AeroSafety WORLD NORTH SEA REVISITED Helicopter safety attitudes BLACK HOLE COASTLINE Wet runway overrun AIRBORNE CONFLICT European forum excerpts
FLYING FOR HIRE SMALL UAS TEMPTATIONS
THE JOURNAL OF FLIGHT SAFETY FOUNDATION SEPTEMBER 2014 Visit us: WYVERN wyvernltd.com
The leader in GLOBAL AVIATION RISK MANAGEMENT & SAFETY AUDITING with locations worldwide.
North America Europe Middle East Latin America Africa South Asia East Asia
10 N. Main Street, Suite B / Yardley, Pennsylvania / USA / 19067-1422 [email protected] WYVERN Phone: +1 800 WINGMAN (946-4626) Fax: +1 877 998 3761 wyvernltd.com
Wyvern Consulting, Ltd. is a wholly owned subsidiary of NEXUS Services America, LLC PRESIDENT’SMESSAGE
INTERNATIONAL AIR Safety Summit
n November, more than 300 aviation safety The major sponsor for IASS is Etihad Air- professionals from around the world will ways, which will be hosting a luxury opening gather in Abu Dhabi for Flight Safety Foun- reception the first night of IASS for all attendees. dation’s 67th annual International Air Safety In conjunction with IASS 2014, we will be ISummit (IASS). Already, we have higher-than- holding our second annual Benefit Dinner. Last usual registration and representation from a year, we raised more than $75,000 to assist with wide range of companies and sectors from every FSF programs, and we are aiming to increase corner of the globe. that amount this year. The dinner, including a It’s not hard to understand why. We’ve paired reception and silent auction, will be held at the one of the most respected and important safety Monte-Carlo Beach Club on Saadiyat Island in events with a region of the world that is home Abu Dhabi. to one of the aviation industry’s highest rates of This will be my first IASS as president and growth. According to some reports, growth in CEO, but the reputation of this event precedes it. I the Middle East is expected to outpace the rest know that it will be an important week of sharing of the world for the next 20 years. It’s no wonder safety information, networking with colleagues that this is turning into a hot ticket. from all around the world and learning about the As the agenda for this event takes shape latest safety technologies. If there is one safety — and you can access it at
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 1 AeroSafetyWORLD
September 2014 contents Vol 9 Issue 7 features
12 CoverStory | Concerns About Small UAS
17 CoverStory | UAS Accident Review
22 CausalFactors | Kingston Runway Overrun
27 SafetyCulture | Business Aviation Constructs
12 32 HelicopterSafety | North Sea Attitudes
38 TrafficControl | European Airborne Conflict
departments
1 President’sMessage | International Air Safety Summit
5 EditorialPage | Test of Resilience
6 SafetyCalendar | Industry Events 17 7 LeadersLog | Marion C. Blakey
2 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 22 27 32
8 InBrief | Safety News
44 DataLink | ATSB Powerplant Analysis
47 InfoScan | Work As Actually Done
50 OnRecord | Slip of the Tongue
56 SmokeFireFumes | Selected Events 38 AeroSafetyWORLD telephone: +1 703.739.6700
Frank Jackman, editor-in-chief, FSF director of publications [email protected], ext. 116 About the Cover Pressures to illegally fly small UAS aircraft for hire call for countermeasures, U.S. experts say. Wayne Rosenkrans, senior editor [email protected], ext. 115 © piotr roae | Fotolia.com Linda Werfelman, senior editor [email protected], ext. 122
We Encourage Reprints (For permissions, go to
| | FLIGHTSAFETY.ORG AEROSAFETYWORLD SEPTEMBER 2014 | 3 Serving Aviation Safety Interests for More Than 65 Years OFFICERS AND STAFF ince 1947, Flight Safety Foundation has helped save lives around the world. The Chairman Board of Governors David McMillan Foundation is an international non-profit organization whose sole purpose is to provide impartial, independent, expert safety guidance and resources for the President and CEO Jon L. Beatty S aviation and aerospace industry. The Foundation is in a unique position to identify General Counsel and Secretary Kenneth P. Quinn, Esq. global safety issues, set priorities and serve as a catalyst to address the issues through Treasurer David J. Barger data collection and information sharing, education, advocacy and communications. The Foundation’s effectiveness in bridging cultural and political differences in the common cause of safety has earned worldwide respect. Today, membership includes more than FINANCIAL 1,000 organizations and individuals in 150 countries. Financial Operations Manager Jaime Northington MemberGuide MEMBERSHIP AND BUSINESS DEVELOPMENT Flight Safety Foundation Senior Director of 801 N. Fairfax St., Suite 400, Alexandria VA 22314-1774 USA Membership and tel +1 703.739.6700 fax +1 703.739.6708 flightsafety.org Business Development Susan M. Lausch Member enrollment ext. 102 Director of Events Ahlam Wahdan, membership services coordinator [email protected] and Seminars Kelcey Mitchell Seminar registration ext. 101 Manager, Conferences Namratha Apparao, manager, conferences and exhibits [email protected] and Exhibits Namratha Apparao Seminar sponsorships/Exhibitor opportunities ext. 105 Membership Kelcey Mitchell, director of events and seminars [email protected] Services Coordinator Ahlam Wahdan Donations/Endowments ext. 112 Consultant, Student Susan M. Lausch, senior director of membership and development [email protected] Chapters and Projects Caren Waddell FSF awards programs ext. 105 Kelcey Mitchell, director of events and seminars [email protected]
COMMUNICATIONS Technical product orders ext. 101 Namratha Apparao, manager, conferences and exhibits [email protected] Director of Communications Emily McGee Seminar proceedings ext. 101 Namratha Apparao, manager, conferences and exhibits [email protected] Website ext. 126 GLOBAL PROGRAMS Emily McGee, director of communications [email protected] Basic Aviation Risk Standard Director of Greg Marshall, BARS managing director [email protected] Global Programs Rudy Quevedo BARS Program Office: Level 6, 278 Collins Street, Melbourne, Victoria 3000 Australia tel +61 1300.557.162 fax +61 1300.557.182 [email protected] BASIC AVIATION RISK STANDARD BARS Managing Director Greg Marshall
facebook.com/flightsafetyfoundation
Past President Capt. Kevin L. Hiatt @flightsafety Founder Jerome Lederer www.linkedin.com/groups?gid=1804478 1902–2004
FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 EDITORIALPAGE
TEST OF Resilience hen, in my last Editor’s Message of 2013, procedures relating to the mitigation of conflict I looked ahead to 2014, I didn’t foresee zone risk in civilian airspace,” ICAO said. David an airliner missing for months, or one McMillan, chairman of the Foundation’s Board getting shot down as it flew a scheduled of Governors, was elected as TF RCZ chairman. Wflight from Europe to Asia. But that’s the reality the “We’re looking for urgent, practical measures to ad- global aviation industry faces following the dual dress these new risks,” McMillan said. The group’s tragedies of Malaysia Airlines MH370 and MH17. preliminary findings are expected in October. Hundreds of passengers and crew are dead, or Of course, work continues on many of this missing and presumed dead, and the industry is year’s “expected” issues, including more effective left searching for answers as to what happened and pilot monitoring, improved upset prevention and how to mitigate the risk of either happening again. recovery training, integration of unmanned air- To that end, two industry task forces have been craft systems into the U.S. National Airspace Sys- convened to study the relevant issues and make tem and more realistic approach and go-around recommendations. The first, the Aircraft Tracking practices and procedures. And that highlights Task Force (ATTF), is being led by the Interna- one of the industry’s core strengths and a primary tional Air Transport Association (IATA) and reason for its stellar safety record: resiliency. comprises subject matter experts from IATA, the The Merriam-Webster definitions for resilience International Civil Aviation Organization (ICAO), include “the ability to recover from or adjust easily airlines, equipment manufacturers, air navigation to misfortune or change.” It usually is not easy, but service providers, labor groups and Flight Safety the aviation industry, because of the professionals Foundation, among others. The ATTF, working it employs, has a finely honed ability to effectively with an aggressive schedule, is expected to be in and efficiently mitigate new safety threats without a position to deliver draft options for “enhanced giving up ground on previous issues. I am confident global aircraft tracking” to ICAO in September, this resilience will carry the day once more. leading to presentation to industry before year’s end. The second group is the Task Force on Risks to Civil Aviation Arising from Conflict Zones (TF RCZ), which was convened by ICAO fol- lowing the loss of MH17 over eastern Ukraine Frank Jackman and which met for the first time in mid-August. Editor-in-Chief The group’s mandate is to “refine the roles and AeroSafety World
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 5 ➤ SAFETYCALENDAR
SEPT. 3–5 ➤ ALTA Aviation Law Americas OCT. 21–23 ➤ NBAA2014 Business FEB. 10–11 ➤ Approach and Landing 2014. Latin American and Caribbean Air Aviation Convention and Exhibition. Accident Reduction (ALAR) Info Exchange. Transport Association. Miami.
6 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 LEADERSLOG
MOVING TOWARD RATIONAL FAA REGULATION OF Unmanned Aircraft Systems BY MARION C. BLAKEY
ven though Congress has man- developing a rational regulatory regime official who will take a more global dated a deadline in 2015 for inte- that provides clarity for the public, policy approach to safety but one expe- grating unmanned aircraft systems hobbyists and more sophisticated UAS ditiously deriving the potential benefits (UAS) into U.S. airspace, that dead- developers and users will stifle innova- of widespread UAS applications. Eline will probably not be met. However, tion, delay the safety improvements that On the positive side, the FAA’s Small increasing attention from many sources come with operational experience and Unmanned Aircraft System Aviation outside the U.S. Federal Aviation Ad- postpone the benefits this technology Rulemaking Committee has proposed a ministration (FAA) is focused on how promises. We will also see an increase smart step-by-step approach to full UAS safety concerns will be addressed. in flights by those who fly UAS illegally, integration. The FAA’s six designated Typically, the safety conversation ignoring the FAA’s restrictions and po- test sites will help us obtain valuable boils down to how to avoid collisions tentially creating unsafe conditions. data to enhance the safety of UAS tech- between conventionally piloted aircraft In developing new regulations, the nical systems and to pinpoint potential and UAS, and UAS crash landings. That’s entire UAS community — government safety issues. And the recent action by a fair departure point for thoughtful and industry alike — must also take on the FAA to entertain license exemptions discourse, but as someone who had re- the challenge of informing and educat- for filmmakers prior to the issuance of sponsibility for safety at the U.S. National ing the public about how real safety the small UAS rule is a welcome step. Transportation Safety Board and the risks are being addressed and mitigated. AIA supported the applications for FAA, I believe we need to consider the A recent Washington Post report, for those exemptions through a joint letter broader picture. UAS have tremendous instance, erroneously used examples of with the Motion Picture Association of life-saving potential when lost people selective and outdated military UAS ac- America to FAA Administrator Michael need to be found; when wildfires devel- cidents in hazardous flying conditions Huerta. Furthering progress requires us op; when tornadoes hit; and when power to paint a dire picture of what problems to keep taking these kinds of steps. lines, oil rigs and bridges need close in- might be engendered by UAS activities We should not forget that there’s a spection. Almost every day, there is news in the domestic airspace. That kind of global competition ongoing to develop of a new idea about how to gain valuable sensational journalism doesn’t promote UAS applications. A decade after the social benefits from this technology with- the clear-eyed and rational discussion Wright brothers flew, the United States out having to put humans in dangerous we should have on regulating UAS. found that it was lagging far behind positions. We need to balance our safety Currently, we have an unstable regu- European aviation capabilities and had concerns about UAS with the safety gains latory environment, with only a handful to make a concerted effort to catch up. we can realize from those operations. of licensed operators, plus those who are For the sake of the U.S. economy and Achieving that balanced approach exempt because they are in the hobbyist society, that historic mistake should not to UAS regulation means recogniz- category. Without clear guidance, this is be repeated by needlessly slowing the ing the need for prudent first steps to a recipe for trouble until the FAA pub- safety regulatory process for UAS.
get a number of these systems into the lishes its small UAS proposed rule and Marion C. Blakey is president and chief airspace. In addition to the immediate moves on to other UAS categories. And executive officer of the Aerospace Industries benefits, we can obtain useful opera- while we appreciate the technical exper- Association.
tional data that will help us enhance tise that is going into the development of The opinions expressed here are those of the UAS safety and allow this industry to new regulations, we believe the Obama author and not necessarily those of AeroSafety develop and grow. Dragging our feet on administration needs to designate an World or the Flight Safety Foundation.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 7 INBRIEF Safety News Asiana Recommendations
oeing should be required to enhance training for pilots of 777s to “improve flight crew understanding of autothrottle Bmodes and automatic activation system logic,” the U.S. National Transportation Safety Board (NTSB) says. The recommendation is one of 27 included in the NTSB’s final report on the July 6, 2013, crash of an Asiana Airlines 777 when it struck a seawall during approach to San Francisco International Airport. The crash killed three of the 307 people in the airplane, and 49 others were seriously injured. The airplane was destroyed. Basil D. Soufi | Wikimedia Commons The NTSB said the probable cause of the crash was the flight Proposed Penalty crew’s “mismanagement of the airplane’s descent during the visual approach, the pilot flying’s unintended deactivation of automatic outhwest Airlines is facing a proposed $12 million airspeed control, the flight crew’s inadequate monitoring of air- civil penalty because of the U.S. Federal Aviation speed and the flight crew’s delayed execution of a go-around.” SAdministration’s (FAA’s) charge that it failed to The NTSB’s investigation of the accident prompted its issu- comply with federal regulations in making repairs on ance of 15 safety recommendations to the U.S. Federal Aviation three Boeing 737s. Administration (FAA), including one that calls on the FAA to Southwest has 30 days from its notification of the require Boeing to develop the enhanced 777 training and an- FAA’s proposed action to respond. other that says the agency should require operators and trainers The FAA said in a statement released in late July that to provide the training to 777 pilots. Southwest had conducted “extreme makeover” altera- Other recommendations to the FAA said that the agency tions beginning in 2006 to eliminate the potential for should require Boeing to include in the 777 crew training manual cracks in the skin of 44 airliners. The airline’s contractor, “an explanation and demonstration of the circumstances in which the Aviation Technical Services (ATS), did not comply with autothrottle does not provide low-speed protection” and convene required procedures in replacing fuselage skin and in a panel of experts to identify the most effective methods of training stabilizing the airplanes on jacks, the FAA said. flight crews in using automated systems for flight path management. The agency also said that the airplanes were returned Other recommendations — among them, dealing with the to service and operated on flights in 2009 while not in need to comply with standard operating procedures, the need to compliance with U.S. Federal Aviation Regulations. In give Asiana pilots more opportunities for manual flight and the addition, the FAA said that Southwest did not properly need for improved emergency communications — were issued install water drain mast ground wires on two 737s in to Asiana, Boeing, the Aircraft Rescue and Firefighting Working compliance with an airworthiness directive; these air- Group and the city and county of San Francisco. planes were operated on more than 20 passenger flights A full discussion of the NTSB final report will be included in after the airline became aware of the problem and before the October issue of AeroSafety World. it was corrected.
Double Meaning
urocontrol is warning pilots and air traffic controllers that confusion could result from use of the “at pilot’s phrase “at pilot’s discretion,” which is common in the United States but not understood globally. discretion” E “In the United States, the meaning of ‘at pilot’s discretion’ in radio telephony voice communi- cations related to climb/descent clearances is promulgated to include the option for pilots to level off at intermediate levels,” Eurocontrol said in a safety reminder message issued in late July. “However, the meaning of this phrase … is not understood globally, and there is a risk that its use outside the U.S. could lead to adverse safety outcomes if non-U.S. based controllers unwittingly approve pilot requests to climb/ descend at their own discretion.” Eurocontrol said its advisory was intended to caution controllers in countries other than the United States that their use of the phrase in response to a request from a U.S. pilot could result in “a situation where they approve the request for ‘own discretion’ (to climb/descend) without recognizing the potential of an unexpected outcome — i.e., a possible intermediate level off.” Use of the phrase “when ready,” as prescribed by the International Civil Aviation Organization, does not imply that an interme- diate level-off is acceptable and precludes misunderstanding, Eurocontrol said.
8 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014
INBRIEF
Undetermined Cause
imited access to the Antarctic site of the Jan. 23, 2013, crash of a de Havilland LDHC-6-300 Twin Otter and the absence of data from the airplane’s cockpit voice recorder (CVR) left accident investigators unable to determine the accident’s cause, the Transportation Safety Board of Canada (TSB) says. The three crewmembers — the only people aboard the airplane — were killed when it struck Mount Elizabeth, perhaps after flying into clouds during a reposition- ing flight from South Pole Station, with an intended landing site of Terra Nova Bay, the TSB said in its final report on the accident, © Chameleonseye | istockphoto released in June. Coping With Armed Conflicts Weather conditions kept rescue person- nel from reaching the site for two days he International Civil Aviation Organization (ICAO) has established a task and prevented accident investigators from force — headed by David McMillan, chairman of the FSF Board of Gover- thoroughly examining the wreckage, the Tnors — to address issues stemming from the July 17 downing of a Malaysia report said. Investigators also found that the Airlines Boeing 777 over eastern Ukraine, killing all 298 people aboard. CVR had not been functioning the day of Authorities say the airplane, en route at 33,000 ft, was struck by a missile the accident. fired from an area where pro-Russian separatists had been fighting Ukrainian The report noted that after the accident, government forces. the operator implemented actions intended The Task Force on Risks to Civil Aviation Arising From Conflict Zones to mitigate flight risks, including improving will review methods that might be used to improve the gathering of informa- the accuracy of Antarctic aviation naviga- tion about armed conflicts and how they might endanger civil aviation. tional charts, developing visual flight rules The task force will focus on methods of effectively collecting and dis- routes for longer flights, altering pre-start seminating “information and intelligence that might affect the safety of our checklists “to confirm that an adequate passengers and crew,” ICAO said, adding that ICAO member states have been oxygen supply is on board the aircraft and “reminded … of their responsibilities to address any potential risks to civil that the [CVR] is functional,” and amending aviation in their airspace.” global positioning system operating proce- McMillan, a former director general of Eurocontrol, said that the industry dures to ensure correct data input. must “apply lessons learned from the tragedy of [Malaysia Airlines Flight 17] … to fill any gaps that may exist to better assess and share risks from and near regional conflict zones.” ICAO said the aviation community asked it to address “fail-safe chan- nels for essential threat information to be made available to civil aviation authorities and industry” and “the need to incorporate into international law, through appropriate [United Nations] frameworks, measures to govern the design, manufacture and deployment of modern anti-aircraft weaponry.” An ICAO safety conference, including all 191 ICAO member states, will be held in February 2015, in part to discuss these issues. IATA said that “clear, accurate and timely information on risks is critical.” IATA Director General and CEO Tony Tyler added, “We were told that flights traversing Ukraine’s territory at above 32,000 ft would not be in harm’s way. We now know how wrong that guidance was. It is essential that airlines receive clear guidance regarding threats to their passengers, crew and aircraft. Such information must be accessible in an authoritative, ac- curate, consistent and unequivocal way. This is the responsibility of states. There can be no excuses.”
Michael Studinger | NASA
10 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 INBRIEF
Upgrade for Serbia country’s civil aviation authority is deficient in one or more areas, including relevant legislation or regulations, technical expertise, erbia has received a Category 1 safety rating from the U.S. trained personnel, record keeping or inspection procedures. Federal Aviation Administration (FAA), signifying that The FAA conducts safety reviews of all countries that have Sits civil aviation authority is operating in compliance with air carriers flying to and from the United States, and of those International Civil Aviation Organization safety standards. that have applied for such flights. The rating, based on an FAA assessment conducted earlier Serbian airlines currently do not fly to the United States, this year, represents an upgrade from the Category 2 rating that but the rating change means that they may apply to the FAA Serbia has held since 2006. A Category 2 rating signifies that a and U.S. Department of Transportation for authority to do so.
In Other News …
Air Methods could face a $428,000 civil penalty proposed by the U.S. Federal Aviation Administration (FAA), which said the emergency medical services (EMS) operator flew helicopters without conducting required inspections of night vision imaging sys- tem–compatible lighting filtration installations. The company has 30 days from receipt of the FAA’s enforcement letter to respond. The agency has proposed a $110,000 civil penalty against another EMS operator, Air Evac EMS, for operating a Bell 206 on several passenger flights even though its chin bubble window — a window at the front of the helicopter that allows the pilot to see below — was not installed in accordance with the manufacturer’s instructions. The FAA says the company has discussed the matter with the agency. … New pilot licensing regulations take effect in Australia in September, and over the next four years, some 40,000 licenses that have been issued under Civil Aviation Regulations Part 5 will be reissued under the new Part 61. New requirements also will be implemented for flight reviews and proficiency checks, the Australian Civil Aviation Safety Authority says.
Compiled and edited by Linda Werfelman.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 11 12 | COVERSTORY about disregard ofrules. domain —raiseconcern aircraft —outsidehobbyists’ flights bysmallremotely piloted Reports ofunauthorizedcommercial BY WAYNE ROSENKRANS FLIGHT FOUNDATION SAFETY |
WORLD AEROSAFETY | SEPTEMBER 2014
© Tyler Olson | Dreamstime.com COVERSTORY
hroughout 2014, observations and media- As for sUAS (aircraft less than 55 lb [25 kg], derived awareness of potentially hazard- often flown with direct, line-of-sight control by ous flights by small unmanned aircraft the pilot), the FAA has scheduled for late 2014 systems (sUAS), called remotely piloted the publication of its notice of proposed rule- Taircraft at the international level, have prompt- making (NPRM) for this category, he said. ed consternation for some U.S. aviation safety professionals. At issue, two UAS subject matter AUVSI Perspectives experts told AeroSafety World, is whether unau- Ben Gielow, general counsel and senior gov- thorized commercial sUAS flights, in particular, ernment relations manager, Association for pose a significant risk to air transport, business Unmanned Vehicle Systems International aviation and other aviation activities. (AUVSI), told ASW editors, “We’re obviously Such flights are prohibited by the U.S. Fed- very concerned with the possibility of [an sUAS eral Aviation Administration (FAA) unless the operator] going out there and flying recklessly operator is one of a select few to have received and dangerously, which is why we … have an exemption from the Federal Aviation been asking the FAA for years to regulate us, Regulations. The experts who spoke to ASW to pass the safety rules — we actually want the offered different approaches to address the regulations. risk that they see. “[Those] flying in downtown New York City over people, or flying around the very busy air- FAA Viewpoints ports there, certainly are not members of ours. … Insights into relevant FAA positions surfaced There’s not a whole lot that can be done right now in the briefing by John Hickey, deputy associate to stop or prohibit them from just going out and administrator for aviation safety, at an Air Line buying the systems online. [Some] don’t know Pilots Association, International Safety Forum in anything and just are flying them, and don’t real- August. “I think that, to some degree, [operating ize the safety risks that they could be posing.” non-segregated UAS] is not going to be as soon The association has called for intensified as some people tend to think it is,” he said. “We’re FAA enforcement of current restrictions and still many years away from what you would see implementing enforceable regulations as the as safe integration in the very busiest airspace in most important risk mitigations. “Until they do, our system. … As the public sees … that we will they’re on legal ‘thin ice’ in punishing people for not allow these UAS to come into the system until flying a [radio control (RC)] model aircraft, a we are completely sure that they are safe, that’s a Raven, as [a] commercial unmanned aircraft,” great step to educating the public.” Gielow said. Perceptions also may be influenced by AUVSI foresees problems if regulations developments such as the September 2013 an- emerge with uniform treatment of all sUAS nouncement of the FAA issuing its first-ever flights that have in common solely their com- commercial, type-approved, restricted-category mercial purposes. “Unmanned aircraft are not aircraft authorization for corporate UAS flights commercial [air] carriers, they are not carry- in the Arctic airspace of Alaska. “We’ve been ing people, and often they only weigh a couple very engaged in providing exemptions to a lim- pounds [0.9 kg],” he said. “So although they may ited group of commercial operations as a result be taking pictures and those pictures may be of … Section 333 of [the 2012 FAA funding] sold commercially, they shouldn’t have to meet reauthorization bill,” Hickey said. “Exemp- the same level of safety requirements across the tions allow certain entities in certain isolated board. … Everyone in the industry anticipates airspace to operate a business venture [such as] that [the new sUAS] regulations will be, or at the Motion Picture Association of America, and least should be, different based on size, weight, we granted an exemption to them.” performance and airspace that they fly in.”
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 13 COVERSTORY
While the industry awaits the sUAS NPRM, speculation abounds regarding the extent to which FAA requirements — such as provisions for personnel certification — will be carried over from or inspired by manned aircraft expe- rience. “Everyone wants to know ‘What are the pilots’ qualifications?” he said. “Do they really need to build up all the hours in a manned air- craft just to prove that they know the airspace?” Benefits from the FAA’s sUAS rulemaking, he said, typically are described in terms of in- vestments, competitive advantage beyond U.S. borders and exports. Yet safety meanwhile is affected in that, Gielow said, “the reality is we need the FAA to write these rules. We’ve been reading more and more about folks … just go- ‘The FAA does not ing out there and flying [sUAS commercially] today — either [not] knowing the FAA prohibi- The association, which primarily rep- have the money or tions or knowing them … but doing it anyway, resents interests of manufacturers of large then challenging the FAA to come after them. UAS, in recent years has been collaborating the manpower to So we’re at a dangerous time because if the FAA closely on safety issues with the sUAS com- track down every does not hurry up and come out with something munity, the RC model aircraft community, the soon, more … will go out there and fly, and if commercial air transport sector, the business reported use of a 4-lb this ‘horse gets out of the barn,’ I don’t see it aviation sector, helicopter operators, general coming back in.” aviation associations, air traffic controllers [1.8-kg] quadcopter, Unauthorized commercial flying arguably and other stakeholders, he said. For example, generates a drag on limited FAA enforcement the association rounded up executives from whether it’s flying resources and a distraction. “The FAA does not 32 aviation associations to sign an April letter inside of a fireworks have the money or the manpower to track down urging the FAA to expedite its second at- every reported use of a 4-lb [1.8-kg] quad- tempt at sUAS rulemaking in part because of display or over copter, whether it’s flying inside of a fireworks discomfort about the “safety vacuum” of the display or over a farm field,” Gielow said. “It status quo. a farm field.’ doesn’t make sense that the only thing differ- Regarding RC model aircraft hobbyists, ent between a model aircraft and an unmanned Gielow said, “On the safety front, there is a lot aircraft is the intent of the pilot, which has that we learn from their community because, for nothing to do with the actual safety of the air- the very small [sUAS aircraft] — operating un- craft or airspace.” The focus on detecting illegal der restrictions of [see-and-avoid] line-of-sight, commercial operations consumes part of air at less than 400 ft, away from people — [such] safety inspectors’ time, he added. commonsense safety restrictions could greatly “Once the rules are out, the FAA … will enable the [sUAS] industry to take off.” have leveled the playing field so that responsible parties will then hold nonresponsible parties Small-Scale Risk Mitigation accountable,” he said. “Then I think there will be The safety culture that has evolved across an industry effort to ensure that everyone is safe. several generations of RC model aircraft hob- But right now, [sUAS operations are] basically byists focuses on reducing the risk of injury turning into the Wild West — folks … doing or property damage — to themselves or others whatever they want.” — in the United States, says Richard Hanson,
14 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 © Yali Shi | Dreamstime.com aircraft leaves actually site.” flying the of things. It’s rare avery occasion where the parking lot and broke windshields, types those back [to operator] the and hit vehicles inthe aircraft was going out of control and was going damage, we’ve had afew instances where the have some instances. been …As far as property outside hobby, the are rare those very but there that,” Hanson said. “As far as injuries to people lower taxiing or legs[while] something like awry, and got they hit hit knees, inthe inthe dling of aircraft, their or something that went “For most the [events part, involved] mishan- by was his killed own flying modeler aircraft. and rarest the the inwhich five being cases acut being with typical finger injury severity havewho injured been by own their aircraft, records have involved AMA-member hobbyists government regulation of hobby, the he said. fectively enough to essentially avoid for need the dures, member education ef- and rules flying adjust safety operations flight policies, proce- to monitor safety the of members’ and activities records kept by program the have helped AMA liability coverage for each. The insurance claim insurance program that provides $2.5million fairs, Academy of Model Aeronautics (AMA). director, public relations and government af- FLIGHTSAFETY.ORG Most of injuries the captured inthese AMA protects members under agroup |
WORLD AEROSAFETY | SEPTEMBER 2014 engage inpublic education vacuum the to fill FAA regulations, to actively AMAdecided operating equipment.” this unique of set safety guidelines for that of aspect year with that community and coming up with a wethings …so …have working been about a with [sUAS] you are around people and around By nature the of doing something purposeful, away from persons that can get hurt or property. for aircraft model are that you at fly alocation el aircraft,” Hanson said. “Our safety guidelines [beyond] where you would- amod typically find lends to them introduced being inenvironments can and perform afunction have apurpose similar innature,very that fact the sUAS] [the serious safety concerns. “Even are though they versus commercially an flying sUAS involves distinction of atraditional flying aircraft model literally thousands of other applications.” prevalent one photography, is aerial but there are ing some revenue stream from it. …The most somehow, of making abusiness or at least creat- extend hobby their into area this or with idea, the —eithertechnology for —to use personal their sUAS.flying have “[They] some interest inthis expressedalso strong interest inowning and responded who bers to an informal AMAsurvey hobby.”the Yet, about 30percent of AMAmem- motivation, for purpose the participation their in at aircraft,” the flying Hanson said. is “That the fly,them learning how and to fly becoming good aircraft for pleasure personal the of watching build, anddesign, fly compete model with these aircraft inflight. and bystanders by struck multi-rotor sUAS–type fatal injuries —caused to nonmember operators anecdotal reports of minor injuries —but no field, he said. The AMAinrecent years received RC aircraft model demonstration at aflying of abystander who, an in1979,was observing ness of five the member fatalities and death the AMA —founded aware in1936—preserves - aviation, and institutional the knowledge of the During the past the year,During absence inthe of new FAA, the Like AMArecognizes the that the “[AMA’s] more traditional, core members … Flying of aircraft model predates manned very similarinnature, ‘Even thoughthey are would finda typically sUAS] a perform can [beyond] where you purpose lendsthem to introduced being function andhavefunction a the fact that [the the fact in environments model aircraft.’model COVERSTORY |
15 COVERSTORY
of knowledge about sUAS risks and Changing the behavior of those people, suggesting perhaps a universally recog- benefits. he believes, requires a human factors– nized endorsement program. Those in the AMA who favored this centered strategy unlike the relatively issue engagement — as opposed to the complex culture, practices and assump- Underestimating sUAS alternative of officially drawing a line tions of manned aviation. AMA staff and members who fly sUAS between model airplanes and UAS, and If efforts to instill safe flying behav- at noncommercial, public awareness disavowing any responsibility for sUAS ior among today’s new sUAS owners and educational demonstrations under safety — prevailed. “The general public prove ineffective, several consequences AMA rules have encountered many doesn’t know … the distinction between seem likely, according to Hanson’s in- people in the audience who say they see a UAS and a model airplane. … [We’re] teractions with them so far. “Basically, no need to learn how to fly such aircraft reaching out to [the sUAS] community, some of them will quit because they because the aircraft always will fly itself. finding people who want to fly safely don’t want to be viewed as operating “That’s absolutely wrong,” Hanson said. and responsibly, and teaching them how irresponsibly,” he said, noting that oth- “The technology is not bulletproof. It’s to do so. … Then the true outliers, [the ers will continue flying without regard no more reliable than the technology people who] choose to operate irrespon- to overly complex safety rules if those your cell phone has. It’s built on the sibly, can be dealt with by regulation, rules do not make sense to them. Still same [location-sensing] circuitry that’s local ordinances and so forth.” others will continue flying their sUAS in your cell phone, and we all know how AMA has productive, longstanding contrary to safety rules and guidance many times a phone tells you you’ve got working relationships with many of “because they don’t care,” he said. ‘GPS lock lost’ and [you have to reboot] the associations representing industry “A lot of [sUAS] depend highly on because an application software locked segments in the domain of manned GPS [global positioning system] signals, up. People need to know how to handle aviation, including safety specialists and if that signal is lost — whether due emergent situations when they occur.” from commercial air transport and to some circuitry or other issue with the Because of an exemption in the FAA business aviation, he said. “But what we aircraft — the people don’t know how Modernization and Reform Act of 2012, find, by and large, is that they [typical- to fly the aircraft any other way. They AMA members’ activities with tradi- ly] have very little knowledge about or can’t manually fly the aircraft and keep tional RC model aircraft essentially will understanding of the hobby and how it [their operation] safe. So there are some continue in isolation from the forthcom- operates,” Hanson said. “There haven’t unique educational training and safety ing FAA regulatory changes focused on been model-airplane [vs.] manned- challenges with this community.” sUAS, he said. The language of the law aircraft incidents of any significant The AMA has been accustomed to refers in part to applicability to any orga- numbers. You can literally count them modelers adhering to its rules for the nization that has a proven community- on one hand. … [They’re] not seeing identification of owners of RC model based safety program and a long track model aircraft getting ingested into aircraft to enable retrieval of an aircraft record of effective safety management. engines. [They’re] not seeing model that inadvertently flies away from the AMA is concerned that no matter aircraft striking the windscreens of full- designated flying field, and to show how often the FAA places official scale aircraft. By and large, [they’re] not legal and ethical accountability for the policy-interpretation announcements in seeing model aircraft anywhere in the consequences of the operator’s actions the Federal Register prohibiting commer- manned aircraft environment.” and/or system malfunctions. The sUAS cial operation of the sUAS that people community should have an equivalent already possess, both the defiance of Unfamiliar Newcomer Traits method — perhaps a formal registra- rules and ignorant behavior seem poised Hanson links the spate of 2014 reports tion program with a registration num- to continue and potentially to increase alleging that an sUAS operator created ber for each sUAS aircraft, Hanson said. the risk for other airspace users. risks for a manned aircraft operation “We also believe that this com- “They’re being sold by the thou- to the emergence of newcomers to the munity — because of the potential for sands,” Hanson said. “We believe we technology who have not “grown up in flying in more sensitive areas — needs need education [now] — not in 2016 the model aircraft culture” and who, be- to be more accountable in terms of — so we’re going forward with that cause of ignorance, fail to operate safely. their education and training,” he said, education.”
16 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 COVERSTORY
small unmanned aircraft systems (UAS) — operating in the area. Ultimately, the U.S. vehicle came so close to a US Airways Federal Aviation Administration (FAA) inves- Bombardier CRJ200 near Tallahassee, tigated but was unable to identify the UAS or Florida, U.S., one day last March that its pilot. theA airline pilot was convinced the two aircraft In this instance, and a number of others like had collided. it in recent months, danger did not material- The pilot reported what he thought was a ize, Jim Williams, manager of the FAA UAS near midair collision to air traffic controllers, Integration Office, said in remarks earlier this who had no information about UAS — also year to the Small Unmanned Systems Business sometimes known as remotely piloted aircraft, Exposition in San Francisco. Nevertheless, he
© Tomacco/iStockphoto unmanned aerial vehicles (UAVs) or drones added that, in similar occurrences in the future,
BY LINDA WERFELMAN Moving IN © Peter Sobolev/Dreamstime.com © Peter
As UAS — authorized and unauthorized — work their way into the airspace, accidents and incidents are increasing.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 17 COVERSTORY
test flight, or being operated by a U.S. govern- ment agency on a public use flight.2 The NTSB’s 2007 final report on the first accident concluded that the probable cause was “the pilot’s failure to use checklist procedures” when switching from one ground control con- sole that was inoperable because of a “lockup” to another console at the same ground control station. In the process, the fuel valve on the General Atomics Aeronautical Systems MQ-9 Predator B was inadvertently shut off, causing the engine to lose power; the aircraft crashed in a remote area near Nogales, Arizona, on April 25, 2006 (see Table 1). U.S. National Transportation Safety Board Safety Transportation National U.S.
NTSB accident the results “could be catastrophic,” especially if a Lost Communication investigators examine small UAS aircraft is ingested into a jet engine. A preliminary report has been issued in a more the wreckage of a “What kind of injuries or damage could recent occurrence — a July 26, 2013, event in General Atomics be caused by one of these aircraft?” he asked. which a Sensor Integrated Environmental Re- MQ-9 Predator “More than you might think, even though they mote Research Aircraft (SIERRA) operated by B that crashed may weigh only a few pounds.” the U.S. National Aeronautics and Space Ad- near Nogales, As an example, he cited an incident in late ministration (NASA) Ames Research Center, Arizona, in 2006. 2013 when an unauthorized small UAS aircraft struck the surface near Prudhoe Bay, Alaska. — an open-rotor hexacopter — that had been Preliminary information indicated that, hired to film an event at the Virginia Motor about four hours into the planned six-hour Speedway in Jamaica, Virginia, crashed into a flight to assess sea ice during the melting season, spectator stand, causing several minor injuries. the aircraft briefly lost its Iridium satellite com- The operator told the FAA that he believed the munication link. When the connection was re- crash resulted from a malfunctioning battery. established, RPM and alternator warning lights With a growing number of UAS — autho- were illuminated on the ground control display, rized and unauthorized — in the skies, the and the aircraft entered a controlled glide until number of reported accidents, incidents and impact, the NTSB said. A preliminary report, near-midair collisions is slowly increasing. which said that the aircraft probably struck the An investigation earlier this year by The ice, added that there were no plans for recovery. Washington Post found that registered UAS The investigation was continuing. operators in the United States, including law Numerous pilot and controller reports enforcement authorities and universities, had to NASA’s Aviation Safety Reporting System reported 23 accidents and 236 unsafe incidents (ASRS) also discuss encounters with UAS that between November 2009 and June 2014.1 air carrier pilots characterized as uncomfort- A search of U.S. National Transportation ably close. Safety Board (NTSB) records reveals only a For example, the captain of a Bombardier handful of final reports on UAS occurrences, CRJ200 described an experience during ap- including three non-fatal, non-injury accidents proach to Newport News/Williamsburg (Vir- and three incidents between 2006 — when the ginia) International Airport in March 2013:3 first UAS accident in the United States was We were issued a clearance to descend to recorded — and 2009. In each case, the aircraft 4,000 ft. At that moment, I saw a target was either being flown on a demonstration or on our TCAS [traffic-alert and collision
18 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 COVERSTORY
avoidance system] about 4 mi [6 same altitude as it went from our 12 the small aircraft, and could not con- km] ahead at 4,000. I told … ap- o’clock position, and for about five firm whether it was a UAS aircraft and, proach about the target, and they seconds, it seemed to chase us … if so, if it was civilian or military. said they weren’t talking to that before suddenly turning back to our One month earlier, the first of- traffic. ... Then we caught the target 12 o’clock position. As it passed by ficer on a corporate jet was flying visually at 12 o’clock. I first thought … we observed it flying extremely an approach to Leesburg (Virginia) it was a hawk circling because it was erratically, in fact, so erratically that Executive Airport when, as he said in very small and maneuvering mostly we pilots believe it was a drone, due his ASRS report, “we got a TA [traffic in circles. A few seconds later, [it] to the excessive g [gravity] forces alert] followed by an RA [resolution took shape of an aircraft with wings. required to pull those maneuvers advisory] climb. … The captain spot- We told approach we were going that were almost continuous rolls, ted the unannounced aircraft closing to turn right to avoid hitting the loops, etc. on us from below and to the left. The aircraft. As we were turning, we Air traffic control (ATC) was unable to distance on the TCAS indicated 200 ft got within 2 ½ mi [4 km] and the give the captain any information about at the closest readout.4
U.S. UAS Accidents and Incidents, 2006–2013
Date Location Aircraft Type Event Severity 01/27/14 Point Loma, California General Atomics MQ-9 unavailable The aircraft was operated by CBP. No further information was available in the NTSB database on this occurrence. 07/26/13 Prudhoe Bay, Alaska SIERRA unavailable The aircraft, operated by NASA to evaluate the condition of sea ice, struck the surface after briefly losing its satellite communication link, according to a preliminary report. The investigation is continuing. 05/10/13 Cocoa Beach, Florida General Atomics MQ-9 Predator unavailable The CBP aircraft experienced a bounced landing and runway excursion. The NTSB said the probable cause was an “improper flare, leading to a nosewheel-first touchdown, which resulted in a pilot-induced oscillation.” 02/19/09 Sierra Vista, Arizona General Atomics MQ-9 Predator nonfatal The CBP aircraft touched down hard and porpoised several times during a training flight. The NTSB cited the student pilot’s “improper flare while landing with a tailwind and the instructor pilot’s delayed response.” 11/06/08 Sierra Vista, Arizona General Atomics MQ-9 Predator B nonfatal The CBP aircraft bounced several times while landing during a training evaluation mission. The NTSB said the probable cause was the pilot’s “failure … to timely flare the aircraft to the appropriate attitude.” 9/24/08 Whetstone, Arizona Raytheon Cobra incident The U.S. Army Corps of Engineers aircraft was testing a mapping camera and related technology when it crashed after losing engine power. The NTSB cited an overheated piston and the pilot’s “failure to send a proper command to the UAS.” 07/28/08 Colorado Springs, Colorado Raytheon Cobra incident The aircraft was on a Raytheon demonstration flight when it overshot final approach and crashed into a stadium light. The NTSB cited “the flight team’s failure to program the UAS with flight-tested parameters that could tolerate the high density altitude and tailwind conditions … and the existence of an undiscovered software anomaly.” 08/24/07 Whetstone, Arizona Raytheon Cobra incident The aircraft was one of two UAS aircraft being operated by Raytheon at an airstrip used for UAS test flights when it dove into the ground. The NTSB cited the “student pilot’s failure to follow proper procedures … which resulted in a loss of aircraft control.” 04/25/06 Nogales, Arizona General Atomics MQ-9 Predator B nonfatal The aircraft was being flown by CBP for border surveillance when it crashed in a remote area. The NTSB’s probable cause was the pilot’s “failure to use checklist procedures” when switching operational control from one ground control console to another.
CBP = U.S. Customs and Border Protection; NASA = U.S. National Aeronautics and Space Administration; NTSB = U.S. National Transportation Safety Board; SIERRA = Sensor Integrated Environmental Remote Research Aircraft
Source: U.S. National Transportation Safety Board
Table 1
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 19 COVERSTORY
The captain questioned ATC about whether in the matter and who said that the FAA did not the other aircraft might have been a UAS air- have authority over small UAS. The FAA is ap- craft, and in response, “a supervisor came on pealing the ruling. line to answer questions and only acknowledge that they were tracking via radar a VFR [visual ‘Sweeping Changes’ flight rules] target but didn’t say where it was.” In Australia, the “rapid growth in the popularity of so-called drones and a corresponding rise in Reckless Flying? the number of safety incidents” have prompted A number of recent near collisions involving the Civil Aviation Safety Authority (CASA) to UAS aircraft also have been reported, includ- begin a review of its rules for safe recreational ing a July occurrence in which two men were flying of remotely controlled model aircraft. accused of operating a UAS aircraft that nearly In 2002, Australia became one of the first struck a New York City police helicopter near nations to regulate UAS operations, and since the George Washington Bridge5 and a May then, “technology has seen sweeping changes report that crews of two airliners had spotted a in the types of remotely controlled aircraft that UAS aircraft flying nearby at 6,500 ft as they ap- are available,” CASA said. “There is concern proached Los Angeles International Airport.6 some people are flying their remotely controlled The UAS story that may have garnered the aircraft irresponsibly and are putting the public most attention was the FAA’s reckless-flying and other airspace users at risk.” penalty against Raphael Pirker, who in October The regulatory review will focus on sec- A senseFly eBee 2011 used a small UAS (with an aircraft weigh- tions of the Civil Aviation Safety Regulations similar to this one ing less than 5 lb [2.3 kg]) in making a promo- that discuss non-commercial UAS operations, was being used for tional video for the University of Virginia. CASA said. Separate regulations deal with aerial photography The FAA assessed a $10,000 civil penalty, commercial UAS. over a mining site in based in part on video that showed the UAS air- Australia when it had craft’s flight under bridges and over the heads of Separation Anxiety a close encounter pedestrians on the Charlottesville campus. How- In recent months, the Australian Transport with an agricultural ever, the penalty was dismissed by the NTSB Safety Bureau (ATSB) has issued a handful of spraying aircraft. administrative law judge who had jurisdiction UAS-related reports — most notably, three re- ports that discuss in-flight separation issues. The first of the three occurred Sept. 12, 2013, while the pilot of an Ayres S2R was en- gaged in aerial agricultural spraying near Hor- sham, Victoria. About the same time, the pilot of a senseFly eBee arrived at a neighboring mine site to conduct an aerial photography survey.7 The UAS pilot completed his pre-flight preparations and conducted a risk assessment, and then heard an aircraft operating about 1 km (0.5 nm) away. The UAS pilot “broadcast on the area frequency advising his intention to conduct unmanned aerial photography operations over the … mine site” and specifically addressed his message to the “ag aircraft operating northeast of [the] mine site.” Hearing no response, he asked the mine © senseFly manager to contact the farmer and request that
20 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 COVERSTORY
he advise the agricultural pilot of the having a diverse mix of aircraft operat- then made two abrupt turns — first UAS operation. ing in the same airspace and the need flying away from the helicopter and The farmer complied, telling the for all pilots and operators to remain then back toward it. As the helicopter pilot that “there would be an ‘aircraft’ vigilant and employ see-and-avoid began descending toward the helipad, conducting aerial photography” near principles.” the pilot saw the UAS aircraft “hov- one of the fields where he would be The UAS operator said that in the ering in position” just above it, the working, the report said. “The pilot as- future, he would insist on speaking di- ATSB said. The pilot’s transmissions sumed that this would be a fixed-wing rectly to the pilot of any aircraft known during the incident on the common aircraft operating at or above 500 ft to be operating in the same area where air traffic advisory frequency netted AGL [above ground level]. Accordingly, he plans to fly — an action endorsed by no responses.9 he intended to remain at or below 350 the ATSB, which said all pilots “need The ATSB’s final report quoted ft to ensure separation.” to recognize that small UAVs may be CASA as saying the UAS aircraft prob- In Australia, UAS aircraft must be difficult to see.” ably was a first person view vehicle operated at or below 400 ft AGL, unless The other two Australian incidents, equipped with a camera that “enables special approval has been granted for both of which occurred in March the operator to fly it remotely whilst operations at higher altitudes; in those 2014, were characterized as near colli- looking through either a pair of goggles cases, notices to airmen (NOTAMs) are sions. Both were categorized as serious or at a screen. … Use of these goggles filed with Airservices to inform other incidents involving “interference from does not provide a line of sight vision of pilots of the operations. the ground.” the UAV.” At one point, the UAS operator put In the March 19 incident, a de his aircraft in a holding pattern to avoid Havilland DHC-8 was in controlled Notes the crop duster, which was operating airspace at 3,800 ft AGL on approach 1. Whitlock, Craig. “Close Encounters: As between 100 and 150 ft AGL, the ATSB to Perth Airport when the crew Small Civilian Drones Get More Popular, report said. saw “a bright strobe light directly in the Near Misses Stack Up.” The Washing- Although the two aircraft came front of the aircraft,” the ATSB final ton Post. June 24, 2014. within 100 m (328 ft) of each other, report said. “The light appeared to 2. Individual NTSB accident reports are the Ayres pilot told investigators that track towards the aircraft, and the available at
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 21 22 | T on awetrunwayinJamaica. of visualcuesledtoanoverrun A strong tailwindandanabsence CAUSALFACTORS failure to conduct ago-around after reduced situational awareness and runway with a14-knot wind, tail their crew’sflight decision to land on awet Authority concluded (JCAA) that “the mishap,the Jamaica the Aviation Civil ran runway the onto arocky beach. aircraftthe was destroyed it when over passengers were seriously injured and nightthe of 22,2009.Fourteen Dec. old at inKingston, airport the Jamaica, down far beyond approach the thresh- Black Hole Shoved Intoa In arecently published report on maining runway after it touched not stop aircraft the on re the - 737-800could Airlines Boeing he crew flight of an American - for runway the markings at airport. the nonreflectivethe paint that used had been down zone lights and centerline lights; and absence of runway approach lights, touch- darknessairport; and heavy rain; the illusion were isolated the location of the that prolonged touchdown. the was low too and to make control inputs caused himto perceive that aircraft the by affected illusion avisual been that captain the tional Airport, might have at Kingston’s Norman Manley Interna - seconds of approach the to Runway 12 contributed to accident.” the aircraftthe longer floated than usual Contributing to “black this hole” The report said that last inthe FLIGHT FOUNDATION SAFETY base. Investigatorsbase. found “no obvious management flight in the system data- anddeck library that procedure the was for GPSapproach the was flight inthe way 30.The report noted that chart the (GPS) approach was available to Run- suitable positioning global system wind on Runway 30. circling approach and alanding into the minimumthe altitude prescribed for a reportedthe was ceiling, which to close The primarily decision was on based 12 despite wind and tail the rainfall. landing system) approach to Runway conduct astraight-in ILS(instrument The pilots were not aware that a Moreover, to crew the had decided BY MARKLACAGNINA |
WORLD AEROSAFETY | SEPTEMBER 2014
© Andrew P. Smith | Reuters CAUSALFACTORS
reason” why the crew was not aware of “The first officer said he had been surface winds from 310 degrees at 9 the approach. to Kingston many times before,” the re- kt, 5,000 m (about 3 mi) visibility in port said. “He had landed there at night thunderstorms and moderate rain, and Fatigue Suspected and in the rain.” a broken ceiling at 1,400 ft. Another possible factor was fatigue: The first officer, who was handling “Although the flight crew had just had Lights Out the radios, then asked the approach three days’ rest and their flight/duty/ The 737, being operated as American controller for an update on the weather rest times were within the required Airlines Flight AA331, departed from conditions at the airport. The informa- limits at the time of the accident, they Miami at 0122 coordinated universal tion provided by the controller was were at the end of the third flight of a time (UTC; 2022 local time) with 148 similar to that in the ACARS message, long duty day,” the report said. passengers and six crewmembers. The except that the ceiling had dropped to The pilots had flown a round-trip captain was the pilot flying. 1,000 ft. When asked about recent arriv- between Miami and Baltimore and had The flight proceeded uneventfully als, the controller said that one aircraft changed aircraft in Miami for the flight until turbulence was encountered at had landed within the past hour and to Kingston. 37,000 ft over Cuba. The pilots de- “didn’t have any problems coming in.” “The flight crew had been on duty scribed the turbulence as “fairly rough” for nearly 12 hours and awake for and “real bumpy.” In-flight service was Alternate Closed more than 14 hours, and it was almost suspended several times, and the cap- Jamaica’s Montego Bay Sangster Inter- ‘bedtime’ in their recent diurnal cycle,” tain told the cabin crew to prepare early national Airport had been filed as the the report said. “The flight crew [was] for landing. However, the turbulence flight’s primary alternate, but the runway possibly fatigued; however, the extent to subsided as the 737 neared Jamaica. at the airport was scheduled to be closed which this affected their performance Scattered thunderstorms and rain for maintenance shortly after the 737’s could not be determined.” had been forecast for Kingston. The estimated time of arrival at Kingston. The captain, 49, had 11,147 flight airport had a single, 8,911-ft (2,716-m) Thus, the aircraft was carrying extra hours, including 2,727 hours in type. runway that straddled a thin peninsula fuel for the possibility of diverting to the After earning an aeronautics degree, he jutting into the Caribbean Sea south of secondary alternate, Grand Cayman in worked as a flight instructor and then Kingston. Neither Runway 12 nor Run- the Cayman Islands, about 270 nm (500 as a pilot and operations director for a way 30 had a runway end safety area. km) northeast of Kingston. charter company. He was employed by The approach lights for Runway 12 “This brought the calculated land- American Airlines in 1986 as a 727 flight had been out of service for a month due ing weight on arrival at Kingston very engineer. He progressed as a 727 and to an underwater electrical systemWikimedia Joshua Lim | fault. close to the aircraft’s maximum landing McDonnell Douglas MD-11 first officer, “There was not much peripheral light- weight,” the report said. and then as a 727 and 737 captain. ing around the runway because of its Complicating the situation was that “He was familiar with Caribbean location across a peninsula with sea at the departure from Miami had been routes and had landed at Kingston both ends and the absence of a nearby delayed by the necessities of offloading on Runway 12 before during rainy settlement,” the report said. “A com- baggage belonging to a passenger who weather,” the report said. mercial power outage had caused the had not boarded the aircraft and then, The report did not specify the first airport to be operating on its standby after leaving the gate, of coordinating officer’s age but noted that he had 6,120 power generator. The outage resulted in with maintenance personnel on defer- flight hours, including 5,027 hours in even less than normal peripheral light- ring a malfunctioning air-conditioning type. After graduating from an aviation ing around the airport.” pack temperature controller accord- college, he worked as a flight instructor At 0248 UTC, the crew received ing to the provisions of the minimum and charter pilot. He was employed by an aircraft communications address- equipment list. American Eagle as an ATR 72 copilot in ing and reporting system (ACARS) Thus, the flight was behind sched- 1994 and was hired by American Airlines message containing a special weather ule. Just before beginning the descent in 1998 as a 727 flight engineer. He then observation for Kingston that was 20 to Kingston, the crew was told by progressed as a 727 and 737 first officer. minutes old. The observation included company dispatch that Montego Bay
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 23 CAUSALFACTORS
had closed. “Because of the fuel needed The aircraft configuration chosen by ‘Serious Warning’ to fly to [Grand Cayman], the crew the crew did not follow the recommen- At about 0304, the approach control- discussed making one approach into dations of the 737 operating manual, ler told the crew, “You may have to Kingston, and, if this approach missed, the report said. The manual states that circle to land. The wind, uh, three zero they would proceed directly to their a flaps 40 setting should be used when degrees at one zero knots.” Notably, the alternate,” the report said. landing with a tail wind, but the crew controller did not mention the GPS decided to use flaps 30. They also decid- approach to Runway 30 as an option. ‘Better Option’ ed initially to use the autobrake 2 setting, “Understand that,” the first officer While briefing for the arrival at Kingston, although the conditions at Kingston replied. “We can go ahead and, uh, the crew decided that due to the reported dictated using either the maximum take a straight-in.” 1,000-ft ceiling, conducting a straight-in autobrake setting or manual braking. Despite the reports of moderate ILS approach to Runway 12 with the tail Landing performance data provided rain at the airport, the crew at no time wind was a better option than circling to by the operating manual for a flaps 30 requested, and the controllers did not land on Runway 30. The published deci- landing show that at maximum landing provide, a runway condition report or a sion height for the straight-in approach weight, the 737-800 requires 6,795 ft braking action report. was 278 ft, and the minimum decision (2,071 m) on a dry runway, 7,814 ft The airport “lacked operational altitude for circling was 1,150 ft (1,140 ft (2,382 m) on a runway reported as wet procedures for the conduct of runway above airport elevation). or as having good braking action, 8,440 surface inspections during inclem- During post-accident interviews, ft (2,573 m) when braking action is fair ent weather,” the report said. “And the first officer told investigators that or medium, and 11,090 ft (3,380 m) the lack of agreements between the both the captain and he had con- when braking action is poor. airport, air traffic service and other ducted the ILS approach to Runway 12 The data also indicate that each users for the furnishing and distribu- many times. “In their interviews, both knot of a tail wind component increases tion of inspection results precluded [pilots] said there was no instrument landing distance by about 191 ft (58 m). flight crews from being apprised of approach to Runway 30 at Kingston,” Thus, a 14-kt tail wind would increase the most recent runway conditions the report said. landing distance by 2,674 ft (815 m). prior to arrival.”
Landing Sequence Key Events R12
KINGSTON HARBOUR PAPI Aircraft wreckage
Road to Port Royal KINGSTON HARBOUR
Over threshold R12 At 1,200 ft At 2,000 ft At 4,100 ft At 4,800 ft At 5,500 ft At 6,900 ft At 8,911 ft 148 KIAS, 162 KGS A/T o Throttle resolver First touchdown Brake pressure Max reverse Brake pressure Aircraft VS -11 FPS 162 KGS angle reduced N1 to 500 psi thrust to 3,000 psi departs end of 70 ft AGL VS -3 FPS decreasing from 60% At 4,300 ft (autobrake 3) 140 KGS (max manual) runway Autopilot OFF A/T ON 40 ft AGL 162 KGS Second touchdown 160 KGS 130 KGS 62 KGS N1 64% VS -4 FPS 148 KIAS, 162 KGS Glideslope >+1 dot 30 ft AGL N1 30% (idle)
AGL = above ground level; A/T = autothrottle; FPS = feet per second; KIAS = knots indicated airspeed; KGS = knots ground speed; PAPI = precision approach path indicator; PSI = pounds per square inch; VS = vertical speed
Source: Jamaica Civil Aviation Authority Aviation Accident Investigation Report JA-2009-09
Figure 1
24 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 CAUSALFACTORS
At 0314, the approach control- each wind check from ATC [air traf- autobrake setting. “Runway’s wet,” he ler cleared the crew to conduct the fic control] of less than 15 knots, they said. “You want to go to brakes three straight-in ILS approach to Runway 12 immediately responded that they would perhaps?” The captain agreed that they and advised that the runway was wet land with the tail wind, despite the heavy should select the autobrake 3 setting. and that the surface winds were now rain and the controllers’ querying of the from 320 degrees at 15 kt. The report intention to land on Runway 12.” ‘Feeling for the Runway’ noted that this was the crew’s second The aircraft encountered heavy rain but indication of an increasing tail wind. ‘Wet’ Runway no turbulence during the approach and The controller asked, “Are you able At 0317, the approach controller broke out of the clouds at about 1,000 to still land, uh, make a straight-in ap- handed off the flight to the airport tower ft. The captain disengaged the autopilot proach runway one two?” controller. On initial contact, the crew at about 550 ft but kept the autothrot- “We copy the wind, and we can reported inbound on the ILS at 2,800 ft. tles engaged. go straight-in to one two,” the first The tower controller reminded the Recorded flight data showed that officer replied. crew that the winds were from 320 the captain made several nose-up pitch- The cockpit voice recording con- degrees at 15 kt and said, “Confirm still control inputs as the aircraft crossed tained no discussion between the pilots requesting runway one two.” the runway threshold at 70 ft radio about the tail wind, the rainfall or the “That’s affirmative,” the first officer altitude, or about 20 ft higher than the runway conditions. Although the airline said. “Runway one two.” ideal crossing height (Figure 1). required pilots to conduct a landing The tower controller cleared the The autothrottle system was in the distance assessment when conditions crew to land on Runway 12 and advised speed mode and holding 148 kt (the change or deteriorate after a flight is that the runway was wet. The report reference landing speed plus 5 kt), re- dispatched, the flight crew did not do so. said that this was the first runway- sulting in groundspeed of 162 kt. Flight Investigators found that pilots arriv- condition advisory received by the crew data recorder (FDR) data confirmed a ing from the north generally preferred to and likely was based solely on the pres- tail wind component of 14 kt, as well as land straight-in on Runway 12 because ence of heavy rain at the airport. a left crosswind component of 7 kt. “it afforded a quicker and more conve- According to International Civil Avi- The captain disengaged the auto- nient procedure … and required less taxi ation Organization guidance, a runway throttles at about 35 ft and manually time to reach the terminal building.” reported simply as “wet” means that the moved the throttles to flight idle about Postaccident interviews revealed “surface is soaked, but there is no stand- 14 seconds after the aircraft crossed the that the 737 pilots previously had ing water.” The 737 operating manual threshold. At this point, the 737 was landed with tail winds on wet runways. indicates that a runway reported simply 3,800 ft (1,158 m) past the threshold A factor that might have influenced as being “wet” means that braking action and “floating” down the runway in a their decision making was that at no can be considered “good.” shallow rate of descent. time during the approach did the tail However, approach-briefing mate- “The FDR showed pitch-control wind exceed the company’s limitation rial provided to the crew contained a motions indicative of the captain ‘feel- of 15 kt. (The limit had only recently caution about the potential for stand- ing for the runway,’ and this prolonged been increased from 10 kt.) ing water on the runway when it rains the flare,” the report said. “The captain “The flight crew was concerned at the Kingston airport. Investigators did not appear to realize that the land- mainly with the tail wind being 15 knots found that neither company dispatchers ing was going to be long [and] the first or less, and the controllers appeared nor the 737 crew were aware of this. officer made no comment.” more concerned with the tail wind The report said that braking action at The 737 touched down 1,130 ft (344 conditions than was the flight crew,” the the time of the accident likely corre- m) beyond the touchdown zone and report said. “The tail wind reports … sponded to the airline’s characterization 4,811 ft (1,466 m) from the end of the should have triggered a serious warn- of “fair/medium,” rather than “wet/good.” runway. The aircraft bounced on touch- ing for the flight crew. … However, Nevertheless, the controller’s advi- down and settled again about 200 ft (61 they continued the approach without sory prompted the first officer to ask m) farther down the runway. The spoil- any discussion or extra briefing, and at the captain if they should use a higher ers and thrust reversers deployed, and
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 25 CAUSALFACTORS
fence, crossed above a road below the Boeing 737-800 runway level and came to an abrupt stop on the sand dunes and rocks between the road and the waterline of the Caribbean Sea,” the report said. The 737’s fuselage broke into three pieces, the nose landing gear and the left main landing gear collapsed, and the right main landing gear and the right engine were torn off the wing. Fuel leaked from the right wing tanks n 1964, Boeing began design work on a twin-turbine, short-range, narrow- onto the sand, but, probably due to the body airliner that could compete with the Douglas DC-9, the British Aircraft heavy rain, there was no fire. ICorp. One-Eleven and the Sud Aviation Caravelle. The result was the 737, The report said that none of the se- which shared many components and assemblies with the 727 trijet, and dif- rious injuries to the 14 passengers was fered from its competitors by having wing-mounted engines, a shorter fuselage life-threatening. The other 134 passen- and a wider cabin seating six abreast. It was the first Boeing airliner to have a two-pilot flight deck. gers either were unhurt or sustained The first model, the 737-100, entered service in 1968, followed shortly by the minor injuries. “None of the flight -200, both with Pratt & Whitney JT8D engines. Continuous improvement over the crew and cabin crew was seriously years has increased the airplane’s size, power, payload and performance. injured, and they were able to assist The “Classic” series — the -300, -400 and -500 models — was introduced in the passengers during the evacuation,” the 1980s. Boeing then began work on the “Next-Generation” 737s, which have the report said. larger wings, higher cruise speeds, transcontinental range, CFM56 engines and glass cockpits. The -600, -700 and -800 models entered service in the 1990s, and The JCAA issued several recom- the -900 and -900ER models followed in the next decade. mendations based on the findings The 737-800 entered service in 1998 with 27,300-lb (12,383-kg) thrust of the accident investigation (ASW, CFM56-7 engines and accommodations for 162 passengers in a two-class cabin 7–8/14, p. 8). Among them was that configuration or for 189 passengers in single-class. Maximum weights are flight crews of all transport category 174,200 lb (79,017 kg) for takeoff and 144,000 lb (65,318 kg) for landing. Typical aircraft should be required to conduct cruise speed is 0.789 Mach. Maximum cruise altitude is 41,000 ft, and maximum range is 3,115 nm (5,769 km). landing performance assessments About 7,900 737s had been delivered by the end of 2013. The -600, -700, -800 before each landing and that the as- and -900 models, as well as the business jet version, are currently in production, sessments should include at least a 15 and a new model called the 737 Max is scheduled to begin service in 2017. percent safety margin. Sources: Boeing, The Boeing 737 Technical Guide, The Encyclopedia of Civil Aircraft The authority also recommended that operators provide flight and ground training on the hazards of tail wind the autobrake system activated about The captain later told investigators landings and “firmly discourage” tail 4,311 ft (1,314 m) from the departure that he had considered initiating a go- wind landings on contaminated runways threshold. around when he first perceived that the or when heavy rain is falling. “The captain stated that the aircraft aircraft was not decelerating properly was not decelerating as expected us- but expected that it eventually would This article is based on Jamaica Civil Aviation ing autobrake 3, and he overrode the slow down. There were 2,111 ft (643 m) Authority Aviation Accident Investigation autobrake system, applying maximum of runway remaining when maximum Report JA-2009-09, “Runway Overrun on Landing, American Airlines Flight AA331, manual braking … and selecting braking was applied. Boeing 737-823, United States Registration maximum reverse thrust,” the report Investigators found no sign that the N977AN, Norman Manley International said. “He was joined by the first officer aircraft hydroplaned before it overran Airport, Kingston, Jamaica, (MKJP), 22 simultaneously applying maximum the runway at a groundspeed of 62 kt December 2009.” The report is available at
© Alan Wilson | WikiMedia Commons | Wilson © Alan manual braking.” at 0322. “The aircraft broke through a
26 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 Susan Reed W now and lack 2034,the of attention to seems be age hours 12.5million flight annually between turbine-powered business aircraft aver will Aviation Administration (FAA) predicts that operators. Considering that U.S. the Federal operators and have ignored business aviation exclusively on large, commercial air transport typicallyers have field inthis almost focused research academic persists because partly - organization remains achallenge —one that FLIGHTSAFETY.ORG the operationalthe setting of aspecific ing of health the asafety culture in interest inbusiness aviation, measur safetyhile culture is atopic of keen |
WORLD AEROSAFETY | SEPTEMBER 2014 BY CHRISTOPHERM.BROYHILL measuring safety culture in culture measuring business aviation. safety - Research constructs aim for better ways of ways better for aim constructs Research - operations produced no results. to assess safety culture inbusiness aviation and instrument designed cally validated survey culture. Essentially, search this for- ascientifi (IS-BAO) development in the of healthy safety Standard for Business Aviation Operations tion on effectiveness the of International the sources of as part my- planned disserta doctoral related literature academic and aviation industry culture measurement tools on market. the qualitythe of nonpublic, the proprietary safety operators may lack asound basis for evaluating more than aminor oversight. I reached conclusion this after surveying 1 One result is that 2 Moreover, the
CULTURESAFETY |
27 © Nova Development SAFETYCULTURE
search revealed no peer-reviewed studies on the definitions do not provide a way to measure safety culture in business aviation. the health of the safety culture. Hence, I saw the This led to a yearlong research project to need to focus on research constructs for better produce a scientifically tested measurement insights into safety subcultures. instrument for the assessment of business aviation safety culture. While the end result Brief Look Back was such an instrument, the research also This effort wasn’t the first to realize that produced some interesting results for students measurement of safety culture required going of aviation safety culture in general and of beyond definitions. One earlier project focused business aviation safety culture in particular: on individual behaviors, or constructs, inside it verified the presence of distinct, measurable of safety culture to validate a survey of com- constructs that reside within a healthy safety mercial aviation operations in 2006.5 That culture. Comprehending these constructs and instrument, the Commercial Aviation Safety the questions that define them may help avia- Survey (CASS), was designed to validate a safe- tion safety managers and other aviation leaders ty culture survey for airline operations based to better assess elements of safety culture in on a five-factor model that included organiza- their own organizations. tional commitment, management involvement, pilot empowerment, reporting systems and Safety Culture Defined accountability systems. The following constructs have been derived After distributing this instrument to the from a commonly agreed definition of the term pilots and managers of a large U.S. airline and safety culture. In a 2002 study commissioned analyzing the results, the researchers were by the FAA, a group of scholars surveyed and forced to revise their model to focus on four compared safety culture across several industries main factors within safety culture: organiza- and produced the following definition: tional commitment, operations interactions, formal safety system and informal safety “Safety culture is the enduring value and system. priority placed on worker and public safety In 2008, a different research team adminis- by everyone in every group at every level I saw the need to tered the revised four-factor CASS to the flight of an organization. It refers to the extent to operations department of a major European focus on research which individuals and groups will commit airline.6 Their analysis confirmed the existence to personal responsibility for safety; act to of a positive, effective safety culture within the constructs for better preserve, enhance and communicate safety organization by focusing on the constructs. concerns; strive to actively learn, adapt and insights into safety The same year, two researchers released an modify (both individual and organization- FAA-funded report highlighting their revised al) behavior based on lessons learned from subcultures. instrument, now called the Safety Culture mistakes; and be rewarded in a manner Scale Measurement System (SCISMS).7 Pres- consistent with these values.”3 ently, the SCISMS appears, from my literature In Implementing Safety Management Systems survey, to be the only industry-validated in Aviation, the authors define the term more instrument designed to measure safety culture succinctly. “Safety culture,” they say, “can be in aviation organizations. described as the values, beliefs and norms that In a related study, another research team govern how people act and behave with respect tested a four-factor model using an existing data to safety.”4 set from a major international carrier.8 While While both definitions provide an overall this model was unorthodox, their results proved context, they do not tell us how people in a that a four-factor construct fit the data better healthy safety culture act. More importantly, than a single-factor construct model.9,10
28 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 SAFETYCULTURE
Constructs in Subcultures Safety Subcultures When I realized there was a need to design an instrument to assess safety culture in business Subculture Key Attribute Key Behavior of Members aviation operations, my first step was to turn to The Informed Culture Knowledge They know what they need to know. the safety subcultures hypothesized by Alan J. The Flexible Culture Adaptation They can adapt when required. Stolzer, Carl D. Halford and John Goglia in their The Reporting Culture Information They tell what happened. 2008 work, Safety Management Systems in Avia- The Learning Culture Growth They learn from the lessons. tion, summarized in Table 1. While the names The Just Culture Expectation They know what to expect. chosen for these subcultures, their attributes and Source: Adapted from Safety Management Systems in Aviation by A.J. Stolzer, C.D. Halford and J. J. Goglia, 2008. key behaviors/constructs had appeared previ- Copyright 2008 by A.J. Stolzer, C.D. Halford and J. J. Goglia; used with permission. ously in other research, most notably the work Table 1 of risk theorist James Reason, the Stolzer team was the first to grasp the importance of the sub- that assessed the respondent’s opinion of the culture context and to group the five subcultures organization’s leadership. The respondents as part of a coherent safety culture description. answered all the safety culture and leadership These subcultures provided only the constructs assessment questions using a Likert scale (1 = I needed to describe the performance of people strongly disagree, 2 = disagree, 3 = slightly dis- inside the safety and a critical component — the agree, 4 = neither agree nor disagree, 5 = slightly measurable behaviors/constructs — needed for agree, 6 = agree and 7 = strongly agree). safety culture assessment in business measurable aviation operations. Test of First Instrument For the first test of my survey instrument, a First Instrument sampling frame was derived of the 44 IS-BAO– Entire textbooks have been written about registered business aircraft operators based in how to construct survey instruments that will the U.S. states of Illinois, Indiana and Wiscon- accurately collect the data they are intended sin. Fourteen operators agreed to participate, to collect. Question phraseology, question but 13 actually completed the survey. The data length, the order of questions and the response collection instrument was distributed to 162 mechanism for questions must be taken into respondents affiliated with the 13 participating account, for example. Once the instrument is operators. A total 101 responses were received designed, multiple pretests and evaluations are for a response rate of 62.35 percent. required to ensure that the instrument gener- The first test of the survey instrument was ates consistent data. Knowing that opportuni- promising in both its validity and its reliability. ties for testing would be limited, rather than Nearly all respondents reported no difficulty develop questions for the entire survey, the understanding the questions, and they agreed majority of my questions were adapted — with that the survey was valid in measuring both attribution — from an open-source version of safety culture and leadership. Measurements of the SCISMS and the Safety Culture Checklist the scale reliability in the subcategory human designed by Reason. behaviors/constructs were regarded favorably The result was a 40-question survey instru- as well. In every construct area but one, the ment. Five questions at the beginning collected survey satisfied the research community’s reli- data on the respondent and five questions at the ability criteria. end asked for the respondent’s opinion of the But most interestingly, when the survey re- survey itself. The remaining 30 questions were sponses were loaded into a principal component written to assess the five safety culture areas analysis, they did not group precisely according identified by the Stolzer team, five questions per to the five subculture areas described earlier. subculture, with an additional five questions Instead, they grouped into eight distinct areas,
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 29 SAFETYCULTURE
Subculture Grouping from First Survey Test
Improvement Sustainment Empowered Flexible Compliant Reporting Open Just Subculture Culture Culture Culture Culture Culture Culture Culture Culture Number of variables 4 6 3 2 4 3 4 4
Source: Christopher M. Broyhill
Table 2
only some of which aligned with the Second Test the subcategories’ individual behaviors/ original researchers’ hypothesis. Based To test the second version of my survey constructs are measurable so that a on the content of the survey questions, instrument, I targeted 116 operators in business aviation organization and its I renamed certain constructs within the California, New Jersey and New York, leaders can know the strengths and model. With these renamed catego- as well as three operators from the weaknesses of its safety culture. The ries, the survey answers (variables) energy industry not located in those descriptions of the final constructs are were distributed as depicted in Table states, for a total of 119 operators. Of in Table 4. 2. Questions devised to assess safety these operators, 18 agreed to partici- Measurement of these constructs culture leadership factors across three pate in the survey. Survey links were requires specifically targeted questions construct areas did not group into one forwarded to 376 respondents, and 232 that ask the respondents’ opinions area as expected. responses were received, a response rate about the aspects of their safety culture. of 61.7 percent. Some of the representative questions Second Instrument The results for the second instru- for each construct are: While the distribution of variables ment were even more encouraging in The Informed Culture — My across the new constructs in the the area of content validity. The respon- organization places high priority on first test was instructive, it was not dents typically reported that the survey training; conclusive, largely due to the limited measured safety culture and leadership, The Flexible Culture — My orga- sample size. I was still convinced that they said they found the questions were nization has a mechanism to approve the survey variables should group easy to understand and not biased, and deviations from existing guidance if into measurable, understandable con- they agreed the time required for the something unexpected happens; structs. This led to a review of results survey was optimum. Scale reliability The Empowered Culture — Line and a revision of the survey instru- for the behavior measurement areas/ personnel are actively involved in iden- ment to measure the original research constructs was higher as well, although tifying and resolving safety and/or op- team’s five subculture constructs and one construct area still did not achieve erational concerns in my organization; one additional area, the Empow- reliable status. Most encouraging was ered Culture, in which members of that a confirmatory factor analysis Revised Instrument the business aviation organization revealed that the hypothesized distribu- Variable Distribution
are given authority to recommend tion relationship in Table 3 held true Questions Measurement Area revisions to safety guidance and once the appropriate covariances were 1–5 The Informed Culture procedures, where appropriate. Ad- taken into account. In other words, the 6–9 The Flexible Culture ditionally, I tightened the focus on seven culture constructs appeared to 10–13 The Empowered Culture leadership and used three questions accurately represent the latent values to gather a limited measurement of inherent in the data. 14–18 The Reporting Culture the respondents’ views of their lead- 19–22 The Learning Culture ers. Rather than an even distribution Results and Application 23–27 The Just Culture of questions across measurement ar- So what is the takeaway from all this? 28–30 The Leadership Culture
eas in the revised survey instrument, Safety culture is measurable. Not only is Source: Christopher M. Broyhill I revised it to measure the subculture business aviation safety culture measur- areas as depicted in Table 3. able from an overall perspective, but Table 3
30 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 SAFETYCULTURE
in aviation (Kindle edition). Burlington, Revised Safety Subcultures Vermont, U.S.: Ashgate, 2011.
Subculture Key Attribute Key Behavior of Members 5. Gibbons, A.M.; von Thaden, T.L.; The Informed Culture Knowledge They know what they need to know. Wiegmann, D.A. “Development and initial validation of a survey for assessing The Flexible Culture Adaptation They can adapt when required. safety culture within commercial flight The Empowered Culture Influence They can make things change. operations.” The International Journal of The Reporting Culture Information They tell what happened. Aviation Psychology, 16(2), 215–238, 2006.
The Learning Culture Growth They learn from the lessons. 6. Von Thaden, T.L.; Kessel, J.; Ruengvisesh, The Just Culture Expectation They know what to expect. D. “Measuring indicators of safety cul- ture in a major European airline’s flight The Leadership Culture Facilitation They make the culture flourish. operations department.” The Proceedings Source: Adapted from Safety Management Systems in Aviation by A.J. Stolzer, C.D. Halford and J.J. Goglia, 2008. Copyright 2008 by of the 8th International Symposium of the A.J. Stolzer, C.D. Halford, and J.J. Goglia; used with permission. Also adapted from IS-BAO Implementation and Healthy Safety Culture: Australian Aviation Psychology Associa- Refining the Measurement of Perceptions by C.M. Broyhill. Copyright 2014 by C.M. Broyhill. tion, Sydney, Australia, April 8–11, 2008. Table 4 7. Von Thaden, T.L.; Gibbons, A.M. The safety culture indicator scale measurement The Reporting Culture — All per- IS-BAO– r egistered operators worldwide system (SCISMS). (Document no. HFD- sonnel can report safety discrepancies for periodic self-assessment. I plan to 08-03/FAA-08-2). Atlantic City, New without fear of negative repercussions; use the instrument to complete in 2015 Jersey, U.S.: FAA, 2008. The Learning Culture — If a safety research for the doctoral dissertation, as 8. Kelly, T. K.; Meyer, R. C.; Patankar. M. issue is raised, it will be communicated noted, on the effectiveness of IS-BAO (2012). Safety culture: Testing the safety to everyone in the organization; implementation and leadership in the culture pyramid with structural equation The Just Culture — Standards of ac- development of a healthy safety culture modeling. ( No. Grant # 08-G-014). St countability are consistently applied to in business aviation operations. Louis, MO: Center for Aviation Safety Research. all personnel in my organization; and, Chris Broyhill is the transportation director The Leadership Culture — Leader- at Exelon Corporation and a Ph.D. student. 9. Patankar, M. S.; Sabin, E. J. (2010). The ship encourages us to actively identify He has held leadership positions in aviation safety culture perspective. In E. Salas and D. Maurino (Eds.), Human Factors hazards and safety risks and when we organizations for over 30 years and has been in Aviation, second edition. Chennai, do, leaders take prompt action to inves- researching safety culture in business aviation for the last three years. India: Elsevier. tigate and mitigate them as practicable. As noted above, these questions 10. The model tested was a pyramid, first Notes hypothesized by Patankar and Sabin in measure respondents’ perceptions/ 2008, and it consisted of four distinct, 1. FAA. Forecast tables, FAA aerospace fore- opinions of the area assessed and in this yet interdependent, layers. “The base of cast fiscal years 2014-2034. Washington, instance, it is perceptions that matter. the pyramid included safety values and D.C.: FAA, 2014. These constructs are all elements of unquestioned assumptions that serve as organizational culture, and according 2. Due to their limited distribution, often the foundation of the model,” their report to one of the foremost authorities on at high cost, and their unavailability to said. “The second layer is described as academic researchers, such proprietary safety strategies and consists of leader- the subject, Edgar Schein, organiza- tools are unlikely to have been subjected to ship strategies, policies, procedures, tional culture is largely a function of the scientific rigor that would help assure their organizational norms, history, leg- perceptions of those involved. statistical validity and reliability. ends and heroes. The third level of the pyramid [represents] the safety climate 3. Wiegmann, D.A.; Zhang, H.; von Thaden, Next Steps of the organization and consists of the T.; Sharma, G.; Mitchell, A. Safety culture: short- and near-term set of attitudes In mid-2014, the International Business A review. (Technical Report no. ARL-02- and opinions surrounding safety. The Aviation Council (IBAC) was consider- 3/FAA-02-2). Atlantic City, New Jersey, apex of the pyramid [represents] safety U.S.: FAA, 2002. ing incorporating the latest safety culture behaviors and consists of individual and survey instrument into its safety culture 4. Stolzer, A.J.; Halford, C.D.; Goglia, J.J. group safety-related behaviors within the toolkit and distributing this toolkit to Implementing safety management systems organization.”
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 31 HELICOPTERSAFETY
A report cites ‘troubling evidence’ about some approaches to helicopter safety Bad in the North Sea energy industry..
Attitude © Niall Cotton BY LINDA WERFELMAN
32 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 HELICOPTERSAFETY
committee of the British Parliament says the industry as one of “macho bullying that it found evidence of a “macho, bully- exists with the tacit acceptance of the employ- ing culture” in the North Sea oil and ers,” an official of Oil & Gas UK — an industry gas industry, including one report that organization — described healthy collaboration Aworkers who expressed concern about the between the industry and the offshore workers. safety of the helicopters that transport them to Nevertheless, the report added that the official offshore platforms were told they should leave agreed that the “big-boy pants” remark “high- the industry.1 lighted the need to rebuild work force confi- Publication of the House of Commons dence and to improve communication between Transport Committee report in July followed the workers and managers.” release of two related documents: the U.K. Air The Transport Committee said in the Accidents Investigation Branch (AAIB) report report that it was “unacceptable that offshore on the 2012 ditching of two Eurocopter2 EC225 workers were told by an operations manager LP Super Pumas in the North Sea3 and the U.K. that they should leave the industry if they were Civil Aviation Authority (CAA) review of off- concerned about helicopter safety. In an inher- shore helicopter safety (ASW, 4/14, p. 33).4 ently hazardous industry, operations managers Besides the ditchings in 2012, three ad- must prioritise safety, which means facilitating ditional accidents involving North Sea helicop- a culture of approachability and openness at all ters — two of them fatal — have occurred since levels.” 2009 (“North Sea Helicopter Crashes, 2009– The CAA’s review did not thoroughly 2013,” p. 35). All of the accidents involved examine the effects of commercial pressures on Super Pumas, which make up about 60 percent helicopter safety, the committee said, adding, of the North Sea helicopter fleet, the report “The evidence that we heard was polarised, and said, adding that their numbers mean that “it commercial sensitivities mean that it is difficult is unsurprising that they are involved in more for most external reviews to examine the con- accidents than other models.” tractual obligations set by industry.” The House of Commons Transport Com- The committee recommended that the U.K. mittee opened its inquiry into offshore heli- Department for Transport conduct an inquiry copter safety after the most recent accident in that area as well as on the role and effective- — in which four of the 18 people aboard were ness of the CAA in regulating the industry. In killed when a Super Puma AS332 L2 crashed addition, the department should commission into the sea near Sumburgh, Shetland Islands, independent research on safety improvements on Aug. 23, 2013. and threats to safety in the industry, the com- During the inquiry, the committee “heard mittee said. troubling evidence” about the safety culture in Among the committee’s other recommen- the oil and gas industry, the panel’s report said. dations was a call for the CAA to ensure that “We were disturbed to hear that just weeks operators regularly review helicopter safety before the Sumburgh crash, workers who had information and ensure that it accurately raised concerns about the airworthiness of describes how equipment should be used. The Super Pumas were told by officials at the oil committee’s report cited preliminary AAIB company … to put on ‘big-boy pants’ or quit information about the August 2013 crash that if they could not deal with the risk of helicop- indicated that preflight briefing material “did ter crashes,” the report said. “That insensitive not fully represent” the type of underwater approach further eroded confidence in Super emergency breathing system available in the Pumas among the offshore work force.” helicopter for use in case of a ditching. As a The report said that, although a labor result, the report said, some crash survivors did union characterized the safety culture within not use the breathing equipment.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 33 HELICOPTERSAFETY
CAA Review the explanation, the CAA “must undertake a The Transport Committee report cited the joint review with its Norwegian counterparts to CAA’s review of offshore helicopter safety, uncover why more occurrences are reported in published earlier this year, for proposing dozens Norway, despite its smaller fleet.” of changes intended to bolster safe operations, The committee, noting that the offshore including prohibiting all but emergency flights industry “has little appetite for transferring during the most severe sea conditions, requir- more responsibility for helicopter operations to ing enhanced underwater breathing equipment a European level,” also urged the Department for for all passengers and establishing the Offshore Transport to “push EASA [the European Avia- Helicopter Safety Action Group to implement its tion Safety Agency] to improve its response and Each accident recommendations. implementation times” when it receives safety occurred after Nevertheless, the report added that the CAA recommendations from the CAA. should consult with the industry “to ensure its a loss of main demands are realistic and implemented in a AAIB Final Report way which continues to allow for maximising In its final report on the 2012 ditchings — dis- rotor gearbox economic recovery.” cussed in a single report because their circum-
oil pressure. Another Transport Committee recom- stances were so similar — the AAIB said that mendation noted that Norway’s offshore safety each accident occurred after a loss of main rotor record has improved over the past decade while gearbox oil pressure. In each case, the crew acti- the U.K.’s record has declined, and that the vated the emergency lubrication system on the CAA has said it can find no explanation for the EC225 LP Super Puma as required. divergence. “Both helicopters should have been able to The Transport Committee and the CAA fly to the nearest airport,” the AAIB report said. agreed, however, that there are differences in “However, shortly after the system had acti- the safety reporting culture in each country vated, a warning illuminated indicating that the — differences that the Transport Committee emergency lubrication system had failed. This described as “worrying.” Since 2008, more oc- required the crews to ditch their helicopters im- currence reports have been filed in Norway than mediately in the North Sea.” in the U.K., the CAA said in its review, adding Each ditching was successful, and no serious that this might indicate a greater occurrence rate injuries were reported to any of the 14 people in or a more active reporting culture (Table 1, p. the first helicopter or 19 people in the second.
36). The Transport Committee said that, to find In each case, the helicopters were flown by Gary Watt | Wikimedia Commons
34 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 HELICOPTERSAFETY
North Sea Helicopter Crashes, 2009–2013
.K. helicopters used in the North Sea offshore oil and gas industry have been involved in five crashes — two of which resulted in a total of 20 fatalities — since 2009. All five accidents involved variants of the Eurocopter1 Super Puma, and three were attributed to gearbox prob- U 2,3 lems. The five accidents were: • The Feb. 18, 2009, ditching of an EC225 LP near an oil platform located 125 nm (232 km) east of Aberdeen, Scotland. None of the 18 people in the helicopter was seriously injured. The U.K. Air Accidents Investigation Branch (AAIB) said the accident was a result of the crew’s erroneous perception of the “position and orientation of the helicopter relative to the [offshore] platform during the final approach” and an inoperative warning system (ASW, 11/11, p. 24). • The April 1, 2009, crash of an AS332 L2 into the North Sea 11 nm (20 km) northeast of Peterhead, Scotland. All 16 people in the helicopter were killed. The AAIB said the accident was caused by the catastrophic failure of the main rotor gearbox (ASW, 2/12, p. 36). • The May 10, 2012, ditching of an EC225 LP in the water about 34 nm (63 km) east of Aberdeen. There were no serious injuries to any of the 14 people in the helicopter. The AAIB said the accident was caused by a gearbox failure and a wiring/pressure switch configura- tion problem that led to a faulty warning light illumination. • The Oct. 22, 2012, ditching of an EC225 LP in the sea 32 nm (59 km) southwest of the The AAIB report Shetland Islands. None of the 19 people aboard was seriously injured. The AAIB said the acci- dent, like the May 10 ditching, was caused by a gearbox failure and a wiring/pressure switch said that a fatigue configuration problem that led to a faulty warning light illumination. • The Aug. 23, 2013, crash of an AS332 L2 into the sea while on approach to Sumburgh Airport crack in the vertical in the Shetland Islands. Four of the 18 people aboard were killed. The AAIB investigation is continuing. shaft of the main — LW gearbox bevel gear Notes 1. Eurocopter was rebranded in January 2014 as Airbus Helicopters. was to blame for 2. U.K. House of Commons Transport Committee. Offshore Helicopter Safety, Second Report of Session 2014 –2015. July 8, 2014. Available at
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 35 HELICOPTERSAFETY
— a training captain who was using the U.K. and Norwegian Occurrence Reporting Data, 2003–2012 flight as part of the revalidation of the Number of Events Reported Hours Flown captain’s line training qualification — Year Norwegian CAA U.K. CAA Norway U.K. had incorporated details of the accident
2003 5 223 44,233 73,139 into a scenario to be used in simulator training for other flight crews. 2004 8 149 41,786 69,674 The AAIB issued several new 2005 76,919 3 148 43,559 safety recommendations, including a 2006 3 208 44,815 71,755 call for EASA to review the installa- tion of the type of life raft used in the 2007 123 229 44,940 73,236 helicopter to ensure “a high degree of 2008 70,924 293 224 43,087 deployment reliability in foreseeable 2009 352 319 47,231 67,000 sea conditions.”
2010 556 293 52,651 69,662 Other recommendations involved the need for clear instructions on the 2011 427 253 53,862 77,610 packing and installation of rescue pack 2012 86,133 356 216 57,160 lines and mooring lines during life raft CAA = Civil Aviation Authority installation. After the second ditching, Source: U.K. CAA. CAP1145, Civil Aviation Authority — Safety Review of Offshore Public Transport Helicopter Operations in Support of the left life raft was fully inflated but the Exploitation of Oil and Gas, Annex C, Paragraph 8.3.1. February 2014. caught up in tangled rescue pack and Table 1 mooring lines, which were untangled by the copilot. Occupants of both heli- Nevertheless, because it was impos- said that early phases of the investiga- copters cut mooring lines because they sible for the flight crews to know that tion revealed no evidence of a technical feared that the life rafts were too close the system was working properly, ditch- problem and that investigators were to the helicopter and might be slashed ing was the appropriate, safe response focusing on operational aspects of the by the rotor blades. to illumination of the warning light, the flight, “especially on the effectiveness of report added. pilot monitoring of instruments during Notes the approach, operational procedures 1. U.K. House of Commons Transport Grounded and the training of flight crews.” Committee. Offshore Helicopter Safety, The two accidents prompted a 10-month Second Report of Session 2014–2015. July grounding of the North Sea fleet of Su- Fatigue Cracks 8, 2014. Available at
36 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 Multiple Aviation Industry Segments, One Message: Safety.
f the entire aviation industry should collaborate on one thing, it is safety. IAt a time of constrained resources, increased regulation and unprecedented scrutiny, the Flight Safety Foundation continues to be the leading advocate for safety and prevention of accidents, thereby saving lives. Show your commitment to the aviation community’s core value — a strong, e ective global safety culture. Join the Flight Safety Foundation.
“The Baby B’Air fl ight vest helps protect lap-held infants from the dangers of unexpected infl ight turbulence. Baby B’Air is proud to be a member of the Flight Safety Foundation and to support e orts across the industry to ensure fl ying remains the safest form of travel in the United States and around the world.”
— Greg Nieberding, Baby B’Air President
Flight Safety Foundation Member Enrollment Membership/Donations/Endowments BARS Program O ce Headquarters: Ahlam Wahdan Susan M. Lausch Level 6 | 278 Collins Street 801 N. Fairfax Street, Suite 400 membership services coordinator managing director of membership Melbourne VIC 3000 Australia Alexandria, Virginia U.S. 22314-1774 Tel.: ext. 102 and business development GPO Box 3026 Tel.: +1 703.739.6700 membership@ ightsafety.org Tel.: ext. 112 Melbourne VIC 3001 Australia Fax: +1 703.739.6708 lausch@ ightsafety.org Tel.: +61 1300 557 162 Fax: +61 1300 557 182 ightsafety.org Email: bars@ ightsafety.org TRAFFICCONTROL
ecent increases in reported losses of required minimum in-flight separation of aircraft, known as airproxes in a number of European countries, and of altitude devia- Rtions from air traffic control (ATC) clearances by flight crews, called level busts, generated enough concern that in June, the stakeholders convened a two-day Airborne Conflict Safety Forum in Brussels, Belgium. The numbers for both airproxes and level busts are small relative to traffic volume, but they are viewed as criti- cal safety indicators because of the severity of potential consequences, presenters said. “In European airspace with prescribed separation minima, there are approximately 150 losses of separation per million flights,” says the final report by forum organizers. “Since each flight receives on average 15 executive instructions in the en route environment, this is equivalent to one loss of separation per 100,000 instructions. … IATA [International Air Trans- port Association] safety data show 0.25 pilot level bust reports per 1,000 flights with 41 per- cent of these occurring during descent. Other data suggest that approximately 15 percent of Fluctuating rates of airproxes and level busts level busts may subsequently result in a loss of separation in busy airspace.” convince European stakeholders to share The 272 participants heard 23 presenta- analyses and refine countermeasures. tions offering insights at European and global levels, according to Tzvetomir Blajev, coordina- tor, operational safety improvement initiatives, an airborne collision advisory system (ACAS, Eurocontrol; organizer of the safety forum; and known in some countries as a traffic-alert and chairman of Flight Safety Foundation’s Europe- collision avoidance system or TCAS) will con- an Advisory Committee. The European Regions form to the procedures of the system’s design; Airline Association and the Foundation joined overcoming variations in requirements for ACAS Eurocontrol in arranging the event. Forum equipage and airspace access; and increasing videos, the agenda, digital slides and the final pilot notifications to air traffic controllers during report are available at no cost at Eurocontrol’s and after responding to an ACAS RA. SKYbrary website at
38 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 TRAFFICCONTROL
reduce the risk of pilots or controllers becoming confused by similar aircraft call signs, and im- prove adherence to professional discipline and mitigating techniques when similar call signs are BY WAYNE ROSENKRANS heard; provide European input to the interna- tional developers of ACAS X, the next genera- tion of automated collision-avoidance warning logic; and publicize emerging airborne conflict issues and recommended solutions.
Insights From Data In an average year, 160 airlines share air traffic management (ATM)–related flight operations data with Eurocontrol’s safety researchers, said Dragica Stankovic, EVAIR (European Voluntary ATM Incident Reporting) function manager at the agency. The region’s air navi- gation service providers (ANSPs) and states’ safety analysts supplement this with their data and analysis of issues such as call sign confu- sion and ACAS RAs. EVAIR recently focused on 2008–2013 level busts and ACAS RAs. “In the data repository, we found 12,000 reports … 0.4 percent of the EVAIR occurrences were identified as level busts and … 12.6 percent … as ACAS resolution ad- visories,” Stankovic said, noting that 11 percent
© siri-korn|VectorStock of level busts were followed by an ACAS RA. “It means that a further erosion of the separa- tion minimum was, in fact, prevented by the class; improve the functionality of short-term ACAS resolution advisory,” she said. The data conflict alert (STCA) technology in ATC traffic showed 57 airlines involved in level busts and 87 displays; and reduce risks of misinterpreting involved in ACAS RAs. ATC instructions by standardizing the responses For 2012, the year in which the largest to controllers from multi-crew flight decks number of level busts was reported during the regarding lateral or vertical clearances. five-year period, the rate was 0.35 reports per Forum participants urged government and 10,000 operations. “So if we have, let’s say, in industry to consider reducing the risk of level the summer season, 30,000 operations daily, busts by changing/harmonizing states’ designat- it means that in Europe … we had at least one ed transition levels (one or more altitudes above level bust daily, if not more,” Stankovic said. “In which all aircraft barometric altimeters must 2013, we recorded quite a good decrease of the be adjusted to standard sea level pressure for number of level busts. After drilling down to the ATC separation, a procedure prone to errors by base data, we saw that a good contributor to that pilots not used to the locally applicable aviation was the reduction of the call sign similarities … regulation); integrate human factors, procedures partly a result of the call sign similarity decon- and technology for a total systems approach fliction tool developed by Eurocontrol [and to airspace design; apply proactive methods to implemented by] about 20 airlines to date.” © Antartis|Dreamstime.com
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 39 TRAFFICCONTROL
In 49 percent of cases, ATC initi- Global Parallels About 68 percent of level busts ated avoidance action by other aircraft Gordon Margison, IATA’s assistant happen during short-haul operations, pilots when the level bust occurred. In manager, Global Safety Information compared with 28 percent during 53 percent, the aircraft involved were Center analysis, used the association’s long-haul operations, he said. Pilots converging from opposite directions; in Safety Trend Evaluation, Analysis and who spend most of their flight time in 42 percent, their tracks crossed. Data Exchange System to compare congested air traffic are more prone to Most level busts took place at about 400 level busts. “Indeed we do altitude deviations. “Most happened relatively low altitudes, from 2,200 ft to see an increasing trend,” he said. “We during a STAR [standard instrument Flight Level 180 (approximately 18,000 have more altitude deviations be- arrival procedure]. … Only 35 percent ft), and the majority of level busts that ing reported. … We have had a large showed that the altitude deviations hap- generated ACAS RAs occurred in the increase in the contribution from U.S. pened below 10,000 ft. … Maybe when upper airspace, Stankovic said, sug- [air] carriers.” This added information the pilots are below 10,000 ft, we have gesting a possibility of improving local most likely indicates an actual number quite robust procedures for maintain- airspace design. of level busts not just greater partici- ing situational awareness such as sterile “We have 11 percent of the level pation in the voluntary reporting of flight deck,” he said. busts where the traffic was, in fact, these events under airlines’ aviation In 89 percent of events studied by maintaining the [ATC-assigned] flight safety action programs, he said. IATA, the autopilot was engaged at the level,” she said. “In situations with un- “The descent [from cruise] and time of the level bust. Anomalies in stable atmosphere or severe turbulence, approach were major phases,” Margison some automated systems also made a we saw [losses] of altitude of more than said. “[Among] our top event types was difference, Buono said. “I don’t want 400 ft and also the [wake turbulence] ‘flight management.’ … Usually this was to get into an issue with manufac- impact of the super-heavy traffic.” a crew error, … a human factors issue turers here, but we still have a lot of Eurocontrol strongly encourages in the cockpit. Also related were … airplanes flying where, when you select flight crews to follow international ATM factors as well as weather; TCAS an altitude on your autoflight panel … standards and recommended practices response [as] a contributing factor to and you start playing with the vertical by refraining from high vertical rates some of our altitude deviations … de- speed selector … the altitude function when climbing or descending to an as- ficiencies in the [flight] documentation disarms and then the airplane will not signed flight level, she said. and data … provided to the flight crews automatically capture the altitude.” In 31 percent of level bust reports, and [in] their charts.” In 70 percent of level busts studied, there was a direct ATM involvement, IATA’s analysis found ATC fac- the pilot flying or the pilot monitoring and analysis of causal factors showed tors such as confusing clearances and recognized the altitude deviation and nearly one-third of those involving changes to clearances early in a flight. took corrective action. “However, in 29 problems in air-ground communica- In other cases, turbulence was the percent, [the level bust only] was recog- tion, she said. major factor. nized by ATC and only in 1 percent [it “Air-ground communication with Giancarlo Buono, a captain and IA- was detected] by an aircraft automated the hearback [controller’s message TA’s regional director, Safety and Flight system’s response,” Buono said. “These verification] omitted — [resulting in] Operations, Europe, said air crew flight data are quite comforting. … ATC misunderstanding and causing confu- management, air traffic management cleared [them] to continue, which means sion — is dominating as a contributing and weather, especially turbulence and that probably there was no immediate factor” in level busts, she said. Other tailwinds, are now the three main areas safety issue related to conflict. … Only issues are inadequate traffic information of concern. “The majority of the events 0.5 percent of the reports indicated that provided by ATC before the pilot selects were successfully managed and did not a reduced separation happened as a vertical climb/descent rates, mistakes by have any further consequences on the result of the altitude deviation.” planning controllers, and lack of timely flight,” he said. “In terms of immediate information from ATC to pilots about effects, we saw that the majority were U.K. Initiatives meteorological conditions that increase flight path deviations in the lateral area, Current initiatives to address level busts susceptibility to a level bust. but also some avoidance maneuvers.” respond to a “Significant 7” list of safety
40 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 TRAFFICCONTROL
2014, this increased to 36 incidents a month. It’s Breaking Down a Level Bust leveled off [as of June] but obviously that’s an area of real concern.” Based on CAA questionnaires completed he U.K. Civil Aviation Authority, through Airborne Conflict Safety by each flight crew following a U.K. level bust, Forum presenter Jacky Mills, cited the following example of a level Tbust (called an altitude deviation in some countries) for which the most frequent scenario is a correct pilot causal factors subsequently were mitigated. readback (message verification) followed by an “[This] level bust in our airspace caused a serious airprox [near incorrect pilot action. Further work is needed to miss] between a Cessna Citation departing from London City Airport assess causal factors, but pilots’ expectations that and a Boeing 777 inbound to Heathrow,” Mills said. “The London City ATC would assign a particular level to their air- DVR 4T SID [standard instrument departure, Dover] track coincides craft, high workload, distraction and conducting with the base leg turn for aircraft inbound to London Heathrow. The DVR 4T requires an initial climb to 3,000 ft, but, on this occasion, the weather-avoidance maneuvers were notable. privately operated Cessna [pilot] read back the clearance for 4,000 ft “Altimeter-setting errors is the next larg- and, unfortunately, the error was not noticed by the tower controller. est [scenario involved in a level bust] followed With no Mode S downlink of [the pilot’s] selected level, the controller by failure to follow the cleared SID [standard was not aware that the Citation was climbing above his cleared level instrument departure procedure] and then until, unfortunately, it had exceeded 3,000 ft. turbulence,” Mills said, pointing out the coinci- “[A Boeing 777 flight crew then] received a [traffic-alert and colli- sion avoidance (TCAS)] “descend” [resolution advisory (RA)] followed dence between days with significantly increased by a TCAS “reversal, climb” RA. The 777 [pilot flying] didn’t follow level busts and low atmospheric pressure caus- the initial “descend” RA but did follow the “reversal, climb” [RA] and ing a large difference relative to the standard sea only then reported the RA to ATC [air traffic control]. Meanwhile, the level pressure setting of 1013 mb (29.92 in hg). Citation [crew] had seen the 777 and — although they thought they “With the transition altitudes in the U.K. being would be well above it when they crossed — they subsequently lower than in a lot of countries, this can catch realized that they’d be quite close, so they changed their heading 30 degrees to the left. pilots out [unaware] if they are not very quick to “The Citation [pilot flying] was under the impression that the TCAS change their altimeter setting.” Unique proce- equipment was serviceable and reported that at about that time, he dures — such as stepped climbs in SIDs — and received a traffic alert. So the [two] aircraft actually passed with a lat- unusually low transition altitudes of 3,000, 5,000 eral separation of only 0.5 nm [0.9 km] and a vertical separation of only or 6,000 ft in U.K. airspace are being harmo- 164 ft. The U.K. Air Accidents Investigation Branch investigated this nized with other European states, but mean- incident, and they recommended that London City amend all SIDS to terminate [at] 3,000 ft and [the removal of] all step-climb procedures. while they remain a risk factor. I’m pleased to say these recommendations have been implemented.” “The U.K. airspace structure is also particu- — WR larly intricate with heavy traffic loads sharing limited airspace [see “Breaking Down a Level Bust.”],” she said. The CAA has been using risks derived from analysis of worldwide fatal Google Earth three-dimensional mapping to accidents and high-risk occurrences that involved identify level bust hotspots based on plotting large U.K. air transport airplanes, said Jacky Mills, four years’ worth of cleared altitudes vs. actual flight operations policy specialist at the U.K. altitudes for events extracted from 740 manda- Civil Aviation Authority (CAA). “Unfortunately, tory occurrence reports. airborne conflict is the only Significant 7 risk for CAA safety outreach includes a reminder which high-severity incidents have not reduced,” card for pilots and controllers. “An accurate she said. “There had been a gradual decline in location of the level bust event [in reports] with events [from 2009 until late 2013] … when they the precise name of the SID and/or the run- started to increase, and the trend [has been] go- way of departure would really help us,” Mills ing upward for six to seven months since then. said. “Pilots could help us by pressing [their This time last year, we were getting an average of transponder’s] IDENT button to register the 24 level bust events in a month, but by February location of a particular event. I would also like
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 41 42 | © Eurocontrol, Maastricht Upper Area Control Centre CONTROLTRAFFIC intervention. faster controller clearance, enabling pilot response toa “grace period”for typical 10-second clearance, stopsthe mismatched to Mode Sand,if through enhanced altitude selections “listens” topilots’ conflict alertsystem The short-term but another fails to aircraft observe positioned in climb or for instruction, descend whatever reason, means asituation acontroller inwhich issues a significant.”potentially very it problem is25,000. …So asmall but, of course, to provide separation are perhaps one inevery Errors where there was amajor requirement things that would else nobody evennotice. … [ATC instructions], but are they kinds the of in]probably[occur about one out 500 of every project. “Minor slips of judgment [or] memory from of beginning the amulti-year research of time,” the Edwards said, noting early insights Edwards, director, Homefield ATM Safety. work Management Directorate, joined by Mike Operations Management Division of Net the - ofhead Safety the Unit in Eurocontrol’s Network operational safety priorities, said Antonio Licu, areThese two of subgroup’s the current “Top 5” to Eurocontrol’s Safety Improvement Subgroup. adjacent between conflicts airplanes, according blind spots to each led asignificant number of standby —and inflight controller selected mode or with transponder the turned off or with its Flying with amalfunctioning transponder — Related Priorities didnotwhich result inalevel bust.” to encourage reports on …altitude deviations By term controller the blind spot Eurocontrol controllers“The get it right 99.9999percent conflict, planned route. …The fourth is solving apotential onewhen of aircraft the is not following its flight third, quite common, conflict-detect is failure to he doesn’t aircraft the see that’s way. inthe The that level. That and focus, becomes primary the [that controller the has] got to get aircraft the to aircraft to leave … at asector level so aparticular alized] Edwards second is [heavily said. “The procedur dard pattern of things the that all he should do,” thing …without else really following stan the just controller the focusing his attention on some conducivescenarios to such controller behavior. future Agroup conflicts. first imagined of experts exclusively focusing attention on potential the for of events actual studied to acontroller almost Researchers far so have attributed 65percent front of pilot the received who instruction. the involved an aircraft crew flight cleared for direct capable of updated being by controller. the Most either were not updating correctly or were not events involved ATC data flight displays that it he to,” when see needs he said. … He puts it to back of the his mind and doesn’t sciously about thinking that aircraft anymore. his or her sector, Edwards said. “He’s not con- issuing instructions to crew the of an aircraft in controllerthe assumes that jobis the done after controller error layered called filtering, inwhich where they’re going to be” is related to another airplanesthe are where actually they but rather craft] right infront of …not them with being simple” and data-block clarity. tools, defensive controlling, efforts at “keeping it probes data, flight separation-alert querying teamleagues, resource management, short-term data flight tines, display systems, proactive col- weredefenses) standard observed scanning rou- error (safety risk barriers Effective scenarios. about— talking or staffing whatever.” distraction ofsort …operational/nonoperational that’s right infront. And lastly, [there is a]general “The first one is attention“The grabber —literally On the technology side, technology 60percentOn the of the “Living future inthe —not [air the seeing groupThe expert looked then at ATC- actual FLIGHT FOUNDATION SAFETY constraints. This is requirement the for an thinking ahead, but ahead, thinking not one the seeing |
WORLD AEROSAFETY | SEPTEMBER 2014 - -
-
- TRAFFICCONTROL
The ability to see pilots’ selected altitude, magnetic heading, indicated airspeed in knots and Mach number via enhanced Mode S adds a safety layer at the Maastricht Upper Area Control Centre.
routing. “There may be a need for executive controller was not talking to the in knots and Mach number — appear ANSPs to focus on providing flight data pilot of either closing airplane. “It’s almost in an extendable label. New color-coded that better supports controllers in poten- like the controller’s worst nightmare,” Ed- warnings also help controllers to quickly tial conflict resolutions,” Edwards said. wards said. “The events themselves are so spot discrepancies between pilot actions The technique noted of imagining few, I’m pleased to say, [that we’re] getting and their ATC clearances. “Before … it scenarios and comparing them with into that difficult area of trying to break was not guaranteed that you would see actual scenarios was applied to mishan- down that last little bit of information — all the discrepancies,” he added. dled ATC coordination of aircraft mov- and that’s a whole new ballgame for us.” The Maastricht center also has elim- ing between adjacent sectors, including inated flight control strips, recognizing those of other ANSPs. Issues included ATC Technological Solutions that controllers have a fast-detection Centre Control Maastricht Upper Area © Eurocontrol, absent, incomplete or misunderstood Europe’s ANSPs have been active in advantage when they can keep their coordination; incorrect data entries; sharing their best strategies — including “eyes glued” to the enhanced labels premature transfer of an aircraft to the for use of technology — for level-bust on their displays. A 10-second “grace next sector, which precluded further risk reduction, said Kris Vermeiren, period” delay between receiving Mode ATC radio communication in case of Eurocontrol operational concepts and S data and presenting an active alert to a conflict (in one-third of events); late validation expert who spoke about the the controller allows the pilot time to transfer of an aircraft after it entered Maastricht Upper Area Control Centre, select the assigned altitude/flight level. the next sector, which precluded radio which is responsible for upper level Many pilots remain unaware that some communication by the new sector’s airspace over Luxembourg, Belgium, controllers now can see these in-flight controller in case of a conflict (in one- Netherlands and northwest Germany. data in real time, however, he said. third of events); and problems in silent STCA capability has proved valu- coordination because of flaws in an able since 1980, he said, but he called Notes agreement specifying the procedure. the value added by processing tran- 1. Forum materials include a 16-page report “Two thirds of such events in- sponders’ enhanced Mode S data “the listing 15 safety improvement strategies; volved … a failure to correctly apply a best invention since radar.” findings and recommendations; and basic standard procedure [and/or a failure] “For only two years, STCA also has background, objectives and outcomes of discussions. to coordinate,” he said. “Separation- been listening to the pilot-intent [data,] predictive tools, airspace incursion taking into consideration the selected 2. Sponsoring forum partners were the tools [and proactive colleagues] could altitude as provided by enhanced Mode International Civil Aviation Organization, the International Federation of Air Traffic prevent all those if they were deployed S data,” Vermeiren said. “This can Controllers’ Associations, U.K. CAA, U.K. and if they were used.” save valuable seconds to intervene.” NATS, IATA, European Cockpit Associa- Most disconcerting, he said, was that The extra data — selected flight level, tion and Direction Générale de l’Aviation in 36 percent of airborne conflicts, the magnetic heading, the indicated speed Civile of France.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 43 DATALINK
BY FRANK JACKMAN ATSB Report Shows Powerplant Problems Rare
owerplant problems comprise a relatively failure; a malfunction that affects the operation small portion of turbofan-powered aircraft of the aircraft; any technical failure that causes technical failures reported to the Aus- death or serious injury, leads to aircraft control tralian Transport Safety Bureau (ATSB) difficulties or seri- Technical Occurrences Involving Pbetween 2008 and 2012, according to an ATSB ously affects operation Turbofan Aircraft Transport Safety Report released in June. Of the of the aircraft; items 500 20,500 safety occurrences of all types reported that become detached Other technical to the ATSB by flight crews and operators of from the aircraft; and Powerplant 400 Australian civil-registered turbofan-powered air- a failure that causes craft during the five-year period, approximately fumes, smoke or 300 1,930 occurrences related to technical failures; fire, or leads to crew 200 of those, only 280 of the technical failures, were incapacitation. classified as powerplant occurrences, the ATSB During the 100 Number of occurrences said in its report (Figure 1). five-year period 0 The report, “Power Plant Failures in reviewed, the number 2008 2009 2010 2011 2012 Turbofan-Powered Aircraft,” is planned to be the of reported technical Year first in a series of research investigations exam- failures in turbofan- Source: Australian Transport Safety Bureau ining technical failures reported to ATSB over powered aircraft the five-year period. Other reports in the series fluctuated between a Figure 1 will look at airframe and systems issues affecting turbine-powered aircraft, and technical failures Air Transport High-Capacity Occurrences involving turboprops, piston-engine fixed-wing by Aircraft Type, 2008–2012 aircraft, and piston and turboshaft-powered Fokker F28/F100 (4%) helicopters, ATSB said. Embraer ERJ 190 (1%) Boeing 717 (2%) Embraer ERJ 170 (3%) Boeing 737 Classics (8%) Under Australia’s Transport Safety Inves- British Aerospace tigation Act and Regulations, technical issues BAE 146/Avro RJ (7%) must be reported to the ATSB if they constitute Airbus A380 (5%) Boeing 737 NG (15%) a transport safety matter, which can include anything that has affected, or has the potential Airbus A330 (8%) to affect, the safety of an aircraft. Powerplant- Boeing 747-300 (2%) related technical issues that occur from the time Airbus A321 (4%) an aircraft is being prepared for flight until all Boeing 747-400 (14%) crew and passengers have disembarked after Airbus A320 (17%) the flight must be reported when they include: Boeing 777 (1%) Boeing 767 (9%) a failure that prevents an aircraft from achiev- Source: Australian Transport Safety Bureau ing predicted performance during takeoff or climb; an uncontained or contained engine Figure 2
44 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 DATALINK
or fewer, or payload capability of 4,200 kg or List of Possible Engine/Airframe Combinations below); charter operation, which involves the in Australian Registered Aircraft carriage of passengers and/or cargo on non- Engine manufacturer Engine Model Aircraft scheduled flights for trade or commerce; aerial Textron Lycoming ALF502 British Aerospace BAE 146, work; flying training; and private. Canadair CL-604 The vast majority (91.4 percent or 256) Textron Lycoming LF507 Avro RJ of the 280 powerplant-related occurrences BMW Rolls Royce Aero Engines BR700 Boeing 717 reported during 2008–2012 originated from General Electric Company CF34 Embraer ERJ-170, Embraer ERJ-190 high-capacity aircraft. Figure 2 shows how those General Electric Company CF6 Airbus A330, Boeing 747, 256 occurrences break down by aircraft type. Boeing 767 The Airbus A320, the Boeing 737 Next Gen- CFM International, S.A. CFM56 Boeing 737 eration (-700 and -800 series) and the Boeing Williams International FJ44-1A Cessna Citation Jet 747-400 accounted for a combined 46 percent of General Electric Company GE90 Boeing 777 the occurrences, followed by the Boeing 767 at Pratt & Whitney Canada JT15D Cessna Citation I, V 9 percent, and the Airbus A330 and 737 Classics Rolls Royce Ltd RB211 (-524 D4, -524 Boeing 747, Boeing 767 (-300s and -400s), both at 8 percent. G2, -524H36) The turbofan-powered aircraft fleet op- Rolls Royce Ltd Tay 620 Fokker F28/F100 erating in Australia is varied and represents Rolls Royce Ltd Tay 650 Fokker F28/F100 a number of different possible airframe and Rolls Royce Ltd Trent 900 Airbus A380 engine combinations. For example, variants of Honeywell International Inc. TFE731 Learjet 31, Cessna Citation III the Rolls-Royce RB211 are found on both the International Aero Engines V2500 Airbus A320, Airbus A321 Boeing 747 and 767, and variants of the General Source: Australian Transport Safety Bureau Electric CF6 are found on both of those air- Table 1 frames, as well as on the Airbus A330 (Table 1). For the purposes of the study, ATSB catego- Powerplant-Related Occurrence Events high of 489 in 2011 rized the powerplant-related technical failures and a low of 321 in into one or more of 11 types of occurrence events Abnormal engine indications 2009. The powerplant (Figure 3). The most common type of event (53 Auxiliary power units occurrences remained percent of the total) related to abnormal engine Compressor stall fairly constant over indications. Reported abnormal engine indica- Engine controls the period, ranging tions related to any abnormal engine instrument from 52 to 66 occur- readings, such as engine power output or temper- Engine systems rences per year, or 13 ature, as well as engine overspeed or over-torque Oil loss to 15 percent of the warnings. Also falling into this category were any Partial power loss annual total of techni- general reports of engine problems or observa- Power plant other cal occurrences. tions of abnormal sights or sounds by a crew- Precautionary in- ight shutdown The powerplant- member, such as smoke or fumes in the cabin or Total power loss or engine failure (of a single engine) related occurrences cockpit, or excessive engine vibration. ATSB said Transmission and gearboxes originate from six that while many abnormal engine indications can 0 30 60 90 120 150 operation groups: air be insignificant or even spurious, 36 did result in Number of occurrences transport high capac- air-returns, and 34 of those necessitated a shut-
Source: Australian Transport Safety Bureau ity, which comprise down of the affected engine. aircraft certified as Failures related to auxiliary power units Figure 3 having a maximum (APUs) were the next most prevalent with 51 capacity of more than 38 seats, or having a occurrences of 18 percent of the total. APUs maximum payload capability that exceeds 4,200 are not part of the propulsion system on an kg (9,259 lb); air transport low capacity (38 seats aircraft; they are turbines and have components,
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 45 DATALINK
operating tempera- three in diversions. Two of the occurrences were Number of Powerplant Occurrences tures/pressures and uncontained engine failures. by Engine Model failure mechanisms ATSB broke down the data into occurrence that are similar to by engine model (Figure 4), but removed the CFM56 RB211 turbines used for APU occurrences. The data in Figure 4 do not CF6 propulsion. The take into account fleet size or hours flown and V2500 most common fault do not represent a rate of occurrences. Figure 5, Tay 650 associated with APUs however, shows the rate of powerplant occur- AF502 was smoke and/or rences by aircraft model per 10,000 hours flown. Trent 900 fumes in the cockpit ATSB stressed that the exposure data are ex- CF34 TFE731 or the cabin, typi- pressed in airframe flight hours and not engine BR700 cally as a result of a hours, and do not take into account the number LF507 contamination of the of engines per aircraft. The 747-300s and -400s, GE90 air conditioning as a the Airbus A380 and the BAE 146/Avro RJ are Tay 620 result of an APU oil four-engine airplanes, and the others are two- JT15D FJ44-1A leak. These kind of engine airplanes. Also, hours flown were not 0 10 20 30 40 50 events accounted for available for the aircraft undertaking charter op- Number of occurrences 29, or 57 percent, of erations, namely the Learjet 45, 36 and 35A; the the 51 APU events, IAI 1124; the Canadair CL-604; the Raytheon Source: Australian Transport Safety Bureau two of which resulted 400A; Cessna 560 and 525; and Hawker 900XP, Figure 4 in air-returns. so those aircraft are excluded from Figure 5. A total of 18 total APUs are included in the rate dataset because it Rate of Powerplant Occurrences power loss/engine is based on airframe hours flown. by Aircraft Model failures were reported Over the five-year period, the BAE 146/Avro to ATSB during the RJ had a rate of occurrences of 7.55 per 10,000 Boeing 717 study period. Two hours flown, which is more than twice as high as Boeing 737 Classics were the result of fuel any other aircraft in the dataset. The next closest Boeing 737 NG Boeing 747-300 starvation in cases was the Fokker F28/F100, with a rate of 3.63 Boeing 747-400 with sufficient fuel occurrences per 10,000 hours flown, and the 747 Boeing 767 on board that didn’t Classics (-300 variant), with a rate of 3.02 per Boeing 777 reach the engine. 10,000 hours flown. The ATSB cautioned that Airbus A320 Both cases were the the different aircraft models are operated by a Airbus A321 result of inadvertent wide variety of operators and that higher rates of Airbus A330 selections of the fuel occurrences could be a result of a better safety- Airbus A380 British Aerospace controls. One of the reporting culture. BAE 146/Avro RJ Embraer ERJ 170 events resulted in an Ninety-eight percent of the 280 powerplant- Embraer ERJ 190 air-return, and in the related events were classified as low-risk oc- Fokker F28/F100 other case, the fault currences indicating a low-risk outcome or no 0 1 2 3 4 5 6 7 8 was recognized, the accident outcome, four were classified as medium Occurrences per engine was restarted, risk, two as high risk and one as very high risk, 10,000 hours own and the flight contin- although none of them resulted in injury to pas- Source: Australian Transport Safety Bureau ued. Of the 16 other sengers or crew. The very high risk occurrence engine failures, four was Qantas Flight 32, an Airbus A380 bound for Figure 5 occurred at start- Australia from Singapore. One of the Rolls Royce up, two during takeoff (with both resulting in Trent 900 engines suffered an uncontained failure rejected takeoffs), and 10 in flight. Four of the that resulted in significant structural and systems in-flight shutdowns resulted in air-returns and damage (ASW, 9/13, p. 10).
46 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 INFOSCAN
BY RICK DARBY
Is there an alternative to studying accidents and incidents? Right Flight
BOOKS high as possible. It is the ability to suc- ceed under varying conditions. Safety–II Work-As-Done is achieved by trying to make sure that Safety–I and Safety–II: things go right, rather than by preventing The Past and Future of Safety Management them from going wrong.” Hollnagel, Erik. Farnham, Surrey, England, and Burlington, Vermont, U.S.: Ashgate, 2014. 200 pp. Figures, tables, glossary, index. Safety–I, Hollnagel says, has prevailed in risk Hardcover, paperback, ebook PDF, ePUB PDF. management since people started pursuing safety in a disciplined way. He discusses several ollnagel, professor at the University of phases of development. Southern Denmark, argues that it is time Hfor a new strategy in safety management. He distinguishes the new process, which he The Three Ages calls Safety–II, from the traditional one that he In what he calls the First Age, “the dominant names Safety–I. threats to safety came from the technology that Here is how he defines the two: was used, both in the sense that the technology … itself was clunky and unreliable, and in the • Safety–I: “Safety is the condition where the sense that people had not learned how system- number of adverse outcomes (accidents/ atically to analyse and guard against the risks. incidents/near misses) is as low as possible. The main concern was to find the technical Safety–I is achieved by trying to make means to safeguard machinery, to stop explo- sure that things do not go wrong, either sions and to prevent structures from collapsing.” by eliminating the causes of malfunctions This prevailed roughly from the beginning of and hazards, or by containing their effects.” the Industrial Revolution period in the late 18th • Safety–II: “Safety is a condition where century through World War II, and for some the number of successful outcomes is as years afterward.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 47 INFOSCAN
“The feeling of having mastered revealed in the Second Age and Third management and others removed from the sources of risks so that the safety of Age are adequate. He says, “While the task; that is at the so-called “blunt industrial systems could be effectively we can have some confidence in the end”) and Work-As-Done (by mainte- managed was rather abruptly shattered answers when the safety of technical sys- nance technicians, pilots and others at by the disaster at the Three Mile Island tems is assessed, we cannot feel the same the “sharp end” of an airplane). nuclear power plant [in central Pennsyl- way when the safety of the human factor “Seen from the sharp end, it is no vania, U.S.] on 28 March 1979,” Hollnagel or the organisation is assessed. The rea- surprise that descriptions based on says. This led to what he calls the Second son for that is simply that the questions Work-As-Imagined cannot be used in Age, which was marked by the study of a are less meaningful than for technical practice and that actual work is differ- new risk factor — human operators. systems, if not outright meaningless.” ent from prescribed work,” Hollnagel While a step forward in some ways, He argues that although techni- says. “But this difference is not at all human factors research too often led cal issues can be analyzed, and de- easy to see from the blunt end, partly to another misguided solution, namely, fenses against technical failure can be because it is seen from the outside writing the operator out of safety man- reasonably precise, the same cannot and from a distance, partly because agement as much as possible. “In the be said about people, still less about there is a considerable delay and partly general view, humans came to be seen organizations. because any data that might exist have as failure-prone and unreliable, and so Safety–I has led to huge success been filtered through several organisa- as a weak link in system safety,” Hollna- in risk reduction. There is no debate tional layers. … gel says. “The ‘obvious’ solution was to about the steep decline in commercial “We know from a long experi- reduce the role of humans by replacing aviation accident rates, particularly ence that it is possible to design even them by automation, or to limit the since the beginning of the jet era, or extremely complicated [technical] variability of human performance by the remarkably good safety record that systems in every detail and to make requiring strict compliance.” As will be continues in most regions of the world. certain that they work, by rigourously seen in the discussion of Safety–II, it is Hollnagel does not suggest, however, ensuring that every component func- precisely this variability that is now said that progress is being held back by tions according to specifications. to offer a key to further risk reduction. Safety–I practices. He says, “While Machines, furthermore, do not need Belief in the supreme efficacy of Safety–II represents an approach to to adjust their functioning because human factors design and procedures safety that in many ways differs from we take great care to ensure that their “lasted barely a decade.” Several events, Safety–I, it is important to emphasise working environment is kept stable including the space shuttle Challenger that they represent two complementary and that the operating conditions stay disaster, the explosion of a nuclear views of safety rather than two incom- within narrow limits.” reactor at the Chernobyl power plant patible or conflicting views.” in the former Soviet Union, and the Against Variability taxi-phase collision of two Boeing 747 Greater Complexity People at the sharp end are assumed to airliners at Tenerife, Canary Islands, Safety management has vastly expand- be equally capable of performing Work- “made it clear that the organisation had ed in complexity since the early indus- As-Imagined — and to be motivated to be considered over and above the trial age, when the goal was mainly to by encouragement or threat. Hollnagel human factor. see that equipment such as railroad says, “According to this way of looking “One consequence was that safety engines did not blow up or other- at the world, the logical consequence management systems have become a wise harm people and property. The is to reduce or eliminate performance focus for development and research, safety focus now includes operational variability either by standardising work and even lend their name to the Third systems and their interrelationships, … or by constraining all kinds of per- Age: ‘the age of safety management.’” maintenance, automation, organiza- formance variability so that efficiency tions and human psycho-physiology. can be maintained and malfunctions or Meaningless Questions? As a result, Hollnagel says, in Safety–I, failures avoided.” Hollnagel is not convinced that the a split inevitably arises between what is Hollnagel distinguishes between the attempts to counter the safety threats called Work-As-Imagined (by designers, terms tractable and intractable systems:
48 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 INFOSCAN
“A system is tractable if the principles of its people directly involved. Hollnagel says, “It functioning are known, if descriptions of it are is essential not to wait for something bad to simple and with few details and, most impor- happen, but to try to understand what actually tantly, if it does not change while it is being takes place in situations where nothing out of described. … A system is intractable if the prin- the ordinary seems to take place. Safety–I as- ciples of its functioning are only partly known sumes that things go well because people simply (or, in extreme cases, completely unknown), if follow the procedures and Work-As-Imagined. descriptions of it are elaborate with many details Safety–II assumes that things go well because and if systems change before descriptions can people always make what they consider sensible ‘It is essential not to be completed.” The more complicated a system, adjustments to cope with current and future the more intractable, and the less its aspects situational demands. Finding out what those wait for something involving humans can be fully specified. Some adjustments are and trying to learn from them bad to happen, but situations can only be resolved by variability can be more important than finding the causes determined ad hoc by humans. of infrequent adverse outcomes!” to try to understand Every successful operation, such as a safe The Unexpected flight, involves countless actions that go right. what actually takes For these reasons, and other issues discussed But how can those actions be studied? Many place in situations in the book, Hollnagel concludes that “people national safety authorities scarcely have the always have to adjust work to the actual condi- resources to investigate accidents and incidents where nothing out tions, which on the whole differ from what adequately, let alone investigate what seem like was expected — and many times significantly non-events. of the ordinary so. This is the performance adjustment or the Hollnagel suggests several techniques, pri- performance variability that is at the core of marily interviewing the people at the sharp end. seems to take place’ Safety–II.” He believes that this is feasible and likely to bear Whereas in Safety–I, the human factor was fruit because asking individuals about their suc- considered at best an unfortunate necessity and cessful procedures avoids any of their tendency at worst a threat to be damped down, Safety–II toward defensiveness. Interviews can include acknowledges the following: questions like these, he says:
• “Systems are not flawless and people must • “What do you do if something unexpected learn to identify and overcome design happens? For example, an interruption, a flaws and functional glitches; new urgent task, an unexpected change of conditions [or] a resource that is missing? • “People are able to recognise the actual de- mands and can adjust their performance • “Is your work usually routine or does it accordingly; require a lot of improvisation?
• “When procedures must be applied, people • “What do you do if information is missing, can interpret and apply them to match the or you cannot get hold of certain people? conditions; [and,] [and,] • “How often do you change the way you • “People can detect and correct when some- work?” thing goes wrong or when it is about to go wrong, and hence intervene before the “A Safety–II perspective will … require methods situation seriously worsens.” and techniques on [their] own to be able to look at things that go right, to be able to analyse how Sensible Adjustments things work and to be able to manage perfor- All these are examples of things that go right, mance variability rather than just constraining but they usually go unnoticed, even by the it,” Hollnagel says.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 49 ONRECORD Slip of the Tongue A trainee controller’s miscommunication placed two A319s in close proximity.
BY MARK LACAGNINA
The following information provides an awareness of problems that might be avoided in the future. The in- formation is based on final reports by official investigative authorities on aircraft accidents and incidents.
JETS
Radar Was Inoperative sufficient capacity to handle the additional Airbus A319s. No damage. One minor injury. traffic. The result was serious display malfunc- n unreliable air traffic control (ATC) tions that led to the radar system being declared radar system necessitating the use of ATC inoperative three days before the incident. Aprocedures that were unfamiliar to some “For three days, air traffic control at Ba- controllers, as well as thunderstorms prompting sel Mulhouse had been based on ‘procedures’ course deviations were among the factors that [which were not defined in the report] because created a high-stress, high-workload envi- of uncertainty about the reliability of the radar ronment in which a trainee controller issued display,” the report said. instructions that placed converging A319s at the The trainee controller and his instructor same altitude near the Basel Mulhouse airport had not previously used procedural control in Switzerland the evening of June 29, 2010. methods. And, although the radar system had A collision was averted when the flight been declared inoperative, they had their radar crews complied with resolution advisories (RAs) display on when the incident occurred. “The generated by their traffic-alert and collision simultaneous use of procedural control and an avoidance systems (TCAS). However, a cabin uncertain radar image increased the workload crewmember was slightly injured during abrupt of the controllers and may have helped create maneuvering by the crew of one aircraft. confusion about the positions of the aircraft,” The English translation of the final report on the report said. the serious loss of ATC separation, published by One of the A319s, of French registry, had the Bureau d’Enquêtes et d’Analyses (BEA) in May, departed from Runway 15 at the Basel Mul- said that the radar system problems had originated house airport for a scheduled flight to Paris and a few months earlier, when the Basel Mulhouse was climbing westbound. The other aircraft, approach control facility was assigned the respon- of Swiss registry, was inbound on a flight from sibility for coordinating air traffic in additional Palma, Spain, and was southwest of the airport, airspace transferred from an adjacent facility. descending to land. The central processing units in the Basel The flight crews of both aircraft had Mulhouse facility’s computers did not have requested and received clearance to deviate
50 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 ONRECORD
around thunderstorm cells. The A319s applied a nose-down input, chang- (Bahamas) International Airport on were on converging courses, and the ing the pitch attitude from 5.3 degrees Sept. 3, 2009. The flight crew shut trainee controller had planned to nose-up to 5.6 degrees nose-down. down the engine and pulled the fire resolve the conflict by instructing the A series of coordinated, correc- handle. crew of the French aircraft to stop their tive RAs then were generated aboard Eight of the 84 passengers sustained climb at 10,000 ft and to tell the crew of both aircraft. The French aircraft crew minor injuries during the subsequent the Swiss aircraft to stop their descent received a “descend, descend now” RA emergency evacuation, said the report at 11,000 ft. However, when he issued while the Swiss aircraft crew received a by the U.S. National Transportation the instructions within a period of one “climb, climb now” RA. Safety Board (NTSB). minute, he inadvertently assigned both The report said that the flight con- Investigators traced the fire to a aircraft the same altitude: 11,000 ft. trol inputs by the pilot of the Swiss air- B-nut that had been cross-threaded The report said that the trainee craft were more abrupt than necessary. on a fuel-supply coupling during believed he had assigned 10,000 ft to the “During these manoeuvres, the vertical the original assembly of the General crew of the French aircraft. He did not load factor recorded on [the Swiss Electric CF34 engine. The improperly detect the error when the crew read back aircraft] oscillated between – 0.19 g seated nut prevented engagement of a the faulty clearance. The trainee’s instruc- and 2.04 g,” the report said. “The minor metal seal in the high-pressure fitting, tor, who was handling additional duties injury to [the] cabin crewmember was leaving an O-ring to act as the primary at the time, also did not detect the error. due to the abrupt manoeuvres.” seal until it failed, causing fuel to be Several factors complicated the situ- The A319s came within 0.29 nm sprayed into the cowling. ation. The French aircraft was climbing (0.53 km) horizontally and 1,760 ft at 3,000 fpm, which the report called vertically of each other before the Anomalies Prompt Diversion “excessive.” In addition, TCAS traffic flight crews received TCAS “clear of British Aerospace 146-300. No damage. No injuries. advisories were generated aboard both conflict” messages. hortly after departing from Exeter aircraft at the same time a short-term The BEA concluded that “the loss (England) Airport for a cargo conflict alert was generated in the ap- of separation that characterized this Sflight to Belgium the night of proach control facility. serious incident was due to an error in Sept. 19, 2013, the flight crew saw the The trainee reacted to the alert by speech by the trainee controller … and “Freight Door Unlocked” warning light telling the crew of the French aircraft to the non-detection of that error by the illuminate and then heard loud noises stop climbing at 10,000 ft. However, the instructor controller.” emanating from the main cargo area. aircraft already was climbing through The investigation led to several “The pilots suspected that the two 10,600 ft when the pilot flying (PF) recommendations, including that the indications were connected and that the disengaged the autopilot and applied a French ATC authority issue clear in- aircraft had suffered structural dam- nose-down pitch input in response to structions on the use of radar imagery age,” said the report by the U.K. Air the trainee’s instruction. Simultaneously, when it is known to be unreliable or Accidents Investigation Branch (AAIB). a TCAS “maintain vertical speed” RA when procedural control is in use, and They declared an emergency, diverted was generated aboard the French air- that the International Civil Aviation to London Gatwick and landed without craft. The PF changed from a nose-down Organization study the feasibility of further incident. to a nose-up pitch control application. incorporating TCAS resolution maneu- Investigators found that the anoma- While this was happening, a “moni- vering in aircraft autoflight systems. lies were not related. The warning tor vertical speed” RA was generated light was triggered by a freight door aboard the Swiss aircraft. The report Fire Traced to Loose Nut latch proximity switch that was out of said that this RA prompted the crew Embraer 190-100. Minor damage. Eight minor injuries. adjustment. “The noises were prob- not to climb. However, the PF inad- fire erupted in the no. 1 engine ably caused by a flexible duct in the air vertently applied a nose-up pitch input cowling as the airplane was conditioning bay becoming detached,” while disengaging the autopilot, then A rolling out on landing at Nassau the report said.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 51 ONRECORD
TURBOPROPS
‘Inadequate Route Planning’ controller’s “failure to issue a safety alert regard- Beech King Air C90GT. Substantial damage. One fatality. ing the proximity of the tower.” fter deplaning passengers at Nemacolin Airport in Farmington, Pennsylvania, U.S., EFIS Goes Blank on Go-Around Athe morning of June 22, 2012, the pilot de- Jetstream 41. No damage. No injuries. parted for a visual flight rules (VFR) positioning he aircraft was on final approach to Wick flight to Morgantown (West Virginia) Municipal (Scotland) Airport the morning of Sept. Airport, about 20 nm (37 km) southwest, to T24, 2013, when the flight crew lost visual refuel the airplane. reference with the runway. “During the missed “The pilot had chosen a direct flight route approach, momentary blanking of the electronic near rising terrain and obstructions within a flight instrument system (EFIS) displays oc- designated mountainous area at his selected curred, but the standby instruments continued cruise altitude of 3,100 feet, which was below to operate normally,” the AAIB report said. the published maximum elevation figure of During the second approach, the copilot’s 3,500 feet depicted on the VFR sectional chart displays went blank, and the crew decided to di- for the area,” the NTSB report said. vert to Aberdeen Airport, where the weather was The King Air was at 3,100 ft when the pilot better. “During the diversion, VHF communica- established radio communication with an ap- tion difficulties were experienced, but the aircraft proach control facility. The controller assigned a landed without further incident,” the report said. transponder code and advised the pilot that the Investigators found that the avionics prob- airplane was in radar contact. lems had been caused by unrelated faults. The The King Air was about 9 nm (17 km) from blanking of the copilot’s EFIS displays and the the Morgantown airport when the pilot descended VHF communications difficulties were caused to 3,000 ft. Shortly thereafter, the airplane struck a by a loss of electrical power to the right essential 3,089-ft communications tower and descended to bus bar. The transient blanking of the pilot’s the ground. displays was caused by the failure of transzorbs, “Aeronautical charts found on board the which are installed in the windshield heating airplane depicted the tower hazard, so the system and designed to protect avionics equip- pilot should have had some awareness of the ment from static. tower’s presence,” the report said, noting that the collision might have occurred in instrument ‘Don’t Pitch Up’ meteorological conditions. A witness near the Cessna 208B. Destroyed. One fatality. Cessna 207. Substantial damage. No injuries. accident site described the weather as “cloudy with lightning and thunder.” he Caravan and the 207, operated by differ- Investigators found that the terrain-inhibit ent charter companies, departed about the mode for the airplane’s enhanced ground- Tsame time from neighboring remote villages proximity warning system (EGPWS) had been for positioning flights on similar routes to Bethel, engaged. This prevented the system from gener- Alaska, U.S., the afternoon of Sept. 2, 2011. ating any visual or aural warnings. “While en route, the Cessna 207 pilot talked NTSB concluded that the pilot’s “inadequate with the Cessna 208B pilot on a prearranged preflight route planning” was the probable cause radio frequency, and the two agreed to meet up of the accident and that contributing factors in flight for the return to their home airport,” were his improper use of the EGPWS and the the NTSB report said.
52 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 ONRECORD
The 207 pilot told investigators that she was wings and cockpit on the right side of the 207 in cruise flight at 1,200 ft when the Caravan flew and felt an impact with the right wing. into position on the left side. “Then, unexpect- The Caravan descended steeply in a nearly edly and unannounced, the pilot of the Cessna vertical nose-down pitch attitude and struck ter- 208B maneuvered his airplane above and over rain near Nightmute, Alaska. The 207 pilot was the top of her airplane,” the report said. unable to maintain level flight and conducted an The 207 pilot radioed that she could not see emergency landing on the tundra. the Caravan and was concerned about its posi- Investigators determined that the Caravan’s tion. The Caravan pilot replied, “Whatever you vertical and horizontal stabilizers had separated do, don’t pitch up.” She then saw the Caravan’s from the airplane after striking the 207’s wing.
PISTON AIRPLANES
Engines Starved for Fuel engine power on the right engine and a partial Cessna 421B. Substantial damage. No injuries. loss of engine power on the left engine due to bout 10 minutes after departing from fuel starvation.” Fairhope, Alabama, U.S., for a VFR flight Ato Selma the afternoon of Sept. 29, 2012, Brake Fails on Landing the pilot repositioned the fuel selectors for both Piper PA-31P. Substantial damage. No injuries. engines from the main tanks to the auxiliary he pilot said that shortly after the Pressur- tanks. He told investigators that later, when ized Navajo touched down on the runway he initiated a descent from 4,500 ft, the right Tat Doylestown (Pennsylvania, U.S.) Airport engine started to “cough and lose power.” the morning of Sept. 8, 2013, the left brake The pilot said that he repositioned the fuel se- pedal “went to the floor.” lector to the main tank, but the engine lost power “He tried pumping the brakes to regain left completely. He was unable to restart the engine. braking action but was unsuccessful,” the NTSB “The pilot did not select the [auxiliary] fuel boost report said. The landing gear collapsed when the pump to ‘low’ per the checklist, and as a result the Navajo veered off the runway and came to a stop system may have provided too much fuel to the in a grassy area. The pilot, alone in the airplane, engine for a restart,” the NTSB report said. was not hurt. About two minutes after feathering the pro- “Post-accident examination confirmed that peller on the right engine, the left engine began to the left brake was inoperative and revealed a small lose power. “The airplane continued under partial hydraulic fluid leak at the shaft of the parking power on the left engine for about six minutes, brake valve in the pressurized section of the cab- when the pilot realized that the airplane had in,” the report said. “Air likely entered the brake descended down to 800 feet,” the report said. line at the area of the leak while the cabin was The pilot decided to land the airplane on a pressurized, rendering the left brake inoperative.” dirt road about 6 nm (11 km) from the Selma air- port. After touchdown, the 421 crossed a bridge, ‘Classic VMC Stall’ clipped a tree and came to a stop in a cotton field Piper Aztec. Destroyed. One serious injury. with substantial damage to the right wing. The he Aztec was about 100 ft off the ground pilot and his three passengers escaped injury. on takeoff from Truckee-Tahoe (California, NTSB concluded that the probable cause TU.S.) Airport the morning of Sept. 21, 2011, of the accident was “the pilot’s improper fuel when the left engine lost power. The pilot told management, which resulted in a total loss of investigators that the airplane rolled left and
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 53 ONRECORD
entered a “classic VMC stall.” (VMC is defined as problem. “However, even though the left the minimum control speed with the critical engine may have been running rough and not engine inoperative.) producing full takeoff power, the right engine The Aztec descended onto an airport park- was operating properly, and if the pilot had ing ramp and was destroyed by fire. The pilot maintained airspeed at or above the airplane’s sustained serious injuries. minimum controllable airspeed, he should Investigators found that particles of paint have been able to maintain control,” the report clogging a fuel nozzle likely caused the engine said.
HELICOPTERS
Somatogravic Illusion The NTSB report said that the helicopter Bell 407. Substantial damage. One fatality. operator’s “incorrect maintenance procedures he pilot was engaged in transporting and inadequate inspections” were contributing passengers across a lake near Abingdon, factors in the accident. Among the mainte- TVirginia, U.S., on Aug. 24, 2012. Night had nance discrepancies was the use of a corrosion- fallen when a boater saw the helicopter de- inhibiting compound, rather than the grease plane passengers and then lift off, turn toward specified in the maintenance manual, and an the lake and descend along an embankment. incorrect torque value during installation of the The witness said that the landing light was not upper rod ends in the servos. on when the skids subsequently contacted the In addition, the inspection procedures pro- water and the helicopter flipped over. vided by the helicopter manufacturer were found “Security camera video footage revealed to be insufficient. “The 600-hour inspection called that the pilot had successfully conducted this for checking the radial play of the end bearings,” low-level, rapid-acceleration takeoff profile the report said. “However, there were no instruc- several times during the day, when visual spatial tions to specifically check the threads of the servo references were plentiful,” the NTSB report said. end fitting or the torque of the rod end nut.” “The pilot’s decision to attempt such a takeoff at night without the aid of ambient light or the use Crash During Bird Avoidance of helicopter lights denied him the visual spatial Bell 206L-3. Substantial damage. Two minor injuries. references needed to assure safe terrain and he LongRanger was engaged in a public use obstacle avoidance.” flight to check a radiological monitoring The report said that the pilot likely expe- Tsystem the afternoon of Sept. 7, 2013. The rienced a type of spatial disorientation called helicopter was in cruise flight about 300 ft above somatogravic illusion, in which acceleration is ground level near Amistad, New Mexico, U.S., perceived as an increasing nose-up pitch attitude when the pilot saw several large birds ahead. and can result in nose-down pitch inputs. The pilot initiated a steep right turn to avoid the birds. “He subsequently noted an increase Rotor Blade Separates in main rotor speed and adjusted accordingly,” Aerospatiale AS355 F1. Substantial damage. One fatality. the NTSB report said. “The pilot rolled out on he helicopter struck terrain in West Wind- a reciprocal heading, leveled the helicopter and sor, New Jersey, U.S., after a main rotor began to slow down. He noticed that the descent Tblade separated during a positioning flight rate was not decreasing even though appropriate the afternoon of Sept. 15, 2012. Investigators control inputs had been made.” found that the upper rod end on the fore/aft The helicopter touched down hard, bounced servo had disconnected due to severely worn and came to a stop about 300 ft (91 m) from the threads in its fitting. touchdown point.
54 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 ONRECORD
Preliminary Reports, June 2014
Date Location Aircraft Type Aircraft Damage Injuries June 1 Middletown, Ohio, U.S. de Havilland DHC-6-200 minor 1 fatal The Twin Otter was parked with its engines operating, waiting for skydivers to board, when an employee of a fixed base operator was struck by a propeller while walking toward the cockpit. June 2 Bahía Solano, Colombia Beech King Air B200 substantial 3 serious The King Air was landed gear-up on a prairie after losing power on takeoff. June 3 Moscow, Russia Ilyushin 96-300 destroyed none A fire that started in the cockpit eventually consumed the IL-96, which was in storage at Sheremetyevo Airport. June 4 Newark, New Jersey, U.S. Boeing 777-300 substantial none The 777 was parked at a gate and was being prepared for a flight with 335 people aboard when it was struck by a catering truck that became wedged beneath the rear fuselage. June 8 Olsztyn, Poland Antonov 2T substantial 2 serious The biplane was returning from a skydiving flight when it struck trees on approach. June 11 Gulf of Mexico Bell 206-L4 destroyed 2 fatal A witness saw the LongRanger spin several times before it descended into the water on approach to an offshore platform. June 13 Aruanã, Brazil Cessna 525 substantial 7 minor The nose gear collapsed when the CitationJet overran the 1,280-m (4,200-ft) runway on landing. June 13 White Plains, New York, U.S. Piper PA-46-500TP destroyed 1 fatal The Meridian struck trees and crashed near a house shortly after taking off in instrument meteorological conditions including 1/4 mi (400 m) visibility in fog and a 200-ft overcast. June 15 Fresno, California, U.S. Lockheed SP-2H substantial 2 none The Neptune tanker was returning to Porterville after a fire-fighting mission when the hydraulic system failed. The flight crew diverted to Fresno and manually extended the landing gear. However, the nose gear collapsed on landing. June 17 Lydenburg, South Africa Cessna 208 destroyed 3 fatal, 2 serious The Caravan was on a training mission for the South African air force when it crashed in the Misty Mountains. June 17 Sula, Montana, U.S. Grumman G-21A destroyed 1 fatality A witness at a ski resort located in a mountain pass at 7,000 ft said that visibility was about 1/4 mi (400 m) in snow when she saw the Goose flying just above the trees and then enter a spin and descend vertically into a parking lot. June 18 Huntsville, Alabama, U.S. IAI 1124A Westwind destroyed 3 fatal Visual meteorological conditions prevailed when the Westwind entered a steep right turn about 100 ft above the ground on takeoff and descended into a cotton field. June 19 Egegik, Alaska, U.S. Cessna 208B substantial 1 minor The Caravan struck a container while taking off from a beach near Egegik. June 23 Elpe, Germany Learjet 35A destroyed 2 fatal The Learjet was participating in a training mission with two Luftwaffe Eurofighter Typhoons when it collided with one of the fighters and crashed out of control. The damaged fighter was landed without further incident. June 23 Texarkana, Texas, U.S. Airbus AS350-B2 substantial 4 none The helicopter was on an emergency medical services flight and was nearing the destination at 1,000 ft when the pilot received a warning about excessive rotor speed. The main rotor blades struck the tail boom when the pilot conducted an autorotative landing in a farm field. June 24 Peshawar, Pakistan Airbus A310-324ET NA 1 fatal, 2 serious The A310, inbound on a scheduled flight from Saudi Arabia, was struck by ground fire while landing in Peshawar. A passenger was killed and two cabin crewmembers were injured by bullets. June 26 Creve Coeur, Missouri, U.S. Cessna 414 destroyed 1 minor The pilot reported a problem with the cargo door shortly after takeoff and turned back to the airport. The 414 stalled and crashed in a wooded area after an engine apparently lost power during the subsequent approach.
NA = not available This information, gathered from various government and media sources, is subject to change as the investigations of the accidents and incidents are completed.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2014 | 55 SMOKEFIREFUMES
Selected Smoke, Fire and Fumes Events, January–March 2014
Flight Date Phase Airport Classification Subclassification Model Operator Jan. 4 Cruise — Buffets/galleys Smoke Boeing 737 Delta Air Lines During flight, smoke and fumes were reported in the cabin and cockpit, and the aircraft was diverted. Maintenance found the forward galley oven with a burned electrical odor, replaced the oven and performed an operations check. The aircraft was approved for return to service. Jan. 8 Cruise Detroit, Michigan, U.S. (DTW) Hydraulic reservoir, main Smoke Boeing 737 Southwest Airlines The flight crew declared an emergency on departure, after a flight attendant reported smoke and fumes in the cabin. The crew performed quick reference handbook (QRH) procedures, and the smoke dissipated after the pack was selected “OFF.” The airplane returned to DTW. Maintenance removed and replaced the hydraulic reservoir, air pressure module and left coalescent bag in accordance with the maintenance manual. Jan. 10 Cruise — Humidity control system Smoke Airbus A300 Federal Express Smoke appeared in the cockpit with no electronic centralized aircraft monitoring (ECAM) indications, and the aircraft was diverted. During touchdown, an ECAM warning for avionics smoke illuminated and then extinguished. Maintenance personnel found excessive deicing fluid in the main wheel well while accessing the air conditioning pack bay and cleaned the wheel well. Maintenance inspected left and right pack coalescer bags, found both very dirty and replaced them in accordance with the maintenance manual. They ran both engines with both packs operating for 35 minutes with no noticeable fumes or odors noted. They completed the avionics smoke detection system check in accordance with the maintenance manual; the check was normal. Jan. 11 Cruise — Cabin cooling system Smoke Embraer 145LR Atlantic Southeast Airlines The crew reported smoke in the cockpit and cabin during flight. Passengers heard metallic grinding near Row 11 and smelled an electrical burning odor. The aircraft was diverted and landed without incident. Maintenance removed and replaced the no. 2 air cycle machine (ACM). It was operations tested with no defects, and the aircraft was approved for return to service. Jan. 31 Cruise — Cabin cooling system Smoke Embraer 145LR Atlantic Southeast Airlines During flight, the crew reported smoke in the cockpit. The aircraft landed without incident. Maintenance inspected and removed and replaced the no. 2 ACM. It was operations tested with no defects, and the aircraft was approved for return to service. Feb. 6 Cruise — Air distribution system Smoke Bombardier CL600 American Eagle Airlines During cruise, a flight attendant reported black dust on the no. 1b overhead bin. This dust later became apparent on the cockpit windshield. The cabin and cockpit had a carbon-like smell. After landing, the dust was noticeable on nearly every overhead bin. Maintenance removed and replaced both recirculation fan filter cartridges in accordance with the maintenance manual. During ground runs, no black dust was noted. Feb. 7 Cruise — Central display Smoke Embraer 145XR Atlantic Southeast Airlines The flight was diverted after an odor of electrical smoke was detected in the cockpit and the no. 4 multifunction display (MFD) went blank. The odor subsided after the MFD circuit breaker was pulled. Maintenance removed and replaced the first officer’s MFD. The operations check was normal, and the aircraft was approved for return to service. Feb. 8 Climb — Air distribution system Smoke Bombardier CL600 Sky West Airlines After takeoff, smoke filled more than half the cockpit. The pilots donned oxygen masks, declared an emergency and landed the aircraft uneventfully. Smoke filled the aft cabin but cleared after landing. The crew performed QRH procedures. An operational test of both packs was conducted in accordance with the aircraft maintenance manual, and no smoke was noticed in the cockpit or cabin. Feb. 18 Cruise Anchorage, Alaska, U.S. (ANC) Air distribution system Smoke Boeing 777 American Airlines During flight from Dallas/Fort Worth (DFW) to Tokyo Narita (NRT), the crew reported a smoke smell in the cockpit. The lower left cabin recirculation fan overheated. The circuit breaker was pulled, and the flight was diverted to ANC, where it landed without incident. The lower left recirculation fan was placarded inoperative in accordance with the minimum equipment list and the flight continued to its destination. Maintenance replaced the left recirculation fan. The system was normal during ground checks. Feb. 26 Climb — Engine (turbine/turboprop) Smoke Embraer 145XR Atlantic Southeast Airlines The flight crew reported smoke in the cockpit immediately after takeoff and performed an air turnback. Maintenance inspected the aircraft and determined it had been deiced prior to takeoff. Deicing fluid was found in both engine inlets. Maintenance removed fluid and ran engines and packs with no smoke noted. Feb. 26 Climb — Air distribution system Smoke Boeing 757 United Airlines Smoke was seen in the cockpit and cabin at climb power with the left pack running. Turning off the pack, in accordance with a service tip from the maintenance manual, stopped the smoke. March 2 Descent — Cabin cooling system Smoke Embraer 190 JetBlue Airways The flight crew declared an emergency due to smoke in the cabin. The smoke dissipated when the cabin in-flight entertainment (IFE) system was turned off as the flight crew conducted QRH cabin smoke procedures. Debris was found on the heat exchanger, and the right ACM and dual heat exchanger were removed and replaced. Operations and leak checks were normal. March 3 Climb — Engine (turbine/turboprop) Smoke Bombardier CL600 Air Wisconsin Airlines The cabin and cockpit filled with smoke and fumes after bleeds were transferred from the auxiliary power units (APUs) to the engines. The smoke and fumes abated when the bleeds were returned to the APUs. The flight crew contacted maintenance and confirmed this was the first flight after compressor cleaning. They suspected that residual chemicals from the compressor wash caused the smoke and fumes. The crew did not declare an emergency but returned to Philadelphia, Pennsylvania, U.S., for an uneventful landing. No smoke or odor were noted during a 20-minute engine run. March 17 Climb St. Louis, Missouri, U.S. (STL) Heating system Smoke McDonnell Douglas American Airlines MD-80 The flight crew reported smoke and fumes in the forward cabin. They declared an emergency and returned to STL, landing without incident. An aircraft inspection found that the forward cargo compartment heater had failed. The repair was deferred in accordance with the minimum equipment list, and the flight continued to its destination. The forward cargo heater was subsequently replaced and the system was normal during a ground check.
56 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2014 59th annual Business Aviation Safety Summit
67th annual International Air Safety Summit
November 11–13, 2014 Jumeirah at Etihad Towers Abu Dhabi, United Arab Emirates Hosted by:
Flight Safety Foundation
Benefi2nd tannual Dinner Wednesday, November 12
Monte-Carlo Beach Club Abu Dhabi, United Arab Emirates
Register NOW!
The 67th annual International Air Safety Summit (IASS) will be held November 11–13, 2014 at the Jumeirah at Etihad Towers, Abu Dhabi, United Arab Emirates. Join us for the Flight Safety Foundation 2nd annual Benefi t Dinner on Wednesday, November 12, being held in conjunction with IASS. Please visit the website below to register and for hotel information and further details about these events.
fl ightsafety.org/IASS2014
@Flightsafety #IASS2014