Proceedings of the 37Th Annual International Seminar

VOLUME 10

Publisher ISASI (Frank Del Gandio, President) Editorial Advisor Air Safety Through Investigation Richard B. Stone Editorial Staff Susan Fager Esperison Martinez Design William A. Ford Proceedings of the ISASI Proceedings (ISSN 1562-8914) is published annually by the International 37th Annual Society of Air Safety Investigators. Opin- ions expressed by authors are not neces- ISASI 2006 PROCEEDINGS sarily endorsed or represent official ISASI International Seminar position or policy. Editorial Offices: 107 E. Holly Ave., Suite 11, Sterling, VA 20164-5405 USA. Tele- phone: (703) 430-9668. Fax: (703) 450- ‘Incidents to Accidents— 1745. E-mail address: [email protected]. Internet website: http://www.isasi.org. Breaking the Chain’ Notice: The Proceedings of the ISASI 37th annual international seminar held in Cancun, Mexico, features presentations on Sept. 11–14, 2006 safety issues of interest to the aviation community. The papers are presented herein Cancun, Mexico in the original editorial content supplied by the authors. Copyright © 2007—International Soci- ety of Air Safety Investigators, all rights reserved. Publication in any form is pro- hibited without permission. Permission to reprint is available upon application to the editorial offices. Publisher’s Editorial Profile: ISASI Pro- ceedings is printed in the United States and published for professional air safety investigators who are members of the Interna- tional Society of Air Safety Investigators. Content emphasizes accident investigation findings, investigative techniques and experiences, and industry accident-prevention developments in concert with the seminar theme “Incidents to Accidents— Breaking the Chain.” Subscriptions: Active members in good standing and corporate members may acquire, on a no-fee basis, a copy of these Proceedings by downloading the material from the appropriate section of the ISASI website at www.isasi.org. Further, active and corporate members may purchase the Proceedings on a CD-ROM for the nominal fee of $15, which covers postage and handling. Non-ISASI members may acquire the CD-ROM for a $75 fee. A limited number of paper copies of Proceed- ings 2005 is available at a cost of $150. Checks should accompany the request and be made payable to ISASI. Mail to ISASI, 107 E. Holly Ave., Suite 11, Ster- ling, VA 20164-5405 USA ISSN 1562-8914

ISASI 2006 Proceedings • 1 ISASI 2006 PROCEEDINGS Latin American, European Canadian, 2 Air Traffic Services, W Seminar, Reachout, Nominatin Membership, Code ofEthic Bylaws, Board ofFellow Ballot Certification, Awar Audi C Rocky Mountain, Pacific Northwest, Northeast, Mid-Atlantic, Los Angele Great Lakes, Florida, Dallas-Ft. Worth, Arizona, Alaska, C U United States, SESA-France Chap., Russian New Zealand, Australian, S N United States, New Zealand, International, European Canadian, Australian, C Treasurer, Secretary, Vice-President, Executive Advisor, President, O Corporate Affairs, Corporate Affairs, Cabin Safety, Southeastern, San Francisco, Government AirSafety,Government General Aviation, Flight Recorder, Investigators Training Human Factors, Positions, OCIETY OMMITTEE HAPTER OUNCILLORS • ATIONAL AND ([email protected]) ([email protected]) ([email protected]) ([email protected]) NITED Ladislav Mika(Co-Chair)([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) Braithwaite ([email protected]) FFICERS ORKING t, Dr. MichaelK.Hynes d, GaleE.Braden([email protected]) ISASI 2006 ISASI Craig Beldsoe , VsvolodE.Overharov ([email protected]) Darren T. Gaines([email protected]) Ben Coleman([email protected]) Bill Waldock ([email protected]) ChrisBaum([email protected]) Barbara Dunn([email protected]) , DavidKing([email protected]) , AnneEvans([email protected]) Ken Smart([email protected]) Frank DelGandio([email protected]) Tom McCarthy([email protected]) James P. Stewart([email protected]) s, Inactive David W. Graham([email protected]) g, Tom McCarthy([email protected]) Barbara M.Dunn([email protected]) Barbara Dunn([email protected]) Kenneth S.Lewis Lindsay Naylor([email protected]) s, JohnP. Combs([email protected] Rodney Schaeffer([email protected]) Tom McCarthy ([email protected]) Joann E.Matley([email protected]) Inactive Ron Schleede([email protected]) Curt Lewis([email protected]) Curt Lewis([email protected]) Peter Williams([email protected]) Ron Chippindale([email protected]) Caj Frostell([email protected]) Ron Schleede([email protected]) s, RonChippindale([email protected]) Peter Axelrod Michael R.Poole S GuillermoJ.Palacia(Mexico) Richard Stone([email protected]) P

Curt Lewis([email protected]) Gary R.Morphew Gary John W. ([email protected]) Purvis William (Buck)Welch Kevin Darcy([email protected]) Richard Stone([email protected]) TATES P G RESIDENTS Vincent Fave John A.Guselli(Chair) Tom McCarthy([email protected]) Proceedings RESIDENTS ROUP & Education, Willaim L.McNease C HAIRMEN R R EGIONAL C EGIONAL HAIRMEN Graham R. ISASI Information t) Finnair Oyj Federal Aviation Administration Exponent, Inc. EVA Corporation Airways European Aviation SafetyAgency Era Aviation, Inc. Emirates Airline AeronauticalUniversity Embry-Riddle EMBRAER-Empresa Brasileirade EL ALIsraelAirlines Dutch Transport SafetyBoard Dutch AirlinePilotsAssociation Directorate ofFlyingSafety—ADF Directorate ofFlightSafety(CanadianForces) Directorate ofAircraftAccidentInvestigations— Delta AirLines,Inc. DCI/Branch AIRCO Cranfield Safety&AccidentInvestigationCentre COPAC/Colegio OficialdePilotosla Continental Express Continental Airlines Comair, Inc. Colegio DePilotosAviadores DeMexico,A.C. Civil Aviation SafetyAuthorityAustralia Cirrus Design China Airlines Centurion, Inc. Cavok Group,Inc. Limited Cathay PacificAirways Bundesstelle furFlugunfalluntersuchung—BFU Bombardier AerospaceRegionalAircraft Boeing CommercialAirplanes Board ofAccidentInvestigation—Sweden BEA-Bureau D’EnquetesetD’Analyses Avions deTransport Regional(ATR) Aviation SafetyCouncil Australian Transport SafetyBureau Atlantic SoutheastAirlines—DeltaConnection Association ofProfessionalFlightAttendants ASPA deMexico Search&Survey, Ltd. American Underwater American EagleAirlines Allied PilotsAssociation CompanyLimited All NipponAirways Alitalia Airlines—FlightSafetyDept. Alaska Airlines AirTran Airways Australia Airservices Aircraft &RailwayAccidentInvestigation Aircraft MechanicsFraternalAssociation Aircraft AccidentInvestigationBureau—Switzerland Airclaims Limited Airbus S.A.S. Air NewZealand,Ltd. Air LinePilotsAssociation Air CanadaPilotsAssociation Air AccidentsInvestigationBranch—U.K. Air AccidentInvestigationUnit—Ireland Air AccidentInvestigationBureauofSingapore AeroVeritas Aviation SafetyConsulting,Ltd. Accident Investigation&PreventionBureau Aeronautical &MaritimeResearchLaboratory Accident InvestigationBoard/Norway Accident InvestigationBoard,Finland C ORPORATE Aeronautica S.A. Namibia Aviacion Comercial Commission M EMBERS NAV Canada National Transportation SafetyBoard National BusinessAviation Association National AirTraffic ControllersAssn. MyTravel Airways Lufthansa GermanAirlines Lockheed MartinCorporation Learjet, Inc. L-3 CommunicationsAviation Recorders KLM RoyalDutchAirlines JetBlue Airways Japanese Aviation InsurancePool Japan AirlinesDomesticCo.,LTD Irish AirCorps Interstate Aviation Committee Int’l. Assoc.ofMach.&AerospaceWorkers Independent PilotsAssociation IFALPA Hong KongCivilAviation Department Hong KongAirlinePilotsAssociation Honeywell Hellenic AirAccidentInvestigation Hall &Associates,LLC Global Aerospace,Inc. GE Transportation/Aircraft Engines Galaxy ScientificCorporation Flightscape, Inc. Flight SafetyFoundation—Taiwan Flight SafetyFoundation Flight AttendantTraining Instituteat WestJet Volvo AeroCorporation University ofSouthernCalifornia University ofNSWAVIATION UND Aerospace U.K. CivilAviation Authority Transportation SafetyBoardofCanada Transport Canada State ofIsrael Star NavigationSystemsGroup,Ltd. Southwest AirlinesCompany Southern CaliforniaSafetyInstitute South AfricanCivilAviation Authority South AfricanAirways SNECMA Moteurs Singapore Airlines,Ltd. Airlines Ltd. Skyservice Sikorsky AircraftCorporation SICOFAA/SPS Saudi ArabianAirlines SAS Braathens Sandia NationalLaboratories RTI Group,LLC Royal NewZealandAirForce Royal NetherlandsAirForce Rolls-Royce, PLC Republic ofSingaporeAirForce Qwila Air(Pty)Ltd. Limited Qantas Airways Pratt &Whitney Phoenix International,Inc. Parker Aerospace ofAviation andAccident Nigerian Ministry Investigation Bureau & Aviation SafetyBoard Melville College ◆ Table of Contents

53 The ATSB Approach to Improving the LATIN AMERICA DAY—Tuesday, September 12 Quality of Investigation Analysis By Michael Walker, ATSB, Australia 2 ISASI Information 58 An Investigation as to How Aviation Safety 4 Preface: Welcome to ISASI and Cancun Will Be Maintained in the Light of the Major By Frank Del Gandio, President Change Processes Taking Place in the Norwegian Civil Aviation Sector

6 Keynote Address: Safety Cannot Be Seen; It Must Be Felt By Dr. Kaare Halvorsen and Dr. Grete Myhre, ISASI 2006 PROCEEDINGS By Capt. Gilberto Lopez Meyer, DGCA Mexico AIB, Norway 8 ‘Dick’ Wood Reaps Lederer Honors 66 Incident Investigation: A Diversion of a Boeing By Esperison Martinez, Editor B-747 Resulting in a Serious Low-Fuel Situation By Johann Reuss, BFU, Germany 10 Remarks to ISASI 2006 By Stuart Matthews, president and CEO, FSF 70 Breaking the Chain: An Empirical Analysis of Accident Casual Factors by Human Factors 13 Accident and Incident Investigation in Argentina Analysis and Classification System (HFACS) —One View about a Maintenance-Related Case By Wen-Chin Li and Don Harris, Cranfield By Horacio Larrosa, JIAAC, Argentina University, UK 18 A CFIT Accident: Lessons Learnt By Capt. Carlos Limón, Deputy President, IFALPA INVESTIGATOR’S DAY—Thursday, September 14

19 The Advanced Qualification Program (AQP) 77 Major Investigation Management as a Tool to Break the Chain of Accidents By Nick Stoss, Transportation Safety Board of Canada By Claudio Pandolfi, DGAC-Chile 84 A Safety Issue Investigation into Small Aircraft 24 Risk Analysis Methodology Application and Accidents Resulting in Post-Impact Fire: Results for Product Safety Monitoring at Embraer The Experience, Techniques, and Lessons Learned By Fabio Catani, Sergio Rodrigues Pereira, and By William R. Kemp, TSB, Canada Umberto Irgang, Embraer, Empresa Brasileira de Aeronáutica, Air Safety Department 93 Investigation into Turbulence-Related Accidents By Gary R. Morphew, SCSI, USA 32 Defining and Investigating Incidents By Richard H. Wood, USA 96 Polishing the Apple and the Investigator— Examining the Importance of Investigator Education Prior to an Investigation INTERNATIONAL DAY—Wednesday, September 13 By Dana Siewert, UND, USA, and Corey Stephens, ALPA USA 35 Industry Working Group for Enhancing the Investigation of Human Performance Issues 99 Investigating a ‘Minor’ Incident Using Lessons By Randall J. Mumaw, Boeing, USA Learned from a Major Accident By Stéphane Corcos and Alain Agnesetti, BEA, France 38 Failure Analysis of Composite Materials in Aircraft Structures 104 Listening to the Specialists: How Pilot Self- By Dr. Joseph Rakow and Dr. Alfred M. Pettinger, Reporting Can Help Break the Accident Chain Exponent Failure Analysis Associates, USA By Sue Burdekin, University of New South Wales, Australian Defense Force Academy 46 Solving FDR Readout Problems: A Proactive Approach 108 ISASI 2006 Photo Review By Guillaume Aigoin and Guilhem Nicolas, BEA, France By Esperison Martinez 50 Using the Threat and Error Management (TEM) Framework as an Analytical Tool in ATC By Bert Ruitenberg, Tower & Approach Unit, Schiphol Airport, Amsterdam

ISASI 2006 Proceedings • 3 ISASI 2006 PROCEEDINGS 4 • well attendedbyregional aviationprofessionals. America, oneinMexico andoneinChile.Eachwasvery alsohashostedtwoOutreach workshopsinLatin tors. ISASI ment oftheLatinAmericanSocietyAirSafetyInvestiga- here weare. We are especiallypleasedwiththeestablish- presence andourrepresentation inLatinAmerica—and seminar inMexico, reinforcing ourinternationalstature. isholdingitsannual of personalsatisfactionthatISASI entire Ihaveadeepsense cityafteradevastatinghurricane. country haslearnedjusthowdifficultitistorebuild an Rita.Myown time afterthedevastationofHurricane rapid recovery thattheyhaveachievedhere insuchashort paradise. tothisCaribbean and thecityofCancun,forinvitingISASI to thepeopleofMexico, aswell thestateofQuintanaRoo a levelthatwe cannolongerrely onaccidents asour is thattheaviationtransport systemnowperformsatsuch “Incidents toAccidents—Breaking theChain.”Itspremise what havebecomeveryrare events. now findsitselftryingtoidentify andminimizetherisksof particularly thepassengerjetsystem,thatmostofworld from safetyhasbecomeso reliable, thesystem.Aircarrier safety. We havepersistentlyeliminatedmore andmore risk world hascontinuedtoachievehigherandlevelsof nor dotheyrecognize awkward nationalfences. Aircraft recognize neither naturalnorman-madeborders— better thanmostthataviationsafetyknowsnoborders. can becauseweinaviationaccidentinvestigationknow assist allouraviationbrethren inwhatevermodestwaywe reallymembership bringstothetable.ISASI isproud to thebreadthof ISASI: andwealthofknowledgethatour what Ihavealwaysbelievedtobeoneofthecore strengths American SocietyofAirSafetyInvestigatorsandillustrate Air SafetyInvestigators. AmericaSocietyof the Latin W W ISASI 2006 ISASI These eventsspeaktothefuture growth oftheLatin andIpersonallyhavelonghopedtoimproveISASI our The peopleofMexico shouldbevery, veryproud ofthe This factisreflected in thethemeofthisyear’sseminar, The goodnewsisthattheaviationcommunityaround the DGAC oftheRepublic ofMexico. Aspecialthanks Gilberto LopezMayer, director generalofthe e are honored withthepresence ofourhost,Capt. with theestablishmentof e areespeciallypleased Welcome toISASIandCancun Proceedings By Frank DelGandio,President PREFACE

E. MARTINEZ toward incidentanalysis. insight intoincidentsandrisk. punitive action.Theseefforts are providing anewwealthof can report incidents totheirairlinewithoutthethreat of systems inwhichpilots,maintenance crews, andcabincrews tually atleast,wecannowmodeltheentire operating system. the future justafewyearsagohasbecomereality today: concep- flights androutine airtrafficdata.Whatseemedtobefaroffin mation technologyanddetailedstatisticalanalysisofroutine toward asystemthatintegratesaviation knowledgewithinfor- investigative andanalyticalresources. broader rangeofincidentsonwhichtouseourtraditional iceberg. Breaking thechainwilllikely require thatwetarget a accidents, eventheseeventsare onlyasmallpartofthe incidents thatcometoourattention.But,similarmajor gative andanalyticalskillstounderstandvisible,high-risk chain ofeventsbefore theyleadtoseriousaccidents. incidents sothatwecanidentifyinterventionsbreak the “breaking thechain” sayswemustlearnmuchmore from risks thatremain part ofoursystemeveryday. Thenotionof incidents beneaththewatermayobscure persistentandserious could haveledtoaccidents.Ataminimum,thatmountainof water depthshideamountainofincidentsthatalltooeasily serious accidentsare literallythetipoficeberg, whilethe primary source oflearninghowtoimprove safety. 2006, Cancun,Mexico. President DelGandiowelcomesdelegatestoISASI Yet, atleasttwochallengesremain fundamentaltothisshift We alsoare seeingtherapidgrowth ofvoluntaryreporting Already, theaviationsafetycommunityismovingrapidly To dothisright,we willneedtosharpentraditionalinvesti- Everyone here hasseentheiceberg illustrationinwhich First, it is not easy to do well or even to do it in a meaningful way. For example, voluntary reporting systems now introduce the challenge of finding that needle in a haystack that might really uring this seminar, several papers be worth understanding. Even with digitally recorded data and Dwill be presented that outline systems modeling, we still need to know what questions to ask so some of the challenges and some of the that we know which data parameters to record and analyze. The second major challenge is to make sure we don’t forget successes in this transition to making lessons already learned. better and more systematic use of ISASI 2006 PROCEEDINGS We must avoid the temptation of plunging into the brave new world of incident analysis and digital data at the expense of what incidents to break the chain. Be we already know to be critical elements in aviation safety. prepared to learn something about For example, we had eight major catastrophic fatal jet accidents in the past year. While this is a remarkably low number incidents to accidents and breaking compared to just a decade ago, we are reminded that risk is not the chain. Again, if anyone is seeking zero, but we also are reminded that most major accidents are to understand more about any issue caused by very well established and well understood risks. In September last year, a Mandala Airlines B-737-200 crashed on related to aviation safety, this seminar initial climbout when the aircraft was misconfigured for takeoff is a great place to start. (no flaps); 104 people on the airplane and 47 people on the ground were killed. major accidents last year involved an Air France A340 that In October, Bellview Airlines lost control when one of its B- landed long in heavy rain and overran at high speed in 737-200 crew tried to fly around thunderstorms at night on Toronto. The aircraft caught fire, but all occupants escaped. initial climbout from Lagos; all 117 people on board were killed. In December last year, Southwest Airlines landed long and In December, Solsoliso Airlines crashed on approach due to overran onto a city street in Chicago, killing a young boy in windshear associated with nearby thunderstorms; 109 people a passing vehicle. were killed. In May of this year, Armavia from Armenia crashed None of these events involved either new or subtle risks, during a go-around in poor weather at night near Sochi, Russia; and none involved risks that were difficult for operators to identify before the accident scenarios began. Again, we must not forget the lessons learned. espite the need to retain what we Yet, despite the need to retain what we already know, already know, breaking accidents breaking accidents chains by improving both our understand- D ing and our awareness of incidents is the direction that our chains by improving both our under- profession must take. Perhaps we could have identified standing and our awareness of something in the data before Southwest overran at Midway. Perhaps future approach-and-landing accidents can be incidents is the direction that our averted by identifying an abnormal frequency of high-energy profession must take. or unstable approaches on a particular approach to a particular runway. Perhaps we can identify, with real data, all 113 on board were killed. On July 9, an A310 operated by certain aircraft performance characteristics that invite Sibir Airlines landed long in bad weather and tailwinds at mistakes by pilots, or identify particular portions of airspace Irkutsk, then overran into a concrete wall and buildings, killing that invite inadequate aircraft separation. 131 of 203 occupants. During this seminar, several papers will be presented that The following day, a Fokker F27 operated by Pakistani outline some of the challenges and some of the successes in International crashed on climbout from Multan, Pakistan, after this transition to making better and more systematic use of an engine failure; all 45 occupants were killed. On August 22 a incidents to break the chain. Be prepared to learn some- Tu-154 operated by Pulkovo Airlines crashed in a thunder- thing about incidents to accidents and breaking the chain. storm. All 170 occupants were killed. On August 27 a CRJ Again, if anyone is seeking to understand more about any operation by Comair crashed while approaching takeoff at issue related to aviation safety, this seminar is a great place Louisville, Ky., killing 49 of the 50 persons on board. Two other to start. ◆

ISASI 2006 Proceedings • 5 ISASI 2006 PROCEEDINGS 6 • countries together havebeendevelopingvarious pro- Directorate ofCivilAviation. Federal Aviation Administration, andtheMexican General three importantorganizations: Transport Canada, the North AmericanAviation Trinational, thatbringstogether Agreement containsaspecialcharterforaviation,calledthe the NorthAmericanFree Trade Agreement since 1994.This and analysistoolstohelpprevent theseaccidents. different aspectsofaccidentreports, accidentinvestigation, acknowledge thatthedifferent speakers willaddress guarantee itandtoperfectit.From theagenda,Ican increase ourknowledgeinthearea ofsafetyandhow to very importantopinions,studies,andpointsofviewthatwill from theinternationalaviationcommunity. We willhear to presentations thatwillbegivenbydistinguishedexperts will allowustobeabitmore effectiveinpreventing accidents. and where eachpointofviewandanalysisproposal Breaking theChain,”where weallfundamentallycoincide safe andreliable. tions, sothataviationcanaccomplishitsmissionofbeing correcting errors, andmaintainingasetoftimelyinspec- are made. be felt,whenperiodiccontrols, inspections,andevaluations avoid theappearanceofincidentsandaccidents.Butitmust become majoraviationrisks. unfortunate eventswhosefrequency orgravitymayletthem programs, andconcrete planstoavoidamultitudeof produce accidentsimpliesagroup ofactionprojects, taken. Therefore, breaking thechainofincidentsthat preventive, corrective, andtimelyactionsthatare being world. Confidenceinthissafetyandsecuritycomefrom the aviation decisionsbeingmadeinMexico andaround the G —Editor) ISASI 2006delegates,onSept.12,2006,inCancun,Mexico. (Remarks presented byCapt.LopezMeyerinhiskeynoteaddress to ISASI 2006 ISASI During thesemore than10yearsofwork,ourthree Mexico, Canada,andtheUnitedStateshavebeenpartof During thisseminar, we willhavetheprivilegeoflistening We havetoaddress theissueof“IncidentstoAccidents— Prevention meanslookingahead,establishingnorms, Safety cannotbeseen,becauseitspurposeisprecisely to Aviation safetyandsecurityare behindmostofthecivil beautiful cityofCancun. that Iwelcomeyoutoourcountryandthis ood Morningtoeveryone.Itiswithgreat pleasure Proceedings Safety CannotBeSeen; By Capt.GilbertoLopezMeyer, Director Generalofthe Mexican GeneralDirectorate ofCivilAviation KEYNOTE ADDRESS It MustBeFelt database containsadescriptionofeachaccident.Andafter elements ofaccidentsreports from thethree countries.The computerized databasecontaining,indetail,thevarious most important.Averyimportanttoolwasdeveloped:a grams—those related toaccidentprevention beingsomeofthe domestic andinternationalregulations. decisions orinverifyingcompliancewith another participateinaviationindus-try technicians—all thosethatinsomewayor authorities, airports,specialists,and us all—aviationcompanies,government those incidents.Aviationsafetyconcerns preventive measurestotryeliminate proposals, andtoagreeoncontrol [accident] chains,toanalyze,establish O Pilot reexamination. • preventive strategieswere established: 8. lackofcommunicationsclarity. 7. diminishedsituationalawareness. 6. notfollowingproper procedures bymaintenance. 5. lackofcrew coordination. 4. aircraft handling. 3. poorjudgmentbyoperations. 2. equipmentorcomponentfailure. 1. notfollowingproper procedures byoperations. causes were strategies toaddress themwere developed.Thoseeightroot Eight mainroot causeswere established, andintervention accidents thatoccurred in thethree countrieswere analyzed. developed. For example, approximately 500airtransport intervention strategiesforeachoftheroot causescouldbe factors thatledtotheaccidentwere established. detailed analysis,theroot causeandsecondaryorcontributing From the analysisoftheseeightroot causes,thefollowing Do thesesoundfamiliar? The database,thus,allowedustoworkoutstatisticssothat ur workduringthenext fewhours and dayswillbetobreakthese TUESDAY—LATIN AMERICA DAY TUESDAY—LATIN

Capt. Lopez Meyer discusses the North American Aviation Trinational charter established in 1994. E. MARTINEZ

• Confidential safety reporting programs for airlines and Traditionally, the focus has been on accident prevention employees. and avoidance and on establishing the necessary trinational • ISO evaluation process (or equivalent internal quality prevention strategies. Today, we are looking at something assurance system such as ISO 9001-2000). less dramatic, but just as important: incidents. And we must • Quality assurance programs. realize that when they often occur, they can lead to what we • CRM courses. really want to prevent: accidents. • Line-oriented safety audits. Our work during the next few hours and days will be to The same procedure was used for general aviation airplanes break these chains, to analyze, to establish proposals, and to and for helicopter operations. agree on control and preventive measures to try to eliminate In Mexico, accident investigation is done in accordance with those incidents. Aviation safety concerns us all—aviation ICAO Annex 13, Mexican civil aviation law, and its regulations. companies, government authorities, airports, specialists, and It is interesting to note that aviation accidents are investigated technicians—all those that in some way or another participate by the General Directorate of Civil Aviation itself. in aviation industry decisions or in verifying compliance with I may say that in Mexico we are actually in the middle of a domestic and international regulations. discussion, trying to decide if the authority responsible for Thus, the audit and follow-up inspection and control accident investigations should not be part of the civil aviation programs and projects are fundamental within the frame- authority. It has been very interesting to me to find that there is work of our safety plans. Mexico’s civil aviation authorities not a simple and unanimous answer for this question—not look with great interest to this international seminar, which even in countries that took the decision to separate both we feel will greatly enhance our future decision, and we responsibilities many years ago. Maybe we will be able to learn appreciate the effort that has gone into putting it together. some valuable experiences from the lectures that will be On behalf of the Mexican federal government, thank you presented at this seminar during the next days. very much for coming to Cancun. ◆

ISASI 2006 Proceedings • 7 ISASI 2006 PROCEEDINGS 8 • I use tothisday. concept ofaccidentanalysiswith the“multi-cause”systemin Safety office;whilethere, hereplaced “theprimarycause” and Programs DivisionintheDirectorate ofAerospace Force in1978,ColonelWood waschiefoftheSafetyPolicy a career inaviationsafety. Whenheretired from theAir the U.S.AirForce risingthrough theranksashefocusedon and militarycombataircraft, Dickbeganhislife’sworkin to thisday. andtheindustry—andthosecontributionscontinue ISASI has beenpunctuatedwithcountlesscontributions—bothto investigation andaviationsafety. Hisprofessional lifetime he hasmadesignificantcontributionstoaircraft accident Through histeaching,writing,andservicetoourprofession, standing tallamonghispeersformore than50years. demandingcriteriafortheLederertruly fitsISASI’s Award, prestigious Jerome F. Lederer Award for2006. persons toberecognized astherecipient oftheSociety’s that accountedforhisstandingbefore thecrowd of300 has madeoveralengthycareer. Itwasthosecontributions investigation andaccidentprevention contributionsDick ISASI 2006 ISASI “He thenjoined theUniversityofSouthern California asa “A pilotwith6,000hoursoftransport, generalaviation, At thelectern,President DelGandiosaid:“DickWood Del Gandio’s laudingcommentsabouttheaccident and fidgetedslightlyashelistenedtoPresident Frank SASI Life MemberRichard H.WoodSASI stoodonthestage Proceedings Investigation, tive textbook usedthroughout theworld, articles. Herecently released thesecondeditionofdefini- eight booksandmanualstohiscredit, aswell24 magazine profession through publicationsandhands-onteaching, with countless others.Heistrulyapersonwhogivesbacktohis military accidents,andhasservedasatechnicalconsultant in has participatedintheinvestigationofmore than125civiland izing inaviationsafetyandaircraft accidentinvestigation.He CabinSafetySymposium. member ofSCSI’s of directors andadvisors,isa23-year Executive Committee boards There,Safety Institute(SCSI). heisamemberofSCSI’s programs, untilhelefttohelpformtheSouthernCalifornia programs, specializingindevelopmentandteachingofmany gation. Later, hebecamedirector aviationsafety ofUSC’s active consultantinaviationsafetyandaircraft accidentinvesti- nance, photography, andotherrelated subjects.Hewasalsoan aviation safetyprogram management,investigation,mainte- professor ofsafetyscience,developingandteachingcoursesin another excellent example ofhisdedication.Dick’sback- Indeed, hislatestpaper, presented onTuesday [seepage 32],is 1978, mostofwhichhavebeen presented seminars. atISASI twice. Hehasauthored nearly30professional paperssince tions, includingpresident oftheLosAngelesRegional Chapter, since 1972,hehasheldvarious officesandcommitteeposi- “Currently, Dick is awriter, lecturer, andconsultant,special- “Dick’s service to ISASI hasbeenoutstanding.Amember “Dick’s servicetoISASI Reaps Lederer coauthored withthelateRobert Sweginnis. ‘Dick’ Wood By EsperisonMartinez,Editor Honors Aircraft Accident

PHOTOS: E. MARTINEZ “ have an office in which the walls are Ifilled with all the awards, decorations, and citations of 26 years in the military and 13 years in academia at USC. But this Lederer Award is going out in the front hall, close to the front door, because I want people who come to visit

me to look at it and say: ‘What’s that?’” AMERICA DAY TUESDAY—LATIN

ground, training, skill, and experience more than qualify him for the prestigious Jerry Lederer Award.” Then, turning to the now-calm figure next to him, Frank announced, “Dick, congratulations.” As thunderous applause filled the room, the highly polished Lederer plaque set in deep ABOVE: Dick Wood, right, accepts the Jerome F. Lederer mahogany wood, exchanged hands. The Jerome F. Lederer Award from President Frank Del Gandio during ceremonies Award is conferred for outstanding lifetime contributions in the at the ISASI 2006 awards banquet held in Cancun, Mexico. field of aircraft accident investigation and prevention. It was FACING PAGE: Dick Wood displays his lively style of delivery created by the Society to honor its namesake for his leadership during the presentation of his technical paper “Defining and role in the world of aviation safety since it infancy. Jerry Investigating Incidents” to the ISASI 2006 audience. Lederer “flew west” on Feb. 6, 2004, at age 101. Somewhere in the “hereafter” Jerry probably smiled glee- In a crisp voice he thanked all of the persons who played fully when Dick accepted the Award and said to himself: “I told a role in his selection: the person who nominated him, the you so!” Awards Committee members who are scattered throughout Why? Here is a story Dick, whose personal friendship with the world in a fashion that attempts to duplicate the Jerry dates back to 1973, recounted in his acceptance remarks distribution of the ISASI membership as closely as possible, to the audience. and ISASI itself for having established such an award. “In 1990 I was asked to become the chairman of the ISASI “I am very, very proud to receive this Award. But what am Awards Committee and held that job for seven years. In 1996 I I going to do with it?” he asked rhetorically. “Well, in my received a letter in the mail. It was from Jerry Lederer. It was condominium in Bellingham, Wash., I have an office in typewritten and it was formatted precisely the way called for by which the walls are filled with all the awards, decorations, the Award nomination rules: typed, one page, one side only. I and citations of 26 years in the military and 13 years in looked at it and recalled that Jerry Lederer did not own a academia at USC. But this Lederer Award is going out in typewriter; everything he wrote was pen and ink, so if he the front hall, close to the front door, because I want people wanted something typed, he had to pay to get it done. Well, the who come to visit me to look at it and say: ‘What’s that?’” letter looked like a nomination. I read it and discovered that With that, the audience burst into loud applause, over Jerry was nominating me for the Lederer Award. I thought, which Dick exclaimed: “That question will get them a free ‘Jeez, what am I going to do with this.’ 10-minute lecture on what ISASI is and what it stands for “I picked up the phone and called Jerry, we talked often and who Jerry Lederer was!” By now, the audience was on its anyway. I said, ‘Jerry, I’m chairman of the Awards Committee, I feet making noise with shouts of glee, in appreciation for cannot accept this nomination!’ He says, ‘I know that, but I had the expressed gratitude and implied veneration he holds for to try.’ Now here I am 10 years later, accepting this Award.” the meaning of the Award. Is it any wonder Jerry may have been smiling? Then, a much more demure Award recipient whispered Dick regaled the audience with other stories involving into the mike with a breaking voice, “I’m profoundly himself and Jerry, evoking feminine peals of delight and hardy grateful to ISASI for giving me this reward; thank you,” male laughter. He then turned to the topic of the presentation. and the applause just got louder. ◆

ISASI 2006 Proceedings • 9 ISASI 2006 PROCEEDINGS Meritorious Service Award.Meritorious Service he hasreceived includeGAPAN’s CumberbatchTrophy andNBAA’s assistance inhelpingmakeRussian aviationsafer. Otherawards that aviation. In2005hewasdecorated bytheRussian Federation for his to the NetherlandsinOrder ofOrangeNassaufor his services numerous awards. industry In1994,hewasknightedbythequeenof select committeesinboththeUSA andEurope andhasreceived Institute ofAeronautics andAstronautics. onvarious Hehasserved of theChartered InstituteofTransport, andanAssociateFellow ofthe engineering. HeisaFellow oftheRoyal Aeronautical Society, aFellow chartered engineerwithadegree inaeronautical andmechanical tion devotedtothecontinuousimprovement ofaviation safety. Heisa Flight SafetyFoundation, amajorinternationalnon-profit organiza- Fokker in1994,hewaselectedtobethepresident and CEOofthe several hundred aircraft intheprocess. Uponhisretirement from company inNorthAmerica.Heranthisforthenext20years,selling invited byFokker Aircraft intheNetherlandstosetupitssubsidiary In1974hewas planning attheformerBritishCaledonianAirways. the airtransportindustry, hewasresponsible forallcorporate involved intheConcorde SSTprogram asaseniorsalesengineer. In worked ontheComet,world’sfirstjetairliner. hewas Later industry, hewasaproject designengineerand,amongotherprojects, industries inEurope andNorthAmerica.Inthemanufacturing experience inboththeaircraft manufacturingandairtransport have beenimproving constantlyduringthose10years,therate rate isnowabout0.7permilliondepartures andsincethings Worldwide, basedona10yearaverage,thehulllossaccident cilities are upgraded,andimproved procedures are adopted. becoming saferasmore advancedaircraft comeintoservice,fa- portation thattheworldhaseverknown.Anditisconstantly safe. Infactairtransportisprobably thesafestformofmasstrans- been doingrecently. few ofthethingsthatweinaccidentprevention worldhave this morningIwanttotake thisopportunitytotellyouabouta pletely forquitesometime.However, wewillnotstoptrying,and cated anddeterminedgroup, weare notlikely tosucceedcom- manding task,andIhavetoadmitthatsinceyouare averydedi- accident investigationcommunityoutofbusiness.Itisveryde- 10 G I don’t havetoremind youthatcommercial aviationisvery • ISASI 2006 ISASI ood morning.Asyouprobably allknow, themainaimof priority foralongtime,hasbeentoputallofyouinthe the FlightSafetyFoundation (FSF),andmyownpersonal and todayhehasmore than53yearscontinuous Havilland Aircraft Companyuponleavingschool, 19. Hebeganhisaviationcareer withtheDe could driveacarandbuilthisownaircraft atage on aviation.Heobtainedapilot’slicensebefore he and from earlyagehasbeenpassionatelykeen avery Stuart Matthews Proceedings By StuartMatthews,Kt.O.N., C.Eng.,F.R.Ae.S., F.C.I.T., A.F.A.I.A.A., Remarks toISASI2006 wasborninLondon,England, President andCEO, FlightSafetyFoundation ALAR implementation recently tohelpfurtherimprove aviationsafety. more primitivepartsoftheworld. most ofcommercial airlineaccidentsoccurtoolderaircraft in accidents thatkeep youfolksbusyenough,anditisnosecret that fatalities. Ontheotherhand,wedocontinuetohaveaviation there isonlyabouta10%chancethatyouwouldbeoneofthe before youwere everinvolvedinafatalaccidentandeventhen, every dayfortherest ofyourlife,some14,000yearswouldelapse 0.2 permilliondepartures, whichmeansthatifyoutookaflight another. InNorthAmericaandEurope, thecurrent rateisabout dent ratevariesconsiderablyfrom oneregion oftheworldto at thisverymomentcanonlybemuchlower. Ofcourse,theacci- cipient problems inthe operationofanaircraft oritssystems tions. Flightdata monitoringonaregular basiscanidentify in- monitoring, alsoknownasFOQA, incommercial airlineopera- FSF haslongchampionedthe useandbenefitsofflightdata Corporate FOQA work foryou. since westarted.Thismeans,ofcourse,feweraccidentsand less the statisticaltrend inCFITaccidentsindicates a30%reduction slow process, butitwouldappearthatwemightbewinningsince and, todate,some3,000peoplehavehadsuchtraining. It’sa their ownorganizations. We dotheseworkshopsfree ofcharge toolkit’s usesothatthey, inturn,canpasstheinformationon around theworldtraining localaviationrepresentatives inthe recent timeswehaveheldnearly251-and2-dayworkshops FSF isnowengagedinimplementingitonaregional basis.In uted widelythroughout theworld—wellover 35,000 sofar—and toolkit hasbeendistrib- of muchuse.ACDcontainingtheALAR pilots, airtrafficcontrollers, andoperationalpersonnel,itisnot is beingusedbythosewhoneeditthemost,predominantly line means toavoidthistypeofaccident;butunlesstheinformation been acceptedbyFAA andJAA (nowEASA). ommendations andbestpracticescontainedinthetoolkithave avoiding anapproach andlandingorCFITaccident.Therec- which setsouteverythingonewouldeverwanttoknowabout our approach toolkit, andlandingaccidentreduction (ALAR) world, toaddress thesemajorconcerns.Outofallthiseffortcame numbering more than300aviationexperts from alloverthe ing. Asyouwillprobably recall, wesetupataskforce, eventually tually allCFITaccidentshappenedduringapproach and land- all fatalitieswere theresult ofCFITaccidents.Furthermore, vir- dents occurred duringapproach andlanding,whileoverhalfof sory Committeeidentifiedthefactthathalfofallaviationacci- Back in1992,theFlightSafetyFoundation’s InternationalAdvi- Let metellyouaboutsomeofthethingsthatFSFhasbeenup However, itisonethingtohavedevelopedthebestwaysand that can be corrected before they become serious. They have been areas, particularly Africa and South America. As a result, FSF has shown to prevent accidents, to save costs, to prevent injuries, and played a major role in the development of the recently published to save lives. In short, they work! We have now developed a dem- Global Aviation Safety Roadmap, which has been developed for onstration program for corporate operations that is being tested ICAO by the international industry. Others who have also been with good results and, in due course, we hope to have FOQA in involved in this initiative include ACI, Airbus, Boeing, CANSO, widespread use in business and corporate aircraft. We anticipate IATA, and IFALPA. The Safety Roadmap sets out the framework that this will make corporate aviation that much safer and, hope- of actions necessary to systematically improve aviation safety in fully, will lead to a quieter life for those of you in the accident those areas of the world having the highest accident rate. investigation community. Nigeria Commercial Aviation Safety Team (CAST) Over the years, west Africa has consistently had one of the high- Another activity in which FSF has been very much involved is est accident rates of any area of the world. Of all the west African CAST. As you might recall, CAST was established in the USA in countries, Nigeria had a particularly poor record in 2005 with 1997 as a result of the recommendations of the review commis- four major accidents with 225 fatalities. The government an- sions set up after two major aircraft accidents (ValuJet and TWA nounced a major shakeup in the civil aviation organization and 800). It was recommended that, rather than working indepen- appointed Dr. Harold Demuren as the new Director General of dently, industry and government should work together to achieve Civil Aviation. Dr. Demuren has been a long-time member of the a national goal of reducing the then prevailing U.S. fatal acci- FSF’s Board of Governors, and he turned to FSF for assistance. dent rate by 80% over the next 10 years. FSF has been a member That is now being provided and FSF has a team of experienced of the CAST Steering Committee and an active participant since aviation personnel in Nigeria at this time. its inception. Nine years on, without going into a full review of all Well, that’s what FSF has been doing to try and put ISASI AMERICA DAY TUESDAY—LATIN the safety recommendations and best practices that have now members out of work. Now I’d like to conclude by telling you been developed within CAST, when fully implemented, we ex- some things that we have been doing to make your work easier pect that they will lead to a 73% reduction in the accident rate. and, possibly, to keep you out of trouble. That is very close to the 10-year national goal set in 1997, and the results already appear to be manifesting themselves, since Protection of aviation safety data there has now been no major commercial jet aircraft accident in For some time we, like you, have been increasingly concerned the USA for the past four years. It’s not for the want of trying, but about the tendency for judicial authorities to interfere with avia- regrettably we have still had two turboprop accidents during that tion accident investigations. You are all probably familiar with period that have kept the NTSB busy. situations that have occurred in the past when hard evidence was There has been a similar organization to CAST in Europe, the sequestered and witnesses intimidated to the detriment of the Joint Safety Strategy Initiative (JSSI), set up independently by investigation itself. Our position has long been that it is more the JAA. It also had similar objectives to those of CAST and the important to establish the causes of an accident so that corrective two organizations have worked closely together. Now that JAA is action can be taken to prevent a reoccurrence—with, possibly, yet running down, the JSSI has been taken over by the new Euro- more lives needlessly lost—than it is to find someone to blame in pean Aviation Safety Agency (EASA) and has become the ESSI. the hope that punishment will eliminate any safety concerns. FSF is a participating member of this group also. With this in mind and following a couple of instances whereby, in our opinion, the accident investigation had been hindered by Smoke, fire, and fumes (SFF) judicial interference, we approached ICAO through the Presi- Following the tragic Swissair 111 accident off Nova Scotia it was dent of the Council, Dr. Kotaite, and proposed that action should recognized that the accepted best practices and procedures fol- be taken to amend ICAO Annex 13 (which deals with accident lowing the discovery of smoke, fire, or fumes while in flight needed investigation) to give priority and immunity to the investigation. to be reassessed. Assembling under FSF’s neutral umbrella, rep- Dr Kotaite was very supportive of this proposal and subsequently resentatives of the major stakeholders—including the major members of our ICARUS (think tank) Committee worked with manufacturers (Airbus, Boeing, Bombardier, and Embraer), ma- ICAO staff to develop appropriate language. However, changing jor airlines, IATA, ALPA, and IFALPA—worked together to de- Annex 13 itself seemed to be an insurmountable hurdle so it was velop consensus on new guidelines and procedures to be followed decided to offer the proposed changes in the form of a resolu- in the event of a smoke, fire, or fumes situation being encoun- tion that would be adopted by the ICAO Assembly. This resolu- tered on board an aircraft in flight. These procedures have now tion called upon States to show how they would change their laws been accepted, and the flight manuals of all aircraft are now be- or regulations to give priority to accident investigations. As part ing changed to reflect them. Hopefully, we can say that following of the resolution, ICAO would provide assistance to States in pro- implementation of the revised procedures there will be no more viding appropriate guidance, and this resolution was agreed by such disasters for you to investigate. the ICAO Assembly at its meeting in October 2004. However, once the resolution had been adopted, things ap- ICAO Global Safety Roadmap peared to go on the back burner for a while with no apparent Although air transport enjoys an incredibly low accident rate in action by ICAO on the development of any of the guidance that North America, Western Europe, and other parts of the devel- had been agreed. Consequently, in mid 2005, we again ap- oped world, FSF has long pointed out the need to address the proached Dr. Kotaite, who took immediate action to get things significantly higher accident rates prevailing in less developed back on track. Within a very short while, it was established that

ISASI 2006 Proceedings • 11 ISASI 2006 PROCEEDINGS 12 information tothepublic.”Ofcourse,asmightbeexpected, there ceedings againstoperationalpersonneland/ordisclosure ofthe mation fordisciplinary, civil,administrative,andcriminalpro- the purposeforwhichitwascollected,namely, useoftheinfor- I quote,“theuseofsafetyinformationforpurposesdifferent from normal administrationofjustice,inappropriate userefers to,and tigation. Whilethesechangesare notintendedtoprevent the any inappropriate wayotherthantoassistintheaccidentinves- is toimprove aviationsafety, shouldnotbereleased orusedin cessing systemsaspartofanaccidentinvestigationwhosepurpose nesses, orinformationcollectedfrom datarecording andpro- sure thatevidenceandinformationprovided voluntarilybywit- ance onhowtheirlawsorregulations shouldbechangedtoen- next November23. March 3earlierthisyearandthattheywillbecomeeffectiveon on pleased totellyouthattheywere adoptedbytheICAOCouncil were developedas Amendment 11toAnnex 13andIamvery nex 13,ashadbeenproposed originally. Theproposed changes the onlyeffectivewaytodealwithmatterwasamendAn- Under thenewamendment,Statesagree andare givenguid- • ISASI 2006 ISASI Proceedings that islikely tobeanever-endingtask. sponsibility toeliminatetheneedforaccidentinvestigators,but safety. collectively, weare constantlystrivingtofurtherimprove aviation that youalsothinksoanditwillbeyetanotherwayinwhich, that FSFhasbeenintheforefront ofmakingithappen.Ihope required tobepartofanysubsequentjudicialinquiry. against them.Similarly, theinvestigatorsthemselveswillnotbe are secure intheknowledgethattheirevidencewillnotbeused to goabouttheirworkcollectinginformationfrom witnesseswho information inthefuture. quences thatsuchrelease mighthaveontheabilitytocollectsafety information mustnowbeweighedagainsttheadverseconse- in extreme circumstances. Howeveranydecisiontorelease the it mightbeconsidered necessaryto release certaininformation are considerationswhere somecaveatsthattalkaboutoverriding Thank youverymuch. Of course,noneofthisrelieves meofmyself-proclaimed re- We considerallthistobeamajorstepforward andare proud As aresult ofallthis,accidentinvestigatorsshouldnowbeable ◆ Accident and Incident Investigation In Argentina—One View About a Maintenance-Related Case By Eng. Horacio A. Larrosa (MO4131), Chief of Technical Investigation and Support Department, Junta de Investigaciones de Accidentes de Aviación Civil, Argentina

he present paper is related to a 2004 non-fatal accident investigation of an airliner that occurred in Argentina, Tstarting with a technician maintenance error, involving a lack of warning inscriptions in parts and documentation, ineffective exchange of information between different levels in the maintenance organization, and resulting in a worldwide alert issued by the airplane manufacturer. TUESDAY—LATIN AMERICA DAY TUESDAY—LATIN Information about the events

Flight description On Feb. 20, 2004, at 16:15 UTC, the aircraft pilot in command of a scheduled flight, with a Mc Donnell Douglas aircraft, model MD-81, registration mark LV-WPY, serial number 48024, took off from Jorge Newbery Airport (AER) heading for Iguazú In- ternational Airport. During the takeoff run, when rotating, the internal wheel of the left main landing gear became detached from the axle and Photo 1. Damage of left main landing gear after landing. went straight onto the runway. First, it hit the localizer antenna (LLZ) of the AER instrument landing system (ILS), then it went through the airport perimeter fence, crossed a public avenue, and continued running until it stopped in the vicinity of some facilities located outside the airport. The flight crew did not notice what was happening and was informed by the personnel of the Air Traffic Services. The pilot in command interrupted the ascent and asked for a sector in order to hold and consume fuel

Horacio A. Larrosa is an aeronautical engineer (La Plata National University–Argentina) and an aeronautical technician. He is also an Argentine Air Force major. He is chief of the Technical Investigation and Support Department of the Civil Aviation Accident Investigation Board “Junta de Investigaciones de Accidentes de Aviación Civil” (JIAAC) in Argentina from 1990 to present. Larrosa has a post degree in fractomechanic design and has taken courses in aircraft and rotorcraft accident investigation in TSI (Oklahoma and Fort Worth, Photo 2. Aircraft damage in left flaps and engine. Tex., USA) and stress analysis in aircraft structures (Cranfield University, UK). He has also taken the ICAO safety oversight auditor so that weight could be reduced and the maximum landing weight training course, etc. Larrosa has training “on the job” as an accident reached. investigator in the NTSB (USA) and AAIB (UK) and has attended When the aircraft touched the runway, everything was un- numerous courses and seminars, specializing in investigation works in der normal conditions until the other wheel of the left main different countries and is an instructor in several courses of accident landing gear, after a short run, also became detached from investigation. He is an ISASI full member and a LARSASI officer. He the axle. The aircraft continued its landing run putting all its was born in Buenos Aires, Argentina, in 1961 and is married and has weight on the wheels of the right main landing gear, the nose, one daughter. and brake assembly components of both wheels of the left main

ISASI 2006 Proceedings • 13 ISASI 2006 PROCEEDINGS reference torque values were reached. that hadnotbeenusedforcomparison purposes.Inallcases,the tests were outwithboth damagedretaining carried nutsand one wheel wasmountedoverthe damagedpiston,andthetorque and thedefiniteof90foot-pounds willbeprovided. Acomplete torque of200foot-pounds shouldbeapplied,thenitwillloosen The manualestablishesthatwhenmountingthewheel, a pre- Torque Test and thegrayadaptorto“Standard” values. 14 adaptor corresponds tothedimensions ofthe“2 ternal position(graycolor).According totheCMM,yellow transducer (“Adapters”): Internalposition(yellowcolor) andex- c) Externalthreads oftheretaining adaptorsofthewheelspeed to theitemindicatedinCMMas“Original”(orstandard). b) Externalthreads oftheretaining nuts:Thevaluescorrespond Reworked.” indicated inthecomponentsmaintenancemanual(CMM)as“2 a) Axlesendsinnerthreads: Thevaluescorrespond totheitem are theresults obtained— The dimensionsofthefollowingelementswere verified, andthese Metrology anddimensionscontrol expansion, andtorque. Three mainverificationswere out:metrology, carried thermal Material trialsatCITEFA laboratory would indicategreat contactstrainbetweenthethreads. its housingwithoutrotating andwithoutsufferingdamagethat nut (graycolor)thatfittedthewheeltoaxlehadslippedfrom wire intact.From whatwasobserved,itdeducedthattheaxle found, almostwithnodamageandthecorresponding safety the protective cap,fasteningandanti-rotating elementswere or undernormaloperation. in order toavoidwearanddamageduringthechangeofwheels rectly onthepistonends,but jackets thatare puttothem wheels are installed.Thewheelsare inserted andplacednotdi- ings. Attheendsofpistonaxle,brake assembliesand withstands weightanddynamicforces duringtakeoffs andland- brake assemblies,andtheaxlesprotecting jackets (orsleeves). piston (P/No.SR09320081-9,S/No.CPT0181),thewheels, Forces ScientificandTechnical Research Institute(CITEFA): the the MaterialScienceandTechnique Department oftheArmed material corresponding totheleftmainlandinggearwassent For thepurposesoftechnicalinvestigation,following Technical nature Investigations andtrials parts thrown outofthebrake assembliesduringthelandingrun. Left wingandfuselagedamagewasproduced bythemetallic Aircraft damage threshold. landing gear;finallyitstopped1,690metersfrom therunway This testshowed that,althoughthethreads clearance is no- Both wheelsdetachedpresented similarcharacteristics:Inside The pistonlookslike aninverted“T,” andistheelementthat The leftengine(No.1)showedsignsofsevere ingestion. • ISASI 2006 ISASI Proceedings nd Reworked” nd transmission of the piston heat to the nut is carried outthroughtransmission of thepistonheattonutis carried out. was carried ture betweenbothpiecesthatproduced adifferential expansion, inserting thenutintopiston, withadifference oftempera- pelled withnodeformation or rotation, atestthatconsisted of In order toexplain thewayinwhichretaining nutswere ex- Thermal trials they were inperfectcondition. torque. Whencheckingthenutsaftertrial,itwasfoundthat that thenutisnotoneestablishedbymanual,through ticeable whenthreading thenut,itisnotpossibletodetermine Photo 4.Detaileddrawingofwheelattachmentassembly. Photo 3.Piston assemblyandwheelattachmentsystem. When theretaining nutismatchedupwiththepiston, the Photo 7. Thermal test: thermocouple system in axle assembly. Photo 5. Detail of axle, spacer. and adapter (internal side). TUESDAY—LATIN AMERICA DAY TUESDAY—LATIN

Photo 8. Thermal test: curve “Nut Temp. vs. Axle Temp.”

one pending value, but in this case the value is higher. It was also Photo 6. Detail of axle thread, nut, and anti-rotating devices observed that, at the beginning, when the heating stationary re- (no damage). gime had not been entered, the slope was even higher. This supports the hypothesis about the amplification of the quicker heat- all the contact surfaces of the threads. When the nut used is smaller, ing phenomenon. According to what was verified in the trial, it the heat flow is restricted since the contact surface between threads could be believed that when the axle heats quickly because of the is reduced. Nevertheless, it was not possible to determine the braking effect, the difference of temperature to be reached be- exact conditions of the heat flow during the accident; however, in tween the axle and the nut could approach the 55 ºC. order to quantify the phenomenon characteristics, a test that consisted of inserting the nut into the piston end maintaining a dif- Summary of the results ference of temperature between the pieces was carried out. With From the way the parts were found and the measurements car- this purpose, the axle was heated, and it was confirmed that the ried out, it is deduced that the key part is the wheel retaining nut nut could be placed by being hit slightly with the hand (without (“axle nut”). rotation) if there was a difference of temperature of about 55º C After the eye observation and the inspection with stereoscopic and higher. glass, it was revealed that the threads were almost intact. Like- In order to better simulate the operating conditions and be wise, it was proved that the clearance with which the nut threaded able to assess the thermal effects that could be generated as a with the piston was too much—although, the nominal torque result of using the brakes, another trial was made and it consisted values were reached during the tests. of heating the axle with the standard axle nut installed with its Because of their dimensions, it was confirmed that the nuts anti-rotation elements to verify if these pieces had a noticeable were original (standard), while the piston had threads correspond- differential heating by conduction. ing to a second reworking, which should have matched up re- The temperatures were measured through a thermocouple taining nuts of second oversize according to the manual. system for both elements. All the same, at room temperature, it was impossible to extract At the beginning of the trial, the temperature of both parts them without rotation movements. It was confirmed that the nuts was 23º C. After about 80 minutes (there was no equipment avail- could not have rotated since they were connected to the anti- able for a quicker heating), the axle temperature reading reached rotation rings; these were also checked, and they were in perfect 113.6º C, while the nut record was 83º C (difference: 30.6º C). All conditions, as well as the piston insertion slot. the intermediate values were also registered, and the curve “Nut The aircraft manufacturer’s information indicates that, under Temperature vs. Axle Temperature” was traced. normal operating conditions, temperatures of about 150º C are If the temperatures increase was even, the graphics should have reached, at approximately 28 cm from the axle end. Such tem-

ISASI 2006 Proceedings • 15 ISASI 2006 PROCEEDINGS installation. place duringtheaircraft third operationcycle,afterthewheels 16 quarter-of-an-inch blacklettersonaone-inch yellowband:“1 No. 100.0from the “ShopTraveler” indicatedthepaintingof (“O/S”) andwere paintedyellow. vibro engravedwiththe pistonserialnumber, marked asoversize adaptors forthetachogenerator fastening.Allthesepartswere house, comingfrom thesameprovider, afterbeingoverhauled. the conditionsunderwhichanotherpistonwasreceived intheware- order torequest JIAACtechnicalpersonnel tobepresent toverify The operatorcontactedJIAAC,duringthepresent investigation,in Repetitive caseforthelandinggearrepairingworkshop two reworked mainlandinggearpistons. know aboutit.Itisworthclarifyingthatthecompanyonly has nents inthefleet,mechanicsfrom alllevelssaidtheydidnot sulted iftheywere aware oftheexistence ofreworked compo- as enoughexperience were observed.Nevertheless, whencon- eral tasksatisfaction,workappreciation, andcommitment, aswell From theinterviewsoftechnicalarea staff,atalllevels,agen- Considerations ontheorganizationalfactor service onFebruary 18 tional test—onFeb. 17,2004.Theaircraft resumed commercial pleted—including brakes, wheels,andthesubsequentfinalfunc- days. Tasks beganonFebruary 16,andtheinstallationwascom- the operator’smajormaintenancehangar, wasperformedin2 include documentarydataindicatingtheexistence ofthosenuts. documentation already mentionedattached,butthelatterdidnot fore, theywere matchedupandwere notinterchangeable. axle andthenutswere reworked atitsorigincountryand,there- serialized withthepistonserialnumber, sinceboththepiston tor interveningonthatoccasionalsofailedtodetecttheomission. one sidebefore assemblingthepistononaircraft. Theinspec- nuts backintheirplace,whichhadbeenremoved andplacedon control). Themechanicexecuting thistaskdidnotputtheyellow portation case,inorder tobesentthedispatchsector(parts was removed tobesentrepair atexternal workshops. Serial No.CPT0181wasdamagedinthechrome plating,thusit invoice, andplanningofworkshopprocess (“ShopTraveler”). following documentation:FAA Form 8130-3,packinglist,supplier bly from itsmanufacture process wasfollowed,studiedmainlythe matched upforthereworked piston,thetraceabilityofassem- ing thewheel,insteadofappropriate oversizenuts,specially havingdetectedthatstandardAfter nutshadbeenusedforfasten- Background andchronology dures, especiallywhenturningtheaircraft. loads thatthelandinggearwithstandsduringtaxiingproce- of thenuts(notmatchedup),addedtoimportantlateral expansion asamechanismhighlycontributingtotheexpelling peratures couldbedeemedenoughtoconsiderthedifferential A mistake wasverifiedinthepartidentification;moreover, task The pistoncamewithtwoaxle nutsforthewheelsandtwo The landinggearinstallationontheLV-WPY, outat carried The operatordispatchsectorreceived thepistonwithorigin It isworthmentioningthatsaidnutswere paintedyellowand Once removed from theaircraft, itwasplacedbackon itstrans- During theassemblingprocess onanother aircraft, thepiston • ISASI 2006 ISASI Proceedings th ofthatsameyear. Theaccidenttook ST to informalloperatorsofsimilaraircraft. case ofLV-WPY (withoutitsidentification)inwebsiteorder known forthiscase. great number ofvariablestobeconsidered andwhichare un- expulsion process wouldnotbecompletelytruthful,duetothe lost, leavingthenutwithsignificantdamagetothread. reworked axleandanunsuitablenut,whichcausedawheeltobe cramp wasmissing.Onlyonecaserecorded witha ofaDC-9 tated andgraduallybecamelooseuntilfree ortheanti-rotation about variouscasesofwheelslossesinwhichtheiraxlenutsro- background information,obtainingdatafrom themanufacturer manufacturer, andtheoperator. (DNA), theNationalTransportation SafetyBoard (NTSB),the NationalAdministration maintained withtheAirworthiness Aviation AccidentInvestigationBoard (JIAAC),closecontactwas From outbytheCivil thebeginningofinvestigationcarried and theairplanemanufacturer Information exchange withtheNTSB try aboutthissituationthrough a“SafetyAlert.” ing factors,theJIAACdecidedtoinformmanufacturingcoun- need touse“matchedup”nutswasoneoftheaccidentcontribut- about theexistence ofoversizethreads, whichwarnsaboutthe was considered thatthelackofaclearidentificationonpart RWK OVERSIZE out.Asit THREADS,”whichwasnotcarried in thecaseof pistons. manufacturer initsCMManditis alloweduptoathird rework, that iswhytheyare reworked. Thisprocedure isapproved bythe in theirthreads and thustheyfalloutsidestandard tolerance; economical, sincetheyare partsthathavesuffered wearandtear second oversizeaxlenuts. had secondreworked threads, whichshouldgowithmatchedup the wheelsaxlenutswere original(standard) whilethepiston The factortriggeringtheaccidentwasidentifiedasfact that Technical analysis the situationwascontrolled bycabincrew inacorrect manner. command himself,and,eventhoughsomeofthemwere nervous, for thepresent circumstance. ing totheinterpretation, out in therightway landingwascarried Flight recorders were inserviceanddatawere obtained.Accord- Operative analysis the aircraft manufacturer sothattheytake measures aboutthis. the related Federal Aviation Administration(FAA) officesandto the world.Immediately, theNTSBdistributeddocumentto other elementsprocessed bythesamecompanyinotherpartsof volved intheaccident.Theseoutcomescouldalsobepresent in in thedocumentationandmarkings,bothpistonin- withacopytotheDNA, statingthemistakestional Affairs, found The JIAACissuedaSafetyAlerttotheNTSBOfficeofInterna- Issuance ofa“SafetyAlert”totheNTSB(USA) As aprecautionary measure, themanufacturer includedthe Manufacturer assertsthatatheoretical simulationofthenut Many consultationswere out,especiallyaboutsimilar carried The installation error ofthesestandard nutswasmainly due The reason tousereworked elementsisbasicallytechnical- Passengers were dulyinformedaboutthesituationbypilotin Safety recommendations

To the operator Consider the convenience to establish procedures aiming at improving communication among mechanics, supervisors, inspec- tors, and higher levels, such as the implementation of working groups in classrooms, the utilization of suitable techniques that enable the strengthening and improvement of interpersonal relationships, and the development of maintenance resource management (MRM) programs. Consider—in order to improve safety levels in the maintenance activity—including the facts leading to the present accident in Photo 9. Axle tip vibro engraved inscription, covered by the technical training program developed by the company to painting (view after painting removal). avoid a similar condition in the future. Consider the improvement of their established procedures for to the following factors: receiving parts not listed in the landing gears documentation, 1. Separation of the piston and its matched up and serialized regarding all not interchangeable, not storable, serialized/matched fastening elements during its removal 8 months before the acci- up parts, that form an indivisible part with their corresponding dent. This action could be understood due to the fact that the component. staff was not aware of the existence of reworked elements. Consider the improvement of communications and of informa-

2. Inadequate communication was discovered here regarding the tion flow between technical managements and the logistics chain AMERICA DAY TUESDAY—LATIN information available for lower level personnel and the lack of common in the business group, when there are supplies policies consultation of the latter to their supervisors about the existence changes, such as the admission of reworked elements into the fleet. of an unusual element in the task (a yellow nut). 3. During the installation of the wheel with standard nuts on the To the National Transportation Safety Board (NTSB, USA) reworked piston, the personnel did not count on any marks warn- Consider the convenience to submit a recommendation to the ing about this situation, thus duly carrying out the task and with Federal Aviation Administration (FAA) so that in Form FAA 8130- the usual elements. The markings mentioned—the vibro engrav- 3, in the “Remarks” box, indication is given in the necessary cases ing on the axles tips was covered by painting, and the yellow of the condition of the element as reworked and/or having band with the relevant inscription was not present. matched up or easily removed parts. The maintenance manual did not warn against this situation. Consider the convenience to submit a recommendation to the Even though the nut clearance was evident when installing it aircraft manufacturer with the following: manually, the threaded joint absorbed the established torque with- • Include in the MD model aircraft maintenance manual (AMM), out any problems. in the chapter corresponding to wheels installation, a clear warning about the utilization of special elements necessary to mount Cause assemblies with oversize elements. These inscriptions are present During the takeoff phase of a scheduled air transport flight, the in other AMMs. (Accomplished by the manufacturer Feb. 25, inner wheel came off the left main landing gear, which caused an 2005: A warning will be added in the upcoming revisions of emergency landing, during which the external wheel of the same the AMM affected airplanes). landing gear came off, due to the installation of standard fasten- • A possible change in the design of matched-up parts, such as a ing elements for the wheel, on a reworked assembly. variation in the threads pitch of oversize elements, that do not allow the interchangeability with standard ones. Contributing factors • Consider the convenience to submit a recommendation to the • Lack of warning inscriptions of it being a non-standard ele- landing gear repair workshop with the following: ment, on the landing gear leg, by the repair workshop that had • Carry out the corresponding warning markings, in a perfectly carried out the piston overhaul. visible way, on the reworked parts. ◆ • Lack of warning about the existence of reworked elements in References/Bibliography the aircraft maintenance manual. Final Accident Report, JIAAC, Argentina (Resolution No. 41/04). • Ignorance of the operator’s mechanics about the installation Technical Report No. 02/04, CITEFA, Argentina. of reworked parts. McDonnell Douglas AMM and CMM (MD model).

ISASI 2006 Proceedings • 17 ISASI 2006 PROCEEDINGS Committee andISASI. He isamemberof FlightSafetyFoundation’s InternationalAdvisory among others,ofcoordinating theAccident InvestigationCommission. ASPA’s director technical from 2002to2005,with theresponsibility, ASPA’s technicalandforeign affairssecretary from 1999to2002and issues insafetyseminarsorganized indifferent partsoftheworld.Hewas deputy president. Capt.Limónhasbeenaspeakerregarding different WorkingALAR Group Since2001,hehasbeentheIFALPA (CAAG). and theIFALPA representative ontheFlightSafetyFoundation’s CFIT/ accident investigator, IFALPA accredited airportliaisonrepresentative, Committee’s vice-chairmanin2006.HeisalsoanIFALPA accredited Pilots Associations Accident AnalysisCommittee since1997andwasthe 1998. HehasbeenamemberoftheInternationalFederation ofAirline professional secretary oftheIberoamerican Pilots’ Organization (OIP)in Pilotos’ ExpertTechnical Commission for5yearsandwasthetechnical accident investigations.Capt.Limónhasbeenthepresident ofColegiode and isalsoamemberoftheaccidentinvestigationteaminseveral and ASPA deMexico(MexicanAirlinePilots’ Association)since1993 tains inthesurrounding areas, makingTuxtla Gutierrez avery and non-precision approaches. ents foraCFITaccidentare lowvisibility, mountainousterrain, fog andclouds.We mustremember thatthethree mainingredi- area, itisverycommontofindlowvisibilityattheairportdue Because ofthislocationandtheweatherconditionsaround the feet. Itislocatedinaplateauthemiddleofmountainchain. instance, innavaids,precision approach systems,andsoon. lar toMexico, withlimitedresources toinvestininfrastructure, for accidents like thisone. the airlineandMexican governmenttoavoidhavingother the mostimportantlessoncanbefoundinactionstaken by discover severallessonsofwhatshouldnotbedone.Moreover, errors thatledthecrew tothisCFITaccident.Indeed,wewill tation wewillanalyze,basedonReason’s Model,thechainof cident thathappened6yearsago.However, duringthepresen- 18 O Even thoughtheairporthasanILS,there are alotofmoun- Tuxtla Gutierrez Airport hasanelevationhigherthan2,000 This couldbeanexample tobefollowedbyothercountriessimi- You willprobably questiontheimportanceofreviewing anac- All 19peopleonboard perishedasaresult oftheaccident. • ISASI 2006 ISASI n July8,2000,aBritishAerospace Jetstream 31hada (Chiapas) toVillahermosa (Tabasco) insoutheastMexico. CFIT accidentwhenoperatingtheroute Tuxtla Gutierrez Pilotos (MexicanProfessional Pilots’ Organization) the Accident InvestigationCommissionofColegiode Safety Program certificate.Hehasbeenamemberof aircraft accidentinvestigatorandbearer ofaUSCAir aircraft, currently flyingasanA320captain.Heis pilot since1979,havingflownB-727andB-757 Capt. CarlosLimón Proceedings hasbeenaMexicanaAirlines By Capt.CarlosLimón,IFALPA DeputyPresident A CFITAccident: Lessons Learnt Lessons to reduce accidents andhavesaferoperations. structure andtodeveloptrainingprograms withthesolelygoal countries like Mexico withlimitedresources toinvestininfra- This presentation andtheanalysis oftheaccidentcouldhelp Conclusions Robert Sumwalt’sconceptofpilotflyingandmonitoring. manuals. ItwasalsothefirstairlineinLatinAmericatoimplement adapted from theFlightSafetyFoundation toolkit. ALAR (Approach andLandingAccident Reduction) trainingcertificate the DGACmandatedthatallpilotsmustpresent theALAR planes for13ormore passengersdoingcommercial operations. Mexico wehavenothadaCFITaccidentsinceJuly2000inair- authority advisor).AsaconsequenceoftheCFITtraining, in de Mexico (theprofessional pilotsorganization recognized asan dation andtranslatedintoSpanishbyColegiodePilotos Aviadores training, basedonthematerialdevelopedbyFlightSafetyFoun- Mexico wastheonly countrythathadestablishedmandatoryCFIT accidents. line andtheMexican DGACinorder toprevent similarfuture also discusstherecommendations andactionstaken bytheair- and latentfailures prevailed overallpossibledefenses.We will this accident,wewillreview Reason’s Model,where thefailures tions, deficientSOPs, complacency, weather, ATC, andsoforth. most ofthem,includinglosssituationalawareness, communica- short periodoftime.Throughout thepresentation, wewilldiscuss ance—errors thatresulted intheCFITaccident. made startingfrom theveryfirstmomentoftakeoff clear- From thisanalysis,weobservedthatseveral mistakes hadbeen was taxingtotherunwayinusemomentofaccident. allowed ustoanalyzetheCVRfrom themomentthat crew stop inVillahermosa forpassengersgoingtothatdestination. to Veracruz. Owingtoallthesedelays,thecrew wasinstructedto Aerocaribe 7831.Theoriginallyroute wasfrom Tuxtla Gutierrez delayed. ThiswasthecaseofourJ31thatoperatingflight the airportwasoperatingnormally. conditions were aboveminimumforoperations.Consequently, the fog.Theairtrafficcontroller “wasestimating”thattheweather airport wasbeingbuiltinabetterlocation. eration wasfinallytaken. Amilitarybasewasusedwhileanew long periodsbecauseoflowvisibility, thedecisiontostopitsop- complicated airporttooperate.Sincethewasclosedfor On theotherhand,Aerocaribe improved itsSOPs andtraining In order toreinforce theCFITtraining,almost2yearsago, It isimportanttonotethatatthemomentofaccident, In additiontotheperformanceofkey playersinvolvedin It isunbelievabletowitnesstheamountoferrors madeinavery The totallengthoftheflightwaslessthan30minutes.This Because ofthelowvisibility, mostoftheregular flightshadbeen The dayoftheaccident,visibilitywasreduced asaresult of ◆ The Advanced Qualification Program (AQP) as a Tool to Break The Chain of Accidents By Claudio Pandolfi (AO4028), Safety Manager, DGAC–Chile

Introduction lows us to consider the skills and behaviors of the sixth genera- Since the first flight of the Wright Brothers in Kitty Hawk in 1903, tion CRM, the last being based on the TEM Model (Helmreich until the early days of the present century, “the human factors have 1998), of error management. been responsible for air accidents,” i.e., more than three out of four In the same order of ideas, we will show how we are managing accidents (80%) are due to problems related with human factors operational risks (MAROP) and the way to integrate all these (ICAO Doc. 9683 An-950). concepts under one common system related to the air Safety According to Dr. A. Kotaite, from the International Civil Avia- Management System (SMS), based on the application of ALARMA tion Organization, 2004 was the safest year in the world aeronau- type programs (CFIT/ALAR toolkit), LOSA and FOQA, and once tical system. Nevertheless, 2005 stands as a contradiction against this information has been processed, updating the AQP program. AMERICA DAY TUESDAY—LATIN the trends shown by the history of flight safety. In the present Through these options, we have defined for short and mid study we will try to demonstrate that the advanced qualification term the targets for its implementation, for which we are apply- program (AQP) breaks the present tendencies related to aviation ing the technological innovation that will lead to the optimiza- accidents and promotes the use of 21st century technology in tion of instruction, training, and supervision factors for the air aeronautical operations in a safer and more efficient way. We will crews in their interaction with the different kinds of technologi- start by defining the basic concept of AQP as Dr. Thomas cal contraptions, which allow the adaptation to our operational Longridge (1998) describes it: “The systemic methodology in the de- cultures and regional and socioeconomic realities. velopment of instruction, training, and evaluation programs for crews and air dispatchers, including skills in CRM.” Genesis and development Starting from this hypothesis, we will analyze historical back- The application of human factors in commercial aviation has been a ground, to eventually check some national and international sta- tool that led to various ways of implementing safety flights, but its tistic data, as well as the techniques we are using to face the human verifications in real operations had yet remained more as a recom- factors dynamics as a proposed strategy. We will also look at the mendation than a true way of theoretical and practical training. conceptual way to achieve quality training along the context of this We can show that the advanced qualification program, or AQP, complex operational dynamics and how high-technology systems is based on the operational form of the human factor training, admit a real air safety solution according to 21st century trends. and on the so-called management skills of the crew resource Thus, these guidelines will allow us to reduce the present tenden- management. Concerning the AQP program, we will talk of an cies that generate accidents with catastrophic consequences. ACRM (advanced crew resource management), or advanced CRM, Following the above, we will expose how we are facing these which is directly related to the behaviors evaluated in today’s new challenges through the application and adaptation of the operating commercial aviation AQP program, according to a platform that was defined and trans- What is the AQP program and what is it for? Will AQP break the ferred by the United States aeronautical authority, with the sup- current accident barriers? Is this model a vanguard system? The port of Dr. Douglas Farrow and Chris McWhorter from the FAA. answer to all these questions is undoubtedly YES, as a systemic way Within this theoretical frame, we will show the tools used to aim to face the instruction, based on the technology available in the 21st through adapted models in human factors training, under the century, and using for this CRM skills and tools. Another open ques- Shell Model concept (Edwards/Hawking 1975), together with tion would be: Is the AQP model based on human factors? Here too using the opportunity windows described by Reason (1990), and the answer is positive; in order to apply and develop this program, it the model developed by Novis and Bendito in 2000, which al- is essential that the companies apply the systemization of the different human factors concepts that are based on the models published Claudio Pandolfi is the head of the aircraft accident by Shell (Hawkins 1975) and TEM (Helmreich and ICAO). prevention department at the DGAC, Chile. He has This program has been applied since the early nineties and 30 year’ experience as a professional pilot and served reveals itself as a proposal for the U.S. air industry, under the with the Chilean Air Force. He earned an MBA supervision of the Federal Aviation Authority (FAA). Its main lines (environment and quality) from IDE Institute of have been led by Longridge and Farrow, from the FAA, which Spain, attended the USAF flight safety officers course, certainly allowed to create the most efficient way of operational and completed the administration of air safety systems training at a global level, and in my opinion, has permitted to requirements at USC. He is a recipient of the “Sir Douglas Bauer” break barriers and trends in accident rates, thus generating a Award and is a member of ISASI and LARSASI. more efficient and secure system.

ISASI 2006 Proceedings • 19 ISASI 2006 PROCEEDINGS 20 two variablesthat thepublicisnotready to giveup:thecostof low-cost companieswaspointedout,as thelatterhavetorespect FIDAE 2006aerospace fair, thephenomenongeneratedby the instructionandcontinuous evaluationprograms foraircrews. crew resource management(CRM),whichare an integralpartof with anobjectiveassessment ofthebehaviorsandskills pelled theoperatorstoapplyhumanfactorstoolstogether ness, asthisprogram hasallowedanindirect control andcom- ing. Thisiswhere theAQPprogram plays avitalrole inairbusi- as anessentialcomponentofthetheoretical and practicaltrain- gram, andisbasedonthesystemicapplicationofhuman factor ship, asthisregion istheonly one thatusesthisinnovativepro- the operationsinthisarea undoubtedlyshowadefiniteleader- the UnitedStates.Underthisperspective,wemaythussay that fic takes placeinthearea includedbetweenMexico, Canada,and lion flights,takingintoaccountthatoverhalftheworld’sair traf- Canada maintainatgloballevelarateof0.5accidentsper mil- thattheUSAand signals theninitsdocumentC-302-AN/175 chose theAQPprogram. achieve thefinalqualificationofcompleteapplicationand fined chronogram ofeventsthatconsidersfivestagesinorder to obtain validatedandfree accessdatafrom theFAA, underade- voluntary applicationbythedifferent companiesandaimsto lation, whichispresently obsolete.Thisprogram isbasedupona iscreated,the AC-120/54 togetherwiththeSFAR 58specialregu- performed orexpected tobeusedinoperationaltraining. this descriptivestudy, whichdescribedindetaileverymovetobe was definedbyBloom’staxonomy, thelatterbeingbasisof ations (LOFT/LOS)fortheairbusiness.Theinstructiontheory typical oradaptedtothereal worldofoperations,ortypicalevalu- may appearthefirsttrainingprofiles inenvironments thatare knowledge around 1988,thatgrows in1989suchawaythat the public.Itisthisvoluntaryworkthatgeneratesanadvanced to bethesafestandmostefficienttransportmeansineyesof safety factorsandachievescaleeconomiesthatallowedthelatter andthecommercialNASA, companies,inorder tooptimizeair groups undertheleadershipofaeronautical industry, theFAA, dustry. Thisresulted in theconstitutionofseveralmulti-taskwork trends thatmightbringsystemicimprovements intotheairin- Moreover, thisstudywasorientedtotheresearch ofoperational belled according tothephenomenoncalled“operatorerror.” auto-critical studyofthevariousfailures andaccidenttrend la- American system,where themultitaskgroups neededadeepand gram results asanaturalexpression ofthecompaniesinNorth to thecommercial airoperations. us toappreciate acompleteandsystemicapplicationofthismodel analysis ofthestandards definedbytheFAA’s AC120-54allows plication requirements ofanAQPstylemodel,whileadetailed JAR 1978regulations onlyincludestendenciesandgeneralap- the real worldofoperations.Acomparisonletsusseethatthe system demonstratesamore systemicandefficientapplicationto can acknowledgeimportantdifferences, through whichtheAQP plied atagloballevel,beitbyEurope ortheUnitedStates,we programs? Whenweanalyzeandcheckthedistinctmodelsap- During thelateIATA meetingheldinSantiago, Chile,atthe analyzingthestatisticsataworldwidelevel,ICAO After In 1990,thestartisgivenunderFAA’s supervision,and First, letusanalyzetheAQPoriginsandgenesis. Thispro- What istheAQP?makes itdistinctfrom thetraditional • ISASI 2006 ISASI Proceedings by thecompanies intheimplementationof AQPprogram. and allowsapermanentsupervision ofthedifferent stagesinvolved does it:Office230.Thisdepartment centralizestheinformation outbyauniquebureau,vision iscarried inasimilarwaytheFAA the companythatchoosesthis excellency qualification. of thecompanies,soitsdevelopmentwillexclusively dependon the applicationofthiskindprogram istotallybasedonfree will level statusinthecompany. Itmustalsobepointedouthere that manent analysisthatgeneratesareal knowledgeoftheinstruction struction isassessedandchecked ateverystage,thanksto aper- based onthecontinuousimprovement concept,inwhichthein- requires specialattention. istic ofourLatinAmericanoperationalenvironment, andwhich instructed, suchasthetypicalMachoPilot concept, socharacter- the appearanceoftypicalculturalproblems whichare notfully situational lossofawareness, whichunderhighstress provoke shows theimportanceoftrainingregarding thedilemmaofshared applied underanoperationalcontext. TheAQPprogram also latter isusedinEurope andallowsustoanalyzethestrategies others, justasexpressed intheNovis/BenditoModel(2003).The tion factors,situationalawareness, anddecision-makingamong between allthecrew members,suchaslanguage,communica- to applytheoretical andpracticalconcepts,astheirinteraction situations underspecificcharacteristics.Notonlydoesitleadus skills, thankstothehighlevelofrealism inthesimulationofreal gram letsusobjectivelyassesseverystageofCRMbehaviorsand vanced simulation(Dismukes 1998).Inthiscase,theAQPpro- some flightinstructors.Thisconstitutesanewparadoxinad- previously flownitphysically, thoughthisgeneratesdoubtsamong that itisactuallypossibletooperateanaircraft withouthaving mum traininglevel. the errors, thankstomore real trainingthatgeneratesanopti- quality trainingtoeventhelessexperienced pupilsandbalance This iswhere theAQPprogram playsavitalrole, asthisgives the pupilandoperateanaircraft withoutactuallyhaving toflyit. are calledfull-flyingsimulators(FFS)andallowtointegrallyqualify practical knowledgeinfulllevel,orCategoryDsimulators:these leave thethird stagefortheapplicationoftheoretical aswell tems suchashydraulics,FMS,ortypicalfailures (Dismukes), and which allowtoperformhundreds ofmaneuvers,andactivatesys- of more advancedprograms inflighttrainingmachines,ofFTD, bus conceptorE-learning.Asecondstageisdefinedbytheuse tool fortheinitialstage,whenusedinconjunctionwithsylla- hand, where basictrainingcomputersorCBTare theperfect define theformulaandwaytousetechnologicallevelat century. Sincethebeginningofprocess, itiscompulsoryto events tobeassessedbyusingthetechnologyavailableinour clearly definedatallstages,anddescribeeachoneofthe seeking excellence intheinstructionprocesses, whichhavetobe The operationalpurposeofthisinnovativeprogram consistsin The goalsoftheAQPprogram expresses thenewmodelthatairbusinesshastoface. will fail.”With thisstatement,theICAOPresident Bisignaniclearly the ticket doesnotunderstandthis andairsafetyfactors.“Who In summary, this program aimsattheoretical andpractical As regards theChileanaeronautical authority, thiskindofsuper- The AQPprogram’s majorgoalistoachieve During thisessentialstage,itispossibletoachieveanefficiency quality training training levels to be actually applied at the various stages deter- active vision. This is our great challenge: stop being reactive, as mined by a company, and at being an integral form within the reflected by the Heinrich pyramid (1930) and be able to invert or latter’s instruction and training programs. It also allows the de- at least modify its base so that our actions are more proactive. velopment of its operational culture and leads to a quality stan- Through our present knowledge, we define as an expect level dard that is its main target, together with the creation of a system that of a crew who still makes operational errors of any kind but is that can tolerate the operational error, as stated by the ICAO, as able to manage them and return to a normal or low-risk level. This well as Helmreich (1998) in his Threats and Errors Management is what AQP is leading to our crews are training in an operational Model (TEM), and Reason (1996) through his concept of the environment that is completely similar to the real operational world human error in his famous Swiss cheese. (LOS/LOE) and generates an environment of efficiency and safety, which leads to a change in our current trends, avoids losses to the The AQP program integral concept air business, and consequently makes the world air system more It is based on the SHEL Model (Hawkins 1975) describing the efficient and eventually safer and more cost efficient. interaction among man, machine and environment, and how The tools provided by the AQP program allow training that is under certain operational circumstances human beings make stu- based on what actually happens in the real operational world, and pid mistakes. Moreover, when we carry out a reactive exam ac- feeds with action a reliable report system (SARSEV, BASIS), an cording to the ICAO’s Annex 13 regarding the investigation of operational quality verification program (FOQA), and a line op- an accident, this model allows us to visualize a part of the equa- erational audit system (LOSA) that all permit, thanks to a com- tion regarding this problem. Nevertheless, and in spite of ergo- mon language, their interaction in an air safety management sys- nomic improvements to come, operational errors are and will be tem (SMS). This global frame feeds the instruction processes by a part of the operational world, and as long as we train in the accessing a standard based on a continuous improvement, with an most real way that is possible, in an integral form and using agreed empirically validated model that allows applying coherent strate- AMERICA DAY TUESDAY—LATIN procedures, it will be possible to reduce our accident rate, or at gies to the distinct instruction processes destined for our air crews. least to revert certain present trends. We think that is not enough to use and apply all the operational resources allowed by our The AQP model and its certification stages organizations (CRM) as these only ensure a certain air safety level, Among the qualities of this program, we can point out that it and that through the implementation of the AQP program it will describes with full details the distinct characteristics, skills, and be possible to reach better operational levels, which will match achievements expected to be applied in the instruction process, the technological level that we operate in this century of commu- based on Bloom’s taxonomy (1948), which allows multitasking. nications. We will take just an example with the different prob- This stage is the basis of the AQP program, and is the longest to lems that occur today during the phase of undercarriage extrac- develop in the company, as it requires the application of the dis- tion. In our 21st century, the old saying: “There are two kinds of tinct agreements that tend to define the resumes and the stan- pilots, the ones who land with the undercarriage up, and the dards the company will use for its operational system, which will ones who will” remains valid. It is not enough to have a standard have to include the necessary corrections as it advances through operational procedure (SOP) and isolated programs that do not the different stages. interact and are copied from different operational cultures. As per the above, experts are needed in all the areas involved, From the application of Helmreich’s TEM Model, we may state such as instructors, pilots, systems engineers, programmers, tech- that as long as we maintain a real training level by applying and nicians, psychologists, and teachers. This working team will have assessing the behaviors, or CRM skills, the latter will avoid open- to define the typical resume to be implemented in this phase, as ing opportunity windows, and let us focus on the operational well as the feedback method. This stage will also have to explain error itself. The AQP is precisely that, a tool that allows us to how to instruct the personnel involved, as well as the chronogram break traditional paradigms in conventional instruction, and sup- of defined events, for our operational reality. This is being imple- plies us with a friendlier system, with a major error tolerance for mented in the Airbus A340 fleet as an initial stage. the operator, and thus reduces our present operational trends, at A second stage will check and correct the system, on the basis on a regional or global level. the recollection of objective evidence, applying the Deming pur- From the natural evolution experimented by the first genera- pose together with the distinct observations found. From there the tion CRM, when it first focused on the crews or the cockpit, to curricular models will be corrected and the changes performed, the present evolution that naturally integrates the Threats and completely or partially. We can take as an example of the latter a Errors Management Model, which seeks to manage the undesir- typical maneuver in which the council or instructors committee able situations know as TEM, thus allowing a more holistic vision objectively determines that the required action has been badly as- of this problem. Man can now manage his own errors and escape sessed and does not match the program’s specific goal, after which from an event with possible catastrophic effects, at being able to the latter is corrected and a new standard is redacted. Maneuvers avoid it or “successfully manage a determined event” thanks to will also be added or modified that result from the daily opera- his capacity to control undesired situations: this is what we call tional experience, based on the information recollected by other 3M—that is the management of threats or lapses, and thus the parallel programs under the safety management system (SMS); ability to avoid an undesired situation and its catastrophic ef- for example, the flight safety anonymous report system (SARSEV), fects. The new paradigm should now consist in learning from the flight operations quality assurance system (FOQA), and in-line successful operations, which represent more than 98% of the safety audits (LOSA), together with the integration of a flight safety events worldwide (Maurino 2005) instead of focusing as we cur- voluntary anonymous report system, which is at the official publi- rently do on the accidents and having a more reactive than pro- cation stage by our national aeronautical authority.

ISASI 2006 Proceedings • 21 ISASI 2006 PROCEEDINGS 22 plications inFTD andFFSsimulators. ment oftheoretical andpractical training,includingtypicalap- CRM skill,hadnotbeencorrect, whichgenerated areinforce- the man/machineinteraction (Shell),madeofhumanfactorsand volved. Oncethedataofthis case were analyzed,itresulted that who eventuallydecidedtoland manually, withallthelimitsin- wind. Thesituationgenerated someuncertaintyamongthecrew, caused theabortionatlowaltitudebecauseofanexcess ofcross not landnormallythree timesinarow, astheautomaticsystem ditions. We knowthecaseofahigh-technology aircraft thatcould peaks upto55knotsatevening,thatgeneratereal tempestcon- strong type,averaging28to35knotswith windsofhurricane in theMagellanStraits,where springandsummerare seasonsof is thecaseinmostsouthernsectorofChile,andspecifically our crews whenoperatinginextreme orhigh-latitudeareas, which as wellpracticalinstructionhours. emphasis totheFTSandFFSphases,through more theoretical factors andCRMskills,soithasbeendecidedtogiveahigher been performedcorrectly ontheground—a clearcaseofhuman the analysisshowedthatsysteminitialization(INS)hadnot and landmanually, eventuallyachievingasuccessfullanding,but results, thecaptainhasfinallytaken therightdecisiontogetback havingtriedtosolvethisproblemAfter withoutanypractical cockpit remain darkandshowonlythemention“Please Wait.” the climbingphase,crew hasseenallthescreens oftheglass In ourreality wehaveknowncasesthataftertakeoff andduring Operational casesandchallenges the othermodels. before directing theeffortstoBoeingB767fleet,andthen plying theDemingcycleaimingforacontinuousimprovement instruction courses,andthedistinctdeviationscorrected byap- for theA340fleet,afterwhichcorrections willbeappliedto initial program hasbeenlaunchedandisnowattheclosingstage supervision oftherespective authority. InthecaseofChile, an achieve, sotheprocess willalwaysremain undertheconstant obtained. We haveassessedthiswilltake 24to36months stage isreached, afterwhichtheAQPprogram certificationis the deficientuseoflanguageatcriticalmoments,amongothers. proximations oftheFlightSafetyFoundation program, or ALAR tions, orthenon-respect ofstandards duringthestabilizedap- eration orACARS,theconfigurationofunexpected approxima- from theprevious events;forexample, adeficiencyinFMAop- is fundamentaltobeablecompare thedistinctobservations experience andminimumoperationstimes willberequired, which standard. vious stagesandestablishacontinuousimprovement asaquality nated workthatwilltendtoovercome thedeficienciesofpre- the companyandupdatelatter’sdatabank,thankstocoordi- improvement. Thisinformationwillhelpprovide feedbackto tors) anddefinethechangesthatwillbringareal continuous gether withtheirrespective aeronautical authority(DGACinspec- the councilofinstructorswillanalyzeglobalinformationto- on acommonlanguageofanSMS-typesystem.Thecreators and these systemsare workingandintegratedinthereality andbased It isimportanthere topointoutthesituationexperience by Eventually, oncealltheprevious stagesare concluded,thefifth In order topassthefourthstageofthisprogram, anempirical A third stagewillseektheupdatingofallprograms, andas • ISASI 2006 ISASI Proceedings R. Sumwaltand J.Walters,R. Bibliography traditional paradigmsinthe air businessenvironment.” tool thatpermitsusto as aleadersystem,atregional levelaswellworldwide. generate asaferandmore efficientsystemtobeacknowledged company forms Initsimplementation, theaeronautical authority as wellthe • able goals. and adaptedtothecompany, allowingustohaveclearandachiev- IntheAQP • advanced qualificationprogram, orAQP. factors TheevolutionofthebehaviorsandskillsinCRMhuman • cient airbusinesssystem. able synergies leadingtotheproduction ofasaferandmore effi- instruction techniquesconstituteaprocess thatgeneratesvalu- Thekindofassessment • technological discoveriesofthe21stcentury. standard thatallowsaqualitytrainingtobedispensed,usingthe From theabovewemaystate • and tothefriendlyuseoftechnologyavailableinourcentury. cesses, leadingtoapplyasystemicapplicationtheseprocesses jectivity inthedifferent theoretical andpracticaltrainingpro- This willallowustoobtainqualitytrainingwithadegree ofob- levels ofbasicoradvancessimulationthrough theAQPprism. on theSHELandTEMModelsapplicationofdifferent man factorscheckinginthedistinctinstructionprocesses, based portance ofimplementingskillsintheCRMbehaviors,andhu- sary toaccomplishanAQPprogram, andpointedouttheim- We havestartedthisstudy showingthegoalsandstagesneces- Conclusions effects atregional level. break the present trends thatcauseaccidentwithcatastrophic will eventuallyavoidtheclassicoperatororhumanerror and tion ofAQP, asclosepossiblefrom theoperationalreality, we tion andqualificationprocesses leadtoasystemicimplementa- to useitinasafeandfriendlyway. Aslongasourpracticalforma- tal inachievingareal man-machine-environment integrationand RNP, ATM, andADS-B. The instructionprocesses are fundamen- tems asILSCatIII-B, EGPWS,TWAS, II,WAAS/LAAS, TCAS requirements andoperationalstandards intheuseofsuchsys- AQP program inouroperationalsystemhavegeneratednew and apracticalreinforcement atFTDandFFStraining. in theinstructionprocesses, theuseofhumanfactorstechniques, the parameterswere corrected, required afurtherreinforcement erational situation.Thesefacts,oncethedatawere checked and and theaircraft maker, inorder toclarifythisuncomfortableop- This unusualattituderequired astudyinvolvingthecompany generates forafewsecondstotaluncertaintyamongthecrew. this stageofflight,havingtheaircraft react automatically, which applied duringtakeoff anattitudebeyondtheonerequested for phenomenon calledlogarithmicsum,inwhichaqualifiedcrew McGraw Hill. Finally, weinsistinstatingthattheAQPprogram isavaluable The distinctchallengesinvolvedintheimplementationof Finally, anotherremarkable case,stillunderstudytoday, isthe are essentialinorder toachievesuccessinthiskindof , theprograms anddistinctstagesare clearlydefined ateamthat,thankstoproactive work,willjointly “break theaccidentchainandchange our Aircraft Accident Analysis:Report End , themethods,innovation,and thattheAQPprogram isanew 2000,

◆ Kanki, Palmer and Gregorich, Impact of Cockpit Automation, LOFT, Crew Course, Human ACRM and Factors, University of the Southern California, Coordination Report, No. 177587,1991. 1996. Woods and Johannesen, How the Clumsy Uses of New Technology Creates the James Taylor, 1992, The CRM in Maintenance, USC-FAA. Human Error, Ceriac Dayton, Ohio, 1993. Dr. Charles Cunliffe, Space Disorientation and Situational Conscience: Concept James Reason, Human Error, Cambridge University Press, 1990. Physiological in Aerospace Medicine, CAP XII, fach. Wiener, Kanki, and Helmreich, Cockpit Resource Management, Academic Richard Wood, Safety Programs, SCSI, Torrance, CA, USA. Press, New York, 1993. Barbara G. Kanki, The Automation in the CRM, NASA. Wiener, Kanki, and Helmreich, TEM Model, Boeing Seminar, 2005. Wiener, Chisdester, Kanki, Palmer, Curry and Gregorich, Impact of the OACI, Training in CRM and LOFT, to circulate No. 217 /AN-132. Automatization in Cabin and CRM, Basket, Ames Research Center. OACI, Human Factor in Management and Organization, to circulate An-1993. Course, FSO in the USAF, SCSI, 1996, Albuquerque, N.M., USA. FAA, CRM Part N 120-/54, SFAR N 58. Course briefing, DEDALE, 1996, IFSA. Robert Alkov, Ph.D., Human Factor Performances, USAF, Albuquerque, N.M., Conference OACI, Safety Measures, Daniel Maurino, Seminary Fidae USA. 2002. Amalberti, Safety in Flight Operations. Course, Human Factors, Douglas Farrow, Ph.D. Wanner, J., Operator, the Automatism and the Safety, Marine, and Aeronautical Seminar ISASI 2000, Human Factors in Aviation. Association (ATMA), discussions, 1994. AC 120-54 A, SFAR N° 58., FAA Benner, L., 1975, D.E.C.I.D.E. in Hazardous Material Emergencies, pp. 13- JAR OPS, 1978, JAA 18. CRM The Takeoff, Hugo Leimann Patt, Ateneo, 2001. Jensen, R.S., Adrin J., and Maresh, J., 1986, To DECIDES Model Aeronauti- AQP Course FAA, Douglas Farrow, Ph.D., Oklahoma Academy, 2005. cal Decision-Making. Building Safe System in Aviation, Norman Macleod, 2005, Ashgate. TUESDAY—LATIN AMERICA DAY TUESDAY—LATIN

ISASI 2006 Proceedings • 23 ISASI 2006 PROCEEDINGS cal engineerfrom theInstituto Tecnologico de Aeronautica (Institute ERJ 145,EMB 120,andF-50 fleet.Hegraduatedasanaeronauti- was responsible forproviding engineeringsupport fortheairline’s as anengineeringmanagerforRio Sul(Varig RegionalAirline)and process. Before joiningtheEmbraer Safetyteamin2002,heworked and isresponsible forcoordinating theProduct SafetyMonitoring leader attheEmbraerheadquarters inSaoJosedosCampos,Brazil, Sergio Rodrigues Pereira School, FGV(GetulioVargas Foundation). degree inbusinessadministrationfrom SaoPaulo Administration University inSaoCaetanodoSul,Brazil,1994andhasamasters He graduatedasamechanicalengineerfrom Mauá Engineering overhaul andlinemaintenance oftheCFM56-3andCF6-50engines. 24 guidelines. To reach ausefulprocess, itisnecessarytoadapt Ten CommandmentsofaSMS”inFigure 2are onlygeneral its owninterpretation. TheSMScomponentsdepictedas“The the term“SafetyManagementSystem,”eachorganization has terminology widelyusedwithintheairtransportindustry. and theimplementationofaSafetyManagementSystem(SMS), ing ofpotentiallyunsafeconditionsintheday-by-day operation equately addressed. Current industrysafetyfocusisthemonitor- critical conditionsalready existed inthepastbutwere notad- incorrect applicationofestablishedtechniques.Inmostcases, come from unknown technicalconditionsbutresulted from the investigations indicatethatmanyaccidentscontributorsdidnot industry safetylevels.However, someoftherecent occurrence tant nowadaystosupportthecontinuousimprovement ofthe ogy andsafetyimprovements toreach thecurrent safetylevels. cesses (Figure 1).Theresults ofthoseinvestigationsledtotechnol- was todeveloptechniquessupportcomplex investigationpro- knowledge onnewtechnologies.Thesafetychallengeatthattime era, thehappeningofseriouseventsshowedneedtoimprove At thebeginningofmoderncommercial aviationtransport Safety Monitoring Safety ManagementSystemsandProduct However, inthisregard, asthere isnodefinitivemeaningto Detailed andcompleteinvestigationprocesses are stillimpor- • Application andResults forProduct ISASI 2006 ISASI Safety MonitoringatEmbraer (Sao Paulo Airlines)andwasresponsible forthe 1999, heworkedasapowerplantengineerforVASP groups. Before joiningtheEmbraer airsafetyteamin ing theprevention programs andhumanfactors dos Campos,Brazil,andisresponsible forcoordinat- team leaderattheEmbraerheadquartersinSaoJose Fabio Catani Proceedings Risk AnalysisMethodology By Fabio Catani,Sergio Rodrigues Pereira, andUmbertoIrgang, Embraer, iscurrently workingasanairsafetyteam iscurrently workingasanairsafety Empresa BrasileiradeAeronáutica, AirSafety fleet performance. uct safetyafterdelivery, through themonitoringofin-service of itsdailyflights,additionallyitisrequired tofocusonitsprod- prototypes andproduction aircraft andmustmanage thesafety facturer. Althoughamanufacturer isalsoanoperatorofitsown SMS foranairlinewillbediverseofthataircraft manu- these guidelinestotheexisting conditionsandobjectives.An investigation process. Figure 1.Specialtestprocedures aspartoftheaccident Center (CENIPA). (Nophotoavailable.) instructor ofpowerplant accidentinvestigationatthe Brazilian’sSafety (2003) attheUniversityofSouthern California(USC).Heisan accident investigation(1993)and aviationsafetyprogram management partnership, from 1978-79.Otherformaltrainingswere in aircraft Technical Center(CTA/ITA) withtheCranfieldInstituteofTechnology propulsion from theInstituteof Aeronautical Technology, Aerospace (UFRGS), Brazilin1976,withapost-graduationlevelcourseaircraft Federal University ofRioGrandedoSulSchoolEngineering andabroad.country Hegraduatedasamechanicalengineer from the tion andhasparticipatedinmore than100formalinvestigationsinhis dos Campos,Brazil.Hehasfullexperienceinaircraft accidentinvestiga- engineer forpropulsion attheAerospace Technical Center(CTA), SaoJose and hasworkedbefore foralmost11yearsasaresearch anddevelopment Product SafetyMonitoring.HehasbeenanEmbraeremployeesince1987 is responsible forthecorporateactivitiesinregard tosafetyprevention and working attheEmbraerheadquartersinSaoJosedosCampos,Brazil, and Umberto Irgang 1989. (Nophotoavailable.) of Aeronautical Technology-ITA) inSaoJosedosCampos,Brazil, The analysisandreview offleetin-servicedifficultiesreports have istheEmbraerAirSafetyDepartment’sseniormanager,

Department SEVERITY

No Safety Slight Significant Large Potential For Likelihood Effect Reduction In Reduction In Reduction In Multiple Safety Safety Safety Fatalities Margins Margins Margins Frequent Low Moderate High Very High Very High Probable Low low Moderate Very High Very High Remote Low low Moderate High Very High Extremely Remote Low low low Moderate High Extremely Improbable Low Low Low Low Moderate

Figure 4. Example of risk-assessment matrix.

Figure 5. Preliminary Risk Index (RI) calculation.

tablish a systematic process to identify and evaluate safety risks, providing input to decision-making and action planning. The core

of this process is the risk analysis and assessment1 (Figure 3). AMERICA DAY TUESDAY—LATIN There is no universal method to identify or evaluate hazard scenarios. The appropriate procedure depends on the specific situation. Experience on the related matter is always necessary to ensure a reasonable analysis. But a standardized procedure for Figure 2. Safety Management System (SMS) components. risk assessment is required to convert the risk analysis results into a measurement that will drive the decision-making process. The selection of an effective risk-assessment procedure must cover the following objectives: 1. The most obvious focus is to provide a realistic quantification of the associated risk. Basically, the method shall establish a standard to measure the answers of the following questions: • What is the severity of consequences on different scenarios? • How frequently these conditions can happen? • How confident are we about the assumptions made on the answers? 2. The second, but not-less-important, objective is to establish a safety communication standard within the organization. The selected procedure must drive the discussion and define the acceptable safety levels, allowing the involved company areas to have the same understanding regarding the priority of the related issue.

A practical risk assessment procedure There are different interpretations and applications for a risk Figure 3. Generic risk- assessment, but the root idea is the same: risk is the combination management model. of severity and likelihood. Usually, the risk assessment results are presented through a matrix, as shown in Figure 4. Instead of using a matrix, the risk assessment procedure may been a key part of the formal continued airworthiness process, where assign a value for each hazard classification and probability level manufacturers and operators are required to report to the Certifica- and use these values to calculate a Preliminary Risk Index (RI). tion Authorities the relevant failures, malfunctions, or defects of an The resultant index (Figure 5) will indicate the risk evaluation aircraft or component. This traditional way of fleet monitoring can and, consequently, will be the reference for the priority to be given be improved with the use of SMS principles, resulting in a process to the issue. that is being denominated “Product Safety Monitoring.” The use of this procedure has shown advantages of attaining the main objectives of the risk evaluation, as discussed below: Risk analysis and Product Safety Monitoring 1. In addition to using the severity and likelihood evaluation, the As with a typical SMS, Product Safety Monitoring is based on the method also takes into consideration a “level of confidence.” Al- traditional safety risk management model. The objective is to es- though the analysis should use the best available information,

ISASI 2006 Proceedings • 25 ISASI 2006 PROCEEDINGS 26 The formulary showninFigure 7canbeused asreference. termining the RI regarding aspecificissueare detailed below. pany standard forsafety riskevaluation.Thebasicstepsforde- areseverity?” or“What thesafetyobjectives?” isthefailure condition answering basicquestionssuch as“What sessment certificationreports. Theuseofthisstandard helps 25.1309 failure conditionclassificationsandresultant safetyas- adopted byEmbraeralsotakes into considerationtheAC/AMJ AC/AMJ 25.1309guidance.Theriskassessmentprocedure processes, followingsystemdesignandanalysisrequirements of was already performedduringaircraft design andcertification hazards. Evaluationoftheeffectsonsafetyforeseeable failures focuses ontheaircraft systemfailure conditionsandassociated As already commentedpreviously, Product SafetyMonitoring Preliminary RiskIndex (RI)calculation 2. made andtheknowledgecontrol oftherelated technology. “level ofcontrol” reflects theuncertainty the RiskIndex canalwaysbeconsidered as”preliminary.” The each estimativewillalwayshavesomedegree ofuncertaintyand Figure 7.RIcalculationformulary. Figure 6.Exampleofactionspriorityrelated totheRI. reference, addedtoothermeansofactionsandcontrols. the onedepictedbeingconstructed(Figure 6)and thentaken for by allinvolvedcompanyareas, withatime-reference tablelike the RI,safetypriorityofeachissuecanbedirectly perceived and doesnotestablishprioritiesforsafety-related issues.Using safety concern” ditional approach todivideissuesinto“ munication standard withintheorganization, replacing thetra-

The RIcalculationprocedure intendstoestablish thecom- The procedure isalsoastrong waytoestablishasafetycom- • ISASI 2006 ISASI categories,sincethisapproach isverysubjective Proceedings

regarding assumptions safety concern ” and “no Figure 9.Likelihoodevaluation. Likelihood evaluation— viding specificinformation. necessary, additionaltestsorsimulationscanbeperformed,pro- mode andeffectanalysis)shallbeusedforreference. Whenever reports (FHA—functionalhazard analysisorFMEA—failure as detailedbelow(Figure 8): possible scenariosbeingconsidered canbeclassifiedfrom 0to4, Severity evaluation— ➅ ➄ ➃ severity. ➂ condition. ➁ ➀ Figure 8.Severity evaluation. reported occurrences. Thelikelihood ofpossible scenariosthatcan but evaluatedconsidering fleetmonitoringand therateofrelated not bebasedonthesystemsafety assessmentcertificationreport, severity evaluation,thelikelihood forareported conditionshall one ofthelevels(1to5)detailed inFigure 9.Unlike from the TheRIwillbethesumof(highestSxL)+(levelcontrol). Evaluatethelevelofcontrol. Considertheworstcondition(highestSxL). Evaluationofscenariosorfailure combinationsthatcanraise Evaluationoftheseverity(S)andlikelihood (L)ofthe reported Briefdescriptionoftheissuebeingevaluated. Information from thesystemsafetyassessment certification The severity( The likelihood ( S ) ofreported conditionor L ) mustbeclassifiedin Figure 12. Relation between the RI value and actions priority, based on the EASA guidance material.

Acceptable action schedule Risk quantification makes no sense if not linked to an action priority reference. In search for an acceptable published reference for establishing rectification campaigns, the EASA guidance material “AMC and GM to Part 21,” published by the European Avia- tion Safety Agency proved to be a useful material. This document provides a set of charts associating the severity and probability of safety-related malfunction with the aircraft and fleet maximum acceptable exposure. The benefit of these guidelines Figure 10. Level of control evaluation. is to form a datum for what is considered to be the theoretically maximum reaction time. As the EASA document also uses the

safety assessment (AC/AMJ 25.1309) taxonomy, it is possible to AMERICA DAY TUESDAY—LATIN position different RI values on the charts provided. This will result in a relation between the RI value and the fleet exposure, as shown in Figures 11 and 12. Similar results can be obtained by using the other charts provided in the document and the final outcome is a table like Figure 6. It is important to reinforce that the purpose of this reference is not to find the most lenient program possible within acceptable risk levels. As stressed by the EASA guidance material, “A considerable amount of judgment will still be necessary in establishing many of the input factors and the final decision may still need to be tempered by non- numerical considerations, but the method proposed will at least provide a rational ‘departure point’ for any exercise of such judg- Figure 11. Relation between the RI value and fleet exposure, ment. It is not intended that the method should be used to avoid based on the EASA guidance material. quicker reaction times where these can be accommodated without high expense or disruption of services.” raise the severity level shall be evaluated based on the combination of individual probabilities of each condition being considered. Building a Product Safety Monitoring System The risk evaluation procedure is just part of the whole process Evaluation of scenarios and failure combinations—Consider and, in order to complete the Product Safety Monitoring System, conditions diverse from the reported, like different flight phases the following points must be considered: or combination with other failures, evaluating severity (S) according to Figure 8 and likelihood (L) according to Figure 9. The Senior management commitment and safety culture—This is the extension of this analysis will depend on the issue being evalu- essential start for any SMS and it is no different for Product Safety ated, as the simultaneous failure of dual systems or loss of sys- Monitoring. Without an adequate Senior Management endorse- tems on critical flight phases (takeoff, landing) must be consid- ment and company safety culture, the monitoring and risk analysis ered whenever relevant. process may become only a bureaucratic way to justify lack of actions instead of a proactive process to identify potentially un- Level of control—The level of control is probably the most sub- safe conditions and prioritize required actions. jective part of the RI. The idea is to quantify the uncertainty regarding assumptions. Policies and objectives—The main objective of the Product Safety Knowledge and control of the related technology (if the sys- Monitoring process is to identify product-related safety issues tem is provided by a third-party O and M, for example) can also through analysis of available information, in order to take pre- be considered. The evaluation of the level of control shall be based ventive actions. As part of the aircraft manufacturer SMS, this on an engineering judgment regarding the related issue. The process must follow company safety published policies. level of control can be considered as a deviation range for the RI calculation. The practical effect is to raise the RI value whenever Assigned responsibilities and product safety committee organiza- the uncertainty is high or there is low control of the related tech- tion—It is necessary to clearly define who is responsible for the nology, as shown in Figure 10. process, and, as most of the activities require involvement of dif-

ISASI 2006 Proceedings • 27 ISASI 2006 PROCEEDINGS Figure 13.EmbraerProduct SafetyCommittee(PSC). 28 Closing thesafety loop reported events,automatically recorded bydedicatedsystems. flight data,expanding theinformation source forthenon-formally including aprocess forthecontinuous monitoringoftherecorded methodology. the effortinprioritizingissuesthrough thissafetymonitoring reflecting fleetmaturity, technicalsolutionseffectiveness,andalso a continuousdecrease (thismeaning“lesseventsperflighthour”), tation, therateofsafetyreports received from thefieldtrends to 2003, yearoftheProduct SafetyMonitoringprocess implemen- flight hours.Taking theregional jet ERJ145asareference, since another, current fleetaverage isoneairsafetyreport per2,000 ings. Althoughtherateofreports canvaryfrom oneoperatorto mation isrepeatedly emphasized duringdedicatedsafetymeet- Air SafetyDepartment.Theimportanceofthissource ofinfor- tronic copyoftheirformalreports totheaircraft manufacturer’s all informationregarding relevant occurrences willbereceived. gage thetechnicalsupportrepresentatives inorder toensure that der toreceive copiesofthesereports. Itisalsoessentialtoen- M andsimilar),acommunicationlinkmustbeestablishedinor- thorities, according tolocalregulations (FAR Part Part 121,EASA erators are already required toreport theseconditionstotheau- that mayaffectthesafetyofaircraft operation.Asmostop- a dedicatedreporting process isinplacetoprovide theevents reports collectedorreceived from thefield(Figure 14),towhich cidents investigation,themainsource ofinformationare thesafety cess includesinformationfrom eventualaccidentsorseriousin- Reporting systemandcontinuousmonitoring than 11isidentified. dinary meetingswheneveranissuewithpreliminary RIgreater mittee hasregular monthlymeetings,gettingtogetherinextraor- uct andischaired bythedirector ofProduct Integrity. TheCom- posed ofrepresentatives ofdifferent areas involvedwiththeprod- influence oftheissueandpriorityassociatedactions. the validatedRIrepresents thecompanyconsensusregarding safety Preliminary RiskIndex (RI)calculationdrivesthisdiscussionsince terize thecompany’sevaluationregarding identifiedissues.The cussion ofeventuallydifferent pointsofview. ThePSCwillcharac- guarantees coordination ofcorporativeactions,allowingthedis- (PSC) isessential.Thecommitteeimproves communicationand ferent companyareas, thesetupofaproduct safetycommittee related issues,additionalattention mustbegiventothefleet imple- The samemethodologyexists fortheE-170andE-190fleets, In addition,alloperatorsare encouragedtoprovide anelec- For example, theEmbraerProduct SafetyCommitteeiscom- • ISASI 2006 ISASI Proceedings — For theadequateclosure ofall safety- — Although thepro- Figure the required control pressure becameloweras airspeeddecreased. airport, landing uneventfully. Theflightcrew alsoreported that elected todeclare anemergency. Theyreturned tothedeparture Theflightcrewon EICAS. rantheappropriated checklistand reported receiving thecautionmessage“RUDDER SYS1-2INOP” crew usedoppositepedaland aileron to stabilizetheaircraft and crew observed thattherightrudderpedalwentforward. Theflight ground, 140to160knots,Flaps9andgearintransit,theflight It wasreported that,aftertakeoff, atapproximately 100feetabove takeoff Occurrence: ruddercontroldifficultiesafter reported in-servicedifficulty. calculation andupdatingbasedontheinvestigationresults ofa that mayinvolveproduct safety. Following isanexample ofaRI very successfulinidentifying,discussing,andprioritizing issues The Product SafetyMonitoringprocess asdescribedhasbeen The Product SafetyMonitoring process—oneexample received from thefield. Figure 15.ERJ145rateofproduct-related airsafetyreports that havebeentaken. will thenindicatethelevelofeffectivenessregarding theactions (AD) willbeissued. authorities regarding directive whetherornotanairworthiness relevant cases,theinvolvementanddecisionofcertification presented atthePSCmeetings.Thisalsoincludes,formost (implementation ofserviceoroperationalbulletins)isregularly mentation andeffectivenessofcorrective actions. The continuousmonitoringofin-servicedifficultiesreports Operator’s feedbackonaccomplishmentofrelevant actions

14. HeinrichPyramidandsources ofinformation. Figure 16. Location of rudder II control rods.

Figure 17b. Removed panel and APU air inlet of a flight test aircraft. TUESDAY—LATIN AMERICA DAY TUESDAY—LATIN

Figure 17. Both rudder II control rods found damaged and separated from the fork ends.

Figure 18. Initial RI evaluation for the rudder II connecting rods failure issue. Figure 17a. Rudder II control rod end wear and damage. Based on the fleet total hour accumulated at the time and that there was During aircraft inspection, maintenance personnel reported that no similar previous reported occurrence of rudder jam due to a dual the two rods that connect the trailing rudder to the vertical stabi- rudder II connecting rods failure, the likelihood was initially evaluated lizer had failed (Figures 16 and 17). Further feedback from the as remote (L=3). field also indicated that the involved aircraft had the rear bulk- ➂ Evaluation of scenarios or failure combinations that can raise head access panel in the CDL (configuration deviation list) removed the severity: Although the reported effect was a rudder jam, the rudder for repairs, a configuration similar to what figure 17b depicts. system safety assessment for a failure of both rudder II connecting rods pointed to a “potentially catastrophic condition” (S=4). The likelihood of Initial evaluation—Although preliminary information was not this scenario was also initially evaluated as remote (L=3). sufficient to identify the cause for the rods fork end detachment, Another possible scenario evaluated was a rudder jam combined with the risk analysis and assessment procedure was applied using the an engine failure. The severity of this failure combination could be the RI calculation formulary. The result is shown in Figure 18 and same as above, but the existing engine inflight shutdown rate indicated detailed below. this simultaneous occurrence as extremely improbable (L=1). ➀ Description of the issue being evaluated: Rudder control difficul- ➃ Consider the worst condition: highest S x L = 12 ties due to rudder II connecting rods failure. ➄ Evaluate level of control: Severity evaluations were fully endorsed ➁ Evaluation of the Severity (S) and likelihood (L) of the reported by the rudder system safety assessment, and conservative approaches to condition: According to the rudder system safety assessment certification the likelihood were based on the rate of reports. The rods are not manufac- report, a rudder jam as reported is considered a major condition (S=2). tured but the system was designed by the aircraft manufacturer, therefore,

ISASI 2006 Proceedings • 29 ISASI 2006 PROCEEDINGS 30 assembly had been foundoutofitsslot(Figure 21).Thesame was commonto bothrods: theanti-rotation tabontheforkend ond rod withthesamekindofplay. Asimilarassemblydeviation the onewithplayhadthread wear, asshownin Figure 20. and replaced forfurtheranalysis.Detailedanalysisindicatedthat fork endside.BothrudderII control rods were thenremoved craft thelowerrudderIIcontrol rod wasfoundwithplayatthe with play: C-check report andfurtherinspections/results—rudder rod found gram wasalsoimplementedfordetailedmaterialanalysis. including thedetailedinspectionofbothrods. Asamplingpro- sion ofa“Cchecktask”forruddermaincontrol pathinspection, garding thesystemoriginalloadanalysisanddesign. Saltspraytests. • Fatigue testwithdifferent rods configuration, and • Ground vibrationtestingfor thecontrol rod assembly, • Additionalflighttestsindifferent configurations, • out,includingthefollowing: carried follow upofallinvolvedactions.Anextensive investigationwas As aresult, theRIwasrecalculated to“9,”asshowninFigure 19. and thelikelihood wasnotfullysupportedbytherateofreports. from “0”to“1,” asthefailure mechanismwasstillnotidentified fied to“extremely remote (2).”Thelevelofcontrol waschanged of bothrudderIIconnectingrods” wasreviewed andre-classi- likelihood ofa“flutterandstructuraldamageduetothefailure and from theresults offlighttestsperformedaftertheevent, play found).Basedontheinformationregarding fleetinspection other aircraft hadanysimilarrod condition(nodeformationor the 2weeksaftereventfrom alloperators,indicatedthatno RI calculationreview an emergency directive. airworthiness next 100flighthours.Thisinspectionwasfurthermandatedby and visualinspectiononbothcontrol rods ofrudderIIwithinthe information wasavailable,providing procedures foradimensional with Product SupportEngineering. AirSafetyDepartmentcoordinated thewholeprocess, together • and informedthecertificationauthorities, Continuedairworthiness • CustomerSupportcontactedtheoperators, • Spare Parts Supportchecked availabilityofrods forreplacement, • Engineeringdevelopedaninspectionprocedure, • ration depictedinFigure 17b, (configuration deviationlist)andnewAPUinlet,intheconfigu- vibration characteristicsoftherudderversuspanelinCDL Exploratoryflight testswere performedto reevaluate loadand • areas withinthecompany: meeting tookplace,withtheactionsdirectly involvingdifferent was considered highintermsofsafety, anextraordinary PSC RI=12 ➅ according toFigure 10,thelevelofcontrol wasconsidered “0.” TheRIwillbethesumof(highestSxL)+(levelcontrol): Additional inspectiononthe same operatorfleetfoundasec- An inspectioncontrol plan wasestablishedthrough therevi- None ofthetestsperformedcouldidentifyanydeviation re- A Level9RIissuedemandsattentionandrequires regular An alertservicebulletinwasissued48hourswhensufficient As theconditionitself,backed bya12RIpreliminary index • ISASI 2006 ISASI During a scheduled C-check inspectionofanotherair- DuringascheduledC-check Proceedings — Feedback from thefield,collectedalong during aC-checkinspection. Figure 20.LowerrudderIIcontrol rod thread wear, found II connectingrods failure issue. Figure 19.Reviewed RIevaluationfortherudder engineering analysis. Also,theprocedure will not giveanswersto the reported situationcouldbeperceived through traditional is notessentialtoidentifycritical conditions.Theriskrelated to As observedfrom theexample ofRIcalculation,thisprocedure Final comments other toguaranteetheeffectiveness ofthecorrective actions. any actionotherthanthecontinuingmonitoringoffleet, in lowering theRIto“4”(Figure 22).ALevel4RIdoesnotdemand rudder IIrods failure andthelevelofcontrol could bereviewed, theaccomplishmentofthisfinalfix,likelihoodones. After ofa locking tabwashersontherudderIIcontrol rods withnewimproved a finalsolution,therod assemblywas modifiedbyreplacing the inspection ofallrudderIIforkendsforproper lockingposition.As fied intheremoved rods. thread wearandtherod forkendplay, similartowhatwasveri- tab rotation outofslot.Thesetestscouldthenreproduce the combination ofrods andterminaldiametersassembledwithanti- a torque lossofthefittingnut. reported occurrence. Theanti-rotation taboutoftheslotallowed condition couldalsobeidentifiedonthefailedrod ofthefirst With theroot causeidentified,aservicebulletin wasissuedfor Engineering performedadditionaltests,usingtheworstrange Figure 21. Anti-rotation tab found out of slot (tube cutout). unknown questions, but creates a standard to quantify the engineering judgment regarding each specific condition. Sharing this standard with different areas within the company is the real power Figure 22. RI review after the accomplishment of the Product Safety Monitoring system. It improves communi- of final corrective actions. cation by clearly defining the company position and actions pri- AMERICA DAY TUESDAY—LATIN Design and Analysis” (FAA/JAA 2002). orities. Aligning the ideas of all areas involved and making them Kolluru, R., Risk Assessment and Management Handbook (McGraw-Hill, agree with the required pace is probably the most important gain 1996). provided by this risk analysis methodology. ◆ SAE, ARP5150, Safety Assessment of Transport Airplane in Commercial Service (SAE 2003). Transport Canada, “Safety Management Systems for Flight Operations and References/Bibliography Aircraft Maintenance Organizations—A guide to Implementation”: ALPA, Background and Fundamentals of the Safety Management System (SMS) www.tc.gc.ca. for Airlines (ALPA 2004). Civil Aviation, Report of the Public Inquiry into the Causes and Circumstances of Endnotes the Accident Which Occurred on the 10th January, 1954, to the Comet Aircraft 1 According to AC/AMJ 25.1309, “The terms ‘analysis’ and ‘assessment’ G-ALYP (Ministry of Transport 1955). are used throughout. Each has a broad definition and the two terms are EASA, Acceptable Means of Compliance and Guidance Material for the to some extent interchangeable. However, the term analysis generally Airworthiness and Environmental Certification of Aircraft and Related implies a more specific, more detailed evaluation, while the term Products, Parts, and Appliances, as well as for the Certification of Design and assessment may be a more general or broader evaluation but may Production Organizations (EASA, 2003). include one or more types of analysis.” In this paper, the term risk FAA, Advisory Circular AC 39-8, “Continued Airworthiness Assessments of analysis refers to the evaluation of a specific condition, considering the Powerplant and Auxiliary Power Unit Installations of Transport Category different scenarios and consequences. The risk assessment refers to the Airplanes”(FAA 2003). process that uses the results of the analysis to provide a measurement of FAA/JAA, Advisory Circular/Advisory Material Joint AC/AMJ 25.1309: “System the associated risk.

ISASI 2006 Proceedings • 31 ISASI 2006 PROCEEDINGS safety professional. tion ment Handbook courses. Heistheauthorof Safety Institutewhere hecontinuedtodevelopandteachaviationsafety dictionary, “probable cause”isalegalterm citingreasonable the mudofdeterminingasingleprobable cause.According tothe few accidentswithjustasinglecause.TheNTSBisstillmired in as incidentsdon’t getalotofattention. failure. Thusenginefailures orinflightengineshutdownsreported don’t havemanyaccidentsthatare solelytheresult ofanengine more. Whileanenginefailure maybetheinitiatingevent,wejust there isanaccident,there mustbeatleasttwocauses—maybe engine failures. Ifanenginefailure occursonanyaircraft and many airlines.Mostofthemare justdata-collectionsystems.Take military incidentdefinitionsandlistsofincidentscompiledby would qualifyasanaccidentprecursor. Thisisalsotrueofour has alistofreportable incidents,but,taken alone,none ofthem no examples. OurNationalTransportation SafetyBoard (NTSB) single event. accident, butthere isalwaysmore totheaccidentthanjustthat selves. Theymaybeaninitiatingeventorevenakey factorinan that almostnoneofthemare precursors ofaccidentsallbythem- accident. Ifyouconsultthevariouslistsofincidents,you’llsee An incident,properly defined,shouldbeaprecursor ofafuture we knowwhatanincidentis.It’salittleaccident.Right?Wrong! our nosesrubbedinthem. evidence thatwehaveignored incidentsevenaswewere having thing withincidents?Notanyregularity. There is,infact, program, notaprevention program. Haveweeverdoneany- on preventing theincidentsfirst.” over andover. “Ifwewanttoprevent accidents,wehavetowork to bediscussed. 32 T There isgeneralagreement (NTSBexcepted) thatthere are very ICAO definesboth“incident”and“seriousIncident”butgives First, Why? Letmesuggestacoupleofreasons. Is thattrue?Yes itis.Ifwedon’t dothat,wehaveacorrection In my40plusyearsinthesafetybusiness,I’veheard oneidea • (2nd Edition).He isaregistered safetyengineer andacertified ISASI 2006 ISASI this tobeaveryappropriate andintriguingtheme.Itneeds nar, “IncidentstoAccidents:Breaking theChain.”Ifound he titleofmypapercomesfrom thethemeofthissemi

we haven’t adequatelydefined“incidents.” Following that,hejoinedtheSouthernCalifornia he taughtnumerous aviationsafetysubjects. faculty oftheUniversitySouthernCaliforniawhere Policy andPrograms. After retirement, hejoinedthe and retired in1978asthedirector ofUSAFSafety He beganinvestigatingaircraft accidentsin1963 Dick Wood Proceedings (3rd

Defining andInvestigating Edition) and Aviation By Richard H.Wood, (LM0598),Aviation SafetyConsultant PE,CSP served 26yearsasaU.S.AirForce served pilot. Aircraft AccidentInvestiga-

Safety Programs, AManage- Incidents

We allthink type. For example, let’s take aspecifictypeof runwayincursion dent toinclude allthefactorsfoundinactual accidentsofthat be precursor ofanaccident,weshould defineareportable inci- incident. Startingwiththeidea thateachreported incidentshould ing itthoroughly. Thisisnotaproactive approach tosafety. of waitingfortheleastlikely eventtooccurandtheninvestigat- ability toinvestigateeverythingislimited,weare in theposition several hundred timeswithoutproducing an injury. Becauseour jury isarare event.Theexact samecircumstances haveoccurred In studiesofindustrialaccidents,weknowthatanaccidental in- hundred nearcollisionsbasedonnearlyidenticalcircumstances. example. For eachactualcollision,there were probably afew result ofaparticularseriesevents.Take mid-aircollisionsasan porting rules.We can’t doit!An actualaccidentistheleastlikely thing thatmightbe We haveneitherthetimenorresources toinvestigate every- those situationsiswellworththeeffort. in anaccidentandthere isnorecovery. Working toeliminate In thosecases,asingleevent,malfunction,ormistake canresult incidents. We canalso see situationsthatare notsingleerror safe. are nolongerprecursors ofaccidents.We tendtoignore them. usually definedassingleevents,malfunctions,ormistakes, they single error safeconcepttotheentire system.Sinceincidents are air trafficcontrol people,andahostofothers.We nowapplyour includes theairport,flightcrew, themaintenancepeople, plane itselfandincludedeverythingthatmakes theplanefly. That present aviationsafety record owesalottothatconcept. the planefalloutofsky. We’ve donequitewellwith thatandour wherein thefailure ofanysystem orpartofasystemdoesnotmake of theairplanedesigncriteriaismeanttoprovide aredundancy basically “singleerror safe.”We startedwiththeairplaneitself.Much difficult aboutthat? is almostalwayspresent inallaccidentsofthattype.What’sso by justeliminatingoneofthelessercauses,particularlythat probable cause”inorder toprevent theaccident.We candothat accident. Inotherwords, wedon’t havetoeliminatethe“most say thatpreventing anyofthoseeventswouldhaveprevented the would havebeennoaccident.Turning thatideaaround, wecould definition of“cause”isanyeventthathadtobepresent orthere safety professionals learnedabout70yearsago.Averyworkable single probable causetendstofocusouractionsonthatalone. don’t findthathelpful.Intheaccidentbusiness,insistenceon a grounds forpresuming guiltinsomeonecharged withacrime.I We needtobemore selectiveonwhatwechooseto callan Here iswhatweneedtodo. Here’s anotherreason ourpresent systemneedsimprovement. That’s aboutwhere weare now. Ourfocusisonaccidents;not Realizing theadvantagesofthis,wehavegonebeyondair- We haveworked hard todevelopanaviationsafetysystemthatis Actually, almostallaccidentshavemultiplecauses,alesson

reported asanincidentundercurrent re- accident—one where an airplane has been cleared onto the run- nated by March 20, 2006. Hooray! I first recommended that in way to await takeoff clearance and another airplane has been an article published in Aviation Week and Space Technology in 1991, inadvertently cleared to land on the same runway. Has that ever about 15 years ago. The FAA, I thought, has finally realized the happened? You bet and the chances of it happening again are benefits of not putting an airplane on the runway until it is cleared quite good. Let’s take a look at the factors that are present in for takeoff. almost every accident of that type. Within a week, there was loud howling within the aviation com- 1. Night or bad weather. munity on how this would gum things up and slow things down. 2. One aircraft cleared “taxi into position and hold” (TIPH), while Not true! It can actually speed things up if you do it right. . awaiting takeoff clearance. This aircraft is either making an in- Anyway, the FAA backed down somewhat and stated that air- tersection takeoff or is holding on the end of a displaced runway ports wishing to continue using TIPH clearances must justify their threshold. Sometimes it is actually “sitting on the numbers” so to use. Although TIPH clearances may be history by the time this speak. If so, there is a pretty good chance that the landing air- paper is presented, I still think it is an excellent example of how craft will notice it, because that’s where those pilots are looking. a simple change to one of the lesser causes can prevent a really 3. Another aircraft is cleared to land. The focus of those pilots is big accident. on the portion of the runway they intend to land on, not the threshold before it nor an intersection after it. Back to the paper: Let’s take another example—runway over- 4. The crew of the plane parked on the runway “position and shoots. These happen with disturbing regularity, and they usu- hold” cannot see the aircraft on landing approach. They have no ally share some common factors. rear view mirrors. 1. The length of the runway is marginal compared to the pos- 5. Obviously, a mistake has been made by an air traffic controller. sible airspeed and gross weight of the landing aircraft.

If the mistake is not recognized, there will be a really bad acci- 2. The pilot either landed long or the runway was contaminated AMERICA DAY TUESDAY—LATIN dent because we have violated our single error safe policy. We with snow or ice. have denied the crew in the aircraft on the runway the opportu- 3. The overrun safety areas were either nonexistent or inadequate. nity to avoid the accident by seeing the other plane, and we have 4. At some point, the pilot could neither stop the aircraft nor get created a situation that is not single error safe. We have left our- it flying again and make a missed approach. The aircraft is going selves no alternative except to hope that the air traffic controller to depart the runway, and the result could be anything up to a realizes the error or the pilots of the landing aircraft happen to serious accident. If there is no damage or injury, the event is not see the other plane on the runway. That’s wishful thinking, and one of the mandatory NTSB incident reports. Because of that, we’ve had the accidents to prove it. we don’t really know how often this has happened. That scenario has existed since at least 1967, which is when I In the United States, we have nearly 300 commercial airports first encountered it. We are still having that type of accident based that do not have the required 1,000-foot safety zones at the ends on nearly identical situations and we have (effectively) done noth- of the runways. For a variety of reasons, they are going to stay ing about it. that way. At this writing, the quickest and least-expensive solu- To date, most of our actions have followed two paths. One is to tion appears to be what we are calling EMAS, which stands for eliminate all air traffic controller errors, which is not possible. Engineered Materials Arresting System. These are located at the They are humans, for heaven sakes. Humans make mistakes! The ends of the runways and are made of bricks of cellular concrete other path is to install expensive equipment that will detect and materials that collapse under the weight of the aircraft. They pro- predict potential runway collisions in time for a human to act. vide rapid, but controlled, deceleration. So far, 18 airports have That would be nice, but it is not going to happen in the near or will have that capability, which is certainly a step in the right future. direction. This won’t happen overnight, and interim solutions My question is, Why don’t we do something simpler than ei- involve better methods of calculating stopping distance and bet- ther of those? Why don’t we eliminate TIPH clearances? You are ter measurements of runway surface condition. Those can be ini- not cleared onto the runway until you’ve been cleared for takeoff. tiated fairly quickly at all airports. The FAA is working on both of If there is a plane on final approach, you can see it. Position and those. hold is an anachronism left over from the 1930s. Then we needed Getting back to the factors listed above, suppose we use those to park on the centerline for about a minute to set the directional factors to define an incident that must be reported and investi- gyros and stabilize the engine temperatures. We no longer need gated. We can call that an accident precursor, and that’s where we to do that. A modern airplane can start its takeoff from the hold should focus our investigative capabilities. There may be other line, adding power as it swings onto the runway centerline. actions we can take that may or may not be related to the most Eliminating TIPH is an example of eliminating one of the lesser probable cause. Curing one of the other causes present may be causes mentioned a page or so ago. That will eliminate a lot of the best solution immediately available. those accidents even though no one would consider that the most Suppose we picked the top five or maybe 10 accident scenarios probable cause of any of them. Better still, that could be done that occur with some regularity and analyzed them in terms of very quickly and wouldn’t cost anything. their common factors. Perhaps we would look at certain types of CFIT accidents or possibly events involving loss of aircraft pres- Author’s note: This paper was written in January 2006. I used surization. Those types of accidents do occur, and they all have runway incursion accidents as an example of a type of accident certain things in common that would help us define our accident that almost always contains the same factors. precursor. Thus we now have five (or 10) incidents that are genu- In March 2006, the FAA directed that TIPH clearances be elimi- ine accident precursors and will attract our attention. Can that be

ISASI 2006 Proceedings • 33 ISASI 2006 PROCEEDINGS 34 2. Lotsofpeopleknewaboutit. 1. Yes. Severaltimes. 3. Whatwasdoneaboutit? 2. Whoknewaboutit? 1. Havetheseeventseverhappenedbefore? questions thatshouldalwaysbeasked. they havefigured outthecausesofanaccident,there are three teaching aircraft accidentinvestigation,Itelleachclassthatonce happened before, butwithoutalltheinjuriesanddamage.When whatever accidentweare currently investigatinghasprobably but that’swhere weshouldbeputtingoureffortsanyway. and filloutthereport. Initiatingpreventive actionmighttake longer, might take asingleinvestigatoranentire daytocollectthefacts damage orinjury, andeveryoneisstillalivetotalkaboutit.That Yes, anditneedn’t bedifficultorcostly. all,there After wasno that weactuallyhavetoinvestigatethesethings.Canbedone? done? Certainly. Will itwork?Onlyifwemake itwork.Thatmeans Unfortunately, theanswerstothosequestionsare usually: Right now, weare intheawkward positionofknowingthat • ISASI 2006 ISASI Proceedings accident precursors, andseriouslyinvestigatingthem. something alittleeasierlike redefining incidents,creating some but thatmightbeagoodthing.Perhaps weshouldstartwith don’t thinkitwouldever risetothestatusofmostprobable cause, cause includedinthereport? Never! Notevenonce! a problem thathasalready beenidentified.” to listinmanyoftheaccidentsIhaveinvestigated. curs, itisabyproduct ofthatprocess; nottheprocess itself. correcting thingsthathavealready happened.Ifprevention oc- active. Asmentionedearlier, we’re notpreventing things—weare thing tellsusthatourinvestigationprogram isreactive, notpro- The ideaofwaitingforanaccidenttohappenbefore wedoany- mended ortaken. 3. Nothing.Noaccidentoccurred andnoactionwasrecom- Nevertheless, thatcausebelongsinalotoftoday’sreports. I Would youlike toknowhowoftenIhavemanagedgetthat “One ofthecausesthisaccidentwasfailure totake actionon That leadsmetomyfavoritecausefactor, onethatIhavetried That willleaveabadtasteinthemouthofanysafetyexpert. ◆ Industry Working Group For Enhancing the Investigation Of Human Performance Issues By Randall J. Mumaw, Aviation Safety, Boeing

Introduction of an industry working group to develop better guidance for in- Each new or revised summary of accidents and incidents in vestigating human performance. commercial aviation re-emphasizes the significance of the role of humans. Accidents attributed to failures in airplane systems Current practice have decreased over the years as those elements have become We interviewed 12 groups (those listed below plus a major air- more reliable. Flight crews, maintenance technicians, air traf- line) to attempt to establish the current state of investigating HP fic controllers, airplane system designers, and others are iden- issues (note that there is a mix of commercial aviation and other tified as significant contributors to an event 60-70% of the time modes of transportation): (e.g., see Boeing annual statistical summary as one index: http:/ • Air Accidents Investigation Branch (UK), /www.boeing.com/news/techissues/pdf/statsum.pdf). In fact, • Railway Safety & Standards Board (UK), even in cases where there are failures in airplane systems that • National Air Traffic Services (UK),

precede a tragedy, accident investigations have revealed that • National Transportation Safety Board (USA), DAY INTERNATIONAL WEDNESDAY— human performance contributed to degraded system perfor- • Bureau d’Enquêtes et d’Analyses (France), mance. This is not only true in commercial aviation; mishaps • Bundesstelle für Flugunfalluntersuchung (Germany), in other highly complex socio-technical systems also reveal the • Transportation Safety Board (Canada), important role of humans in the accident chain. This influ- • Civil Aviation Department (Hong Kong), ence on the accident chain may have links to system design, • Aviation Safety Council (Taiwan), operational procedures, training, and organizational policies • Australian Transport Safety Bureau, and and practices. • Transport Accident Investigation Commission (New Zealand). To “break the chain,” we need to become even better at under- For each interview we covered a range of topics, including the standing and addressing issues in human performance (HP). My following: personal accident investigation experience, and the experience • the framework used for addressing HP issues, of several colleagues at Boeing, suggests that approaches to in- • existing guidelines, checklists, and procedures used for inves- vestigating HP issues around the world can vary widely and are tigating HP issues, sometimes ineffective. • types of HP expertise available to them, To understand the current situation better, a small research • how they assign HP specialists to investigations, team at Boeing surveyed major accident investigation agencies • HP-related data-gathering techniques, to document their approaches to HP issues in accidents and inci- • HP-related analysis techniques, dents. The next section describes some key results from this sur- • how HP accident data are structured for input to an accident vey, and the second half of the paper describes our proposed database, and response to the current situation—specifically, the establishment • what gaps have been identified in investigating HP issues. The following are summaries of our findings for two of these Dr. Randy Mumaw is a human factors specialist issues: HP expertise and HP guidance materials. and associate technical fellow in the Aviation Safety Group at Boeing Commercial Airplanes. Dr. Mumaw HP expertise and training. One question concerned the num- received his M.S. and Ph.D. in cognitive psychology ber of investigators or staff formally trained as HP experts. More from the University of Pittsburgh. Dr. Mumaw has specifically, we identified the number of people with an M.S., studied human performance and safety in nuclear M.A., or Ph.D. in a human factors-related (HF) field of study. power plant control room operations, air traffic 0 HF investigators 5 agencies control, and military and commercial aviation. He is the author of 1 HF investigator 1 agency more than 80 technical papers, most of which address human perfor- 4 HF investigators 2 agencies mance and error in complex, high-risk systems. At Boeing, Dr. Mumaw 6 HF investigators 2 agencies has focused on the human aspects of safety and on flight deck interface 10 HF investigators 2 agencies design, especially in the area of autoflight and the flight management The above shows that responses varied considerably. While system. He is an author on several patents for new autoflight interface there were five agencies that had no investigators trained in an designs. He has also supported a number of accident investigations that HF field, there were two agencies that each had 10 people with involved significant human performance issues. HF training, and another two with six HF investigators. Those

ISASI 2006 Proceedings • 35 ISASI 2006 PROCEEDINGS 36 ing aninvestigation. to conductaninvestigationbut offerslittleguidanceonconduct- work. TheDekker bookfocusesondescribinginappropriate ways does offersomepracticalguidance forvariousaspectsoffield little inthewayofguidancefor conductinganinvestigation.He ber ofpotentiallyrelevant topics(e.g.,computerdisplays)but Strauch’s bookprovides somebackground knowledge onanum- level andfocusesonthechecklistfrom theSHELLModel. 4 agency. The ICAOdocumentprovides guidanceataveryhigh little guidancethatcouldbereadily adoptedbyaninvestigation 4 cent booksonthetopic(Dekker 2002;Strauch2002)—wefound tial sources—the ICAOHFDigest(ICAO1993)andseveralre- 4 ance from anoutsidesource. However, whenwelooked atpoten- unable toobtainguidancefrom othersources. of guidancethatcouldbenefittheirinvestigators,andthey are ance. Agencieswithnoexpertise are unabletodevelopthetypes this findingisthattheexpertise isrequired todeveloptheguid- agencies thathadmore expertise. We believethatthereason for More completeguidancedocument(s) Checklists forguidance No HPguidancematerial ment thataidedthemininvestigatingHPissues. an accidentinvestigationmanualorageneralguidancedocu- tially importantissues.Theremaining fouragenciesactuallyhad (typically one)thatinvestigatorscoulduseforidentifyingpoten- gations (seebelow).Four agencieshadoneormore checklists tion agencieshadnoguidancedocumentsatallforHPinvesti- that mayhaveinfluencedperformance;oranalysistechniques. ing humanerrors; methodsforidentifyingcontributingfactors portant actions,decisions,andconditions;asystemforclassify- techniques fordatagathering;aframeworkidentifyingim- lists (typesofdatatocollect,HPissuesconsider);methods/ 4 HP issues.Guidancecantake manyforms,forexample, check- dures thatagencieshaveinplacetoguidetheinvestigationof HP guidancedocuments. expertise. HP expertise andotheragencieswithlittletrainingorin-house No HP/HFtrainingforallinvestigators 4 4 Train allinvestigatorsonHP/HF—dedicated HP/HFcourse Train allinvestigatorsonHP/HF—partofbroader course a fewinvestigatorsmaygetsomeHFtraining. have noHFtrainingthatisrequired ofallinvestigators;instead, course (usuallyaweekinlength).Theremaining fouragencies Four otheragenciesexpose eachinvestigatortoadedicatedHF cies, theHFtrainingispartofabroader investigationcourse. all investigatorsreceive someHF-related training.For fouragen- vide theirinvestigatorsonHPissues.Mostagenciesreported that ready accesstothistypeofexpertise. ence (butcometogetherwhenanaccidentoccurs)mayhaveno also indicatesthatagenciesmaynothaveafull-timeexist- ants withthatexpertise. However, ourinvestigationexperience agencies thathavenoHFexpertise inhouseoftenhire consult- Thus, there are severalagencieswith strong skills inHPinves- One potentialsolutiontothisapparent dilemmaistogetguid- Interestingly, there wasmore developmentofguidancefor The responses spannedawiderange.Four ofthe12investiga- So, theoverallpicture isamixed bag—somepockets ofstrong We alsotalked toagenciesaboutthetypesoftrainingtheypro- • ISASI 2006 ISASI Proceedings Akey question concernedtheproce- cies thatlackHPexpertise. the workofthesefewgroups isnoteasilyconveyedtootheragen- especially inthearea oforganizational factors.Unfortunately, nuclear power)thatare alsoestablishingmore detailedguidance, dition, there are investigationagenciesoutsideofaviation(e.g., to framethedataandidentifyunderlyingcauses,etc.Inad- HP investigation:whatquestionstoask,datacollect,how tigation thatare leadingthewayindefininghowtoconductan be clearlylabeledassuch. hard dataaboutperformance,butthistypeofaccountneedsto say there isnoplaceforspeculativearguments whenthere islittle what “mayhave”influencedactionsanddecisions.Thisis not to with data,wehopetoavoidthespeculativearguments madeabout formance. Bylimitingourtopicstothosethatcanbebacked up quite abitisknownabouthowinadequatesleepaffectstask per- on theeffectsofafactorhumanperformance.For example, to actualperformancedata—thatis,areas inwhichthere are data ence documentforinvestigatorsonkey HPtopics. about fivepages;theideawastohaveaquick,easy-to-use refer- area, andtrainingthatisavailable.We targeted eachmoduleto niques, references formore information,namesofexperts inthe and thenleadintopracticalguidanceforinvestigatorsontech- analysis). safetyassessmenttechniques(e.g.,barrier • analysistechniques(e.g.,speechfrequency analysis),and • fatigue, stress), factors thatcontributetohumanperformanceproblems (e.g., • human performanceissues(e.g.,spatialdisorientation), • data-collectiontechniques(e.g.,cognitiveinterview), • topics. Thesemoduleswouldcoverarangeoftopics: out aplantodevelopsetofindividualmodulesonspecificHP investigation guidancethatmostagenciesare missing.We laid cidents cannotbeeasilycompiledandanalyzedasaset. Without thisshared framework,thefindingsfrom individualac- has beeninfluentialbutfallsshortofcreating aunifyingapproach. ing anddescribingHPissues;theReason (Swisscheese)Model There isnoshared frameworkacross agenciesforunderstand- • not formallyshared outsideofthatagency). oped withintheagenciesthathavemostexpertise (anditis HPguidanceiseitherinsufficientlydetailedorbeingdevel- • and HPissuesare toorare fortoday’sneeds. it isneeded.Thosewithtrainingbothinaccidentinvestigation agencies andisnotreadily acquired from aconsistentsource when HP expertise exists primarilywithinthelarger investigation • Our datagatheringreinforced ourbeliefsthat Boeing response accident investigationagencies, • airplane manufacturers, • practice. Thesestakeholders includethefollowing: sus positionisrequired tomake asignificantchangetoindustry Expertise isdistributedacross these stakeholders and aconsen- major stakeholders incommercial aviationaccidentinvestigation. was importanttocreate guidancethatwouldbe acceptable toall As weproceeded withmoduledevelopment,werealized thatit Industry workinggroup Further, wewantedtoensure thatthetopicscovered were tied Each modulewouldprovide abriefbackground ontheissue The initialBoeingresponse wastobegindevelopingtheHP • aviation regulators, • the collection of human performance data should not be seen • those representing the people who may be “blamed” (pilots, as implying that human error is a working hypothesis for the ATC, maintenance technicians), investigation. Initial interviews of operational personnel involved • airlines, in the accident or incident (e.g., pilots, air traffic controllers, • aviation safety organizations, and maintenance technicians) should be conducted in a way to maxi- • training organizations. mize the retrieval of information about the event; they should Therefore, we turned our attention to organizing stakeholder not focus on finding fault with the actions taken or decisions made. representatives to develop an industry solution to this problem. As of this writing, the IIWGHF is just ramping up. We plan to We started by seeking and being granted sponsorship from ISASI. deliver a number of guidance modules by the end of 2006. After a ISASI appointed Capt. Dick Stone as the ISASI chairman of an core set of materials is developed and approved, we will use ISASI industry working group; Capt. Stone has since added an Advi- to distribute them to key industry stakeholders. If these materials sory Board that, under Capt. Stone, will approve our develop- achieve a good level of acceptance within the industry (and per- ment plan and review guidance material before it is distributed. haps within other areas of accident investigation), they will start to The group has been named the ISASI International Working shape how investigations are conducted and reports are written. Group on Human Factors (IIWGHF). Ideally, we will eventually establish a well-defined set of expecta- The next step was to bring together the HP expertise in the tions about the policies and practices of HP investigations. ◆ industry. We have a team of 10 human factors professionals with accident investigation experience who are continuing to develop References/Bibliography Dekker, S. (2002). The Field Guide to Human Error Investigations. Hants, guidance modules. This team will work with a set of reviewers UK: Ashgate. (industry representatives) who will make an early evaluation of a International Civil Aviation Organization (1993). Human Factors Digest module to ensure that it is fair and useful for the work of investi- No. 7: Investigation of Human Factors in Accidents and Incidents. (Circular 240-AN/144). Montreal, Canada: ICAO. gators. Through a number of review-and-rewrite cycles, we hope Strauch, B. (2002). Investigating Human Error: Incidents, Accidents, and to produce a significant set of guidance modules that we can then Complex Systems. Hants, UK: Ashgate.

package and distribute through ISASI. DAY INTERNATIONAL WEDNESDAY— Another potential role of the IIWGHF is to put forward posi- Acknowledgments tion statements that can establish a standard on how HP issues Many thanks to the following Boeing people who made signifi- should be investigated. There are a number of potential issues to cant contributions to this project: Simon Lie, Hans-Juergen be addressed here. An example being considered is the following: Hoermann, Richard Kennedy, and Rich Breuhaus.

ISASI 2006 Proceedings • 37 ISASI 2006 PROCEEDINGS 38 aircraft.for transportation-category (No photoavailable.) been retained innumerous accidentinvestigationsanddesignreviews metal aswellcompositeaerospace components. Dr. Pettinger has Analysis Associates.Hespecializes intheevaluationanddesignof Dr. Alfred Pettinger journals andfrequently speaksatinternational conferences. organizations. Hehaspublishedanumberofarticlesin scientific being employedforprimarystructures inmajoraircraft programs. control surfacesandsecondarystructures, composites are now is agenerationofcompositeaircraft. Historicallyreserved for to metalinthe1920s. tures tocomposite structures, similartothetransitionfrom wood are progressing through amajortransitionfrom metallicstruc- history ofcomposites,aircraft structures ofthecurrent decade has flowntospacewithrepetitive success.Asanextension tothe ers fordecades.Evenanall-compositespacecraft, posite aircraft havebeencommercially availabletohome-build- oped andusedformilitaryaircraft formore 50years,andcom- Composites are notnew. Compositestructures havebeendevel- Introduction the analysisoffailedcompositestometals. lines Flight587.For perspective,thispaperfrequently compares the failedcompositeverticalstabilizerinvolvedinAmericanAir- cepts are demonstratedbydiscussingtheanalysis bytheNTSBof as tension,compression, bending,impact,and fatigue.Thesecon- composites underavarietyoffundamentalloadingconditionssuch introduces someofthebasicconceptsinvolved inanalyzingfailed dents islargely dependentonmetallicaircraft. Thispaper rent bodyofknowledgeandexperience regarding aircraft accidents involvingcompositefailures. Despitethispossibility, thecur- posites. Thisadvancementcreates thepossibilityofaircraft acci- traditionally constructedofmetalare beingconstructedofcom- nology inwhichprimarystructuralcomponentsthathavebeen new generationofmilitaryfighters,marksashiftinairframetech- 787, theAirbus380,newlyemerging verylightjets,andthe The impendinggenerationofaircraft, represented bytheBoeing Abstract The next generation ofaircraft, comingtomarket thisdecade, • ISASI 2006 ISASI By JosephF. Rakow, Ph.D.,P.E. (AO4926),Engineer, ExponentFailure AnalysisAssociates,and Structures in Aircraft Accidents Structures inAircraft Alfred M.Pettinger, Ph.D.,P.E., ManagingEngineer, ExponentFailure AnalysisAssociates initiatives ofavarietycommercial andgovernment Rakow’s workhasaddressed products, failures, and failure, andthedesignofmechanicalcomponents.Dr. aeronautical structuralengineering, structural engineering consultingfirm.Dr. Rakow specializesin Failure AnalysisAssociates, aleadingscientificand Dr. JosephRakow Proceedings Failure AnalysisofComposite isamanagingengineerwithExponent Failure is anengineerwithExponent SpaceShipOne, VLJ (clockwisefrom top). General ElectricGEnxfanbladesandcase,Adam Aircraft A700 Figure 1.Examplesofcompositestructures: Boeing787fuselage, ever built.Second, weare buildingcomposite structures through fuselage willbethelargestThe B-787 compositepressure vessel building compositestructures onascaleneverbefore achieved. gation. Whywouldthesecomposite structures fail? First, weare structures maybeprimarystructures ofsignificanceintheinvesti- tures withincreasing frequency inthecomingdecades,andthese cident investigatorswilllikely encounterfailedcompositestruc- growing useofcompositesinmilitaryandcommercial aircraft. tered production justadecadeearlier. Figure 2illustratesthe pared withslightlymore than20% fortheF/A-18C/D,whichen- The F-22 containsapproximately 60%compositestructure com- A700 (Figure 1). Parallel advances continuewithmilitaryaircraft. the all-compositeairframesforverylightjets,suchas Adam Complementing thistransitioninthelarge transportmarket are notable feature oftheA380isanall-composite centralwingbox. that isapproximately 25%compositestructure byweight. One the newAirbus380isscheduledtoenterservicewithanairframe ure 1)ratherthantraditionalmetals.Inadvance oftheB-787, with fanbladesandcontainmentcasingmadeofcomposites(Fig- by weight.Powering willbetheGEnxturbofanengine theB-787 than adecadeagowithanairframeof10%compositestructure wing boxes constructedofcomposites. sections ofthefuselagewithintegralstiffeners(Figure 1),andthe posite structure byweight,withnearly100%oftheskin,entire The airframeoftheBoeing787willbeapproximately 50%com- With theincreased useofcomposites inprimarystructures, ac- For perspective,theBoeing777entered themarket justmore Figure 2. The growing use of composites with time in major Figure 3. The ductility of metal structures provides aircraft programs by percent of the total airframe weight (JEC, macrostructurally visible information regarding an accident Estin & Co, Hexcel). (Wanttaja 1994). relatively new, automated techniques rather than relying on tradi- 1 tional methods of constructing composites by hand. And third, DAY INTERNATIONAL WEDNESDAY— our inspection and maintenance requirements will no longer be driven by fatigue and corrosion performance, as they are for metallic structures, because composites are not as susceptible to these failure mechanisms. Instead, accidental subsurface damage and subsequent failure progression will be more important. Past experience with metallic structures will be relevant, but new methods and techniques particular to composite structures will be required. These advances, a collective departure from applications, techniques, and methods of the past, may lead to landmark lapses in safety with subsequent “lessons learned” for composites. Such lapses in safety may provide lessons learned in the manner that the Comet accidents provided lessons learned regarding stress concentrations and metal fatigue and that Aloha Airlines Flight 243 provided lessons learned regarding aging aircraft structures. It is through experience and effort that the community of aircraft accident investigators has developed a considerably mature understanding of failure in metallic structures. This has been a process spanning more than 80 years of accidents involving metallic aircraft. The accrued knowledge and experience must be extended to composite structures. This paper is intended to contribute to that effort by introducing some of the basic concepts of failure in composite structures as a result of a variety of loading conditions—tension, compression, bending, impact, and fatigue. Figure 4. Indications of fatigue cracking in the lower right wing Select failure characteristics are then illustrated through a dis- spar cap of the Chalks Ocean Airways Grumman Mallard G73 cussion of the failure of the composite vertical stabilizer of Ameri- that crashed during takeoff Dec. 19, 2005. This is an example of can Airlines Flight 587. For perspective, the analysis of compos- using accumulated knowledge and experience with metallic ite failures in this paper is frequently discussed with respect to structures to identify possible factors in an accident (NTSB 2005). corresponding failures in metallic structures. In that vein, this paper first addresses some key features particular to failed me- metal aircraft. Employing knowledge accrued during this period tallic structures that may no longer be available in the analysis of of time, investigators often rely heavily on their ability to analyze failed composite structures. failed structures in an effort to determine the cause and events of an accident. Some investigators have emphasized the role of such Examination of failed metallic structures analysis— The science and art of analyzing failed metallic structures has “The bent metal speaks.”2 matured in part as a result of the analysis of accidents involving “The story is written in the wreckage.”3

ISASI 2006 Proceedings • 39 ISASI 2006 PROCEEDINGS 40 “You havetolearnhowread thebentmetal.” explosion inanaccident. unzipping ofpanelsalongrivetlinesallindicatetherole ofan ruptured edges awayfrom theexplosion, andthestretching and metallic fuselage.Thebulgingoffuselagepanels,thecurling is thedeformationproduced byanexplosion insidea occurring engine waspowered atthetimeofaccident.Anotherexample direction ofrotation. Thisdeformationcanreveal whetherthe fan willgenerallybenduponimpactinadirection oppositethe examine thefanblades.Metallicbladesofapowered turbo- was powered atthetimeaircraft impactedtheground isto riety ofways.Onemethodfordeterminingwhetherajetengine lines onapproach (NTSB1995). According totheNTSB,thisaircraft impactedasetofpower shape, andenergy associatedwiththeimpactororimpactors. this accident.Moreover, theevidenceidentifiespossiblesize, tained inFigure 3immediatelyidentifiesimpactasafactorin cording evidenceofeventsintheaccident.Thecon- nent bending,twisting,anddentingofstructures, essentiallyre- deformation priortofinalfailure. Ductilityallowsfortheperma- aluminum, are ductile,whichmeanstheyundergo significant tures isenhancedbythefactthattypicalaircraft metals,suchas a collectionofdentsontheleadingedgesanaircraft. ing edge.Figure 3showsanexample ofmacrostructural evidence, buckled fuselagepanel,atwistedpropeller blade,adentedlead- evidence refers totheoveralldeformationoffailedstructures—a tural evidenceandmicrostructural evidence.Macrostructural the wreckage willbereferred tointwocategories—macrostruc- structural evidence, supportedbyanaccrued bodyofknowledge tigue failure. Asaresult ofthisestablishedanalysis, themicro- marks, whichisevidencewidely acceptedtobeindicativeoffa- 5, anunaidedvisualinspection ofthewingsparcapreveals beach ing damageinthestructure oftheleftwing.AsshowninFigure tural componentsintheright wing(Figure 4),withcorrespond- days, theNTSBhadidentified fatiguedamageinmetallicstruc- dence indicatedthattherightwinghadseparatedinflight.Within 101 inDecember2005offthecoastofMiami,Fla.Initial evi- the past,oftenprovided rapidandinsightfulresults. established andwidelyusedbodyofknowledge,whichhas, in dence infailedmetallicstructures, investigatorsrely uponawell- visual ormicroscopic analysis.To interpret microstructural evi- the structure, suchasfracture surfaces,thattypicallyrequire close evidence refers torelatively localdeformationandchangesin microstructural evidence becomesparamount.Microstructural change from ductile tobrittlestructuralmaterials,theanalysisof posite fuselage? evidence wouldbeproduced com- byanexplosion insideaB-787 engine, withitscompositefanblades,impactingtheground? What composite structure? Whatevidencewouldbeproduced byaGEnx will likely change.Whatevidencewouldbeproduced byafailed dence from anaccident,suchastheexamples discussedabove, prior tofinalfailure. Without ductility, themacrostructural evi- means theyundergo relatively minorpermanentdeformation Ductility inmetalsprovides macrostructural evidenceinava- The valueofmacrostructural evidenceinfailedmetalstruc- For thepurposesofthispaper, theevidencecontained within One example istherecent Flight crashofChalks OceanAirways With changesinmacrostructural evidenceassociated withthe Typical aircraft compositesare notductile;theyare brittle,which • ISASI 2006 ISASI Proceedings 5 4 Chamis 1987). of features. Microscopic analysisisparamount(Gintyand even simpletensioncanproduce fractures withawidevariety Figure 5.Tension failure incomposites.Macroscopically, metals. Some of thesevariablesare fiberorientation, fiber-to- reconstruct them. nomena, accidentinvestigators mustbeabletorecognize and While designersknowof,understand, andcanpredict these phe- ite totwist;asimpletwistingload cancauseacompositetobend. cannot. Asimpletensileload, forexample, cancauseacompos- plied. Compositescanrespond toloadsinwaysaircraft metals loads usuallyvarieswiththedirection inwhichtheloadisap- composites varyfrom locationtolocation,andtheirresponse to variables oftenexist inacomposite. ner ofatextile. Ply-wise variationsinfiberorientationandother cally runparalleltoeachotherorare woventogetherintheman- assembled layerbylayer, calledplies.Thefibersineachplytypi- glue, thatholdsthefiberstogether. Thegluedfibersare typically cally carbonorglass)andamatrix,essentiallyhardened plastic made oftwomaterials,longfibersthatare stiffandstrong (typi- tures, madeofmultiplematerials.Typical aircraft compositesare classified asengineered materials,compositesare actuallystruc- posites are oftenconsidered tobematerialsandare generally structures requires, inmanyways,anewmindset.Althoughcom- Transitioning from failedmetallicstructures tofailedcomposite Examination offailedcompositestructures posite structures. derstood byaccidentinvestigatorsinorder toanalyzefailedcom- and otherrudimentarycomponentsofknowledgemustbeun- do notevenexist intheanalysisoffailedmetallicstructures. These fiber pullout,delamination,andinterfacialfailure. Theseterms The analysisoffailedcompositestructures involvestermssuchas on theknowledgeandexperience accruedformetallicstructures. sider inthisinvestigation. idly establishedthewingsparcapasacriticalcomponenttocon- regarding theinterpretation offracture surfacesinmetals,rap- Composites have designvariablesthatare notavailable in In contrasttotypicalaircraft metals,thephysicalproperties of The analysisoffailedcompositestructures cannotrely solely Figure 6. Example of fiber pullout as a result of tensile loads (Friedrich and Karger-Kocsis 1989). Figure 7. Example of fiber kinking as a result of compressive loads (Bolick et al 2006). matrix volume ratio, ply thickness, and ply stacking sequence, among others. With new variables come new opportunities for manufacturing errors or imperfections. Some of these imperfections are fiber waviness, poor adhesion between fibers and matrix, poor adhesion between plies, excessive voids in the matrix,

and an improperly cured matrix, among others. Changes in de- DAY INTERNATIONAL WEDNESDAY— sign variables and accumulated imperfections directly affect the failure of a composite. For example, Figure 5 shows 20 failed composite specimens, four groups of five specimens, representing four different ply-wise fiber orientations. Each specimen was subjected to simple tensile loading. Despite the similarity in loading, the failure in each specimen looks unique. Some of the failed specimens have a shredded appearance with a very rough fracture surface; some of the specimens have a smoother, angular appearance. Some specimens even broke into three pieces, rather than two. The differences in the appearance of these failures are a result of two primary sources of variation among the specimens. The first source of variation is the intentional variation in design variables, in this case, fiber orientation. The second source of variation is the accumulation of imperfections, as discussed above. The result is that these composites, all of which failed in tension, appear very different from each other. Figure 8. Chop marks can be produced on the ends of broken This is one of the challenges of analyzing failed composites. In fibers that have buckled and failed under compressive loads many cases, this challenge can be addressed by performing a mi- (Stumpff 2001). croscopic analysis of the failure surfaces to identify common features that indicate failure in tension. ing extracted from the matrix. Close inspection of Figure 6 reveals, in addition to pulled-out fibers, holes in the matrix that Tension were created by other pulled-out fibers. In some cases of tensile Regardless of the macroscopic variation of the fractures discussed failure, the fibers do not completely fracture and only the matrix above, tensile fractures of fibrous composites typically exhibit some completely fractures. The fibers then span the matrix fracture in common characteristics that can help identify failure under ten- a phenomenon called fiber bridging. In either case, the investi- sile loads. One characteristic is that the fracture surface generally gator can use the pulled out fibers to identify tensile loading, has a rough appearance, as can be seen in the failed specimens and in the case of stacked laminates, identify those plies that have in Figure 5. Figure 6 shows a microscopic view of a fracture sur- been loaded in tension. The length of the pulled out fibers can face of a composite that failed under tensile load, with the fibers provide perspective on important fundamental conditions present aligned with the direction of the load. in the composite at the time of fracture, such as temperature, One clear characteristic of the fracture surface is that fractured exposure to moisture, and rate of loading. fibers are sticking out of the fractured matrix, contributing to the As long, thin members, the fibers are designed to carry tensile rough appearance of the fracture surface. Called fiber pullout, loads, and composites are nominally designed such that the fi- this characteristic is a typical indication of tension failure in a bers run parallel to the tensile loads. However, in the common composite. Fiber pullout is the result of a fiber breaking and be- case of composites with ply-wise variations in fiber orientation,

ISASI 2006 Proceedings • 41 ISASI 2006 PROCEEDINGS 42 the compressive load approaches acriticallevel,which isafunc- ing onandeventually crushingasodacan. The fibersbuckleas bands are aresult ofstructuralinstability, muchlike apersonstand- ites istheformationofkink bands, asshowninFigure 7.Kink mon characteristicofthecompressive failure offibrous compos- Under compression, the fibersare relatively lesseffective.One com- Compression failures canalsobeproduced undercompression. tures onthefracture surfacecalled hackles.Suchinter-plyshear trix-rich region betweenplies,typically associatedwithrough fea- larly atthefiber-matrixinterface,andshearfailures inthema- loading conditionsare tensionfailures betweenfibers,particu- occur inthematrix.Commonmatrixfailures associatedwithsuch tension loadsdonotrunparalleltothefibers,andfailure can are clearly identifiable(Stumpff2001). pullout, andtherelatively smootharea ofcompression failure The relatively rough area oftensionfailure withsignificantfiber Figure 10.Compositewingthatreportedly failedinbending. and Schultz1990). area ofcompression failure are clearlyidentifiable (Beaumont relatively rough area oftensionfailure andthe relatively smooth Figure 9.Compositespecimenthatfailedinbending.The • ISASI 2006 ISASI Proceedings grade theload bearingcapabilityofthecomposite eventhough nation among multiple plies.Suchdamage can dramaticallyde- views ofthecross-section ofa compositeplateafterimpact. gate alongthefiber-matrixinterface. Figure 11 showsacouple boring plieswere joinedduringmanufacturingoritcanpropa- posite. Thesplitcanpropagate alongtheinterfaceatwhichneigh- delamination. Adelaminationisasplitbetweenpliesin com- indicated onthesurface. the surfaceofacompositecanbemuchmore extensive thanthat age onthesurfaceatall.Ineithercase,levelofdamage below crushing ofthefibersandmatrixoritmaynotproduce anydam- a brittlecomposite,theimpactofwrench mayproduce local dication ofthesignificanceresultant damage. Ifthewingis tially recording theimpactandproviding somerudimentaryin- wing ismadeofaluminum,theimpactmayleaveadent, essen- chanic dropping awrench onthetopsurfaceofawing.If out anyvisibleevidenceonthesurface.Consideranaircraft me- may notbeasreadily observedinacompositestructure. a clearindicationofimpactbyforeign object.Impact evidence metallic aircraft discussedaboveandshowninFigure 3provides tively littlepermanentdeformationpriortofinalfailure. The structural failure. Asbrittlestructures, composites exhibit rela- mation provides informationregarding theeventspreceding of permanentdeformationpriortofinalfailure, andthisdefor- than ductile.Ductilemetalstructures undergo relatively highlevels As discussedabove,typicalaircraft compositesare brittlerather Impact compression inbending. texture relative tothetopsideofwing,whichwassubjected which wassubjectedtotensioninbending,hasaveryfibrous failed inbending(Stumpff2001).Thebottomsurfaceofthewing, characteristics canreadily translatetoamacroscopic level. section isintensionandtheotherpartcompression. These This isaresult ofthefactthat,inbending,onepartcross- contains pulled-outfibersandtheotherpartisrelatively flat. vided byaneutralbendingaxis,onepartofthefracture surface ing. Figure 9showsaspecimenthathasfailedinbending.Di- is readily demonstratedincompositesthathavefailedbend- The difference betweentensileandcompressive fracture surfaces Bending graphs belowregarding impact. ferred toasdelaminationandisdiscussedfurtherinthepara- tween plies.Matrixsplittingattheinterfacebetweenpliesisre- tion, suchasatthefiber-matrixinterfaceandbe- at weakpointsinthematrixorareas ofhighstress concentra- be seeninFigure 7asgapsinthematrix.Matrixsplittingoccurs side ofthefiberfrom thecompression sideofthefiber. the neutralaxisoffiberinbending,separatingtension buckled andhavebenttofailure. Thechopmarkscoincidewith ling canalsobeidentifiedbyexamination ofthefiberends. tion ofmaterial,geometric,andenvironmental factors.Fiber buck- As indicatedinthefigures, theimpactcausedextensive delami- One commontypeofsub-surfacedamagefrom impactis In fact,impactloadingcancausedamagetoacompositewith- Figure 10 showsacompositeaircraft wingthathasreportedly Often associatedwithkinkbandsismatrixsplitting,whichcan As showninFigure 8,chopmarks indicatefibersthathave Figure 11. Example of composite failure involving delamination (Bascom and Gweon 1989). the fibers may remain intact. Moreover, the damage, if unnoticed, can continue to propagate upon further loading of the composite. Without visible evidence on the surface, delaminations must be identified by cross-sectioning the composite in the location of the delamination or by employing non-destructive techniques such as ultrasonics or X-ray tomography. If destructive techniques are employed, delaminations may be identified visually. In graphite-epoxy composites, delaminations can be identified by a dull, Figure 12. Striations at the interface between fibers and matrix whitish appearance, relative to the shiny, black appearance of (Stumpff 2001). neighboring areas free from delamination. WEDNESDAY— INTERNATIONAL DAY INTERNATIONAL WEDNESDAY— Fatigue One of the attractive qualities of composites is that they generally have better fatigue performance than typical aircraft metals such as aluminum. Despite this fact, composites can fail under fatigue loading and such failures result in particular failure features. Fatigue failure in metals can be readily identified, in many cases, by an unassisted visual inspection. A typical fatigue failure in metals will produce a fracture surface with beach marks. An example of beach marks was already discussed above and shown in Figure 4. Fatigue fracture surfaces in composites, on the other hand, do not typically have visible beach marks. In fact, fatigue fractures in composites typically do not appear any different from a corresponding overload failure. While fatigue fractures lack macroscopic evidence, some evi- Figure 13. A300-600 composite vertical stabilizer that dence may be identified microscopically. Figure 12 shows stria- failed during American Airlines Flight 587 in November tions at the fiber-matrix interface of a composite. 2001 (NTSB 2004). One striation typically corresponds to one load cycle. Although these striations indicate fatigue failure, areas containing stria- ally replaced by a composite design employing carbon fibers in tions are typically small in size, few in number, and may be dis- an epoxy matrix. Since that time, the composite stabilizer has persed over multiple locations in the composite. In addition, the accumulated more than 20 years of service. In November of 2001, striations are often identifiable only under high magnification American Airlines Flight 587’s composite stabilizer failed (Fig- and oblique lighting (Figure 12 was captured under a magnifica- ure 13). As a potential harbinger of the failures discussed in this tion of 2000x). In short, the identification of fatigue failure in paper, the failure of this composite structure is discussed in the composites can be very challenging. One macroscopic feature paragraphs below. The discussion frequently refers to the fea- that can provide evidence of fatigue is abrasion between mating tures of failed composites discussed in the section above. fracture surfaces. With repeated loading, the growing fracture The vertical stabilizer of the A300-600 is attached to the fuse- surfaces may rub against each other and leave abrasive marks on lage by three pairs of composite lugs—forward, middle, and aft— the ends of broken fibers and in the matrix. along the union between the stabilizer and the fuselage. The lugs transfer bending moments applied to the stabilizer through large American Airlines Flight 587 diameter bolts. Between each pair of lugs is a composite trans- Soon to be eclipsed by the center wing box of the A380 and the verse load fitting that transfers lateral loads applied to the stabi- fuselage of the B-787, the vertical stabilizer of the Airbus A300- lizer to the fuselage. Analysis of flight recorder data by the NTSB 600 is one of the largest composite principal structural elements indicates that the aircraft was subjected to a violently changing in commercial aviation. Although the structure was originally oscillatory sideslip motion, causing loads in excess of the ulti- designed with metallic materials, the metallic design was eventu- mate design loads of the stabilizer. The NTSB determined that

ISASI 2006 Proceedings • 43 ISASI 2006 PROCEEDINGS (NTSB 2002). the rightaftlugwere rough, consistentwithtensileloading Figure 14.Alongwithseveralotherfractures, thefractures of 44 failed undertensile loads.Similarrough fracture surfaceswere this fracture surface helpedtheNTSBdeterminethatlug surface oftherightaftcomposite lug.Therough appearanceof produce rough fracture surfaces.Figure 14showsthefracture attachment points. ure thatcausedtheprogressive failure ofthe remainder ofthe the rightrear lugofthestabilizersuffered atensileoverloadfail- with compressive loadingandbucklingoffibers(NTSB2002). (marked witha“c”)ontheendsoffractured fibers,consistent Figure 15.Fractures inmultiple locationsexhibitedchopmarks As discussedabove,tensilefailures incompositesgenerally • ISASI 2006 ISASI Proceedings With newvariablescome failure modes, suchasfiberpull- ric variationsamong plies,andcuringprocesses, amongothers. new variablesintotheanalysis, suchasfiberorientation,geomet- accident investigators.Theintroduction ofcompositesintroduces sis offailedcompositestructures willbeofsignificancetoaircraft With theimpendinggenerationofcompositeaircraft, theanaly- Conclusions age intheverticalstabilizer. noted thattheNTSBdidnotfindanyindicationoffatigue dam- bending ofthestabilizerfrom righttoleft.Finally, itmustbe ure. Thisevidencewasfound bytheNTSBtobeconsistentwith had arelatively smoothappearance,indicatingcompressive fail- tensile failure, whilethefracture ontheleft-mostattachmentpoint of thetransversefittingwere rough inappearance,indicating verse fitting.Fractures ontheattachmentpoints ontherightside left forward lugaswell. plies (Figure 16),asdiscussedabove.Hackleswere foundonthe les associatedwithshearfailure inthematrix-richregion between fibers withchopmarks.Alsofoundontheleftaftlugwere hack- left forward lugsofthefailedstabilizereachcontainedfractured failed fibermayindicatechopmarks.Theleftaft,center, and loads, theycanbuckleandthefracture surfaceontheendofa 15, whichshowschopmarksfoundontheleftaftlug. dence associatedwithcompression failure ispresented inFigure failure inbending,asdiscussedabove.Anexample oftheevi- the lugsonleftsideofstabilizer. Thisisconsistentwith the inboard sideandcompression failure ontheoutboard sideof The NTSBidentifiedevidenceconsistentwithtensionfailure on and compression developedontheoutboard sideofthelugs. In bending,tensiondevelopedontheinboard sideofthelugs left, loadingthelugsonleftsideofstabilizerinbending. right sidefailed,thedamagedstabilizerdeflectedfrom rightto the stabilizerfailedduetooverstress undertensileloading. a result, theNTSBconcludedthatlugsonrightsideof found ontheothertwolugsrightsideofstabilizer. As hackles, consistentwithfailure inshear (NTSB2002). Figure 16.Interlaminarfractures inmultiplelocationsexhibited Evidence consistentwithbendingwasalsofoundintheafttrans- As discussedabove,whenfibersare subjectedtocompressive According to theanalysisbyNTSB,afterlugson out, fiber kinking, and delamination, as well as the prevalence of Beaumont, P.W.R., and Schultz, J.M., Failure Analysis of Composite Materials. Delaware Composites Design Encyclopedia, Volume 4, 1990. brittle failure in composites as opposed to ductile failure in met- Ginty, C.A., and Chamis, C.C., “Fracture Characteristics of Angleplied als. Consequently, the analysis of failed composite structures can- Laminates Fabricated from Overaged Graphite/Epoxy Prepreg,” not rely solely upon the body of accrued knowledge and experi- Fractography of Modern Engineering Materials: Composites and Metals. ASTM, 1985. ence related to failed metallic structures. This paper has intro- McCormick, B.W., and Papadakis, M.P., Aircraft Accident Reconstruction and duced some of the basic concepts involved with analyzing failed Litigation. Third Edition, Lawyers and Judges Publishing Company, composites under a variety of fundamental loading conditions. 2003. National Transportation Safety Board. Probable Cause SEA95LA024, Fractographic details have been presented and subsequently il- 1995. lustrated by a short discussion of the analysis by the NTSB of the National Transportation Safety Board. Materials Laboratory Factual failed composite vertical stabilizer involved in American Airlines Report 02-077, 2002. National Transportation Safety Board. Materials Laboratory Factual Flight 587. It must be emphasized, though, that the above dis- Report 02-083, 2002. cussion is very limited in nature. With a broad range of associ- National Transportation Safety Board. “In-Flight Separation of Vertical ated design variables, the investigation of composite structural Stabilizer,” AAR-04/04, 2004. National Transportation Safety Board. NTSB Advisory 051222a, 2005. failures requires particular expertise. It is likely that, given such Stumpff, P.L., “Visual Analysis, Nondestructive Testing, and Destructive complexity, future investigations involving composite primary Testing,” ASM Handbook, Volume 21: Composites. ASM International, structures will require significant input from accident investiga- 2001. Stumpff, P.L., “Fractography,” ASM Handbook, Volume 21: Composites. ASM tors with expertise in the analysis of failed composite structures, International, 2001. as was required by the investigation of Flight 587. ◆ Wanttaja, Ron, http://www.wanttaja.com/avlinks/wire.htm.

Bibliography Footnotes Bascom, W.D. and Gweon, S.Y., “Fractography and Failure Mechanisms of 1 Conversely, automation will eliminate some sources of error associated Carbon Fiber-Reinforced Composite Materials,” Fractography and Failure with the construction of composites by hand. Mechanisms of Polymers and Composites. Elsevier, 1989. 2 M.P. Papadakis (McCormick and Papdakis 2003). Bolick, R.L., Kelkar, A.D., and Mohan R., “Performance Evaluation of Z- 3 S. Taylor (McCormick and Papdakis 2003). pinned Carbon Composites under Tension-Compression Fatigue 4 S. Taylor (McCormick and Papdakis 2003). WEDNESDAY— INTERNATIONAL DAY INTERNATIONAL WEDNESDAY— Loading,” Aerospace Testing Expo, 2006. 5 Such events typically produce microstructural evidence as well.

ISASI 2006 Proceedings • 45 ISASI 2006 PROCEEDINGS international working groups suchasGAIN andJSSI(ODA). A340 (August 2005,Toronto, Canada).Hehasalsobeeninvolvedin Britair CRJ100(June2003,Brest, France) andan AirFrance Airbus international investigations.These haveincludedtheaccidenttoa in 2003.Hehasbeeninvolved safetystudiesandparticipatedin a degree inhumanfactorsfrom theRenéDescartesUniversity, Paris, recorders, andARINC. suchasEUROCAE He hasalsobeeninvolvedinthedevelopmentofstandards forairborne computations andradardataanalysis. developed toolsfortrajectory 46 ration from a dedicatedstudy on thecountryofregistration. Thepresent papertakes itsinspi- other countries,andtheydonotdependontheaircraft modelor rent difficultieswere alsomentionedbyrecorder specialistsin readout workandsubsequentlytheinvestigation.Theserecur- data. Thismaysignificantlyblockordelaythevalidationof inappropriate decodingdocumentsorabsentbadlyrecorded corder readouts oftenbringtolightavarietyofproblems suchas requires that recordings beprocessed more rapidly, thoughre- recorders (FDR)ornon-protected datarecorders. Thisactivity include analysesofairbornerecordings, eitherfrom flightdata mercial airtransportwascreated 3yearsago.Theteam’stasks to incidents.Ateamdedicateddealingwithincidentsincom- progressively givenoveralarger partofitsinvestigationactivity In order todevelopitsrole inimproving safety, theBEAhas 1. Introduction and theiroriginswillbebrought togetherwiththeresults ofa can FAR Part 125.Thentypicalproblems related toFDRreadout posed intonationalregulations ofJAA members,andtheAmeri- resentative regulations: theEuropean JAR OPS1,whichwastrans- 6 Part Irecommended practiceswillbecompared withtworep- and discussregulations pertainingtothesechecks.ICAOAnnex present the principlesofrecording systemoperationalchecks After areviewAfter ofparameterrecording formats,thispaperwill • ISASI 2006 ISASI Solving FDRReadout Problems: incorporated intotheperformancegroup and ment in2001asasafetyinvestigator. Hewas in 2001.HejoinedtheBEAEngineeringDepart- from thePaul SabatierUniversity(Toulouse, France) School (ENAC)andamastersdegree inautomatics aeronautics from theFrench NationalCivilAviation Guillaume Aigoin Division in2000asasafetyinvestigator. Hereceived in Miami.HejoinedtheBEASafetyAnalysis USA) andaninternshipattheNTSBregional office Aeronauticalwith Embry-Riddle University (Florida, School (ENAC)in2000afteranexchangeprogram aeronautics from the French NationalCivilAviation Guilhem Nicolas Proceedings By GuillaumeAigoinandGuilhemNicolas,Bureau d’Enquêtesetd’Analyses A Proactive Approach 1 . received amastersdegree in received amastersdegree in pour laSécuritédel’Aviation Civile(France) reverse conversionfunctioniscalled“ der toretrieve theactualparametervalue.Theinformationon function mustbeappliedtotherecorded parametervalueinor- tion definedbytheaircraft manufacturer. Thereverse conversion not recorded assuch,butratherconvertedusingaconversionfunc- location. bers, word numbers,andsubframenumbersiscalled“ where aparameter’s dataare tobefoundintermsofbitnum- other subframes,orwithalowerfrequency. Theinformationon eral timesoneverysubframeoritmayberecorded onevery eral bitsofoneormore words. Itmayberecorded onceorsev- start ofthesubframeinbinaryfile. “synchronization word” sinceitcontainsamarker indicatingthe ning totheendofsubframe—thefirstword beingcalledthe with afixed number ofbits.Words are numbered from thebegin- (see Figure 1). as binaryfilesthatare sequencedin“frames”and“subframes” onboard computers,andotherinstruments.Dataare recorded unit thatcentralizesandformatsdatacomingfrom sensors, The FDRrecords informationcomingfrom adataacquisition 2. Principles ofdatadecoding complies with requirements onrecording quality. When these Periodic operationalchecksare necessarytoverifythattheFDR 3. Recording systemoperationalchecks accuracy, rangeand resolutions. provides alistofparameters torecord andrequirements ontheir operators mustkeep suchadocument.Eachofthese regulations The JAR OPS1andtheFAR Part 125alsostatethataircraft informationtoreadhave thenecessary outthedatainengineeringunits. explicit purposeistoensure “ tions all documents“ for keeping andupdatingit. staller atinitialinstallation,andtheoperatoristhenresponsible ment isprovided bytheaircraft manufacturer orequipmentin- any recorded parameterautomatically(seeFigure 2). Suchadocu- sions sothatdecodingsoftware canbeprogrammed toretrieve tains completeinformationonparameterlocationsandconver- recordings and theBEA’s corresponding recommendations. what needstobedoneimprove theoverallqualityofFDR tors. ThelastpartwillbededicatedtotheBEA’s conclusionson survey onFDRmaintenanceconductedamongFrench opera- In order tosavememoryspace,aparametervalueisgenerally As Figure 1illustrates,aparameterisrecorded ononeorsev- Each subframeitselfisdividedintoanumberof“words,” each According toICAOAnnex 6Part I,operators shouldarchive The dataframelayoutdocumentofaFDRinstallationcon- ” obtainedfrom theinitialinstallationofequipment.The ” concerning parameterallocation[and]conversionequa- that accidentinvestigationauthorities parameter conversion. parameter ” . Table 1. Extract of an FDR inspection report.

Figure 1. Parameter acquisition and coding. WEDNESDAY— INTERNATIONAL DAY INTERNATIONAL WEDNESDAY—

Figure 3. System calibration involves comparing baseline values with data acquisition unit output values.

cal order and without any overlapping. ICAO Annex 6 Part I states that operators should carry out annual inspections of FDR recordings. It recommends that “the FDR data from a complete flight … be examined in engineering units to Figure 2. Information related to a parameter evaluate the validity of all recorded parameters.” A report of this in- in the data frame layout document. spection should be made available to the state’s regulatory authority and the recorder should be considered unserviceable “if requirements are not met, various types of actions can be taken: one or more of the mandatory parameters is not recorded correctly.” In replacement or repair of malfunctioning elements or modifica- contrast, neither JAR OPS 1 nor FAR Part 125 recommends any tion of the data frame layout document. Two complementary type of FDR recording inspection. However JAR OPS 1 requires maintenance tasks are presented below that would allow an op- a flight data monitoring (FDM) program for those aeroplanes erator to guarantee the continuous serviceability of installed FDRs with a maximum certificated takeoff weight in excess of 2 27,000 and regulatory requirements pertaining to these tasks. References kg, as recommended by ICAO Annex 6 Part I. Numerous prob- to non-mandatory guidance are also provided. lems can be detected when FDM is put in place, even if this is not The first task is the FDR recording inspection. It starts with equivalent to a regular inspection of FDR recordings. Indeed, processing the entire FDR recording with decoding software that FDM sources are generally non-protected recorders, whose re- has been programmed according to the data frame layout docu- cording media can be removed and replaced quickly. Problems ment. Decoded parameters are then analyzed for quality. The related to the FDR may, therefore, go undetected. operator should produce a report including the detailed results The second maintenance task is the calibration check of the of the recording inspection and take corrective actions. Table 1 FDR measuring channels. Indeed, conversion functions provided illustrates an extract of the recording inspection report. by manufacturers are the result of tests performed on prototypes A comprehensive inspection has at least four components— and can, therefore, differ from the functions appropriate for a given • Firstly, to check consistency of parameter values and evolu- aircraft. Several factors can alter the quality of the measurements tions with operational knowledge. such as sensor aging and disassembly of mechanical elements dur- • Secondly, to check the consistency of the parameters’ patterns ing an overhaul causing a sensor to go out of adjustment. These in typical phases of flight such as causal relation between a flight problems can go undetected since sensors used for recorders are control and associated flight surfaces in the context of takeoff. sometimes different from the ones feeding data to flight instru- • Thirdly, to check that the total accumulated time of unread- ments and other aircraft systems. In addition, parameters that are able data is limited and that there are no cyclical areas of unread- used to warn of unusual situations, such as GPWS warnings, are able data. not activated during normal flights and do not appear on FDR • Finally, to check that data were recorded in proper chronologi- recordings. For these reasons, a specific test is needed.

ISASI 2006 Proceedings • 47 ISASI 2006 PROCEEDINGS 48 nological order. There are multiplecausesfor theseproblems, recordings, flightsoverlapwitheachother, upsettingdatachro- cyclical periodsofinvaliddata are found inarecording. Insome possible, orare verynoisy(seeFigure 4).Sometimes,large or be invalidandunusable—they havevaluesthatare notphysically plete data.Inmanyrecordings, severalparametersare foundto data framelayoutdocumentsaswellFDMimplementation. FDR data,includingthereadout equipmentused,theupdateof at analyzingareas related toFDRmaintenanceandtheuseof representative sampleof20French airlines.Thesurveywasaimed sults ofasurveyconductedbytheBEAin2002and2003 ona reason, theproblems were categorized andgrouped withthere- equately ensure theoperational serviceabilityofFDRs.For this ence ofthereadout problems thatcanbeencountered. tion bodies,theBEAEngineeringDepartmenthasbroad experi- them inthecontext oftechnicalassistancetoforeign investiga- With about30 4. Problems relatedtoFDRreadoutandanalysis ommendations andmeansofconformityforFDRmaintenance. EUROCAE Document112containsrec- organizations suchasEUROCAE. on FDRshasalsobeenissuedbynon-state not verifiedfrom theflightdata. parameters the performanceofanymandatory the DFDR” parameters recordedableness ofmandatory by recording checktodetermine“ maintenance program includeanFDR FDRs. Itrecommends thattheoperator ance aboutmaintenanceoperationson sory Circular AC20-141provides guid- authorities. For example, theFAA’s Advi- tional checkshasbeenissuedbynational non-mandatory guidanceonFDRopera- ing channels. calibration checkoftheFDRmeasur- OPS 1norFAR Part 125recommend a accordingly. Incontrast,neitherJAR to calibrationshouldbekept up-to-date Thedocumentationrelatedthe FDR. eters provided bysensorsdedicated to and more frequently forthoseparam- years forthemandatoryparameters should beperformedatleastevery5 tion tablesandtake corrective actions. operator shouldproduce areport containingparametercalibra- compared withtherequired accuracy, asshowninTable 2.The system outputare entered inaso-called“calibrationtable”and frame layoutdocument.Deviationsbetweeninputandreadout putes thephysicalvaluesusingconversionfunctionsofdata tion unitare processed by acompatiblereadout systemthatcom- Figure 3).Thecorresponding outputvaluesofthedataacquisi- of baselinevaluesandenteringtheseintoasensor(see The firstcategoryofproblems pertains tomissingorincom- These problems generallyoccurduetoairlinesfailingad- Apart from regulatory requirements, ICAO Annex 6partIindicatesthatsuchacalibrationcheck For agivenparameter, thistestconsistsofgeneratingaseries • ISASI 2006 ISASI and afunctionalcheck“

FDRs read outandanalyzedeachyear, halfof Proceedings ” Guidance the reason- to verify Figure 4.Various problems mayaffectparametersfrom thesameaircraft. Table 2.Exampleofacalibrationchecktableforflightsurface. been changed. Informationrelated toFDRinstallation isalso eters maynotbe documentedoraparameter locationmayhave data framelayoutdocument is oneidentifiedcause:newparam- to performanadequaterecording inspection. recording sincetheoperatordoesnothavedocument needed dataintheFDR document. Thisisoftenassociated withcorrupt aircraft manufacturer insteadofanup-to-datedataframelayout taining acopyofthegenericdocumentationprovided bythe part ofthefleetortospecificcategoriesevents. but notsystematicFDM,i.e.,theylimiteddatamonitoring toa 500 employees).Eightoperatorswere foundtoperformregular systematic FDM.Thesewere mainlylarge airlines(more than BEA surveyrevealed thatonly9outof20operatorsperformed in therecording andisrequired byEuropean regulations. The cording inspectionbutithelpstheoperator to detectproblems recording inspectionbyoperators. son forthefrequency offailures istheabsenceofadequateFDR lem, oradefectiverecording medium.However, themainrea- such asdefectivesensors,aconnectionorprogramming prob- The retrofit ofaFDRinstallationwithout modificationofthe The secondcategoryofproblems pertainstotheoperatorre- As explained above,FDMisnotstrictlyequivalenttoFDRre- that their operators can rapidly provide comprehensive and up-to-date data frame layout documents.” At the European level, the BEA recommended that European regulations be updated “in terms of necessary corrective actions when a mandatory parameter is not correctly recorded or the chronological recording structure does not match the history of the flights performed.” It also recommended “a comprehensive calibration program for mandatory parameters measuring and processing channels,” so that calibration problems are detected. In order to ensure that some kind of information related to parameter decoding can be retrieved readily by investigators, the BEA recommended that regulatory requirements be defined to get data frame layout information “recorded on FDR’s themselves.” Nationally, the BEA’s study showed that regional civil aviation services have the most appropriate means at their disposal to check the Figure 5. Example of deviation from theoretical equation. quality of data frame layout documents. As a result, the BEA recommended “that all operators and lost throughout the lifetime of the aircraft at each change of op- regional services of the French Civil Aviation authorities possess identi- erator. The BEA survey revealed that only 11 out of 20 operators cal, up-to-date and comprehensive data frame layout documents.” The

had complete data frame layout documents. These included op- BEA also recommended the study of “a formalized report template DAY INTERNATIONAL WEDNESDAY— erators performing FDM, as parameter analysis is not possible for the verification of mandatory parameter recordings.” The objective when data frame layout information is missing. Four operators is to make FDR recording inspection reports more understand- had either incomplete or outdated documents; five operators able through standardization. did not store any documents. Through its study, the BEA aimed at alerting the aviation com- The third category of problems pertains to absent calibration munity on a global safety problem. Improving FDR recording check reports. Generally the operator does retain generic pa- quality is only possible if most national authorities and operators rameter conversion equations but no parameter calibration tables. commit themselves to more stringent FDR operational service- However, the difference between the decoded value and the ac- ability requirements. The safety benefits, though not immedi- tual value of a parameter happens to be higher than the required ately apparent, are significant enough to justify an additional ef- accuracy, as illustrated by Figure 5. Unchecked parameters may fort being made and international cooperation being further then lead investigators to erroneous conclusions, or excursions extended. Improving safety is the way ahead, realizing the full of a parameter beyond operational safe limits may go unnoticed potential offered by FDRs is the means to achieve it. ◆ by the operator FDM. The BEA survey showed that no operators were performing References any kind of calibration check of FDR measuring channels, which ICAO Annex 6 part I, International Commercial Air Transport—Aeroplanes (July 2001). See Subchapter 3.2 and Attachment D. is no surprise since European regulations do not require this as a JAR OPS 1, Commercial Air Transportation—Aeroplanes (March 2006). See basic maintenance task. The operators checked elements of the Paragraphs 1.037, 1.160, and paragraphs 1.715, 1.720, and 1.725. measuring channels separately but did not test any measuring FAR Part 125, Certification and Operations: Airplanes Having a Seating Capacity of 20 or More Passengers or a Maximum Payload Capacity of 6,000 channels overall. Pounds or More (November 2003). See Section 125.226. FAA Advisory Circular 20-141, Airworthiness and Operational Approval of 5. Progress and challenges Digital Flight Data Recorder Systems (May 1999). United Kingdom CAA Safety Regulation Group CAP 731, Approval, The BEA concluded that recurrent FDR readout problems are Operational Serviceability, and Readout of Flight Data Recorder Systems (May due to factors including data frame layout documents not being 2004). archived or properly updated, inadequate inspection of FDR re- United Kingdom CAA Safety Regulation Group CAP 739, Flight Data Monitoring (August 2003). cording, and absence of calibration checks of FDR measuring Australia CASA, CAAP 42L-4, Flight Data Recorder Maintenance (October channels. These issues are often linked to poor specific knowl- 2002). edge about FDRs, especially among small- and mid-sized opera- EUROCAE Document 112, Minimum Operational Performance Specifica- tion for Crash Protected Airborne Recorder Systems (July 2003). See tors. In addition, national regulations trail behind ICAO recom- Chapter II-6, Annex II-A, and Annex II-B. mended practices and fail to give detailed and constraining requirements on FDR operational checks, even though valuable Endnotes guidance already exists. Consequently, the BEA study dedicated 1 Flight data recorder readout: technical and regulatory aspects available on the to FDR maintenance contained several recommendations. BEA website. 2 The French transposition of JAR OPS 1 is more stringent, since it In order to improve the quality of data frame layout docu- requires flight data monitoring for turbine-engine-powered aircraft with ments on a worldwide scale, the BEA recommended that the ICAO a maximum certificated takeoff weight in excess of 10,000 kg or with a ensure, through its audit procedures “that contracting states ensure number of seats in excess of 20.

ISASI 2006 Proceedings • 49 ISASI 2006 PROCEEDINGS 50 quest wasapproved byATC. permission touseRunway18Cforitsdeparture, and thatre- missed approach onthelandingrunway. normally. Becauseofthegustywind,quiteafewaircraft madea (18center)asopposedtotwo, other runwayavailableforarrivals was onerunwayavailablefordepartures (18left),andonlyone It wasadaywithfrequent showersandastrong, gustywind.There Case study(AmsterdamAirport) vestigation report. work before finalizingthein- ated byusingtheTEMframe- ommendations canbeevalu- the effectivenessofdraftrec- study isusedtoillustratehow dent investigation.Acase an analyticaltoolinATC inci- framework forapplicationas potential valueoftheTEM lent ofLOSA. i.e.,theATC(NOSS), equiva- mal OperationsSafetySurvey basis foraprogram calledNor- after itsintroduction asthe embrace theTEMframework community isalsostartingto The airtrafficcontrol (ATC) by airlinesaround theworld. grams thathavebeenadopted tions SafetyAudit(LOSA)pro- for thesuccessfulLineOpera- sity ofTexas andisthebasis was developedbytheUniver- agement (TEM)framework The Threat andError Man- Introduction of aviationincidents andaccidentsintheNetherlands. For operational reasons, oneparticularflighthadrequested This paperwilldiscussthe • ISASI 2006 ISASI Management (TEM)Framework as By BertRuitenberg, ATC Team Leader–Tower &Approach Units,Schiphol Airport,Amsterdam Factors Program. Hehas participatedininvestigations FlightSafetyandHuman consultant totheICAO Controllers’ Associations(IFATCA) andisalsoa specialist fortheInternationalFederation ofAirTraffic Amsterdam, theNetherlands. Heisthehumanfactors sor, andATC safetyofficeratSchipholAirport, Bert Ruitenberg Proceedings Using theThreatandError An AnalyticalTool inATC isaTWR/APPcontroller, supervi- Figure 1 controller used(18left)which intheircasewasincorrect forthe the clearance, pilotsusedthesamerunway identifierthatthe edged bytheaircraft nearthelandingrunway. Intheirreadback of fier (18left)inhisclearance, thetakeoff clearancewasacknowl- runway (18C).Althoughhedid includethecorrect runwayidenti- number ofthataircraft withthoseoftheaircraft nearthelanding the takeoff clearance,however, hemixed upthecallsign andflight to cleartheaircraft waitingontherunwayfortakeoff. Whengiving tower controller, whoalsowasthetowersupervisorthatday, wanted 18C. on Runway18L,andYXS148(“Flyfine148”)wasnear craft intendingtodepartfrom 18C:YZS158(“Airline 158”)was of theaircraft ontherunwaywasverysimilartothatofair- to aminoremergency atan aircraft parkingstand.Thecallsign fire brigadewascrossing therunway(withclearance)inresponse used holdingpointontheothersideofrunway. The airport the regular holdingpoints,andoneaircraft at aninfrequently craft linedupandwaitingontherunway, severalotheraircraft at was acknowledgedbythepilots. “there were severaldepartures infront.” Theholdinginstruction to itsfirstcallbyinstructingtheaircraft toholdshortbecause frequency tothetowerfrequency, thetowercontroller responded for itsdeparture andwastransferred from theground control After thefireAfter truckshadcrossed thedeparture runway(18L)the Meanwhile, onRunway18L,thetowercontroller hadoneair- When thatparticularflighttaxiedouttothe(landing)runway runway they were about to enter (18 center). The aircraft subse- 3. Used incorrect callsign/flight number/runway identifier com- quently departed from Runway 18C, which by chance occurred bination in takeoff clearance (“Flyfine 158 cleared for take off 18 between two successive landing aircraft of which the second made left”). a missed approach because of the wind. 4. Did not notice that the take off clearance was acknowledged by At the time of this occurrence, a rain shower passed over the YXS148. beginning of Runway 18C, obscuring the view of the holding A third category in the TEM framework is that of undesired point from the tower. The tower controller didn’t realize what states, which are defined as “operational conditions where an had happened until the aircraft was airborne from Runway 18C, unintended traffic situation results in a reduction in margins of flying in front of the aircraft that had to make a missed approach, safety.” Undesired states can be managed effectively, restoring which he observed on his radar display. The aircraft waiting on margins of safety, or the air traffic controller’s response(s) can Runway 18L reminded the controller a few moments later that induce an additional error. Undesired states are transitional states they were still lined up, after which the controller cleared them between a normal operational state and an outcome. Outcomes for takeoff. can be “uneventful” in the case of successful management of the Based on the information presented above, preventive mea- undesired state, or be a reportable occurrence (an incident or an sures that could be proposed include (but are not limited to) the accident) in the case of unsuccessful management of the undes- systemic deconfliction of callsigns, having a dedicated supervisor ired state. on duty, or using separate controllers for each of the runways. In The undesired states that can be identified in the case study order to find out which of those measures is potentially the most are effective one, the occurrence is analyzed using the Threat and 1. YXS148 departing from Runway 18C on the takeoff clearance Error Management (TEM) framework. intended for YZS158 on Runway 18L. 2. YZS158 remains lined up and waiting on Runway 18L. TE-based analysis According to the TEM framework there is a link between In the air traffic control adaptation of the TEM framework, threats threats, errors, and undesired states. Not every threat leads to an

are defined as “events or errors that occur beyond the influence error, and not every error leads to an undesired state, but mis- DAY INTERNATIONAL WEDNESDAY— of the air traffic controller, increase operational complexity, and managed threats frequently lead to errors, and mismanaged er- which must be managed to maintain the margins of safety.” The rors frequently lead to undesired states. The following paragraphs threats that can be identified in the case study above comprise explore the links for the case study: (in no particular order): 1. Strong gusty wind conditions. Threats linked to errors 1 and 2 2. Only one landing runway available (as opposed to two, nor- T4. Controller also is the tower supervisor. mally). T5. Departure from non-standard runway. 3. Several earlier missed approaches because of weather. T6. No extra markings for non-standard runway on flight strip 4. Controller also is the tower supervisor. YXS148. 5. Departure from non-standard runway. T7. No heads-up remark from ground controller with transfer of 6. No extra markings for non-standard runway on flight strip YXS148 near 18C. YXS148. T8. Departure 18C to be integrated with landing traffic. 7. No heads-up remark from Ground Controller with transfer of T16. Beginning of Runway 18C obscured by rain shower. YXS148 near 18C. Those threats were not managed and are linked to error 1 8. Departure 18C to be integrated with landing traffic. (Did not notice that YXS148 was at the holding point for Run- 9. Departure 18L from non-standard holding point. way 18C). Error 1 was not managed and is directly linked to error 10. Fire engines requiring to cross the departure runway. 2—provided incorrect information (“several departures in front”) 11. Similar company identifiers on flight strips of departing traf- to YXS148. fic (YXS and YZS). 12. Company identifiers do not resemble the corresponding Threats linked to error 3 callsigns (Flyfine and Airline). T11. Similar company identifiers on flight strips of departing 13. Similar flight numbers (148 and 158). traffic (YXS and YZS). 14. Acceptance and acknowledgement of clearance for incorrect T12. Company identifiers do not resemble the corresponding runway by YXS148. callsigns (Flyfine and Airline). 15. YZS158 doesn’t challenge the clearance for the other flight T13. Similar flight numbers (148 and 158). to take off on 18L. Those threats were not managed and are linked to error 3— 16. Beginning of runway 18C obscured by rain shower. used incorrect callsign/flight number/runway identifier combi- The TEM framework defines error as “actions or inactions by nation in takeoff clearance (“Flyfine 158 cleared for take off 18 the air traffic controller that lead to deviations from organiza- left”). tional or air traffic controller intentions or expectations.” The controller from the case study made the following errors: Threat linked to error 4 1. Did not notice that YXS148 was at the holding point for Run- T14. Acceptance and acknowledgement of clearance for incor- way 18C. rect runway by YXS148. 2. Provided incorrect information (“several departures in front”) This threat was not managed and is linked to error 4—did not to YXS148. notice that the takeoff clearance was acknowledged by YXS148.

ISASI 2006 Proceedings • 51 ISASI 2006 PROCEEDINGS 52 following threats: systemic deconflictionofcallsigns.Thismeasure addresses the the listofthreats. Thefirstpotentialmeasure mentionedwasthe effectiveness ofthepreventive measures mentionedearlieragainst undesired statesare established,itbecomespossibletocheckthe Now thatthelinksbetweenidentifiedthreats, errors, and Effectiveness ofpotentialcountermeasures craft fortake off.Itsoutcomeis,therefore, inconsequential. quent remark from YZS158andmanagedbyclearing theair- to take offon18L. T15. YZS158doesn’t challengetheclearanceforotherflight fore, isalsolinked withthreat 15from thelist: ticed bythecrew ofYZS158onRunway18L.Thiserror, there- parture from anotherrunwaythanintendedbythecontroller. ance intendedforYZS158onRunway18L. US1. YXS148departingfrom Runway18Conthetakeoff clear- aged bythecontroller, resulting inanundesired state: turn islinked toerror 4.Thislasterror wasnotnoticednorman- edgement ofclearanceforincorrect runwaybyYXS148),whichin inconsequential. was alsonotnoticednormanaged,however, itsoutcomewas by thecontroller andresulted directly inerror 2.Thaterror by YXS148. E4. Didnotnoticethatthetakeoff clearancewasacknowledged left”). nation intake offclearance(“Flyfine158cleared fortake off18 E3. Usedincorrect callsign/flightnumber/runwayidentifiercombi- to YXS148. E2. Provided incorrect information(“severaldepartures infront”) way 18C. E1. DidnotnoticethatYXS148wasattheholdingpointforRun- Errors linked toundesiredstates T10. Fire enginesrequiring tocross thedeparture runway. T9. Departure 18Lfrom non-standard holdingpoint. T3. Severalearliermissedapproaches becauseofweather. normally). T2. Onlyonelandingrunwayavailable(asopposedtotwo, T1. Strong gustywindconditions. managed orinconsequential: This undesired stateisnoticedbythecontroller after asubse- US2. YZS158remains linedupandwaitingonRunway18L. This threat isnotmanagedandleadstoanundesired state: Although error 3wasnotnoticedbythecontroller, itwasno- This undesired statewasnotmanaged;theoutcomeade- Error 3islinked withthreat 14(Acceptanceand acknowl- As notedearlier, error 1wasnotnoticedandmanaged The remaining threats from theoriginallistingwere either • ISASI 2006 ISASI Proceedings ICAO, Reference are proposed ininvestigation reports. TEM frameworkcanassistinvalidatingcountermeasures that of therelationships betweenthoseelements.Applicationofthe air trafficcontrol operationsandbyproviding anunderstanding accident investigationbyquantifyingelementsinthecontext of The TEMframeworkcanpotentiallybeappliedinincidentand Conclusion preventive measure isthemosteffectiveone. either managedorinconsequential,itisevidentthatthisthird T1, T2,T3,T9,andT10comprisethelistofthreats that were shower overthebeginningofrunway. Whenrealizing that priate levelofattentioncouldbegivenespeciallyifthere wasa frequency ofthecontroller forRunway18C,towhichtheappro- each other. YXS148wouldbetheonlydepartingflighton so theflightsinvolvedinthisincidentwouldn’t beabletohear T16. BeginningofRunway18Cobscured byrainshower. to take offon18L. T15. YZS158doesn’t challengetheclearanceforotherflight rect runwaybyYXS148. T14. Acceptanceandacknowledgementofclearanceforincor- T13. Similarflightnumbers(148and158). callsigns (FlyfineandAirline). T12. Companyidentifiersdonotresemble thecorresponding traffic (YXSandYZS). T11. Similarcompanyidentifiersonflightstripsofdeparting T8. Departure 18Ctobeintegratedwithlandingtraffic. YXS148 near18C. T7. Noheads-upremark from ground controller withtransferof YXS148. T6. Noextra markingsfornon-standard runwayonflightstrip T5. Departure from non-standard runway. controllers foreachoftherunways,addresses thefollowingthreats: T4. Controller alsoisthetowersupervisor. in reality onlyaddresses onespecificthreat: rect runwaybyYXS148. T14. Acceptanceandacknowledgementofclearanceforincor- T13. Similarflightnumbers(148and158). callsigns (FlyfineandAirline). T12. Companyidentifiersdonotresemble thecorresponding traffic (YXSandYZS). T11. Similarcompanyidentifiersonflightstripsofdeparting preliminary edition2005,inprint). Each controller wouldbeworkingonadedicatedfrequency, The third potentialmeasure mentioned,i.e.,usingseparate The potentialmeasure tohaveadedicatedsupervisoronduty Threat andError Management(TEM)inAirTraffic Control ◆ (ICAO, The ATSB Approach to Improving the Quality of Investigation Analysis By Michael B. Walker, Senior Transport Safety Investigator, Australian Transport Safety Bureau Summary the investigation, as well as project management software to for- The Australian Transport Safety Bureau (ATSB) is developing a mally manage the tasks and resources of an investigation; Safety Investigation Information Management System (SIIMS) • Report workflow: tools to assist the development of an investi- for its investigation activities. A key component of the System will gation report, and its modification through the different stages be a set of tools for the analysis phase of a safety investigation. of review; These tools were developed as part of a broader framework for • Search: tools to search the investigation documents and forms improving the quality of investigation analysis activities. This in the workspace, as well as tools to search the occurrence data- paper will provide a brief overview of SIIMS, and then describe base; the new ATSB analysis framework. • Contact lists: a means to organize all relevant contacts for the investigation, and therefore facilitate communication with exter- The Safety Information Investigation nal parties about the investigation;

Management System (SIIMS) • Access to a reference library (i.e., a set of documents and links DAY INTERNATIONAL WEDNESDAY— In 2004, the ATSB was successful in obtaining substantial Austra- that provide useful reference material to investigators, such as lian government funding to replace its existing occurrence2 data- ICAO Annexes, ATSB manuals, and technical manuals); and base (OASIS) with a new system. There were several drivers for the • Access to the occurrence database. change, including the fact that OASIS was based on a very com- The system is being developed in consultation with a plex data model, which made trend analysis and research difficult. multidisciplinary team of investigators. In addition, the system The previous system also had limited functionality beyond being design has been aided by discussions with the Canadian Trans- an occurrence database. The ATSB wanted to take advantage of portation Safety Board (TSB), which has been developing a simi- developments in information technology to build a system that lar system. SIIMS is expected to be fully operational in early 2007. could enhance the quality of the investigation process. To meet this aim, SIIMS will have an investigation workspace Need for a new analysis framework for each investigation with the following components: The analysis phase of a safety investigation is where the available • Investigation log: a form to record and categorize significant data are reviewed, evaluated, and then converted into a series of events and decisions made during the investigation; arguments, which produce a series of relevant findings. The quality • Document management: a structured set of folders to store of an investigation’s analysis activities obviously plays a critical and organize all of the evidence collected during the investiga- role in the determining whether the investigation’s findings are tion, including text documents, images, and other multimedia successful in enhancing safety. files; The analysis phase is also rarely easy. Safety investigations re- • Evidence tracking: a tool to manage the movement and ex- quire analysis of complex sets of data, and situations where the amination of original items of evidence (e.g., logbooks, wreck- available data can be vague, incomplete, and misleading. There age, recorders) held by the investigation team; are no detailed, prescriptive rules that can be applied in all situ- • Analysis: a set of tools to help guide the analysis phase of the ations and provide guaranteed success, and analysis activities ul- investigation, as well as document the results of analysis activities; timately rely on the judgment of safety investigators. • Project management: a tool to identify and manage risks to Despite its importance, complexity, and reliance on investigators’ judgments, analysis has been a neglected area in terms of Mike Walker is a senior transport safety investigator standards, guidance, and training of investigators in most orga- with the Australian Transport Safety Bureau nizations. Many investigators seem to conduct analysis activities (ATSB), and has been at the ATSB1 since 1995. His primarily using intuition rather than any structured process. It primary role has been to investigate the human and also appears that much of the analysis is typically conducted while organizational aspects of aviation accidents and the investigation report is being written. As a result, the writing incidents. He has substantially contributed to more process becomes difficult, supporting arguments for findings may than 20 significant investigations and has been be weak or not clearly presented, and important factors can be actively involved in developing investigation methodology at the missed. ATSB. Mike has a Ph.D. in organizational psychology, a master’s To help address this situation, the ATSB wanted to introduce a degree in human factors, a BSc honors (1st class) in psychology, and a comprehensive framework (including tools in SIIMS) to guide and diploma of transport safety investigation. support the analysis activities of its investigators. The ultimate aims

ISASI 2006 Proceedings • 53 ISASI 2006 PROCEEDINGS conditions ascontributory toanoccurrence. mechanism provides aclearer basis foridentifyingorganizational in stepsfrom onecontributingsafetyfactortothenext. This been expanded tomore easily allowthereasoning process tomove is acommonwayofdefining cause.However, thedefinitionhas “A” didnot happen,then“B” wouldnothavehappened),which occurred orexisted. anothercontributingsafetyfactorwouldprobably nothave • probably nothaveoccurred orhavebeenasserious; adverseconsequencesassociatedwiththeoccurrence would • theoccurrence wouldprobably nothave occurred; • not occurred orexisted attherelevant time,then tributing safetyfactor tributed totheoccurrence ofinterest. More specifically, a systemic conditions. vidual actions,localconditions,andarangeoforganizational or and conditions,suchasaccidentevents,technicalfailures, indi- with anoccurrence. Safety factorsincludeawiderangeofevents rence, and/ortheseverityofadverseconsequencesassociated curred inthefuture, wouldincrease thelikelihood ofanoccur- creases safetyrisk.Inotherwords, itissomethingthat,ifoc- 54 factor,” and“safetyissue.” lems, theATSB decidedtouse“safetyfactor,” “contributingsafety associated witharangeofsemanticandcommunicationprob- investigation. Ratherthanusetermsbasedon“cause,”whichare represent thetypesofevents andconditionstobefoundbyan risk, safety, andhazard. More importantly, itincludedtermsto tent usageofanalysis-related terms.Thisincludedtermssuchas The ATSB recognized theneedforcleardefinitionsandconsis- Standardized terminology policies,guidelines,andtraining. • analysis toolsinSIIMS;and • a definedprocess orworkflow; • anaccidentdevelopmentmodel; • terms; Standardized terminology anddefinitionsforanalysis-related • the followingcomponents: material inmanyareas. Theresulting frameworkisdescribedby processes where appropriate, butalsosubstantiallyadding tothis borrowing usefulideasfrom otherorganizations anditsexisting the process. and majorinvestigations,lackofguidancematerialabout handle novelsituations,lackofflexibility todealwithbothsmall cus onalimitedpartoftheanalysisprocess, lackofflexibility to applicability toanarrow domain(e.g.,aircraft maintenance),fo- found tomeettheATSB’s needs.Commonlimitationsincluded methods applicabletosafetyinvestigation.Noneofthesewere effectively “breaking thechain” ofaccidentdevelopment. system. Theframeworkwilltherefore haveadirect role inmore ability ofinvestigatorstodetectsafetyissuesinthetransportation defendability ofinvestigationanalysisactivities,andimprove the of thisframeworkwere toimprove therigor, consistency, and The definition alsospecificallyincludesthe term“probably,” This definitionisbasedonacounterfactualconditional(i.e., if Safety factorscanbeclassifiedintermsofwhethertheycon- A Consequently, theATSB developeditsownanalysisframework, The ATSB initiallyreviewed existing analysisframeworksand • safety factor ISASI 2006 ISASI Proceedings was definedasan wasdefinedasasafetyfactorthat,ifithad

event orconditionthatin- con- which wasdefinedasmeaningaprobability of75%ormore posed abouthow accidentsdevelop.Such modelscanplaya A large numberofdifferent modelsortheorieshavebeenpro- Accident developmentmodel terms oftherisklevelassociated withtheissue. only safetyissuesshouldberanked, andtherankingshouldbein terms ofthesafetyrisklevelfor future operations. Inotherwords, rence. Ifsafetyfactorsare toberanked inanyway, itshould bein in termsofthedegree towhichtheycontributedanoccur- In theATSB framework,contributingsafetyfactorsare notranked term “probably,” thedefinitionisnotsameas“probable cause.” have contributedtotheoccurrence. safety issues,regardless ofwhethertheycanbedemonstratedto ment purposes,investigationsshouldalsofocusonidentifying holders, newsmedia,andthepublic.However, forsafety-enhance- tributing safetyfactors,asthisiswhatofmostinterest tostake- investigations havetraditionallyfocusedonidentifyingthe con- contributed totheflightcrew’s fatigue).Accidentandincident ment system,butcannotconcludethattheseproblems probably tion mayidentifyproblems withanoperator’sfatigue-manage- safety issueswillbecontributingfactors(e.g.,aninvestiga- landing accident,buttheyare notsafetyissues).Similarly, notall pilot handlingandfatigueduringapproach maycontributetoa erational environment ataspecificpointintime. characteristic ofaspecificindividualor characteristic ofanop- isacharacteristicofanorganization orasystem,ratherthan • affect thesafetyoffuture operations,and canreasonably beregarded ashaving the potentialtoadversely • a safetyfactorthat fluence onsafety. More specifically, a or theactionsofflightcrew). produce fewfactors otherthanthoseinvolvingtechnicalfailures dard suchas“beyondareasonable doubt”(whichwouldusually that maybeconsidered weakbyexternal parties)andahighstan- “on thebalanceofprobabilities” (whichcouldproduce factors tions isapracticalcompromise betweenalowstandard suchas This ensures thatthestandard ofproof usedinsafetyinvestiga- Although thedefinitionofcontributingsafetyfactoruses the Not allcontributingsafetyfactorswillbeissues(e.g., Safety factorscanalsobeclassifiedintermsoftheirfuture insafety issue wasdefinedas Figure 1 3 . Figure 2 tates the identification of safety factors, and can also help the investigation team maintain awareness of their progress when identifying potential factors during the investigation.

The analysis process A major part of the ATSB analysis framework is a defined process or workflow to be used when conducting analysis activities. The overall process is divided into five separate processes, each of which is further broken down into a set of stages. The relationship between the five processes is shown in Figure 2. The five processes can be briefly described as follows: • Preliminary analysis: A range of activities to convert data into a format suitable for the analysis of safety factors. This involves the use of techniques to interpret and organize data, including the systematic review of the sequence of events associated with an occurrence. Preliminary analysis may require the use of arguments to develop intermediate findings on a range of topics (e.g., angle of impact, who was the pilot handling, wind speed during approach). Figure 3 • Safety factors analysis: A structured process to determine which events and conditions were safety factors, with an emphasis on determining the contributing safety factors and safety issues. Fur- ther information on safety factors analysis is provided below. • Risk analysis: A structured process to determine the risk level

associated with any verified safety issues. This involves determin- DAY INTERNATIONAL WEDNESDAY— ing the worst feasible scenario that could arise from the safety issue, and ranking the consequence and likelihood levels associated with such a scenario. The resulting risk level is classified as “critical,” “significant,” or “minor.” • Safety action development: A structured process of facilitating safety action by communicating safety issues to relevant organizations. The nature and timeliness of the ATSB communication is determined by the risk level associated with the safety issue. useful role during an investigation by helping investigation teams • Analysis review: A review of the analysis results to identify identify potential safety factors, and also providing a frame- gaps or weaknesses. This process involves checking the investi- work for classifying safety factors in a database. Unfortunately, gation findings for completeness and fairness. It also involves some analysis methods provide no guiding model to assist with reorganizing the findings into a more coherent format and se- the identification of factors, whereas some other methods focus quence (if required). too much on a model and not enough on the identification As indicated in Figure 2, safety factors analysis is the heart of process. the analysis process. It is composed of two main components: In recent years, the ATSB and other safety investigation agen- safety factor identification and safety factor processing. An over- cies have successfully used the Reason Model of organizational view of safety factors analysis is presented in Figure 3. accidents (Reason 1990, 1997) to guide the analysis phase of some During safety factor identification, potential safety factors are investigations. Although this Model is widely accepted, it has some identified by asking a set of generic questions about the occur- features that limit its usefulness. The ATSB has adapted the Model rence (based on the accident development model), and asking a to better suit the requirements of safety investigation and to make set of focussed questions to explain specific factors. In some situ- the Model more applicable to a wider range of investigations. ations, specialized techniques may also be useful to identify ex- The primary changes from the Reason Model include broad- planations for specific types of factors (e.g., barrier analysis, prob- ening the scope beyond a focus on human factors, and to more lem analysis, failure mode effects analysis). functionally define the components of the model in order to re- Safety factor identification activities start early in the investiga- duce overlaps and confusions when categorizing a factor. In par- tion and are repeated at regular intervals until there is sufficient ticular, the ATSB model clearly distinguishes between the things data available to conduct safety factor processing. Investigators are an organization puts in place at the operational level to minimise encouraged to use charting techniques to display the relationships risk (i.e., “risk controls,” such as training, procedures, warning between potential factors. They are also encouraged to regularly alarms, shift rosters), and the conditions that influence the effec- review the list of potential factors to determine if there may be tiveness of these risk controls (i.e., “organizational influences,” critical safety issues that need to be urgently addressed, as well as such as risk-management processes, training needs analysis pro- to determine needs for additional data collection. cesses, regulatory surveillance). Safety factor processing focuses on each potential safety factor The resulting model can be arranged into a series of levels, as that has been identified and selected for further analysis. This shown in Figure 1. Representing the model in this format facili- further analysis involves defining and testing the factor. Each

ISASI 2006 Proceedings • 55 ISASI 2006 PROCEEDINGS 56 investigation. Borrowing aconceptfrom theCanadianTSB useful todiscussthedifferent typesoffindingsproduced byan analysis framework.Prior todiscussingthesetablesfurther, itis tigation orkeeping trackofitsprogress. mented trailofreasoning isinvaluablewhenreviewing theinves- thoughts andactivitieswhendoinganalysisactivities.Thisdocu- vide ameansfortheinvestigationteamtodocumenttheir guidance whenconductingtheanalysisprocess. Theyalsopro- as summarizedinTable 1.Thetoolsprovide abroad levelof Each ofthefiveanalysisprocesses issupportedbytoolsinSIIMS, SIIMS analysistools for theproblem, anddirectionality ofinfluence. being explained), required assumptions,alternativeexplanations presence ofinhibitors,characteristicstheproblem (i.e.,factor plausibility, knownhistoryofinfluence,presence ofenhancers, ing, reversibility, relative location,magnitudeofproposed factor, provided guidingquestionsonthefollowingcriteria:relative tim- example, tohelpconductthetestforinfluence,investigatorsare ance forconductingthetestshasbeenextensively expanded. For ICAO humanfactorsdocument(ICAO1998).However, theguid- ence andinfluencetestsare basedonconceptspresented inan portance), orofnoconsequencetotheinvestigation.Theexist- influence), anothersafetyfactorofinterest (existence plusim- tential safetyfactorisacontributing(existence plus overview oftheflowtestingprocess ispresented inFigure 4. the testforexistence, testforinfluence,andimportance.An determine whetherthefactorcanbe“verified.”Thesetestsinclude fied asneedingfurtheranalysis,aseriesoftestsare performedto analysis frameworks.For everypotentialsafetyfactorthatisidenti- ATSB frameworkhasplacedsubstantiallymore emphasisthanother sion ofsafetyfactoridentification). potentially explained byotherfactors(i.e.,arevision andexten- final stageistoensure that,where possible,thefactorhasbeen verified factoristhenclassifiedintheoccurrence database.The a key finding. to helpfacilitate theprocess ofmovingfrom thecollected datato number ofintermediatefindings (duringpreliminary analysis) tion tothe“key findings,”aninvestigationmayalsodevelop a the importantsafetymessages from theinvestigation.Inaddi- tole inreducing theriskassociatedwith occurrence. or eventsconditionsthat“savedtheday”playedanimportant were notabletobemade.Itmayalsoincludepositivesafety factors, possible scenariosorsafetyfactorswhenfirmfactorfindings findings toresolve ambiguityorcontroversy, andfindings about clude inthefindingssectionoffinalreport. Thismayinclude • the testforimportance); factor butwere stillconsidered tobeimportant (i.e.,theypassed vestigation thatdidnotmeetthedefinitionofcontributing safety • dardized terminologyabove); • tion reports intothree subsections: ATSB hasstarteddividingthefindingssectionofitsinvestiga- Evidence tablesare acriticallyimportantpartoftheATSB The result ofthetestingprocess willdeterminewhetherapo- The “test”stageofsafetyfactorprocessing isanarea where the The intentionofthisformat istomore clearlycommunicate Other key findings Other safetyfactors Contributing safetyfactors • ISASI 2006 ISASI Proceedings : anyotherfindingconsidered relevant toin- : safetyfactorsidentifiedduringthein- (asdefinedinthesectiononstan- 4 , the eiwfnig omintoamore coherent formatforthefinalreport Reorganizes key findingsofaninvestigation findingsform organizations regarding Summarize review RecordsAnalysis detailsofcommunicationswithexternal factorsidentifiedduringtheanalysis form Records theresults ofeachstagearisk development Safety action Safety action Risk analysis Risk analysis non-safetyfactorfinding Purpose analysis Safety factors table Tests thesupportingargument fora Tool Basic evidence analysis Preliminary Process may berelevant tothefinding, oneforclarifyingcomments about three columns:onefortheitemsofevidence orinformationthat ings” andproposed intermediatefindings. Thetablesconsistof the evidencetabletobemore aflexible andeasiertouseformat. ibility orrelevance ofitemsevidence.TheATSB developed data, orsituationswhere there are concerns regarding thecred- difficult process, particularlywhendealingwithcomplex setsof by thefinding.Developinganargument inthisformatcanbea critical reasoning isuseaseriesofstatements—premises followed sis sectionofareport. structured andunderstandable waypriortowritinguptheanaly- investigators topresent theirsupportingarguments inamore incomplete, andtimeconsumingtofinalize.TheATSB wanted form inaninvestigationreport. Thisformatcanbeambiguous, supporting arguments fortheirfindings,otherthanin paragraph Basic evidencetablesare usedtotestproposed “otherkey find- The traditionalwayofpresenting arguments inthefieldof In thepast,investigatorshavenotalwaysclearlypresented the omanalysisconductedonasafetyissue form finding(builtintothesafetyfactorform) Tests thesupportingargument forasafetyfactor evidence table Safety factor Records theresults ofthedefine,test,classify, Safety factor form associatedwithanoccurrence, andproduces Records summarydataofpotentialsafety Safety factorslist Records summarydataofkey events events list Sequence of (if required) any proposed orcompletedsafetyaction various typesofchartsthissequence and explain stages of safetyfactor a safetyissue,aswell Figure 4 Table 1 processing Figure 5 tion into more useful and manageable components. The guidelines and tools are being introduced and reinforced through a 4-day training course for all investigators at the ATSB. The training involves a large component of practical experience in applying the framework’s concepts, process, and tools. One feature of the guidelines and training worth mentioning is the strong emphasis on teamwork. Investigators have excellent skills and knowledge of particular domains, but it is unlikely that any one investigator is going to have sufficient knowledge in all relevant domains to deal with the complexity that arises during investigations. As the range of experience that contributes to analysis judgments is broadened, then the quality of the resulting findings will improve.

Concluding comments each item, and one for rating how the item may impact on the Analysis activities ultimately rely on the judgment of investiga- finding (i.e., supports, opposes, no effect, or unsure). Based on tors. The ATSB analysis framework is designed to guide and sup- the information in the three columns, an overall assessment can port these difficult judgements, rather than replace the central be made as to whether the proposed finding is supported. A role of its investigators. By providing standardized terminology, simple example of a basic evidence table is provided in Figure 5. a generic accident development model, a defined process, tools, In SIIMS, investigators will be also able to provide links to sup- policies, guidelines, and training, the ATSB believes that it will porting evidence in the document-management system for each improve the rigor, consistency, and defendability of its investiga- of the items or comments in the table. tion analysis activities, and improve the ability of its investigators

Safety factor evidence tables are used to test proposed safety to detect safety issues in the transportation system. DAY INTERNATIONAL WEDNESDAY— factors. They have separate parts for the test for existence, test The ATSB analysis framework will be fully operational when for influence, and test for importance. The existence and influ- SIIMS comes on line by early 2007. Prior to then, investigators ence parts are essentially the same as the basic evidence table. are being encouraged to start using the new analysis guidelines The influence part (if required) is simply a free-text box allowing in their current investigations. Preliminary feedback has been investigators to justify why they think the safety factor should be positive. Although the new framework may require more effort analyzed further. initially as investigators become familiar with the concepts, pro- Investigators are provided with guidance for developing an evi- cess, and tools, it is widely appreciated that it will provide more dence table in four stages: review related information, identify rel- assurance of quality in the longer term. evant items of information, evaluate the strength of each item, and The new ATSB analysis framework is just a starting point. The evaluate the overall strength of the potential finding. The guidance intention is that, as investigators become more familiar with it, consists of a series of questions or criteria to consider at each stage. they will actively contribute to its ongoing improvement. In other words, the framework is a platform for documenting the ATSB’s Policies, guidelines, and training organizational learning about analysis methods. To emphasize the importance of using the terminology, model, The ATSB has disseminated information about earlier versions process, and tools in the analysis framework, the ATSB has de- of its analysis framework to other agencies. It also intends pro- veloped a set of policies for its investigators. Examples of these viding further information to interested organizations in the near policies include requiring a sequence of events analysis for each future. Any feedback anyone has for enhancing the quality of the occurrence investigation, completing an evidence table for each ATSB framework would be gratefully received. ◆ key finding, conducting a risk analysis of each verified safety issue, and encouraging external organizations to initiate safety References action prior to ATSB issuing any recommendations. ICAO, Human Factors Training Manual, Doc. 9683-AN/950, pp. 2-4-19 to 2-4-20 (ICAO 1998). The policies are supported by a comprehensive set of guide- Reason, J., Human Error (Cambridge University Press 1990). lines. These guidelines provide information on analysis termi- Reason, J., Managing the Risks of Organizational Accidents (Ashgate nology, accident development models, and principles of critical Publishing 1997). reasoning (e.g., components of arguments, deductive versus in- Endnotes ductive arguments, common fallacies of reasoning, characteris- 1 Prior to July 1999, the aviation investigation section of the ATSB was tics of evidence that influence its credibility and relevance, pre- known as the Bureau of Air Safety Investigation. ferred terminology to use for describing probabilities, and simi- 2 The ATSB uses the term “occurrences” to refer to both accidents and incidents. lar concepts). The guidelines also provide detailed guidance on 3 The definition of “probable” being equal to 75% or more was based on a how to conduct each of the processes and stages of the analysis review of research into how different groups of people understood phase. For many of the stages in the analysis process, the guid- verbal probability expressions, as well as standards used in fields such as climate change and intelligence analysis. ance is presented in the form of a series of questions or criteria to 4 The Canadian TSB format for findings uses different titles but similar consider. This approach breaks down the general “why” ques- concepts.

ISASI 2006 Proceedings • 57 ISASI 2006 PROCEEDINGS NRAF’s maindepotbefore becomingchiefinspectorattheAIB/Nin1998. 58 knowledge thatina“normalsituation” itistheresponsibility accident prevention investigation. in us,byawarding ussuchabroad-based andground-breaking would like tothanktheMinistryforconfidenceithasplaced without havingbeeninitiatedbyseriousaccidents.TheAIBN orabroad, outinNorway no suchaviationstudyhasbeencarried incidents associatedwiththeairtrafficservice. 2004, aswelltwoearlierreports, 05/94and49/2000,concerns someone’s “psychologicalstate.”Oneofthesereports, SLrep 42/ which asignificantcontributoryfactorwasdistractioncausedby well asthree, thenfresh, AIB/Nreports from seriousincidents,in municated from aviationcommunity, partsoftheNorwegian as to undertake thisstudybecauseoftheconcern thathadbeencom- in the5-year periodfrom Dec.31,1999,to31,2004. civilaviation sector that hadbeentakingplaceintheNorwegian maintained inthelightofcomprehensive changeprocesses port andCommunicationstoinvestigatehowaviationsafetywas MinistryofTrans-(AIB/N) wascommissionedbytheNorwegian In November2004,theAccidentInvestigationBoard/Norway Introduction The AIB/N has carried outthisimportantprojectThe AIB/Nhascarried infull As farastheAIB/Nisaware, partlythrough thisinvestigation, The MinistryofTransport andCommunicationsrequested AIB/N • Light oftheMajorChangeProcesses ISASI 2006 ISASI By Dr. Kaare Halvorsen(presenter) andDr. Grete Myhre, AccidentInvestigationBoard/Norway (AIB/N) An InvestigationastoHowAviation Safety Will BeMaintainedinthe Taking PlaceintheNorwegian He wastheheadofmechanicalworkshopsat selection andcorrosion anderosion problems off-shore. onmaterial worked forashortperiodintheoilindustry ing foranoffshore helicoptercompanyin1987. He metallurgy andstartedasastructuralengineerwork- AIB/N. Hehasamasterofsciencedegree inphysical Kaare Halvorsen factors inaccident investigationintheAIB/N. 20 yearsbefore becomingresponsible forhuman ment, andeducationofhumanfactors inNRAF for responsible foraccidentinvestigation,crises manage- and aPh.D.inbiologicalpsychology. Shehasbeen AIB/N. Shehasamastersinexperimental psychology Grete Myhre Proceedings iscurrently theacting director in Civil AviationSector iscurrently thechiefengineerat Trondheim ATCC andtransferofitsarea ofresponsibility to a Air trafficcontrol hasbeenreorganized withtheclosure ofthe outmajororganizationalcarrying changes andstaffreductions. public limitedcompany(PLC), andhasbeenintheprocess of Jan.1,2003:Luftfartsverket wasreorganized intoaseparate • and Communications. ing agovernmentcorporation undertheMinistryofTransport changed itsnametotheCivilAviation Administration,becom- was removed from theformerCivilAviation Authority, which CivilAviation Authority Jan.1,2000:Thecurrent Norwegian • 2000 untiltoday. Thesechanges are tion sectorandhasundergone majorchangesintheperiodfrom lations are compliedwith. regulations updatedandbymonitoringtoensure thattheregu- the ground. Thisgoalistobeachievedbykeeping therulesand less ofwhethertheseoperationsare outintheairoron carried organization, techniques,procedures, orindividualskills—regard- relatedtions inNorway toaviationsafetyinterms ofequipment, TheAuthorityencompasses allopera- tration (nowAvinor AS). was previously CivilAviation Adminis- apart oftheNorwegian a pointofdeparture. TheAeronautical InspectionDepartment on Jan.1,2000,withtheAeronautical InspectionDepartmentas try ofTransport andCommunications.TheAuthoritywasfounded aviation,undertheauspicesofMinis- agency forNorwegian applies, inprinciple,forothertransportsectorsandindustries. ing forothersthanthe“investigated”players.Thesamealso parts ofthebackground material willalsoprove tobeusefulread- than enoughfocusonthem. “major” companiesmighthavefeltthatthere wasperhaps more challenges theyfacewere not(sufficiently)discussed,while the craft andhelicoptercompanies,mighttherefore feelthatthe including themanysmall-andmedium-sizedcommercial air- aviationindustry.gious” playersintheNorwegian Somepeople, priorities, amongthemto“only”investigatethemost“presti- relatively shorttimeframe,theAIB/Nhadtoplaceanumberof aviationindustry.the Norwegian of theCAA/Ntoevaluatehowaviationsafetyismaintainedin Avinor AS is one of the central players in the Norwegian avia- isoneofthecentralplayersinNorwegian Avinor AS CivilAviation Authority isthesupervisory The Norwegian In ouropinion,however, boththemainconclusionsandlarge Within theextremely wide-rangingproject descriptionandthe newly created ATCC North at Bodø. The decision has been made rated and organized as separate companies, SAS Technical Ser- to close the ATCC at Røyken (presently south/east). Air traffic vice (STS) and Braathens Technical Service (BTS)—a subsidiary control in southern Norway will be unified in one ATCC South at of STS. Lately it has been decided that BTS will be shut down Stavanger (Sola) (presently west). and the activity moved to Sweden. The ground staff at Braathens • The Civil Aviation Administration is established as a limited com- were absorbed into SAS Ground Service (SGS), a subsidiary of pany owned 100% by the state, changing its name to Avinor AS. SAS—which was also created in that period. In the spring of 2004, • Dec. 4, 2003: Avinor AS decides to implement a major cost- the airlines SAS and Braathens were merged into one—SAS saving program, the project Take-Off-05 (the project had, how- Braathens. Similar restructuring has taken place at CHC (for- ever, been in preparation since the autumn of 2002). merly “Helikopter Service”), which has new Canadian owners Avinor is responsible for the total range of air navigation ser- and where technical maintenance has also been moved into a vices in Norway and owns/operates 46 airports, including one he- separate company, Astec. liport. At the end of 2004, the Avinor Group had a total of 2,732 These are changes took place concurrently and, in some cases, full-time employees, compared with 3,072 the previous year (ac- at high speed. cording to the 2004 annual report). In addition to its directly avia- In addition to these changes in the domineering airlines in tion-related activities, the company also has commercial interests Norway, new players entered the market, primarily Norwegian in the form of property, rental, hotels, parking, etc. OSL (the main Air Shuttle, which competes against SAS Braathens on both do- national airport at Gardermoen “close” to Oslo) is a separate lim- mestic and international routes. Air miles programs on domestic ited company, owned by Avinor, and is a part of the Avinor Group. flights was terminated, and the prices of domestic flights were In addition to these changes, there have been other major and heavily reduced as a result of increased competition, both na- minor changes, including a major change in 2001 when 11 re- tional and international. gions were reduced to 5. This study focused on the most compre- The increase in competition, with its increased focus on costs, hensive process of change, Project Take-Off-05. The Air Naviga- led to changes in the jobs of major groups in Norwegian aviation Services Division is the unit in Avinor that affects safety to tion. Pilots now have a more active flight service duty—in other

the greatest extent, although all of the divisions must function words, they have increased their airborne time when they are on DAY INTERNATIONAL WEDNESDAY— optimally and in coordination if Avinor’s contribution to total duty. Time on the ground between flights has been reduced, and aviation safety is to be ensured. a number of technical maintenance routines have been trans- The mandate of Norwegian Civil Aviation Authority is from ferred from aircraft technicians to other personnel. The number 1999, and its strategic plan dates from 2000. The mandate states of airports having technical maintenance staff available has been that CAA/N shall strive to ensure that air traffic in Norway is reduced, etc. carried out in a safe and expedient manner. Section 3 of the The word “safe” in the expression “safe aviation operations” is mandate sets the stage for a detailed supervision in which spe- an abstract expression for a result, goal, or vision that is under- cific work tasks with respect to the supervision objects are spelled stood in different ways, according to the user’s point of view and out. It is clearly stated, however, that the Norwegian Civil Avia- safety needs. If the safety of a state, condition, transport activity, tion Authority does not have responsibility for safety; this lies or a transport system is to be expressed in an understandable with the individual aviation company. However, the Norwegian way, it is completely necessary to be able to understand which Civil Aviation Authority assumes responsibility for its own opera- element could potentially be unsafe or a threat. It is the under- tions in fulfilling of international requirements. standing of unsafe that expresses the level of safety. Safety or In 2002, Prime Minister Bondevik’s second government exam- level of safety is often stated quantitatively as how probable it is ined the various government supervisory agencies’ dependency that an unsafe situation can arise, or qualitatively with what would relationship with their respective Ministries. A proposal for wide- be the consequence of a state or condition. ranging independence for the supervisory agencies was submitted As a basis for this investigation, we defined (aviation) safety as in Report to the Parliament No. 17 (2002–2003)), Supervision a state in which Report Doc. 2 proposed that the Norwegian Civil Aviation Au- • the significant sources of danger linked to a system, or an thority should be relocated to Bodø, in the north of Norway. The activity, are under control. result of this new supervisory arrangement was intended to help • the level of risk is acceptable and/or as low as practically possible. make the various supervisory agencies more independent, clarify By risk, we understand the danger that undesirable incidents their roles, and enhance their professional expertise. represents for human beings, the environment, or material prop- In this relocation matter, it appeared that financial, legal, and erty. In this study, we only considered the danger of acute, unin- regional considerations carried the most weight. Safety was men- tended events. The risk of terrorist incidents was, for example, tioned, but in our opinion it did not play an active enough role in not considered. Risk concerns the possibility of unwanted inci- the assessments. Nor did safety appear to be one of the key con- dents. Incidents that have been experienced and possibly quan- cepts in the final decision. tified in accident frequencies are, therefore, not a direct expres- In addition to the changes that have taken place and are taking sion of risk. In principle, one or more sources of hazard may be place in connection with the movement of the CAA/N from Oslo out of control, even if accidents have not occurred in connection to Bodø and the reorganization of Avinor AS, several other changes with these sources. have taken place in parallel in Norwegian aviation since 2000: The basis for AIB/N’s assessments in this study were the au- • There have been major changes in the company structure in thorities’ and industry players’ expressed, and partly written, several Norwegian airlines. SAS acquired Braathens in 2001. In overall guidelines and goals stating that both SAS and Braathens the technical services have been sepa- • levels of aviation safety must be continually improved, and

ISASI 2006 Proceedings • 59 ISASI 2006 PROCEEDINGS 60 AIB/N decided toapproach theairlinestrough themaintenance In order toobtainpresumably best/mostquantitative data,the The airlines that willachievethehighestpossible levelofaviationsafety. be subjecttogreater considerationinorder forachoicetobemade nate thedifferent pointsofview, sothattheissues discussedcould concerning thesameissue.Insuchcases,AIB/Nchosetoillumi- interests. Thevariousgroups oftencometodifferingconclusions ments/studies hadbeenproduced bypersonsorgroups withvested the studyanditsanalyses. ferent groups haveprovided usefulbackground informationto aviationindustry.the Norwegian Theassessmentsmade bydif- who, directly orindirectly, were engagedinsafety-related workin An anonymousquestionnaire spection visits,corrective orders andinitiativesimplemented). example out,systemaudits,in- numbersofinspectionscarried numbers ofaccidentsandincidents)activityindicators(for informants. We havealsoinvestigatedresult indicators(forexample, tatives). Inall,wehavebeenindirect contact withseveralhundred operative personnel,supervisoryandunionrepresen- have interviewedpersonsinvariouspositions(e.g.,management, have retrieved andanalyzedbothqualitativequantitativedata. various datasources andmethodsofapproach. Thismeansthatwe to datahaveallowed,usedmethodsbasedontriangulationbetween of changeandaviationsafety. We have,asfarresources andaccess sessments andinterpretations ofthelinkbetweenactualprocesses approach inwhichweemphasizeourinformationsources’ ownas- In thispresent project, wehavechosentouseanopenmethodof Methods duringthecurrent period. maintained inNorway a basiswhenassessingwhetherlevelsofaviationsafetyhavebeen It has,therefore, beennecessarytouseothertypesofindicatorsas eral yearsaftertheimplementationofchangeshastaken place. consequences rarely materializeintheformofaccidentsuntilsev- experience from abroad demonstratethatanynegativeairsafety or poorer asaresult ofthechangesinpastyears.Research and sure orconfirmthatthelevelofaviationsafetyhasbecomebetter impossible atanationallevel,toapplyaccidentstatisticsmea- ber ofaccidentsandseriousincidents,make itdifficult,nottosay requirements, suchasatomicpowerstationsandoilproduction. production facilitiesthatalsohavestringentsafetyandreliability pen. Inthisway, itisbettertocompare aviationwithadvanced using statistics,quitesimplybecauserelatively fewaccidentshap- fic, aviationsafetycanonlybeinvestigatedtoalimitedextent aviationsector.level ofsafetyintheNorwegian Unlike road traf- changes toprivateandpublicplayersdohaveanimpactonthe the CAA/Nledtostrong protests from employees. Especially thedecisionsconcerningrelocation oftheATCCs and work tasks,relocalization, andredundancies inthecompanies. tion sector. Thechangeshaveledtolossofjobs,transferother and aftertheperiodofmajorchanges. levelsofaviationsafetymust,atleast,bemaintainedduring • One challengeforAIB/Nwasthatseveraloftheavailabledocu- In additiontostudyingexisting documentsandanalyses,we The generallyhighsafetylevels,withtheirattendantlownum- It isentirely possiblethatsuchcomprehensive andconcurrent These changesaffectvirtuallyallgroups workingintheavia- • ISASI 2006 ISASI Proceedings wassenttoamajorityofemployees management. The process agrees withageneral management company hasa risk-basedoranaction-based approach tosafety being proactive orreactive insafetyworkdecideswhether the (proactive approach; upperpartofthefigure). Theemphasison tives tobeimplementedbefore undesirableincidentstake place threats mustbeidentified,andrisksurveyed,inorder forinitia- that youdonotexclusively investinareactive approach; new management model)are taken. Goodsafetymanagementmeans which thenecessaryactions(reactive approach, lowerloopofthe continual process ofmonitoringandcontrol alsotakes placein which safetygoalsare defined onthebasisofasafetypolicy. A sired levelofsafetycan be achievedbyastructured process in tain riskcontrol anddevelop safety. Themodelshowsthatade- by thethreats thatare present andwhatactionsare taken tomain- sired levelofsafety. The levelofsafetyisdeterminedatanytime agement thatallowsthemaintenanceanddevelopmentof ade- regulations. Individualoperatorsneedasystemof safety man- the respective companies. tion. Thismodelisusedtogiveaholisticandequalassessmentof A basicmodelforsafetymanagement Absencethrough illness. • Cancellations/unscheduleddowntime,and • HIL/backlog, • TECHREPs (reported bymaintenance), • PIREPs (reported byflightpersonnel), • Technical faultreports, • MELexcesses, • Technical dispensations, • Reported incidents, • This indicatesareduction inthelevelofsafetymaintenance. of TECHREPs isdecreasing whilethe rateofPIREPs isincreasing. maintenance andkeep intact.Oneexample—The thebarriers rate indicator isameasure onhowthecompanyisabletoperform The safety-related indicators an, asfarpossible,objectivepicture aviation. ofNorwegian standardize them,inorder tocompare thecompaniesandform period foreachoftheairlines,bothtocompare indicatorsand Activity levels the companies. used toexplain different trends forthesafetyindicatorsbetween cally usingtheSequentiallyTimed EventsPlotting(STEP)and Changes intheexternalframework the basisofstudy. by aviationauthorities,politicalandthemarket were investigated anddiscussedindependently. copter companies(CHCHSandNorskHelikopter), sotheywere nificant difference betweenfixed-wing airlinesandoffshore heli- aviationsector.basis forassessingtheNorwegian There isasig- Helikopter. Theselectionwasmadetoincludearepresentative Braathens, Widerøes, AirShuttle, CHCHS,andNorsk Norwegian could affectaviationsafety. organizational nature, or acombinationoftheseinwaythat nical, maintenance,operational,administrativeandpersonnel/ sider whetherthecompanyhadimplementedchangesofatech- side. Themainpurposeofthemaintenancereview wastocon- A satisfactorylevelofsafetycannotbeensured solelybysetting The followingsafetyindicatorswere definedforthestudy: The changesintheexternal frameworkconditionslaiddown The airlinecompaniesthathavebeeninvestigatedare SAS andchangesinthemhavebeensurveyedforthewhole are Each basedontheprincipleofbarriers. conditionswere illustratedgraphi- wasformedfortheinvestiga- WEDNESDAY— INTERNATIONAL DAY INTERNATIONAL WEDNESDAY—

Figure 1. The safety management model. The arrows give an indication of interaction, including how the results of one activity may be the input to another activity. model for achieving defined goals: “planperformcheckact,” on the aircrafts. All of the dispensations were within the limitations which we recognize from quality management. stated in the maintenance program. Changes over the period are different for the different companies, which may indicate that some Results from the maintenance review changes have been more comprehensive than others. Toward the Fixed-Wing end of the period, use of dispensations normalized. Activity level in the airlines Production per individual aircraft was decreasing in the first part MEL remarks of the period but is back at an equivalent level at the end of the MEL as the indicator may say something about the aircrafts’ tech- period in relation to the beginning. Contributions to the decreas- nical condition in relation to safety-critical systems and the ing trend have been stronger from certain companies. This is, in company’s ability to carry out maintenance. part, linked to acquisition of new aircrafts and decommissioning MEL contains criteria for the type of faults in systems that may of older aircraft. be significant to safety. This is a strong safety indicator, as there is reduced redundancy in the aircraft’s safety-critical technical sys- Trends in safety-related indicators tems. There was differing practice at the different companies in Reporting the way they reported and analyzed data. Some companies During the period, the investigated companies showed an in- counted the number of departures with MEL remarks while oth- creased tendency to report. All of the companies attribute this ers counted the number of remarks. Analysis is part of the reli- increased reporting to a rising awareness of the importance of ability analysis per system or per MEL overrun. reporting. All of the companies have focused on incident report- MEL is an indicator that shows both the incidence of faults in ing in the period and the increase is a result of this work. systems and the company’s ability to correct the fault. MEL is registered as a PIREP, as an MEL departure normally takes place Technical dispensations while the aircraft is operational. This is a measure of the companies’ ability to perform maintenance MEL follow-up contribution to risk management:

ISASI 2006 Proceedings • 61 ISASI 2006 PROCEEDINGS 62 related illness,evenifthisisnot thecasehere, isaregularly used Absence through illness,whichisoftensynonymouswithwork- Absence through illness cant changestotheindicator intheperiod. panies thatwere abletoprovide these costs,there were no signifi- specification ofthesecostswithin thecompanies.Atthosecom- The datafortheindicatorwasverylimitedbecauseoflack of Cost ofmaintenance outaccordingnance notcarried toplan. the variouscompaniesisbeingreduced. in thenumbersofreported HIL.Thismeansthatthebacklogat of thecompaniesinstudyshowedamainlydeclining trend collection ofHIL. study, bothinthewaytheyreport aswellthestartingtimefor faults thathavenosignificanceforaviationsafety. However, theHoldItemListcontainsalltypesoffault,including company’s abilitytocorrect detectedtechnicalfaultsquickly. The indicator“OpenHILitems”provides informationaboutthe Open HoldItemList(HILitems) level ofreporting duringthephasing-inperiod(newaircraft). sible thattheinitialhighnumberisanaturalresult ofahigher company wasatthesamelevelasothercompanies.Itispos- had alarge decrease. In2004,thenumberofTECHREPs forthis One companythathadahighinitialnumberofTECHREPs also As withPIREPs, thenumbersofTECHREPs are mainlystable. TECHREPs lent toareduction insafetymargins. that thefaultsare detectedatalaterpointintime.Thisisequiva- are detectedbyPIREPs, andfewerbyTECHREPs, this isasignal detected. Ifithappensthatanincreasing numberofincidents say somethingaboutwhere chaintheincidentsare inthebarrier and thenumberofTECHREPs wasbecausethesetwotogether One ofthereasons thatthisstudyexamined thenumberofPIREPs PIREPs stock, orreorganization ofthespare partsupplyforsomeoperators. 2004 period.Thereason forthiswasgivenaslackofspare partsin flying hour/departures, butthere are certainexceptions inthe2000- industry showsanegativedevelopmentinnumbersofMELper show aslightincrease inthenumberofMELs. Thetrend forthe cator ofwhere anacceptancecriterioncanbeset. than thetotalriskforcompany. Itcan,therefore, be anindi- which theriskofanindividualMELdeparture isaffectedmore MELdepartures thatflypastthetimelimitare adeviationin • be anindicatorofwhere anacceptancecriterioncanbeset. affected more thaneachindividual departure. Itcan,therefore, tures provides apicture inwhichthetotalriskforcompanyis the pilotformsacompensatorybarrier. ThetotalofMELdepar- departures represent anacceptableriskcontributioninwhich ure tellsustheregularity ofMELdepartures. Individually, these ThenumberofMELnotationsper1,000departures. Thisfig- • Reduction ofthebacklogshowsapositivetrend formainte- For fixed-wing companiesthathavedata onthisindicator, all There wasdifferent practiceatthevariouscompaniesin Based onthenumberofMELs,airlineswithsameaircraft • ISASI 2006 ISASI Proceedings vice” isthecause ofthisincrease. 2004. Thecompany statesthat“reorganization of thesupplyser- One ofthecompanieshada significantincrease from 2003to from maintenanceprograms andotherdefinedtechnical limits. hours. Thisindicatesthatthe companiesare careful indeviating approximately 4and7technical dispensationsper1,000flying The levelsforbothcompanies were lowthroughout, between Technical dispensations regarded asnormal. per1,000 flyinghours,whichis companies wasat10-15ASR There wasa steadylevelthroughout theperiod.Thelevelinboth Air SafetyReports ASAR Trends insafety-related indicators share ofthetwoplayershasbeenstable. mately 5%)intheperiodfrom 1999to2004, whilethemarket nental shelfhasdecreased byaround 2,100flyinghours(approxi- The totalmarket conti- forhelicopterflightsontheNorwegian Activity of change. necessary tomaintainaviationsafetythrough theactualprocesses large degree establishedtheflexible andadaptiveculture thatis panies thathavechosentooperateinthesemarkets havetoa and state-subsidizedSTOLaviationinNorway. However, thecom- gain orlossoftenders,isparticulartotheoffshore, ambulance, long-term contractsandassociatedmajorchangesinvolvedin official approvals, etc. technical personnel,acquisitionofhangarsandofficefacilities, acquisition ofhelicopters,employmentandtrainingpilots company andanequivalentupswingforthewinner, involving pany. Thisresults inareduction initsactivitiesforthelosing an operationthat,attimeofaward, isrunbythecompetingcom- other helicoptercompanieswishingtoenterthismarket. of thecontracts,althoughthere are alsotendersfrom twotothree Helikopter Service andNorskHelikopter, sofarhavesecured all full competitionconditionsinwhichthetwomainplayers,CHC tion isapproximately 6years.Eachcontractisawarded under land and/oroffshore bases.Thetypicalaveragecontractdura- award contractsof3to10years’durationforflightsoutfrom companies workinacontractmarket, inwhichoilcompanies shore continentalshelf.Thehelicopter SARontheNorwegian There are twomainplayersinmovementofpersonnelandoff- Offshore helicoptercompanies tions thatispresent insituationswhere thisissafetycritical. the employeesanddegree of loyaltytodecisionsandregula- illness astheonlyindicatortoactuallyperceived situationfor linked withthis,thefocusmustbemovedfrom absencethrough riod. Ifacompanywantstofollowupsafety-related indicators figures intheanalysisofthesecompanies. the illness.We sawbothnegativeandpositivetrends inabsence about whatishappeninginthecompaniesandcouldcause related conditionsfrom thefigures without more information and concrete indicator. Evenso,itisnotalwayseasytoread safety- This typeofcontract-orientedactivity, withlarge andrelatively It isnotunusualforoneofthecompaniestowinacontract As awhole,wecanseeabsenceasstablethroughout thepe- MEL pecially clear when the Authority was moved at the same time as For one of the operators the indicator showed a very stable and Avinor carried out/planned major changes to its organization. low level throughout the period, while the level was considerably In addition to the surroundings for all organizations becoming higher for the other. This company is the same as the above- more dynamic, surveys indicate that major organizational changes mentioned reorganization of the supply service. may have negative impact on levels of safety. Ytrehus and Østerbø (2002) state that they can document organizational changes as in- HIL direct contributory factors in several major accidents, including Only one of the companies kept statistics of the HIL items. The the Norwegian Åsta rail accident in 2000. In general, “disturbance” curve showed a relatively stable trend throughout the period, with in organizations, which often occurs during organizational changes, somewhat of an increase from 2003 to 2004. The above reorgani- will be an expression of employees’ impression that they are not zation of the supply service may be one reason for this increase. listened to and taken into account. Larsson (2005) has recently documented the connection between such conditions in the work- PIREPs ing environment and the risk of accidents. There was relatively stable levels for 2000-2002, and a decreas- Rasmussen (1997) points out that modern changes to a great ing tendency for both companies in 2003 and 2004. The level, extent concern deregulation and exposure to competition, and 100-130 PIREPs per 1,000 flying hours, is regarded as normal in that this may lead to reductions in attention to safety and the the industry. barriers that have been erected. Research around the so-called “High Reliability Organizations” (HRO) emphasize organizational TECHREPs redundancy as an important safety factor. Put simply, it means that Stable or decreasing trends for both companies. the organization contains “slack” and that this forms a barrier against accidents. Modern processes of change often involve Cost of maintenance downsizing, leading to the extent of such barriers shrinking. This Both companies had seen an increase in maintenance costs per may lead to a higher risk of accidents.

flying hour, which is equivalent to general inflation levels. The results of research around the impact of change on safety DAY INTERNATIONAL WEDNESDAY— are not unambiguous. One possible reason may be that the Absence through illness changes and deregulation lead to clearer divisions of responsi- “Company A” showed a decreasing trend throughout the period, bility and that such changes lead to some inappropriate safety although the level was relatively high, on average approximately cultures and practices being weeded out. Basically, therefore, it is 6%. The 2004 level, approximately 4.5%, is regarded as normal an open question as to what consequences the major changes on for this sort of activity. so large parts of the Norwegian aviation sector have on safety. “Company B” had a stable and very low level of absence through In order to achieve ever-improving levels of safety, the perti- illness. nent regulations are updated on a continuing basis. Initial surveillance and operator surveillance are carried out, and service is Discussion provided for the users while keeping open lines of communica- In general, it is accepted that as the degree of change increases, tion with users and the public alike. Tasks are carried out in ac- it is no longer sufficient to establish good safety management cordance with sound administrative principles, consistent with solely through routines and regulation (Hale & Baram 1998). the demands of national and international aviation legislation, When circumstances are predictable and fixed, such safety man- and in accordance with the stated needs of the users in the air agement is adequate; but when circumstances are in the process transport market. of continual change, efforts must be made to internalize employ- During the actual period, the companies have carried out orga- ees’ safety awareness. Safety cultures and safety climates, which nizational changes for adaptation to JAR-OPS 1 and JAR 145. The can be seen as latent and manifest expressions of organizations’ companies have carried out the changes to varying extents inter- degree of focus on safety, have, therefore, come steadily more in nally in existing organizations and by splitting the company into focus in modern safety management. technical and operative independent companies. The challenge The starting point for the AIB/N was not that change equiva- in relation to splitting the companies into operative and technical lent to those that have been taking place in Norwegian aviation companies lies in the new interfaces for administration and checks are ipso facto a threat to aviation safety. The study has attempted of the activities. It seems, according to the indicators, that this has to point out the necessity of holistic thinking and use of thor- been for certain companies a period of adaptation that has had an ough safety analyses in order to reveal which weaknesses the impact, but that has normalized after a short while. change(s) can lead to in different safety levels. Such analyses will normally say something about compensatory measures that Training should be put in place before the change takes place. If this is In the period, technical training has been complicated by the done, there is high likelihood that safety levels are maintained changes in the regulations. The changes in the regulations have and may even be improved through the process(es) of change. taken place quickly, which has led to a gap between skills and the There has been only a limited focus on safety in the political requirements placed on the training departments (ICAO M to processes when the CAA/N was separated from the old Civil Avia- JAR/Part 66 B1 and -2, CRM concept/human factor training, Part tion Authority and the latter changed to a state-owned company. 147/Part M approval). There has also been little focus on the fact that deregulation means It must be noted here that these are trends over a short time, increased demands on supervision and control. This became es- and that the companies, through a number of initiatives in the

ISASI 2006 Proceedings • 63 ISASI 2006 PROCEEDINGS 64 lenges andtasks theagencywillface. and capacitywill—in time—reach alevelconsistentwith thechal- realistic enoughtoensure thattheAuthority’sexpertise, resources, Civil Aviationthe newNorwegian Authorityappearscredible and decision torelocate andthemove itself. AIB/N seesit,isthatmajor challenges havegrown outofthe their owndivisions,andmuchelse).Themainreason forthis,as lished, thesplittingoffofAFISandairtrafficcontrollers into with (thetrainingofpersonnelwhenATCC Northwasestab- accepted solutionsthat,inhindsight,theyare notcomfortable In anumberofkey areas, CivilAviation Authority theNorwegian has notbeenabletosatisfactorilyfollowuponchangesand plans. has theimpression CivilAviation Authority thatthe Norwegian vice inthewake ofthedecisionto Aviation Authorityhasbeenableto maintainahighlevelofser- line companieshavebeenimpressed Civil thattheNorwegian not currently beingsatisfactorilymet.Theinformantsintheair- neously inagivenlineofbusiness.AIB/Nfeelsthatthisneedis many changesandrestructuring effortsare goingonsimulta- countries confirmthatthere isaneedforstrong supervisionwhen in anacceptablemanner. Experiencesfrom Swedenandother capable ofmonitoringandensuringthatairsafetyissafeguarded tion thatcallsforastrong, alertsupervisoryauthority, onethatis a dividingupofresponsibility. Thisisexactly thekindofsitua- rationalization, downsizing,mergers, organizational changes,and turing processes thatare criticaltosafetyare underway, suchas profitability. Partly asaconsequence,majorandpotentialrestruc- stiff competition,financialconstraints,andgreater demandsfor ing systems,thatthedegree ofreporting hasbeenimproved. through clearer requirements forreporting andaccessto report- tion, haveinitiatedanumberofpositiveprocesses andhasshown, ing cause.Thestudyshowsthatthecompanies,inthisconnec- technical systemsandaircraft typesbuthavethesameunderly- of incidents.Humanerror may, forexample, occurindifferent less overtifdirect ortriggercausesformthebasisforassessment lated totheorganization andhumanerror. Root causescan be dent escalationshave,toagreater extent, underlyingcausesre- to thesameextent before. Itistypicalofsuchchangesthatinci- and market adaptationsthatthecompany hasnotexperienced tain companieshaveundergone majororganizational changes authority andmarket regulated. Duringthestudyperiod,cer- characteristic ofstablecompanies,whichhavebeenhistorically in itsmanagementandcontrol ofactivities.Thisnormallyisa safer inthetask. unsure aboutwhattheysee.Thistrend decreased astheyfelt craft remain ontheground, ratherthanleave,whenpilotsare were introduced. works,asair- Thistellsusthatthepilotbarrier number oftechnicalcancellationsincreased whenpilotchecks though withinacceptablelimits). throughout theperiod,withoutnotificationofitincreasing (al- had aslightregular increase intheAirlineRiskIndex (ARI) the startofperiod.Oneexception iswhere onecompanyhas that thelevelatendofperiodisequalto,orbetterthan, trend inmostofthestatisticsthatare covered bythisstudy, and last partofthestudyperiod(2002-2004),havehadapositive Nevertheless, theactionplan thathasnowbeenpresented for aviationareThe commercial playersinNorwegian allfacing The industryistraditionallyreactively (event-based)oriented It canbeseenfrom thedatathathavebeencollected • ISASI 2006 ISASI Proceedings relocate. AsforAvinor, AIB/N the future seemstobefargreater than thenewtrainingcenter’s by Avinor isnotadequate. Theneedforairtrafficcontrollers in on thesurveywasverylow. ing environment canbe maintained.Thesafetyculture score based relation tothecreation of theATCC Southsothatagoodwork- safety tobecompromised. outin Betterworkshould becarried poor thatsomethingmustbedonetocorrect it,toavoidaviation controllers indicatethattheworkingenvironment atBodøisso still remains. Thequestionnaire anddiscussionswithairtraffic new ATTCs. Bodøisalready upandrunningwhileStavanger and Bodø.Theresult was thatBodøandStavangerbecamethe relations betweenStavangerandRøyken andbetweenTrondheim various partiesreturned different views,andthisledtoconflictin two outofthefourshouldremain wasyettobedecided.The and thesamefortwoATCCs Trondheim andBodø.Which aware thatthetwoATCCs Stavangerand Røyken shouldmerge in apotentialmerger, wasunsatisfactory. AllfourATCCs were in whichtheyassessedtheirowncapacitytotake overothers’jobs measures shouldbeinitiated. meetings togetherwiththeairtrafficcontrollers. Compensatory controllers anddidnot,amongotherthings,participateinCRM AFIS dutyofficersare nowsidelinedcompared with airtraffic is difficulttoseeitasapositivecontributionaviationsafety. separate divisionsseemssomewhatstrangetotheAIB/N,andit is beingtaken seriously. satory coordination measures are putinplace.Itseemsthatthis difficult tomaintainfocusonthesesafetyareas, unlesscompen- dents andincidents.Anorganizational splitcanmake itmore is currently great focuson“runway incursions”andground acci- traffic servicesunderdifferent management.Internationally, there represents acontributiontoimprovement ofaviationsafety. Avinor hasclarifiedroutes ofreporting andresponsibility and as aresult, itfeelsentitled tosubmitthistrans-sectorsafetyproposal). thority foraccidents/incidentswithinthetransportationsectorasawhole; (AIB/N isintheprocess ofbecominganindependentinvestigativeau- cies are givenanopportunitytosubmittheircommentsandviews tion hearingshouldbeconductedinwhichtheappropriate agen- about whethersafetyisatissue.Alternatively, abroad consulta- the transportationsectorwhenthere are legitimatequestions assessment ofsafetyconditionsasabasisforpoliticaldecisionsin responsible ministries,shouldconsiderincludingatotalimpact sition, thusmaintainingmarket trust. out thesupervisiontasksinasatisfactorymannerduringtran- acquire thecompetencetheyneed.Thisisnecessaryforcarrying der toensure thatnewemployees receive theexperience and transitional phasewithdoublestaffinginOsloandBodø,or- TheCivilAviation Authorityshouldconsiderextending the • part ofthosebeingmonitored. safety ramificationsinthewake ofrestructuring initiativesonthe the leastsoitcanfollowupandpickonpossiblenegative and develop/recruit personnelwiththenecessaryexpertise—not emphasis onsystem-oriented,all-round, risk-basedsupervision TheCivilAviation Authorityshouldconsiderputtinggreater • The estimatednumberofnecessary airtrafficcontrollers made The process linked togatheringreports from thefourATCCs, The decisiontohaveairtrafficcontrollers andAFISofficersin A challengeispresented byhavingairportservicesandair The changefrom aregional modeltoadivisionalat The MinistryofTransport andCommunications,other capacity. Continued safe management of air traffic depends on a tained by Avinor (RFL I and AIP) should be transferred as soon sufficient number of competent air traffic controllers. as possible to the CAA/N. The technical platform for control of Norwegian air space has, There is doubt as to whether the competence requirements set to a great extent, been developed by Avinor’s own technicians at by the CAA/N for acceptance/approval of key Avinor personnel Røyken. Unease around the localization and in the relationship are sufficient. between central administration and the employees has led to sev- Follow-up and control of the company demand more of the eral skilled technicians leaving the company, with more on their owner (the Ministry of Transport and Communications) now that way out. Management claims that new recruitment will correct Avinor has become a state-owned company. The “political man- this—this is not AIB/N’s opinion. agement” of Avinor should focus just as highly on Avinor’s soci- Training of air traffic controllers will be significantly weakened etal/safety-related duties as on the financial return. The owner if it is not possible to carry out OJT and PFO at a time when seems to have assumed that the CAA/N will cover any potential there seems to be a discrepancy between tasks and the number of weakness associated with aviation safety. air traffic controllers. Training of personnel at Bodø following The main conclusion is that a number of major and minor the merger of Trondheim ATCC and Bodø ATCC was not ac- changes have not been sufficiently assessed, individually or ho- cording to the regulations, and questions can be raised as to listically, with regard to their impact on aviation safety. When such whether there was sufficient training.(Several incident reports assessment has been carried out, there often seems to be a lack of lately supports it was not.) A repetition of this should be avoided follow-up and documentation of “closure” of the conditions and in the creation of ATCC South. results and recommendations. All of the aviation players that we Redundancy and the EMP situation, particularly associated with have investigated, including the authorities, have potential for Bodø, seem to have been inadequately studied, and there seem improvement. to be questions as to whether the intentions of the Ministry of There is nothing in the statistical material that we have stud- Transport and Communications and the CAA/N have been met. ied that indicates any reduced technical standard in the aircraft, The hasty creation of ATCC North meant that the decision or reduced maintenance quality.

was made to continue to control air traffic with outdated equip- DAY INTERNATIONAL WEDNESDAY— ment, not choosing a solution that would have provided improved Recommendations air safety. • The airlines that have been studied should consider looking The interpretation of BSL E 4-4 for staffing fire and rescue is more holistically at their initiatives, and carrying out analyses to based on an absolute minimum interpretation, and the opportu- see how concurrent changes and use of dispensations and MEL nity to allow for concurrent firefighting and rescue has not been and HIL lists affect safety. (The study has revealed that MEL is taken. The opportunity to vary airport categories in relation to not regarded as a safety reduction as long as the regulations con- planned aircraft activity allows the non-participation of all avail- cerning type and time are adhered to.) able equipment in the contingency and will, therefore, lead to a • The airlines are advised to survey cultural differences before reduction in air safety. considering association/mergers, and to integrate courses from Training and testing of fire and rescue crews has improved, the original companies in such a way that a “new” corporate cul- and those participating today are better prepared for their tasks. ture can be established in a clear way for everyone involved. This has not always been the case previously. Finally, the AIB/N would like to remind you that commercial Avinor did not allow sufficiently time for the CAA/N in the civilian aviation is an especially safe form of transport, especially Take-Off-05 project. However, the CAA/N has kept to its self-im- in our “western” part of the world and that the assessments and posed deadline of one month time for processing and decision- safety recommendations that appear in this report are intended making. There may be reason to question whether this has af- to contribute to ensuring that the major changes occurring in fected the quality of the decisions made by the CAA/N. the Norwegian aviation sector do not take place at the expense There has been a conflict between the CAA/N and Avinor, which of aviation safety. ◆ has been present since the “divorce.” The Ministry of Transport Reference and Communications has contributed to maintaining the con- AIB/N report, SL REP 35/2005 Safety in Norwegian Aviation during the flict by allowing the creation of a Avinor, which has retained some process of change (5th of Aug. 2005): www.aibn.no/default.asp?MARK_ supervisory tasks. The supervisory activities that have been re- SEARCH=YES&SEARCH_ID=1&V_ITEM_ ID=1246

ISASI 2006 Proceedings • 65 ISASI 2006 PROCEEDINGS and theGerman NationalAviation Authority (Luftfahrt Bundesamt). (Bundesanstalt fürFlugsicherung) the GermanAir Navigation Services Darmstadt. From 1980until1987,heworkedinvariouspositionsfor theUniversityofAppliedScienceinDieburg/engineering from Bonn-Bad Honnef. In1980 hegraduatedwithadegree inelectrical crash investigationattheInternational UniversityofAppliedSciences investigation ofavionicequipment. Heisalecturer forthecourseair 66 rated thelistofseriousincidentslistedinAnnex 13,Appendix C. kg are investigated.TheAirAccidentInvestigationLawincorpo- operated aircraft withamaximumtakeoff weightexceeding 2,000 cording tothislaw, seriousincidents which occurwithcommercially vides fortheinvestigationofaccidentsandseriousincidents.Ac- for example, passedtheAirAccidentInvestigationLaw, whichpro- of seriousincidents.Asaresult, theFederal Republic ofGermany, incidents toenactnationalprocedures thatincludetheinvestigation principles governingtheinvestigationofcivilaviationaccidentsand Directive 94/56/ECofMay16,1994,establishingthefundamental In 1994theEuropean memberstateswere asked through Council tions aspartoftheworkindependentinvestigationauthorities. tion ofincidentsandseriousintotheirnationalregula- ous incidents. into Annex 13,whichpavedthewayforinvestigationofseri- ing (AIG92)in1992,theterm“seriousincident”wasincluded Why investigateaccidentsbutnotincidents? regarding flightsafetyimprovement. Thejustifiedquestionarose: incidents becauseofthesuccessaccidentinvestigationshowed and flightsafetyexperts startedtodiscusstheinvestigationof tion doesnotdetermineblameorliability. investigation istheprevention offuture accidents.Theinvestiga- in usealmostallovertheworld.Thesolepurposeofaccident dardized methodsandprocedures ofaccidentinvestigationare cantly totheimprovement offlightsafetyincivilaviation.Stan- For decades,airaccidentinvestigationhascontributedsignifi- Introduction A Diversion of a Boeing B-747 Resulting A DiversionofaBoeingB-747 How canreality beassessedalmost15yearsafterAIG92?In Over theyears,manycountrieshaveincorporatedinvestiga- As aresult oftheICAOAccidentInvestigationDivisionalMeet- Already duringthe1970sand1980s,accidentinvestigators • ISASI 2006 ISASI In aSeriousLow-Fuel Situation accredited representative, adviser, oranexpertfor investigations asaninvestigator-in-charge (IIC),an several nationalandinternationalaircraft accident Flugunfalluntersuchung). Hehasparticipatedin of Aircraft Accidents Investigation(Bundesstellefür accident investigatorfortheGermanFederal Bureau Johann Reuss Proceedings By Dipl.Ing.JohannReuss, BundesstellefürFlugunfalluntersuchung Incident Investigation: hasbeenworkingsince1987asan (German Federal Bureau ofAircraft AccidentsInvestigation) relevant forflightsafetyandmayhavecomplex causes. seriousincidentscausedbyalow-fuel situationare extremely • improvement offlightsafety, and dent investigationauthoritycanprovide valuableinsightsforthe theinvestigation ofaseriousincidentthrough anindepen- • that Resulting inaseriouslow-fuelBoeing B-747 Situation” shallshow for accidentinvestigatorsandflightsafetyexperts. Accidents—Breaking theChain” describesthe current challenge almost impossible. spend asmuchtimeandeffortonthiskindofinvestigationis tion ofanaccidentwithafataloutcome.Itisequallyclearthatto incident cancontributeasmuchtoflightsafetytheinvestiga- investigated. not allincidentsthatshouldbedefinedasseriousare airlines investigateincidentsandseriousincidents.Nevertheless, investigation authority. Eventheflightsafetydepartmentsofmany some countries,seriousincidentsare treated like accidentsbythe riorated andthat there were thunderstormsandheavyrain. that weatherconditionsatFrankfurt Airporthadsuddenly dete- from crews crew ofotheraircraft tothefact alertedtheB-747 enter aholdingpattern. from Frankfurt, theairtrafficcontroller instructedthecrew to with informationthatCAVOK conditionsexisted. About35nm furt automaticterminalinformationserviceprovided thecrew 747 commenceddescentintoFrankfurt at03:00UTC.TheFrank- isted, withnosignificantchangesexpected. Thecrew oftheB- the crew includedtheinformation thatCAVOK conditionsex- Frankfurt was03:19UTConJuly28,2005. parted Singapore onJuly27,2005,at15:21 UTC. TheETA for quirement toplanforanalternateairport.TheBoeing747de- andthereconditions attheestimatedtimeofarrival, wasnore- the terminalaerodrome forecast forFrankfurt indicatedCAVOK sengers onboard. At thetimeofflightplanninginSingapore, Singapore toFrankfurt with4pilots,14cabincrew, and378pas- wasonascheduledpassengerflight from A BoeingB-747 offlight History Example The presentation “IncidentInvestigation:ADiversionofa 2006seminarinCancun“Incidents to The mottooftheISASI It isverycleartoanyonethattheinvestigationofaserious The crew electedtodivertMunich where landed. the B-747 wasintheholdingpattern,radiotransmissions As theB-747 The 02:20UTCFrankfurt routine weather report obtained by The reserve fuel remaining aboard the B-747 was less than the operator’s Civil Aviation Safety Authority (CASA) of Australia- approved fuel policy permitted. Fuel remaining was 3.5 t (total) and 4.3 t (FMC calc).

Investigation

Notification The incident was reported by Munich Airport with the following wording: • The crew decided to divert to Munich due to a delay because of a thunderstorm at the destination airport Frankfurt/Main. About 10 hours later, the TSB of Australia sent a notification: • We have been advised by the Australian operator of an incident involving a B-747 in diverting from Frankfurt to Munich due to unforecast thunderstorms resulting in a serious low-fuel situation. The facts contained in the report from Munich Airport did not meet the BFU’s criteria for an investigation into the incident. Figure 1. Flightpath of the B-747. The additional information “unforecast thunderstorms” and “serious low-fuel situation” provided by the TSB of Australia prompted the BFU to initiate an investigation. 04:01 UTC: ARR: Request POB and DG

Cooperation with the TSB 04:03 UTC: Transfer to MUC Director 118.42

At the beginning of the investigation, the B-747 had already gone DAY INTERNATIONAL WEDNESDAY— back to Australia and that meant that neither the crew nor FDR 04:07 UTC: DIR: B-747 on requested HDG clear to ILS 08L or CVR data were available. The B-747 crew was interviewed by an accident investigator of 04:08 UTC: Transfer to MUC TWR 118.7 the TSB of Australia. The BFU secured and evaluated all data from the responsible ATC provider. 04:09 UTC: TWR: clear to land The following actual flight status was reconstructed based on the evaluated data: 04:10 UTC: Landing in MUC 03:18 UTC: B-747 reports to Langen Radar NR 4: Cleared GEDERN FL 110 At 04:10 UTC the aircraft landed in Munich. Nobody was injured, and the aircraft was not damaged. Fuel remaining was 3.5 03:24 UTC: Radar NR 4: Fly one holding pattern overhead t (total) and 4.3 t (FMC calc). GEDERN, reduce speed During the interview, the crew made some remarks that could be of significance to the assessment of the incident. 03:28 UTC: Transfer to Frankfurt Arrival • The weather information was not up-to-date. • Other air crews and ATC controllers were talking in German 03:34 UTC: B-747: Frankfurt, can you update the weather of the on the radio frequencies. field; • The alternate airport Cologne-Bonn was not acceptable due TR 1: I’ll call you back to the prevailing weather. • After “PAN PAN” was used, ATC did not provide any prefer- 03:37 UTC: B-747: B-747 fuel critical, we require immediate ential treatment. deviation to Munich • The support provided by ATC during the approach to Munich was good. 03:37 UTC: TR 1: for your info: Nobody approaching here because of the weather Weather situation All relevant weather data available to the crew for their flight 03:41 UTC: Transfer to Langen Radar OR 1 planning were secured during the investigation into the serious incident. The written documentation of the prevailing weather 03:51 UTC: Transfer to Munich Radar at the time of the incident was also secured. During their flight planning in Singapore, the following TAFs 03:52 UTC: B-747: Pan Pan: Fuel critical direct to OM 08L and actuals of the destination airport were available to the crew: • TAF EDDF 280000Z 280110 17005KT CAVOK 03:56 UTC: B-747: Require priority and still clearance 08L OM • TAF EDDF 280300Z 2 NR I: Confirmed and priority is copied • METAR EDDF 280220Z 01005KT CAVOK 21/19 Q 1010 NOSIG= 80413 20008KT CAVOK 03:59 UTC: Transfer to MUC Arrival 128.02 • METAR EDDF 280250Z 3504KT CAVOK 21/19 Q 1011 NOSIG=

ISASI 2006 Proceedings • 67 ISASI 2006 PROCEEDINGS 68 safely accomplishable. Afurtherdelayduring theapproach to of 3.5tago-around atMunichAirport would nothavebeen quantity required bytheoperator. With aremaining fuel quantity landinginMunich, thefuelremainingAfter wasbelowthefuel Analysis lia-approved fuelpolicy. ofAustra- the operator’sCivilAviation SafetyAuthority(CASA) The fuelupliftfortheflighttoFrankfurt wasinaccordance with Fuel planning tween 04:15UTCand04:4535approaches were possible. UTC and04:15UTC,approaches were notpossible atall.Be- Airport hadtobereduced duetothunderstorms.Between03:55 that between03:15UTCand03:55approaches toFrankfurt The ATC provider DFS(GermanAir NavigationService)stated Air trafficcontrol holding area GEDERN(about100kmnortheastofFrankfurt). cal officeFrankfurt showedsignificantthunderstormactivitiesinthe weather. The landingweatherforecast (TREND)reported nosignificant directions. Meanwindspeedswere almost10kt(03:20UTC). 03:20 UTCand04:20UTC,surfacewindcamefrom changing 10 kmandthecloudbase(SCTCB)in4,000ftAGL.Between light rain(-TSRA). Horizontalground visibilitywasmore than logical officeFrankfurt (EDDF)reported thunderstormswith Frankfurt Airportwasratherlow. At03:20UTCthemeteoro- thunderstorm cellswhosemeteorological activityinthearea of the prevailing sky coverincorporatedindividualshowersand Service) meteorological officeatFrankfurt Airportstatedthat -NOSIG -1011 -21/19 -TS FEW040CBSCT090BKN280 -33005kt WIND18:30004G08KT/260V340 9999 -ILS 25L -ATIS 1915CTR:VMC EDDFCSPECI280305SR:0350SS: ATIS July2803:09:05: -Lightning TSSWPART -NOSIG -1011 -CAVOK -35004kt WIND18:31003G04KT/270V340 -ILS 25L -ATIS EDDFCMETAR 1915CTR:VMC 280250SR:0350SS: ATIS July2803:00:12: ing weatherinformation: their approach toFrankfurt Airport.ATIS broadcast the follow- SCT040CB SCT090BKN28021/19Q1012BECMGNSW= METAR EDDF280320Z26009KT 240V3009999–TSRA • At 03:30UTCand03:45radarimagesofthemeteorologi- The weatherreport oftheDWD’s (GermanMeteorological crew wasabletolistenATISThe B-747 Frankfurt during • ISASI 2006 ISASI Proceedings nificantly worseintheholdingarea GEDERN. ing area GEDERNwasmore than40nm.Theweatherwassig- its vicinity. ThedistancebetweenFrankfurt Airport and thehold- drome and,forcertainspecifiedpresent weatherphenomena,in information shouldberepresentative ofconditions attheaero- Annex 3statesthatforMETAR andSPECI,the present weather to theprevailing weatherinthedirect vicinityoftheairport.ICAO did notlistentothatoneanymore. tivities (TSFEW040CBSCT090BKN280).Thecrew, however, Only theATIS broadcast afterthatreported thunderstormac- the lastATIS broadcast, whichthecrew listento,reported CAVOK. have madeanapproach toFrankfurt Airportimpossible.Even tain anyinformationonspecialweatherconditionsthatwould about theseweatheractivitiesviaradiocommunication. holding area GEDERNtalked amongthemselvesandwithATC intheholdingareaoccurring GEDERN. Otheraircraft inthe airport wasperfectlyavailablefortakeoffs andlandings. more than10 kmandacloudbase(SCTCB)in4,000ft,the which showedthunderstormswithlightrain,ground visibilityof According tothereport ofthemeteorological officeFrankfurt, activity inthedirect vicinityofFrankfurt Airportwasratherlow. GAMET andAIRMET. derstorms orcumulonimbuscloudswhichwere issuedthrough Greater Frankfurt hadweatherconditionswithindividualthun- Weather situationandtransmissionofprevailingweather the holdingarea attheentry ofGermanairspace.Anearly deci- for thatmatter) ofthecurrent weatherintheapproach zoneand the controllers crew (andothers couldhaveinformedtheB-747 tion butnotoftheparticularsituation intheapproach zone. briefing hadinformedthecontrollers ofthegeneralweathersitua- furt AirportbutnotattheATC controllers’ workstations.A weather ation intheholdingarea GEDERN. in Germany. Thisradarimageclearlydepictedtheweathersitu- The DWD usesweatherradartoobserveandrecord theweather Communication which were mostlyheldinGerman. cells andexcerpts ofothercrews’ radiocommunicationswithATC, furt ontheironboard weatherradar, whichshowedthunderstorm expect CAVOK conditions. cast weatherinformation(TAF, METAR, ATIS), thecrew could the terminalarea ofFrankfurt Airport.According tothebroad- weather radar. equally duetotheweathersituationindicatedbyonboard to theflightplanning,wasnotconsidered tobeanalternative foreseeable. Thealternateairport(Cologne-Bonn), according furt duetotheweathersituationbecausealandingdelaywas creased consumptionwasaresult ofthelongerflightpath. Munich couldalsohaveresulted inacriticalsituation.Thein- The weathersituationissuedthrough METARs corresponded TAFs andMETARs crew availabletotheB-747 didnotcon- Distinctive weatheractivities(thunderstorms)were, however, Between 03:20UTCand04:20UTC,theeffectofweather Had theATC workstationsbeen equipped withweatherradar, The radarimagewasavailabletotheweatherinformationatFrank- The crew basedtheirdecisiontoaborttheapproach toFrank- crew wasnotinformedoftheprevailingThe B-747 weatherin The crew decidedtoaborttheinitiatedapproach toFrank- Crew decision The B-747 crew was under pressure to come up with a decision. The crew had gathered information of the difficult weather situation and the possibly resulting delays shortly before they decided to divert to Munich. The B-747 crew could have reached the alternate airport Cologne-Bonn faster but the thunderstorm cells indicated on the onboard weather radar and the altogether unclear weather situation justified the crew’s decision. Any distance to Nuremberg, Stuttgart, or Hanover airports would have been shorter, and the prevailing weather at the respective destination would have permitted a landing.

Conclusions The investigation of this incident shows that • a low-fuel situation may arise in spite of the adherence to the required fuel policy, Figure 2. TMA Frankfurt. • the reasons for a low-fuel situation can be very complex, sion to divert to Munich Airport could have saved about 60 min- • the pressure to come up with a decision can be very high in a

utes’ flight time. Without a weather radar image, the controllers low-fuel situation, DAY INTERNATIONAL WEDNESDAY— depended on weather information coming from flight crews via • the weather information must be up-to-date, radio communication. This communication did take place but • by definition, TAFs, METARs, and SPECIs report weather in- mostly in German. The result was that the B-747 crew was not formation of airports and certain specified present weather phe- able to gather all up-to-date weather information. nomena in their vicinity, • enroute and approach weather information must be transmit- ATC support ted to flight crews, The workload for Langen Radar’s controllers of the respective • ATC support with up-to-date weather information can be crucial, sectors was high because of the approach delays for Frankfurt • an exchange of weather information between aircraft in the Airport. same airspace and between aircraft and ATC can be important, The controllers did not give any weather information to the B- and 747 crew. The B-747 crew asked ATC for weather information • radio communications should be in English. shortly before they decided to divert to Munich. ATC’s answer Moreover, this case shows that was, “I’ll call you back.” The crew decided to divert to Munich • the investigation of a serious incident can provide vital infor- before they received an answer to their request. mation for flight safety, The B-747 crew used “PAN PAN” after their decision to divert • the investigation of a serious incident can be time consuming, to Munich and not “MAYDAY MAYDAY.” By definition, “PAN and PAN” indicates that the crew has an urgent message to transmit • an investigation done by an operator can only be incompre- but is not in an emergency situation and, therefore, ATC does hensive because, for example, access to data from ATC or other not have to give them priority. involved organizations is limited. ◆

ISASI 2006 Proceedings • 69 ISASI 2006 PROCEEDINGS 70 [email protected]. (Nophotoavailable.) and Aerospace Safety editor inchief(withHelenMuir) ofthe and Cognition,Technology, andWork (Springer-Verlag). Heisalsoco- boards oftheInternational JournalofAppliedAviation Studies(FAA) the BritishArmyDivisionof Aviation. Donsitsontheeditorial aircraft accidentinvestigator (specializinginhumanfactors)oncallto Safety Group andoftheDefenseHumanFactors Group. Hewasan engineering. Heisdirector ofthe FlightDeckDesignandAviation Dr. DonHarris [email protected]. with theEuropean AssociationofAviation Psychology. Contacte-mail: tual proof forhardware failures thanforhumanfailure. Therole In accidentinvestigation,itiseasiertoidentifythecausewithfac- Introduction dial safetyactionsforbreaking thechainofaccidents. investigations andfortargeting potentiallycost-effectivereme- that theHFACS frameworkisausefultoolforguidingaccident targeting theseareas. Furthermore, thisstudyalsodemonstrates ment”). Thegreatest gainsinsafetybenefitcouldbeachievedby cess,” “inadequatesupervision,”and“crew resource manage- “organizational influences”(forexample, “organizational pro- the strongest andgreatest numberofsignificantassociationswith for remedial safetyactionsshouldbeaimedintheareas thatshare ing onthecategoriesathigherlevelsofHFACS. Specifictargets dents. Suggestionsare madeaboutinterventionstrategiesfocus- levels intheorganization result inoperationalerrors andacci- upon empiricalevidence,ofhowactionsanddecisionsathigher and Shappell(2003).Thisstudyprovides anunderstanding,based sification System(HFACS) frameworkdescribedbyWiegmann tween 1978and2002usingtheHumanFactors AnalysisandClas- This research analyzed523accidentsintheROC.AirForce be- Abstract Analysis ofAccident CausalFactors by • ISASI 2006 ISASI Breaking theChain:AnEmpirical By Wen-Chin Department ofHumanFactors, LiandDonHarris, SchoolofEngineering, Classification System(HFACS) iswithCranfieldUniversityinhumanfactors (MErgS.) andanaviationhumanfactorsspecialist registered memberoftheErgonomics Society Cranfield University, United Kingdom.Heisa Ph.D. research intheDepartmentofHumanFactors, China, andiscurrently onsabbaticalundertaking Training Division,AirForce Academy, Republic of Wen-Chin Li Proceedings Human Factors Analysisand (publishedbyAshgate). Contacte-mail: isalieutenantcolonelintheAviation Journal HumanFactors Cranfield University, UnitedKingdom spawned inthe uppermanagementlevelsof theorganization. As factors tobreach thesystem’s defenses.Theselatentfailures are for alongtimeandare onlytriggered whencombinedwithother cies ormis-specificationsthat mightliedormantwithinasystem plex systems,andlatentfailures are characterized asinadequa- associated withtheperformance offront-line operatorsincom- systemwide modelofhuman error inwhichactivefailures are human factorsaspectsofaccidents.ItisbasedonReason’s (1990) oped forU.S.militaryaviationasatooltheanalysis of the a basisforthecurrent work. (2003) isthemostcommonlyusedandoneherein as tion System(HFACS) developedbyWiegmann andShappell and Baker 2000).TheHumanFactors AnalysisandClassifica- the years(e.g.,Diehl1989,Harle1995,Hollnagel1998,Hunter works, taxonomies and analysisstrategieshavebeendevisedover dents. Asaresult, manyhumanfactorsaccidentanalysisframe- has playedaproportionately increasing role inthecauseofacci- craft havebecomeincreasingly more reliable, humanperformance result ofpoorpilotjudgment(Trollip andJensen,1991).Asair- 80% ofcasesandthatmore thanhalfoftheseaccidentsare the pilots are assessedasbeingthecauseofaccidentsinmore than are theweaklinkinaviationsafetychain.Ingeneralaviation, now suggestedthathumans,primarilytheaircraft pilotandcrew, logical advances,aircraft accidentscontinuetohappen,anditis for breaking thechainleadingtoaccidents. situations inorder todeveloptheeffectiveprevention strategies may beidentifiedthatthenappliedtoindividualcrews or correlating informationacross anumberofaccidents,predictors standing ofthesurrounding circumstances. Byexamining and tion associatedwithhumanerrors andtogainacompleteunder- and make adetailedexamination ofthelarge amountsofinforma- that therole ofpsychologistswhoinvestigateaccidentsistocollect accidents are inevitable(Diehl1989).Feggetter (1991)suggested the performanceofequipment,crewman, orbothuntil ciated withachainofevents—aseriesproblems thatdegrade dents, especiallythoseinvolvinghumanerrors, normallyare asso- tribution inthesequenceofeventsleadinguptoanaccident.Acci- their nature andthe underlying causalfactorsofthehumancon- analyzing humanerrors, eachbasedondifferent assumptionsabout debate. There are anumberofperspectivesfordescribingand of humanerror inaircraft accidentsisatopicofmuchscientific HFACS isagenerichumanerror frameworkoriginallydevel- Helmreich (1994)suggestedthatdespiteimpressive techno- assumed to affect the next downward level in the HFACS framework (see Figure 1). • Level 1—“Unsafe acts of operators”: This level is where the majority of causes of accidents are focused. Such causes can be classified into the two basic categories of errors and violations. • Level 2—“Preconditions for unsafe acts”: This level addresses the latent failures within the causal sequence of events as well as more obvious active failures. It also describes the context of substandard conditions of operators and the substandard practices they adopt. • Level 3—“Unsafe supervision”: This level traces the causal chain of events producing unsafe acts up to the front- line supervisors. • Level 4—“Organizational influences”: This level encompasses the most elusive of these latent failures—fallible decisions of upper-level management, which directly affect supervisory prac-

tices, as well as the conditions and ac- DAY INTERNATIONAL WEDNESDAY— tions of front-line operators. Wiegmann and Shappell (2001a) reported that the framework as a whole had an inter-rater reliability figure (using Cohen’s Kappa) of 0.71, indicating substantial agreement; however, no figures were reported for the individual HFACS categories. Li and Harris (2005) conducted further research and found the inter-rater reliabilities for the individual categories in the HFACS framework (as- Figure 1. The HFACS framework—each upper level would affect a downward level, sessed using Cohen’s Kappa) ranged be- proposed by Wiegmann and Shappell (2003). tween 0.440 and 0.826, a range of values spanning between moderate agreement Reason (1997) noted, complex systems are designed, operated, and substantial agreement. Fourteen HFACS categories exceeded a maintained, and managed by human beings, so it is not surpris- Kappa of 0.60, which indicates substantial agreement. Four catego- ing that human decisions and actions are implicated in all orga- ries had Kappa values between 0.40 and 0.59, indicating only mod- nizational accidents. Reason’s model revolutionized the manner erate levels of agreement (Landis and Koch 1977). in which the role of human error in aviation accidents was viewed, Maurino, Reason, Johnston, and Lee (1995) suggested that it but it did not provide a detailed method for the analysis of avia- is important to understand how decisions made by people at the tion accidents and mishaps. However, Wiegmann and Shappell sharp end (in this case, pilot) are influenced by the actions of the developed the HFACS to fulfill such a need. The development of people at the blunt end of their operating worlds, the higher HFACS is described in a series of books and papers (e.g., Shappell levels in their organizations. However, there is little empirical and Wiegmann 2001, 2003, and 2004, and Wiegmann and work formally describing the hypothesized relationship between Shappell 1997, 2001a, 2001b, 2001c, and 2003). Wiegmann and organizational structures, psychological precursors of accidents, Shappell (2001b) suggest that the HFACS framework bridges the and the actual errors committed by pilots. This research investi- gap between theory and practice by providing safety profession- gated 523 accidents in the ROC Air Force occurring between als with a theoretically based tool for identifying and classifying 1978 and 2002 through the application of the HFACS. The ob- human errors. The tool focuses on both latent and active failures jective was to provide probabilities for the co-occurrence of cat- and their interrelationships, and it facilitates the identification of egories across adjacent levels of the HFACS to establish how fac- the underlying causes of human error. However, as aviation acci- tors in the upper (organizational) levels in the framework affect dents are often the result of a number of causes, the challenge for categories in lower (operational) levels. Once the significant paths accident investigators is how best to identify and mitigate the in the framework have been identified, the development of acci- causal sequence of events leading up to an accident. dent intervention strategies should proceed more rapidly and HFACS examines human error at four levels. Each higher level is effectively for breaking the chain leading to accidents.

ISASI 2006 Proceedings • 71 ISASI 2006 PROCEEDINGS and lowerlevelsoftheHFACS were used.Asthe statistical strength ofassociationbetweenthecategoriesinhigher designated asbeing dependentuponthecategories attheimme- directional statistic.Thelower-levelcategoriesin the HFACS were Goodman andKruskall’slambda hastheadvantageofbeinga used tocalculatetheproportional reduction inerror (PRE). analyses usingGoodmanand Kruskall’slambda( test ofassociationtheseanalyses were supplementedwithfurther 72 Chi-square ( Statistical analysis accident. each HFACS categorywascounted amaximumofonlyonceper report. To avoidover-representation from anysingleaccident, sence ofeachHFACS categorywasassessedineachnarrative accurate understandingofitscategories.Thepresence orab- gether for10hourstoensure thattheyachievedadetailedand vestigators were trainedontheuseofHFACS frameworkto- tors, aninstructorpilotandaviationpsychologist.Thesein- Each accidentreport wascodedindependentlybytwoinvestiga- Coding process HFACS isdescribeddiagrammaticallyinFigure 1. agement,” “organizational climate,”and“organizational process.” influences” andcomprisesofthesubcategories“resource man- tion.” ThefourthandhighestlevelofHFACS is“organizational tion,” “failure tocorrect knownproblem,” and“supervisoryviola- includes “inadequatesupervision,”“plannedinappropriate opera- vironment.” Thethird levelofHFACS is“unsafesupervision,”which sonal readiness,” “physicalenvironment,” and“technologicalen- “physical/mental limitations,”“crew resource management,”“per- categories: “adversementalstates,”physiological cerns “preconditions forunsafeacts,”whichhassevenfurthersub- ceptual errors,” and“violations.”ThesecondlevelofHFACS con- four subcategoriesof“decisionerrors,” “skill-basederrors,” “per- acts ofoperators”thatcanleadtoanaccident.Thiscomprises HFACS categorizeseventsunderthegeneralheadingof“unsafe Wiegmann andShappell(2003).Thefirst(operational)levelof This studyusedtheversionofHFACS frameworkdescribedin Classification framework accident prevention. causal factorsoftheaccidentandcontainsrecommendations for tigation bytheengineeringteams.Thefinalreport detailsthe control. Thewreckage oftheaircraft isthenrecovered forinves- information, andtransmissionstofrom tacticalairtraffic and post-impactinformation,meteorological information,radar formation, missionandflightdetails,historyofflight,impact tion details,pilots’information,personnelinvolved,aircraft in- further analysisincludingtheaccidentclassification,identifica- investigation. Theinitialstagecollectsrelevant informationfor tor-in-charge followsastandard procedure forconductingthe 25-year period.For eachaccident,the24-houron-callinvestiga- duringthis The datasetcomprisedof523accidentsoccurring intheROCAirForcedents occurring between1978and2002. The datawere derivedfrom descriptionsofacci- thenarrative Data Method • ISASI 2006 ISASI χ 2 ) analysesofthecross-tabulations tomeasure the Proceedings χ 2 testisasimple λ ), whichwas category forall523accidents. Table 1.Frequency andpercentage countsforeachHFACS supervision,” “planned inappropriate operations,”“failed tocor- associated with allfoursupervisoryfactorsat Level3:“inadequate ries atadjacentlevels.“Organizational process” wassignificantly there were eightpairsofsignificantassociations betweencatego- “unsafe supervision” foundthatoutofapossible 12relationships HFACS Level4“organizational influences”andHFACS Level3 ological state”(Level2)failedtoachievedoublefigures. (Level 4);“supervisoryviolation” (Level3)and“adversephysi- ally lowcounts.Onlythecategoriesof“organizational climate” 264 (15%)ofinstances.Relatively fewcategorieshadexception- influences” levelintheHFACS modelwasinvolvedasafactorin was involvedin221(12.5%)ofinstances,andthe“organizational factor in552(31.3%)ofinstances;the“unsafesupervision” level instances, the“preconditions forunsafeacts”levelwasasacausal of “unsafeactsoperators”were involvedin725(41.1%)of the HFACS framework.Initialresults foundthatactsatthelevel accidents, 1,762instancesofhumanerror were recorded within in theanalysisof523accidentsisgivenTable 1.Inthese The frequency ofoccurrence theindividualcausalfactorscoded Results affect higherlevels. theoretical standpoint,lowerlevelsintheHFACS cannotadversely ingful whenassociatedwithanon-zero valueforlambda.From a are anasymmetricmeasure, theyare onlyreally theoretically mean- in anothercategory. However, itmustbenotedthatasoddsratios egory beingassociatedconcomitantlywiththepresence ofafactor hood ofthepresence ofacontributoryfactorinoneHFACS cat- tios were alsocalculated,whichprovided anestimateofthelikeli- simple testofco-occurrence between categories.Finally, oddsra- organizational levels,thusgoingbeyondwhatmaybedeemeda the HFACS beingdeemedtoinfluence(cause)changesatthelower indicates thestrength oftherelationship, withthehigherlevelsin theoretical assumptionsunderlyingHFACS. Thevalueforlambda diately higherlevelintheframework,whichiscongruentwith Analysis ofthestrength ofassociationbetweencategoriesat ns: not significant ns: not significant nc: not computed due to a zero frequency in one cell of the contingency table nc: not computed due to a zero frequency in one cell of the contingency table Table 3. Chi-square test of association and Goodman and Table 2. Chi-square test of association and Goodman and Kruskall’s lambda and odds ratios summarizing significant Kruskall’s lambda and odds ratios summarizing significant associations between categories at the level of “unsafe supervi- associations between categories at the level of “organizational sion” and “precondition for unsafe acts.” influences” and “unsafe supervision.” rect a known problem,” and “supervisory violations.” “Organiza-

tional climate” was significantly associated with “inadequate su- DAY INTERNATIONAL WEDNESDAY— pervision,” “failed to correct a known problem,” and “supervisory violations.” “Resource management” was significantly associated with only one category at Level 3, “inadequate supervision.” Further examination of the directional PRE showed two significant associations between categories at Level 4 and Level 3; “organizational climate” with “inadequate supervision” and “organizational process” with “inadequate supervision.” It should be noted, though, that only four instances were observed in which “organizational climate” was implicated as a contributory factor. As a result, any associations involving this category should be treated with extreme caution. The association between “organizational process” with “inadequate supervision” also had a high odds ratio, suggesting that poor supervisory practices were more than 13 times more likely to occur when associated with poor higher level managerial processes in the air force. These statistically significant relationships are summarized in Table 2 and are described diagrammatically in Figure 2. Analysis of the strength of association between categories at HFACS Level 3 “unsafe supervision” and HFACS Level 2 “pre- ns: not significant conditions for unsafe acts” showed that out of a total number of nc: not computed due to a zero frequency in one cell of the contingency table 28 possible comparisons, a further eight pairs of significant asso- Table 4. Chi-square test of association and Goodman and ciations between categories at adjacent levels were found. “Inad- Kruskall’s lambda and odds ratios summarizing significant equate supervision” showed significant statistical associations with associations between categories at the level of “precondition for five categories, “adverse mental states,” “physical/mental limita- unsafe acts” and “unsafe acts of operators.” tions,” “crew resource management,” “personal readiness,” and “physical environment.” “Planned inappropriate operations” had pervisory practices were almost 13 times more likely to subse- significant relationships with two Level 2 categories, “adverse quently result in poor CRM. mental states” and “crew resource management.” “Failed to cor- Analysis of the strength of association between categories at rect a known problem” was significantly associated with the lower- HFACS Level 2 “preconditions for unsafe acts” and HFACS Level level category of “adverse mental states.” These significant asso- 1 “unsafe acts of operators” showed a further 16 pairs of signifi- ciations are summarized in Table 3 and in Figure 2. Further ex- cant associations out of a possible 28. The Level 2 category of amination of the directional PRE found that there was a significant “adverse mental states” exhibited significant statistical associa- association between the Level 3 and Level 2 categories of “inad- tions with four Level 1 categories, “decision errors,” “skill-based equate supervision” and “crew resource management.” This re- errors,” “perceptual errors,” and “violations.” “Crew resource lationship also had a high odds ratio, suggesting that poor su- management” was also associated with four lower-level catego-

ISASI 2006 Proceedings • 73 ISASI 2006 PROCEEDINGS 74 tained. Reason (1990 and 1997)hassuggestedthat there isa“many the results ofthestatistical analysesandthepatternofresults ob- occurrence in thedataset,whichallowsreasonable confidence in majority ofHFACS categorieshadlarge numbers ofinstances It canbeseenfrom the datapresented inTable 1thatthevast Discussion performance atthelowerlevels. categories wasassociatedwithmuchincreased likelihood ofpoor gesting thatinadequateperformanceinthehigherlevelHFACS nificant associationswere associatedwithhighoddsratios,sug- 4 andare describeddiagrammaticallyinFigure 2.Allthesesig- These significantstatisticalrelationships are summarizedinTable with thecategoriesof“decisionerrors” and“skill-basederrors.” cision errors” and“skill-basederrors,” and“personalreadiness” and “skill-basederrors,” “crew resource management”with“de- based errors,” “physical/mentallimitations”with“decisionerrors” were “adverse mentalstates”with“decisionerrors” and“skill- cant associationsbetweenLevel2and1categories.These tion ofthedirectional PREfoundthatthere were eightsignifi- with “decisionerrors” and“skill-basederrors.” Further examina- “perceptual errors.” Finally, “personalreadiness” wasassociated Level 1categories,“decisionerrors,” “skill-basederrors,” and environment” wasalsostatisticallyassociatedwithafurtherthree “skill-based errors,” and“perceptual errors.” The“technology tations” wasassociatedwiththree categories,“decisionerrors,” rors,” “perceptual errors,” and“violations.”“Physical/mentallimi- ries intheHFACS framework,“decisionerrors,” “skill-baseder- categories MeansChi-square significantMeansbothchi-square andlambdasi using chi-square ( Figure 2.Paths betweencategoriesatthefourlevelsinHFACS frameworkshowingthesignificantassociations • ISASI 2006 ISASI Proceedings χ χ χ χ χ 2) andlambda( λ λ λ λ λ ). Meansthecategoryhasnosignificantassociationwithdownward level present inallsystems andthattheyare aninevitable partoforga- and culture. Reason (1990)proposed thatlatentconditionsare ating procedures, andindirectly through theorganization’s norms zation influencesdecisionsdirectly bystipulatingstandard oper- making occursinanorganizational context andthattheorgani- gruent withtheunderpinning theory. work were dependentuponthehigher-levelcategories,asiscon- assumed thatthecategoriesinlowerlevelsofHFACS frame- tion isaccompaniedbyasignificantvalueforlambdacan itbe noted thatonlyinthosecaseswhere asignificant terpreted outsidetheaccidentcausalsequence.Itshouldalsobe tionships betweenHFACS levelsandcategoriesshouldnotbein- operations thathavenotresulted inanaccident.Thus,therela- within thevariousHFACS categorieshaveoccurred inday-to-day accidents. Itisunknown(andunknowable)howofteninstances more, thefrequency countswithincategorieswere allderivedfrom categories (notedearlier)thefrequency countsare small.Further- ing thestatisticalrelationships presented withinHFACS. Inafew Figure 2).However, somecare needstobetaken wheninterpret- factors, andtheerrors committedbypilots(seeTables 2-4and tors athigherorganizational levels,thepsychologicalcontributory There are statisticallysignificantassociationsbetweencausalfac- and Shappell(2003)goessomewaytosupportingthisassertion. research, usingtheHFACS frameworkdeveloped byWiegmann actual errors willoccurasaresult ofwhichpreconditions. This and theactualerrors themselves,makingitdifficultto predict which to one”mappingofthepsychologicalprecursors ofunsafeacts Orasanu andConnolly(1993) havesuggestedthatdecision- gnificant χ 2 testofassocia- nizational life. For example, resources are normally distributed level categories suggesting that a completely different mecha- unequally in organizations. The original decision on how to allo- nism is at play here to cause such failures (see Figure 2). cate resources may have been based on sound commercial argu- Some aspects, however, are almost out of the control of even ments, but such inequities may create reliability or safety prob- the higher levels of the organization. It is interesting to note that lems for someone somewhere in the system at some later point. the Level 2 category of the “technological environment” (which This analysis showed that at HFACS Level 4, “organizational in- is essentially concerned with such factors as the quality of cockpit fluences,” all the categories had some association with causal fac- interfaces) is not at all influenced by the higher managerial lev- tors at Level 3 (“unsafe supervision”). However, the category of els. However, it has a significant association with several HFACS “organizational process” is the key factor at this highest organi- Level 1 categories. This is probably a result of the higher levels in zational level. Poor “organizational processes” were associated the ROC Air Force chain of command having little or no influ- with inadequacies in all categories at the level of “unsafe supervi- ence on the cockpit design of their aircraft. Indeed, it is often the sion” and hence indirectly were ultimately at the root of many case in the military that those responsible for the design and/or operational errors resulting in accidents. Well-developed “orga- procurement of large pieces of equipment are in entirely differ- nizational processes” that are consistently adhered to are key to ent organizations to the operators of these systems. Those re- all safety management systems. The commitment to safety must sponsible for the technology environment are not actually in the come from the very highest levels of the organization if it is to be same management hierarchy as the people using it. successful in this respect (Reason 1997). Both Reason (1990) and It will be noted from the results presented in tables 2-4 (and in Wiegmann and Shappell (2003) hypothesized that inappropri- Figure 2) that even though there were a considerable number of ate decision-making by upper-level management can adversely statistically significant associations between HFACS categories at influence the personnel and practices at the supervisory level, adjacent organizational levels, there were relatively few “causal” which in turn affects the psychological preconditions and hence relationships, where the lower-level categories were statistically the subsequent actions of the front-line operators. This study dependent upon higher-level categories. This may lead to the provides statistical support for this hypothesized relationship. suggestion that unlike the proposition expounded in the HFACS

Furthermore, the odds ratios associated with “supervisory fail- model (and in its associated underlying theory), organizational DAY INTERNATIONAL WEDNESDAY— ures” were more than 13 times more likely to occur in the pres- influences are not always unidirectional. People at lower levels in ence of a concomitant failure in the category of “organizational the organization may, in some circumstances, adversely influence process” (see Table 2). behavior at higher managerial levels. It is conceivable that pilots Wojcik (1989) proposed that some conditions are studied by exhibiting “poor personal readiness,” an “adverse mental state,” psychologists and are reasonably well understood, such as work or who had “physical or mental limitations” could cause prob- schedules that allow adequate sleep. However, other conditions lems that resulted in “inadequate supervision.” On the other hand, related to management and organizational factors are more diffi- though, it is difficult to see how “decision errors” could cause an cult to observe and quantify. At present, the accident causal factors “adverse mental state.” The results obtained suggest that the cited by investigation authorities usually, though not always, em- HFACS framework needs to be modified slightly to encompass a phasize technology, the physical environment and the more im- more dynamic view of organizations. mediate human factors, an emphasis partly due to the “stop rules” The results suggest that interventions at HFACS Levels 1 and of investigators when searching for accident causes (Rasmussen, 2 would only have limited effect in improving overall safety. As 1988). The category of “inadequate supervision” was the key fac- an example, improving CRM practices alone is unlikely to have a tor at HFACS Level 3. It had many, significant statistical associa- major impact on safety unless the supervisory processes (Level 3) tions with categories in Level 2, however, there was only one sig- and organizational processes (Level 4) are in place to provide nificant “causal” relationship observed, which was with the Level 2 facilities, oversee CRM training, monitor its effectiveness, and category of “crew resource management.” The failure of senior respond to any further changes required in the training program. officers in a supervisory position to provide guidance and opera- All of these activities require organizational commitment and tional doctrine to pilots was associated with many forms of psycho- capacity, which can only be provided from the highest levels of logical precursor that subsequently resulted in active, operational management. Furthermore, on a “dollar-for-dollar” basis, inter- failures. Again, the values for the odds ratios associated with “su- ventions at higher levels are also likely to be more cost effective in pervisory failures” and several Level 2 categories strongly suggest terms of the net safety benefits they realize. Specific targets for that this is a key area for breaking the chain leading to accidents. remedial safety action should be aimed in the areas that share This suggests that accident investigations should be pursued fur- the strongest and greatest number of significant associations with ther back into the organization than is often the case at present. lower levels in the organization (for example, “organizational Reason (1990) suggested that human behavior is governed by process,” “inadequate supervision,” and “crew resource manage- the interplay between psychological and situational factors. The ment.” All of these categories are also at the root of paths of preconditions for unsafe acts (Level 2) show a number of strong association with other HFACS categories that have very high val- statistical relationships with the active failures of the operators at ues for the odds ratios associated with them, which further sug- Level 1. In many cases the relationships uncovered in the data gests that the greatest gains in safety benefit could be achieved by suggest a strong “causal” influence of the higher-level HFACS targeting these areas. categories on the Level 1 errors. These Level 2 factors show Reason’s classic “many to one” mapping of psychological precur- Conclusions sors to active failures in all of the Level 1 categories with the There is a growing awareness of the role of management and or- exception of “violations” which is only closely related to two higher ganizational factors in aviation accidents (Orasanu and Connolly

ISASI 2006 Proceedings • 75 ISASI 2006 PROCEEDINGS 76 Harle, P.G. (1995).InvestigationofHuman Factors: thelinktoaccident Feggetter, A.J.(1991).TheDevelopment Diehl, A.(1989).HumanPerformance/System SafetyIssuesinAircraft References remedial safetyactionsforbreaking accidentschain. accident investigationsandfortargeting potentiallycost-effective HFACS frameworkhasbeenproven tobeausefultoolforguiding ing from latentconditionsintheorganization. Furthermore, the ture thatsupportsReason’s (1990)modelofactivefailures result- support theHFACS methodology. Thisresearch drawsaclearpic- other cultures, thereby providing furtherempiricalevidenceto other datasetstoestablishifthepatternsobservedholdgoodin reason whythisanalytical methodologycannotbeemployedon tionships reported maybeculturallyspecific.However, there isno all occurred intheROCAirForce, thusthepatternsofinterrela- levels intheorganization. Theaccidentsandincidentsanalyzed with inadequaciesatboththeimmediatelyadjacentandhigher scribed pathsthatrelate errors atLevel 1(theoperationallevel) errors andaccidents. There are clearlydefined,statistically-de- promulgate throughout theROCAirForce toresult inoperational of howactionsanddecisionsathigherlevelsintheorganization study provides anunderstanding,baseduponempiricalevidence, human error facilitated(Wiegmann andShappell2001c).This gations canbeimproved, andanalysisoftheunderlyingcauses oped sothatdatagathered duringhumanfactorsaccidentinvesti- tors investigationmethodsandtechniqueswillneedtobedevel- more, iftheseefforts are tobesustained,appropriate human fac- factors responsible foraviationaccidentsandincidents.Further- ing organizational factors,aswellthemore immediatehuman needs tobeconducteddeterminethemostprevalent underly- atically refocused, acomprehensive analysisofexisting databases factors mustbeaddressed. Before research effortscanbesystem- ducing theaviationaccidentrate,theseorganizational andhuman the aviationindustrywantstoachievegoalofsignificantlyre- the higherlevelsintheirorganizations (Maurinoetal.1995).If mitted bypilotsare influencedbytheactionsofmanagementat performance. Itisimportanttounderstandhowtheerrors com- conditions andtheindividualpsychologicalfactorsaffectingsafety 1993). There isanexplicit relationship betweenorganizational State University. International SymposiumonAviation Psychology Data BaseasanAidfortheInvestigationofAircraft Accidents. Aviation Psychology Accident InvestigationandPrevention. • ISASI 2006 ISASI Proceedings (pp.838-847).TheOhioStateUniversity. of anIntelligentHumanFactors Fifth InternationalSymposiumon (pp.324-629).TheOhio ◆ Sixth Wojcik, L.A.(1989).Probabilistic RiskAssessmentandAviation System Wiegmann, D.A.,andShappell,S.A.(1997).HumanFactors Analysisof Wiegmann, D.A.,andShappell,S.A.(2003). Wiegmann, D.A.,andShappell,S.A.(2001c). HumanError Analysisof Wiegmann, D.A.,andShappell,S.A.(2001b).HumanError Perspectives Wiegmann, D.A.,andShappell,S.A.(2001a).ApplyingtheHumanFactors Trollip, (1991). andJensen,R.S. S.R., Shappell, S.A.,andWiegmann, D.A.(2003). Shappell, S.A.,andWiegmann, D.A.(2004).HFACS AnalysisofMilitary Shappell, S.A.,andWiegmann, D.A.(2001).ApplyingReason: thehuman Reason, J.(1997). Reason, J.(1990). Rasmussen, J.(1988).HumanError MechanismsinComplex Work Orasanu, J.,andConnolly, T. (1993).TheReinvention ofDecision Maurino, D.E.,Reason, (1995). J.,Johnston,N.,andLee,R.B. Li, W.C., D.(2005).HFACS andHarris, AnalysisofROCAirForce ,andKoch,Landis, J.R. G.G.(1977).TheMeasurement ofObserver Hunter, andBaker, D.R., (2000).Reducing R.M. Accidentsamong Hollnagel, E.(1998). Helmreich, (1994).AnatomyofaSystemAccident:TheCrash R.L. The OhioStateUniversity. Safety. The InternationalJournalofAviation Psychology Postaccident Data:ApplyingTheoretical Taxonomies ofHumanError. System Aviation Accident Analysis:TheHumanFactors Analysis andClassification Medicine Analysis andClassificationSystem. Commercial Aviation Accidents:ApplicationoftheHumanFactors 357. in Aviation. Psychology Aviation AccidentData. Analysis andClassificationSystemtotheofCommercial Englewood, CO:JeppesenSanderson. 03/4). Washington, DC:Federal Aviation Administration. International SocietyofAirSafetyInvestigators and CivilianAviation Accidents:ANorthAmericanComparison. Aerospace Safety factors analysisandclassificationsystem(HFACS). England: Ashgate. Environments. NewJersey:Norwood, Ablex. (Editor), andC.E. Zsambok Calderwood, Making. G.A.Klein,J.Orasanu,R. Aviation HumanFactors International JournalofAppliedAviation Studies Aviation Accidents:reliability analysisandcross-cultural comparison. Agreement forCategoricalData. Ashgate. The Fourth Australian Aviation Psychology Symposium General Aviation Pilots through aNationalAviation SafetyProgram. England: ElsevierScience. 265-284. Avianca Flight025. England: AshgatePublishing. Applications ofPsychology totheAviation System Fullerprevention. Johnston,andR. N.McDonald,R. (Editor), . Aldershot,England:Ashgate. Fifth InternationalSymposiumonAviation Psychology ,72(11),1006-1016. Decision MakinginAction: ModelsandMethods TheOhioStateUniversity. The InternationalJournalofAviation Psychology , 1(1),59-86. Reliability EngineeringandSystemSafety Human Error Managing theRisksofOrganizational Accidents Cognitive ReliabilityandError AnalysisMethod The InternationalJournalofAviation Psychology . England:AshgatePublishing. Eleventh InternationalSymposiumonAviation . NewYork: CambridgeUniversity. Biometrics Aviation, Space,andEnvironmental Human factorsforgeneralaviation

A HumanError Approach to (Report No.DOT/FAA/AM- (pp.2-8).Queensland. , 33,159-174. , 7(1),67-81. (pp. 101-107).Aldershot, , 5(1),65-81. Aldershot,England: Human Factors and , 22,155-167. (pp. 3-20). (pp.402-407). , 11(4),341- . Aldershot, Beyond . Oxford, , 4(3), . Major Investigation Management By Nick Stoss, Director, Air Investigations Branch, Transportation Safety Board of Canada Background and experience. It is for these reasons that I suggest that the As the director of the second-largest national aviation safety in- cornerstone to an AAIA’s organizational readiness to respond to vestigation authority, I frequently have been asked for how the any accident, but in particular to a major accident that will stretch Air Branch of the Transportation Safety Board of Canada (TSB) resources and that will probably exceed in-house capabilities, is a plans for and conducts major investigations. The catalysts for comprehensive Major Occurrence Response Plan (MORP) and such a request from another national aviation accident investiga- related checklists. tion authority (AAIA) are valid concerns that the AAIA may not An AAIA’s plan is not just a document solely based on intu- have the required resources and expertise to capably respond to ition. It is a document that should be based on in-depth consid- a major accident, and that the AAIA may not have the knowl- eration of the following factors: edge and experience to manage and conduct a major investiga- 1. the AAIA’s legislation, policies, and standards that support all tion. The basic challenge is “Will the AAIA be able to do it com- the elements of the response and investigation plans; petently and professionally the first/next time it happens?” 2. the AAIA’s investigation procedures and checklists to meet the I routinely have three responses to these questions. The first is requirements of all types of investigations, taking into the ac- that “managing a major investigation is not rocket science”; the count the possible ranges of size and complexity; DAY THURSDAY—INVESTIGATOR’S second is that “a successful major investigation does rely on com- 3. the AAIA personnel’s level of expertise, experience, and prehensive readiness and sound management”; and the third is knowledge; “that, rather than starting from ‘scratch’ [i.e., reinventing the 4. the AAIA’s financial and equipment resources; wheel], one can learn much of what is required through consulta- 5. the AAIA’s management structure and authorities, as well as its tion with other AAIAs and a careful review of their documented decision-making process(es); processes.” 6. the AAIA’s readiness and ability to acquire additional finan- In this paper, I first will present my views on “organizational cial, human, and equipment resources; readiness,” “major occurrence response,” and “managing major 7. the entitlements, responsibilities, and procedures of other na- occurrence investigations.” Then, I will touch on some TSB re- tional and international agencies and departments that would cent experiences in conducting major investigations, including become involved in the AAIA investigations; and the management of the investigation into the Air France A340 8. industry stakeholder1 readiness and abilities to support an AAIA runway-overrun accident at Toronto on Aug. 2, 2005. investigation. This paper is not designed to provide all the answers to the The first four factors above are fundamental to day-to-day in- complexities of conducting a successful major investigation; investigation operations and already should be well understood by stead, I will be highlighting some important issues that the TSB all AAIAs. Although careful consideration of each of these points believes should be the basis for an AAIA to examine/evaluate its is required to ensure the integrity of an AAIA’s MORP, for the readiness and ability to take on such an important task. purposes of this section of my paper I will limit myself to the discussion of the last four points, which are based on lessons Organizational readiness learned by the TSB during our recent major investigations. I know that all AAIAs would agree that organizational readiness is the cornerstone to being able to handle day-to-day responsi- Management of a major investigation bilities. At the same time, AAIAs would acknowledge that their (command and control) ability to meet these responsibilities can be affected by limited Managing a major investigation is like managing any important financial budgets, human resources, and investigation expertise project. The investigator-in-charge (IIC) is the project manager who has been assigned a project [the safety investigation] with a Nick Stoss is the current director of Air Investiga- clear objective [advancing transportation safety] that will be real- tions for the Transportation Safety Board of Canada ized with the production of an investigation report and safety (TSB). His career in aviation spans more 43 years, recommendations. The IIC is provided with specific financial, including 27 years with the Department of National personnel, and equipment resources to complete the project. The Defence as a pilot, staff officer, and flight safety IIC is accountable to the tasking authority [the Director of Inves- officer; 2 years with Transport Canada as an tigations (DOI)] for conducting the investigation in accordance aviation inspector; and 14 years with the TSB as an with the AAIA’s legislation, policies, standards, and procedures. operations specialist investigator, safety analyst, and manager. Finally, the IIC must keep the DOI informed as to the project Effectively, Nick has been involved in accident investigations for more status and the project plan, in particular when the assigned re- than 30 years. He is an experienced pilot in fixed-wing and helicopter sources are inadequate and when additional support is required. operations and holds an airline transport pilot license. The DOI, on the other hand, is responsible for ensuring that the

ISASI 2006 Proceedings • 77 ISASI 2006 PROCEEDINGS 78 by thechairman, theDOImayalsobe TSBofficialspokes- quiries onreleased TSBBoard recommendations, and ifapproved Safety InformationLetters.The DOImayalsorespond toin- dures; and,on released Aviation SafetyAdvisoriesandAviation investigation legislation,policy, process, standards andproce- tion, istheTSBexecutive responsible forcommunicating onTSB thedirector of AirInvestigations,throughout theinvestiga- • safety communicationsandtheTSBfinalinvestigationreport. may alsobetheTSBofficialspokesperson ontherelease ofTSB the TSBInvestigationprocess. Ifapproved bytheDOI, IIC tigation, release offactualinformation,investigation plans,and throughout theinvestigationregarding theprogress oftheinves- theinvestigator-in-charge istheTSB officialspokesperson • TSB MOIC,inpart,statesthat tigated andtheconductofinvestigations. lishing policiesthatgoverntheclassesofoccurrences tobeinves- reports onitsfindings.TheBoard isalsoresponsible forestab- deficiencies, makes safetyrecommendations, andissuespublic findings astocausesandcontributingfactors,identifiessafety theBoard reviews transportationoccurrence reports, makes • dance withTSBpolicies. tion AccidentInvestigationandSafetyBoard Act,andinaccor- cised inaccordance withprovisions oftheCanadianTransporta- gation asrequired bytheBoard. Thisauthoritymustbeexer- with respect toinvestigationsandshallconductfurtherinvesti- tigation onbehalfoftheBoard. TheDOIshallreport totheBoard the DOI hasexclusive authoritytodirect theconductofinves- • duct, andcontrol oftheinvestigation. theIICisaccountabletoDOIformanagement, con- • context ofan aviationoccurrence— list (MOIC). Air InvestigationsBranch,MajorOccurrence InvestigationCheck- of responsibility formanagementandteammembersintheTSB investigation planandchecklists. gation teammembersare responsible forfollowingthe lished procedures. Finally, thegroup chairpersonsoftheinvesti- tion, policy, standards andguidelinesforfollowingestab- cation. Next, theIICisresponsible foradheringtothelegisla- guidelines, procedures, within-agencyliaison,andresource allo- directors, andseniormanagers]isresponsible forstandards, and memorandaofunderstanding.Thenext level[executives, the responsibility forlegislation,policy, inter-departmentliaison, authority [chairperson,board, orcommissioner]isvestedwith of thisissue. The followingparagraphsprovide someexample perspectives understands thechainsofauthorityandscoperesponsibilities. roles ofthosemanagementlevelstoensure everyoneinvolved investigation. TheMORPshoulddocumenttheinvolvementand AAIA thathavearole toplayinsupportofamajoroccurrence reality isthatthere maybeotherlevelsofauthoritywithinan ties oftwolevelsmanagementinamajorinvestigation.The to modifytheproject objectivesorscopeaccordingly. required tocompletetheinvestigationand,ifthisisnotpossible, investigation teamisprovided withtheproper levelofresources In thecontext ofcommunicationsduringaninvestigation, the For example, regarding theinvestigationandreporting inthe At theTSBofCanada,we,inpart,documentthesedivisions For example, from anAAIA’s perspective,thehighestlevelof The aboveparagraphisasimpleportrayaloftheresponsibili- • ISASI 2006 ISASI Proceedings ited representatives andadvisors. recommended practicesregarding theentitlementsofaccred- the AAIAmusttake intoaccountICAOAnnex 13standards and that avoidsallactualandpotentialconflictsofinterest. Finally, liability, anddiscipline],toconductthemselvesinamanner dence from allotherresponsibilities [suchaslitigation, product involved inthesafetyinvestigationtomaintaintheirindepen- tion. Equallyimportantwouldbetherequirement forallthose independence andtomaintainabsolutecontrol oftheinvestiga- would bebasedontherequirement oftheAAIAtomaintainits the useofnon-AAIApersonnelandresources. Theseprovisions legislation, policies,andprocedures mustincludeprovisions for Based ontheconceptthatoutsideexpertise willberequired, AAIA legislationpoliciesandprocedures AAIA observer interest would be“advancingsafety.” A “safetypartnership”does interest; andinthecontext ofanAAIAinvestigation,themutual nership” impliescooperation onthesubjectmatterofmutual lished bylessformalmeans. Notwithstanding,theterm“part- ortheycan beestab- understanding orworkingarrangements, idly expand resources. “safety partnerships”willprovide theframeworkrequired torap- will neverbeabletoplanforeverycircumstance, establishing pens todothisanalysisofresource requirements. Althoughyou note thatanAAIAcannotafford towaituntiltheaccidenthap- AAIAs, manufacturers, regulators, etc.].Itisveryimportantto organizations, andassociations]aswellforeign resources [other ment agencies,airlinesoperators,maintenanceandtechnical falls. Thissearch couldinclude othernationalresources [govern- AAIA andthensearch forsources ofthatexpertise tofillshort- determine whattypesofexpertise are notavailablewithinthe major investigation. from outsidetheagencytocompetentlyandcredibly conducta To augmentitscapabilities,theAAIAwillhavetousepersons house expertise andresources torespond toamajoroccurrence. No AAIAisstaffedtothelevelwhere ithasalltherequired in- Use ofstakeholders/safety partners tives, manufacturers, operators,associations]. partments, foreign statesandagencies,accredited representa- members, butalsothenon-AAIAentities[othergovernmentde- cess toallthoseinvolvedintheinvestigation,notonlyAAIA addition, suchdocumentationwilladdtransparency ofthepro- nificant partintheefficientmanagementofinvestigation.In tion oftheprocess andindividualresponsibilities willplayasig- investigations. Theimportantissueisthatproper documenta- communications. son ontheTSBinvestigationprocess andpreviously released TSB communicationstaffmaybeappointedastheTSBspokesper- • issues wouldnormallybedeferred totheIICorDOI. reports. Questionsonon-goinginvestigationsandtechnical TSB Board recommendations, concerns,andfinalinvestigation cate onTSBinvestigationlegislation,policy, andprocess andon thechairman,throughout theinvestigation,couldcommuni- • concerns, andtheTSBfinalinvestigationreport. person ontherelease ofTSBBoard recommendations, safety These partnershipscanbeformalized usingmemorandaof To establishreadiness foramajorinvestigation,theAAIAmust There isnotjustonemodelforthemanagementofmajor not imply collaboration, complicity, or compromise on safety is- • assist in the validation of investigation data. sues, nor does it include any activity that is not directly linked to • contribute to investigation planning. advancing safety. Any safety partnership agreement must clearly • assist in areas of analysis. state the conditions and limits of the partnership. • assist in determining safety significant events and underlying Fundamental to the readiness to use non-AAIA personnel are factors. the following: • assist in assessing risks, defenses, and risk control options. • The AAIA rules and guidelines on and the conditions for use • assist in validating safety deficiencies. of these “safety partnerships” must be well documented. The following are those who the TSB normally invites and • The AAIA personnel must be knowledgeable about these rules accepts as observers: and conditions, • Accredited representatives from the AAIAs of involved states; • The AAIA personnel must be knowledgeable about the safety • Advisors to accredited representatives as appointed by the for- interests and aware of the potential conflicting interests of the non- eign states; AAIA entities that may become involved in an AAIA investigation. • Transport Canada, by legislation, is permitted to appoint a • Not only must all non-AAIA personnel be familiar with the Minister’s observer, but this observer’s participation is limited to AAIA’s rules and guidelines on and conditions for the use of these observing; “safety partnerships,” but they must be knowledgeable about • Airline safety department investigators of the involved airline; AAIA’s investigation mission, methodology, policies, standards, • Manufacturer safety department investigators of the involved and procedures. manufacturer; Finally, to ensure the readiness of potential safety partners, • Safety staff of other involved organizations—we do not accept the AAIA may have to conduct training for them. Such training lawyers or managers and staff who may be implicated in the in- could include involving non-AAIA personnel in AAIA investi- vestigation; gation response exercises and having them participate as ob- • Association safety department investigators of the association servers on AAIA investigations. Equally important for AAIA whose members are involved; and DAY THURSDAY—INVESTIGATOR’S personnel is that they participate in the emergency response • Foreign AAIA investigators for both training purposes and for exercises conducted by other agencies that have disaster response specific expertise. responsibilities. TSB observer/safety partner readiness TSB observer policy and procedures The TSB spends significant effort at establishing and maintain- Here is how the TSB handles some of the safety-partner/observer2 ing relationships with key foreign states, companies, departments, issues. organizations, and associations to ensure that these are ready to • First, TSB legislation makes it very clear that it is solely the participate in TSB investigations. TSB’s discretion to accept observers. It also directs that observers • State AAIAs: TSB investigators are frequently in contact with will only be appointed if they have expertise required by the TSB. foreign investigation agencies when they become involved as ac- • The TSB is also very clear that, no matter what organization credited representative representing Canadian safety interests in the observer normally works for, while working on a TSB investi- foreign investigations. The TSB also conducts liaison visits, ex- gation, observers work directly for the IIC. changes training opportunities, and shares experiences with these • Another area of concern is the inadvertent release of investi- agencies. The TSB also consults other agencies when establish- gation information. In this regard, two conditions for a person ing and revising investigation policies, standards and procedures. being granted “observer status” on a TSB investigation are that • Manufacturers: The TSB maintains relationships with the safety the TSB IIC is the sole person entitled to release investigation departments of Canadian manufacturers of aeronautical prod- information and that no release or use of investigation data is ucts to ensure response readiness for Canadian and foreign in- permitted without the specific approval of the IIC. For the TSB, vestigations involving these products. The TSB does likewise with this is a two-way street: the IIC would routinely provide advance foreign manufactures whose products are used in Canada. notice to stakeholders about information that will be released, • Airlines: The TSB maintains relationships with the safety de- and the observer must request permission to pass any investiga- partments of all Canadian and some foreign airlines to ensure tion information to the parent organization, prior to any use of response readiness and effectiveness for Canadian and foreign that information. investigations. • The TSB lives up to the information sharing requirements con- • Police Forces: TSB regional offices maintain close contact with tained in ICAO Annex 13 information provisions but restricts provincial and municipal police forces during day-to-day investi- the release and use of the information as stated above. gations operations. These relationships are further enhanced by joint disaster response exercises, routine meetings, and briefings TSB roles of observers/participants to ensure clear understanding of each other’s mandates and pro- In addition to the provisions within Annex 13 regarding the rights cedures. The TSB also has memoranda of understanding with of accredited representatives and advisors, the TSB has a broader some police forces to ensure proper handling of evidence, secu- view of the roles of observers on a TSB investigation. Specifically, rity for accident sites, immediate access to accident sites for TSB observers and participants are expected to investigators, and procedures for resolving conflicting interests • contribute their expertise where required by the TSB. and priorities. • be the point of liaison between the TSB and their parent orga- • Coroners: TSB regional offices maintain close contact with pro- nization or agency. vincial coroners during day-to-day investigations operations, and

ISASI 2006 Proceedings • 79 ISASI 2006 PROCEEDINGS 80 accidents. This teamremains incontrol untilthemajorinvesti- regional teamthatwouldreact onaday-to-day basistoroutine initial response totheaccidentsiteisconductedbysamesmall Day #2investigationplan. checklists inmostsituationsare, infact,theAAIA’s Day#1and Effectively, theAAIAresponse planandthemajoroccurrence your planandrely onthereadiness andtraining ofyourstaff. the temptationtosecond-guessyourpreparations, andgowith result inuncertaintyandlike causeconfusion.Specifically, resist time formakingchangestoyourplan—doingsowillprobably aging theexisting initialresponse plan.Thiswouldnotbethe to amajoraccidentisthattheAAIAshouldconcentrateon man- if needbefrom non-AAIBsources. sion ofpersonnelandotherresources totheinvestigationteam, investigator-in-charge (IIC)andgroup chairmen,and theprovi- quired. Thesefactorswouldalsoinfluencetheselectionof depth ofinvestigationexpertise, resources, andequipmentre- property, etc.,theAAIAwouldhavetodeterminetypeand and aircraft, thenumberofpersonsonboard, the damageto currence, thelocationofoccurrence, thetypeofoperation major investigationteam.Basedontheprofile andtypeofoc- AAIA entities. tify andincreased number ofinvestigators,supportstaff,andnon- a majorinvestigationsituationwouldbetherequirement tono- quired byICAOAnnex 13.Theonlydifference forthisaspectin manufacturers, etc.;andthenotificationofforeign statesasre- vice providers, police,etc.;thenotificationofinvolvedairlines, cation ofnationalauthorities,includingregulators, airtrafficser- out ofrequired investigatorsandsupportpersonnel; thenotifi- mine thetypeandscopeofAAIAresponse required; thecall lection andassessmentoftheoccurrence informationtodeter- factors intheplanwouldnormallyincludefollowing:col- Each AAIAshouldhaveaplanforreacting toaccidents.The Activate themajorinvestigationresponse plan Major occurrenceresponse on mutualknowledgeofthemedia’sandTSB’s requirements. posture, procedures, andproducts have beenformulatedbased mandates andprocedures. TheTSB’s current communications to understandtheirrequirements and toeducatethemonour • adjusters toshare effortsinrecovering wreckage. • them. TSB alsoparticipatesinmeetingsandexercises withmostof partment ofHealth,Treasury Board, NationalDefence,etc.The Foreign Canada,emergency Affairs measures organizations, De- withTransportand maintainsworkingarrangements Canada, involved inresponding tomajoraccidents.TheTSBestablished tains closeliaisonwithotherCanadiangovernmentdepartments • randa ofunderstandingwiththecoroners ofallourprovinces. cident scenesforthecoroner inquiries.TheTSBalsohasmemo- sies forTSBinvestigationsandtechnicalassessmentsofac- the TSBandcoroners exchange services,suchascoroner autop- An importantelementinthe TSB’s response planisthatthe Another importantfactorthatwillresult inasuccessfulresponse The next stepwouldbetoestablishthecompositionof News Media: Insurance Adjusters: Other CanadianGovernmentOrganizations: • ISASI 2006 ISASI TheTSBliaiseswithnewsmediaorganizations Proceedings TSBregional officesworkwithinsurance TheTSBmain- the majoroccurrence investigationteams. of theorganization are ready tomanageandprovide supportto lists havebeenputinplaceacross theTSBtoensure thatallparts over thelastfivemajorinvestigations,additionalplansandcheck- perspective. However, inadditionandbasedonourexperiences ments theroles ofTSBmanagersfrom theinvestigationteam Branch, MajorOccurrence InvestigationChecklist(MOIC)docu- cial, technical,andhumanresources fortheinvestigation. tor strategicplanningissues,suchasacquiringadditionalfinan- the investigationteam.TheAAIAmanagementshouldalsomoni- ment role shouldbecomeoneofensuringsupporttotheIICand investigation hasbeenpassedtotheIIC,AAIAseniormanage- tion teamisestablishedandtheday-to-day managementofthe and themanagementteam.Specifically, oncethemajorinvestiga- structure, andthecommunicationrequirements between theIIC its managementteamandexecutives, thecommandandcontrol The AAIA’s MORPshoulddocumenttheroles andinvolvementof Role ofAAIAmanagement/executive ticular during the firstfewdaysofinvestigation. To besuc- and toknowevery aspectofanunfoldinginvestigation, inpar- As statedearlier, anIICcannotbeexpected todoallthework Tracking majorinvestigationissues some non-criticalinvestigation tasks. available, andinsomecircumstances mayevenhavetosetaside delay someaspectsoftheinvestigationuntilresources become investigators, mayhavetodowithfewerresources, mayhaveto and schedules.Inreality, theIICmayhavetodomore withfewer This typeofplanningiscriticalinsettingoutworkrequirements and thatfuture needsoftheinvestigationteamare determined. vided totheinvestigationare assignedtoinvestigationgroups, has theinvestigationexpertise required, thatthepersonnelpro- gation, theIICmustensure thatthemajorinvestigationteam manage investigationteamresources: Throughout theinvesti- • needs toberevised. in allareas oftheinvestigationandtodetermineifChecklist Checklist isthebestwaytodetermineifeffective monitoringofthe should blindlyfollowtheChecklist.TheIIC’s future investigationactivities.ThisisnottosuggestthattheIIC sis formonitoringtheprogress oftheinvestigationandplanning usetheMajorOccurrence InvestigationChecklist:Itistheba- • and planningahead. monitoring theprogress oftheinvestigation,lookingforward, concentrateonmanagingtheinvestigation:AnIICshouldbe • be successful,amajoraccidentinvestigationIICmust tise ofhisgroup chairmenandinvestigatorstodothiswork.To operational investigationexpertise, nowhastorely ontheexper- who probably isverycomfortableinapplyinghistechnicaland managementoftheproject.tion istheIIC’s Effectively, theIIC, The mostcriticalaspectofasuccessfulmajoraccidentinvestiga- Managing—general Management ofthemajorinvestigation dent location. organize anddeploythemajorinvestigationteamtoacci- onsite.Thispracticeallowsmoregation teamarrives timeto As mentionedearlierinthispaper, theTSBAirInvestigations cessful, the IIC needs to concentrate on the validated factual in- the IIC team meetings is the effectiveness of communications formation and significant safety issues identified by the investi- within and between the investigation groups. The IIC should gation team, on the status of the overall investigation plan, on encourage that investigation group meetings, as well as inter- the plans of all the investigation groups, and on the outstanding group liaison and communications, take place regularly before investigation requirements. investigation team meetings. In the TSB context, the MOIC allows flexibility in the organization and structure of the major investigation team and provides Communications, communications, communications specific checklists3 for these investigation management areas. The AAIA major investigation plan should document the responsibility for communication between the investigation team and se- Managing investigation schedules nior management, and within the AAIA executive. In this regard, One of the most valuable resources that an IIC has is his or her the IIC would be the logical link between the investigation team assigned personnel, and the IIC must ensure that they maintain and management. At the TSB, the IIC is required to communicate their physical and mental health and that their work areas are internally with the DOI on a daily basis and whenever a significant safe. If investigators are left to do their own work scheduling, the issue arises that requires higher level advice or support. work pressures and their own enthusiasm can easily cause most The plan should document who within the AAIA will be re- of them to try to work 24 hours a day, 7 days a week. The only sponsible for external communications with involved organiza- time-critical investigation task that exists is ensuring that perish- tions and people with a direct interest in the investigation, such able evidence is not compromised or lost. Once this task is com- as crew, passengers, next-of-kin, and the news media. In the Ca- pleted, the IIC must not only manage the team work schedule, nadian context, the IIC is the spokesperson on investigation but also his or her schedule as well. This aspect of management matters. Although a public relations coordinator and families li- must be done to not only ensure that the IIC and the group chair- aison coordinator may be assigned to the investigation team, the men have the time available to meet their investigation manage- IIC must consider and must make time available for external ment responsibilities, but also to ensure that the investigators are communications tasks. DAY THURSDAY—INVESTIGATOR’S not over worked. Needless to say, overtime costs may also have In particular, during the first week(s) of a major investigation, an influence on scheduling. the external communications tasks have the potential to be over- whelming, and resources outside of the AAIA, including media IIC meetings specialists, may be needed. Team meetings are vital to the IIC’s ability to competently manage the investigation. IIC meetings should be held daily during Expect surprises the first few weeks of an investigation and then as required as the There will always be some surprises during an investigation so investigation progresses. The following are some factors that the IIC and management should expect them. When surprises should be considered when planning team meetings: happen, IICs must remain calm and not jump to judgment or • An IIC should plan investigation meeting times that will es- conclusions quickly. Also IICs must not take on tasks that are tablish a limit to the work day for all investigation team mem- beyond their responsibilities or beyond the capabilities of the bers; establishing firm times and mandatory attendance for meet- investigation team. ings will help in that regard. Other factors to be considered are the potential loss of perishable evidence, daylight hours, travel Managing critical issues time, briefings, interviews, etc. At the TSB, investigation progress The IIC of a major investigation will frequently encounter criti- meetings are scheduled at about 1900 hours and at 0800 hours. cal issues that need prompt handling. Good management prin- • IICs must have a concise, consistent, and specific plan for all ciples suggest that establishing a separate project team may be meetings and should follow the plan. Doing so will enhance the best way to handle this “unplanned for” event. The disposition IIC’s credibility and will be the catalyst to effective participation of the issue should be based on whether the issue is critical to the by others. For the most part, attendees at the meeting should be safety investigation and whether the existing investigation team limited to the active participants in the investigation. can take on the issue without adversely affecting the progress of • The focus of the team meetings should be on group chairman the investigation. presentations on the following points: the completed elements The AAIA’s MORP and MOIC should include guidelines to of the investigation plan, the significant facts determined, the assist in decision-making for this type of event. In some cases, safety issues under consideration, the proposed adjustments to the best solution may be to assign a separate project leader re- short-term and long-term group investigation plans, the resource porting to someone other than the IIC. requirements and implications, and any assumptions and analysis—but only if they are required to support of safety issues and Managing investigation creep changes to the group investigation plans. Throughout the investigation, the scope and depth of the inves- The objectives of these of investigation team meetings are the tigation will have to be re-evaluated, in particular when a lack of proper assessments of the progress of the investigation, and the resources will dictate that the investigation team cannot investi- validation of the team, and group investigation plans for the fol- gate all deficiencies or ambiguities discovered during the investi- lowing day(s). In this regard, the success in managing the inves- gation. In such situations, hard decisions will have to be made. tigation will hinge on the IIC’s decisions made as the result of Important criteria for these decisions should be the relationship these meetings. of the potential investigation area with the identified safety sig- A factor that will play an important role in the effectiveness of nificant events of the occurrence, as well as on the potential of

ISASI 2006 Proceedings • 81 ISASI 2006 PROCEEDINGS 82 termine thetypes ofexpertise required andthesources from which and thelevelof expertise availablewithintheTSBandthende- decision wastoassessthetypes ofinvestigationexpertise required establish amajoroccurrence investigationteam.Theimmediate by sendinginvestigatorstothe site. office responded immediatelybynotifyingthehead officeand vided byNAV CANADAatLBPIA.TheTSBOntarioregional minutes oftheaccidentbyairtrafficcontrol (ATC) servicespro- Transportation SafetyBoard ofCanada(TSB) wasnotifiedwithin crew membersandninepassengers received seriousinjuries. The board theaircraft. Anensuingfire destroyed theaircraft. Two port perimeter. There were noreported dangerous goodson of therunway, andcametorest inaravinejustoutsidetheair- eastern daylighttime,theaircraft theend landedlong,overran Pearson InternationalAirport(LBPIA),Ontario,Canada.At1602 conducted anapproach toRunway24Latthe Toronto/Lester B. Airbus 340-313,French registration F-GLZQ, SerialNumber289, On Aug.2,2005,thecrew ofAirFrance Flight358(AF358),an Air France investigationexperience A340runway-overrun soon astheyare recognized. vestigation, corrective actionis taken onallsignificantissuesas the investigation,andratherthanwaitingforendofin- ments. Thisreview includesallpartsoftheAAIAthatsupported both positiveandnegativelessonslearnedideasforimprove- members are encouragedthroughout theinvestigationtorecord mendations forimprovements forfuture investigations. tigation anditsreport. Thereview isexpected toresult in recom- taken bytheAAIA,regulators, andindustryasaresult oftheinves- actions taken toresolve theissues;andevaluatessafetyactions examines theproblems encountered andtheeffectivenessof tion teamorganization, planning,procedures, andprocesses; re- dards andprocedures; evaluatesthe effectivenessoftheinvestiga- tigation. Thisreview evaluatestheadequacyofinvestigationstan- wrap-up meetingtoreview ofthelessonslearnedduringinves- experience. Inthisregard, theTSBconductsapost-investigation conduct majorinvestigationsishavingaprocess tolearnfrom past Another importantpartofenhancingthereadiness ofanAAIAto Conducting lessonslearned on totheresponsible authority conduct furthertechnicaloroperationalanalysiscanbepassed dated asafetydeficiency, tothepointthatarecommendation to investigation hasalready reached positiveconclusionsandvali- delaying thedecision.There alsowillbesituationswherein the investigation; settingasidetheproposed area ofinvestigation;or of limitingotheraspectstheinvestigationordelayingoverall the proposed area ofinvestigation,withtheprobable consequence ments toaviationsafety. the additionalinvestigationworktoresult insignificantenhance- sions madeandthesupportingrationale. a decision-makingprocess thatincludesdocumentingthedeci- sequently, theAAIAshouldplanforthisproblem area andhave tation atriskwillalwaysbepresent onamajorinvestigation.Con- thing andtheconcernthatnotdoingsomayputAAIA’s repu- Based ontheprofile oftheaccident, decisionwasmadeto To enhancetheeffectivenessofthisreview, investigationteam Possible decisionsincludethefollowing: aggressively pursuing The pressures foraninvestigationteamtoinvestigateevery- • ISASI 2006 ISASI Proceedings 4 . vestigation isnot rocket science. Notwithstanding,being ableto As Imentioned atthestartofthispaper, managingamajorin- Conclusion summary site safety problem area thatcametolightwasrelated tositesecurityand encountered duringthefieldphaseofinvestigation.Thefirst made availabletothisinvestigation. ensuring thatneededexpertise andsupportwere immediately legislation, investigationprocedures, andexpertise resulted in NTSB andtheAAIBin-depthknowledgeofeachothers’ Second, havingworkexperience and closerelationships withBEA, cooperation andcoordination ofactivitiesattheaccidentsite. cies. Also,knowingeachothers’requirements greatly facilitated enhanced theinitialresponses bytheTSBandotheragen- ticipated withtheseentitiesindisasterresponse exercises greatly port authority, localpolice,andNAV CANADA,andhavingpar- question thathavingpreviously establishedrelations withtheair- tion were significantinanumberofareas. First, there wasno and Runway24Lwasreturned totheairportauthority. gation wascompletedin14days.OnAugust16,control ofthesite Toronto AirportAuthority(GTAA). Thefieldphaseofthisinvesti- Goodrich Corporation,thePeel Regional Police, andtheGreater NAV CANADA,AirFrance, Airbus,GeneralElectric,theUKAAIB, the Federal Aviation Administration(FAA) oftheUnitedStates, and 43observersfrom thefollowingentities:Transport Canada, ported byaccredited representatives from theBEAandNTSB, phase oftheinvestigationcomprised35TSBinvestigators,sup- the sitewithin12hoursofaccident.Theteamforfield the Weather Group. to aTSBrequest, suppliedexpertise fortheEnginesGroup and craft AccidentInvestigationBranch(AAIB),which,inresponse of anothersource from which expertise wasacquired wastheAir- National Transportation SafetyBoard (NTSB).Anotherexample and AirFrance, theTSBrequested additionalsupportfrom the In additiontotheexpertise thatwouldbeavailablefrom Airbus was readily apparent thatadditionalresources wouldberequired. though theTSBhadonecabinsafetyspecialistinvestigator, it l’Aviation Civile(BEA)ofFrance. Anotherexample isthatal- and theBureau d’Enquêtesetd’AnalysespourlaSécuritéde requirement, theTSBusedexpertise ofAirbus,AirFrance, erational ortechnicalexpertise ontheA340aircraft. To fillthis ucts andlarge passengeraircraft, itdidnothaveanyspecificop- had investigatedanumberofoccurrences involvingAirbusprod- that expertise couldbeacquired. For example, althoughtheTSB and otherauthorities. thecontrolmally transferring ofaccidentsitebetweentheTSB tablishment ofanewchecklist, procedures, andformsforfor- sulted inseparatingthesetwoareas ofresponsibility andthees- vestigation. Theresolution ofthisproblem area, inpart,hasre- tasked withthemanagementofothertechnicalareas ofthein- assigned asasecondarydutytoanindividualwhowasheavily addition, theresponsibility fortheapplicablechecklisthadbeen tion ofresponsibilities forboth sitesecurityandsafety. In part, determinedthatthethere were weaknessesinthedelinea- of thefieldphase,TSBexamined theproblem areas, andin The TSBhasalsolearnedlessonsastheresult ofproblems The lessonsalready learnedfrom thisportionoftheinvestiga- The TSBdeployedamajoroccurrence investigationteam to 5 . Inthisregard, withinweeksfollowingthecompletion competently conduct a major investigation requires comprehen- www.tsb.gc.ca), where additional information on TSB legislation, sive planning. Competent investigation management is the cor- policies, investigation process, occurrence reports, recommen- ner stone to a successful and effective investigation. Unfortunately, dations, subscription services, and statistics is readily available. I could not cover all aspects of investigation management in this TSB manuals are also available on request. ◆ paper; doing so would have resulted in a very large document. Consequently, I highlighted organization readiness, the impor- Endnotes 1 tance of documented major occurrence response plan and check- The terms “stakeholder” and “safety partners” in this paper represent the various states and organizations that have a safety interest in the lists, and the need for AAIAs to augment their resources using investigation and have the expertise necessary to contribute to the non-AAIA personnel. I particularly emphasized the need for the AAIA’s mandate to advance aviation safety. 2 AAIA to plan the involvement of safety partners in its major in- In the Canadian Transportation Accident Investigation and Safety Board Act, the term “observer” is defined in part as “a person” who “is invited by vestigations and to prepare its staff and potential safety partners the Board to attend as an observer because, in the opinion of the Board, for such an engagement. the person has a direct interest in the subject matter of the investigation This paper also covered some important aspects regarding the and will contribute to achieving the Board’s object.” (Other wording in the Act recognizes accredited representative entitlements contained in response to a major occurrence, concentrating on an AAIA’s initial ICAO Annex 13.) response, on selected aspects of managing the field investigation, 3 Although all the specific positions listed in the MOIC may not be and on the importance of having a process to learn from both the staffed for every investigation, the checklists established for the deputy IIC, operations lead, technical lead, safety analysis (safety action) successes and difficulties encountered during the investigation. coordinator, family liaison coordinator, and investigation team The last element of my paper dealt with TSB’s recent experi- administration office facilitate the monitoring and management of ence during its response to the Air France 358, Airbus A340-313, those functions associated with the investigation. 4 For example, as part of the ongoing TSB investigation (A04F0047) into runway-overrun accident that occurred in Toronto, Canada, on the March 6, 2005, Air Transat Flight 961 A310-300 loss-of-rudder event, Aug. 2, 2005. Although this event challenged the TSB, our suc- the Board determined that the current inspection program for Airbus cess confirmed the importance of our readiness, plans, check- composite rudders might not ensure the timely detection of defects, and

that delamination could grow undetected and the increasing age of the DAY THURSDAY—INVESTIGATOR’S lists, procedures, and approach to investigation management. composite rudders suggest that increased attention is warranted. As a I hope that this paper will be of benefit to other state accident result, the Board issued recommendations A06-06 and A06-06 for investigation authorities, as well as any other entities that may authorities to continue to research the problem area. ... that the Department of Transport and the European Aviation Safety become involved in a major aircraft accident investigation. Agency, in coordination with other involved regulatory authorities and As a final note, if you require additional information on man- industry, urgently develop and implement an inspection program that aging major investigations, do not hesitate to contact me directly: will allow early and consistent detection of damage to the rudder assembly of aircraft equipped with this type of rudder. phone: 613-994-3813, cellular: 613-286-4348, facsimile: 613-953- 5 At the time of the accident, in the TSB MOIC, these two areas of 9586. Alternatively, you can go to the TSB website (http:// responsibility were assigned to the “site coordinator/safety officer.”

ISASI 2006 Proceedings • 83 ISASI 2006 PROCEEDINGS 84 the TSBCWestern RegionOffice,inEdmonton, Alberta. and hasaspecific interest Heworksout of inaircraft crashsurvival. anthropology, withapsychologyminor, from theUniversityofAlberta helicopter accidentinvestigations. BillholdsaBAwithdistinctionin conference inSeptember2006. of AirSafetyInvestigators(ISASI) website athttp://www.tsb.gc.ca/ before theInternationalSociety ommendations, isexpected tobepublicandavailableontheTSB Impact Fires Resultingfrom SmallAircraft Accidents,” investigations. gation couldbenefitfuture small andlarge aircraft safetyissue experience, techniques,andlessonslearnedfrom thisinvesti- data deficiencies,andpropose optionsforimprovement. The that were encountered, discussfactorsthatmaycontributeto for thissafetyissueinvestigation,identifythedatadeficiencies files anddatabases. tity andqualityofsupplementalaccidentdatainaircraft accident safety action,theresults were limitedbyweaknessesinthequan- occupants ofsmallaircraft andthatthere isevidencetosupport vestigation identifiedthatPIFcontinuestopresent agreat riskto been supportedbyanyotherinvestigativemeans.Whilethein- tions, andtheconclusionsrecommendations couldnothave have becomeapparent through individualoccurrence investiga- fire (PIF).Theoverallsignificanceofsmallaircraft PIFwouldnot weighing 5,700kilogramsorless,whichresulted inpost-impact Canada between1976and2002,inclusiveinvolvedaircraft gation (SIIA05-01)into521aviationaccidentsthatoccurred in Board ofCanada(TSB)recently undertookasafetyissueinvesti- portation safety. TheAirBranchoftheTransportation Safety recommendations tomitigatetheconcern,andadvancetrans- conditions inorder toconfirmaparticularsafetyconcern,make currences thatare indicativeofsignificant unsafesituationsor A safetyissueinvestigationexamines multipletransportationoc- 1.1 Safetyissueinvestigation 1.0 Introduction A SafetyIssueInvestigationintoSmall The safetyissueinvestigationreport (SIIA05-01),titled This conference paperwilldescribethemethodologyused • ISASI 2006 ISASI Post-Impact Fire: TheExperience, Techniques, Learned andLessons Aircraft AccidentsAircraft Resulting in experienced inallcategoriesoffixed-wing and Canadian Aviation SafetyBoard in1988.Heis aircraft maintenanceengineerpriortojoiningthe flight instructor, afixed-wingcharterpilot,and an began hisaviationcareer in1971andworkedasa Transportation SafetyBoard ofCanada(TSBC).He Bill Kemp Proceedings By William R. (Bill)Kemp,By William R. SeniorTechnical Investigator, TSBCanada isaseniortechnicalinvestigatorwiththe includingrec- “Post- control optionsavailabletomitigate thoserisks. survivableaccidentsand therisk associated with PIFinotherwise mine theextent to whichsafetydeficienciescontributetotherisks tial query. the numberthathadbeenrecovered from during theini- ASIS were identifiedashavingresulted inPIF. This wasovertenfold Ultimately 521Canadianaccidentsinvolving523smallaircraft tified through useofwords like “backfire” and“exhaust flame.” fire were excluded, aswere non-PIF accidentsthathadbeeniden- to confirmthatPIFhadoccurred. Accidents involvinginflight and finalreports fortheseoccurrences were reviewed oneby isolated approximately 800accidents.Theinitialnotifications words like “burn,”“fire,” “flame,”and“explosion.” Thissearch cally formattedsmallaircraft accidentreports were searched for follow-up, initialnotification summariesandallelectroni- allASIS which, basedoncorporateknowledge,wasstillverylow. Asa PIF accidents.Ahigher-levelqueryidentified86accidents, cated thatPIFhadnotbeenentered asaneventandphaseforall 43 PIFaccidents.Thisnumberwasunexpectedly low, whichindi- the events(fire) revealed andphases(post-impact)fieldsofASIS small aircraft accidents,goingbackto1976.Theinitialqueryof tools suchasFulcrum. tion inthefree-text fieldscanbesearched withtext search Querytools,andinforma- searching thedatafieldswithASIS text fields.Informationcanberetrieved from thedatabaseby Oracle-based systemthatcomprisesbothdatafieldsandfree- pository forallAirBranchaccidentandincidentdata.Itisan istheelectronicdents thathadoccurred inCanada.ASIS re- to determinethenumberofsimilarsmallaircraft PIFacci- databasewasqueried tion SafetyInformationSystem(ASIS) deficiency. fuel systemcrashworthinessstandards asasmallaircraft safety craft occupants,andtheinvestigationidentifiedlackof demonstrated thatPIFcontinuestoposearisksmallair- passenger sustainedfractures andseriousburns.Theaccident tained fatalinjuriesduetothethermaleffectoffire, andthe pact fire ensued,whichdestroyed theaircraft. Thepilotsus- (reference report A00W0109).Anintensefuel-fed,post-im- following takeoff from theCallingLake, Alberta,aerodrome VFR underCARs703airtaxirules,strucktrees andcrashed On May30,2000,aCessna177BCardinal, beingoperated ofeventsleadingtotheinvestigation 1.2 History In lightofthatfinding,theBoard identified aneedtodeter- containedrecordsIn year2000,ASIS ofapproximately 14,000 During theinvestigationintothisaccident,TSBAvia- 2.0 Methodology occurred at night, in a non-airport location, and in instrument meteorological conditions, which often thwarted rescue and 2.1 Literature review firefighting efforts. Li et al. (1999) had noted that general avia- The initial phase of the investigation consisted of a literature re- tion accounts for the majority of aviation crashes and casualties view to determine the extent to which PIF had been addressed by in the United States and that better occupant protection equip- accident investigation agencies and regulators in the past, to evalu- ment, such as air bag and crashworthy fuel systems, were needed ate the success of previous efforts, and, in short, start where other for general aviation aircraft. Bensyl et al. (2001) had concluded people left off. The literature review uncovered a chronicle of that post-impact fire was the strongest predictor of fatality for efforts by accident investigation agencies, regulators, and aca- pilots involved in work-related aircraft crashes in Alaska between demics to identify the risks associated with PIF and to reduce 1990 and 1999, and that fuel systems that could more effectively that risk. The record included special studies, reports, recom- withstand impact forces and keep from igniting in crash condi- mendations, and notices of proposed rulemaking. tions would lessen the number of PIF accidents. As far back as 1971, the Flight Safety Foundation had identified the small aircraft crash fire hazard as one of the critical prob- 2.2 Previous notices of proposed rulemaking lems in flight safety. The study established that if an accident In 1985, the FAA had announced its intent to incorporate air- resulted in fire, there are almost two chances out of three of a worthiness standards for crash-resistant fuel systems into FAR 23 fatality, while without fire the chance of fatality dropped to one in aircraft in an advanced notice of proposed rulemaking (ANPRM). ten. The report concluded that elimination of fire would sub- The purpose of the ANPRM was to solicit public comment re- stantially improve safety (Hoekstra and Huang 1971). garding needed regulatory changes and their costs. In a response Between February 1976 and June 1977, the United States Fed- to the ANPRM, the NTSB reported that about 14% of the fatally eral Aviation Administration (FAA) sponsored a project to dem- injured occupants in fire accidents could have survived had there onstrate the crash performance of light-weight, flexible, crash- been no fire and that about 26% of the seriously injured occu- resistant fuel cells in combination with frangible fuel-line cou- pants in accidents with fire could have been injured less severely DAY THURSDAY—INVESTIGATOR’S plings in fixed-wing aircraft. Three full-scale crash tests were had there been no fire. performed by catapulting Piper Navajo airframes into an earthen The FAA had issued NPRM No. 85-7A, titled 14 CFR Part 23, hill. The report concluded that light-weight, flexible, crash-resis- Airworthiness Standards; Crash-Resistant Fuel Systems in February tant fuel cells used with self-sealing frangible fuel-line couplings 1990. The NPRM had proposed changes to FAA Part 23 airwor- could effectively reduce post-crash fuel fires in general aviation thiness standards to enhance fuel system crash resistance in nor- aircraft equipped with wing tanks (Perella, W.M. 1978). mal, utility, acrobatic, and commuter-category aircraft. The NPRM The United States National Transportation Safety Board focussed on fuel containment during crash conditions and did (NTSB) published a special study in 1980 titled General Aviation not address elimination of crash-induced ignition sources. The Accidents: Postcrash Fires and How to Prevent or Control Them (NTSB- NPRM was withdrawn in December 1999 following review of com- AAS-80-2). The study revealed that PIF occurred in approximately ments received from 17 respondents. The withdrawal notice stated 8% of general aviation accidents. The final report included six that the FAA had completed a revised economic evaluation of recommendations (A-80-90 to A-80-95) aimed at reducing the the safety recommendations as a result of the comments received incidence of PIF. The recommendations called for changes in and concluded that the costs of the proposed changes were not airworthiness regulations, funding for further research and de- justified by the potential benefits. The withdrawal notice also dis- velopment, and assessment of the feasibility of retrofitting exist- cussed the concerns expressed in the comments received, including aircraft. ing the need for a definition of a “survivable” crash, the reliabil- The General Aviation Safety Panel, a committee of knowledge- ity of self-closing devices in fuel lines, the preference for an ob- able volunteers from the general aviation community that was jective test for fuel tanks rather than mandating the use of flexible formed in the early 1980s, had also submitted recommendations bladder tanks, and the inability to apply selective standards based to the FAA. The recommendations proposed requirements to on aircraft types. Since the withdrawal of NPRM 85-7A in 1999, reduce fuel spillage in specified areas of aircraft and for tanks in there had been no tangible action by regulators to address the defined locations to meet specific crashworthiness criteria. The issue of crashworthiness as it related to PIF in small production recommendations also proposed that the FAA investigate addi- fixed-wing aircraft through certification change. tional means to reduce fuel spillage from tanks in general and In contrast, NPRM 90-24, Airworthiness Standards; Crash Resis- prepare an advisory circular to identify acceptable means for com- tant Fuel Systems in Normal and Transport Category Rotorcraft, was pliance with regulations pertaining to fire-resistant fuel systems. issued in 1990. This was essentially the helicopter version of Small aircraft PIF had also been addressed in a number of NPRM 85-7A. NPRM 90-24 proposed to add crash resistant fuel studies by individuals and non-governmental groups. Jennings system (CRFS) design and test criteria to the airworthiness stan- and Mohier (1988) had described how progressive improvements dards for FAR 27 (normal category) and FAR 29 (transport cat- in crash protection technology, including fuel tank placement egory) helicopters. In 1994, after approximately 4 years of delib- and the use of internal rubber fuel bladders, had reduced the eration, the FAA issued the final rule for NPRM 90-24, which incidence of PIF in Indianapolis Motor Speedway accidents, and mandated CRFS standards for newly certified helicopters. This proposed that many of the crashworthiness technological advances was one of the most significant certification improvements in the were directly transferable to aircraft. Li et al. (1996) had studied history of civilian helicopter development. Fuel systems in heli- the epidemiology of aircraft fire in commuter and air taxi crashes copters certified subsequent to 1994 were required to meet drop- and had concluded that aircraft fire was most likely when a crash test criteria and specific load factors, and required design fea-

ISASI 2006 Proceedings • 85 ISASI 2006 PROCEEDINGS 86 conditions that hadcontributedtothefire-related injuries and 28,000-cell Excel spreadsheet toidentify thecommonunsafe tured bymeansoffile-by-file examination andentered intoa Core accidentdatafortheimpact survivablePIFsubsetwere cap- 2.4 Identificationofunsafeconditions thatcontributedtoPIF 35% ofthe231seriousinjuries). 30% ofthe728fatalities)and80fire-related serious injuries(nearly had accountedfor, atminimum,205fire-related fatalities(nearly in 128oftheseaccidents.Theseimpactsurvivableaccidents fied aseitherpartlyorsolelythecauseofdeathserious injury for 129ofthe728fatalities.Fire orsmoke inhalation wasidenti- ties and231seriousinjuries.Causeofdeathwasundetermined from thosethatwere not. sheet, todifferentiate theaccidentsthatwere impactsurvivable were recorded asimpactrelated orfire related onanExcel spread- and/or finalreports. For eachaccident,theinjuriesand fatalities ries, survivorinterviews,investigatornotes,newspaperclippings, serious injurieswere identifiedbyareview ofoccurrence summa- gation statements,and/orregistrations ofdeath.Fire-related death statementsonavailableautopsyreports, coroner investi- uted tofatalitieswasdeterminedsolelybyreference tocause-of- ioned manualdetectivework.Theextent towhichfire contrib- were missingfrom theoccurrence files. coroners across Canadaforhistoricalpathologicalrecords that requests were forwarded tochiefmedicalexaminers andchief spelled name,notbyaccidentdateorlocation.Where necessary, ner records couldonlyberecovered byreference toacorrectly medical examiners andcoroners. Medicalexaminer andcoro- searched to recover themissingnamestofacilitaterequests to not beenrecorded. Inthesecases,newspaperarchives were of reference toinjurydetail,thenamesofpassengersoftenhad incomplete thanflightcrew data.Inadditiontothegenerallack of death,ordetailedinjurydescriptions.Passenger datawere more most notablyduetomissingvictimautopsyreports, registrations incomplete, omittingburnvs.impactinjuryandpathologydata, fatalities, hadbeenrecorded inallcases;however, manyfileswere rence filecouldnotbefound. cess archived paperfiles;inasmallnumberofcasestheoccur- contributed toinjuryandfatality. Requests were submittedtoac- injury andpathologyrecords toidentifyaccidentswhere fire had The next phaseoftheinvestigationconsistedexamination of and pathologydata 2.3 Examinationofavailableinjury been unsuccessful,duetonegativecost-benefitanalysis(CBA). and FAA topromote tenablechangeinsmallaeroplanes had practical wayinnewlycertifiedmodels,pastactionsbytheNTSB While thehelicopterindustryhadaddressed theproblem ina continuing safetyconcernandthattheriskswere well-known. did notaddress retrofitting ofpreviously certifiedhelicopters. walls are required tobeimpactandtearresistant. NPRM90-24 tial ignitionsources, andrigidorsemi-rigidfueltankbladder cated asfarpracticablefrom occupiedareas andfrom poten- deformable structuralattachments.Fuel wasrequired tobelo- tures suchasself-sealingbreakaway couplingsandfrangibleor Collectively, the521PIFaccidentshadresulted in728fatali- The review oftheserecords required alotofgood,old-fash- Tombstone data,includingthenumbersofseriousinjuriesand The literature review confirmedthatsmallaircraft PIFwasa • ISASI 2006 ISASI Proceedings for thistooccur— tion identified fouressentialconditionsthat hadtobeinplace fire orsmoke forsometimefollowingthe impact.Theinvestiga- ries orfatalities,theaircraft occupantswere incloseproximity to In allofthe128accidentswhere PIFcontributedtoserious inju- 2.6 Preparation offinal report andBoard process post-impact fires. using thenewandcomprehensive TSBdatabaseofsmallaircraft forspecificPIFRSMs, tailed cost-benefitanalysismaybewarranted recent empiricalestimates.Thereport alsoconcludedthatade- of astatisticallife(VSL)islowbyaboutfactortworelative to mendable. Theonlyapparent defectisthat$3 millionforvalue analysis generally, andcost-benefitanalysisspecifically, are com- risk control measures (PIFRCMs)intermsoflivessavedCanada. preliminary analysisofthepotentialbenefitspost-impactfire United Statestoassessaviationsafetymeasures andoffered a report reviewed theprocess ofeconomicanalysisfollowedinthe a MaximumCertifiedTakeoff Weight of5,670KilogramsorLess Control OptionsforMitigationofPost-impact Fire RisksforAircraft with port wastitled“ control options thatare availabletomitigatePIFrisks.Theirre- fect ofthatprocess ondecision-makingintheapplicationofrisk aviation economicanalysis,includingCBA,andtoassesstheef- economists were contractedtoexamine thecurrent process of due tonegativeCBA,twoUniversityofAlbertaTransportation In lightofthefindingthatNPRM85-7Ahadbeenwithdrawn 2.5 Reviewofthecost-benefitanalysisforNPRM85-7A limited. poses.” Overall,thePIFdataforClass5occurrences wasextremely for possiblesafetyanalysis,statisticalreporting, orarchival pur- gated; however, dataare recorded “insuitablescopeanddetail occurrences. Bydefinition,Class5occurrences are notinvesti- many smallaircraft occurrences hadbeenrecorded asClass5 sufficient detailtobeofanyuse.Aswell,duringrecent years, such asspeedandangleofimpacthadnotbeenrecorded in adequately documentedoraddressed. Accidentcharacteristics PIF inimpact-survivablesmallaircraft accidentshadnotbeen data necessarytoidentifysafetydeficienciesthatcontribute mon unsafeconditions,itbecameclearthatinmanycasesthe possible combustibles. may haveindicatedseveralpossibleignitionsources orseveral unsafe conditionswere notmutually exclusive; forexample, afile review ofthefiles,andnoaccidentswere reinvestigated. The the unsafeconditionsspreadsheet were gathered entirely from a was unknownifanunsafeconditioncontributed.Thedataon an unsafeconditioncontributed,andthecellwasleftblankifit tion wasdeemednottohavecontributed,a“1”entered where “0” wasentered intheappropriate cellwhere anunsafe condi- THAT A and“FIRESUPPRESSION.” BURNED,”“EGRESS,” spreadsheet: “IGNITION,”“COMBUSTIBLEMATERIALS conditions were grouped underfourbroad categoriesonthe base oroccurrence report. Onehundred tenpotentiallyunsafe dent, asevidencedbythecorresponding occurrence file,data- to atleastonefatalityorseriousinjuryintheassociatedacci- fatalities. Theunsafeconditionscontributedorlikely contributed The report concludedthattheU.S.guidelines oneconomic During theprocess ofreviewing thesubsetfilestorecord com- A ReviewoftheProcess ofEconomicAnalysisintoRisk .” The 1. There was an ignition source in proximity to a combustible vestigation identified similar deficiencies in the investigation and material, such as fuel. documentation of small aircraft PIF accidents in the United States. 2. There was combustible material in close proximity to the occu- A request was forwarded to the NTSB for statistics relating to pants. small aircraft PIF rates and to the number of fatalities where fire 3. Occupant egress was compromised. contributed to death in the United States during the most recent 4. The fire was not suppressed in time to prevent fire-related 10 or more years. Five years of limited data was provided. Be- injuries or fatalities. tween Jan. 1, 1998, and Dec. 31, 2002, there were 1,368 fatal A confidential draft report was prepared and forwarded to accidents involving small aircraft in the United States. The num- major interested parties whose interests may be affected by the ber of PIF accidents was not identified, and the number of fire- report, for comment, and all comments were considered prior to related fatalities could not be fully determined because database final Board approval of the report. files pertaining to PIF accidents had to be researched individually to determine the cause of death, and in many cases no cause 3.0 Databases of death information had been recorded. To the extent that the available data was examined, 9 fatal accidents where fire had 3.1 Data and information caused or contributed to fatalities were identified, and the total The terms “data” and “information” are often used interchange- number of fatalities in those 9 accidents was 16, including one ably; however, database designers assign them distinctly differ- individual who was on the ground near the impact site at the ent meanings. Data are characteristically defined as raw, time of the accident. These results are considered highly conser- unsummerized, and unanalyzed facts, while information is data vative, due to incomplete data. that have been processed into meaningful knowledge. In the con- As recent as 2005, Haden et al. (2005) reported the primary text of safety issue investigations, data from multiple occurrences limitation in their study into the effectiveness of crash-resistant are the raw material for the investigation and information is the fuel systems in civil helicopter accidents was the lack of informa- product, in the form of a report and recommendations. Accident tion in the NTSB database to determine severity of impact. The DAY THURSDAY—INVESTIGATOR’S databases capture both quantitative data, which are represented authors reported that the NTSB database contained little or no mostly by variables recorded numerically, and qualitative data, specific data on injuries sustained by occupants, a lack of data which are represented mostly by variables recorded in text or related to the performance of personal protective systems such imaging form. as seats and restraint systems, and virtually no data related to the type of fuel system or its performance in a crash. 3.2 Other references to data deficiencies in aircraft accident databases Concerns regarding injury and fatality data deficiencies have The literature review turned up numerous references to data been expressed in large aircraft safety studies as well. In 1996 the deficiencies limiting the results of aviation safety studies. The European Transport Safety Council (ETSC) published a report 1971 Flight Safety Foundation report noted that while a consid- that examined ways to improve occupant survivability in acci- erable effort had been devoted to studies of crashworthiness, there dents involving large aircraft, through improvements in occu- was very little specific information in the reports of fatal acci- pant protection, fire survivability, and evacuation. The report dents in general aviation as to the cause of death. The report stated that improving survivability would necessitate comprehen- suggested that more complete and concise reporting would aid sive review of all promising options available to regulators and in developing design changes and improved standards (Hoekstra industry. The report also stated and Huang 1971). In 1987, the FAA published a report titled “Study of General “A fundamental limitation to this process, however, is the lack of ad- Aviation Fire Accidents (1974-1983).” The report described patterns equate accident information from a sufficient number of accidents to of post-impact and inflight fire accidents involving general avia- allow a full cost benefit analysis to be performed. The absence in many tion aircraft and documented the application of various interior accident investigations of detailed information on injury mechanisms materials used in those aircraft. The primary source of accident and cause of death makes the precise estimation of the potential benefits information for the study was the computerized accident data of any one measure very difficult.” system of the NTSB. The report concluded In 2002, Robertson et al. (2002) reported on the results of a “Overall, data regarding general aviation fires was found to be scarce study, funded by the FAA, of transport airplane crash-resistant and often inaccurate. Recent changes in the investigation program of the fuel system (CRFS) technology, and on the efforts that have let to FAA and NTSB promise to improve the collection of data on fires; how- the highly successful military CRFS, which has saved many lives ever, improved computer handling and access processes need to be devel- and reduced the costs of accidents. The following quotation is an oped to ensure the data is not modified during entry and that it is more excerpt from the Executive summary of the report: easily and flexibly accessible.” “A review of the available accident data is of little help in establishing the In 1997, Li and Baker (1997) reported that injuries sustained level of current fuel system crash performance. Although the occurrence from aviation crashes have not been well documented at a na- of fire is reported in accident reports, the number of fatalities caused by tional level and concluded that the full importance of PIF may fire, as opposed to impact, is often not available or is unreliable. The effect be underestimated. of the crash on the fuel system and its components is not reported. Simi- Formal and informal communication with NTSB aviation ac- larly, the reports on structural damage are inadequate to establish crash cident investigators during the course of the PIF safety issue in- vectors, crash forces, structural displacements, and other necessary struc-

ISASI 2006 Proceedings • 87 ISASI 2006 PROCEEDINGS 88 dent andincident datatoberecorded inaconsistent wayand requirements. format tomeettheICAOaccident/incident reporting (ADREP) non-compliant databasescan oftenbetranslatedintotheADREP few databasesare entirely ADREP2000compliant, thedatain standard isADREP2000.Whileitunlikely thatmore thana rent International CivilAviation Organization (ICAO)taxonomy taxonomies forrecording dataas there are databases.Thecur- pendent databases,andthere are probably asmanydifferent Most accidentinvestigationagenciesmaintaintheirown inde- 3.4 Acommontaxonomy taxonomy. enhanced bytheuseofacommon,internationallyrecognized different investigators.Accuracy, reliability andconvenienceare events andphasesmustbecaptured andrecorded uniformlyby tent manner, andrecorded accurately. Qualitativedatasuchas scientific research mustbegathered systematically, inaconsis- quality inorder topreserve confidenceinthedata.Datafor considered indatabasedesign.” gradually expandedoradjustedifneeded;thus,adaptabilityshouldbe maintain andencourageshigher-quality data.Suchadatabasecanbe needed forthetaskathand.Theresulting databaseislessexpensiveto “Ideally, adatabase should bedesignedonlytocollectthedatathatare forward perspectiveondatamanagement— RiskEvaluation(CARE)(1999)providesAirworthiness astraight- cant valueinfuture safetyissueinvestigations. regulators andATC agencies,are unlikely tobeofanysignifi- corded inotherdatabases,suchasthosemaintainedby bases. Basictombstone-typedatathatare identicaltodatare- plicating thestorageofdataalready availableinotherdata- ments like tocollectvolumesofdata,there is littlevalueindu- benefit wastesresources. Aswell,whileitisagiventhatgovern- and store, andstoringlarge amountsofdatafornoeventual inert untilyouhaveaquestion.Dataare expensive toacquire questions willbe10yearsdowntheroad. Dataare essentially pect tohaveanswerinthefuture, andnooneknowswhatthe need tocollectforfuture usedependonthequestionsyouex- the answeriscomplicatedbyacircular dilemma:thedatayou the organizational culture. With regard tolong-termplanning, tions, theinvestigationmethodologiesusedbyagency, and the agency’smandateasdefinedbygoverningactsandregula- answer maybeinfluencedbyanumberofvariables,including cally gathered andstored inorder tomeetthosegoals.The agement goalsandidentifieswhatfactshavetobesystemati- swer tothisquestiondefinesimmediateandlong-termdataman- arefundamental questionis“Why wecollectingdata?”Thean- management isdeterminingwhatrawdataneedtobestored. A The greatest challengetoaccident/incidentdatabasedesignand 3.3 Challengestoaccidentdatabasedesign worthiness technologyanddatacollection.” underscores theneedfortrainingoffieldinvestigatorsinspecificcrash- tural behaviorpatterns.Theinadequacyofcurrent availablecrashdata The useofacommon taxonomy like ADREP2000allowsacci- A secondchallengeismaintainingahighstandard ofdata An excerpt from aFlightSafetyDigestreport onContinuing • ISASI 2006 ISASI Proceedings the prevention ofaccidentsandincidents.” soleobjectiveoftheinvestigationanaccidentorincidentshallbe “The tion. Chapter3paragraph3.1ofAnnex 13states provides guidelinesforaircraft accidentandincidentinvestiga- the basicphilosophyofaccidentinvestigation.ICAOAnnex 13 cits insmallaircraft accidentdatabases.Onekey factormaybe Several factorscontributetocrashworthinessandinjurydatadefi- 3.5 Factors andPIFdatadeficits thatcontribute toinjury data relevant toPIFare provided inTable 1. Problems (ICD),intothesystem. national StatisticalClassificationofDiseasesandRelated Health incorporating arecognized medicaltaxonomy, suchastheInter- fractures andsofttissueinjuries.Thiscouldbeeasilyimproved by standard to record injurydetailssuchastypesandlocationsof One minorshortcomingofADREP2000isthatithasnotaxonomy potential ignitionsources andfire locations,are easilyrecorded. injuries andfatalitiesduetoburns,qualitativedatasuchas cant outlayofresources. Quantitativedatasuchasthenumberof late acredible record ofbasicPIFstatisticaldata,withoutasignifi- taxonomy suchasADREP2000,itwouldbepossibletoaccumu- tal fieldstobecompletedineverycaseofPIF, usingastandard record basicdatarelative toPIF. Byrequiring certainsupplemen- Commission, 2000),thesystemoffersarespectable opportunityto of generatinginappropriate codingremains quitehigh(European plete, especiallyforthepartrelative tohumanfactors,andtherisk has beencriticizedasbeingcomplex andcumbersometocom- human factors.Whiletheclassificationprocess withADREP2000 cluding events,phases,explanatory anddescriptivefactors, 2000 allowsacomprehensive reconstruction ofanaccident,in- field isassignedanidentificationnumber. Thestructure ofADREP filled ineitherbymanualentryorfrom apredefined list.Each for incidentreporting. Systems (ECCAIRS)recently adoptedtheADREP2000taxonomy European Coordination Centre forAviation IncidentReporting mately abetterunderstandingofrepresentative key issues.The solidation ofresources, simplifiedsearch capabilities,andulti- shared worldwidethrough theweb.Otherbenefitsincludecon- far more effectivetoprevent PIFthantorely onpotentialfire gineering improvements toreduce theriskofeventslike PIF. Itis strong bureaucratic reluctance tomandatingcomprehensive en- Yet, despitetheunderstandingthat accidentswilloccur, there isa These defensesare necessarybecauseaccidents are anticipated. trained flightattendantsonlargeairports, andtocarry aircraft. craft rescue andfirefighting services(ARFF) available atlarge systems. There are requirements tofileflightplans,haveair- kits, andtobefittedwithrobust passengerandcargo restraint lators require aircraft ELTs, tocarry survivalgear, and firstaid accident. Infact,aviationaccidentsare expected tooccur. Regu- tion.” Thisconceptonlyworksuptothepointofnext PIF injury, solet’sreduce theriskofPIFthrough accidentpreven- mindset of“prevent theaccidentandyouprevent thefire and tors suchasvehiclecrashworthinessandPIF. Thisinducesthe tential toimprove safetythrough investigationofpost-crashfac- Examples offieldsinADREP2000thatcanbeusedtorecord ADREP 2000containsmore than600datafieldsthatcanbe A possibledrawbackinthislogicisthatitdisregards thepo- supplemental data will be entered. As well, investigators need to be convinced of the long-term benefit to collecting and entering non-essential and non-cause-related data, such as types and mechanisms of injury, in order to buy in. If investigators see little or no connection between the reports they are working on and the data they are expected to enter, in other words the data does not contribute to the reports, they will not be motivated to complete the work. Another factor is that managers, junior investigators, and seasoned investigators all tend to see things differently, which leads to different attitudes and values regarding data entry requirements. Investigators and agencies tend to avoid including details regarding cause of death and injury in final reports due to the sen- sitive and personal nature of the information. As well, while cause of death data is readily available to investigators in the form of autopsy reports and registrations of death, survivor injuries may be difficult to document properly. While the survivors themselves may be able to describe their injuries in general terms, physi- cians prefer not to discuss or release details, due to doctor/pa- tient privilege and privacy concerns. Descriptions and discussions of survivable burn, disfigurement, and amputation injuries in public reports may be particularly upsetting to families of survivors. In some countries it may be illegal to include injury details DAY THURSDAY—INVESTIGATOR’S in public reports without consent by the survivor. When injury information is obtained, it can be technically deidentified by not naming the individual concerned; however, if there were only one or two people on the aircraft, it is easy to connect the injury Table 1 to a specific occupant. Crashworthiness recommendations are weakened without injury details. Because of these complexities, and rescue services when fire occurs. Clearly accident prevention investigators often take the positions that if the injury and fatality takes precedent over any other safety initiative; however, in a information will not be included in the final report, why bother dedicated effort to investigate and make findings solely to pre- to collect and record it in a database. vent re-occurrence, the investigation community may inadvert- One of the reasons for the data deficiencies pertinent to the ently minimize or exclude consideration toward investigating post- PIF safety issue investigation may have been that no one recog- accident survivability issues such as PIF to the extent necessary to nized the importance of collecting PIF information to the de- bring about change. gree necessary to support a safety issue investigation, at the time The second challenge is convincing investigators to obtain and of the individual occurrences were investigated. Other factors may enter supplemental data, such as survival and PIF data, into a include a lack of crashworthiness training for investigators and database. The traditional standard for small aircraft crashwor- mediocre knowledge of medical terminology. thiness investigation is to examine the use of restraints, and report if a shoulder harness was or was not available and was or was 3.6 Sources of bias in the data analysis of SII A05-01 not used. Inflight fires are investigated to the extent possible; In addition to the full contribution of PIF to fatalities and serious PIF on the other hand is accepted as a fact of life. Data entry injuries likely being underestimated in SI A05-01, several sources above and beyond the minimum required to support an indi- of bias likely distorted the record of unsafe conditions associated vidual occurrence investigation is often perceived as a clerical with the accidents in the impact survivable PIF data subset. One job, not an accident investigation job. The priority is writing an potential source of bias relates to the dynamics of PIF. In cases of individual occurrence report that will pass the various levels of extreme fire damage, it is difficult to determine where the fire review. With the “cradle to grave” approach to small aircraft acci- started and how it progressed, due to loss of evidence; hence the dent investigation, whereby the investigators themselves are re- unsafe conditions that were easiest to detect or identify would be sponsible for the investigation, the safety analysis, the report writ- more prevalent, possibly inflating their importance. ing, and the safety action, investigator workload for individual As well, the reference to “did not contribute as an unsafe con- occurrence investigations had increased significantly. One result dition” in the common unsafe condition Excel spreadsheet var- is that investigators are likely to collect more information but ied across unsafe conditions so that the frequencies of “did not tend to input less data into the database. contribute” could not be directly compared to the frequencies of Ease of data entry will also influence data input. A complex, “contributed.” For example, if hydraulic fluid was not the “pri- user unfriendly database that requires significant training, fre- mary combustible,” should spillage or consumption by fire be quent reference to policy manuals, and constant use to maintain designated “contributed” or “did not contribute”? As well, be- data entry skills will be underutilized due to investigator frustra- cause the impact survivable data set had been assembled from tion. The easier it is to enter supplemental data, the more likely many accident records complied over many years by investiga-

ISASI 2006 Proceedings • 89 ISASI 2006 PROCEEDINGS 90 improve information managementproducts, services, andpro- agement System (TIIMS).Thisproject aimstomodernizeand is knownastheTransportation Investigation InformationMan- Safety Team theNTSB,and TSB.TheTSBinitiative (CAST), Aviation IncidentSystem(ECCAIRS),theCommercial Aviation making changesincludethe European Coordination Centre for dent investigationagencies and affiliates.Agenciescurrently data collectionandmanagementwithinamongvarious acci- number ofinitiativesunderwaythatare intendedtoimprove has resulted inanexplosive growth indata.There are currently a Computers provide nearlyunlimitedpower tocollectdata,which 3.7 Initiativestoimprove datacollectionandrecording unsafe conditions. by science,allofwhichcanresult intheidentificationofdifferent all investigatorsare occasionallyguidedmore byintuitionthan are knowntoseethingsdifferently thanjuniorinvestigatorsand currences inthedataset.Furthermore, seasonedinvestigators and itwasnotpossibletoreinvestigate anyoftheindividualoc- That context wasunavailabletothesafetyissueinvestigationteam, the context of theirownperceptions ofsalientunsafeconditions. different investigatorsoveraconsiderableperiodoftime,within manner. Asnotedabove,theoriginaldatawere recorded bymany less likely unsafecondition. the occurrence, thereby inflatingtheapparent prevalence ofthe corded ascontributoryandascribedequalcausallikelihood in tions from eachfamily(ignitionsources inparticular) were re- been present. For manyaccidents,more thanoneunsafecondi- cued tocheckforadditionalunsafeconditionsthatmayhave may underrepresent unsafeconditionsasinvestigatorswere not of investigatorsbythereporting form,ordatasubsequentto1991 an overrepresentation oftheseunsafeconditionsduetopriming extensively reported before 1991.Datapriorto1991mayreflect with PIF, particularlythoserelated toignition sources, were more clined significantly. Consequently, unsafeconditionsassociated and theextent towhichthesetypesofdatawere recorded de- computerscreensASIS replaced theseformsintheearly1990s, area, anddistance from nearest availablefire fightingequipment. information, distanceoccupantshadtomoveclearthefire tible materialsandprobable ignitionsources, fire suppression mented theextent offire damage,theidentificationofcombus- rescue groups, andtheevacuationtime.Fire datafieldsdocu- toxic fumes,theeffectivenessofevacuationassistancebyground data fieldsdocumentedthenumberoffatalitiesfrom burnsand (page 14)andfire data(page15)intheICAOforms.Survival sembled priorto1991,were thepagesdedicatedtosurvivaldata greatest sources ofdataspecifictoPIF, inoccurrence filesas- International CivilAviation Organization (ICAO)definitions.The tained unsafeconditioncheckboxes andtext boxes basedon the completedformstooccurrence file.Thereport formcon- atically recorded core accidentdataonpaperformsandattached Aviation SafetyBoard airaccidentinvestigatorssystem- (CASB) of recording dataonlyonacomputer. Prior to1991,Canadian a paperreport formtorecord basicdatavs.thecurrent practice applicable. indicated thatitscontributionwasunknownoritnot tors, theabsenceofdataregarding an unsafeconditionmayhave Finally, theavailabledatawere notcollectedinaconsistent A third potentialsource ofbiasistheformerpracticeusing • ISASI 2006 ISASI Proceedings in foureasysteps: answerquestionstofill out theappropriate are similartoincometaxsoftware programs, whereby dataisfiled in thefuture, tobestidentifyrelevant data. challenge ispredicting whatquestionswillneed tobeaddressed maintain ahighlevelofconfidence inthedata.Onesignificant required dataandtoimplementquality assurance procedures, to is alsoaneedtostandardize methodstosystematicallycollectthe tigations andtosetprioritiesonthecollectionofthatdata. There tal dataneedstobecollectedsupportfuture safetyissueinves- tionally, toexamine waystoprioritizewhatbasicandsupplemen- for accidentinvestigationagencies,bothnationallyandinterna- base systemlike ADREP2000foreveryaccident. There isaneed defined goals.Itisimpossibletofilloutall600fieldsina data- with theneedtodecidewhatdataneedsbecollected meet The greatest opportunityforimprovement indatacollectionrests 4.2 Suggestionsforimprovement collection. in thehistoricaldatabase,duetoshorterperiodofdata occurrence datasetswillbesmaller, compared tothenumber disadvantage isthatthenumberofoccurrences inthemultiple the collecteddata;thiswillresult instronger safetyaction.The methodology shouldresult inahighdegree ofconfidencein standard specifictoeachindividualsafetyissue.Following this a definedperiodoftime,bytheapplicationaninvestigation allows specifieddatatobegathered inaconsistentmanner, over oughly duringfuture individualoccurrence investigations.This issue onakey issueslist,andtheninvestigatethatissuethor- based onanalysisofpreviously acquired data,placethatsafety able data. is entirely dependentonthetype, qualityandofavail- report andanyaccompanyingrecommendations byregulators, that hasfollowedthismethodology, includingacceptanceofthe the filereview. Thesafetyimpactofaissue investigation gate pastoccurrences toanswerquestionsthatcome upduring there wasnoopportunityto revisit accidentsitesorreinvesti- data. Thisapproach isentirely retrospective innature; hence cally review, record andanalyzepreviously acquired accident The approach tothissafetyissueinvestigationwassystemati- 4.1 Safetyissueinvestigationmethodology 4.0 Discussion data collection. cess isnotuserfriendly, thethere willbelittleimprovement in investigations isnotidentifiedorjustified,ifadataentrypro- ment toenterspecificsupplementaldataforuseinsafetyissue still needtobeprioritized,gathered, andentered. Iftherequire- data necessarytosupportfuture safetyissueinvestigationswill changed. Theyare simplylinked toTIIMS.Thesupplemental ever, asthemodalaccidentinvestigationdatabasesremain un- the inputofrawquantitativeandqualitativeaccidentdata,how- information requests mucheasier. Itwillnotnecessarilyimprove ernment andwillmake dataretrieval forsuchthingsasaccessto trative requirements forrecord keeping withinthefederalgov- ductivity toolswithintheagency. TIIMSwill meettheadminis- There may bebenefitstodevelopingdatabaseprograms that The idealmethodologymaybeacombinationofthetwo. An alternativeapproach istoidentifyapotentialsafetyissue fields, have the software review the inputs for errors, correct the able, the significance of further PIF investigation is diminished. If errors, and file the data. A system like this provides a built-in it is determined that the accident was impact survivable, then it is quality control. necessary to ascertain and document the unsafe conditions that A third possibility for improving documentation and data col- contributed to PIF. Survivor and bystander testimony can be ex- lection, especially for secondary issues such as small aircraft PIF, tremely helpful to identify the source and propagation pattern of may be to return to paper-based recording of certain supple- the fire. Record the type and amount of fuel on board the aircraft, mental data in the field, then scan the recorded data field into the location of fuel relative to the location of each occupant, po- the electronic database using optical character recognition (OCR) tential sources of fuel spillage and ignition, the wind and tempera- software. The potential for improved data collection is evidenced ture conditions, and the effectiveness of emergency response. As by the fact that during this safety issue investigation, significantly PIF occurs in approximately 4% of small aircraft accidents, this more data was gathered from a review of the pre-1991 ICAO- process to document PIF factors should be required in only about based paper forms, compared to the post-1991 ASIS records. four percent of overall accidents. There are a number of advantages to utilizing hard-copy forms to collect core accident data. The use of a paper format makes 5.0 Analysis life easier in the field. Paper documents are easily portable, they By examining multiple aviation occurrences that have similar serve as a field checklist, and they provide a basis for consistency characteristics, accident investigation agencies may identify com- in data gathering. The use of a standardized format results in binations of safety deficiencies or unsafe conditions that would data being gathered in a consistent manner and with reference not be apparent through individual occurrence investigation and to a standard taxonomy. During the course of this investigation, analysis. Whereas an individual occurrence investigation concen- it was determined that the ASIS screens containing fields for trates largely on gathering new data that is associated with the supplemental PIF data, for the majority of occurrences, had not occurrence, a safety issue investigation depends largely on data been utilized sufficiently to provide any useful documentation in that already exists. Safety issue investigations can provide strong the PIF project. As a result, investigators required an inordinate support for recommendations that may not be otherwise pos- DAY THURSDAY—INVESTIGATOR’S amount of time to identify the accidents that had resulted in PIF sible and are a reliable source of data for cost-benefit analysis. to determine the number of fire-related injuries and fatalities There is a safety implication concerning the quality of data avail- and to identify the common unsafe conditions that contributed able for cost-benefit analysis: conservative or inferior data can to those PIF accidents where fire-related injuries and fatalities negatively bias the result, which precludes safety action. No orga- occurred. The history of incomplete ASIS PIF data entries con- nizations are better suited to collect and record this data than stituted a corporate safety deficiency. accident investigation agencies that have complete and timely Universal acceptance of the ADREP 2000 taxonomy system as access to the data, and there is no better time to acquire the data the standard for database management would go a long way to than during investigations into individual occurrences. improving data collection. A “most wanted fields” list, based on The objectives of the PIF safety issue investigation were to de- the safety issues of greatest importance, would help to prioritize termine the extent of fire-related injuries and fatalities in 521 and manage the data input workload and reduce the probability PIF accidents, identify the common unsafe conditions that con- of accumulating insignificant data. Sharing of standardized da- tribute to PIF, and identify the control options for mitigating the tabases via the Internet may also be easily facilitated by use of a risks associated with this type of occurrence. The data that were standard taxonomy. essential for this investigation were data that pertained to post- impact aspects of the accident, rather than data that had been 4.3 A straightforward approach to the documentation of PIF accumulated to make findings as to the cause and contributing Useful small aircraft PIF data can be collected and recorded with factors. The data collected and analyzed indicated that there is a minimal outlay of resources. Documentation of PIF begins by en- significant risk for PIF and fire-related injuries and fatalities in tering PIF as a phase and event in the electronic database, and by small aircraft accidents and that past attempts to change certifi- stating in the initial notification summary and the final report that cation requirements had been unsuccessful. The fact that the PIF occurred. Where PIF has occurred, it is necessary to deter- NTSB had reported in 1980 that about 14% of the fatally injured mine if the accident was impact survivable. A PIF accident is clearly occupants in fire accidents could have survived had there been impact-survivable if there are survivors; in this case, record the no fire, and that about 26% of the seriously injured occupants in extent of burn injuries. Where fatalities have occurred, it is impor- accidents with fire could have been injured less severely had there tant to communicate directly with the responsible coroner or medi- been no fire, while corresponding TSB figures are 30% and 35%, cal examiner as pathologists are not necessarily aviation experts. A indicates a weakness in the earlier data. The data weakness may coroner or medical examiner will be required to determine the have contributed to the cost-benefit analysis (CBA) conclusions cause of death in every case of accidental or unexpected death. to disregard the safety action proposed in NPRM 85-7A. The pathologist’s opinion of the medical cause of death is based There are at least three lessons to be learned from this safety on the pathological examination. Where PIF has occurred, a thor- issue investigation. Lesson one is that while tools are in place to ough post-mortem examination of all fatally injured occupants, to record critical supplemental accident data, such as injury and the level permitted by the nature of the remains, is necessary to survival data, that data had often not been recorded in sufficient differentiate fire-and impact-related deaths with certainty. A full quantity or quality, especially in the electronic database, to be of autopsy may not required to determine cause of death; however, value. This concern has been raised in numerous other safety body X-rays should always be performed to identify patterns of studies. Lesson two is that the safety deficiencies that contribute skeletal trauma. In cases where the impact was clearly not surviv- to PIF in otherwise survivable small aircraft accidents had also

ISASI 2006 Proceedings • 91 ISASI 2006 PROCEEDINGS 92 tigation agenciestoidentifysafety deficienciesandmake recom- supplemental accidentdatareduces theabilityofaccidentinves- widespread thancurrently recognized. Weak andincomplete quality inaircraft accidentdatabases.Theproblem may bemore This PIFsafetyissueinvestigationexposed weaknessesindata 6.0 Conclusions management. issue investigationscanonlybeachievedthrough improved data safety issueinvestigations,weneedtherightdata.Successin safety vidual occurrence investigations anddedicatemore resources to of identifyingcausesandcontributingfactorsbasedonlyon indi- to beexplored. Inorder tomoveawayfrom thetraditionalmindset benefits ofmultipleoccurrence safetyissueinvestigationsneed of individualoccurrence investigations are diminishingandthe We mayhavereached apointinthatevolutionwhere thebenefits stantly evolvingasnewchallengesandtechnologiesappear. tigations andsafetyrecommendations. portant tootherswhentheycanuseitsupporttheirowninves- can beturnedintohelpfulinformation.Thatdatabecomesim- also clear:dataisonlyusefulifitavailableinadatabaseand to advancesafety. Themessageformanagersandinvestigatorsis output endofthedataspectrumanddiminishesopportunity the wrong data;eitherwaywastesresources ateithertheinputor makes iteasytocollectinsufficientamountsofdataortoomuch not necessarilybetter. Thespecificnature ofaccidentinvestigation required tocataloguedataisnot.Datarelevance isthekey; more is technology problem. Computertechnologyischeap;themanpower data isamanagementproblem, notahardware orsoftware ishes theopportunitytoadvancesafety. too muchofthewrong data,whichwastesresources anddimin- specific nature ofaccidentinvestigationmakes it easytocollect lection, andtolookatbetterwayscollecttherightdata.The community tobecomeinvolvedinsettingprioritiesfordatacol- tional implications;thus,there isaneedfortheinternational taxonomy are available.SafetyissuessuchasPIFhaveinterna- right high-qualitydata.Thetoolssuchashardware, software, and vivability, itismore importantthanevertocollectandrecord the cially inthearea ofengineeringimprovements toenhancesur- further changesare necessarytoimprove aviationsafety, espe- becoming more andmore difficulttoconvinceregulators that the successofasafetyissueinvestigation.Attimewhenitis investigations; therefore, dataqualityandquantityare criticalto lowing alternatemethodologies. ously acquired data,andimplythatthere are advantagestofol- comings tobasingasafetyissueinvestigationonlimited,previ- pact-survivable PIFaccidentset.Alloftheselessonsidentifyshort- distorted therecord ofunsafeconditionsassociatedwiththeim- several sources ofdatabiasintheanalysis,whichmayhave exist orwere inadequate.Lessonnumberthree isthatthere were or prevent theproblem ofincompletedataentrieseitherdidnot This indicatesthattheadministrativedefensestolimit,reduce, not beenwellrecorded intheelectronic databaseinthepast. As withallenterprises,aviationaccidentinvestigationiscon- The messageforaccidentinvestigationagenciesisclear:weak Multiple occurrence dataare therawmaterialforsafetyissue • ISASI 2006 ISASI Proceedings Federal Aviation Administration(1999),14 CFRPart 23,Airworthiness Federal Aviation Administration(1990),14 CFRPart 23,Airworthiness European Commission(2000),JointResearch Centre, “Annual report European Transport Safety Council(1996),“Increasing theSurvivalRate Enders, JohnH.,Robert S.Dodd,andFrank Fickeisen (1999),“Continuing Moran,andGeorgeBensyl, DianaM.,Katherine A.Conway(2001), ICAO ADREP2000Taxonomy (2006),http://eccairs-www.jrc.it/Support/ References/Bibliography Robertson, S.H.,N.B.Johnson,D.S.Hall,andI.J.Rimson (2002),“A Study Perella, W.M. (1978),“Tests ofCrashResistant Fuel SystemforGeneral National Transportation SafetyBoard (1980),SpecialStudy: General Ludwig, Benner, Jr., Richard Clarke, andRussellLawton(1987),“Studyof Lindsey, andD.S.West R., (2003),“A Review ofTheProcess OfEconomic Li, G,andS.PBaker (1999),“Correlates ofPilot Fatality inGeneral Li, G.,S.P. Baker, EpidemiologyofAircraft Dodd(1996),“The andR.S. Jennings, R.T., Mohler(1988)“Potential andS.R. Crashworthiness Hoekstra, Harold D.,andShung-ChaiHuang(1971), Haden, M.S.,D.F. Chen,andS.P. Shanahan,L-H Baker (2005),“Crash mote theseinitiatives. maybeabletopro- Society ofAirSafetyInvestigators(ISASI) gest practicalimprovements. ThemembersoftheInternational ciencies are constrainingoverallsafetyimprovement andtosug- identify theextent towhichaccidentinvestigationdatabasedefi- ternational level.Additionalanalyticalstudiesare necessaryto port future issue-basedsafetyinvestigationsatacollaborativein- method ofsystematicallycollectingthedatatoeffectivelysup- lected, setprioritiesoncollectionofthatdata,andstandardize a to prioritizewhatbasicandsupplementaldataneedsbecol- There isaneedfortheinternationalcommunitytoexamine ways ability ofregulators toconductaccuratecost-benefitanalyses. in supplementalinjuryandfatalitydataalsocompromise the greater riskfortherecurrence ofsimilaraccidents.Deficiencies mendations andultimatelyplacestheaviationcommunityat rulemaking; withdrawal, Standards; Crash-Resistant Fuel Systems;Notice ofproposed 55(40), February 28. Standards: Crash-Resistant Fuel Systems;Proposed rule, 2000,” http://humanfactors.jrc.it/ar_2000.htm. in Aircraft Accidents,”http://www.etsc.be/oldsite/survival.pdf. Digest RiskEvaluation(CARE):anexploratoryAirworthiness study,” 1042. Alaska, 1990-1999,”AmericanJournalofEpidemiology, 154(11),1037- “Factors AssociatedwithPilot Fatality inWork-Related Aircraft Crashes, Downloads/Files/Documentation/Release40Taxonomy/R4LDICAO.pdf. Department ofTransportation, Federal Aviation Administration,March. AR-01/82, NSA/CR-2002-211437, Final report prepared forU.S. of Transport AirplaneCrash-Resistant Fuel Systems,”report DOT/FAA/ U.S. DepartmentofTransportation, Federal Aviation Administration. Aviation,” report numberFAA-RD-78-28, interimreport prepared for Washington,Them, NTSB-AAS-80-2, D.C. Aviation Accidents:Postcrash Fires andHowtoPrevent orControl Transportation, Federal Aviation Administration,February. FAA /CT-86 /24,finalreport prepared forU.S.Departmentof General Aviation Fire Accidents(1974-1983),”report numberDOT/ Canada, March 14,2003. Kilograms orLess,”Paper prepared forTransportation SafetyBoard of Risks forAircraft withaMaximumCertifiedTakeoff Weight of5,670 Analysis intoRiskControl OptionsforMitigationffPost-Impact Fire 305-309. Aviation Crashes,” mental Medicine, Fire inCommuterandAirTaxi Crashes,” Technology,” Benefits toGeneralAviation from IndianapolisMotorSpeedway tion Aviation, Space,andEnvironmental Medicine Resistant Fuel SystemEffectivenessinCivilHelicopterCrashes,” , 1 , FlightSafetyFoundation, 18(9-10),September-October, 1-51. st edition,FlightSafetyFoundation, Inc.,Arlington,Virginia, USA. Aviation, Space,andEnvironmental Medicine 67(5),434-437. Aviation, Science,andEnvironmental Medicine ◆ Federal Register , 65(250),December30. Aviation, SpaceandEnviron- , 76(8),782-785. Safety inGeneralAvia- , January, 67-73. Federal Register Flight Safety , 70(4), , Investigation into Turbulence-Related Accidents By Gary R. Morphew, Director, Aircraft Accident Investigation, Southern California Safety Institute Background he felt there was little or no sense of “urgency” in the warning. As an instructor and as an aircraft accident investigator, I have • Ten minutes after the captain had warned the flight attendants, been trying to review all kinds of accident reports in order to the aircraft encountered turbulence severe enough for the unre- improve my own knowledge and pass on meaningful investiga- strained flight attendant in the rear of the aircraft to be thrown tion techniques to my students. down with sufficient force to break his leg. When I became an investigator, as a pilot, I understood fully By this time I was formulating my own findings, causes, and the scrutiny that would be placed on the pilot flying the aircraft recommendations for the report (a practice I have for evaluating as well as the crew’s interaction during the events that followed. all investigations). Imagine my surprise when I read the following: By fully exploring the pilot’s actions and inactions, we have, over The NTSB probable cause was stated as “an inadvertent en- the years, improved training, perceptions, and communication, counter with turbulence.” Given the circumstances I have de- and this has resulted in a reduction in the accident rate. We have scribed, what was “inadvertent” about the encounter? moved far beyond “pilot error” and have found many factors • The captain gave the warning in a timely manner. that lead to the error in the first place. • The lead flight attendant passed on at least the substance, if Until I joined SCSI, however, I had not spent too much time not the urgency, of the warning. DAY THURSDAY—INVESTIGATOR’S looking into the role of the flight attendant other than as a valu- • The lead flight attendant was reportedly “unaware” of the sta- able member of the crew during evacuations and emergencies. tus of the other flight attendants. Now, with my association with the annual International Aircraft It was not “inadvertent,” it was expected. The actions by the Cabin Safety Symposium, I have a different appreciation and, to flight crew were appropriate, the actions in the cabin were sus- be honest, some concerns over the analysis of the flight attendant’s pect. There must be more to the story. role in reported accidents. I continued reading the report looking for additional infor- In the summer of 2005, I was reading a synopsis of an NTSB mation about the flight attendants. I wanted to understand the investigation report involving an encounter with turbulence and experience of both the lead and the injured flight attendants. a serious injury to the flight attendant on board. Nothing in par- When I evaluate a pilot’s role in an event, his or her experience ticular was revealing in the synopsis until I got to the statement overall and in the specific aircraft is critical to understanding the of probable cause. There I found a need to review the full report. decisions and reactions to events. I was sorely disappointed. Noth- The more I read, the more I became concerned that the point of ing at all was listed. the investigation had been missed by the NTSB investigator. Further, when I got to the part of the report that indicated who This concern was based on the following “assisted” in the investigation, only the legally required FAA rep- • The aircraft’s captain understood the potential for an encoun- resentative was identified. I was surprised that the flight atten- ter with turbulence severe enough to call the lead flight attendant union was not represented. dant and told her to expect turbulence on arrival. The discussion I immediately contacted some of my friends in the union. They between them evolved into a decision to complete all the pre- put me in contact with the specific airline’s flight attendant safety landing “final” cabin preparations early and to be seated. representative and we discussed the event. From the union, I • The lead flight attendant notified the other flight attendants, understood that since this was a “tabletop” investigation, one not completed her portion of the prelanding preparation, and took actually involving face-to-face cooperation between the investi- her seat. The report indicated that the lead flight attendant was gators, the IIC determined that the union’s participation was not from this point “unaware” of the status of the flight attendants at required and denied their petition to participate. Not only that, the rear of the aircraft. One of these flight attendants reported I found out that in contrast to the NTSB report, the airline does not utilize a lead flight attendant as a designated, assigned, crew Gary Morphew is the director of the Aircraft position! Apparently, airline management determined that if it Accident Investigation for the Southern California designated a crewmember to have the specific responsibility as Safety Institute. Prior to joining SCSI, he was a lead, it would necessarily have to compensate them for the addi- career officer and pilot in the United States Air Force. tional responsibility. While in the Air Force, he held numerous safety To further my consternation, I learned that the senior flight positions including an assignment at the USAF attendants, who are able to pick their routes and assignments, Safety Center where he was the USAF at-large choose not to occupy the lead position since they would not be investigator. He also consulted with numerous aircraft mishap compensated for it and they, therefore, did not want the respon- investigation boards as a human factors investigator. He has been a sibility. Consequently, the position fell to the more junior flight member of ISASI since 1983 and is currently the president of the attendants who were left that “seat” to assume the communica- Rocky Mountain Regional Chapter. tion and coordination responsibility.

ISASI 2006 Proceedings • 93 ISASI 2006 PROCEEDINGS 94 alone! Infact,in nearlyone-halfofthesecases, theNTSBdeter- (45) ofthereported accidentswere attributedtothe turbulence led metothisresearch Three-quarters wasnotanaberration. tion and,eventually, changetheconditionsfaced. in theNTSBreports, itisincreasingly difficulttoshare informa- the-job injuries.Butwithout the formalidentificationoffactors safety staffwouldhavepaidagreat dealofattentiontotheseon- not conductitsowninvestigationintotheevent.Ibelieve the able membersoftheinvestigationhadbeenexcluded. had received earlierthattheinclusionofthesepotentiallyvalu- investigation. Thislentcredence totheinformal observation I organization (orunion)was listedasparticipatingintheNTSB ports, Ifoundonlytwocases(3.3%)inwhichtheflightattendant to whentheperceived dangerhaspassed. mally donotincludeanycommunicationfrom theflightdeckas policiesnor- significant whenyoufactorinthattheaircarrier termined onhisorherownwhentoresume cabinduties.Thisis in three ofthesefourcases,theinjured flightattendanthadde- ever, indicatedwhencausewasattributedtotheflightattendant, found thistobeaverysurprisingnumber. Closeranalysis,how- were deficientanddescribedintheprobable causestatement.I find thattheactionsorinactionsofinjured flightattendant flight attendants,whentheywere present. deck, theleadflightattendantpassedonwarningtoother most ofthecases(36.7%)where awarning wasissuedbytheflight the flightattendantreceives thewarningfrom the flightdeck?In to bebeyondthenormalcautionarylevels.Sowhathappenswhen warning fortheFAs tobeseatedastheturbulencewasexpected fastened. the passengershavebeenadvisedtoremain seatedwithseatbelts dants mustaccomplishduringthenormaloperatingperiodswhen ever, weallrecognize thatthere are manydutiesthatflightatten- indicating ananticipationofsomedegree ofturbulence.How- fact, inonly7reports (11.7%)were there onlypassengerinjuries. craft wasundamagedandthere were fewpassengerinjuries.In injuries were, infact,thereason fortheinvestigationasair- dants reportedly injured. In53cases(88.3%)ofthereports, their riod. Intheseinvestigations,there were some88flightatten- turbulence tobecursorytheaccidentitself. database search foundtheword “turbulence,”butIfoundthe as theprimaryevent.There were severalreports inwhichthe that, afterreview, didnotinvolveanencounterwithturbulence cause aspartofmyinvestigation.Finally, Iculledoutanyreports mary availableasIdecidedneededtoevaluatetheprobable In addition,Ideletedthosereports thathadonlythefactualsum- all thosereports thatwere inthepreliminary investigationstage. From thislistingofsome86reported accidents,Ieliminatedfirst accident reports involvingturbulenceintheyears2000-2005. orjustindicativeofthe“norm.” investigation wasanaberration I decidedtoconductmyownresearch todiscoverwhetherthis Data extraction/analysis Even more surprising,Iconfirmedthattheinitialreport that Now, Iamnotsayingthattheuniondidcare northatitdid Most significantlytomyreview wasthefactthatof60re- In thefinalanalysis,inonlyfourcases(6.7%)didNTSB In 28accidents(46.7%),however, theflightdeckhaspasseda I foundthatinmostcases,(81.7%)the“seatbelt”lightwason This leftsome60accidentinvestigationreports forthepe- Using theNTSBaccidentdatabase,Iextracted allaircarrier • ISASI 2006 ISASI Proceedings injured? vestigation, the IICdidnotknowwhich flight attendantwas person asthe“undetermined crewmember.” Evenafterthein- resting withtheflightattendant,NTSBreferred tothethis probable causestatement,whichidentifiedthe probable cause erate thesame?Ithinknot. In fact,inonereport alonginthe tion. There isnodiscussion todefinethese.Doallairlinesop- flects nothingaboutthedutiesandresponsibilities oftheposi- warned ofturbulenceahead. concerning turbulenceavoidanceorsecuringthecabin when flight attendantprocedures corporatepolicies ortheaircarrier’s that noneofthereports Ireviewed had anydiscussionofthe Further, there wasneveradiscussionabouttraining. Ialsofound union participating,nocauseorcontributingfactoreversurfaced. that ineachinvestigationactuallyhadtheflightattendant there probably wassomeconsiderationtoit. Itwasinteresting flight attendantactionsorresponsibilities. Insomecases,Ifeel no ideawhethertheinvestigator-in-charge actuallyevaluatedthe Let meaddress myperceived inadequacyofthereports. Ihave Investigation reports prevention process. rately identifythetruecausefactorsisessentialtoaccident factors andcrew resource management,thenecessitytoaccu- ever, inmyexperience inaircraft accidentinvestigation,human our statedpolicy, thatIamnotputting“blame”onanyone.How- cabin. cure seat-beltedpositiontoattendaperceived anomalyinthe The flightattendantunderstoodthedangerbutlefttheirse- • and/or continued routine cabindutiesinsteadofsecuringthemselves; Theflightattendantheard andunderstoodthewarning,but • adequately; The leadflightattendantfailedtocommunicatethewarning • dant failedtounderstandthegravityofexpected turbulence; Theflightattendantwhowasinjured ortheleadflightatten- • flight attendantactionsorinactions. investigations, atleast12accidents(20%)were adirect result of FAs ofthedanger. probable causeshared withaleadFA’s failure towarntheother claimed theseatbelthadnotworked. Inonlyonecasewasthe to attendacabinduty, andinanother, theflightattendant dants. Intwo,theinjured flightattendant removed theseatbelt probable causerested atleastpartiallywithoneofflightatten- each ofwhomfailedtorelay hazardous weatherinformation. with others—oneadispatcher, theotheranairtrafficcontroller— vertent” entryintoturbulence. or failure todeviatefrom knownweather, oreventheir“inad- actions oftheflightcrew, eitherinthefailure toissueawarning, the accident. expected, orunforecast” andthatthiswastheprimarycauseof mined thattheencounterwithturbulencewas“inadvertent,un- Common terminology, such astheleadflightattendant,re- It really shouldbeunderstoodatthisjuncture, inkeeping with In these12cases,Ifeltthecausefactorsincluded However, ofallthe inmyopinion,basedonthenarratives Again, theNTSBfoundonlyfouraccidents(6.7%)where the In twoinvestigations,theNTSBfoundprobable causerested In one-fifth(12)ofthecases,NTSBfoundcausewith Recommendations translates into advances. Air carriers are in budgetary crisis and So what do I feel must be done? First and foremost, the flight that is well understood. Savings based on compromise of safety attendant unions must attempt to participate in every investiga- will never be returned when occurrences turn into incidents, or tion involving an injury to one of their members. This may put a incidents become accidents. real burden on the safety staff, but the safety representatives as- If there is a lead position, it should have expected responsibili- sociated with the airline can assist. If the NTSB denies participa- ties. If training and experience factor into the appointment of tion, this fact must be documented and if it becomes a trend, a those assigned lead positions, then compensation must naturally communication to the chairman of the NTSB regarding this must follow. be made, and, if necessary, made public. I have been involved in aviation for more than 40 years and in Next, the actions and inactions of all affected flight attendants aviation safety for nearly 30; I know that investigations must be must be evaluated. Even when the flightdeck crew’s actions are thorough and accurate if any meaningful changes are to be made. not suspect, their flying time, years qualified as a pilot, and their We have got to move beyond the detailed documentation of just duties as instructor, check airman, etc., are identified. The only the flightdeck personnel. When the reporting forms call only for time I saw a discussion regarding the flight attendants outside documenting the pilots, it is not surprising that this is all we get. the aircraft referred only to where the flight attendants were do- If the investigation does document the experience and training miciled! The duties and responsibilities of those placed in critical of all crew members involved, but it is not reported, the aviation positions must be evaluated and deficiencies identified. community which relies of the exchange of information in order Additionally, if clear and unambiguous terms have not yet been to see trends and effect change is denied the opportunity to learn developed, there should be a specific phraseology agreed upon from other’s accidents. that conveys the urgency and the danger of an anticipated en- Of course, detailed investigation and reporting into the actions counter. If time is available, something to the effect of “Clean up or inactions of flight attendants during turbulence events as well the cabin then be seated” should be used. If insufficient time is as other cabin-related safety duties will bring deficiencies to public available to clear the cabin, some phrase like “Sit Down, Now!” notice. That being said, it is time for the cabin crew to experience DAY THURSDAY—INVESTIGATOR’S should be used. Also, there should be equally clear communica- the gains that full and accurate reporting has meant for the pi- tion as to when the danger is down to an acceptable level; “All lots—even when it is painful to have it identified. Positive changes Clear or Resume Duties” comes to mind. will come about. It may be embarrassing, it may be difficult to Finally, The role of the lead flight attendant should be clearly accept at times, but the benefits will eventually come about. defined and experience should count! If air carriers have not yet Lastly, while my research dealt with only investigations con- decided that leadership extends to activities on the passenger ducted by the United States National Transportation Safety Board, side of the cockpit door, then they truly do not understand the I think an analysis of all governmental investigations would dem- lessons learned in more than 100 years of aviation. In any opera- onstrate that my observations are not unique to the NTSB or the tion that deals with the safety of flight, experience and training United States. ◆

ISASI 2006 Proceedings • 95 ISASI 2006 PROCEEDINGS with theU.S.National Transportation Safety Board. CoreySafety ofUnitedAirlinesand hasalsoworkedinthe Department Implementation MonitoringData AnalysisTeam (CAST–JIMDAT). an ALPA representative totheCommercial Aviation SafetyTeam–Joint CommonTaxonomyCAST/ICAO Team as (CICTT),andhealsoserves expertise oninternationalaccidents. Corey co-chairofthe istheindustry tional Federation ofAir Line Pilots Associations (IFALPA) withtechnical accidents intheUSAandCanada.HehasalsoassistedInterna- in 2005foroutstandingachievementscollegiateaviationsafety. was awarded theUniversityAviationAward AssociationJohnK.Lauber courses inaviationmanagementandaircraft accident investigation.He and alsoattendedtheUniversityofSouthernCalifornia(USC),taking prevention counselor. HeisagraduateoftheUniversityNorthDakota certificates andassociatedratingsanFAA-appointed accident (DPE) forprivatethrough airlinetransportpilotandflightinstructor 96 Confucius, I hearandforget. Iseeandremember. Idoandunderstand. Introduction The manufacturer istheexpert ondesign,systems,andperfor- as wellbeingfamiliarwithcompanypolicyandprocedures. tion bringssomeonewhoistyperatedandcurrent intheaircraft bring technicalexpertise toaninvestigation.Thepilots’associa- keep upthatsameleveloftraining.Parties intheUnitedStates can bedifficultforotherpartiesthatsupportaninvestigationto cies are abletokeep theirinvestigatorstrainedand“current,” it prepared andproperly trained.Whilemostinvestigativeagen- dents; but,ifthere were one,everyonewouldshowupcompletely By DanaSiewert,Director ofAviation Safety, UNDAerospace, UniversityofNorthDakota, andCorey Stephens, Polishing theAppleandInvestigator In anidealworldwewouldn’t haveaircraft accidentsorinci- • ISASI 2006 ISASI Senior StaffEngineer, Engineering&AccidentInvestigationSection,AirLinePilots Association,Int’l Chinese philosopherandreformer (551BC-479BC) —Examining theImportanceof nated Federal Aviation Administrationpilotexaminer engine seaandhelicopter. Mr. Siewertisalsoadesig- engine aircraft withcommercial privilegesinsingle- transport pilotcertificateinbothsingleandmulti- than 9,000flighthours,heistheholderofanairline Safety attheUniversityofNorthDakota.With more Dana Siewert has beenwithALPA for9yearsandhasworkedon ALPA’s course.Corey accident investigation advanced investigation activity, andheisthestaffleadfor duties includeparticipatinginallofALPA’s accident Pilots Association, International (ALPA). Hiscurrent Engineering &AirSafetyDepartmentoftheLine Corey Stephens Proceedings Investigator EducationPrior is presentlydirector the ofAviation is a senior staff engineer withthe engineer isasenior staff To anInvestigation regular review, aninvestigator’s skillsmaybecomestale. dents inNorth Americaare veryinfrequent. Without practiceor as theCommercial Aviation Safety Team acci- aircarrier (CAST), investigations. With improvements insafetyandinitiativessuch little busierandinvestigators couldparticipateintwoorthree wereserious incidentinthefield. Someyears,somecarriers a to completeinitialtraining and workatleastoneaccidentor busier yearsinthepast,itwasnotuncommonforaninvestigator allow investigatorstobuildupormaintainfieldexperience. In no fatalities.Whilethelowaccidentrateiswonderful,itdoesn’t phone ore-mail,workingsmallereventsthatnormallyinvolve parties thatsupportaninvestigationdomuchoftheirwork by have kept mostorganizations “outofthefield.”Recently, most in everyinvestigation.Lowaccidentratesoverthelastfew years parties thatsupportaninvestigationnormallydon’t participate experience workinginthefield.Unlike theinvestigativeagency, a core group ofinvestigators whoare trainedandhave built up “stale” ifnotpracticedregularly. Mostinvestigativeagencies have tor—the firstbeingthananinvestigator’strainingcanbecome As statedearlier, there are fourfacts thatcanaffectaninvestiga- Field investigationissues Investigation Courseasanexample ofsuchtraining. Int’l andtheUniversityofNorthDakota’s AdvancedAccident problems. We willbelookingattheAirLinePilots Association, have encountered andhowweare beginningtotrainforthose paper wewillbelookingatsomeoftheproblems investigators tool fornotonlyaccident,butalsoincidentinvestigation.Inthis accident sitewithmultiplepartiesinvolvedwasanidealtraining needed tobemodified.Whatweconcludedwasthatasimulated issues, itbecameapparent thatourinvestigatortrainingprogram does notensure successinthefield.Whenconfronted withthese tive group systemcanbeconfusing;and4)beingasubjectexpert 3)thepartyandinvestiga- investigation canbeoverwhelming; come “stale”ifnotpracticedregularly; 2)thefieldphaseofan found fourfactsthatcanaffectinvestigators:1)trainingbe- pared toparticipateinaninvestigation. as arepresentative, itisalsoimportanttohavethatpersonpre- this input.Whileitisimportanttohaveaknowledgeableperson edge totheprocess, andtheinvestigationismore completewith every partymember. Allofthepartiesbringimportantknowl- practices, policies,procedures, andtraining.Thelistgoesonfor mance. Theairlinebringsknowledgeofcompanymaintenance In ourexperience workingaccidentsandincidents,wehave Another issue that we see in the field is that new investigators can he was a subject matter expert, but he had never received any become overwhelmed working on an accident. After an accident, an training outside a classroom and had no field experience. This investigator is expected to “hit the ground running.” If the wreck- accident taught him some valuable lessons for the future. In an- age is accessible, it is not uncommon to begin field work the day of other example from a different accident, a group member was or the day after an accident. For someone who works accidents regu- accompanying his group to document switch positions in a cock- larly, there are a lot of familiar names and faces. For someone new, it pit. This member had limited accident experience but was as- can be daunting. You may have a long day in the field, having to signed to this event because of previous experience as a pilot and work effectively and efficiently with a group whom you first met at in airline operations. While the group was preparing to enter the breakfast. The investigators also find themselves working in a totally cockpit, this member began randomly flipping switches. The alien environment. Wreckage, fire, spilt fuel, firefighters, law enforce- member was confronted and quickly admitted he didn’t realize ment, and the press all add to the sights and sounds and can be he had done anything wrong. It was unclear if he correctly re- distractions. For pilots working in the field, they are looking at the called all the switches he had flipped. This investigator had lim- wreckage of an aircraft that they fly regularly. Seeing an aircraft they ited field experience and had no clue as to the importance of have flown for some time and have learned to rely on, bent and protecting evidence. With these examples, it is easy to see that broken in a field, can be disturbing. For pilots, flight attendants, some initial training in a field environment is necessary. mechanics, or other airline employees you are looking at an aircraft Clearly, the stakes of any aircraft investigation are extremely whose history you may know and have possibly flown several times. high. Not only are there lessons to be learned, but the potential All of these thoughts can cause someone unfamiliar with an acci- outcome can have a dramatic effect on companies, careers, and dent site to feel overwhelmed. While the person is still a valuable organizations for many, many years. Because of this, the quality resource, he or she may not be as focused as need be. of an investigation is of the utmost importance. In order to keep Another issue is that the party and investigative group process the quality of an investigation high, the investigators must be can be confusing. While the Investigator-In-Charge (IIC) has the properly trained, well prepared, and focused. ultimate control on any site, the average participant will inter- DAY THURSDAY—INVESTIGATOR’S face more with the investigative group chairman and the party Combined training coordinator. We have found that you can present the chain-of- While there are countless books, brochures, and pamphlets on command structure to new investigators in a classroom setting, aircraft accident investigation techniques, they can not fully re- but until they see the structure in place and at work, it doesn’t late issues encountered in the field. There are many organiza- really become clear to them. An investigator working an accident tions and educational institutions that provide classroom courses for the first time can easily be caught in procedural mistakes that and theory on the subject, however, little practical hands-on, lead to not only lost time but possibly evidence. It can take a “tinkicking” application. The ability to maintain pace with chang- couple of days for a new investigator to fully understand the in- ing technology, commercial and general aviation glass cockpits, formation flow pattern from the investigative groups up to the technically advanced aircraft (TAA), and very light jets (VLJs) is, IIC and then back out to the parties. If an investigator has a and will continue to be, a current and expanding challenge for better grasp of the process and information flow earlier in the future accident investigators. investigation, the more beneficial that investigator will be to his In addition to the National Transportation Safety Board, or or her group and party. any country’s investigative agency, there are a multitude of “par- Finally, being a subject matter expert does not guarantee suc- ties” that have expertise as well as an interest in the findings that cess in a field investigation. A person can be a renowned expert result from an investigation. From air carriers to aircraft manu- in a particular area but lack the basic skills needed to be a suc- facturers, law enforcement, flight schools, and flight departments, cessful investigative group member. An investigator must be ready all facets of aviation at some point in time may be called upon or to not only lend expertise, but also be able to function in the may need to participate in the investigative process. field. If the investigative group will be working on a crash site, Unfortunately, many of those that may become, or have a will- then the group needs to have been trained in how to dress for ingness to become, a party to the investigation have limited guid- the environment and the safety protocols to be used on site. No ance and low experience levels as investigators. Past experience matter which group the investigators will be working with, they shows that the efficiency of those investigating a major airline, should have some basic knowledge of what that group is nor- general aviation, or military aircraft accident depends on each mally responsible for and what its end product will be. Investiga- investigator’s knowledge of the investigative process and tech- tors working on an investigative group owe it to the investigative niques, how this “process” works, and the politics that may be- agency, the group they will be participating on, and to their party come apparent with a variety of federal and local agencies as well to know what that group’s purpose is and what is expected for a as personalities. However, as in any investigation, the primary final product. purpose is to learn as much as possible by investigating all hu- In cases where investigators have limited experience in the man, material, and environmental factors that directly or indi- field, it can take some time for them to become acclimated. While rectly may have contributed to the accident. It’s been said that working the wreckage of a CFIT accident several years ago, an each accident is an opportunity to learn, in an effort to define or investigative group was documenting impact marks in a wooded reshape company culture or increase the level of aviation safety. area. All group members but one were dressed appropriately. One method of preparing investigators for field investigations This member would have been highly valuable to the group, but is through a realistic training program. An ideal program will he was forced to stand on the sidelines because he was not pre- bring together all of the facets of an investigation, from wreckage pared to work in the environment. He had been chosen because and environment to the investigative process and parties. This

ISASI 2006 Proceedings • 97 ISASI 2006 PROCEEDINGS 98 Control (ATC), CockpitVoice Recorders (CVR),Maintenance tional Transportation SafetyBoard (NTSB),includingAir Traffic posed tosomeofthesameinvestigative groups usedbythe Na- are conducted rainorshine,hotcold,andnotalways“bugfree.” pants mustplananddress fortheelementsasoutdoor modules sure vessels,andenvironmental issues.Unlike aclassroom, partici- ardous debris, biohazard disposal,aswelljaggedmetal,pres- of personalprotective equipment, thehazards associatedwithhaz- “contaminated” wreckage site,whichtrainsapplicants ontheuse tered inthefield.Additionally, thecoursesimulatesa amination demonstratesmanyoftheactivitiesandissuesencoun- ing avideoorDVD. From sitesafetytosurvey, theon-siteex- ence inaclassroom, learnfrom reading abookorexperience watch- site provides participantsopportunitiestheycouldnever experi- using anactualaircraft wreckage andre-created aircraft accident be confusing,chaotic,andlaborintensive,thishands-oncourse intricacies ofaircraft accidentinvestigation. experience thatprovides participantsaneducationalcourseon University ofNorthDakota hasresulted inalifelike, hands-on vestigative techniques.ThiscooperativeeffortbyALPA andthe response, participation,on-sceneinvestigativegroups, andin- course placesparticipantsinthelogisticsinvolvedaccident training theaircraft accidentinvestigatorsofthefuture. together, forminganeducationalteamthatfocusesspecificallyon forces toprovide astagethat allowsindustryandeducationtocome the UniversityofNorthDakota, inacooperativeeffort,havejoined and theJohnD.Odegard SchoolofAerospace Sciencelocatedat accomplish individually. TheAirLinePilots (ALPA) Association,Int’l particular goalthatwouldhavebeendifficult,ifnotimpossible,to joint venture bypoolingtheirresources andexpertise toachievea tations inadvancingaviationsafetyandeducationentered intoa personnel andprocedural problems. tigation. Bothtypesofinvestigationinvolvesomethesame benefit foranaccidentinvestigation,butalsoincidentinves- The skillslearnedinthistypeofcoursewouldnotonlybe but withoutthecriticalityandpressures facedatanactualsite. the sights,sounds,personalities,andconfusionofanaccident— combined trainingprogram wouldexpose investigatorstoallof During thethree, 10-hour-dayschedule,participants are ex- Because thefieldphaseofanaircraft accidentinvestigationcan While notdesignedtosolveaircraft accidents,therealistic Recently, twoorganizations knowninternationallyfortheirrepu- Figure 1 • ISASI 2006 ISASI Proceedings tion, thechaincanbebroken before itleadstoanaccident. dent investigation.Ifthisleadstoanimproved incidentinvestiga- accident, andthelessonslearnedhere canalsobeapplied toinci- While everyaccidentisanopportunitytolearn,soasimulated one gainsrespect forwhatthesegroups bringtoaninvestigation. ing togetherasmanyoftheinterested partiesaspossible,every- ing onsomeoftheirexperience duringtheexercise. Also,bybring- are abletolearnaboutnewtechnologyandprocedures, whilepass- also tolongdaysandgroup dynamics.Experiencedinvestigators not onlyexposed toinvestigativeprocesses andprocedures, but tors canlearnfrom asimulatedaccident.Newinvestigatorsare a practicumforthistraining.Bothnewandexperienced investiga- for passingongeneralknowledge,asimulatedaccidentsiteactsas erly prepared for, dangerous. Whileclassroom instructionisgood confusing,andifnotprop-An investigationcanbeoverwhelming, Conclusion resources, greater capacity, andincreased technicalexpertise. combining thetalentsoftwoorganizations, theresults are increased to asuccessfulpartnershiprequires planningandcooperation.By accident investigation.Jointventures are notnew. However, thekey has beenasuccessfulmissiontoenhanceaviationsafetythrough increasing theirpersonalsafetyandthatof passengers. that canbeappliedduringfuture accidentinvestigationsaswell decompressions givesparticipantsactualtrainingandexperience trapped andevolvedgases,cabinpressure emergencies, andrapid opportunity toactuallyexperience hypoxia,hyperventilation, tunities generallyexperienced byonlythoseinthemilitary. The in analtitudechamberproviding participantseducationaloppor- clusion ofeachday. Thecoursealsoincludeshigh-altitudeflights during afieldinvestigation,includingpress briefingsatthecon- ing moduleprovides therealities onewouldactuallyexperience from stake linestoglobalpositioningsystems(GPS).Everytrain- how todocumentwreckage andground scarsusingeverything and compression loads, torque andtransverseshear. Theywilllearn impact. Participants learnthedifferences between tensionloads pact andlookforanyevidenceofinflightfailure priortoground how todocumentthepositionofflightcontrols atthetimeofim- As anexample, duringthestructures module,participantswilllearn work withthelatesttechnologybeingusedinfieldinvestigations. also gainexposure totopicssuchascognitiveinterviewingand issues thathavebeenencountered inthefieldbefore. Students dents are exposed tonormalgroup work,aswelltosimulated with therealism ofanactualaircraft accidentinvestigation.Stu- ence ineachspecificarea. Allmodulesare designedandconducted 3-hour moduleallowsparticipantson-the-spot,practicalexperi- Records, Operations,Aircraft Structures andSurvivalFactors. Each The synergy developedbyALPA andUNDinthisjointventure Figure 2 ◆ Investigating a ‘Minor’ Incident Using Lessons Learned From a Major Accident By Stéphane Corcos and Alain Agnesetti, BEA (Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile) 1. Introduction lines know this situation and exploit these breaches, eventually Last summer was a terrible one for aviation safety, with several making their way into western countries. “Virtual airlines,” made fatal accidents, in which more than 500 passengers died in just 2 up of parts that are often inconsistent, and which should actually months. Most investigations are still ongoing, but it is likely many be called “ticket sellers” rather than “airlines,” are created there of them will highlight shortcomings in the way various operators and then, like genuine toadstools, jeopardizing the safety and were overseen by their national authorities. The BEA has been stability of the air transport industry. involved in a number of them, to various extents, as the state of The world aviation community has identified the problem, but the manufacturer, the state having citizens among the victims, implementation of solutions is very slow. ICAO has limited power, but also by assisting several countries in their investigations, in- since its system is based on sovereignty. Many states commit them- cluding flight recorder readout. selves to implement ICAO standards but often have not taken DAY THURSDAY—INVESTIGATOR’S Although most of these fatal accidents occurred outside the appropriate action to enforce them through regulations, proce- western hemisphere, any given citizen of a western country may dures, proper staffing—and above all, they lack political will to one day be a passenger on a domestic flight in a less-developed move forward. Instead, technical expertise is often superseded country, or between two of them. Moreover, an investigation into by political considerations for various reasons. Safety regulations an incident that occurred during takeoff from Paris CDG in July are often seen as hindrances to the prosperous operation of an 2005 showed that it is not necessary to travel abroad to be at risk: airline, and both authority and airline technical staff are under in Europe, airlines from countries where safety oversight is weak pressure from politics or financial managers. Safety is not attrac- can operate on a wet-lease basis for national flag carriers from tive because it may, ultimately, confront you with the taboo of EU states, where leasing conditions are somewhat overlooked. cancelling a flight. In aviation culture, especially in a fiercely com- According to ICAO findings (the 35th assembly, September 2004), petitive environment, cancelling a flight is seen as a failure. Con- there are almost 30 states where safety deficiencies still prevail, sequently, safety personnel end up with being blamed for their where corrective actions have not been implemented. Rogue air- actions, and are seen as “the bad guys.” Above all, it is our terrible experience in society that some- Stéphane Corcos is the head of the BEA Investiga- times it seems that a price must be paid in blood before lessons tions Department. He joined the BEA as head of the are really accepted and the situation changed, before those con- Safety Analysis Division in 1996. Prior to joining the cerned are convinced by the lessons derived from other occur- BEA, he worked for the DGAC (French civil aviation rences, overcoming the inevitable costs and putting aside pres- authority) for 8 years, including 4 years as deputy tige considerations. When the aviation community says it will head of the flight training organization’s Supervision improve its level of safety, accident investigators are too often the Division. Stéphane graduated from the French “efficiency sensor,” who demonstrate that the picture remains National Civil Aviation School (ENAC) with a masters degree in imperfect. aeronautical engineering in 1987, including an internship at the Traceability of airplanes can be impossible across borders, ex- Flight Safety Foundation in Arlington, Va. He is the current holder of cept with the help of private companies or individuals, whose a commercial licence and a multiengine instrument rating. He also website may include interesting information on a given situation. held a Beech 200 type rating. Thanks to Internet search engines, used more and more frequently in difficult investigations, some achievements are pos- Alain Agnesetti is a former Air Force pilot instructor. sible. But traceability of pilots, their initial and recurrent train- As a flight safety officer and accident investigator in ing, their ratings, and their actual experience is almost impos- the French Air Force, he led various military accident sible, especially when, de facto, they act as mercenaries. They investigations. A retired major with more than 6,000 often move from airline to airline, and have no time to become flying hours, he joined the BEA in 1999 as a safety familiar with the airline, the working environment, the standard investigator. He has been an IIC on a number of operating procedures, the network—and they are not always in a national and foreign investigations and an accredited position to perform at an acceptable safety level. representative on major investigations abroad. Alain has a professional To illustrate this, we could reiterate the occurrence the BEA pilots license. He is a Chevalier de l’Ordre National du Mérite and presented at ISASI 2005. The investigation into this incident in holds the Médaille de l’Aéronautique. Nantes (approach flown well below and outside normal final ap-

ISASI 2006 Proceedings • 99 ISASI 2006 PROCEEDINGS 100 der tomaintain anacceptablelevelofsafety, increasing human, affected aviation. Thesystemhasbecomeso complex that inor- has beencharacterizedbyincreased globalization,whichhasalso tool fordevelopmentofexchanges. Butthiseconomic growth growth, whichithasaccompanied effectively, asafundamental steady growth andhasalwaysbeenaheadofglobal economic the Council. dards, Article38stipulatesthatthesedifferences benotifiedto rules adoptedbyotherstatesare inferiortointernationalstan- satisfactorily undertakingtheircommitments.Specifically, ifthe also impliesthateachstatemayascertainotherstates are tion, toputintoplaceandapplytheinternationalstandards. This civil aviationcode,completedbythenecessaryrulesofapplica- correspond tothestandards. nition ofdocumentsissuedbythestateregistry insofarasthey ant totheConventionand,inArticle33,international recog- regulations tobeinconformitywiththerulesestablishedpursu- Convention introduces, inArticle12,anobligationfornational Article 12,tothestateofoperatoraircraft. tal transferoftheseresponsibilities, aswellthoserelating to to theircrews. However, Article83bauthorizesthepartialorto- craft undertakinginternationalflightsandcertificateslicenses states ofregistry toair- mustissuecertificatesofairworthiness place. TheConventionalsospecifies(inArticles31and32)that applicable intheplacewhere theflightormaneuveristaking found, shouldbeinconformitywiththerulesandregulations well asanyaircraft withitsregistration mark,wherever itmaybe any aircraft ormaneuveringthereon, flyingoveritsterritory as plete andexclusive sovereignty overairspaceaboveitsterritory.” The Conventionrecognizes (Article1)that“eachstatehascom- equality ofopportunityandoperatedsoundlyeconomically.” tional airtransportservicesmaybeestablishedonthebasisof be developedinasafeandorderly mannerandthatinterna- cago Convention,“inorder thatinternationalcivilaviationmay Dec. 7,1944,onInternationalCivilAviation, knownastheChi- relation tosafetyoversightare derivedfrom theConventionof cable requirements andstandards. tions) performtheirdutyinasafemannerandmeettheappli- the aviationindustry(airmen,operators,maintenanceorganiza- Through safetyoversight,astateensures thatnationalactorsin 2. Safetyoversight concern aswell. themselves, isnoeasier, whilethisisincreasingly becomingasafety him followadditionaltraining. No onehasanywaytoknowwhere heisnow, evenlesstohave ployer whohasnoreason tobelievehisknowledgeisinadequate. ferred nowhisinadequaciestoanothercountry, toanotherem- the investigationwascompleted.He,quiteprobably, hastrans- elan licensebutflewwithanEgyptianairline,wassacked before on theautopilotofhisairplane.Thispilot,whoheldaVenezu- instrument approach procedures principlesandlimitations proach path)hadshownthatthecaptainlacked knowledgeon Over thepast15years,aviation hasexperienced rapidand This impliesthateachstatecommitsitselftoadoptalawor a To ensure harmonybetweenthesevariousobligations, the Furthermore, itstipulates(Article12)thatstatesensure that The responsibilities andinternationalobligationsofstatesin Finally, traceabilityofairlinemanagers,andevenairlines • ISASI 2006 ISASI Proceedings real time. thority oftheinspectedoperatortosolvesafetyissuesalmost in cooperation betweentheinspectingstateandcompetent au- which contributetosafetyonagivenairplane.Finally, theyfoster Furthermore, these inspectionsmayleadtomandatoryrepairs, ough, theygiveageneraloverviewoftheforeign operator’ssafety. a memorandumofunderstanding. accelerated thisprocess. Turkish operatorwithmostlyGermancitizensonboard) in1996 Puerto Plataaccident(aBoeing757operatedbyBirgenair, a that startedin1996,asacomplementtoUSOAPaudits.The ropean SAFA program (SafetyAssessment ofForeign Aircraft) (ECAC). TheDGACwasdesignatedcoordinator ofthenewEu- through ICAOandtheEuropean Conference for CivilAviation forcement ofsafetyoversightforeign both statesandcarriers, requesting thattheFrench DGACplayaleadrole intherein- following establishedprocedures. ments ofoversightinpertinentSARPs inanacceptablemanner, whether agivencontractingstatewasimplementingcriticalele- sonnel licensing,andoperations.Theirpurposewastoassess Assembly. teen meterspast therunwayendon extended runway of liftoff.Itstruck anILSbuildinglocated a hundred andeigh- run, theairplaneexperienced along,delayed,andshallowangle non)–Dubai (UnitedArabEmirates) route. Duringthetakeoff of itsConakry(Guinea)–Cotonou–Kufra (Lybia)–Beyrouth (Leba- line UTA (UniondesTransports wasonitssecond leg Africains), A Boeing727-223registered 3X-GDO, operatedby Guineanair- offlight 3.1. History (Benin) onDec.25,2003. of theinvestigationintoanaccidentthatoccurred inCotonou This oversightissuewassignificantlybrought tolightinthecourse 3. Accident toaBoeing 727operatedbyUTA inCotonou Program (USAOP),adoptedbyresolution A32-11ofthe32 1998, thiswasreplaced byaUniversalSafetyOversightAudit ment ofnationalaviationauthoritieswithincontractingstates.In ity (CAA)inaccordance withICAOstandards. wasprovidedthese carriers byacompetentcivilaviationauthor- level ofsafety, itwasnecessarytoascertainthatsafetyoversightof operate toorfrom theUnitedStateswere offeringanacceptable nized thatinorder toensure thatallforeign that aircarriers operations andmaintenanceestablishedbyICAO. Itwasrecog- ternational standards andrecommended practicesforaircraft try, ratherthanthatofanindividualaircarrier, toadhere toin- The foreign assessmentprogram focusesontheabilityofacoun- eral Aviation Administration(FAA) program. established theIASA by more andmore states.InAugust1992,theUnitedStatesFed- that allstateskeep upwiththeirresponsibilities hasbeenshared difficulties inexercising theiroversightfunction.Thisconcern has notedthatmore andmore contractingstatesare facedwith Not allcontractingstatescancopewiththischallenge,andICAO financial, organizational, andtechnologicalresources are required. Although theSAFA inspectionsare limitedandseldomthor- Both theSAFA andUSOAPprograms are interrelated through Meanwhile, in1995,theBEAissuedasafetyrecommendation These auditsstartedin1999andcovered per- airworthiness, In 1996,ICAOsetupavoluntaryprogram forsafetyassess- nd At their main base in Conakry, apart from a rented check-in counter, the airline had two containers in which spares, drinking water, and the printed paperwork required for operations were stored. It should also be noted that there was no competent technical management, that operational and maintenance activity were nonexistent (no maintenance documents could be supplied to the investigators), and that no training was provided for ground crew.

3.4. History of operations The airline, UTA, was initially based in Sierra Leone and operated under the name of West Coast Airlines. In 1997, its home base was transferred to Guinea under the name of UTA. It started operating rather light airplanes: a Let 410 and an Antonov 24. Both airplanes belonged to a Russian citizen, who was also the technical director of the airline. The airline was owned by a Lebanese citizen UTA Boeing 727 accident Cotonou. living in Guinea, several family members being among top managers of the airline, including the director general and the opera- centerline and crashed onto the beach with most parts ending tions manager. When the airline added the Boeing 727 to its fleet, up in the ocean. There were at least 160 people on board, among none of the technical staff had any knowledge of the airplane. whom 22 survived the accident, including the captain and the Until 2003, UTA performed local flights in western Africa. From airline’s general manager. April 2003, the airline wanted to extend its range of operations, The Benin government delegated the investigation to the BEA. and in June of the same year, long-distance flights to Lebanon DAY THURSDAY—INVESTIGATOR’S and the UAE were organized with a Boeing 727. In April 2003, a 3.2. Accident description request to open a Conakry–Abidjan–Cotonou–Beirut route was The investigation showed that the airplane weight was 7 to 8 tons made to the authorities in the various countries concerned. On above the maximum allowable weight and that the cargo com- June 28, 2003, the route was opened between Conakry, Cotonou, partments were loaded by poorly managed employees, in an and Beirut. In November, it was extended to Dubai. anarchic way. The aircrew was unable to obtain precise data con- The Boeing 727 was leased from FAG (Financial Advisory cerning passengers and luggage, nor for possible freight on board. Group), formerly based in Miami (Florida), then allegedly based Furthermore, they were lacking documentation to establish a in the Virgin Islands, but for the airplane lease, the sole interface precise load sheet: they were not informed that the forward cargo was through its office in Sharjah (United Arab Emirates). The hold had been heavily loaded, which significantly displaced for- leasing contract included the aircrew and technical maintenance ward the center of gravity. Therefore, the crew took into account of the airplane. It also stated that insurance and wages were to be a weight of 78 tons with a standard loading, and a configuration paid by the airline. It should be noted that FAG did not hold an of flaps 25°, trim setting 6¾, packs off, brakes release on takeoff air operator certificate. thrust. At V1-VR callout, the airspeed was 137, which is in fact a The airplane was first delivered to American Airlines (USA) in V1-VR for 85.5 tons. On reaching this airspeed, the copilot (who 1977. Until 2001, it had normal flying activity in the USA— was the pilot flying) pulled back on the column, but the airplane Between 2001 and 2003, stored in the Mojave desert; in 2003, failed to pitch up. The airplane rotated slowly and lifted off in became the property of a bank, still with a U.S. registration. the very last meters of the runway. The main landing gear struck January 2003: operated by Ariana Afghan Airlines, Kabul (regis- a 2.45-meter-high building containing the localizer system. The tered YA-FAK), owner based in Sharjah (UAE). right main landing gear broke off and ripped off a part of the June 2003: operated by Alpha Omega airways, same owner, reg- underwing flaps on the right wing. The airplane banked slightly istered in Swaziland (3D-FAK). to the right and crashed onto the beach. It broke into several July 2003: “operated by UTA,” under wet lease from Alpha pieces and ended up in the ocean. Omega, same registry. October 2003: new lease to UTA, this time from FAG, same 3.3. Operational failings registration. The overall operation of the airplane, both at its base and at the Two days later, transferred to Guinea registry, and became 3X- various destinations it served, was not organized, undertaken, and GDO. overseen in an appropriate manner (this is an understatement). From October 2003 till the day of the accident, it remained leased In Cotonou, the station manager had no aeronautical knowl- by FAG and operated by UTA as 3X-GDO on Guinea registry. edge. The resources (counters, vehicles, and staff) were rented It should be noted that UTA operations actually begun with from a company based at Cotonou airport, but this company was another B-727, registered 3X-GDM, also the property of FAG, which not tasked with any duty related to dispatch or handling, in par- was grounded in Lebanon at its first flight for a number of major ticular providing the crew with performance data. Basic loading deficiencies. The airplane was then replaced by the 3D-FAK, and elements to the aircrew (number of passengers, estimated weight FAG got it back. The BEA deeply regrets that, due to time con- of luggage) were provided by a representative of the airline, fly- straints and since this was not a part of the investigation, this air- ing on board the airplane. plane was not tracked after it returned under FAG responsibility.

ISASI 2006 Proceedings • 101 ISASI 2006 PROCEEDINGS 102 aviation authorities, inparticularofGuinea, soastoreorga- A firstsetofsafety recommendations wasaddressed tocivil 3.8. Safetyrecommendations or handlingagentsattheCotonou station. all themore difficult,aswellthefailure touseproper dispatch spread ofresponsibilities between thepartiesthatmadechecks oversight. istration ofGuinea,andSwazilandpriortoit,inthearea ofsafety insufficientmonitoringexercised bytheCivilAviation Admin- • organizing lineoperation andcheckingtheairplane’sloading. tory documentation,whichprevented themfrom appropriately theoperator’slackofcompetence,organization, andregula- • the crew. The direct causeoftheaccidentwasaforward CG,unknownto 3.7. Causes deficiencies eventuallycorrected. was grounded inturn. second plane,therampcheckrevealed 18 deficiencies.Theplane ing withpassengersandwasreplaced bythe3D-FAK. Onthis showed suchdeficienciesthatthe3X-GDM wasbannedfrom fly- FAK/3X-GDO. Althoughlimitedintimeanddepth,arampcheck thority conductedrampinspectionsonthe3X-GDM and3D- and employmentissues. plane activityfollowup—inpartunderpressure from economic operations, documentation,flighttimelimitation,crew orair- most nosafetyaudituponapplicationtooperate,checkson in January2004,afewweeksaftertheaccident. GDO, Afghanistan, maintenancehadbeenscheduledinKabul, shop forthefirstoftwoBoeing727s.For thesecond,3X- nance manual. the DNACandinaccordance withthemanufacturer’s mainte- plane hadtobemaintainedaccording toaprogram approved by 727, theGuineacivilaviationauthoritystipulatedthatair- 2001. Whentheairlineexpanded withtheleasingofaBoeing of Guinea.AnairoperatorcertificatewasissuedinNovember Nationale del’Aviation Civile),theCivilAviation Administration The airlineoversightwasexercised bytheDNAC(Direction 3.6. Oversight structure. Overall, theairlinewashardly more thanapurely commercial follow upatall,evenlessensure thesafetyofitsflights. of aviation,itcouldneitherorganize nor plananyoperational did notpossess.Astheoperatorhadnoknowledgeofworld systems, humanresources, andequipmentthattheairlineUTA based onthatofaJordanian airline.Itcontaineddescriptionsof airline’s operationsmanualwasa“cutandpaste”jobseemingly airplane’s andtheairline’smandatorydocumentation.The The investigationbrought tolighttheinadequacyofboth 3.5. Organizational failings Several contributoryfactorswere noted,amongwhichwere a The root causesoftheaccidentswere It tookatleastthree iterationstotheLebaneseCAAhave all During stopoversinBeirut,theLebaneseCivilAviation Au- The GuineaCAAfailedtoexercise itsnormalduties,withal- The DNACcouldnotgetinformationonthemaintenance The airline’sonlyofficewasaticket officeindowntownConakry. • ISASI 2006 ISASI Proceedings Paris CDG,afteranuneventfullanding down, requested avisualapproach andtheairplanereturned to spread. Thiswasalsoseenfrom theground byplanespotters. cabin rows, passengerssawaflamebehindtheengineandpanic above limits,alongwithvibrationsfrom engineNo.3.Inseveral could beheard. Thecrew noticedturbinegastemperature rising minutes late.Ontakeoff, justaftergearretraction, loudthumps them lefttheairplane.Iteventuallygate4hoursand40 eral passengerspanicked, someofthemrebelled, andhalfof erally hammeringonthecargo doortocloseitbefore flight.Sev- boarded, loudbangscouldbeheard, produced bymechanicslit- OA202 from Paris toAthens. lease basisthrough abroker toperformthescheduledflight nance andwasshortofairplanes.ItcontractedStarJetonawet- dent occurred inParis CDG. In July2005,almostasaprecursor ofthetragicsummer, aninci- StarJet-registered A6-BSM 4. IncidenttoaLockheedTristar operatedby in anincident. StarJet Lockheed Tristar, registered A6-BSM,involved applicable safetystandards, anexemption wasgrantedsoasthey operations. Althoughaware StarJetoperationsfailedtomeetthe try, andoftheoperator, revealed shortcomingsinthearea of the UAE). MMEL, althoughthiswasagreed asanexemption bytheCAAof ate (OPSmanualoutdatedandinadequate,MELreplaced bythe ment were notairworthy, thedocumentation wasnotappropri- no logbookentriesforseveralflights,piecesofequip- vealed severalshortcomingsintheoperationsassetupbyStarJet: maintenance operations.More generally, theinvestigation re- mentation madeitimpossibletoconductaproper followupof not undertaken byanapproved facility, andthelackofdocu- numerous deficiencieswere brought tolight. Maintenancewas determine thefacts. neighbouring theairport.TheBEAstartedaninvestigationto tion authorities…. responsibilities, publicationofguidelinestobeusedbyCivilavia- flights, identificationofoneoperatorsoastolimitthespread of operator, harmonizationbetweenscheduledandnon-scheduled ber states,toincludeclarificationofdutiesthestate a comprehensive enhancement ofsafetyoversightwithinallmem- nize safetyoversightandimplementationofICAOSARPs. The crew appliedtheappropriate procedure, shuttheengine The airplanewasalready lateatthegate.Whenpassengers Olympic Airlineswasstrugglingtokeep upwithitsmainte- The oversightfrom theUnitedArabEmirates,state ofregis- Beyond a“mere” enginesurge followedbyexhaust pipefire, The newsmediasplurge wasamplifiedbyresidents Another setwasaddressed toICAO, recommending fostering 1 . could fly for Olympic. The supervision and checks conducted by more precisely the apparent areas of deficiency, addressing in an the civil aviation authority of Greece and Olympic Airlines could even more pertinent way the root issues of failings in oversight. not prevent this airplane from being operated within the Euro- The two investigations showed that aviation safety faces at least pean Union. two challenges. The first one is a sound and organized imple- The history of activity for the Boeing 727 3X-GDO and the mentation of international standards for operation of airplanes, Tristar L1011 A6-BSM are very similar. In both cases, the pattern and an appropriate level of supervision to ensure this standard. of the geographical spread of the respective owners, operators, The second one is that western airlines, usually subject to a more registry and oversight authorities, therefore, of responsibilities, stringent oversight from their authority, may delegate transport is similar— activity to operators who are subject to a much weaker monitor- 1981: BWIA (West Indies Airways), Trinidad ing activity. Action taken to guarantee an equivalent level of safety 2003: stored in Port-of-Spain, then registered in Sierra Leone is not robust enough. Ultimately, fare-paying passengers may “le- (9L-LED) with a 1-year validity certificate of airworthiness. gally” end up flying with a much lower degree of safety. October 2004: bought by Star Air in Sierra Leone. The base was Among the challenges of the coming years, safety oversight is in Gibraltar and the headquarters in Amman (Jordan). The air- certainly one for which every country has a part to play, and should plane was ferried to Amman. go beyond the concept of “black lists”: strengthening of over- October 2004: withdrawn from Trinidad registry. sight, ramp checks extended as far as possible to areas such as June 2005: registered A6-BSM in the UAE. New owner : StarJet, aircrew training, cooperation between states, exchange of infor- company based in Sharjah. Same president as Star Air. No formal mation, training, assistance to less-developed countries, and use purchase or sale document formalized this transfer of property. of accident or incident investigation reports to be part of the July 2005: StarJet was operating on a wet-lease basis for Olympic safety assessment, to name but a few. Airlines (Greece). In this respect, satisfactory investigations are essential, since in Although it was grounded most of the time, the airplane was, some cases they consist now more of an audit on the safety struc- therefore, registered in more than one state between November tures than an identification of previously unknown safety weak- DAY THURSDAY—INVESTIGATOR’S 2003 and October 2004. nesses. This implies, of course, that confidence and cooperation The above are only a few of the failings found, and the investi- be total between accident investigation authorities and that no gation is still ongoing; more details will be found in the final one should be influenced, during an investigation, by economic, report. political, or image considerations. ◆

5. Conclusion Endnote 1 To date, the airplane is still grounded in Paris CDG. Several components The experience gained during the investigation into the Cotonou were found to be not airworthy, as revealed by the first and subsequent accident helped investigators operate more effectively and explore inspections, and the owner has not mandated the repair.

ISASI 2006 Proceedings • 103 ISASI 2006 PROCEEDINGS 104 International Society ofAirSafetyInvestigators. Institute ofLogistics andTransport, andanassociatememberofthe Psychology Association,theRoyal Aeronautical Society, theChartered European AssociationforAviation Psychology, theAustralian Aviation editor ofthejournal Defence Force Crew Resource ManagementWorking Group andco- staff, maintainers,loadmasters,refuellers, baggagehandlers, they transitairportcustomsandsecurity; theyliaisewithground They receive NOTAMS andweatherfrom therelevant provider; interact closelywiththeoperationalsideofaviationindustry. working livesatthecoalfaceofaviation.Everydaypilots Pilots are ahighlytrainedgroup ofindividualswhospendtheir Introduction aviation environment. dents andincidents,make avaluablecontributiontosafer tify andrectify safetydeficienciesthatcouldcontribute toacci- operational datafrom “front line”specialistscanproactively iden- inEurope.carrier Itthendiscusseshowthisutilizationofrich scribes apilotself-report research studyconductedatalow-cost vention actionsare workinginlineoperations.Thispaperde- development ofadversetrends aswellmonitorwhetherinter- pilot self-reporting hastheabilitytoalertorganization tothe training programs. Whentailored tosuitaspecificoperation, for changeandtoprovide direction andemphasis forin-house titative andqualitative,formanagementtopresent asafetycase tential toprovide evidenceintheformofhard data,bothquan- ing program basedonsoundoperationalresearch hasthepo- investigation canbemade.Acarefully designedpilotself-report- and ground staffsothatacloserandmore definedproactive cerning aircrew, cabincrew, airtrafficmanagement,airports, incidents developing.Itcanidentifypotentialproblem areas con- happening. Itcangivewarningofissuesarisingandpossible ity ofnotonlywhatishappeninginthefield,butalsowhyit information cangivemanagementandoperationalstaffvisibil- fully utilized.Pilot self-reports ofstructured in-flightbehavioral day-to-day operationalknowledgethat,toalarge extent, isnot Pilots are agroup ofaviationspecialistswithavastamount Abstract • By SueBurdekin, Lecturer/Researcher-University ofNewSouthWales, AustralianDefenceForce Academy ISASI 2006 ISASI How PilotSelf-Reporting CanHelp ment. Sueisafoundationmember oftheAustralian extensive experienceinaviationbusinessmanage- psychologist withacommercial pilotslicenseand in Canberra,Australia. Sheisanorganizational Australian DefenceForce Academy (UNSW@ADFA) factors withtheUniversityofNewSouthWales atthe Sue Burdekin Proceedings Australian Aeronautics Listening totheSpecialists: Break theAccident Chain lectures inaviationsafetyandhuman . Sheisamemberofthe Photo 1.HUD display from thecockpitof theF/A-18 Hornet. about thepossibleuseofpilotself-reports asapotentially valu- feedback onthesafety“health”ofsystem.Whenquestioned a dailybasis,theyare rarely asked toprovide formallystructured mally gatheringintelligencefrom everyfacetoftheoperation on However, eventhoughthesehighlytrainedspecialistsare infor- with theoperationofflightfrom dutysignontooff. determine whetherthere are anysafetyimplicationsassociated be abletoidentifyareas inneedofattentionandtobe ableto tasks theyneedtoachieve.Importantly, pilotsare inapositionto service andcooperationtheyreceive inorder tostreamline the and reasonably accurateassessmentofthelevelandquality given time,pilotsshouldbeabletocomposeacomprehensive employees bothinflightandontheground. Therefore, atany approach, andtower;theyworkcloselywithothercompany work airports;theycommunicatewithairtrafficproviders enroute, out ofarangescheduledandoccasionallynon-schedulednet- pushback, andsurfacemovementcoordinators; theyflyintoand to seek its cooperation. It was agreed that only volunteers were to be involved, no personal identification information was to be collected, and the primary researcher was to be the gatekeeper of the data. The design of the study was developed in conjunction with easyJet pilots and Safety Department personnel. Although the protocols were influenced by the ADF study and the Airbus Line Operations Audit System, the nature of the information collected was designed and customized to be of use to the easyJet Safety Department in the early detection of safety-related issues. The reporting form asked pilots to assess their interaction with air traffic control, airports, ground support, and passengers. Pilots were also asked to rate their own performance across eight categories of behavior: briefing, contingency management, monitor/cross check, workload management, situational awareness, automation management, communication, and problem solving/ Photo 2. EasyJet pilot fills out self-report during turnaround. decision-making. Each category of behavior was given a comprehensive descriptor. For example, the descriptor for the category able proactive safety measure, airline safety and accident investi- “briefing” was gation personnel often anecdotally reply that such reports would probably be unreliable because they would be biased. The required briefing was interactive and operationally thorough. Concise, not rushed, and met SOP requirements. Bottom lines were established. Roles Self-reporting research and responsibilities were defined for normal and non-normal situations. DAY THURSDAY—INVESTIGATOR’S Most of the self-report research that has been conducted has cen- Workload assignments were communicated and acknowledged. tered on the medical, educational, and workplace sectors. Self-report and self-assessment is common in these areas, and studies have In order for the pilots to make a more informed rating choice, shown that with practice these reports are generally critical and real- a series of specific “word pictures” was given to each category of istic (Drewes and Rundle 2002). Mabe and West (1982) proposed behavior ranging from a grading of 1 to 5 (refer to Table 1). that if individuals understand the dimension in question, accept the All data-collecting missions originated at easyJet’s Geneva base dimension, and perceive that the assessment will not be used against and were flown in its fleet of A319 aircraft during normal rev- them, self-assessments would be more accurate. enue raising flights. At the time, the network of destinations was An Australian military pilot self-report study conducted by restricted to eight UK and European airports. In addition to re- Burdekin (2003) found that after flying structured mission pro- porting on their own individual performance during the flight, files in the simulator, F/A-18 Hornet pilots were able to recall and the captain and the first officer were asked to report on each report on behavioral categories of their own performance, such other’s performance using the structured questionnaires provided. as automation management, communication, and workload The observers used the same questionnaires to report on both management, and that their self-reports were highly correlated the captain and first officer. In an effort to be as unobtrusive to with the ratings of the same behaviors made by an independent observer. This study was conducted in the simulator because many 1. Unsatisfactory briefing standard. military aircraft do not have provision for an observer in the cock- • Briefing duration and crew interaction minimal. pit, and the Australian Defence Force (ADF) was interested in • Available company resources not utilized to a satisfactory standard. whether this kind of self-reported, structured and categorized • SOPs not adhered to. behavioral information, as distinct from a normal mission de- 2. Basic briefing conducted with limited crew interaction. brief obtained from pilots after the mission would be reliable. • Incomplete use of available resources, and workload Pilot reports were seen as useful in collecting operational data allocation limited. from front-line specialists as part of the overall ADF accident and • SOP briefing structure loosely adhered to. incident prevention strategy. Such data also provide a means of 3. Crew operates in accordance with SOP briefing structure. evaluating the effectiveness of training programs such as CRM • Interactive briefing conducted in a timely manner, utilizing in normal operations and could be fed back into such training. available resources to an adequate standard. 4. Effective crew briefing conducted utilizing all company/non- company information. Testing airline pilot self-reporting in flight • Proficient time and workload management with clear On learning of the results from the ADF study, the Flight Opera- interaction and allocation of duties among crew. tions Monitoring Group from Airbus was interested to determine 5. Comprehensive and operationally thorough briefing conducted whether pilot self-reporting would be a reliable means of gather- to a high standard. ing operational data from crews in a commercial airline environ- • Excellent crew interaction, participation, and understanding. • All available briefing resources utilized, and clear and concise ment. With the assistance of easyJet, one of their customer air- • workload allocation among crew. lines, an airline pilot self-report study was conducted. Early in the planning stage, easyJet management and the research team Table 1. Grading/word pictures for the behavioral made a presentation on the proposed research to the pilots’ union category “briefing.”

ISASI 2006 Proceedings • 105 ISASI 2006 PROCEEDINGS Table 2:Ratingsacross allbehavioralmarkers. 106 mitted accessto theFDMdatafrom theirownflightsthereby en- crews shouldconducttheirown flightdataanalysisbybeingper- reports explaining thedetailsof theflight.Theypropose thatflight it couldbematchedtoaformal systemofoperationalcrew self- al (2005)whoargue thattheFDMsystemcouldbemore efficientif field offlightdatamonitoring (FDM)issupportedbyReisinger et One potentiallyvaluableapplication ofpilotself-reporting inthe How canpilotself-reporting beapplied? would beexpected forany newprogram. sive trainingwouldneedtobeanintegralpartofthepackage, as pilot self-reporting systemwere to beintroduced, comprehen- had inratingoperationalperformance.Thismaymeanthat ifa training environment may betheonlyexposure thattheyhave of otherpilots,thehigher-than-averagestandard expected ina first officersare notgenerallyinvolvedintheformalassessment been trainedtoandassessedataveryhighstandard. Because captains. Whenfirstofficerscompletetheirtrainingtheywill have tion forthisresult wassuggestedbyairlinecheckandtraining they were more severe onthemselves.Themostlikely explana- present theirperformanceinanartificiallyinflatedscore, rather first officerswere more discriminating.Theydidnotseekto ratings forthe“communication” marker. markers butthecaptainsandfirstofficersonlyagreed withthe servers andfirstofficersfoundagreement onfouroftheeight mance, thefirstofficersseemedtohavesomedifficulty. Theob- good atinterpreting themarkers andratingtheirownperfor- need abetterdefinition.Whilethecaptainsappeared tobe very be reconsidered forfuture use.Itmaybe foundthattheysimply “problem solve/decision-making.” Thesemarkers wouldneed to observer withtheexception of“automationmanagement”and to beunderstoodandratedconsistentlybythecaptain the overallresults (refer toTable 3). to determinehowindividualbehavioralmarkers contributedto an observerandeachother(refer toTable 2). range ofstructured categorieswhencompared tothereports of pilots were abletoreliably report ontheirownbehavioracross a to bestatisticallysignificantindicatingthatcommercial airline pared tomeasure thedegree ofcorrelation. Theresults were found captain, observer/firstofficer, andcaptain/firstofficerwere com- a priorletterfrom managementrequesting theircooperation. a singlepageofexplanatory notesbefore theflightinadditionto a trainingprogram toexplain theexperimental studybutrather regular operationsaspossible,thepilotvolunteerswere notgiven ** Significant.001 / .34.38 7 .169** .206** 376 .344** r 376 .53281 432 .58599 N .53281 .36345 3.7394 .58599 4.0000 .36345 3.7394 F/O 3.995 CPT sd 4.000 F/O 3.995 OBS CPT Mean OBS Rater A closerinspectionofthedataindicatedthatratings This breakdown revealed thatthemarker selectionappeared The datawere thencompared bybehavioralcategoryinorder Sixty flightsectorswere observed.The ratingsoftheobserver/ • ISASI 2006 ISASI Proceedings Table 3:Correlations bybehavioralcategory. ** correlation issignificant.001 * correlation issignificant.005 prove thesafetyof operationshouldbecollected. system. Onlyinformation thatcanbe,and willbeused,toim- Great care shouldbetaken inthedesignofdata-gathering • with identifyingsafetytrends across theorganization. pant. Theresults ofsuchaprogram shouldonlybeconcerned aggregate formonly. There isnopersonalthreat toanypartici- not lookingatindividuals.All dataare combinedandusedin Emphasisneeds tobeplacedonthefactthatsuchasystemis • data willbeused. of datasecurity, participantanonymity, andforwhatpurpose the unions. Agreement mustbemadeinadvanceconcerningissues the commitmentandsupportofseniormanagement the Ifapilotself-report systemistobeintroduced, itmusthave • achieve commongoalsinsafetyimprovement. culture where bothmanagementandpilotsworktogetherto Thecompanyshouldalready havedevelopedamature safety • ing pointsberecognized: in theself-reporting process, itisrecommended thatthefollow- To encourageactiveparticipationbylinepilotsandaccuratedata Bringing outthebestinpilotself-reporting contributing toanaccidentorseriousincident. pany atthemanagementlevelcouldpossiblyberesolved before ground handlingissuesthatwithearlyinterventionbythecom- lems withFODatanotherairport,andarangeofdeveloping traffic managementatoneparticularairport,increasing prob- data onarangeofissues,suchasseparationproblems dueto dling. Analysisofthesecommentsprovided consistentempirical ics suchas,airtrafficmanagement,airports,andground han- partment requested thatpilotsprovide open commentsontop- (Airbus 2005). the flighttheyhavejustcompletedpriortoexiting theaircraft the pilotstoaccessanddownloadfrom thecockpitaprofile of that ithasmadeavailableontheA380.Thenewdesignallows can tailorhis/herfuture trainingaccordingly. propose thatifeachpilotisaware ofhispersonalstatistics,he/she into whycertaindecisionswere madeinflight.Theresearchers management strategies.Theobjectiveistogainagreater insight and errors made,alongwiththeirpersonalcopingmethods and abling themtoaddvaluetheflightdata,suchaspotentialthreats uoainmt.0 31*.195 .335* .441** .132 * .301 .115 -.043 .457** .164 .275 .368* .109 .000 Problem solve/decision- -.098 .427** ** .364 Communications .271* .056 Automation mgt .278* .630** Situational awareness ** .361 CAPT/FO Workload mgt Monitor-x-check OBS/FO Contingency mgt OBS/CAPT Briefing Behavioral Marker During thepilotself-reporting studyateasyJet,theSafetyDe- Airbus hasbeenthinkingalongsimilarlineswithanoption aig.6 .3 -.116 -.232 .265 making airline’s integrated safety management system (Burdekin, in press). With the adoption of a tailored design to suit individual airline operations, it is suggested that regular pilot reports on relevant safety issues could be adopted as an added component in the preventative accident and incident “toolkit.” A structured program of pilot self-reports would enhance the factual information that is presently gathered from other sources, such as FDM, audits, and so on, to provide the explanation of “why it happened” to the “what happened” data. Empirical evidence obtained from both civil and military pilots has shown that “listening” to highly trained and situationally aware pilots at the frontline of airline operations by introducing a structured pilot self-reporting system can provide an additional, and potentially very effective, tool to help break the accident chain by the early detection and rectification of problems in the aviation system. ◆

Photo 4. Pilots were asked to comment on ground handling, References/Bibliography ATC, airports, etc. Airbus SAS, A380-800 Flight Deck and Systems Briefing for Pilots. Flight Operations support and Services. Blagnac Cedex. (2005) Burdekin, S.G., Civil Airline Pilot Behavioural Self-Reports During Normal In- • The tasks required of the pilots should be well defined, with Flight Operations. (In press) clear user directions, and any individual rating scale should be Burdekin, S.G., Mission Operations Safety Audits: Measurements of Behavioural

Performance Or Non-technical Skills From Military Air Crew. Spotlight 0403. DAY THURSDAY—INVESTIGATOR’S behaviorally based. Directorate of Flying Safety. Canberra. (2003) • The protocols should be intuitive and easy to work with, so Drewes, G. & Runde, B., Performance Appraisal. In Psychological Manage- that the introduction of an additional pilot requirement is unde- ment of Individual Performance. Editor Sonnentage, S. John Wiley & Sons Ltd. (2002) manding and has a low impact. Mabe, P. A. & West. S.G., Validity of Self-Evaluation of Ability: A Review and • A focused training program should accompany the introduction Meta-Analysis. In Journal of Applied Psychology. Vol. 67. No. 3. 280-296. of any new system. Promotion of the system is recommended by way (1982) Reisinger, D., Sporer, S., & Knoll, G., Paper presented to International of in-house magazines, posters, and other company-specific meth- Society of Air Safety Investigators, Fort Worth, 2005. ods. The use of advocates and role models is extremely beneficial in order to ensure a smooth introduction to the program. Acknowledgment • Pilots need ongoing feedback if a self-reporting system is to The author would like to thank the administrative and opera- remain “alive,” viable, and dynamic. They must see evidence that tional staff of easyJet Geneva for its cooperation and assistance problems they have identified are being acted upon. in collecting the data for this research with special thanks to Capt. • Any self-reporting system should be periodically reviewed and Philippe Pilloud. Thanks must also be given to the staff of the evaluated to ensure that the system is still achieving its aims. easyJet Safety Department at Luton and in particular Capt. Simon • One advantage of such a system is that pilot self-report proto- Stewart and Rafeef Abboud for their contribution to the design cols can be easily altered for future data collection to reflect chang- of the experimental protocols. The author would like to acknowl- ing operational requirements. edge the very kind assistance of Capt. John Scully from Airbus • A pilot self-reporting program should be a component of an and Capt. Peter Griffiths from easyJet.

ISASI 2006 Proceedings • 107 ISASI 2006 PROCEEDINGS 108 • ISASI 2006 ISASI Proceedings ISASI 2006PictorialReview Photos byEsperisonMartinez ISASI 2006 PICTORIAL REVIEW

ISASI 2006 Proceedings • 109 ISASI 2006 PROCEEDINGS 110 • ISASI 2006 ISASI Proceedings ISASI 2006 PICTORIAL REVIEW

ISASI 2006 Proceedings • 111 ISASI 2006 PROCEEDINGS 112 • ISASI 2006 ISASI Proceedings