locally to which, in accordance with article 84 of Taiwan Civil Aviation Law correct the conversion. Using the BEA’s tape reader and decoding and ICAO Annex 13, the BEA was invited to participate to repre- software, it was possible to decode and validate the 7 last seconds of sent the state of manufacture, assisted by advisors from the ATR 72 the recording that were missing at the first readout. manufacturer. The BEA sent five investigators to participate in the With the help of the BEA, the ASC conducted a full flight simu- on-scene investigation and the underwater searches, and provided lator (FFS) at ATR and analyzed data related to previous similar

ISASI 2010 Proceedings • 95 ISASI 2010 PROCEEDINGS 96 agencies,has ever dealt with all the possible problems that can beAccidents are still rare enough that no one, including investigative the investigation. ficiently, or which have simply not yet been developed at the time of which require some specific training and experience to be used ef- scale, wide a on commercialized not are that tools requires often partnership betweenthetwoorganizations. technical a of beginning the was this Department; Engineering offeredto have investigators from the ASC spend some time in its them the tool developed for among F800 magnetic tape BEA, readout. The the BEA at used tools investigative about more learning in interested was time, this at agency investigative young a relatively was which ASC, the together working of experience this After Sharing technicalresources Reference 1,2). icingcertification requirements of FAR/JAR 25 Appendix (seeC ably encountered severe icing conditions that were worseperformance analysis, the thanASC concluded thethat the GE791 had prob- and FDR, CVR, the from data recorded the on Based 40%. about by degraded was (lift/drag) aircraft the of behavior aerodynamic the disengagement, autopilot to Prior wings. the on accumulated had that ice of quantity significant the by affected greatly were ity stabil- lateral and longitudinal the upset, roll the before seconds 4). Ten Figure (see condition flight normal in drag of +170% of minutes4 prior autopilotto disengagement andreached valuea mance analysis indicated that the accident aircraft’s drag increased Perfor conditions. icing severe involving occurrences 42/72 ATR Figure 4.ResultsofGE791icingperformanceanalysis Figure 3.BEAsoftware forF800readout. Work related to aviation occurrence investigations is of a kind that • ISASI 2010 ISASI Proceedings One example of this is the field of flight recorders. . - ” program, which uses Google uses which program, “TRK2KML ” the and (EFAS), the (OIMIS), System mation the ASC include the new toolsaswell. newly developed to shown tools has and the ASC capacity the that of the interest ASC the laboratory appreciates much to develop Taiwanin agencies two the very BEA The 2009. and 2007, 2003, in between organized seminars formal includes This years. many for file(seeFigure5). by oneandreconstructthebinary had to apply specific techniques to read out the memory chips one corrosion due to prolonged water immersion, and the investigators data recorder whose electronics board had been exposed to severe arise at times. In 2009, for example, the BEA had to deal with a flight even if new technology recorders are more reliable, difficulties still ties have often been encountered with magnetic tape recorders, and techniques have to be applied to solve a readout problem. Difficul- basis with damaged flight recorders in which in certain cases special regular a on deal that agencies investigative the of experience the complement they and essential, even useful, very are courses ing at training such ASC and the BEA have, for example, followed a common session of operations to be performed during readout (investigators from the better understand to order in community the investigation waythe for recorderstraining offer turers work and the major recorder.checksflight damaged a out reading andin encountered recorder. Figure 5. Readout of corroded memory chips from a flight Figure 6.MajoranalysismodulesoftheOIMIS. Recently, for example, important engineering developments at at developments engineering important example, Recently,for continued has BEA the and ASC the between cooperation The 3 Communication and Honeywell). These train- These Honeywell). and Communication L3 Occurrence Investigation ngineering Failure Analysis System. System. Analysis Failure Engineering Management Infor Manufac-

arth Earth - THURSDAY, SEPT. 9, 2010 SEPT. THURSDAY, Figure 7. Operational procedures of the EFAS. Figure 8. Flight paths of two cases: an MD-80 runway veer off and an UH-1H wire strike. as a data visualization tool. Some specific features are summarized below. receivers (GPS MAP 96/96C/196/296/396/495/496). Using this • The Occurrence Investigation Management Information System partnership with Garmin, the ASC has helped the BEA to decode (OIMIS), which integrates multi-data sets (ground scars, wreckage some of the files that had been extracted from Garmin GPS units distribution, CVR/FDR data, radar tracks, SIGMET charts) into a at BEA’s avionic laboratory. For some of the most recent units, the 3-D GIS, to visualize the sequence of events of the occurrence. It con- data are encrypted and can not easily be decoded without techni- tains four analysis modules: flight recorder readout management, cal assistance from the manufacture. (For more details about issues flight path reconstruction, wreckage database, and flight recorder related to the extraction of data from damaged electronic units, see underwater localization system (see Figure 6, Reference 4). Reference 3.) • The Engineering Failure Analysis System (EFAS), a system that However, ASC’s contribution to the safety community outside use a precise optical scanner and Finite Element Analysis (FEA) of Taiwan is, of course, not limited to the BEA. After benefiting program assistance to determine the root cause of structure failure from contact with more experienced investigative agencies, the modes (see Figure 7, References 5 and 6). ASC is willing to play a role in turn within the international safety • For considerations of cost effectiveness, accurate mapping, and investigation community. fast presentation of the sequence of events of an aviation occurrence, the ASC has developed the TKM2KML program to visualize flight Beyond the bilateral partnership paths on Google Earth, which is available and free for worldwide Accident investigator recorder meeting (AIR) investigators (see Figure 8, Reference 7). In 2004 the AAIB, the ASC, the ATSB, the BEA, the BFU, the Like the NTSB in the U.S., the AAIB in the UK, and the MAK in NTSB, the TSB, and other national investigative bodies initiated Russia, the BEA has developed its own software for decoding and an annual Accident Investigator Recorder (AIR) meeting to share analyzing flight data, a tool calledLE A. This choice comes from the experience in technical fields such as the handling and readout fact that tools available commercially for airlines to perform flight of damaged recorders, flight data analysis, flight path reconstruc- analysis do not exactly correspond to the needs of investigators. An tion, avionic systems examination, and underwater recovery. Most airline analyzes the safety risks associated with a large number of of the investigative agencies take part in this annual meeting, flights, whereas an investigative agency concentrates on one particu- which one of them hosts each year, and have the opportunity to lar event and often wants to perform detailed calculations on the compare each other’s way of solving technical issues encountered data, such as the calculation of parameters not originally recorded during investigations, as well as to decide common action from by the airplane. In 2008 the BEA and the ASC decided to install the the group for future solutions. This group is also a good place to LEA program at ASC facilities in Taiwan, which was effective in April discuss regulatory activities because several members participate 2009. The ASC thus benefits from being able to freely use a tool individually at various levels (ICAO, the FAA, EASA) and define developed by the BEA, but the BEA also benefits from it by receiving harmonized positions when needed. feedback from the ASC that will help to improve the software. Shortly after its creation, the group felt the need to have a Now that the ASC is a more experienced investigative agency, it is dedicated website for exchanging data and continuing discussions also taking an active part in providing solutions to problems encoun- between each annual meeting. The ASC proposed to set up this tered by investigators. Recently, the ASC has developed a partnership website (http://irig.asc.gov.tw) and continues to maintain it. with Garmin (through its branch in Taiwan) to get assistance with the readout of damaged GPS units and the decoding of files extracted Conclusion from memory chips on these units to use them as a source of data Conducting Accurate, Speedy, Independent, and Authentic investi- for investigations. This partnership includes the development of an gations requires knowledge, financial resources, dedicated tools, and investigation kit to recover data from damaged Garmin portable GPS the capacity to adapt to the specificities of each occurrence.

ISASI 2010 Proceedings • 97 ISASI 2010 PROCEEDINGS Investigators will always need to work with manufacturers, airlines, airlines, manufacturers, with work to need always will Investigators them. overcome to tools suitable design to together work to order in investigations during encountered difficulties sharing as well as of overcoming the limitations in resources or technical capabilities, way effective an is groups, multilateral through or understanding) through agencies, investigation safety culture andrequiressomelanguagebarrierstobeovercome. even though it implies a greater effort of adaptation to each other’s sary. We believe that sharing information and techniques is valuable, Bilateral and regional cooperation between safety agencies is neces- technical assistance in several fields such as flight recorder readout. the ASC is also providing help to the safety community and is giving Todayoccurrences. of number large a with confronted was which BEA, the as such agencies experienced more from help from efits real occurrence. a and theories between differences always are there since tors, investiga- for insufficient are but beneficial very be can courses trainingThese investigationagencies. by provided courses ing train- other or manufacturers from training get usually agencies 98 Building technical partnerships and exchanges between aviation The ASC was once a young investigative body and could gain ben- capabilities, investigative their of level the raise to order In • ISASI 2010 ISASI Proceedings s (memorandums of of (memorandums MOUs 2 4 3 capabilities. ◆ tions is to maintain a good level of expertise and modern technical investiga- independent truly perform to able be to agencies gative investi- for way only however, the fields; various from experts and t 7 t 5 1 References t 6

A Dynamic Wen-LinGuan,M.H. Yang,K.F. Chou,Kayand Yong,“Performance FlightandNo. Li-ChangChuang,H. Seminar, Singapore, forts to Recover Buried Data,” IS Cooperation Nuggets: “Finding Menez, Christophe and Projetti Jérôme VitalEf- in Conference, T System for SouthwestofMakung City, Penghu Islands, Sea, the into OccurrenceInvestigationGE791 Crash Encounter “In-flightand Report, Icing to tion of the Flight Recorder Underwater Locating System,” 2009CSCA JointConference, InvestigationSystem,”Occurrence Information the Management 2009 of International Seminar, Singapore, aipei, ien-Fu, Yeh,H.T Wen-Linand Guan, ien-Fu, Yeh,Chih-Yi, and Jih Wen-LinDevelopment“The Guan, and ien-Fu, Yeh, Chih-Yi, Jih, and Wen-Lin Guan, “The Development and Implementa- nnual International Seminar, Fort Worth, A ASC- ssist T aiwan, Dec.12,2009. A nalysis of the Flight in Ice in Flight the of Analysis viation Occurrence Investigation,” IS Aircraft OR-05-04-001, T T aipei, ransAsia Accident Investigation,” 2009 T Aug. 27-30,2007. aiwan, Dec.12,2009. T irways Flight 791, Flight Airways .Young, and T aipei, April, 2005. T A Aug. 27-30,2007. aiwan, Dec.12,2009. SI Proceedings of the 36th T . Web-Basedthe Young, GIS of “Utilization .B. Huang,“Engineering.B. Failure SI Proceedings of the 36th 36th the of Proceedings ISASI Accretion, T exas, US R 72-200, B-22708, 17 Kilometers Kilometers AT17 B-22708, 72-200, R T aiwan.Dec. 21,2002” A SI Proceedings of the 36th AASRC/CSCA Joint Conference, A , Sept. 12-15, 2005. AA A nnual International SRC/CSC A pplication Application SCReport AASRC/ A A A nalysis nnual Joint Terrain Profile Analysis Using Radar Altimeter Data from FDR By Frederico Moreira Machado and Umberto Irgang, Embraer Air Safety Department

Frederico Moreira Machado graduated in computer FDR, making it more difficult to draw conclusions from the infor- engineering and has a master’s degree in aeronauti- mation available. Furthermore, even new generation aircraft fitted cal engineering. He joined the Embraer Air Safety with solid state recorders are subject to the shortage of important Department in 2008 and since then has worked with parameters due to external factors. An example of that is the lack the Flight Data Analysis and Statistics Group, which is of ILS deviation parameters on approach and landing accidents responsible for providing support to accident investiga- that occur on airports that are not equipped with this system. This tions in the field of flight data recorders. study has resulted from a runway excursion accident with these 9, 2010 SEPT. THURSDAY, circumstances with an airplane manufactured by Embraer, which Umberto Irgang Photo and bio not available participated in the subsequent inquiry providing support to the investigation authority. The lack of geographic coordinates and ILS Abstract parameters in the FDR motivated the development of a technique Accidents and incidents that occur during takeoff, initial climb, that relies on altitude parameters to draw the terrain contour of the and final approach have been raising major concern in commercial region the aircraft has flown over. By comparing the terrain profile aviation in recent years. Investigation of such occurrences requires obtained from the FDR parameters with the actual terrain contour that all the data available from the FDR (flight data recorder) are obtained by topographic data, it was possible to “link” the aircraft used so that the involved circumstances are completely clarified. trajectory with the ground, i.e., determine the touchdown point on This paper describes a technique developed at the Embraer Air the runway. Several other studies have addressed the subject of trajec- Safety Department that combines radio altimeter data from the tory reconstruction (Machado, 2009), but in this case, the available FDR and topographic data from the terrain the aircraft has flown parameters would not allow the determination of the aircraft posi- over. By using the radio altimeter and pressure altitude parameters tion with respect to the ground. It is important to mention, however, recorded in the FDR, it is possible to determine the terrain’s topo- like any other flight data analysis technique, this one must be applied graphic profile, which can then be compared with the terrain’s actual when accident circumstances are suitable for it and its results should profile obtained from SRTM (Shuttle Radar Topography Mission) be cross-checked with every other source of information available data. This comparison allows for the refinement and/or validation so that it does not lead to wrong conclusions. of a rough trajectory obtained from less accurate means, such as an In order to explain the technique, this paper begins with a assumed sequence of geographical coordinates. The determination description of the determination of the terrain profile from the of the trajectory with respect to the ground is a key factor for the FDR parameters. Then, it discusses the determination of the ac- comprehension of several types of occurrences. The technique tual topographic profile from the SRTM data. Next, the process of revealed to be especially useful to confirm trajectories when other comparison of both terrain profiles is described. Finally, the case FDR parameters such as ILS (instrument landing system) deviations study which motivated the development of the technique is briefly and GPS (global positionings) coordinates are unavailable. After the presented followed by a discussion of the usage of the technique technique description, a case study of an investigation supported by for validation of trajectories obtained by FMS (flight management Embraer using terrain profile analysis is presented. system) coordinates.

Introduction Terrain profile—altitude parameters In the recent years from 1999 through 2008, 56% of fatal accidents This section describes the determination of the terrain profile from occurred during either takeoff, initial climb, final approach, or land- altitude parameters recorded in the FDR, hereafter referred to as ing phases, according to Boeing’s statistical summary of commercial altitude profile. Basically, there are two distinct sources for altitude jets (Boeing, 2009). These figures indicate that every organization information on a commercial aircraft recorder: static pressure in the industry somehow involved with accident investigation must altitude and radio altimeter, according to airplane flight recorder be prepared to investigate that class of accident. Fortunately, more specifications (FAA, 2010). Pressure altitude is the height of the parameters are being recorded in the FDR as a consequence of more aircraft above sea level derived from the measurement of the static stringent requirements, increased systems integration, and memory pressure assuming a standard atmosphere (Collinson, 1996). The availability. This allows for more detailed analyses, improving the value of the static pressure is associated with a pressure altitude value investigator’s work when it comes to determining the contributing by means of the ISA (international standard atmosphere) model. On factors of the occurrences. On the other hand, thousands of older its turn, the radio altimeter measures height above terrain by means generation aircraft are still in operational use and thus are subject of electromagnetic waves that are transmitted toward the ground. to be involved in accidents. These aircraft represent a challenge for This device transmits a radio signal that is reflected from the ground flight data analysts as a restrictive set of parameters is recorded in the and measures the time delay to the reflected return signal (Helfrick,

ISASI 2010 Proceedings • 99 ISASI 2010 PROCEEDINGS 100 is afilewiththe HGTextension. of a portion of an SRTM tile of 1 arc-sec resolution. view schematic a presents 2 Figure 2004). (USGS, integers signed bit 16 are elements whose array two-dimensional a as formatted is tudedegree inwidth andlongitude1 degree inheight. on thousands of tiles, with each tile covering a square area of 1 lati- meters. 90 approximately of distance a to correspond data arc-sec 3 whereas samples, adjacent between 1 arc-sec data correspond to a distance of approximately 30 meters rest of the planet is presented with 3 arc-sec data. In practical terms, States territory is available with the higherresolution. arc-sec 3 or 1 either with public made 1 arc-sec resolution. The were originally collected with 1 arc-sec resolution, the results system and flew wereduring 11 days around the planet. Although the data shuttle space The 2004). processed to digital topographic data at 1 arc-sec resolution (USGS, data, radar interferometric acquire to antennas radar dual used It the German and Italian space agencies, and flew in February 2000. Administration), the National Geospatial-Intelligence Agency, and was a joint endeavor of NASA (the National Aeronautics and Space project The earth. the of model elevation digital resolution high a TopographyRadar Shuttle The TopographyShuttle Radar Mission cannot bedeterminedwhentheairplaneisflyingabovethat. 2,500 ftaboveground(FAA, 2010).Therefore,thealtitudeprofile altitude parameter is required to be recorded up to the elevation of topographic outline later. It is important to mention that the radio not critical, but its shape is so that it can scopebe compared of tothis the actualtechnique, the numeric the For profile. terrain the in results subtraction the beneath, rain value of the terrainter the respect elevationwith altitude aircraft the measures altimeter is radio predeterminedato reference (usually thesealevel) whereas the respect with altitude aircraft the measures altitude pressure the As 1. Figure in illustrated is principle The profile. terrain the yields simple the subtraction Therefore, level. of sea the radio mean altitude below located from aerodrome the pressure an on altitude the radio altitude parameter, except when the airplane is operating (FAA, 2010). FDR the in parameters altitude radio and pressure both record to 1995). Commercial aircraft equipped with both systems are required altitude parameter. the valueofradioaltitudeparameterfrom thepressure Figure 1.Determinationoftheterrainprofile bysubtracting • ISASI 2010 ISASI Usually, the pressure altitude parameter is greater than Proceedings ndeavour was equipped with the radar radar the with equipped was Endeavour ission was an initiative to obtain obtain to initiative an was Mission levation data are presented presented are data Elevation nly the Only Each SRTM tile E achtile nited United

- the terrainprofiletechnique. of use the impair might that factor a is voids data of presence the reasons. causes, such as shadowing, phase anomalies, or other radar-specific depends ontheresolutionof SRTM databeingused. points the between distance The centerline. prolonged the showing on the runway centerline. Figure 3 depicts a sequence of coordinates located point arbitrary an from starting equations distance circle great terline. To calculate these coordinates, it is possible to use the so-called graphical coordinates that correspond to the prolonged runway cen- or initial climb), it is simply necessary to determine a sequence of geo- in which the aircraft is aligned with a runway (either in final approach the flight phase whosedetermine a sequence of latitude/longitude pairs that correspond to profile one wants tothe casesdetermine. in which few For parameters flight aretioned available, coordinatesphases were itknown thefirst inis place. relatively Fortunately, easy for to The resultingelevationdatamakesuptheSRT M terrainprofile. and then determine the terrain elevation of each of its coordinates. trajectory is necessary so that trajectory that will be itused to obtain a isvalid trajectory. The possibleprojected to look inside trajectory onto the ground. In theother words, this SRTprojection is a rough aircraft actual the of projection the considered be can coordinates cal coordinates (i.e., only latitude necessary to know andthe final approachlongitude trajectory in terms of geographi- parameters). These In order to determine the terrain profile from theTerrain SRT profile—SRTM SRTM tile. Figure 2. Schematic representation of a 1 arc-sec resolution SRTM data also contain occasional voids due to several different For the cases in which the aircraft is not aligned with a runway, it However, the technique would not be if necessary these aforemen- Elevation voids are flagged with the value -32768. Naturally, M data, it is M file other circumstances may cause SRTM profiles not to bring useful information to be compared with the altitude profile. SRTM data do not render the best results when applied in regions with characteristics of flat terrain or flights above the sea. Additionally, as the SRTM data were originally collected in the year 2000, many relief Figure 3. Sequence of geographical coordinates (in gray dots) aspects may have changed since then as many of its characteristics defining the prolonged centerline calculated from a point on the are subject to human activities or environmental processes (e.g., the runway. This sequence can then be used to calculate the SRTM construction of new buildings, earthquakes, etc.). terrain profile. Comparison of terrain profiles is possible to find a reference on the ground that might be related Once both SRTM and radio altimeter profiles have been deter- to the aircraft trajectory, such as a VOR/DME station that the air- mined, it is necessary to plot them both as a function of the horizon- craft was using as a navigation aid. In theses cases, determination tal distance from a given reference. Plotting the SRTM profile as a of the coordinates might be more difficult because more complex function of distance is quite simple, as the geographical coordinates calculations are required. of the elevation samples are known, and consequently the distance Once the coordinates have been determined, it is necessary to between them can by obtained by great circle equations. In order to determine the elevation of each of the coordinates by looking into obtain the distances between the elevation samples of the altitude 9, 2010 SEPT. THURSDAY, the SRTM file. The tile that contains the phase of flight must be profile, it is necessary to consider the aircraft ground speed regis- used. As it was described, the SRTM file is a grid composed of eleva- tered in the FDR. By taking the ground speed in consideration, it is tion samples separated by 1 or 3 arc-sec of degree. As the trajectory possible to determine the horizontal distance between the elevation coordinates do not necessarily coincide with the points in the SRTM samples obtained from the altitude parameters. One point is chosen grid, it is necessary to either interpolate the elevation samples or as the distance reference and from that point, the next points are find the nearest match in the SRTM grid. For the purposes of this calculated, one after the other. By integrating the groundspeed pa- technique, the nearest match approach proved to be adequate. rameter in time, it is possible to obtain the traveled distance between Figure 4 presents the SRTM terrain profiles of two distinct airports. two elevation samples. Figure 5 presents the process of calculating The one above is the terrain profile obtained by extending runway the horizontal distance between the elevation samples so that the 17/35 centerline toward the south at Mariscal Sucre International altitude terrain profile can be plotted as a function of that distance. Airport (SEQU), Quito, Ecuador (3 arc-sec resolution). The one An important aspect to consider is the timing between samples of below is the terrain profile obtained by the extension of Runway the involved parameters, as the integration process depends on the 05/23 centerline toward the northeast at Yeager Airport (KCRW), association between the ground speed and the altitude parameters. Charleston, W.Va. (1 arc-sec resolution). It is possible to notice that For example, if the sample rates of these parameters do not match, the 3 arc-sec resolution profile presents sharp edges where the relief it is necessary to carefully select which samples will be used in the is irregular. That effect is a consequence from the lower 3 arc-sec integration process. Otherwise, the analysis accuracy might be de- resolution and is a factor that hampers analyses in regions outside teriorated. It is important to mention that the horizontal distance is the United States. Furthermore, in the 3 arc-sec profile, it is possible not necessarily a distance measured along a straight line. Even if the to notice the presence of the aforementioned data voids between trajectory is curvilinear, the method is still applicable because the 0 and 4 km from the runway. The occurrence of voids, however, is elevation profile is a sequence of terrain elevation samples measured not restricted to lower resolution data only. In addition to low resolution data and presence of data voids,

Figure 4. Comparison of two different terrain profiles. Above, profile from 3 arc-sec resolution SRTM data. Below, profile from 1 arc-sec resolution data. On both plots, the runway is located in the Figure 5. Process of determination of the horizontal distance. leftmost section of the graph. GSPD is the ground speed parameter.

ISASI 2010 Proceedings • 101 ISASI 2010 PROCEEDINGS 102 aiming point, whereas the point in which the altitude profile begins point where the SRTarbitrary M profile begins was the touchdown chosen The sections. previous the in described steps the following technique. Both altitude and SRTM terrain profiles were determined rain nearby the runway and this motivated the development of the ter hilly with airport an on place took occurrence the hand, other the FDR recording ceased while the airplane was in motion. touse this parameter to determine the touchdown point because parameter,groundspeed the record did aircraft possible not was it eters were not available for analysis as well. param- crew.deviation flight ILS the the by Therefore, set not was IL longitude parameters. Furthermore, although the airport did have and latitude record not did aircraft occurrence The conditions. E an involving excursion runway a of investigation the in applied was technique profile terrain the how describes study case This Case study—runwayexcursion profile andtheactualtouchdownpointonrunway. corresponds to the distance between the point arbitrary in the SRTM runway threshold. In thistouchdown case,aiming point,the located displacementapproximately 1,000 aircraft frombetweenftthe touches theground, andtheSRTboth profiles landing,the altitude profile might begin in a theduring example, For point. actual the pointand point arbitrary the from in which the from each other. That “Terraindisplacement profile—SRTM”), it is likely that the profiles will be will displaced defineSRT M theprofile was assumed to begin in an point arbitrary (see section horizontal distance of them present similar relief features, such as hills and valleys. As the both that reveal will plot that and plotted are profiles the termined, airspeed, makingtheappropriatewindcorrections. available in the FDR. In that case, it is necessary to use the recorded or “shrunk”)whencomparedwiththeSRTM profile. fact that it defines if the altitude profile seems distorted (“stretched” between them. The importance of the horizontal distance lies on the only the distance between samples matters, along a sequence of points that are necessarily aligned. Therefore, not the relative bearing features whichare displacedfrom eachother. currence flight. It is possible to observe that bothFigure present 6.ComparisonofaltitudeandSRTMprofiles oftheoc- similar mbraer aircraft. The approach took place during adverse weather S antennae, the corresponding frequency on the navigation radio nce the horizontal distance between the altitude samples is de- is samples altitude the between distance horizontal the Once not is parameter speed ground the however,that possible, is It • ISASI 2010 ISASI Proceedings M Moreover, although the profile begins thein On the -

occurrence andtheinvolvedfactors. runway and ultimately helped investigators to better understand the down approximately 4,400 ft from the runway threshold of a 9,700-ft touched actually aircraft the that showed discovery That m. 1,036 by displaced were they that determined was it profiles, the paring com- By be. actually should it point the threshold) runway the of which the SRTM profile begins is located (in forward the direction in point arbitrary the that indication an is This profile. SRTM the terrain feature, its horizontal distance from the origin is smaller for rain features occur “before” in the SRTM profile. That is, for ater given the that notice to possible is other.It each from displaced are aircraft hadlanded.Figure6presentsbothprofiles. isthe instant inwhich the aircraft air/ground logic indicated the tion oftheplot. without displacement.Therunway islocatedintheleftmostsec- It ispossibletonoticethatboth present thesamerelief features Figure 7.Comparison betweenSRTMandALT terrainprofiles. resolution of3arc-sec,approximately90m. match, and thus the error trajectory is smaller than the SRT M data SaoatJose dos Campos Airport, Brazil. showsIt thatthe profiles of both profiles using this technique during the landing of an error in the direction of motion. Figure 7 presents the comparison sure that these geographic coordinates do not present displacement altitude and SRT M profiles can be plotted together in order to- en in which F cases example, For data. the of cross-check for tool useful a be can parameters are available and the trajectory is known, the technique trajectory determination. However, even for the cases in which more So far it was discussed how the terrain profile analysis can be used for Trajectory validation tion oftrajectoriesobtainedfromotherFDRparameters. it was discussed how the technique can be used to a perform valida- available data do not allow it based on other analyses. Furthermore, capacity to correlate the aircraft trajectory with the ground when the touchdown point. The merit of the technique, therefore, lies on its which the FDR data alone did not in allow excursion for runway the a determination of of the investigation the in useful be to proved technique The sources. different two from obtained profiles rain This paper presented a technique based on the comparison of ter Conclusion bservation shows Observation that the profiles are similar very in shape but M S latitude and longitude are available in the FDR, the -Jet E-Jet - - On the other hand, the tool also has its restrictions. As mentioned, investigations and help to increase aviation safety. Additionally, the SRTM profile does not provide adequate information when thanks to the Embraer Air Safety Department staff and ITA (the applied on regions of flat terrain or water. Moreover, the altitude Brazilian Aeronautical Institute of Technology) for their constant profile cannot be determined when the aircraft reaches 2,500 ft above support. ◆ ground level. All these restrictions must be considered carefully prior to drawing any conclusions from the application of this technique. References Nevertheless, as investigators are more and more required to Boeing Commercial Airplanes (2009). Statistical Summary of Commercial Jet timely respond to occurrences with accurate conclusions, it is always Airplane Accidents–Worldwide Operations (1959-2008). Seattle, WA. Machado, F.M. (2009). Trajectory Reconstruction Tool for Investigation of desirable to have an additional means to extract useful informa- Runway Overruns. Dissertation (Master’s Degree). Aeronautical Institute of tion from flight data, further enhancing their ability to adequately Technology, S.J. Campos, Brazil. investigate incidents or accidents. If applied correctly, this tool is a Federal Aviation Administration (2010). Appendix M to CFR Title 14 Part 121: Airplane Flight Recorder Specifications. Washington, D.C. step in that direction. Collinson, Richard P.G. Introduction to avionics. London, UK: Chapman and Hall, 1996. Acknowledgments Helfrick, Albert D. Practical aircraft electronic systems. Englewood Cliffs, NJ: Prentice-Hall, 1995. The authors wish to thank ISASI for the opportunity to share the United States Geological Survey (2004). SRTM Topography. Reston, VA. Available basic ideas of this technique that hopefully might be used in future at http://dds.cr.usgs.gov/srtm/. THURSDAY, SEPT. 9, 2010 SEPT. THURSDAY,

ISASI 2010 Proceedings • 103 ISASI 2010 PROCEEDINGS flight. Consequently, the investigation focussed on human and envi- viewsrevealed the aircraft had operated normally throughout the wreckage andprovedtobean importantinformationsource. anomalies. A cockpit voice recorder (CVR) was recovered from the on theTSBwebsite. 104 full details of the occurrence, see the investigation report For methods. these illustrate to used is occurrence the about tion was destroyedbyfire. aircraft The injuries. minor had officer first the and injured, ously seri- were technicians) (medical Twopassengers arrived. rescuers cupantsevacuated the aircraft, the captain died of injuries before collided with trees beyond the end of the runway. While all four oc- and sufficiently climb not did aircraft the but attempt, landing its evacuation flight inbound to Sandy Bay, Saskatchewan, abandoned On the evening of Jan. 7, 2007, a commercial Beech King Air medical Introduction arguments fortheexistenceofsafetydeficiencies. management systems) into smaller components to support analytical structs (crew resource management, situational awareness, and safety con- conceptual divided analysis The bias. hindsight overcome to crew andorganizationallevels. Investigatorsused multiple time lines tounderstand supervisors. to known not events were atthat the adaptations widespread were embeddedin interviews subsequently revealed that the deviations survey crew flight informal an and practices) procedures, policies, look at organizational factors. to expanded scope investigative and procedures, operating dard several usefulmethodsforinvestigatinghumanfactors. Airaccident (TSB A07C0001) as acase study, this paper discusses analyse relevant information. and collect to methods good need they and data, of flood a with In the aftermath of an occurrence, investigators are frequently faced Abstract Subsequent review of the CVR, aircraft records, and initial inter Examination of the wreckage revealed no indication of pre-impact This paper focuses on investigative methods, and some informa- Investigators applied the local rationality principle in an attempt stan- from deviations crew many identified investigation Initial • Techniques: A Case Study of a Fatal Useful Human Factors Investigative ISASI 2010 ISASI By DavidRoss,RegionalSeniorInvestigator, Operations,Transportation SafetyBoardofCanada pilot license. andholdsacurrentsupervisor Canadianairtransport training and check pilot, and also as a flight operationsCanadian military. DavidRoss hasexperienceasa 1999. He was previously a transport pilot with thethe Transportation Safety Board of Canada sinceDavid Ross has been an operations investigator with Proceedings King AirAccident inCanada Using the investigation of a fatal King Examination of the 4 Ps (philosophy, 1 available - identify runwaylengthasathreat. not did and performance aircraft the assess not did crewmembers directlyto afinding as to causes and contributing factors that the while some others rarely did so. (See Table 1.) This information led did not make landing performance calculations required by policy, surveyThesummarypilotsshowed the interviewedthatmostof data. to know the extent to which pilots used aircraft performance runways much like the one involved in this occurrence. We needed questions. are twoexamplesoftheresponsestosurvey From the transcripts, we developed a survey summary. The following man performance investigators, and were recorded and transcribed. hu- and operations by conducted were interviews The interviews. between varied questions of timing and sequence the and survey, timesduring interviews. Interview subjects werenotaware the of the 4P’s ofphilosophy, policies,procedures,andpractices. policies. This was consistent with TSB investigative guidance to examine pilot knowledge of and compliance with the company’s procedures examine and to questions 13 of survey informal an developed we flight, factors inmoredetail. organizational examine to investigation the of scope the panded ex- we Consequently,crew. occurrence the beyond extend could ofthis process, we were concerned that the variations in practices on the occurrence flight from policies and procedures. At the end we continuedtoreviewtheCVRandconductinterviews. team, investigative the to addition this With assigned. was Division Performance Human TSB the necessary,from investigator an and of the air operator company. Wepractices that varied substantially from decidedthe procedures and policies investigative assistance was see theinvestigationreportregardingenvironmentalfactors. ronmental factors. This paper addresses only human factors; please usedchartsduring training, rarelyusedthemsince. Table 1.SurveySummary—Landing Performance usedchartsduring training, rarelyusedthemsince. Calculations First Officer First Officer First Officer Captain Training Captain Training Captain Position managers. the pilots’supervising Weaircraft. company’sAir the interviewed King operated also two O survey Interview ne month after the accident,interviewedmonthafterthewene sevenpilots who First, the company frequently had flights operating on short on short operating flights had frequently company the First, conductedsurveywasTheasking questions by appropriate at First, we verified and documented the variation of crew practices crew flight of instances multiple of aware became quickly We U singtherecord variantof crewpractices fromthe occurrence Not asked. charts notused. Performance charts notcoveredingroundschool. Performance charts notused. Performance Answer Second, the Sandy Bay aerodrome did not have any instrument operator company and the regulatory oversight agency. Time lines or visual vertical guidance system for pilots and also did not have were developed to establish the sequence of events within both of any communications facilities. Consequently, company policies and these organizational levels, and to help investigators understand the procedures prohibited straight-in approaches and required pilots inter-relationships between the levels. to visually inspect the runway before landing. We needed to know The organizational time line for the company was useful in that it whether pilots were aware of and complied with these policies. organized supervisory activities into chronological order, again with The survey summary showed that half the pilots interviewed were linkages to underlying factors. This enabled a cross-reference to the not aware of this prohibition, and the remainder reported flying crewmember time lines, helping investigators to better understand straight-in approaches when prohibited (see Table 2). the company’s supervisory capabilities and limitations. The organizational time line for the regulator helped document Position Answer events we had identified in chronological order. However, this time Training Captain Aware of policy. Thinks compliance good with occasional intentional deviations in visual conditions. line was of low resolution and dealt with events that had occurred Training Captain likes to circle, but has done straight-in approaches. up to 2 years previously. The limited number of events we identified Captain Unaware of policy. Flies straight-in approaches if were specific to investigative areas of interest, and, to investigators, winds known. these events took on the appearance of a linear chain of events. In First Officer unaware of policy. Thinks decision is at captain’s reality, these events were far from linear. Hundreds of other events discretion. THURSDAY, SEPT. 9, 2010 SEPT. THURSDAY, First Officer unaware of policy. we did not know about created a complex organizational context. First Officer Aware of policy. Thinks compliance is good with Within this context were the selected events we studied. occasional intentional deviations. Our recommendation is to use such a time line with caution Table 2. Survey Summary—Straight-in Approaches regarding hindsight bias, and to work to understand the overall organizational context. This interview survey proved to be a very effective data collection method. Formatting the data in a summary documented the Conceptual deconstruction extent of pilot non-compliance, which supported our finding that Portions of the analysis in the investigation report discussed three substantial and widespread deviations from standard operating broad concepts: crew resource management, situational awareness, procedures had developed and persisted within the company’s and safety management systems. We were unsuccessful in our initial King Air operation. attempts to develop convincing arguments to support our findings in During interviews with flight operations managers, investigators these areas. This resulted from describing how the occurrence events also asked questions regarding supervisory practices and knowledge indicated problems with each concept as a whole, with investigators of pilot compliance with policies and procedures. This revealed that expecting that our findings were, to a large extent, self-evident. supervisors were unaware of the pilot practices that deviated from However, as Dekker 4,5 points out, we had made a “leap of faith” by policies and procedures. using the categories as labels, and we had not clearly demonstrated While the interview survey was very useful, one negative conse- that the facts led to our conclusions or that the problems identified quence was that it substantially increased investigative workload, had contributed to the occurrence. because many more interviews were conducted compared to other Once the draft report had been reviewed externally, it was obvi- TSB investigations of similar occurrences. ous from reviewer comments that our initial analysis needed to be revised. The approach taken was to deconstruct each of these three Time lines broad concepts into smaller, more manageable components. A timeline is a useful tool to help investigators understand why people did what they did. According to Dekker, “If you want to be- Crew resource management (CRM) gin to understand human error,…a good starting point is to build First, we will discuss crew resource management (CRM). The defi- a time line.”2 nition of CRM that we used is the use of all human, hardware, and Establishing and documenting a sequence of the occurrence information resources available to the flight crew to ensure safe and events is part of the TSB’s integrated safety investigation method- efficient flight operations. In this occurrence, amongst the informa- ology (ISIM)3, and is a normal TSB investigative function. ISIM is tion resources available to the crew was extensive operational risk embedded in the TSB’s transportation investigation information management guidance in the company’s flight operations manual management system (TIIMS) through the use of a number of soft- and standard operating procedures. ware tools for documenting and analysing time lines. Canada requires that flight crews operating airline category air- In this investigation, high-quality data from the CVR enabled de- craft with 20 or more passenger seats must receive CRM training. velopment of a detailed occurrence sequence of events. However, not However, crews operating smaller aircraft, such as the King Air, are all events were recorded on the CVR, and many safety issues involved not required to receive such training. The Commercial Air Services events that should have happened but did not. The occurrence Standards6 of the Canadian aviation regulations lists eight CRM time line was used to integrate events identified from all sources, components for which training must be provided to airline category and to identify times when the non-events should have occurred. pilots. Several of these components were used in the revised analysis The occurrence time line was extremely useful in determining the to better describe the problems that existed on the occurrence flight sequence of events, and aided us in understanding the flight crew’s and within the company’s King Air operation. This paper will discuss behaviour in the context of the many underlying factors. the CRM components of problem solving, and decision-making. In addition to the events during the accident flight, the inves- Problem solving is a CRM component listed in the training re- tigation also examined events at two organizational levels: the air quirements. When this portion of the analysis was revised, we used

ISASI 2010 Proceedings • 105 ISASI 2010 PROCEEDINGS 106 miles from the threshold. Subsequently, the captain identified that 4 about runway the with reference visual acquired crewmembers Both aircraft. the flying officer first the with approach strument in- non-precision a conducting was crew The solving. problem crew ineffective of example an as serve also flight the of portions rencecrew’s conduct of the final approach and go-around. These approach toSandyBay. thatthelessexperienced crewember wasthepilot flying for the determine why this decision was made. A not result of this decision was could investigation The feet. 3,500 than shorter runways on landings conduct to captains requiring policy second a and day, policy requiring the captain to be pilot flying on the first leg of the company one to contrary was This leg concurred. officer first the and the for flying pilot the as officer first the designated captain ineffective. was decision-making that argument our enhance to behaviour crew occurrence of examples used again We required. is training and timelygo-arounddecisionasacrew. no longer possible, and they were unprepared to make an informed they did not discuss and agree on a point at which a safe Consequently,landing threat. was a as length runway identify or performance onpastexperience. expectations ofaircraftperformance lotpractice across the company’s King Air operations waspi- tobasethat Weconcluded calculations. performance aircraft conduct they,showed normally pilots not other did of too, survey interview the Additionally, flights. previous from different little be to flight flown into Sandy Bay without incident, and they likely expected this previously had pilots Both calculations. performance landing any contaminated runway operations, the occurrence crew did not make aircraft performance calculations and to consult landing charts for reduce thetouchdownzonelength. contaminating snow loose the and compacted runway However, feet. would 1,280 of increase length zone the landing distance and touchdown a in resulting feet, 1,600 was surface paved level bare a runway. on distance landing the showed calculations Post-accident argument thattheirproblemsolvingwasineffective. a number of examples of crew behaviour as premises to support our A second example of ineffective decision-making is the occur the is decision-making ineffective of example second A O which for component CRM listed second a is Decision-making The occurrence crewmembers did not assess the aircraft landing Although company procedures required pilots to make pre-flight The destination of the occurrence flight was a 2,880-foot gravel • ne examplene occurred duringafter-startthe check,when the ISASI 2010 ISASI Proceedings - GPS distance-to-go hadnotcontributedtothe occurrence. of use the that determine to investigators helped elements smaller into concept overall the divide to ability the However, issue. this aircraft duringthefinalapproach. crew the of ability the particular in element, spatial/temporal the on focused elements. We five into divided is concept the wherein contributed totheoccurrence. flight crew exhibited ineffective CRM and that the ineffective CRM convincingmore a argumentsupportconclusionsourto provided the that components CRM specific of context the in analysis ofthe initial draft report. However, discussing them in the revised of go-aroundactionsrequired. didnot have the desired effect and of non-standard triggering was officer first the correctthe to sequencedecision this of nication commu- his but go-around, a initiate to decided captain the flare, continuedcoaching the first officer into the landing flare.In and the suggestion the rejected captain the but go-around, a conduct they that suggestion an unassertive made officer first officer. The the aircraft was high on the approach and began coaching the first to theaircraftbeinghighonfinalapproach. coordinates, and our hypothesis was that this may have contributed waypoint aerodrome the to distance the than less mile nautical ¼ than the threshold. The actual distance to the threshold was about ness of using GPS distance-to-go to the centre of the runway rather ends of the runway. Bay, thispoint wasthecentreofrunway, equidistantfromboth Sandy In centre. geometric aerodrome the for those are waypoint King Airpilots. other company’s the by used also was practice this and waypoint, used the GPS to provide distance-to-go to the aerodrome identifier and flight crew training was being developed. The occurrence crew aircraft were equipped with GPS certified for instrument approaches, regulatoryapproval conductto GPSapproaches. Thecompany’s awareness. A second broad concept the investigation examined was situational Situational awareness Our examination of situational awareness did not extend beyond All of these examples had been included in the factual section section factual the in included been had examples these of All We used a model of situational awareness described by Brunelle by described awareness situational Weof model a used aware- situational crew flight on effect the assess to wanted We However, the geographic coordinates of an aerodrome identifier received, yet not had but toward, working was company The predicttheprojected flight path theof Therefore, the crew was able to accurately action. corrective take and approach on identify visually that the aircraft was high the landing attempt, and the captain did therunway for at least 2 minutes before with contact visual had crewmembers both However, approach. final on high being aircraft the to contributed this determineunableWewereto whether and the distance to the runway threshold. ence between the depicted GPS distance differ mile ¼ the of unaware likely were the aircraft. to anticipate the projected flight path of We concluded that the crewmembers Wecrewmembers the that concluded 7 , -

Safety management systems (SMSs) 2006, a consultant audited the company’s operations and found, in A third broad concept we examined was safety management sys- part, that the company’s management response to repeated flight tems. crew regulatory infractions was insufficient and recommended that In 2005, the Canadian aviation regulations were revised to require the company implement a disciplinary policy. The company initially specified organizations to implement safety management systems used unpaid suspension from duty as punishment, with a subsequent (SMSs). The occurrence air operator company was required by the revision to fines of 10% of monthly salary for a first offence and 20% new regulations to have an SMS because it operated three airline of monthly salary for a second offence, with no suspension from duty. category aircraft. Implementation of the SMS was being done in Within 2 months of implementation of this policy, six company pilots four phases under the oversight of Transport Canada. had been disciplined, including the accident crew. The regulations and Transport Canada guidance material divide Our investigation determined that use of punitive action can a safety management system into six components. Three of the substantially impair safety reporting systems. We made a finding as components are further divided into elements, for a total of 17 to risk that, in an SMS environment, inappropriate use of punitive SMS elements. actions can result in a decrease in the number of hazards and occur- In January 2007, at the time of this occurrence, the company rences reported, thereby reducing effectiveness of the SMS. was in phase 2 of implementation. During phase 2, amongst other The ability to divide the overarching SMS concept into smaller, SMS elements, the company was implementing a non-punitive more manageable elements proved to be quite helpful to our in- reporting policy; a reactive reporting system; and reactive investiga- vestigation. We were able to more effectively demonstrate that the 9, 2010 SEPT. THURSDAY, tion, analysis, and risk management processes. Proactive processes facts supported our conclusions. would be implemented during phase 3. The company did not have a fully functioning SMS and was not required to have one until the Local rationality completion of phase 4, in September 2008. Hindsight bias strongly influenced initial attempts to understand We limited our examination of the company’s SMS to only those the many deviations from policies and procedures that occurred elements being implemented during phase 2. during the accident flight. At that time, the focus of the investigation We determined that the company’s immature SMS had not de- was on explaining what should have been done but was not. This tected some previous occurrences involving the accident crew, or approach influenced the analysis and findings in the initial draft many underlying factors identified as contributing to the accident. report. When external reviewers provided comments on the draft From this, we concluded that the company’s reactive reporting report, it became clear that revisions were necessary. system was not yet functioning. During the post-review phase, our focus shifted to explaining why In November 2006, 6 weeks before the accident, the company’s the crew behaved as they did, rather than pointing out what they SMS did detect and investigate a regulatory infraction involving the should have done but did not. To help us do this, we applied the accident crew. We examined the reactive investigation, analysis, and principle of local rationality. 8 risk management processes used by the SMS in this instance. That is, people do not go to work with the intent of causing an We determined that the company’s investigation was well accident. Their decisions and behaviour make sense to them in the documented but was limited in scope. The company SMS analysis context of their knowledge, circumstances, and goals. Although focussed solely on the crew and did not identify underlying super- there may be limited information available, their situation may seem visory and operational control deficiencies. Short-term corrective ambiguous, or they may have multiple conflicting goals, they make action taken by the company was an immediate suspension without the best of what they have in order to get their work done. pay of 2 weeks for the captain and one week for the first officer. Our challenge was to understand the world as the crew perceived Long-term corrective action included both a safety directive to it, in order to understand how they made sense of the situation. We flight crews regarding the numerous flight operations regulatory used this approach to revise the analysis of the transfer of control violations incurred by the company and pilot meetings to be held that occurred during the go-around. at each base to discuss the violations. Procedures for clear and consistent verbal communications pre- Follow-on action was to be a line check of the crew to assess com- vent confusion between pilots as to who has control of the aircraft, pliance with regulations and standard operating procedures. The and the company had a control transfer procedure that was standard captain and first officer were scheduled to fly together only once throughout its fleet. in December 2006 following their suspensions; consequently, the However, the investigation revealed that the captain and first of- company intended to conduct a line check in January 2007 but had ficer occasionally used a non-standard transfer of control practice not yet scheduled it when the accident occurred. that varied substantially from the procedure specified in the standard The company’s SMS was immature and still under development, operating procedures. This practice resulted from the captain’s and this was reflected in the SMS investigation of the November mistrust of the first officer’s ability to land the aircraft. 2006 incident. We concluded that the company’s safety management During previous flights, the captain had taken control of the system was not yet capable or expected to be capable of detecting, aircraft from the first officer on numerous occasions, sometimes analyzing, and mitigating the risks presented by the hazards underly- doing so using the phrase in the standard operating procedures, “I ing this occurrence. This finding was listed with O“ ther Findings,” have control,” sometimes using non-standard verbal phrases, and which are intended to clarify a point of ambiguity or controversy. sometimes without making any verbal statement. In instances when This issue had not contributed to the occurrence. the captain took control without making any verbal statement, the We were also interested in the company’s use of punitive suspen- first officer’s practice was to release the controls upon sensing pres- sion from duty when an SMS non-punitive reporting system was sure from the captain’s control inputs. being implemented. Our investigation revealed that, in the fall of Our problem was that the captain had been fatally injured, and we

ISASI 2010 Proceedings • 107 ISASI 2010 PROCEEDINGS 108 the that likely very was it that concluded safely, we land to ficient communication, and the fact that the remaining runway was insuf- response from the first officer to the captain’s ambiguous go-around of lack the aircraft, the land to ability officer’s first the of mistrust captain’s the Given landing. during and approach on both officer officer releasedthecontrolcolumn. practice theyhademployedonpreviousflights. non-standard the using statement, verbal any making without also column, control the released officer first the flights, previous on taking control without making any verbal statement, as had occurred the captain’s hand on the control column. Believing the captain was first officer perceived pressure on the control column and observed Neitherpilotwasincontrol. • Thecaptainwasincontrol. • Bothpilotswereattemptingtocontroltheaircraft. • Thefirstofficerwasincontrol. • the go-around: his go-arounddecision. of communication his to responded not had officer first the and runway, remaining the on safely land not could they that him to vanced thepowerlevershimself. now,ad- by urgency of sense a feeling likely captain, the decision, the power levers. Four seconds after communicating his go-around captain’s intentions, and did not initiate the go-around by advancing non-standardambiguous,and first theofficer unsure the was of levers.powerHowever,the captain’sbecausethe statement was around, the captain would have expected the first officer to advance non-standard andambiguousstatement. a with officer first the to decision this communicated and around a go- initiate to decided captain The flare. landing the into officer first the coached captain the and flying, pilot was officer first the local rationalityhelpedustoreviseouranalysis. of principle the Applying inconclusive. was transfer control this of officer during the go-around. In the initial draft report, our analysis were unable to confirm he had, in fact, taken control from the first On previous flights, the captain had taken control from the first The first two scenarios listed above did not occur because the first Immediately after the captain had advanced the power levers, the Weexamined four possible scenarios of aircraft control during The captain almost certainly took this action because it was clear ago- toconduct his intent of officer first the advised Having approach, final on high was flight the discussed, previously As • ISASI 2010 ISASI Proceedings Use • means ofobtaininginformation. circumstances, knowledge,andgoals. things for reasons that made sense to them at the time, given their did rationality.pilots crew’slocal These the of context the in us to unlikely.controlling theaircraftwasvery flying fortheremaining20secondsofflight. captain did take control from the first officer and became the pilot Conducting • Conclusions 2 1 Endnotes 4 3 The • helpful. organizational An factors. time underlying line and for events company of sequence managerial occurrence the activities was also 8 7 6 5 Arguments • a timelineshouldbeusedwithcaution. tional context within which decisions and actions were taken. Such confusion because of the inability to portray the complex organiza- establish chronological sequencing. However, it actually introduced The • existed andcontributedtotheoccurrence. ponents will provide a trail to your conclusions that the deficiencies com- smaller into concepts the reader.Dividing the convince not avoid thenegativeeffectsofhindsightbias.◆ to and them, to sense made crew’s actions flight and the decisions t

Dekker, S. (2006), The Field Guide to King AirC-GFFNSandyBay, Saskatchewan. Dekker, S. (2006), The Field Guide to Manual—Air. TSB (Undated) ISI M–Integrated Safety Investigation Aldershot, and LocalRationality. Woods,D., and Cook, R.I., Perspectives onHuman Communicate? ISASI,Halifax,Canada. Standard Brunelle, Services N. (2008), Air Conversations Commercial in the Cockpit:725.124(39). Pilot regulations, aviation Canadian Aldershot, UK. Dekker, S. (2002), The Field Guide to Human Aldershot, Theconclusions we reached in the revised analysis made sense Wealso concluded that the scenario in which neither pilot was SB InvestigationSB

of regulator principle

U U time K. K. regarding a

survey A of line time 07C0001-Collision with local

was line within deficiencies

rationality very was

interviews helpful of Understanding Human Understanding Human low helped in resolution

T to concepts errain- proved

rror Investigations, Ashgate, Error Investigations, Ashgate, analyse us T ranswest Methodology Reference E to rror:Hindsight Biases to such

but E and understand rror or a Failure to be A was Error, Ashgate, Error, Ashgate,

as a ir Beechir understand very CRM useful useful A may why 100 to

Effects of Mental Stressors During Flight on Prosodic Features of Speech And Autonomic Nervous Responses By Hiroto Kikuchi (MO3562), Japan Air Self Defense Force Hiroto Kikuchi is a chief researcher with the Air and reveal adequate voice index for stress level estimation, not only Safety Investigation Division and has been involved in space and aviation field, but also in defense and jurisdiction; a with air safety investigations as a psychologist for number of research areas need further investigation (Hansen et al., more than 50 mishaps of the Japan Air Self Defense 2000). Especially, the research related to the relationship between

Force. He received his bachelor of arts in psychology voice indices and physiological indices is required. 9, 2010 SEPT. THURSDAY, from Gakushuin University in March 1984 and received his master of human sciences from Waseda Results of previous studies University in March 2009. The glottis movement is innervated by the Xth brain nerve, the vagus for 90%. The vagus has mostly inhibiting functions, controlling Outline activity locally, but does influence nearly all parts of the body, as the This study examined the relationship between vocal indices and parasympathetic part of the autonomic nervous system (Johannes, physiological indices of pilots subjected to mental stressors dur- Salnitski, Gunga, and Kirsch, 2000). ing flight to determine the optimum voice indices for estimating The superior laryngeal nerve controls the cricothyroid muscle, psychological stress. which relates to the fundamental frequency rise by the glottis extension, and the recurrent laryngeal nerve controls the other Intrinsic Introduction laryngeal muscles. Pilots operates an aircraft with maintaining situational awareness Numerous researches have been done from 1960s in the space while processing multimodal information, such as visual, audi- and aviation field. In 1965, the voice during A.A.L eonov’s extrave- tory, somatosensory, tactile, and olfactory information. Particularly, hicular activity outside the Voschod-2 was investigated as information modern pilots must have highly cognitive abilities including meta of mental state of a cosmonaut. In 1978, the voice of S. Jaehn during cognition and self-monitoring, to play an important role as system preparation and different flight phases was investigated for voice programmer, system monitor, and system administrator, not to pitch, formant, and intonation. Due to this kind of research, F0 have speak of a good decision-maker who has a good flying skill, which been found to indicate higher significantly under mental and physi- has been crucial ability of the pilot from their incunabula, in their cal stress situation of the extreme conditions of space mission. activities. A series of these information processing activities can be In Japan, the Aeromedical Laboratory of the Japan Air Self De- done by automatic process for a typical procedure through daily fense Force started to investigate the voice change characteristics training and experience, and done by pattern matching strategy during emergency situations in 1970s, and proposed the VSSR (Vi- for relatively easy decision-making matters. It enables pilots to save bration Space Shift Rate) index by analyzing the voice, and deliberat- their cognitive resources. However, in case of unusual emergency, ing the relationship between voice index and assuming emergency or event which can cause a mishap, the pilot is obliged to decide situations (Kuroda, Fujiwara, Okamura, and Utsuki, 1976.). VSSR under highly cognitive workload situation, where the pilot should is as F0 increasing rate from that of uneventful situation. select the most appropriate solution, while gathering information Alpart and Schneider (1987) reported that reaction times tended and considering another solution within limited time under stressful to be faster and its standard deviation tended to be higher, and situation in peril of his life. frequency and amplitude of the voice tended to be higher and its An estimation of the pilot’s emotion during a series of events is standard deviation tended to be lower in the high workload condi- necessary to analyze psychology and behavior of the pilot involved tion, as compared with the low workload condition. Brenner and in such situations, as well as information of an aircraft system and Shipp (1987) examined the following eight voice indices as stress its maneuver. However, available information is limited, even if the evaluation scales under the sponsorship of United States Air Force, aircraft has an FDR (flight data recorder) or CVR (cockpit voice based on the comprehensive literature review by Naval Air Test Cen- recorder). In the event of mishap or emergency event of an aircraft ter. Results showed that every voice index was less robust than that that has no FDR or CVR, the sole clue for psychological analysis is the of heart rate index. Only three indices, as amplitude, fundamental voice of the pilot, that is a radio communication recording between frequency and speech rate, provided significant discrimination. pilot and air traffic controller, UH D (head-up display) VTR of the 1. Fundamental frequency (pitch) aircraft, or another aircraft, for example. There may be an increase in fundamental frequency under stress. Kuroda (1986) reported that an estimation of pilot’s stress by voice Fundamental frequency may reflect the physical tension of the analysis is an effective method to estimate stress level during emer- vocal muscles. gency situations of real operation. Many researchers tried to examine 2. Amplitude (loudness)

ISASI 2010 Proceedings • 109 ISASI 2010 PROCEEDINGS 110 Teager modulation component and frequency modulation component) by the resultreportedbyBrenneretal.(1987). contradicted results these of part A stress. under increased energy jitter, amplitude shimmer, and 1,600Hz to 4,500Hz band harmonics frequency,frequency fundamental that showed results and stress, (1988) examined vocal characteristics under cognitive workload and sponse profiles to the workload duringre- flight. voice the identify to them for impossible was it but simulator, flight on turbulence and window cross with landing during voice measure combinesothermeasuresdescribedabovestatistically. There may be an increase in derived measure under stress. A derive 8. Derivedmeasure tween 500Hzand1,000Hz. be- energy speech of proportion the in increase an be may There 7. Energydistribution There maybeanincreaseinPSEscoresunderstress. 6. PSEscores(psychologicalstressevaluator) There maybeadecreaseinshimmerunderstress. 5. Amplitudeshimmer There maybeadecreaseinjitterunderstress. 4. Frequencyjitter processes. motor cognitive and of general speeding up reflect a may Speech rate stress. under rate speech in increase an be may There 3. Speechrate reflect anincreasedairflowthroughthelungs. There may be an increase in amplitude under stress. Amplitude may “Speech (HMM). Hidden or frequency fundamental than accurately (1999, 2001) reported TEO based voice index classified stress level Wittels, Johannes, Also, 2000). al., et (Johannes researches in identified is load emotional and frequency fundamental between relationship amount is rather small, as 4%, 2Hz and 1dB for each index. Yet, the increased statistically under high workload situations, but their shift speech rate, fundamental frequency,(the National Aeronautics and andSpace Administration) reported that amplitude (loudness) son, haveVloeberghs, Trancoso, and Verlinde, 2000). In addition, NASA of NATO (Hansen, Swail, South, of speech produced under workload stress remain unclear.” due to the report under stress from 1995 to 2000. However, “Changes in the characteristics still unresolved. NATO has worked on a research project for speech stress effects on voice and relationship between stress and voice was posed the necessity for another research, because their complexity of their effects on voice. Then, tic Treaty frequency (r frequency Results showed the high correlation coefficient for fundamental recordings. tape from digitized of that with samples digitized a psychological stress index. voice index of fundamental frequency is considered as excellent as while there was no significant difference by physical workload,a so reported fundamental frequency increased under mental workload, Teager (1980) invented a non-linear voice index (amplitude (amplitude index voice non-linear a invented (1980) Teager Schneider and Alpert (1989) examined variation of a test pilot’s During the progress of voice indices research, a workshop of of workshop a research, indices voice of progress the During Gelfer and Fended (1995) compared voice measures of directly • ISASI 2010 ISASI Energy Enne, Under Stress” took place in September 1995 by North Atlan- Organization (NATO), and discussed the stress model and =.989, Eisinger,Adler, Thomas, Castro, (2007) Gerzer and ). Then, Zhou, Hansen, and Kaiser Kaiser and Hansen, Zhou, Then, (TEO). Operator Proceedings p <.001, N Murray, Baber, and South (1996) pro- =30), and for jitter (r jitter for and =30), Moore, Steeneken, Cupples, Ander Mendoza and Carballo arkov model model Markov =967, p <.001, <.001, - tion coefficient for shimmer (r N Stress Analysis) for Analysis) Stress U level was not above chance level. TrusterPro were invalid for its validity and reliability, because its hit achievedvocalmorethan90%,butmeasuresrateshitofthe of showed that electrodermal, respiratory, and cardiovascular measures TrusterPro (Trustech) in the detection of guilty knowledge. of Results measures vocal and measures psychophysiological traditional Rill,Vossel, and Godard (2006) investigated Gamer,the 2000). Yourick,validity and Koenig, ofSaviolakis, several (Meyerhoff, ment the of concerns great and authorities tion traditional polygraph, because of spread of the software in jurisdic - thesoftware’s reliability examining been and has validity, Institute Polygraph as Defense well as of the difference Department from ers, but the outcome failed to meet expectations. government purchased the Nevertheless, merchandise and trained some - examin the for Truth Verification) appeared on the market, the(ComputerAfterCVSA Voice StressAnalyzer, NationalInstitute Polygraph Institute began to examine voice stress analysis method. Defense of Department The detection. false in especially index, of voice theadvantage about concerns great had field, aviation and Bou-Ghazale,1995). situation, andimprovetherecognitionrateofsystem(Hansen emergency of stress under effect an consider or effect, Lombard spectrum component increase, and amplitude increasefundamental due to thefrequency increase, formant frequency of noise shift,eliminate to higherlimelight into got training recognition prior modern aircraft system, research using Hidden Accompanied with the introduction of voice recognition system on ers looked to voice for its unobtrusiveness, availability, and feasibility. of voice index has been done without intermission, because research- are indispensable for continuous evaluation. Nevertheless, research available in natural operational environment, some amounts of data and identifiability. Besides, speech as a data source of voice index is than the physiological index has been found so far, for its sensitivity took place (Whitmore and Fisher, 1996), butduring noa 36-hour voicemission using indexB-1B fighter bomberbetter flight simulator research for examining the relationship between monitoring fatiguemethod in near andfuture (Fiedler,voice 2004). In aviation field, method as a index of stress analysis andvoice 2005), Flynn, and Sipes, Short, (Kane, astronauts for fatigue will be included as ment aTool cognitivefor Windows) as Assess- a cognitive Cognitive performance evaluation tool (Spaceflight SCAT Win developed has NSBRI) facility isavailable. analysis, in case of only an analogue recording of air traffic control voice for recordings tape from digitized of source audio the use shimmer,than robust more is jitter and to way proper a is it and and jitter, it is reasonable to consider that fundamental frequency frequency fundamental for correlation high the exist there that so far that sensitivity and identifiability are beyond physiological physiological beyond are identifiability and sensitivity that far so not abovechancelevel. wereinvalid forits validity andreliability, because itshit level was for Truth Verification). Their results also showed that both software and CVSA (Computerized Voice Stress Analyzer, National Institute =30). pchurch, and Defensejurisdictionand spaceand authorities,the as well as (NASA/ Institute Research Biomedical Space NASA’sNational Afterallthese researches, voiceno measures havebeen found n the other hand, results showed relatively low correla- low relatively showed results hand, other the On M oore (2007) investigated the validity of VSA (Voice L ayered Voice Analysis, Voice (L ayered VA =.481, Moreover, Damphousse, Pointon, p <.01, N nited States govern- States United =30). Due to the fact Markov model with L VA Solutions) Solutions) VA U nited States Figure 1. F-2 fighter aircraft. 9, 2010 SEPT. THURSDAY, measures. Nevertheless, the United States Department of Defense has been interested in voice measures as an important information sources, as EEG (electroencephalogram), eye movement, and ther- mography (Meyerhoff et al., 2000). Another researcher examined voice measures for an estimation Figure 2. Schematic diagram of the measuring devices. of intent or feeling of speaker. Maekawa and Kitagawa (1999) analyzed fundamental frequency, amplitude and duration of voice by Kruskal’s multidimensional scaling method and multiple regression analysis; the results showed high correlation and predicted paralinguistic information (doubt, praise, dismay, indifference, neutral, and emphasis) precisely. Nwe, Foo, and Silvaet (2003) examined voice measure of log frequency power coefficients L( FPC), and the results showed that the proposed system yielded an average accuracy of 78% and the best accuracy of 96% in the classification of six emotions by using hidden Markov model (HMM).

Purpose The purpose of this research is investigating the relationship between vocal indices and physiological indices of pilots under stressor during flight to find out the optimum voice indices to estimate psychological stress. The word “stress” in this paper deals with acute distress.

Method During flight training of the JASDF (Japan Air Self Defense Force) fighter pilot training course, the voice and the physiological indices of the pilot was recorded and analyzed. The flight simulator scenario Figure 3. Frequency response chart of the microphone. was derived from the JASDF fighter pilot training course syllabus. 3. Measuring devices 1. Subjects The schematic diagram is as shown in Figure 2. Thirteen pilots of the JASDF attended the experiments. Seven pilots 3.1. Digital audio recorder were trainees, and six were instructor pilot. Voice was recorded on PCM audio recorder (PCM-D1, SONY) (48

kHz, 16 bit) via built-in microphone of O2 mask. Figure 3 indicates 2. Flight simulator frequency response chart of the microphone. The flight simulator was F-2s, which precisely simulates flight char- 3.2. Eye mark recorder acteristics and cockpit of F-2 fighter aircraft. The simulator has 210º Pupil diameter was recorded on the eye mark recorder (EMR-8B with horizontal field-of-view and 110º horizontal field-of-view visual display 62° visual angle lens, nac) by recording unit attached on helmet. system; projection resolution is 8.5min/OLP(optical line pairs) for 3.3. Biosignal Recorder front area and 9.5min/OLP for peripheral area, and luminance Electrocardiogram(ECG) and respiration was recorded on biosig- is 2ft-L(6.85 cd/m2). The F-2 is a multi-role, single engine, fighter nal recorder (BIOPAC Type-MP30, BIOPAC System) at 250 Hz, by aircraft based on the F-16C/D Block 40 and tailored to Japan’s NASA lead using electrode leads(SS2L, BIOPAC System) attached requirements (see Figure 1). to disposable electrode (Vitrode M, NIHON KOHDEN).

ISASI 2010 Proceedings • 111 ISASI 2010 PROCEEDINGS 112 baseline “remove with width), peak to peak of (5% 5% was width reduction Noise bpm). window was 0.33 for minimum and 1.5 for maximum (40 bpm-180 tectorfunction ofthe software, using de- positive rate peakby detection; detected was the interval R-R Ver.3.6.7Systems). BIOPAC Student (Biopac software analysis data biosignal by lyzed ana- were frequency respiration and rate, heartbeat interval, R-R 4.3. Biosignalrecorder ordinate. Spatial resolution of eye mark detecting unit is 0.02 mm. co- center the detecting of process the in diameter pupil obtains smoothed usingmovingaveragemethod(timespan:0.2sec.). ogy) to obtain variations of pupil diameter,recorder andanalysis software then (EMR-dFactory Ver.1.2, the data nac wereImage Technol - converted to avi files. The encoded data were decoded by eye mark imported to personal computer via IEEE1394 port as DV stream and codes and recorded on videotape recorder, and then the data were recorder mark eye to encoded were diameter pupil of Variations 4.2. Eyemarkrecorder ining spectrogramandamplitudeofthevoicesignal. extraction errors that resulted from noise were eliminated by exam- frequency jitter. Proceeding to the analysis, fundamental frequency 5105 Ver.2.3, Kay Ver.2.33700 Model and (Multi-Speech software analysis voice by analyzed were Voicedata 4.1. Digitalaudiorecorder 4. Datareductionandanalysis Figure 4.Fundamental frequency. frequency0.043Hz).at cutoff Spectrum for estimation equivalent wasanalyzed (g=300, theby method priors smoothness the ing and 0.15Hz-0.40HzasHFband component. as VLF band component, 0.04 Hz-0.15 Hz as Ver.1.1,Software Analysis (HRV software analysis HRV by analyzed was variability rate heart error of rate detector function of the software existed. In addition, diogram wave when respiration frequency was strongly observed or interval. R-R interval was corrected by R-R examining original electrocar of detected validity confirmed and spectrogram examining to applied was algorithm) Burg values=8,193, spectral estimated miscounting ofspikenoise. EMR-8B eye mark recorder utilizes an image of binarization and The low frequency baseline trend component was removed us- removed was component trend baseline frequency low The of Number order=100, (regression method entropy Maximum • ISASI 2010 ISASI E Proceedings lemetrics) to obtain fundamental frequency and N,” “Automatic threshold “Automatic ON,” ulti-Dimensional VoiceProgram Multi-Dimensional niversity of Kuopio), for 0 Hz-0.04 Hz Hz Hz-0.04 0 for Kuopio), of University F band component, LF band component, N” to prevent prevent to ON” ab PRO Lab odel Model -

but susceptibletopitchextractionerror. Absolute jitter has high sensitivity to the period-to-period variability, 5). Figure (see sample voice analyzed the within period pitch the Absolute jitter is an evaluation of the period-to-period variability of 5.1.6. Absolutejitter dard deviationoffundamentalfrequency. The fundamental frequency standard deviation is the value of stan- 5.1.5. Fundamentalfrequency standard deviation increasing rateasstandardninescale. value derived from the standardized point of fundamental frequency Thestanine scale of fundamental frequency increasing rate is the 5.1.4. Staninescaleoffundamentalfrequency increasing rate frequency duringaviationcommunicationsentencereadingtask. fundamental average by divided frequency fundamental average The fundamental frequency increasing rate is the value derived from 5.1.3. Fundamentalfrequency increasing rate vations. obser of value average the is frequency fundamental average The 5.1.2. Average fundamentalfrequency has thelargestnumberofobservations. the lowestfrequencyinaharmonicseries(seeFigure4). Fundamental frequency is the inverse of the pitch period length, or 5.1.1. Modefundamentalfrequency pattern, andsoforth. formant spectrum, frequency amplitude, duration, speech as such wasselected for voice index, though there are many voice indices tion, fundamental frequency and frequency jitter related voice index condi- experiment the Considering analysis. amplitude for setting there existed difficulty to control speech contents and microphone so training, simulator flight during executed was experiment The 5.1. Voice index for relativelyshorttimeduration. rate heartbeat and HRV for recommended (1992) Roscoe which sec, 30 was range analysis indices physiological and indices Voice 5. Measuringvariables Figure 5.Absolutejitter. of Tarvainen (2002)recommended. that was method Detrending Hz. 4 of rate interpolation with 256) Welch’s Periodogram (1,024 points, hamming window 512, overlap ode fundamental frequency is mode value, or the value that that value the or value, mode is frequency fundamental Mode - Figure 8. Smoothed pitch period perturbation quotient.

The pupil diameter is the average value of observations. 5.2.2. Pupil diameter standard deviation The pupil diameter standard deviation is the value of standard

deviation of pupil diameter. 9, 2010 SEPT. THURSDAY, 5.2.3. Average heartbeat rate Figure 6. Relative average perturbation. The average heartbeat rate is the average value of observations. 5.2.4. Incremental heartbeat rate The incremental heartbeat rate is the difference between average heartbeat rate and average heartbeat rate during 2 minutes rest after flight simulator training. 5.2.5. Heartbeat rate increasing rate The heartbeat rate increasing rate is the value derived from heartbeat rate divided by average heartbeat rate during 2 minutes rest after flight simulator training. 5.2.6. Heartbeat rate standard Deviation The heartbeat rate standard deviation is the value of standard deviation of heartbeat rate. 5.2.7. Root mean square successive differences (RMSSD) The RMSSD is the square root of the mean of the sum of the squares of differences between adjacent NN intervals. 5.2.8. Low frequency power (LF) The LF is the relative power in low frequency range (0.04-0.15Hz) of heart rate variability. Figure 7. Pitch period perturbation quotient. 5.2.9. High frequency power (HF) The HF is the relative power in high frequency range (0.15-0.4Hz) 5.1.7. Relative average perturbation of heart rate variability. The relative average perturbation (RAP) is relative evaluation of the 5.2.10. Ratio LF/HF (LF/HF) period-to-period variability of the pitch within the analyzed voice The LF/HF is the value derived from LF absolute power divided by sample with a smoothing factor of three periods. Relative average HF absolute power. perturbation is less sensitive to both period-to-period variability and pitch extraction error, but is capable of indicating results of short Results period (three periods) in detail (see Figure 6). 1. Pearson Product-Moment Correlations between the voice index and the 5.1.8. Pitch period perturbation quotient physiological index The pitch period perturbation quotient (PPQ) is the relative Pearson product-moment correlations were calculated to examine evaluation of the period-to-period variability of the pitch within the the relationship between the voice index and the physiological index. analyzed voice sample with a smoothing factor of five periods (see The results are shown in Table 1. Figure 7). The results showed that the correlation between the average fun- 5.1.9. Smoothed pitch period perturbation quotient damental frequency and the pupil diameter was significant r( =.411, The smoothed pitch period perturbation quotient (sPPQ) is the rela- p<.001), and between the mode fundamental frequency and the tive evaluation of the period-to-period variability of the pitch within pupil diameter was significant r( =.306, p<.001). The correlation be- the analyzed voice sample with a smoothing factor, smoothing factor tween the average fundamental frequency and the average heartbeat of 55 is adapted in this paper. The more the smoothing factor is high, rate was significant r ( =.236, p<.001). The correlation between the the more detail results of long-term evaluation of the period-to-period fundamental frequency increasing rate and the average heartbeat variability of the pitch can derived from the data (see Figure 8). rate was significant r( =.251, p<.001), and between the fundamental 5.2. Physiological index frequency increasing rate and the pupil diameter standard deviation 5.2.1. Pupil diameter was significant r( =-.225, p<.001). The correlation between the stanine

ISASI 2010 Proceedings • 113 ISASI 2010 PROCEEDINGS 114 (r significant fundamental frequency standard deviation and the heartbeat rate was was significant (r scale of fundamental frequency increasing rate and the Physiological Index. heartbeat rate Table 1.Pearson Product-Moment Correlations BetweentheVoice Indexandthe for all subjects, and for the instructor pilots and trainees group, response autonomic the of complexity the of consideration in tionship between the voice indices and the physiological indices The canonical correlations analysis was run to examine the rela- analysis 3. Canonicalcorrelations as vocalindicatorofstressduring simulatedflight. of this analysis have identified the difficulty of using a single voice index deviation was significant(r damental frequency increasing rate and the pupil diameter standard the heartbeat rate standard deviation (r deviation standard rate heartbeat the ( square successive differences (r differences successive square rate standard deviation (r the heartbeat rate increasing rate (r (r significant was rate heartbeat Incremental the and quotient perturbation period pitch smoothed the between tion cantly with the fundamental frequency standard deviation. The correla- ter multiple physiologicalindicesascriterionvariables. and variable dependent index an as index voice single a between The multiple regression analysis was run to examine the relationship 2. MultipleRegression Analysisofthephysiologicalindextovoice with thefundamentalfrequencystandarddeviation. well the model fits, the data were not good (R trainees group, respectively. R-square value which is an indicator of how indices were adopted for physiological allvariables, dependent index as And adopted. were subjects,tient and for the instructorrelative average perturbation and the pitch period perturbation quo- pilots and the fundamental frequency standardfrequency, the stanine scale deviation,of fundamental frequency increasing rate, the absolutevariable, the mode fundamental frequency,jitter, the average fundamental the avoiding multicollinearityproblemduringtheanalysis.Asacriterion to selected was five than greater not was Factor) (VariationInflation r =.272, The stepwise method was selected (Criteria: probability of F to en- to F of probability (Criteria: selected was method stepwise The <=.05, • ISASI 2010 ISASI p Probability <.001), the heartbeat rate increasing rate (r =.212, =.250, Proceedings p <.001), and also the incremental heartbeat rate rate heartbeat incremental the also and <.001), of p F <.001), and between the stanine scale of fun- =-.205, =.274, to remove =.207, p p <.001) were correlated significantly <.001). The correlation between the =.291, >=.10), p <.001) was correlated signifi- correlated was <.001) =.280, p <.001), and the heartbeat and 2 =.025-.282). The results p =.268, the <.001), Root mean mean Root <.001), model =.267, p <.001), and p that <.001), <.001), VIF

significant (l significant demonstratedthatthecanonical correlations forallsubjects was for all instructor pilots and trainees group respectively.situationthedependentwhether asemergencyvariablesnot or The results and variable, independent index an as index voice the of variant canonical analysis. The discriminant analysis adopted the canonical ingthebycanonical variant theofvoice index derived fromthe ability of simulated emergency situation of the flight simulator train- discrimination the examine to run was analysis discriminant The 4. Discriminantanalysis significant (l NCP=0, LO90=0,R MSEA=0, PCLO=.845,CFI=1,AIC=26.535) value (χ good very showed model the of fit assessing the of measures The 5.1. Assessingfitofthemodel between twoormorelatentvariables. (measured) and unobserved (latent) variables and also relationships rate as observed variablesofthephysiologicalindex. rate asobserved of the voice index, and the pupil diameter and the average heartbeat fundamental frequency and the absolute jitter as observed variables relationsbetweenvariables.the modelTheadopted averagethe among structuralmodelsexamined. structural model showed in the Figure 9 indicated the highest validity tionships between voice and autonomic responses.rela- complex test to used is As(SEM) amodeling result,equation Structural the 5. Covariancesstructure analysis(CSA) system responsetraitevaluation. and alexithymia trait should be evaluated, as well as cardiovascular induce voice responses. So the possibility from the instructor pilot of during simulated repressorsflightwas not enough to or sensitizers the stressor level of the simulated emergency situation and direction though responses, autonomic and indices voice between tionship results suggested that there were individual differences of the rela- p (l significant was subjects five for correlations canonical the that demonstrated results the and run, was subject each for analysis discriminant the Then respectively. 39%, and <.10). The cross-checked error rate was 25.5% to 41.7%. The41.7%. tocross-checked25.5% Thewas<.10). rate error S In Figure 9, we can visualize the structural model that shows the EM is usedtestisto“complex” relationships between observed 2 =.535(df

=.363, =.283, =1), p p <.001). The cross-checked error rate was 37% <.001),and also that for trainees group was p rate only as voice variablesvoice(l as only rate quency,fundamentalthe frequency increasing fre- fundamental average the using correlations response effect. nervous autonomic the estimate we when rate, quency and the fundamental frequencyvariables, as well as the increasingaverage fundamental fre- perturbation quotient should be included as voice standard deviation and the smoothed pitch period resultssuggest thatfundamentalthe frequency higher (l higher was variables voice as quotient perturbation smootheddeviationperioddardpitchtheand increasing rate, the fundamental frequency stan- damental frequency, the fundamental frequencyaverage fun- the using correlations canonical of respectively. =.464, he results demonstrated that eigenvalue that demonstrated results The n.s., 2 =.238-.521) than that of canonical canonical of that than =.238-.521) CMIN/DF=.535, PRATI O=.100, =.331-.525,p 2 =.220-.510). <.001- he The l 2 are those of the author, and do not necessarily represent the views of the Japan Air Self Defense Force, the Ministry of Defense, or any other government agency. This study would not have been possible without support from the Japan Air Self Defense Force pilots who contributed as participants for study. I am truly grateful to all of them. ◆ References Alpert, M., and Schneider S.J. (1987). Voice-stress measure of mental workload, NASA Document ID: 19880013997 (In NASA. Langley Research Center Mental- State Estimation, pp.155-162). Brenner, M., and Shipp, T. (1987). Voice stress analysis, NASA Docu- ment ID: 19880014011 (In NASA. Langley Research Center Mental-State Estimation,pp.363-376). Damphousse, K.R., Pointon, L., Upchurch, D., and Moore, R.K. (2007). Assess- Figure 9. Covariances structure analysis result (standardized ing the validity of voice stress analysis tools in a jail setting. U.S. Department estimates). of Justice Document Number 219071. Fiedler E. (2004), NASA/JSC Behavioral health and performance: Four factors with a focus on cognition in spaceflight. (Paper presented at the meeting) 5.2. Standardized regression coefficients of the model Gamer, M., Rill, H.G., Vossel, G., and Gödert, H.W. (2006). Psychophysiological The standardized regression coefficients of the path of the voice and vocal measures in the detection of guilty knowledge. International Journal 9, 2010 SEPT. THURSDAY, index to the physiological index was .51(R 2=.26, p<.001). of Psychophysiology. 60, 76-87. Hansen, J.H.L., and Bou-Ghazale, S.E. (1995). Robust speech recognition train- Correlation between two observed variables of the voice index was ing via duration and spectral-based stress token generation. IEEE Transactions significant r( =-.48,p<.001), the standardized regression coefficients on Speech and Audio Processing, 3(5), 415-421. of the path of the average fundamental frequency to the voice index Hansen, J.H.L., Swail, C., South, A.J., Moore, R.K., Steeneken, H., Cupples, E.J., Anderson, T., Vloeberghs, C.R.A., Trancoso, I., and Verlinde P. (2000). The was 1.13 (p<.001), and the standardized regression coefficients of impact of speech under “stress” on military speech technology, NATO Project the path of the absolute jitter to the voice index was .38 (p<.001). 4 report, NATO AC/ 232/ IST/ TG-01. The standardized regression coefficients of the path of the physi- Johannes, B., Wittels, P., Enne, R., Eisinger, G., Castro, C.A., Thomas, J.L., 2 Adler, A.B., and Gerzer, R. (2007). Non-linear function model of voice pitch ological index to the pupil diameter was .85 (R =.74, pp <.001), and dependency on physical and mental load. European Journal of Applied Physiol- the standardized regression coefficients of the path of the physiologi- ogy. 101, 267-276. cal index to the average heartbeat rate was .49 (R 2=.27, p<.001). Johannes, B., Salnitski, V.P., Gunga, H.C., and Kirsch, K. (2000). Voice stress monitoring in space-possibilities and limits. Aviation, Space and Environmental Medicine. 71, Section2, A58-65. 6. Application of new multiple voice index to real flight situation Kane, R.L., Short, P., Sipes, W., and Flynn, C. F. (2005). Development and vali- To verify the efficacy of the new multiple voice index, the last model dation of the spaceflight cognitive assessment tool for Windows (WinSCAT). Aviation, Space and Environmental Medicine. 76 (6), Section2, B183-B191. of SEM was applied to the voice index of real flight situations. Results Koike, Y. (1973). Application of some acoustic measures for the evaluation of show that the stanine scale of fundamental frequency increasing rate laryngeal dysfunction. Studia Phonologica. VII, 17-19. Kyoto University. has faults to express the trend of psychological stress, comparing to Kuroda, I., Fujiwara, O., Okamura, N., and Utsuki, N. (1976). Method for determining pilot stress through analysis of voice communication. Aviation, Space the new multiple voice index. Besides, the new multiple voice index and Environmental Medicine. 47, 528-533. surpass the fundamental frequency increasing rate in interpreting Kuroda, I. (1986). Mental and behavioral reactions under emergency situation the trend of psychological stress, and more sensitive to understand during flight.Japanese Journal of Social Psychology. 1(2), 4-11. Maekawa, K., Kitagawa, T. (1999). Production and perception of the paralinguistic autonomic nervous responses. information in speech–A Multidimensional Scaling Analysis. Technical Report of IEICE. 99-10, 9-16. Conclusions Mendoza, E. and Carballo, G. (1998). Acoustic analysis of induced vocal stress by means of cognitive workload tasks. Journal of Voice, 12(3), 263-273. To examine the relationship between voice and autonomic nervous Meyerhoff, J.L., Saviolakis, G.A, Koenig, M.L., and Yourick, D.L. (2000). Physi- responses more systematically, we should consider CNS activities, ological and biochemical measures of stress compared to voice stress analysis as EEG, cerebral metabolism, and blood flow, as well as internal using the computer voice stress analyzer (CVSA). Report No. DoDPI98-R-0004, Department of Defense, U.S. secretion and immunity. Murray, I.R., Baber, C., and South, A. (1996). Towards a definition and working For efficient utilization of voice variables as stress index of the pilot model of stress and its effects on speech. Speech Communication. 20, 3-12. in case of mishap investigation, I recommend that the safety investiga- Nwe, T.L., Foo, S.W., Silvaet, L.C.D. (2003). Speech emotion recognition using hidden Markov models. Speech Communication. 41, 603-623. tion board construct a voice database of pilots during calm condition Roscoe, A.H.(1992). Assessing pilot workload. Why measure heart rate, HRV on ground in advance. And whenever interpreting the results of and respiration?. Biological Psychology. 34, 259-287. voice stress analysis, presume that there exists individual differences Schneider S.J., and Alpert, M. (1989). Voice measures of workload in the advanced flight deck: Additional studies. NASA Document ID: 19900014571. of autonomic nervous response characteristics, and the psychologist Tarvainen, M.P., Ranta-aho, P.O., and Karjalainen, P.A. (2002). An advanced should interpret the results deliberately on a basis of psychological detrending method with application to HRV analysis. IEEE Transactions on knowledge, as well as the pilot’s personality and experiences. Biomedical Engineering. 49 (2), 172-175. Teager, H.M. (1980). Some observations on oral air flow during phonation.IEEE Continued research including the basic study and application Transactions on Acoustics, Speech, and Signal Processing, 28(5), 599-601. of the study results to field work in this area is required to provide Whitmore, J., Fisher, S. (1996). Speech during sustained operations. Speech Com- reliable measures of stress during flight. munication. 20, 55-70. Zhou, G., Hansen, J.H.L., Kaiser, J.F. (1999). Methods for stress classification: Nonliniear TEO and linear speech based features. Acoustics, Speech, and Signal Acknowledgments Processing, 1999. ICASSP ’99. Proceedings, 1999 IEEE International Conference on This article is based on a thesis submitted by the author to Waseda Acoustics, Speech and Signal Processing. Zhou, G., Hansen, J.H.L., Kaiser, J.F. (2001). Nonlinear Feature Based Classifica- University, in partial fulfillment of the requirements for a master of tion of Speech Under Stress. IEEE Transactions on Speech and Audio Processing, human science degree in safety engineering. The views and opinions 9(3), 201-216.

ISASI 2010 Proceedings • 115 S ISASI 2010 PROCEEDINGS of samples was an early indication that a complex investigation of of investigation complex a that indication early an was samples of number large a such of handling secure the and containers able suit- of number sufficient a finding for of logistics The testing. further required was it case in kept be to had and tanks fuel aircraft Inaddition, around three tonnes offuel were removed from the engines. and aircraft the on locations of variety a from taken were acted as our independent fuels adviser. investigation In excess of 66 this fuel samples throughout who QinetiQ, at division fuels the and Rolls-Royce, Boeing, from specialists and NTSB the AAIB, the telephoneagreedby conferences involving representatives from the of aspects many like the Boeingfueltestrig. of evolution the and made were that decisions the on background during experienced we that formally publishthemostlikelycauseofaccident. it was a further year before we felt that we had sufficient evidence to Investigation Branch determined the cause of the accident. In reality, available, it would only be a matter of days before the Air Accident data recorded of amount considerable a was there and intact, was aircraft the as that commentators various the between consensus general a be to seemed there and media news the from gleaned been had accident the of knowledge main my point, that to Up 116 Understanding Unusual Properties in Understanding UnusualProperties in Fuel SystemtotheAccumulation and For my group, the initial priority was the testing of the fuel. And During the next 20 minutes, I will highlight some of the problems • tasked with chairing the Fuel and Aircraft Fuel Systems Group. shortat Heathrow airport Ijoined the investigation and was everal days after the British Airways Boeing triple seven landed ISASI 2010 ISASI In ConductingTests toDetermine The Vulnerability of an Aircraft’s Society. tered Engineer, andmemberoftheRoyal Aeronautical an MScfrom Loughborough University, isaChar the Royal Air Force as an engineering officer. to joiningtheBranchin2004,hespent27years He has with theUKAirAccidents InvestigationBranch.Prior Brian McDermid is a senior inspector (engineering) By BrianMcDermid,Seniorinspector(Engineering),AirAccidentsInvestigationBranch Heathrow 777: Challenges in Proceedings Aviation Fuel and Problems investigation, the extent of the testing was was testing the of extent the investigation, the investigationthe giveandsomeyou Release ofIce - any type of fault finding, was difficultexposure to the whennoise was also very thistiring, and communication, and runway was used for the engines of aircraft waiting to line up on the runway. The constant aircraft, and it was impossible to 27 detect any leaks over the noise more fromthan 110 feet of fuel pipes. have to listen for and trace leaks inusto carry a out pressurefuel anddelivery vacuum tests systemduring which containingwe would toany part of the fuel system being disturbed. This would require detailed inspection and test of more a conduct theto decided was it back, roll aircraftengine double the for fuel delivery system prior wrong with the fuel remaining system had functioned correctly and there was onnothing apparently the aircraft. With no obviousthe causefuel samples, it quickly of testing and recorders, flight the on data becamethe of analysis aircraft, apparent that the engine control wrong with such an ideal site? From the initial examinationadministrative ofsupport thefrom our own staff. So what could possibly be ish Airways was also readily at hand, and there was excellent IT and office, toilets, and storage facilities. The proposed site seemed27 Runway of threshold to the to beadjacent area ideal.maintenance a Close by there was a to site accident goodthe from aircraft move the to made was decision sizea Mike wasmoreorlessinthemiddleofdistribution. 2007. As you can see, in terms of the distillation range, the fuel from accident flight with more than 1,200 batches of fuel sampled during normal range. QinetiQ undertook a comparison of the fuel on the with the industry standards, and the fuel was found to be within the susceptibletoicing. We compared the main hydrocarbon groups there was a specific combination that made thistains thousands of different hydrocarbons we batchcould not establish if of fuel more the from taken samples the paceofinvestigation. dictates extent, an to which, problems, large brings aircraft large a In order for the runway to be returned to full operational use, use, operational full to returned be to runway the for order In fuel the about unusual nothing identify could testing Extensive eft was adjacent to the area in which we were we which in area the to adjacent was Left aircraft, and as aviation turbine fuel con- fuel turbine aviation as and aircraft, Unfortunately the hold for Runway Engineering support from Brit-

workingon the

eft. Left. aircraft taking off. Whilst noise-abatement procedures are a sensi- might have caused the accident gradually took greater precedence tive issue at Heathrow, the investigator in charge negotiated with and Boeing identified two of their test facilities where they could the airport authorities for a 48- hour period during which Runway carryout some fuel system icing tests. 27 Left would only be used for landings. However, it still took more Small-scale fuel tests were carried out in a climatic chamber at than 24 hours for the operational changes to be instigated. the Boeing Kent facility to allow us to understand how ice forms in The large aircraft syndrome came into play again during the cold fuel. At the same time, Boeing assembled a large-scale fuel test inspection and testing of the aircraft fuel system. The fuel delivery rig at their North Boeing Field facility. Whilst it was not intended to pipes still contained fuel that could not be drained out. This meant replicate the fuel system on the aircraft, it did use 2-inch diameter that it was not possible to use the videoscopes that are normally used fuel pipes and components fitted to the Boeing triple seven aircraft in the aviation industry, as they are not safe to use in an explosive and the Trent 800 engine. Over time a number of changes were environment. We tried to blow the fuel out of the pipelines with made to the rig such that it became more complex and components nitrogen, but this was unsuccessful, and consequently there was a such as the engine driven low pressure fuel pump were fitted and further delay as we tried to find an explosive proof videoscope with hot oil was fed to the fuel oil heat exchanger. a probe at least 30 feet long. A suitable videoscope was eventually The tests carried out on the rig consistently proved that it was pos- hired from a company in Hamburg. Later in the investigation, we sible to restrict the fuel flow through a hot fuel oil heat exchanger discovered that the water industry use explosive proof videoscopes with a relatively small quantity of water, providing the water was to inspect sewers and one was used during an inspection of another introduced at a high enough concentration. 9, 2010 SEPT. THURSDAY, Boeing triple seven aircraft to determine where ice and water might However, we had less success in generating ice in other parts of accumulate in the fuel tanks. Nevertheless, the issue of cameras the fuel system, and even with identical conditions we experienced plagued us throughout this investigation and none of the parties in poor repeatability and the term “the randomness of ice” regularly the investigation could identify a suitable camera that we were happy cropped up in test reports and briefings. Consequently we began to use in the explosive environment of a wet fuel system. Instead we to question if the variations between the aircraft and fuel test rig, relied on still photographs taken from the videoscope. and the technical innovations used to try and maintain the water On the positive side, we were very thankful for an early decision concentration in cold fuel, might mask other subtle causal factors to accept the offer from Boeing for one of their videoscope opera- with the risk that we might inadvertently engineer a restriction that tors to be flown over from Seattle. He was not only familiar with could not occur in flight. inspecting the inside of the fuel delivery system, but he also had It is worth stating that there was tremendous support from within a great ability to tease the probe around the many contours and the aviation industry, and whilst Boeing was running the tests on corners in the long pipe runs. their fuel rig we explored the problems of ice forming in aircraft The extensive testing and examination of the aircraft fuel system fuel systems with other aircraft manufacturers, universities, and could not identify a fault that would have caused the engines to roll research organizations. Information was also freely exchanged back. Therefore, many of the fuel system components were removed between Airbus and Boeing, which both use the Trent engine on and in most cases sent to the original equipment manufacturer their aircraft. As investigators, we go to great lengths to protect pro- for further inspection and testing under the supervision of one of prietary information, and therefore it was a new experience to be in our inspectors. We also made the decision to assemble the left side of the engine and aircraft fuel delivery system removed from the accident aircraft in one of our hangars at Farnborough. This reconstruction proved to be invaluable and was the first time that most people involved in the investigation had actually seen a large aircraft fuel system laid out. The reconstruction was also useful in identifying potential scenarios and subsequently helped us in defining the boundaries and factors that we wished to be included in the Boeing fuel test rig. It was also necessary during the investigation to construct a fluid dynamic model of the fuel feed system, and again the reconstruction proved to be very useful as pipe dimensions and gradients could be taken directly from the reconstruction. Whilst the work on the aircraft was still ongoing, representatives from all the parties in the investigation met in Seattle to develop possible scenarios and provide technical support for the fieldwork. As various causes were eliminated, the possibility that ice in the fuel Figure 1. The crystal structure of water ice at different temperatures.

ISASI 2010 Proceedings • 117 ISASI 2010 PROCEEDINGS 118 extremely was temperature fuel the when components to adhere to ice for difficult was it that that knew we review documentation low temperatures were likely to be encountered.Boeingtriple seven shouldHowever not beused onroutes fromwhere extremeour AirAccident Investigation Branch that as an interim measure the factor, and there were suggestions from certain quarters outside significant the possible a being as flight accident the on experienced fuel test rig was representative of the ice that is generated in flight. could not be totally sure that the type of ice that we generated on the lack of knowledge was a concern toan industry we usappear to know relatively duringlittle about ice in fuel. theThis investigation as we of ice, but instead I just want to leave you with the message formation the about you to talking day the of rest thatthe spend could as icecrystals cannot negotiate corners aseasily assmaller crystals. I number and type of nuclei. the water droplets, the rate of cooling, amount of agitation, and the and perhaps the type, of the ice is crystals dependent on the size of icing, the more we began to understand how complex it is. The size, in aviationfuel? industry, could provide us with anything like this for ice that forms aviation,theInternet,websitefuelintheing oneor on no and you be surprised if I told you that this was taken from Woulda snow board- ice. the of properties the at guess a hazard and structures think I and temperatures, documentation waseventuallyreleasedtotheinvestigation. requirement. Despite this difficulty, some testmilitary reportsa andmeet supporting to out carried been had testing the as seven triple Boeing the to fitted valve spar the for reports test obtaining in culty diffi- had also we But organisations. military foreign with problem difficult obtain to copies their of test reports. particular a This is research military organisations have carried out, and it is even more what establish to difficult extremely is it However,inhibitor. icing that resulted in the development and introduction programme research extensive an initiated Force Air States United of a fuel system the finding, this of result a As filters. fuel engine the in and system Despite the aircraft catching fire, ice was found throughout the fuel freezing. below was temperature ambient the where Dakota South on a B-52 lost power during the approach and the aircraft crashed in any evidence. That was until 1958 when on a cold day, all eight engines fuel system, but given the perishable nature of ice they could not find number of accidents the symptomratherthanrootcause. as fuel heaters and filter bypasses were introduced, which addressed did not appear to have been taken Instead forward. measures such recommendations the icing, fuel of cause root the understand to papers frequently recommended that further research was required lems such as blocked inlet screens and fuel filters. Whilst these early 1950s and that some research had been carried out to address prob- that fuel icing was a Pratt andWhitney. and GE, Rolls-Royce, with arranged Boeing that meeting similar a they may or may not be susceptible to icing. We were also present at described how their fuel systems were designed and discussed how the same room with two of the major aircraft manufacturers as they Thedata mining group activity identified the low temperatures The more we delved into the early research papers on fuel system different at ice water of structure crystal the shows 1 Figure the 1950s the During Documentation searches were also carried out, and we discovered • ISASI 2010 ISASI Proceedings known problem on civil aircraft in the 1940s and involving B-52 aircraft were caused by ice in the nited States Air Force suspected that a a that suspected Force Air States United Large water droplets settle quickly; larger mostyouofcanlook someat theseof suspended water, cloudy. andice,isvery use cameras to detect the accumulation of ice as cold fuel containing not Wecould help. also little of been have would instrumentation on the fuel pressure and temperature, so pressure and temperature to be blocked by ice. A lesser amount of ice would have little effect wouldrequire around 97% of the cross sectional area of the pipe ice was forming as the roll-back experienced on the accident flight of the test flights. There was also the difficulty in establishing when event there was a real possibility that it might not occur during any as a fuel flow restriction caused by a blockage of ice was such a rare external environment; we weren’t sure what we were looking for and the control to unable been have would we recorders; and sensors with modified be to need might that aircraft suitable a needed we Firstly path. this down going from us swayed that disadvantages of its normal operating environment. There were, however, a number port. The main advantage is that you test the actual aircraft systems in that something was testing ofthefuelsysteminanenvironmentaltestrig. chamber,and climatic a in aircraft an of testing scale full testing; flight included options These flight. accident the during ronment and more accurately replicate the aircraft installation and the envi - mask some subtle factor, a Delta aircraftinNovember2008. a on engines the of one on occurred that back roll the from data was a coincidence, rather than a causal factor, until we analysed the that the very low fuel temperature experienced on the accident flight the sticky range of ice, we could not say with any great confidenceappear to contradict each other. Whilst we had some knowledge of thesetemperature bands arenot well defined and several that papersyou warning by information this caveat should I though fuel, aviation in ice water about know we facts the of some summarises peraturewasbetween -8and -20 degrees Celsius. Theslide tem- abovefuel the when accumulate to likely most was ice that and low experienced during the accident flight for an unlimited period. We haveallowed us to expose the aircraft would facility The to the testing. totalof days air10 around temperature us given have would is heavily utilised and there was only a 3-week window available, which ing of a Boeing triple seven aircraft. The downside was that the facility was identified as a suitable facility in which to conduct full scale test- The Flight testing initially appeared to be the most obvious choice and might rig test fuel Boeing the that concern increasing our With McKinley climatic chamber at Boeing and Rolls-Royce were prepared to sup- to prepared were Rolls-Royce and Boeing number of options were explored to try number of options were explored to try Eglin Air Force Base in Florida could have used the aircraft boost pumps to pump fuel from the The results from the environmental testing were very consistent, main tanks to the engine where the fuel would be tapped of to a and the final test proved the theory that ice can build up in the collector tank. Alternatively, we could have run one of the engines pipes and then release in a sufficient quantity to restrict the fuel at cruise power for one hour at the fuel flow experienced during flow through the fuel oil heat exchanger. the accident flight.U nfortunately, like the flight testing option, we This has been a very quick overview of the fuel systems aspect would still have the problems of aircraft availability, matching all the of the Mike Mike investigation. However, I hope that you do not environmental factors, and the detection of the formation of ice. fall into the trap of believing that it was a fault in either the fuel oil Testing the fuel system in an environmental fuel rig appeared to heat exchanger or the aircraft fuel system that was the cause of the be the only viable option remaining, and we discussed our desired accident to the British Airways Boeing triple seven. Modification of requirement for a single pass test of sections of the aircraft fuel system the FOHE will make the system more tolerant of ice, but it will not with a number of agencies. Single pass testing is where fresh condi- prevent ice accretion and release within the fuel feed system. The tioned fuel is pumped from a supply tank through the test section problem of fuel system icing was identified in the 1940s and 1950s and into a collector tank. For a large aircraft system this requires a and recommendations were made on a number of occasions that considerable quantity of fresh fuel that needs to be stored and cooled further research was required to fully understand the extent of the down to the required temperature. By recirculating the fuel, it is pos- problem. However research to establish the root cause of fuel system sible to use a smaller quantity of fuel and therefore smaller storage icing does not appear to have been carried out, and instead a number tanks. However, a disadvantage of a recirculating test rig is that it of measures such as the introduction of fuel heaters and bypasses 9, 2010 SEPT. THURSDAY, effectively dries the fuel out, and we were concerned that introducing were introduced to fix specific problems. But as we have seen, these additional water to maintain the required concentration might give measures only store up problems for the future, and we do not know us unrepresentative results. Unfortunately, there are few facilities that what combination of aircraft, engine, and environmental factors will could carry out single pass testing on the scale required. result in the next fuel icing accident. It is for this reason that the we In the end we had to accept the limitations of a recirculating test believe that it is important that the regulative authorities instigate a rig in order to achieve the desired long endurance runs, which were number of coherent research programmes into fuel system icing in necessary to establish if ice would accumulate along the inside of order to underpin the future design and certification requirements the fuel delivery pipes. We were fortunate in that Boeing had a suit- for commercial aircraft. able fuel tank available in which we could mount the fuel delivery That concludes this presentation. Hopefully I have given you a pipes removed from the right main fuel tank of Mike Mike. These feel for the problems we encountered and the close cooperation fuel pipes were fed from a supply tank that had been cooled and among ourselves, Boeing, and Rolls-Royce. And of course not forget- conditioned with water to represent the condition of the fuel during ting the support we were given by a large number of organisations the accident flight. and individuals within our industry. ◆

ISASI 2010 Proceedings • 119 ISASI 2010 PROCEEDINGS 120 Air by operated F-GZCP registered 203 Sunday On Introduction theB from all over the world are closely supporting lenging endeavour. A wide rangeian), etc. No efforts were spared in this chal- of specialists vehicles, AWACS, satellites (military and civil- (deepwater and nuclear), remotely operatedsonars (autonomous and towed), scan side hydrophones, underwater means: submarines of range wide a from coming data of types searchanalyzedteamspaigns.Theseveral cam- search sea the managing and paring pre- from gained been has that experience the estimatedaccidentzone. also affected the modelling of the currents in short distances. The proximity to the theunderwater terrain was equatorrough, with great variations in depth over were above the Atlantic ridge close to the equator. This implied that The environment was also very unfavourable since the search zones absence of an emergency distress message, and the lack of radar data. the zone, the absence of any trace of the accident in the first days, the wreckage overavastareaoftheAtlanticOcean. underwaterseasearch campaigns wereundertaken locateto the Rio de Janeiro (Brazil) and Paris-Charles de Gaulle (France). Several istered F-GZCP, disappeared over the ocean while en route between On June 1, 2009, Air France Flight AF447, an Airbus A330-200 reg- Abstract and acertifieddiver. the French NationalCivilAviation School(ENAC).Heisalsoapilot Alain Bouillard Photoand determine thecausesofthisaccident. to better understand the circumstances and thewreckage and the flight recorders so as This paper aims to share the wealth of of wealth the share to aims paper This These searches faced several difficulties such as the remoteness of livier Ferrante, Head of Recovery Group,BEA,France By AlainBouillard,HeadofSafetyInvestigations,andOlivierFerrante,Recovery • E ISASI 2010 ISASI A withA thesame objective offinding Lessons and Recommendations ay 31, 2009, the Airbus A330- Airbus the 2009, 31, May Undersea Search Operations: holds amaster’sdegree inaviationengineeringfrom Commercial Aviation SafetyTeam Olivier (CAST). FAA cooperation agreement. He also worked with the on datasharingandriskmodellingunderaBEA- was seconded to the FAA in 2006 and 2007 to work 2000 as the head of the Safety Analysis Division. He Olivier Ferrante, topicpresenter, joinedtheBEAin Proceedings bio notavailable From Flight447 Figure 1.AF447trajectory. -030.59° (west). This point is also called the last known position position known last the called also is point This (west). -030.59° longitude and (north) +2.98° latitude were received coordinates on transmitted was message) type tional system. ACARS the via minutes TASIL point.Therewasnofurthercontactwiththecrew. controllerasked the crew three times for its estimated time at the answer. not did TASIthe crew the The at point. Afterwards, time L controller asked them to maintain also transmitted F their SELCAL code and a test was The performed. estimated times: SALPU at 1 h 48 min then following the announced then point INTOL the passed had they theATLANTICO ATC centreonHFat1h33. • FL350, and the • theBRASILIAATC centreat22h55, • at 22h45, the • RIODEJANEIROapproachcontrol, • 29. Thecrewcontacted,successively h 22 at off took airplane The board. on were passengers 216 and TwelveGaulle. de crewmembers Charles Paris and Galeão Janeiro Francewas scheduled toundertake Flight AF447 between Rio de The airplane was configured to send position 10 messages every controller that that controller AT LANTICO the informed crew the 35, h 1 At RECIFE CURITIBA ATC ATC centre centre, at 23 which The last position message (opera - message position last The h 19, L 350 and to give their estimated cleared the June 1 at 2 h 10. The last last The 10. h 2 at 1 June airplane ORAR at 2 h 00. They it to climb being

to stable FL350 at

locator beacon, it was decided to prioritise an acoustic search initially, though taking into account the limited range of the beacon transmitters, which is about 2 km at most. The propagation of acoustic waves in a liquid medium, which depends on many interdependent parameters such as the salinity and the temperature of the water, must also be taken into account. When an acoustic wave is propagated in the sea, it can be subjected to refractions and this generates multiple trajectories. The acoustic waves may also be deflected in such a way that there is a “shadow” region that is never reached by these waves. Acoustic searches using beacons that transmit at 37.5 KHz (± 1 KHz) are in general more effective than searches using sonar, mag- netometers, and video cameras. Nevertheless, the duration of the beacon transmission is limited, being certified for a minimum transmission duration of 30 days from immersion. This short timeframe implied a race against time to select, contract and send search assets to the middle of the Atlantic. The BEA contacted the manufacturer of the beacons, which stated that the duration of transmission was 9, 2010 SEPT. THURSDAY, Figure 2. Adapting the search means to the depth. of the order of 40 days. This is why the search using hydrophones ended on July 10, 2010 (later called phase 1). (LKP). In addition to this operational message, 24 maintenance Taking into account the range of the beacon transmissions, the messages were received on June 1 between 2 h 10 and 2 h 15. Their hydrophones had to be brought closer to the source of any transmis- analysis suggests that the airplane probably did not fly for more than sion, by towing specialized equipment near the seabed. another 5 minutes. This means a likely maximum distance of less In relation to towed acoustic devices, the BEA approached the U.S. than 40 nm. The accident site is thus probably located within a circle Navy. The latter has two towed pinger locator (TPL) hydrophones with a radius of 40 nm centred on the last known position. and uses them regularly to search for civil or military aircraft crashed at sea. The U.S. Navy TPLs can operate at up to a depth of 6,000 m. Surface search They operate on a waveband between 5 and 60 KHz, which includes A massive international search and recovery effort was undertaken the frequency transmitted by the underwater locator beacons. To after the disappearance of Flight AF447. The Brazilian and French optimize the use of this equipment, the BEA chartered two available armed forces mobilized search and rescue vessels and aircraft. The ships from the Dutch subsidiary of Louis-Dreyfus Armateurs. These United States also participated and several merchant vessels joined two tugs were the Fairmount Expedition and the Fairmount Glacier. the search, which was coordinated by the Recife MRCC, the airplane having disappeared in its zone of SAR responsibility. Deploying side scan sonars The surface searches focused on possible transmissions from ELT At the end of 31 days of acoustic searches in phase 1, no signals had beacons1 and the localisation of floating debris. This led to the recov- been detected from the flight recorders’UL Bs, and no parts of the ery of bodies and parts of the airplane from June 6, 2009, onward. wreckage of F-GZCP could be located after underwater observations of the seabed. Side scan sonars represented the best-adapted search Difficulty of the searches means in the absence of any beacon transmissions. The first difficulty is the remoteness of the zone, which requires tran- sits of the order of 2 to 4 days from ports such as Praia (Cape Verde), Operating principle Natal (Brazil), or Dakar (Senegal). The absence of any trace of the A side scan sonar is designed to produce detailed acoustic images accident in the first days and the absence of an emergency distress of the seabed. A narrow acoustic beam is transmitted at a low angle message or radar data complicated the searches. The environment is (see Figure 3). It illuminates the seabed over a narrow strip. Within also very unfavourable since the search zones are above the Atlantic ridge close to the equator. This implies that the underwater terrain is rough, with great variations in depth over short distances. The proximity to the equator affects the modelling of the currents in the estimated accident zone. The lack of available on-the-spot data and the complex oceanic dynamic (notably due to the seasonal start of the north-equatorial counter-current during the month of June) also made it difficult to model the marine currents. These factors contributed to making the reverse-drift calculations imprecise, added to which it was necessary to make them over a period of 5 to 6 days, which accentuated the gaps.

From Searching with hydrophones to using side scan sonars Searching with towed hydrophones Figure 3. Towed side scan sonar towed at 70 m above the seabed As the aircraft’s recorders were each equipped with an underwater and having a swath of 1,500 m.

ISASI 2010 Proceedings • 121 ISASI 2010 PROCEEDINGS 122 Figure 5.Bathymetryofthesearch area. portion a intercept will elevation enough with obstacle An effect. interesting an has also seabed the on “shadows” of formation The hard sediments will reflect (backscatter) more than soft sediments. Backscattering depends on the composition of the seabed. Rocks or Backscattered images image” oftheseabedisbuiltup. as the sonar moves forward. This is how, line after line, an “acoustic through its high resolution signal, this by detected are capacity.which obstacles, small or anomalies of This signal is laterally recorded swath. This backscattered data enables visualisation of the presence itsalong seabedbackscatteredthe represents sonarofaimage sweepson both sides of this whole zone, called that aswath. area” “acoustic an Thus, delineates signal the transmitted the range, its Figure 4.Underwatersonarimage. • ISASI 2010 ISASI Proceedings n the and Ventôse, nm (around72km). able assetduringthesonarsearch. acoustic images. The geologists in the search team were a very valu- Pas? developed a methodology based on the analysis of the various multibeam echosounder. The IFREMER team on board the kHz24acoustic images theofseabed thanks itstohull-mounted position (see Figure 5). The survey of the zone within a circle of 40 nm centred on the last known the topography of the area and carried outgraphical and a complete bathymetric ROV andtheNautilesubmarine. its multibeam echosounder, the towed sonar array, the Victor 6000 mission to deep undersea sites, the Pourquoi Pas? ship in Dakar during its port call. For this exploratory backscattered images. been searching for man-made objects that appear as anomalies on sonar (mounted on towed or autonomous vehicles),terrain. underwater similar with analystsimage this resemble could have parable to that of a B-52. The wreckage of the disappeared AirbusORIN towed side scan sonar. The size of the Airbus A330 is com- the with localized was that and 2008 July in Guam off crashed that presence of the wreckage of a crashed airplane.an acoustic image of the It seabed (depth representsof approx 3,600 m) with a the B-52 seabed such as wreckage. The following image (see Figure 4) shows shape. This specificity is useful very in the search for objects on the and size its assess to enable will analysis Careful object. the of that with associated shape a with shadows some contain will image the that mean will This angles. given at and times some at scattering of the transmitted beams, and therefore prevent some seabed back- of 17,000 km 17,000 of order the of zone search a accident, the after days few first the In a signal for a notional period of at least thirty days when immersed. transmit to designed beacon a with equipped being recorder each (ULB), beacons locator underwater the by transmitted signals Thefirst phase involved the search for the flight recorders viaPhase 1:June10–July10,2009(onsite) the involved numerouscomplexoperations. fromall over the world. The contractual and the financial aspects The various search phases involved Summary ofthevarioussearchphases several specialized organizations made available a team of specialists and technical equipment. made availableateamofspecialistsandtechnicalequipment. equipment • after theaccidenttoensuremobilisationof immediately framework legal formal appropriate an establishing and the two tugs from Fairmount ships • urgency ofthiscommitment. public works contract regulations, taking into account the overriding contract signed by the BEA within the context of article 35-II of the Fairmount Marine. company Dutch the with signed was that law Dutch under lished estab- contract a of terms the under BEA the by 5 June as early as The French Navy deployed two ships, During this mission, a detachment of the French Navy Hydro- Navy French the of detachment a mission, this During For phase 2, the IFREMER towed sonar array was installed on the The B to EA chartered three ships (the tow

was defined within a circle with a radius of about 40 40 about of radius a with circle a within defined was the Oceanographic Service (SH OM) completed data on from Emeraude U.S. IFREMER Navy’s nuclearsubmarine. The Pourquoi Pas? also acquired 12 kHz and acoustic in Marine). This operation required Pourquoi Pas? was equipped with the systems. Pourquoi Pourquoi Pas? from R IFREME context BPC Mistral and the frigate These of a were U procurement nitedStates chartered Pourquoi Pourquoi sing Using

companies selected, Seabed AS and Phoenix International Inc., in accordance with maritime practices. • two service contracts, respectively under Norwegian and U.S. law, with these two companies. • an amendment to an intergovernmental agreement in order to be able to pay for services provided through the U.S. Navy. The above services were financed thanks to a fund set up with Airbus and Air France, who each provided $6.5 M. In February 2010, the BEA chartered two ships with the most high-technology equipment on board that could operate down to depths of 6,000 m: • The American ship Anne Candies from Phoenix International equipped with an ORION deep towed sonar and a CURV 21 remotely operated vehicle (ROV) belonging to the U.S. Navy. • the Norwegian ship Seabed Worker from the Seabed AS company equipped with one Triton XLX 4000 remotely operated vehicle

(ROV) and three REMUS 6000 autonomous underwater vehicles 9, 2010 SEPT. THURSDAY, (AUV) operated by the American Woods Hole Oceanographic Institution (WHOI), of which two belonged to the Waitts Institute for Discovery (WID) and one to GEOMAR, the German oceanographic institute. Figure 6. Zones covered during phases 1 and 2. Phase 3: April 2–May 24, 2010 Phase 2: July 27–Aug. 17, 2009 (on site) 1st period: from April 2-25, 2010 (on site) The objective of the second phase was to search for the airplane The ships left the port of Recife (Brazil) on March 29and the sea wreckage with the aid of towed sonar and Victor 6000 and Nautile searches took place from April 2-25, 2010, which was when the ships underwater vehicles. This phase was concentrated on the squaring left the search zone. They arrived in the port of Recife on April 28, line (J-M 24), which had not been explored because of a lack of time. 2010, for a port call. At the end of this first period, an area of around The bathymetry of the zone, consisting of a plain and slight slopes, 4,500 km had been explored. was compatible with the use of the IFREMER towed sonar. An area of 1,230 km was covered during phase 2, completed by reconnaissance 2nd period: from May 3-24, 2010 (on site) dives. None of the detections corresponded to airplane debris. In order to take advantage of the means already mobilized for this The first two phases cost the BEA an estimated 10 million Euros. operation, it was decided to extend the searches. Since the U.S. This does not include the millions spent by the Brazilian and French Navy ROV and sonar, installed on board the Anne Candies, were no armies in the immediate aftermath of the accident.

Preparation of phase 3: September 2009–January 2010 During phase 1, scientists were brought together in the context of a “Drift Committee” working group. The objective was to estimate a search zone based on calculations of the drift of the bodies and airplane parts that had been recovered. To prepare phase 3 of the sea searches, the BEA enlarged this working group with international partners, in order to identify the possibility of improving the reverse drift calculations. The group was made up of representatives from the following scientific organisations: CNRS/Brest, University of Massachusetts/ Dartmouth, INMRAS/Moscow, Mercator Océan/Toulouse, CLS/ Toulouse, WHOI/Woods Hole, IMT/Toulouse, SHOM/Brest, NOC/ Southampton, IFREMER/Brest and Météo-France/Toulouse. During the preparatory work, analysis of the data from the previous phases and modelling of the structures of the sea currents made it possible to estimate the drift of the airplane debris between the date of the accident on June 1, and the time of recovery from June 6 onward. This work led to a significant reduction in the area of the zone, which was thus reduced from almost 17,000 km to around 2,000 km (see initial zone on Figure 7). In January 2010, an international call for tenders made it possible to select candidates and offers from international operators. This required a complex legal framework that included • a charter contract under U.S. law between the BEA and the two Figure 7. Areas covered during phase 3.

ISASI 2010 Proceedings • 123 ISASI 2010 PROCEEDINGS 124 fortunate tobenefitfromtheassistanceofinternationalgroup subsequent phases when time was less of a factor. The BEA has been ting, it became a very complex operation for the preparation of the against time to operate the TPLs while the beacons were still transmit- eration (Brazil, France, the the Rio-Paris flight have required wide-ranging international coop- of enigma the solve and wreckage the find to efforts search These Conclusions two RemusoperatedbyWHOI. the sea search operations continued with the operation, scientific a in participate to had Remus GEOMAR the and operation, military American an of result a as available longer last last known airplane position. This was explored from water locatorbeacon(ULB)duringpostanalysisofthedata. tion of acoustic signatures similar to those transmitted by an under searches: a zone was defined based on the French Navy’s identifica- the first phase of the searches. The BEA thus decided to extend its June 30 and July 1, 2009, by the on the results of analytical work carried out on the data recorded on airplane wreckage. April 2 and by theFrenchNavy. the zone of around 300 km² defined on the basis of the data provided second period, an area of almost 1,800 km was explored, including searcharea tosail totheport ofPraia (Cabo Verde). During this searches in zones from The area. search original the to return ing optimal coverage of the whole of the zone, the BEA decided to without any success in localising the airplane wreckage. After ensur On The In total, an area of nearly 6,300 nearly of area an total, In • May 6, the French ISASI 2010 ISASI Seabed Worker then sailed to an area located south-west of the M ay 24, 2010, but without having been able to find the Proceedings May 13-24, which was when the ship left the inistry Ministry of Defence provided information USA, Norway, and others). From a race Emeraude nuclear submarine, during km was thus explored between between explored thus was km continued its its continued Worker Seabed Seabed Worker and the M ay ay 7-12, 2010, - - decisions aboutthefourthcampaignofseasearches.◆ areassearched.beto Thiswillhelpfulbe making in appropriate assessed. The objective here is to produce a probability(wreckage mapsearch). of theThe performance ofeach sensor isalso being 3 and 2 phase and search) (pinger 1 phase of results the as well as efforts included air, satellite, cident andas well as the surfaceresults of the unsuccessful search searchesefforts. These for floating debris should beeasiertoinvestigate. sea at accidents future that so ICAO by board on taken been have further,carry more quicklyfromthesurface. equipment is designed to detect these low-frequency signals, which much easier to detect it the wreckage. made The have French and would foreign kHz) military 9.5 and 8.5 between example (for cies the coast. The utilisation of beacons transmitting at lower frequen- depths greater than 1,500 m, abovethat specificall when equipment, the notwreckage very widely is available, far frommust be used for The • drift betterfromtheearliesthours. arrive over the zone would have made it possible to understand the The • beacons inthisvastzone. days would have made it possible to prolong the search for the The • calisation ofthewreckage: lo- the facilitate to order in n°2) Report Interim in presented are in ordertoensurethatitselectedthebestmeansavailable. 1 Endnotes

tion EL automatic activation Theairplane was equipped with three emergency locator transmitters (one A has been reviewing all the data gathered since the ac- the since gathered data the all reviewing been has BEA The recommendations safety BEA other and feedback this of Some The negative search results triggered some lessons learned (which

dropping 37.5 utilisation T wasrecovered.ItsswitchfoundtobeintheOFFposition.

kHz

ULB of

of EL drift-measurement

ULB T and two manual activation

beacons

have

capable

limited buoys

of EL by

range,

transmitting Ts). the One manual activa- first

which aircraft

means for B ULB

90 to

Colgan Air Flight 3407: Achieving The Delicate Balance Between Timely And Thorough While Staying True To the Investigative Process By Lorenda Ward, Senior Investigator-In-Charge, United States National Transportation Safety Board

Lorenda Ward has worked for the National Transpor- on the day of the accident. The crew’s first two flights of the day tation Safety Board (NTSB) since 1998. In addition to were cancelled because of high winds at the airport. The planned 9, 2010 SEPT. THURSDAY, the Colgan Air investigation, she was the investigator- departure time for Flight 3407 was 7:45 p.m. with a planned arrival in-charge for the Edelweiss uncontained engine failure time of 10:21 p.m. in Miami, Fla.; the Era S76A++ helicopter crash The captain was the pilot flying, and the intended cruise altitude in the Gulf of Mexico; the Executive Airlines ATR was 16,000 feet. During the ascent to 16,000 feet, all de-ice systems 72 crash in San Juan, Puerto Rico; the Air Midwest were selected on, including the icing reference speed switch, and Flight 5481 crash in Charlotte, N.C.; the Pinnacle Airlines CL-600 2B- stayed on throughout the flight. About 40 minutes into the flight, 19 accident in Jefferson City, Mo.; the Cirrus SR20 accident in Manhat- the crew began the descent portion of the flight. tan, N.Y.; and the ABX Air B-767 ground fire in San Francisco, Calif. About 9:54 p.m. the first officer briefed the airspeeds for land- She has acted as an accredited representative to numerous foreign ac- ing with flaps at 15 degrees as 118 knots (reference landing speed) cident and incident investigations. She worked six major water recovery and 114 knots (go-around speed). The first officer had obtained accidents, along with numerous mid-air collisions and inflight breakups. the landing airspeeds for non-icing conditions. She did not enter She supported the Federal Bureau of Investigation at both the Pentagon the keywords that would indicate the flight was in icing conditions; and the World Trade Center after the terrorists’ attacks. Before coming to therefore, the landing speed of 118 knots that was set by the flight the NTSB she worked for the U.S. Navy as an aerospace engineer on the crew was 13 knots below the actual stick shaker activation speed of EA-6B and F-14 programs. She received her bachelor degree and master 131 knots, which was applicable with the reference speed switch of aerospace engineering degree from Auburn University. activated. About 10:10 p.m. the flight crew discussed the build-up of ice Abstract on the windshield. A few minutes later, the flight was cleared to In keeping with the International Society of Air Safety Investigators 2,300 feet. About 10:14 p.m., the airplane reached 2,300 feet and theme for this year’s conference, “Investigating ASIA in Mind— maintained this altitude for about 2 minutes before the stick shaker Accurate, Speedy, Independent, and Authentic,” this paper will activated. convey the author’s ASIA experience on the Colgan Air accident During this time, power was reduced to near flight idle, the investigation. The investigation identified numerous safety issues, altitude hold mode was active, airspeed slowed down from about which resulted in 25 safety recommendations to the Federal Aviation 180 to about 130 knots, and pitch increased from 3 to 10 degrees. Administration (FAA) that focused on operations and human per- About 10:16 p.m. the crew lowered the landing gear. About 20 formance. This paper discusses the challenges and decision-making seconds later, per the captain’s request, the first officer moved the process followed in order to complete the Colgan Air investigation flaps from 5 to 10 degrees. within one year without compromising thoroughness and quality. When the airplane reached 131 knots, the stick shaker activated On Feb. 12, 2009, about 10:17 p.m. Eastern Standard Time,1 a and the autopilot disengaged. A review of performance data indi- Colgan Air, Bombardier DHC-8-400, N200WQ, operating as Conti- cated that the airplane was not close to an actual stall because the nental Connection Flight 3407, experienced a loss of control on an airplane had minimum ice accretion, but the flight crew was unaware instrument approach to the Buffalo-Niagara International Airport, of that fact. The captain reacted to the stick shaker by pulling back on Buffalo, N.Y., and crashed into a residence in Clarence Center, N.Y., the control column and applying less than the fully rated power. The about 5 nautical miles northeast of the airport. captain’s aggressive pulling back on the control column increased The 2 pilots, 2 flight attendants, and 45 passengers aboard the the angle-of-attack, pitch, and load factor, causing the airplane to airplane were killed, one person on the ground was killed, and the enter an accelerated stall. airplane was destroyed by impact forces and a post-crash fire. The This action was accompanied by a pitch-up motion, and a left roll, flight was operating under the provisions of 14 Code of Federal followed by a right roll, during which the stick pusher activated and Regulations Part 121 as a scheduled passenger flight from Liberty the flaps retracted. The airspeed decreased, and, after further pitch International Airport, Newark, N.J., to Buffalo. Night visual meteo- and roll excursions, the airplane pitched down, entering a steep rological conditions prevailed at the time of the accident. descent from which it did not recover. The flight crew was scheduled to report for duty at 1:30 p.m. During the stall sequence, the stick pusher fired three times to

ISASI 2010 Proceedings • 125 ISASI 2010 PROCEEDINGS 126 transported toastoragefacilityinDelaware. dent flight, airplane, and crew. acci- the to related records collecting and interviews, conducting of data,andtheFDRhad250parameters. hours 2 had CVR Washington,The in D.C. headquarters NTSB to recorder (FDR) were recovered the firstthe next daymorning. The cockpit onvoice recorder scene(CVR) and flight and data sent back of a Board member and 17 NTSB staff members was launched early the accident about 10:30 p.m. on Feb. 12, 2009. A go-team consisting temperature wasminus7degreesC. moderate rime icing at 5,000 feet, 10 miles southeast of Buffalo. The cident was at 6:15 p.m., when an Airbus- ac the before PIREP last 319The area. pilotBuffalo the in icing reportedrime light light to feet, andtemperatureof1degreeCelsius. 2,100 at overcast ceiling feet, 1,100 at clouds few a mist, and snow light in miles 3 visibility knots, 14 at degrees 250 from winds cated recovery. erbatedthe airplane’s stalled condition and prevented a potential captain continued to pull back on the control column, which exac- decreaseangle-of-attack.the However,activation, eachafter the Air, ALPA, andBombardier. and engineering. Parties to the public hearing were the FAA, Colgan research of director the and safety aviation of NTSB’sdirector the with Transportationalong the Canada, and of (TSB) Board Safety fatiguemanagement. • and flightcrewtrainingandperformance, • sterilecockpit, • coldweatheroperations, • airplaneperformance, • were swornintodiscussthefollowing: Association (ALPA), and the Federal Aviation Administration (FAA) Air,Colgan (NASA), Administration Space and Air the Aeronautics National Bombardier,the from witnesses 20 hearing, ways toimprovepilothiring,training,andtestingatallairlines. hearings, the FAA administrator issued a “Call to Action” to address spokesman for the families of the passengers. Shortly after the June FAA industry,the administrator,a aviation by and the of members mony to the Senate and House in mid-June. Testimony was also given Air investigation. Then-Chairman Representatives held hearings on issues stemming from the Colgan hours, with 1,030 as pilot-in-command and 110.7 in the Dash 8. In the 3,379 of time flight total a had He crash. the before months few a only 2008, November in 8 Dash the in rating type his received had captain The experts. performance NTSB’shuman and operations programs. safety FAA’s the strengthens and obtain, to easier records pilot increases pilot bill training requirements, This addresses pilot Congress. fatigue, makes to introduced was 2009 of Act Improvement enbanc interviewscompletedand documentation preparationin thefor During wreckage, the documenting days 8 for scene on was team The The National Transportation Safety Board (NTSB) was notified of of (PIREPS) reports pilot been had there day the Throughout At the time of the accident, the weather observed at Buffalo indi- After the public hearing, both the The technical panel was comprised of investigators from the NTSB O The flight crew’s experience and training was examined by the the by examined was training and crew’s experience flight The • n July 29, 2009, HR3371: Airline Safety and Pilot TrainingPilotand SafetyAirlineHR3371: 2009, 29, July n ISASI 2010 ISASI 2 public hearing that was held M arch and April, the team conducted more than 30conducted thanteammoreApril,the and arch Proceedings On the eight day, the wreckage was Mark V. Rosenker provided testi- U.S. Senate and M ay 12-14, 2009. During the U.S. House of ine Pilots Pilots Line Dash 8 in 56 hoursinthelast30daysand167days. 90 days preceding the accident, he had flown 116 hours, including crewmember fatigue that reiterated the company’s fatigue policy and management. Colgan Air did not provide specific guidance to its pilots on fatigue school. ground indoctrination basic the in covered was that place and receivingtextmessagesthroughout thedayofaccident. officer commuted to Newark on ancomputer system at 3:00 a.m. and at 7:30 a.m. In addition, the first overnight flight and was sendingthe accident, the captain logged into Colgan Air’s crew scheduling Theinvestigationrevealed that, onthedayof crew’s performance. expected toflightcontrolinputsthroughouttheaccident flight.) wasminorandtheairplanecontinuedtorespond as performance the airplane prior to the initial upset event, but its effect on aircraft investigation did reveal that ice accumulation was likely present on vated and while the crew was executing the approach checklist. (The training that occurred just a few minutes before the stick shaker acti- and conditions icing in crew’sexperience the regarding versation should have been in effect. For example, there was a 3-minute con- theaccident flightcrew members when sterile cockpit procedures The CVR transcript documents non-essential conversation between impacted the pilots’ situational awareness of the decreasing airspeed. time oftheaccident. are scheduled to work. This statement was they not in the Handbook at the day same the on base their to commute to attempt not should members flightcrew that stated Handbook the of edition pilot is expected to report for duty in a timely manner.” A previous member Policy Handbook. The Handbook stated that “a commuting than 1,000 miles away. mutegreater thanmiles,400thoseofpilotswith 29 living more com- a had pilots Forty-nine commuters. as themselves identified a.m. thedayofaccidentflight. flight before the accident. She did not arrive into Newark until 6:23 ficer had commuted from the Seattle, Wash., area on an overnight Tampa, Florida area a few days before the accident, and the first of- outside of the Newark vicinity. The captain had commuted from the the pilots’ performance. Both pilots were based in Newark but lived place asrecommendedintheSAFO06015. in program training remedial a have not did Air Colgan accident, with persistent performance deficiencies. In fact, voluntary implementation of remedial attraining programs for the pilots time of the O for Alert Safety FAA’s2006 the with complied had Air Colgan if verify to able not was Air Colgan for (POI) inspector operator pal princi- testimony, the hearing public During one. had officer first the accident and disapprovals, certificate FAA four had captain hours inthelast7days. had flown 163 hours, including 57 hours in the last 30 days and 15 774 hours in the Dash 8. In the 90 days preceding the accident, she perators(SAF Thefirst officer received second-in-command privileges on the n April 29, 2009, Colgan Air issued an operations bulletin on on bulletin operations an issued Air Colgan 2009, 29, April On in policy fatigue a had Air Colgan accident, the of time the At A controversial issue was how fatigue may have affected the flight The investigation examined how violating the sterile cockpit rule Crew- Flight its in outlined was policy commuting Air’s Colgan 93 2009, April in Newark at based pilots Air Colgan 137 the Of Theinvestigation explored how commuting may have affected During the investigation, the NTSB discovered that the accident March 2008. She reported 2,244 hours total pilot time with O ) 06015,purpose)the promotewhich toof was provided information to crewmembers on what causes fatigue, how While waiting for the natural gas fire to be extinguished, member to recognize the signs of fatigue, how fatigue affects performance, Chealander participated in a press briefing with other local, state, and how to combat fatigue by properly utilizing periods of rest. and federal officials. We also visited the three other command posts The investigation was completed in just under one year. On Feb. that were set up by different agencies. 2, 2010, the NTSB determined that the probable cause of this ac- That night we began the press and family briefings and also held cident was the captain’s inappropriate response to the activation our organizational meeting, which normally takes a few hours. At of the stick shaker, which led to an aerodynamic stall from which this meeting we identified the teams to be formed and the parties the airplane did not recover. Contributing to the accident were (1) to the accident investigation. The following investigative teams were the flight crew’s failure to monitor airspeed in relation to the rising formed: operations and human performance, structures, systems, position of the low-speed cue, (2) the flight crew’s failure to adhere powerplants, air traffic control, meteorology, aircraft performance, to sterile cockpit procedures, (3) the captain’s failure to effectively maintenance records, and pipeline. In addition, specialists were as- manage the flight, and (4) Colgan Air’s inadequate procedures for signed to conduct the readout of the FDR and transcribe the CVR airspeed selection and management during approaches in icing at the NTSB’s laboratory in Washington, D.C. conditions. Parties to the investigation were the FAA, Colgan Air, ALPA, The safety issues discussed in the report focused on strategies the National Air Traffic Controllers Association (NATCA), and to prevent flight crew monitoring failures, pilot professionalism, the United Steelworkers Union (flight attendants). In accordance fatigue, remedial training, pilot training records, airspeed selection with the provisions of Annex 13 to the International Civil Aviation 9, 2010 SEPT. THURSDAY, procedures, stall training, FAA oversight, flight operational quality Organization, the TSB of Canada participated in the investigation assurance programs, use of personal portable electronic devices on as the representative of the State of Design and Manufacture (Air- the flight deck, the FAA’s use of SAFOs to transmit safety-critical in- frame and Engines), and the Air Accidents Investigation Branch formation, and weather information provided to pilots. Safety recom- of the United Kingdom (AAIB) participated in the investigation as mendations concerning these issues were addressed to the FAA. the representative of the State of Design and Manufacture (Propel- The NTSB had issued past recommendations on stall training, lers). Transport Canada, Bombardier, and Pratt & Whitney Canada stick pusher training, pilot records, remedial training for pilots, participated in the investigation as technical advisors to the TSB, sterile cockpit environment, situational awareness, pilot monitor- and Dowty Propellers participated in the investigation as a technical ing skills, low airspeed alerting systems, pilot professionalism, and advisor to the AAIB. fatigue. Although these issues were not new, this accident investiga- The overall schedule for the briefings was to inform the families tion still resulted in a flurry of activity in the aviation community, in first, have the news media interviews, and then hold the team prog- Congress, and with the family members of the passengers. ress meeting. Since the family and news media briefings were held Up until now, this paper has focused on the information gathered ahead of the progress meetings, I had to touch base with the group to support the accident report. The rest of the paper will focus on chairman mid-afternoon to get an update on how things were going. a behind-the scenes look at how the Colgan Air accident investiga- This information, along with “bullets” from headquarters, was the tion came together. This paper is written from my perspective as framework for the briefings. the investigator-in-charge (IIC) and is my opinion of how certain The concern with multiple briefings was maintaining consistency events evolved. of the information. The family members and the news media are As mentioned earlier, the NTSB was notified of the accident able to ask questions at their respective briefings. If additional in- about 10:30 p.m. on Feb. 12, 2009, and a go-team launched early formation was provided in an answer to a question in a meeting for the next morning from the FAA hangar in Washington, D.C. Ac- one group, another group might feel slighted that it did not receive companying the team to Buffalo was former Board member Steven that information. To prevent this from happening, we stuck to the Chealander, who gave a quick press briefing at the hangar before talking points and provided follow-up at the next briefing. the team left for Buffalo. The team traveled by FAA airplane and The challenges on scene were the natural gas line break, the commercial flights. outside air temperature, the approaching snowstorm, and the long Once we arrived on scene, we checked in with the incident com- hours. The natural gas fire created a hot, concentrated fire that left mander for status of the rescue, recovery, and overall firefighting molten metal and ash in its wake, making the examination of flight efforts. We were informed that there was a broken natural gas line control continuity and some parts identification very difficult. For- at the accident location that was feeding the fire. The natural gas tunately we had good FDR data that allowed us to conclude that the company shut off the flow of gas to the houses on either side of the accident flight had flight control continuity and no “fault” discretes accident site but was unable to stop the flow at the accident site were identified as to a failed part or system. because the shut-off valve was located directly in the fire area. One of the repercussions from trying to put the natural gas fire The natural gas company developed a plan to do a sectional out was that the wreckage site was saturated with fire suppressant shutdown that would have required cutting off gas service to about material. Every morning the team used portable heaters to thaw out 50 homes in 32 degrees F weather. This would have led to the evacu- the frozen wreckage site, creating a mud zone by the afternoon. This ation of 50 residences in the early morning hours along with the ultimately slowed down the recovery effort. assumption of responsibility for the evacuated homes. The incident To help speed things up, personnel from the Federal Bureau of commander deemed this solution unacceptable. Other options were Investigation’s (FBI) Evidence Recovery Team and local medical explored; and by mid-morning, the natural gas company secured the students assisted with the recovery of the airplane and passengers gas flow at the accident site, putting out the natural gas fire. from the house. The house was excavated down to its foundation. The structures group chairman retrieved the FDR and CVR and We also had help from the local volunteer fire department. sent them back to Washington, D.C., on one of the FAA airplanes. The FBI gave our team access to its mobile command post, and

ISASI 2010 Proceedings • 127 ISASI 2010 PROCEEDINGS 128 tions to the Board, and sandwiched in between was the Colgan Air example, in April and June, I brought two major accident investiga- pipelineand were scheduled to go before the Board in 2009. For them when they return. works well if the team members do not have reportwritingotherwhilewaitingpartysubmissions.for workprocess That waiting for with the investigation, hold a technical review,ranted,hold suchhearingand a andburrowopenpublica docket, intocontinue the the on-scene activities, return and decide if a public hearing is war accident.the naturalTheinvestigationcoursean of complete is helped maximizeparticipationintheprogressmeetings. flying the line or a desk. The use of an electronic calendar and email either jobs, regular their to back went participants the of lot a site, accident the left we once that Recognize monthly. to bi-monthly held were they progressed, investigation the weekly.As held were they hearing, public the before month The varied. call-ins the of frequency The concluded. investigation the of portion on-scene accident scene. These meetings continued telephonically after the coordinator and/orgroupchairman. zational meeting, so those individuals were briefed in by their party organi- the held we when scene on arrived had participants the of it set the tone for the rest of the firstinvestigation. meeting. The very organizational the from expectations clear set I field, playing the meetingneutralize was so importantToagendas. and interests becausecompeting have can who individuals of a in world. perfect work usually not do I and world, perfect a in is That vision. that fulfill to resources the commit then and is vision the what of understanding clear a have must members Board the even and chairmen and management, the parties, accredited representatives, through to the presentation of the Board report.timely The investigation.NTSB group It starts with the accident notification and flows occurred almost2.5yearsearlierinLexington,Ky. last major domestic fatal air carrier accident in the neither of those accidents involved fatalities. Prior to these cases, the Flight US 1549 Airways ditching on the Hudson River. Fortunately, runway excursion accident in Denver, Colo., and the second was the tion accident in 3 months. The first media attention was was constant. the This was the Continental third major domestic avia Flight 1404 hadno idea what was in store for us over the next year. The news better opportunity a had forteams our sleep.that so time earlier an at meetings progress our associated with long, stressful days, a few days in we started holding theinvestigation up and running. To combat getting just long the really were eventual days few first The morning. fatigue early and night the throughout continued coordination and notification the and night the during occurred accident the since hours long longhours.Thisaccident investigation startedpreludewith ato all ofthewitnessesandprovideddetailedreportstous. hot meals and warm conversation. In addition,out of the cold and work on field notes. the FBI interviewed the local volunteer fire station opened its doors so the team could get Iand others on the team had accident reports that were in the of scene the from returned we when us awaited challenges New Progress meetings were held daily until the day before we left the On scene, we started from scratch, building teams from a group a for set be to needs foundation the investigation, an in Early While we diligently worked through the challenges on scene, we strangertoaccident familiarinvestigationAnyonewithno is • ISASI 2010 ISASI Proceedings ocal volunteers provided Local volunteers provided U nfortunately, not all United States had - - disadvantagewas not being A kept timeframe. inthe loopshort bya the FAAsuch onsomein occurring were that changes the all the and FAA the from information new with report a update continually and TheirRoleinAviation Safety.” symposium on code-sharing titled, “Airline Code-Sharing Arrangements understanding of overall agency mission. understanding ofoverallagencymission. better a have and reports, written better produce oversight, less conducting a timely investigation. in essential is which team, experienced an have to fortunate was I An experienced team can require public hearing in which I had the additional role as hearing officer. ” Performance. Controller “ May 18-20, 2010, the NTSB held a forum on professionalism titled, report. the from separate detail, more in explored be would code-sharing and Professionalism offered. was compromise a and addressed, be to had areas both knew We became. they complex moreissues, thetheseinto dug wecode-sharing, morethe but professionalismonlayers and the back peel to triedteam The report. the for develop to had we than time more take would that the reporttoensureaccuracy. of reread complete a do to time the make to had report. We final This leads to the potential for misinformation to promulgate to the sections. troublesome more the to skip reviewers the down, nailed tiple reviews and short turn-around times is that when one section is that an error does not creep into the report. The problem with mul- intended meaning, and we have to carefully review every version so When one person changes a details. sentence, it different can potentially change for the report the reviewing people different many document issues. the minimize to helped communication better but refining, some took It chairmen. group the team of level frustration the the increased and of progress the down slow to potential the had delays tion,withorstamps indicating “forinvestigative useonly.” These associated with receiving documents late, with incomplete informa- eyes reviewadocumentbeforeitisreleased. of sets three least at having of policy internal accuracy,an have we to sacrifice accurate or factual detail to meet a deadline. To ensure to the public. In trying to be expeditious, we had to be cautious not becollected or generated. to have material) docket (public documents support The lenging. 4,462 pagesand152documents. and 25 new recommendations to the FAA. The public docket held underyear.a just in The finalBoard reportthe to was 285report pages,draft withthe 46 conclusionspresent and accident the of sources, we were still able to hold a public hearing within 3 months immediately beforetheColganAiraccident. supporting the other two major with associated airwork carrierthe consideration into take accidentsnot do numbers that occurred hearings during the course of the Colgan Air investigation.package Thoseon helicopter emergency medical services, and three public Safety presented five draft reports to the Board, a recommendation Professionalism in Aviation: Ensuring Excellence in Pilot and Air Traffic This report was my firstThis reportexperiencemywas that involved need to the To put the workload issue in perspective, the perspective, in issue Toworkload the put During the report writing phase, we quickly identified two areas The accident report writing process itself can be challenging with delay the was investigation this in faced we hurdles the of One chal- be can timeframe short a in report detailed a Producing re- competing with associated challenges additional the Despite .S. Congress. It was challenging to keep current with with current keep to challenging was It Congress. U.S. On ct. 26-27, 2010, the NTSB will hold a a hold will NTSB the 2010, 26-27, Oct. O ncethe docket is open, it is available ffice of Aviation Aviation of Office n On issues and only becoming aware of these details when the FAA ad- technical review, but now party coordinators are asked to review and ministrator delivered testimony to Congress. We relied on the NTSB comment on the factual reports earlier in the investigation, before government affairs office to keep the team informed of scheduled the docket is opened and released to the public. testimony, and we regularly checked the FAA and congressional In summary, the NTSB has the luxury of being an independent websites for updates. agency. We conduct our investigations with an unbiased approach, Another first was the family members of the passengers on Flight where our main objective is to determine probable cause and issue 3407 became safety advocates and even after the NTSB report was safety recommendations. Speed is measured by the eye of the be- published they continued to fight for changes in the aviation indus- holder. The fastest turtle is still beaten by the slowest hare. We will try. Family members and close friends of the victims went to Buffalo never be as fast as the news media or political pundits. Our reports immediately after the accident to learn more about what happened will never be quick enough to answer the families’ questions. to the accident flight. In the weeks following the accident, a bond was Remember that NTSB safety recommendations can be issued at formed amongst the family members and they formed an alliance any time, independent of an accident report. Our public docket is to promote positive change in the aviation industry. Their goal is now available on the Internet, and anyone can access all the factual to bring awareness to outstanding safety issues yet to be addressed documentation before the Board report is released with just the click by the FAA and major airlines and to improve overall safety of pas- of a mouse. All of our Board meetings and public hearings are open sengers in the skies. to the public and can be remotely viewed from the internet.

An authentic investigation depends on facts. Board reports are For more details on the accident, please download a copy of the 9, 2010 SEPT. THURSDAY, structured so that any analytical statement is supported by factual report titled Loss of Control on Approach, Colgan Air, Inc., Operating as documentation. The NTSB recently adopted a new procedure that Continental Connection Flight 3407, Bombardier DHC-8-400, N200WQ, requires all group chairmen reports to be vetted by the parties to the Clarence Center, New York, February 12, 2009, Aircraft Accident Report investigation before these reports go into our public docket. Nor- NTSB/AAR-10/01, (Washington, DC: National Transportation mally, these reports would go through the group members and then Safety Board, 2010) at the following link: http://www.ntsb.gov/ be finalized and put into the docket. The legacy process involved the publictn/2010/AAR1001.pdf. ◆ conduct of a technical review meeting only after the public docket was opened and all of the factual reports were completed. At this Endnotes 1 All times are Eastern Standard Time unless noted otherwise. technical review, all parties would preview the reports and provide 2 In an enbanc hearing, all of the Board members participate as part of the technical comments for consideration by the NTSB. We still have the Board of Inquiry for the public hearing.

ISASI 2010 Proceedings • 129 ISASI 2010 PROCEEDINGS 130 • ISASI 2010 ISASI Proceedings ISASI 2010PictorialReview Photos byEsperisonMartinez ISASI 2010 PICTORIAL REVIEW

ISASI 2010 Proceedings • 131 ISASI 2010 PROCEEDINGS 132 • ISASI 2010 ISASI Proceedings ISASI 2010 PICTORIAL REVIEW

ISASI 2010 Proceedings • 133 ISASI 2010 PROCEEDINGS 134 • ISASI 2010 ISASI Proceedings