Air Safety Through Investigation JULY-SEPTEMBER 2018 Journal of the International Society of Air Safety Investigators

Analysis Techniques for Investigating Human Performance page 4

Airbus Support to Accident Investigation page 12

ISASI Kapustin Scholarship Essay— Accident Reports and Aeronautical Decision- Making: Applying Case- Based Reasoning to Improve GA Safety page 16

The Role of Investigations in Creating and Implementing Safety Nets: Minding the Gap page 19

Investigations, Recommendations, and Safety Management Systems page 22 CONTENTS Air Safety Through Investigation Journal of the International Society of Air Safety Investigators FEATURES Volume 51, Number 3 Publisher Frank Del Gandio 4 Analysis Techniques for Investigating Human Performance Editorial Advisor Richard B. Stone By Randy Mumaw, Researcher, NASA Ames Research Center; William Bramble, Senior Editor J. Gary DiNunno Human Performance Investigator, NTSB; Joel Morley, Former Senior Human Factors Design Editor Jesica Ferry Investigator, Transportation Safety Board of Canada; and Fanny Rome, Human Factors Associate Editor Susan Fager Safety Investigator, BEA—The authors examine human performance factors as one of many contributors to air accidents and incidents and that they can be shaped by contextual ISASI Forum (ISSN 1088-8128) is published quar- and system factors. terly by the International Society of Air Safety Investigators. Opinions expressed by authors do 12 Airbus Support to Accident Investigation not necessarily represent official ISASI position By Nicolas Bardou, Director of Flight Safety, Airbus—The author outlines support Airbus or policy. provided during investigation of the crash and lo.ss on Oct. 31, 2015, of an A321 flying from Editorial Offices: Park Center, 107 East Holly Ave- Sham El-Sheikh, Egypt, to St. Petersburg, Russia, that resulted in the deaths of all 224 nue, Suite 11, Sterling, VA 20164-5405. Telephone crewmembers and passengers aboard. 703-430-9668. Fax 703-430-4970. E-mail address, [email protected]; for editor, jgdassociates@ 16 ISASI Kapustin Scholarship Essay—Accident Reports and starpower.net. Internet website: www.isasi.org. ISASI Forum is not responsible for unsolicited Aeronautical Decision-Making: Applying Case-Based Reasoning manuscripts, photographs, or other materials. to Improve GA Safety Unsolicited materials will be returned only if By Ross Rozanski, University of Southern California, 2017 Kapustin Scholarship submitted with a self-addressed, stamped enve- Winner—The author proposes that using case-based reasoning in GA pilot training rather lope. ISASI Forum reserves the right to reject, than rule-based reasoning can produce safer pilots who are more capable of reacting posi- delete, summarize, or edit for space con- siderations any submitted article. To facilitate tively to emergency scenarios. editorial production processes, American Eng- lish spelling of words is used. 19 The Role of Investigations in Creating and Implementing Safety Nets: Minding the Gap Copyright © 2018—International Society of Air Safety Investigators, all rights reserved. Publica- By Jim Burin, ISASI Member and Flight Safety Foundation Fellow—The author observes that tion in any form is prohibited without permis- air travel has superb safety nets that are the result of outstanding investigations over many sion. ISASI Forum registered U.S. Patent and years. He says there is, however, a gap between creating safety nets and using safety nets that T.M. Office. Opinions expressed by authors do must be identified and corrected. not necessarily represent official ISASI position or policy. Permission to reprint is available upon 22 Investigations, Recommendations, and Safety Management Systems application to the editorial offices. By Thomas A. Farrier, Senior Safety Analyst, JMA Solutions, LLC—The author suggests that Publisher’s Editorial Profile: ISASI Forum is print- as safety management systems and “proactive approaches” continue to gain prominence, ed in the United States and published for profes- the need for effective investigations and well-founded recommendations that highlight their sional air safety investigators who are members limitations has never been greater. of the International Society of Air Safety Inves- tigators. Editorial content emphasizes accident investigation findings, investigative techniques and experiences, regulatory issues, industry ac- cident prevention developments, and ISASI and DEPARTMENTS member involvement and information. 2 Contents Subscriptions: A subscription to members is pro- vided as a portion of dues. Rate for nonmem- 3 President’s View bers (domestic and Canada) is US$28; Rate for 28 News Roundup nonmember international is US$30. Rate for all 30 ISASI Information libraries and schools is US$24. For subscription 32 In Memoriam—Charles Foster information, call 703-430-9668. Additional or replacement ISASI Forum issues: Domestic and Canada US$4; international member US$4; do- mestic and Canada nonmember US$6; interna- ABOUT THE COVER tional nonmember US$8. Airbus participated as part of a team (see page 12) to investigate the 2015 crash of an A321. The investigation included assembling a layout of recovered wreck- age on a grid that was completed in only a few days. This process allowed the investigation team to concentrate on particular areas of interest. INCORPORATED AUGUST 31, 1964 2 • July-September 2018 ISASI Forum PRESIDENT’S VIEW

ANOTHER ASPECT THAT SOMETIMES OCCURS AS A RESULT OF HUMAN INTERACTION ON INVESTIGATIONS—IT IS EXTREMELY RARE, BUT IT DOES HAPPEN—INVESTIGATORS FALL IN LOVE AND GET MARRIED.

THEY MET BY ACCIDENT

ircraft accidents to improving air travel safety, Carolina, USA. National Aviation University. create a great deal of investigations bring together There was a second mar- After graduation, she worked trauma and misery for a wide range of people who riage—one that followed at the National Bureau of Air A surviving passengers sometimes develop life-long the American Airlines Flight Accidents Investigation of and flightcrew members, fam- professional relationships 191 accident in May 1979, in Ukraine and was part of the ilies, and people present at the and personal friendships. This Chicago, Illinois, USA. The Ukraine investigating team. impact site. Air accidents and includes governments, indus- accident fatally injured 273 She subsequently enrolled as a incidents can also be difficult tries, unions, first respond- people, including two people Ph.D. student at Delft Univer- for other people in the world ers, operators, and anyone on the ground. Dr. Andy Horn, sity in aerospace engineering. who are not directly affected, involved in the investigation. representing the U.S. Feder- Both Julia and Michiel were but who feel empathy and Another aspect that some- al Aviation Administration on break and met in the hall. compassion for those directly times occurs as a result of hu- (FAA), was on the Survival Sparks flew, and the rest is involved even though they are man interaction on investiga- Factors Group. Kathy Russo history. strangers. tions—it is extremely rare, but was on the team representing Michiel was the first recipi- ISASI members realize that it does happen—investigators the Association of Professional ent of ISASI’s Kapustin schol- fall in love and get married. every accident and incident Flight Attendants. They were arship in 2003, which led to his On April 4, 1977, Southern is an opportunity to improve married shortly after the acci- employment with the Dutch Airways Flight 242, a DC-9-31, aviation safety and survivabil- dent. Horn passed away about Safety Board. In addition, at crashed in New Hope, Georgia, ity. Safety is enhanced if we, as 10 years ago, and we were the Adelaide, Australia, sem- USA, following an encounter unable to locate or obtain inar in 2014, Michiel shared investigators, do a thorough with hail that caused a loss of job and make meaningful safe- information on Russo. the Award of Excellence for thrust in both engines. Sev- best seminar paper with Kas ty recommendations that get On June 8, 2018, Michiel and enty-two people were fatally Beumkes, a fellow employee at acted upon. Last year’s annual Julia Schuurman were married injured, including nine on the the Dutch Safety Board. ISASI seminar theme was at the Delft City Hall, in Delft, ground. There were 27 survi- ISASI extends congratula- “Do Air Safety Investigations the Netherlands. They first vors. tions to Michiel and Julia on Really Matter?” The consensus met in Kiev, Ukraine, following The U.S. National Transpor- their recent wedding. of technical papers presented tation Safety Board (NTSB) the Malaysia Airlines Flight was clearly, yes, they do. investigated the accident, 17 shootdown that occurred That knowledge helps us and Matt McCormick was the on July 17, 2014. At the time, deal with trauma-induced chair of the Survival Factors Michiel’s employer was the stress that we face in our pro- Group. Patricia Hopkins, a Dutch Safety Board, and he fession. But sometimes more flight attendant with South- was a member of the accident human interaction is needed. ern Airlines, was on the team investigation team. Subse- Airlines, aircraft manufactur- representing the Transport quently, he accepted employ- ers, and employee organiza- Workers Union. About two ment with Delft University of tions recognize the adverse years later, Matt and Patricia Technology as an associate consequences of facing such came together while testifying professor teaching aviation- trauma and have developed at a U.S. congressional hearing related subjects. Michiel had very successful crisis stress on airline deregulation. They originally graduated from intervention programs to help married in 1980 and now re- Delft University. Frank Del Gandio responders cope. In addition side in Surf Side Beach, South Julia studied in Kiev at the ISASI President July-September 2018 ISASI Forum • 3 (Adapted with permission from the ANALYSIS TECHNIQUES FOR INVESTIGATING authors’ technical paper Analysis Techniques for Investigating Human Performance presented during ISASI 2017, Aug. 22–24, 2017, in San Diego, HUMAN PERFORMANCE California, USA. The theme for ISASI 2017 By Randy Mumaw, Researcher, NASA Ames Research Center; William was “Do Safety Investigations Make a Bramble, Senior Human Performance Investigator, NTSB; Joel Morley, Difference?” The full presentation can be found on the ISASI website at www.isasi. Former Senior Human Factors Investigator, Transportation Safety Board org in the Library tab under Technical of Canada; and Fanny Rome, Human Factors Safety Investigator, BEA. Presentations.—Editor)

casual reading of popular print the actions of pilots, maintenance tech- finds it difficult to reconcile the actions and online communications can nicians, and controllers. Previous studies he exhibited during the conduct of this lead one to believe that human offered useful insights into how these flight.” Aviation industry representatives A error is the leading cause of air- various influences can come together. expressed dissatisfaction with such find- plane accidents. Consider the following We—the members of this panel (the au- ings, saying they left the industry with the claims: thors who presented this material during unhappy choice of explaining accidents in • A 2007 article in Boeing’s trade ISASI 2017)—seek to promote a similarly terms of suicidal flight crews or complete magazine, Aero, stated that “humans nuanced understanding of how human incompetence. are the largest cause of all airplane performance contributes to accidents To better address the concerns, the accidents” and “approximately 80% of (and to safety). NTSB began to hire human performance airplane accidents are due to human It is true that human performance investigators to dig into underlying HF error.” contributes to a majority of aviation acci- and organizational causes. The NTSB • From the BBC: “How human error dents and incidents, but it is important to hired its first human performance inves- can cause a plane crash.” recognize that human performance is one tigator in 1977 and established a stand- • In the Independent in 2015: “Human of many contributors to an accident and alone group by 1983. This group began error has been revealed as the biggest is shaped by contextual or system factors. probing more deeply into systemic issues, cause of air disasters around the Unless we clearly understand the factors which was reflected in more expansive w o rl d .” contributing to human performance in causal statements, like one from the in- • In a report by the UK civil aviation an occurrence, resulting safety action will vestigation of a crash in Rockland, Maine, authority: “Two-thirds of all fatal be poorly targeted or superficial. For this USA, that cited management pressure, accidents involved a flight crew– reason, we would prefer to see the identi- supervision, training, procedures, and related primary causal factor.” fication of human error as a starting point fatigue. Other national transportation for analysis, not an end point. With that accident investigation agencies followed • There is the Wikipedia page titled “Airliner accidents and incidents goal in mind, we strive to offer analysis suit. caused by pilot error” that lists sever- techniques that can reveal important The French Bureau d'Enquêtes et al hundred accidents and incidents. influences on human performance. d'Analyses pour la sécurité de l'aviation civile (BEA) more thoroughly investigat- Those who came before us ed HF issues during the investigation of Human error and accidents an A320 accident in Mont Sainte-Odile, Not surprisingly, others have examined France, in 1992. Afterward, the BEA These types of pronouncements lead the this topic. Notably, the theme of the Soci- worked with HF institutes and gradually public to the unambiguous conclusion ety of Air Safety Investigators second an- that “human error causes accidents”—a nual meeting in 1971 identified a need for introduced HF academic courses into the strongly misleading claim. Certainly, a more complete analysis of human per- training curriculum for all BEA investi- these communications sources are less formance. At this meeting, U.S. National gators. The Transportation Safety Board concerned about trying to explain the Transportation Safety Board (NTSB) man- of Canada (TSB) has employed dedicated complex nature of causation, but a few ager Chuck Miller declared human factors HF investigators since the late 1990s of these strong statements regarding (HF) the “greatest single technological and provides all of its investigators with causation are coming from the aviation challenge” facing society. At the time, training in investigating for human and industry. interest in HF was prompted by unsatisfy- organizational factors. For aviation safety professionals, it ing conclusions in some accident reports. In the recently published Human should no longer be acceptable to make For example, an accident involving a Factors in Air Transportation Systems, the claim that there is a single “cause” Convair 340 that crashed in New Hav- the chapter “Accident Investigation,” behind any accident or incident. As we en, Connecticut, USA, was explained in which William Bramble authored, offers a now know, accidents are the result of terms of the captain’s intentional descent history of advancements in investigating some combination of latent failures, un- below minimums. The report concluded human performance. This chapter pro- expected situations or failures, underlying that the board was “unable to determine vides a detailed tour of the major shifts organizational policies and practices, what motivated the captain to disregard and mileposts, including the establish- degraded environmental conditions, and prescribed operating procedures…and ment by NASA of the CRM (crew resource

4 • July-September 2018 ISASI Forum management) framework; the work in the 1980s, motivated by the Three Mile Island accident and others, to describe complex system failures; the bow-tie method of risk management; Reason’s book on human error in the early 1990s and his later work on organizational accidents; Woods and is employed by San Jose State University his colleagues and their publication Behind Human Error, which laid a (SJSU) and is a researcher at NASA foundation for resilience theory; the work by Vaughn to apply sociological Ames Research Center at Moffett Field, constructs to the analysis of complex system failures like the Challenger California, USA. Prior to joining SJSU, he worked at Boeing for 18 years and for disaster; the Wiegmann and Shappell work on the Human Factors Analy- much of that time supported aviation sis and Classification System taxonomy; and Leveson’s control-theoretic safety and accident investigation. His Systems-Theoretic Accident Model and Processes (STAMP) model. These Randy primary interest is understanding how to advancements and the work of others led to improved guidance from the Mumaw support human performance in complex, International Civil Aviation Organization (ICAO)—specifically, the 2011 safety-critical systems. He holds a Ph.D. document that describes how HF analysis techniques could be integrated in cognitive psychology. into the overall investigation. Bramble also gives ample space to the Australian Transport Safety Bureau (ATSB) document “Analysis, Causality, and Proof in Safety Inves- tigations” (2007), which addresses the concept of causation, links from evidence to conclusions, establishment of standards of proof, investigative is a senior human performance stop rules, and a refined language for probability that is used in ATSB investigator with the U.S. National reports. This ATSB document establishes a standard for rigorous analysis Transportation Safety Board, where he has worked since 1999. He holds a Ph.D. of HF issues in accident investigations. The Bramble chapter provides a in human factors psychology from the sense of the foundations of human performance investigation. Investiga- University of Central Florida and a U.S. tions also require practicable investigation techniques. private pilot certificate. Over the last In the following sections, the individual ISASI 2017 panel members William two decades, Bramble has investigated offer specific methods and tools to support understanding the influences Bramble aircraft accidents in the Americas, underlying human performance. Africa, the Middle East, and Asia and has trained accident investigators in the Two HF issues need addressing (Randy Mumaw) U.S. and abroad. Thanks largely to the efforts of the members of ISASI, accident investiga- tion has made significant strides in shifting to a more nuanced and com- plex account of accident causation and to a deeper analysis of “human error.” Indeed, commercial aviation has made such strides in its approach served as a senior human factors to managing safety that industries such as health care and process control investigator with the Transportation have sought to emulate our approach. Although these important shifts are Safety Board of Canada for 11 years. In occurring around the world, there is still a need to address two issues: this role, he investigated human factors issues in many air, rail, and marine 1. Inconsistent access to HF expertise and methods occurrences. Morley also worked as a HF expertise, especially as it applies to accident investigation, is well human factors specialist for Canada’s air navigation service provider for six established in a number of the investigation agencies around the world. Joel Morley years and has a background in research We, the authors of this article, are testament to the increasingly important and consulting. He has a Ph.D. in applied role that HF is given. However, this expertise is still sometimes unavaila- psychology from Cranfield University. ble to smaller investigations, and there have been cases in which critical system factors that affected human performance were not addressed fully. Part of the explanation for this state is that to develop the right people, HF expertise needs to be integrated with knowledge of airline operations and an understanding of the investigation process. A formal education in works as a human factors safety HF is unlikely to produce the full range of skills required, and a technical investigator for the Bureau d'Enquêtes et background in aviation is unlikely to promote a sufficiently deep under- d'Analyses pour la sécurité de l'aviation standing of HF theories and paradigms. Neither approach provides the civile (BEA). She has an engineering necessary background in investigative skills, such as interviewing and degree and a Ph.D. in ergonomics in documenting evidence. aviation. Rome worked for several years as a consultant and joined the BEA Investigation agencies must find ways to develop all three competen- Fanny two years ago. She has participated cy areas to create an effective HF investigative capability. The lack of a Rome in several safety investigations, substantial cadre of HF investigators has also limited the establishment including the Germanwings accident of standard analysis methods and tools. Early ICAO documents on HF investigation. She is currently working provided only lists of potential influences on human performance. Inves- on the implementation of an analysis tigators were not given analysis methods or tools to determine whether methodology. these influences actually were present and influenced performance. While useful methods and tools have been developed more recently, it has been

July-September 2018 ISASI Forum • 5 difficult to establish standards or even ensures he or she is fully qualified or that determine the priority for the response in best practices. a training performance standard was not the context of everything else going on, enforced. These are system issues to be and then execute the appropriate actions. 2. The remaining vestige of the “bad pilot” addressed. But when a pilot has met the Ideally, the flight deck interface and its approach performance standards in the prescribed associated procedures aid the flight crew The “person” view of human error from manner, it does not advance the investi- in completing this sequence accurately decades ago focused on the close prox- gation to point out that he or she had a and completely. An assessment method, imity of the error to a bad outcome and weak evaluation in the past. called CREW, allows an analyst to identify concluded that the human triggered the To advance the state of the art of acci- both factors that support this perfor- catastrophe. There was less emphasis on dent investigation, HF professionals need mance and factors that make perfor- determining the influences on that per- to provide analysis methods and tools mance more difficult. formance, and it led to the idea that if we that can move us beyond the identifi- The assessment method consists of remove the pilots who make errors from cation of a human error. The following evaluating the sequence of actions using the system, the system would be safer. are two tools that have been effectively a set of more than 100 help and hinder Our evolving view now accepts that applied to human performance. prompts, i.e., in the case of detection, pilots—indeed, all humans—make errors, what factors help, or aid, detection and and an effective operational system needs Spatial disorientation/vestibular what factors hinder detection. An exam- to be resilient when errors occur. We ple of what can help detection is a salient need to understand that there is a range illusions alert; an example of a detection hinder is of pilot skill and knowledge within the Around 2008, I conducted an analysis when there is no alert and the pilot must qualified pilots worldwide; that there that suggested that spatial disorientation compare current airplane performance are daily influences on performance and (SD) had been a factor in a number of to some internally defined standard, such proficiency, such as fatigue, operational commercial transport accidents and inci- as feel. An example of what can hinder de- pressures, crew dynamics, and compla- dents. Indeed, SD may have played a role termining actions is when the nonnormal cency in a safe system; and that flight in about 20 accidents and major incidents checklist is not associated with an alert crew responses to failures and upsets since 2000. The concern regards two types (such as unreliable airspeed in many air- are trained but not to the point that the of vestibular illusions, a somatogyral illu- planes). In that situation, the flightcrew appropriate response is highly reliable. sion and a somatogravic illusion. When members are required to recall that there Airlines strive to balance training costs the external view of the world is lost or is a relevant checklist for the situation and pilot proficiency. degraded due to weather or darkness, a they are experiencing. There is more work to do. Some acci- pilot can be strongly influenced by ves- The objective of this assessment is to dent reports have noted that the accident tibular illusions and make control inputs analyze the alerts and other flight deck pilot’s training record showed less-than- that lead to a loss of control or pitching effects that occurred in the accident and perfect performance, such as a failure to down into the terrain. the response expected from the flight concentrate or a low score for situational These vestibular illusions cannot be crew to see if there is strong support from awareness. The implication seems to be observed, but the control actions of the the interface or if the flight crew needs to that this pilot, who failed to perform as pilot are observed and recorded, and find its way to an appropriate response on expected in the accident flight, had weak- these actions can be cast as pilot error. In its own. In one analysis of an operational nesses that were revealed in training, and order to investigate the potential role of event, it was determined that the pilot therefore that pilot was unable to perform vestibular illusions, Boeing worked with needed to take an action that was the across the full range of operational a Dutch company, TNO, to develop an opposite of the training standard. Thus, situations. Stated more strongly, “This analysis tool that determines the acceler- the assessment tool can aid investigators pilot was ‘qualified,’ but there were some ations at the point of the pilot flying and in understanding why the flight crew did known weaknesses, and this pilot finally uses those accelerations to determine the not take the appropriate actions. found a situation that he or she was not likelihood that a vestibular illusion could able to handle. The pilot should not have account for the control inputs. Although Using an influence diagram (William this tool cannot definitively determine been flying.” Bramble) This is a version of the “bad pilot” that the pilot was influenced by SD, it offers a way to test whether inappropriate A challenge that multidisciplinary teams approach to safety because it makes the face when investigating aircraft accidents suggestion that the pilot was not truly pilot actions are consistent with mislead- ing vestibular cues. is the development of a shared mental qualified for the job. However, the system model of possible causal influences. needs to be able to accommodate pilots Individuals with different backgrounds who, even though they are qualified (by Interface support for responding to gravitate toward different issues. Lacking regulation), do not concentrate fully nonnormals a common accident model, investigations during a five-hour flight or are slow to When airplane system failures occur, can become fragmented, and the syner- respond to a stickshaker because they did the flight crew should take the following gistic benefits of a multidisciplinary team not expect it. This will always be the state actions: Detect that an important change can be lost. Since 2014, I have been exper- of pilots worldwide. occurred (an alert), understand the imenting with solutions to this problem. To be clear, it is appropriate to point nature of that change, determine what ac- The work of Rasmussen (1997) and Leve- out when a pilot lacks the training that tions (if any) should be taken in response, son (2004, 2011) has been particularly 6 • July-September 2018 ISASI Forum Figure 1. Influence diagram for a Ketchikan, Alaska, USA, air tour accident. helpful. Both authors have created rubrics I am the first investigator at my agency I created another influence diagram for visualizing causal influences, includ- to use adaptations of them to facilitate during my work on the investigation of a ing management and regulatory aspects, multidisciplinary investigative teamwork. 2014 accident involving a privately oper- and these visualizations can be custom- My initial attempts at influence ated Gulfstream G-IV that crashed during ized to highlight the unique complexities diagramming did not hew closely to an attempted takeoff with the gust lock of a particular accident and industry. Rasmussen or Leveson. I first tried engaged. This time, I did the diagram- Both authors have strived to create con- influence diagramming during my work ming earlier in the investigation, and I trol-theoretic models of sociotechnical on the investigation of the 2013 accident found it useful for explaining my analysis systems. They suggest that participants in involving Asiana Airlines Flight 214 in San to other colleagues. I found the technique such systems strive to cope with com- Francisco, California, USA, in which the helpful for explaining my logic in group petitive pressures for productivity and flight crew lost awareness of the active meetings. This case was also a test of efficiency while simultaneously keeping modes driving the autoflight system on the value of influence diagramming in a other aspects of system operation, like approach, and the airplane decelerated less complex investigation. Although the safety, within acceptable parameters. below approach speed and struck a sea case involved a general aviation airplane Rasmussen asserts that individuals at dif- wall. This was a test case for me, and I operated by two full-time pilots with little ferent levels of the system have different used influence diagramming to explain management structure, diagramming goals, different access to information, and investigative analysis that had already causal influences allowed me to explicitly different methods of control, and that the been completed. I found a single-page link social issues, like procedural drift and interaction among these actors—govern- visual representation of complex causal distant failures in prior safety audits and ment officials, regulators, associations, influences underlying this accident to certification of a fail-safe design feature, companies, managers, and operators— be very helpful for explaining the causal to the sequence of events leading to the sets the stage for an accident. I am not logic of the report, and I used the dia- crash. the first investigator to use these models gram to present HF in the case at various I used influence diagramming a third for the analysis of accident causation, but conferences. time during my work on a small-team

July-September 2018 ISASI Forum • 7 investigation is thus: “How do we get to an explanation of human behavior that is rigorous, defensible, and leads us to miti- gations that improve safety by addressing the reasons for the behavior at the system level?” An in-depth investigation that digs into systemic causes is not practicable for every accident. Accidents in less complex systems, or that present lower levels of risk to the traveling public, do not attract the same level of investigation and may not have sufficient data available to pro- vide answers that would lead to systemic changes. More complex accidents, involv- ing greater risk to the traveling public, normally result in thorough investiga- Figure 2. The need to balance the level of investigation with the data available to get the tions and have sufficient data available to biggest safety payoff possible. support in-depth safety analysis. investigation of an air tour accident focus of investigative interviews. In short, The goal is to balance the level of inves- involving a de Havilland DHC-3 that I have found influence diagrams to be a tigation with the data available to get the crashed when transiting a mountainous very useful tool. biggest safety payoff possible (see Figure area in low-visibility weather conditions The acci-map–inspired diagrams I 2). In this way, we keep the scope of the near Ketchikan, Alaska, USA (see Figure 1, have been using have several potential “not much data” accidents smaller but do page 7). By this time, I had become aware shortcomings. They incorporate a linear enough so that we can use the aggregate of Rasmussen’s acci-map method, and it sequence of events (as shown in Figure to achieve meaningful safety information influenced my decisions about what to 1) that has been opposed by various the- (e.g., another VFR into IMC accident is include in the diagram. I also began the orists, including Leveson. They contain unlikely to lead to much safety action diagramming much earlier in the inves- an eclectic mix of content with a less but, when considered as part of a data tigative process and used the resulting formal hierarchy than those described set, can lead to meaningful inquiries). products to lead small-group meetings by Rasmussen. The relationship between In accidents where we have good data, near the beginning of the analysis phase influence and outcome is not quantified, we devote greater resources and achieve of the investigation. Use of the diagrams and the linkage of evidence to conclusion safety action at the system level. How do we make sure we are eking was quite helpful conceptually for linking is not as explicit as the method described every bit of safety benefit from the infor- competitive pressures and social and by the ATSB (although this linkage is ad- mation we have available? Experience technical influences to the accident dressed in subsequent written analyses). points to five critical success factors relat- sequence of events. It was also pragmat- Furthermore, considerable subjective ed to how we carry out an investigation: ically useful for aiding the development judgment is involved in the selection of 1. Follow a method. of team thinking about causal influences issues to highlight. 2. Back up your method with tools and for facilitating team decision-mak- Despite these potential shortcomings, ing about which influences to address and frameworks. I have found influence diagramming 3. Use a team. with safety recommendations and how quite helpful because it encourages a to divide the work of developing those 4. Iterate. systems-oriented approach, facilitates the recommendations. 5. Consider the whole system. development of a shared mental model Since completing the Ketchikan among investigative team members, sup- 1. Follow a method accident investigation, I have been using ports team decision-making, and explic- An investigation methodology that is influence diagramming for two additional itly links safety issue areas with accident based on good safety science will save investigations that are still ongoing. In features. time and make conclusions more defen- these most recent cases, I have been sup- sible by plementing acci-map–inspired diagrams, • providing a structure for organizing like the one shown in Figure 1, with dia- Maximizing safety benefit from avail- able information (Joel Morley) data that is based on a firm under- grams of organizational control structure, standing of safety, risk, and how like those developed by Leveson and A safety investigation should lead to a accidents happen. applied by Thomas and Malmquist in the reduction in risk. Achieving this objec- • helping to share information among aviation domain. In my latest investi- tive requires that a safety investigation team members. gation, I created a draft influence dia- provides an in-depth understanding of gram within weeks of the accident. This not only what happened at the time of • making analysis visible to all team facilitated shared team thinking about the occurrence, but also why it happened members. investigative issues, facilitated investiga- so that mitigations can be directed at the • providing a mechanism to challenge tive planning, and helped me refine the system level. The challenge for the HF the investigation team’s thinking.

8 • January-March 2018 ISASI Forum At the TSB, we follow our Integrated stand how the situation was understood contributed to that performance. Second, Safety Investigation Methodology (ISIM). by those involved as it unfolded, is critical it helps us consider alternatives when we This methodology incorporates steps to an effective HF investigation. To under- cannot definitively identify a single chain that guide investigators from the facts of stand how to prevent recurrence, we must of events. In such cases, we need to lay the occurrence to making a compelling first understand why the actions of those out the possibilities with the information argument for mitigations that address involved in the occurrence made sense available to support or refute each one. system safety deficiencies. Steps include to them at the time. This is best achieved When laid out on paper, an investi- developing a sequence of events, identify- with investigation teams that incorporate gation methodology looks like a linear ing the unsafe conditions and underlying different perspectives to challenge view- process—from data collection to analysis factors that contributed to these events, points and expand thinking. to investigation report. In reality, how- performing an analysis of the defenses As we work through our analysis meth- ever, these phases overlap considerably. that are already in place to address these odology and apply the tools and frame- Analyzing what went wrong in a complex conditions, and determining the residual works, it is vital that we challenge our system often leads to additional questions level of risk in the transportation system. thinking. Explaining the links between resulting in renewed data collection. For the facts of the occurrences and identified example, hypothesizing that a knowledge 2. Back up your method with tools and underlying factors prompts questions and deficiency contributed to a particular frameworks helps to point out gaps in our knowledge crew action leads an investigation team Of course, any methodology is only as and logic. On large investigations this is to begin to review training programs and good as the information that is entered easy—the group structure ensures a team files that may lead to further data collec- into it. We need complementary tools and approach. In smaller investigations, when tion to establish whether the issue is local frameworks to help guide our thinking working more independently, we often or systemic. This cycle of scratching the as we apply a methodology with a view need to seek out people, and the best surface and then digging deeper into a to understanding behavior in complex investigators do this by pursuing collab- specific issue takes place multiple times systems. orators at critical points in the investiga- when carrying out an HF investigation. At the TSB, we have adopted certain tion and talking through their analysis. frameworks to help us explain human In short, a team helps us to build more 5. Consider the whole system behavior. For example, we train our in- compelling arguments for safety improve- Finally, to be sure we achieve the great- vestigators to apply a version of Reason’s ments. est safety benefit from an investigation, Generic Error Modeling System (GEMS) we need to consider all aspects of the to analyze the unsafe acts involved in an 4. Iterate system, including organizational factors, occurrence. Applying this model involves We are in the business of analyzing com- the regulatory framework, and regulatory examining whether events went accord- plex systems and developing a compelling oversight. The investigation should be ing to an operator’s plan and pinpointing argument for safety improvements. To do considered complete when we reach an the type of error we are trying to explain. this successfully, we need to build our un- underlying factor for which no further This understanding facilitates the derstanding, challenge it, improve upon mitigation is practicable. identification of contributing factors and it, and build it some more. allows safety action to be better targeted Repeated iteration provides us the Using a specific occurrence analysis on the systemic deficiencies contributing means to avoid two potential pitfalls in to human performance. For example, the HF investigation. First, it prevents methodology (Fanny Rome) understanding that an execution error us from settling too early on an overly The aim of safety analyses is to under- consisted of a memory failure leads us simplistic explanation and helps ensure stand why there are occurrences and to examine the effectiveness and use of that we are understanding human perfor- draw up recommendations to prevent memory aids. Similarly, understanding mance in the context of the system that their reoccurrence. These two objectives that an operator’s plan was based on an incorrect understanding of the opera- tional situation leads us to examine the information available to the operator and the many factors influencing the opera- tor’s ability to perceive and process that information. We have also developed guides to be applied to help investigate specific areas, including sleep-related fatigue and organ- izational and management factors. These tools help us to gather and analyze data in these areas, helping to ensure conclu- sions are rigorous and defensible.

3. Use a team Perspective-taking, the ability to under- Figure 3. The accident model.

July-September 2018 ISASI Forum • 9 STCA can detect the conflict. This step might need a collective ap- proach and require different actors from the sector. The idea is to determine the regulatory principles and the principles actually in place. This step is similar to a work analysis, independent of the acci- dent. Thus, the starting point is not the human error but rather the positive side, as correct performance and error can be viewed as two sides of the same coin.

Steps 3 and 4. Performance of safety principles The following steps are the analysis of the performance of the different safety principles. The objective is to analyze how the safety principles actually worked in the occurrence. Some safety principles failed, and others worked in a more or less efficient way. Then the analysis focuses on the Figure 4. Synopsis of the analysis methodology. “why”—why some principles failed and others worked. The methodology does are complementary but not alike. Indeed, of the accident and the escape point. The not focus on errors but rather on perfor- predictions [and thus recommendations] accident corresponds to the classical mance variability. Data come from the oc- are possible only because we have created definition of an accident: controlled flight currence but also from everyday working some kind of “model” for the situation we into terrain, runway excursion, etc. The practices and from similar occurrences. wish to gain control over, not because we escape point is the state of the sociotech- Indeed, it is interesting to consider the can exhaustively foresee every contextual nical system corresponding to the loss of performance of the safety principles on factor, influence, and data point control of the situation (the ball is forced other days. This might reveal that the With this idea in mind, a specific occur- out of the gutter). For example, an escape adjustments are everyday adjustments rence analysis methodology called point can be “visual approach toward an that are not specific to the day of the MINOS has been developed by the com- inappropriate runway” or “undetected occurrence or to the different operators pany Dedale to provide a pragmatic step- conflicting flight paths.” working at that time. by-step guide to safety investigators. Lessons learned: The lessons learned The underlying accident model is based Step 2: Determine the safety principles in raise two kinds of questions: (1) What on the “gutter” metaphor (see Figure 3, the operational situation can be inferred concerning the safety page 9) with the idea that any accident is The safety expectations are detailed for principles’ effectiveness and robustness? the result of an unrecovered loss of con- the sociotechnical system and the oper- (2) Were the expectations realistic? trol of the system’s (disturbed) dynamics. ational situation defined in the previous These elements then guide the safety At the BEA, we adapted the MINOS step. They form an explicit description of recommendations. methodology to our needs and objectives. the expected principles that answer these We follow an iterative process composed three questions: (1) What is supposed An example of four main steps (see Figure 4). to keep the sociotechnical system safe We applied this methodology to the anal- in such a situation? (2) How is a loss of ysis of a serious incident: a near collision Analysis methodology control of the situation supposed to be re- between an aircraft in visual approach Step 1: Define the sociotechnical system, covered? (3) How are consequences sup- and a helicopter in VFR flight. the operational situation in which the posed to be mitigated? This corresponds Rather than considering the perfor- occurrence occurred, and the occurrence to the “kind of model for the situation we mance of each actor individually, we category wish to gain control over.” Expectations considered the overall situation, the “ap- Based on the theory of joint cognitive sys- are defined in light of safety objectives; proach toward parallel runways with VFR tems, a sociotechnical system is defined the performance considered is a safety and IFR traffic.” The potential accident by humans, machines, and organizations performance; i.e., how the sociotechnical was a mid-air collision, and the escape operating together toward a common system is supposed to work safely. Safety point was the aircraft following conflict- goal. The sociotechnical system usually principles can be technical, human, or ing flight paths without anyone being considered is “the aircraft and the crew,” joint performance. For example, a safety aware of it. and the operational situation is the flight principle can be “the conflict is detected, Safety principles were determined or a part of the flight and an escape maneuver is executed.” The by answering the question, “What was The occurrence category is composed crew, the controller, the TCAS and/or the supposed to keep the system safe in ap-

10 • July-September 2018 ISASI Forum proach with mixed traffic?” For example, 2. Most accidents and incidents are errors may not be linked to an undesired the visual acquisition of traffic by crews caused by human error. outcome, such as a low-energy state or an is based on an outside visual scan guided We counter these misconceptions with incorrect altitude. by ATC information, on the monitoring of an understanding that accidents are the The second approach, described by the VHF frequency, and on the ND, which result of some combination of latent Rome, starts with an undesired out- is an unintended use of TCAS. The con- failures, unexpected situations or fail- come: a loss of control of the system. troller’s awareness of the traffic is based ures, underlying organizational policies The analysis then identifies the ways on the radar, on communications, on the and practices, degraded environmental in which the overall system design was outside visual scan for the tower control- conditions, and the actions of pilots, supposed to prevent or recover that loss ler, and on reported positions from the maintenance technicians, and control- of control; these are the safety principles. crews. lers. We consider it naive and unhelpful to The analysis next attempts to determine To recover from a loss of separation, the conclude that an accident was the result how the safety principles failed to prevent detection is supported by alerts: TCAS of a single cause, especially if that single system performance from transitioning may alert the crews of the conflict and cause is a human. to the undesired outcome. For human the controller might be informed by the Yes, human performance contributes— performance, specifically, “How did the STCA. in the majority of cases—to the sequence system fail to maintain (or succeed in The performance of these different of events that lead to an accident, but maintaining) performance within expect- principles was analyzed. The weakness unless we clearly understand the factors ed limits?” The CREW tool, discussed by of the visual detection was underlined influencing human performance in an Mumaw, can be useful for understanding once more. A single technical failure (the occurrence, resulting safety action will why some safety principles fail to achieve transponder failure) led to the failure of be poorly targeted or superficial. To best the desired human performance; it offers several safety principles. The technical identify and manage system risks, we a systematic analysis of the flight deck ef- failure the day of the occurrence entered would prefer to see the identification of fects—indications, alerts, etc.—to identify in resonance with performance variability human error as a starting point for analy- the ways in which they can reduce pilot (nonstandard phraseology, variability in sis, not an end point. Collectively, we—the reliability. flight paths, etc.). The impact of the loss four authors—have been conducting These two complementary approaches of the transponder was clearly underesti- human performance investigations for reflect mated. decades, and we have developed (or are • the variability (or lack of reliability) The occurrence showed that at an aware of) analysis methods and tools to of human performance that is always airport with high-density traffic, the wish aid in revealing systemic influences on present and is either managed or to optimize the traffic and keep it flowing, human performance. it leads to more vulnerable system in addition to the trust existing between We each described investigation tech- states—or even undesired outcomes. pilots at their home base and control- niques, processes, models, or tools that • the system design (broadly defined, lers, could make these actors work with can provide a link between human perfor- e.g., by the flight deck interface, reduced safety margins without being mance and systemic influences. These -to operational procedures, pilot train- aware of this. This leads to a system that gether do not represent a single, coherent ing, oversight from others, etc.) that, is not very robust to a disruption. analysis approach but are meant to show ideally, manages that performance In conclusion, in this methodology that promising solutions exist for specific variability to ensure safe mission human performance is not considered in performance issues or for conducting an completion. an isolated way but rather at a sociotech- investigation. A larger point is that HF The appropriate role of the overall avi- nical level. Performance is considered expertise should be sought out to support ation system is to both increase reliability in light of safety—safety investigations any investigation. in human performance (reduce human are not audits or training evaluations. One difference that may stand out in errors) and to manage the inevitable Performance is considered in light of our descriptions is between analysis that performance variability when it threatens daily habits and constraints, and over is triggered by a human error and analysis to transition to an undesired outcome. time. By doing so, the methodology helps that begins with an undesired system out- An investigation of human performance us to draw up recommendations that come. In the first approach—e.g., Morley’s is likely to address both perspectives not only focus on the human but also on GEMS method—the analysis starts with in explaining systemic influences, and the systemic level, in particular when a specific behavior that is different from Bramble offers representational methods the expected human performance is not the behavior expected (typically having to integrate these influences into a more realistic. the benefit of hindsight)—a pilot does not coherent description. detect that airspeed has decreased to the We see a future in which these human Presentation summary stickshaker or a pilot makes an input on performance investigation methods and The starting point for this paper was a the controller (column or sidestick) that tools are important elements of a more recognition that two misconceptions is the opposite of what was prescribed. integrated approach to accident investi- about accident causation still pop up in These unexpected behaviors (in the gations. Each investigation agency is on the popular communications (and some- operational context) are typically labeled its own path to this more integrated times in aviation industry publications): as human error, and there follows an approach, and we hope that this paper 1. Accidents typically have a single attempt to understand the nature of the has created a spark for further progress cause. error and what led to it. Note that these down that path.

July-September 2018 ISASI Forum • 11 AIRBUS PROVIDES SUPPORT

By Nicolas Bardou, Director of Flight Safety, Airbus

The event synopsis The Airbus chief product safety officer’s the Airbus mission at any time, if re- On Saturday, Oct. 31, 2015, at 0350 UTC, decision to dispatch a go-team is always quired. This allowed the team of inves- an A321 registered EI-ETJ departed from made after information consolidation tigators to focus only on the technical Sharm El-Sheikh, Egypt, under flight from multiple sources (local field repre- mission. number 7K-9268 to St. Petersburg, Russia, sentatives, embassy, news media, etc.), with two cockpit crewmembers, five cab- medical checks of team members, and a Mission preparation and coordination security assessment as appropriate. in crewmembers, and 217 passengers on As the time on site was limited, the The Airbus go-team arrived in Cairo, board. At 0412 UTC, the aircraft vanished objective was to maximize efficiency by Egypt, on November 1. The team was from radar. Aircraft wreckage was found splitting the teams into groups: composed of an Airbus product safety in central Sinai (about 131 nautical miles • The first group would detail the accident investigator who was assisted north of Sharm El Sheikh city). The air- “main” wreckage (see Figure 1, page by two corporate security officers and craft was completely destroyed, and there 15) formed by the forward fuselage specialists from powerplant, aircraft sys- were no survivors. The aircraft debris field up to the wings and both engines tems, and structure. This team was then was spread over more than 16 kilometers (separated from the wings). southeast of the main wreckage area, reinforced by four additional members typical of an in-flight breakup. from product safety, flight test, and flight • The second group would focus on the recorders to support flight data recorder rather large fuselage parts present a Airbus crisis response analysis. few kilometers away from the main wreckage site. Airbus Toulouse Crisis Control Center was immediately activated, and contact Mission preparation • The third group would try to reach was made with Le Bureau d'Enquêtes et First information shared by the IIC re- the most remote light aircraft parts. d'Analyses pour la sécurité de l'aviation vealed that the accident site was isolated, Each group was composed of repre- civile (BEA), airline representatives, and spread over several kilometers, and only sentatives from each organization. As the investigator-in-charge (IIC) from the accessible by helicopter (one and a half there is no GSM network cell coverage in Egyptian Central Directorate of Aircraft hours and 280 kilometers away) with daily that area, iridium phones and walkie- Accident Investigation (ECAA) leading rotations from dawn to dusk. This would talkies were used to ensure coordination the investigation. The IIC accredited limit the time available on site and would and communication between the groups. representatives from all the countries require several coordinated teams. Both Before each group separated, an initial involved included recorders had been located and were be- risk assessment and awareness was • Russia (Interstate Aviation Com- ing recovered so a separate team was set proposed by the operator and Airbus and mittee/IAC MAK) as the state of the up to prepare data retrieval in the Cairo validated by the IIC. operator, facilities. The Egyptian authorities shared • France (BEA) as the state of design, security information and presented Initial risk assessment • Germany (Bundesstelle für Flugunfal- their objectives for the coming days. If The operator and manufacturer can luntersuchung/BFU) as the state of weather permitted, investigators would provide relevant information to the manufacture, be dispatched to the accident site every investigation boards concerning poten- tially dangerous cargo, estimated fuel • Ireland (Air Accident Investigation day by means of the Egyptian Ministry of Unit/AIU) as the state of registration, Transportation. at the time of impact, and location, as and Airbus security officers gathered max- well as the number of oxygen bottles, imum information in terms of accident fire extinguishers, oil tanks, composite • The United States (National Trans- site location, security dispatch setup at materials, batteries, and more (see Figure portation Safety Board/NTSB) as the and around the wreckage, the weather 2, page 15). All of these elements must be state of the engine manufacture. forecast, and logistics for the journey carefully considered before approaching a The operator was appointed technical (communications, food, water, medical damaged aircraft. advisor to the ECAA. Pratt & Whitney was first aid kits). They continuously assessed Because the area to cover in the desert appointed technical advisor to the NTSB. the security situation by gathering and was immense and there was limited EASA and Airbus were appointed techni- sharing information with all the parties time on site, each group was requested cal advisor to the BEA. involved. They were empowered to stop to gather only factual information while 12 • July-September 2018 ISASI Forum TO ACCIDENT INVESTIGATION

(Adapted with permission from the author’s technical paper Airbus Support to Accident Investigation presented during ISASI 2017, Aug. 22–24, 2017, in San Diego, California, USA. The theme for ISASI 2017 was “Do Safety Investigations Make a Difference?” The full presentation can be found on the ISASI website at www.isasi.org in the Library tab under Technical Presentations.—Editor)

keeping analysis and identification and then transmitted the results of for a later stage. Each group recorded their review to Cairo’s team. wreckage evidence by taking the GPS On the systems side, this helped to position and photos of each part. Upon rule out some scenarios and helped return to ECAA headquarters, the the on-site team focus on the remain- information collected was shared with ing ones. all members of the investigation, and On the structure side, for each the missions for the next days were aircraft part, they could identify and prepared. locate it precisely on the airplane. While performing the identification, Next missions the team drew the contour of each Viewing the accident site configu- part on a spreadsheet by counting its ration—spread over several kilome- frames and stringers. This provided a ters—it appeared that the initial event global vision of what was recovered, occurred at a rather high altitude and what was still missing, and what parts that the first parts to detach were the were adjacent to other parts. furthest ones from the main wreckage. Airbus Defense and Space shared “Plei- Aircraft 3-D mockup ades,” very high resolution imagery, to The 3-D mockup of the aircraft air- help the team locate wreckage parts frame and systems was created using and prepare for missions. CATIA software, which is usually used In the desert, travel is permitted only for design and production purposes. It by four-wheel drive vehicles so that is composed of several layers; the idea the topography is not damaged and here was to adapt the software from its by following “wadi” (a valley or ravine) original purpose and use it to create protected by Egyptian military forces a 3-D reconstruction of the wreckage. (ground and air). Groups were then The 2-D drawings were redrawn on the split up according to areas that could external layer (as if it were decals) and be reached following predetermined applied to the airframe layer to display routes (see Figure 3, page 15). This each part precisely (see Figure 4, page Nicolas Bardou would keep the groups from having to 15). search for route access, avoiding long Then one by one, each wreckage part was appointed director of flight safety– accident/incident investigations in detours and saving time. was placed on the mockup. Parts with 2006 within the Airbus product safety a common side matched very well, and team. In this function, he leads Airbus Evidence collection, engineering it appeared that more than 95 percent investigations of major events in support analysis of the aircraft could be reconstructed. of official investigation board activities. Due to the very large number of wreck- This 3-D visualization allowed the In his current position, Bardou has age parts and evidence collected, team to identify areas of particular in- developed expertise in the accident Airbus set up a “mirror” team coordi- terest to the investigation and helped investigation domain by coordinating nated from Toulouse Crisis Control determine where the event initiated the Airbus team’s multiple on-site activities, flight data recorder analyses Center composed of experts to analyze (see Figure 5, page 15). and associated engineering studies, and collected data that were transferred operational reviews, thus addressing overnight from Cairo on a secured Wreckage layout the safety issues and capturing the server. From the collected photos and In order for the metallurgist and struc- lessons learned. Prior to assuming on-site observations, the team precise- ture specialists to further investigate this position, he served six years in the ly identified aircraft parts and per- the parts located in those areas and to Flight Test Department for in-service formed an in-depth analysis of high lift analyze the interfaces between them, and development of aircraft flight test and fuel systems, doors and exits, the the investigation team decided to analysis. powerplant, and the airframe structure gather all the wreckage parts from the July-September 2018 ISASI Forum • 13 desert and perform a wreckage surface layout reconstruction (see Figure 6, page 15). The ECAA managed to transport every part associated with the accident from the desert to an area close to Cairo Interna- tional Airport using exceptional means and convoy. Before starting this “giant jigsaw puzzle,” a work process was proposed by Airbus and agreed to by all the parties. A fu- selage can be represented as a cylinder composed of circular frames and longitudinal stringers. If this cylinder is split open from its top and rolled over, it would end up in a 2-D grid in which frames and stringers references could be used as coor- dinates to locate every part (see Figure 7, page 15). Given the size and weight of certain parts and the limited space for the cranes and lift forks to maneuver, the order in which each part was put on the grid was of key importance. We used a whiteboard to draw the grid and label each part (see Figure 8, page 15) and agreed on how to proceed before moving any heavy part. This grid was painted on the floor (see Figure 9, page 15) to reproduce what was planned on the whiteboard. When the plan was agreed to by all the parties and present- ed to the drivers, we were able to start positioning each part at its correct location. Thanks to the preparation work and advanced discussions with all the involved parties and the exceptional dexterity of the Egyptian drivers, the wreckage surface layout was com- pleted in only a couple of days (see Figure 10, page 15). Once this was performed, the investigation team had a global view of the aircraft wreckage and focused on particular areas of interest. Metallurgists and structure specialists were not only able to examine fracture surfaces and lines propaga- tion but also to compare those to adjacent ones. From this, they were able to identify parts that needed to be sent to the laboratory for further investigation. From the top left:

Conclusion Figure 1. Russian television footage. Airbus support to this particular accident investigation was continuously provided to the investigation boards throughout Figure 2. Airbus aircraft rescue and firefighting chart. all phases of the investigation. By sharing its resources and ex- pertise, Airbus provided on-site support for security and risk assessment by dispatching a team of experienced investiga- Figure 3. Area determination from Google Earth. tors and specialists. It also provided its expertise and support in mission planning and wreckage identification using all Figure 4. From wreckage photo to contour available resources globally within the Airbus company. drawing and 3-D modeling. Airbus support to the investigation was not limited to on- site investigations but was backed up by teams of experts co- Figure 5. 3-D mockup visualization of identified ordinated from Toulouse Crisis Control Center that worked in wreckage parts. conjunction with the field investigation to multiply efficiency and ensure proper reactivity. Figure 6. Wreckage parts gathered from the Airbus proposed the use of the best adapted tools and re- Sinai desert. sources that could support the investigation and created new ways of using them. This allowed investigators to perform a Figure 7. A representation of the fuselage split complete mapping and identification of a wreckage spread open. over 16 kilometers in the desert and to assist the investigation team to complete 3-D wreckage reconstruction and physical Figure 8. Parts location using a grid on the layout less than one year after the accident. whiteboard. Metallurgists and structure specialists were able to deter- mine the in-flight breakup point of initiation and send Figure 9. Grid painted on the floor. structure samples to laboratories for root-cause analysis. Figure 10. Wreckage surface layout in progress. 14 • July-September 2018 ISASI Forum Figure 1 Figure 2 Figure 3

Figure 4

Figure 5 Figure 6

Figure 7

Figure 8 Figure 9 Figure 10

July-September 2018 ISASI Forum • 15 ISASI Rudolf Kapustin Scholarship Essays ACCIDENT REPORTS The following article is the final of four essays from the 2017 AND AERONAUTICAL Kapustin Scholarship winners. The Scholarship Committee will DECISION-MAKING: announce 2018 selectees in the coming months. The number APPLYING CASE-BASED of scholars selected each year depends upon the amount of REASONING TO IMPROVE money ISASI members donate annually to the scholar- GA SAFETY ship fund. Details can be found on the ISASI website at www. By Ross Rozanski isasi.org.—Editor. University of Southern California

hile the fatal accident rate While these issues have been mostly for commercial aviation has resolved in commercial aviation with the been steadily decreasing over implementation of CRM, the application Wpast years, the rate for general of this concept in ADM and single-pilot aviation (GA) has remained largely the resource management has not yielded a same. Although the implementation of similar decline in fatal accidents. concepts like crew resource manage- One reason is experience—the deci- ment (CRM) and aeronautical deci- sion-making processes of expert pilots is sion-making (ADM) has been linked to qualitatively better than those of novice reducing many commercial accidents, or intermediate pilots. Specifically, those a gap between teaching this knowledge with more-experienced backgrounds and its successful implementation demonstrated “a qualitative distinc- remains in GA. By successfully applying tion…in the process of information these concepts in GA, one of the most acquisition and not simply in terms of attributed causes of GA accidents—pilot the quantity of information accessed.” error—can be mitigated. The ability to perform both of these ADM is currently taught with the tasks is evident in many fields in which methodology of rule-based reasoning experts are best able to diagnose a prob- (RBR), which emphasizes learning lem by integrating the relevant factors. objectives in a theoretical and academic Although there is no substitute for pure framework. Research shows that mixing flight hours, a way to increase the task Ross Rozanski earned a bachelor of sci- this methodology with case-based assessment skills of less-seasoned pilots ence degree in mechanical engineering from the University of Southern Califor- reasoning (CBR) produces safer pilots is to encourage critical assessment of nia in May 2018. His studies included more capable of reacting to emergency their own performance, providing access mechoptronics laboratory, CAD with NX scenarios. Consequently, investigators to simulated scenarios, and reflection of 10, fluid dynamics, thermodynamics, are called on to prepare more thorough case studies. heat transfer, and strength of materials. accident reports that can be used with CBR is, in the most general sense, “the While attending USC, he served for two CBR in pilot training, and members of act of developing solutions to unsolved months as a fluids lab research assistant the aviation community are called on to problems based on preexisting solutions to assist a Ph.D. candidate researching encourage the use of CBR in pilot train- of a similar nature.” Through the process turbulent wake boundaries, served two ing to increase GA safety. of retrieval, analogy, adaption, and years as a stability and control analyst The fatal accident rate in GA has been learning, individuals can systematically for the USC AeroDesign Team, was a constant in past decades, with about respond to a scenario with a degree of member of a team planning to build a bridge in rural Panama, and served 300 fatal accidents each year since 2004. experience, even if they have never phys- as a language tutor for USC graduate This alarming statistic is indicative of a ically experienced the actual situation students to improve their English skills consistent problem in GA safety that has before. As a learning model, there are and knowledge of American culture. He yet to be addressed—namely pilot error several benefits to CBR, including the holds a single-engine, land, and VFR and loss of control of the aircraft, the ability to learn incrementally, the notion pilot license. most frequent causes of GA accidents. of adaption, a focus on failure as a learn- 16 • July-September 2018 ISASI Forum Ross Rozanski

ing experience, and taking advantage of from how pilots make decisions in the real creasing amplitude. Instead of choosing to the problem-solving information process- world. ADM historically has been taught as go around at this point, the pilot commit- ing intrinsic to human cognition. a rulebook to follow, a concept that seeks ted; and on the last bounce, the propeller Although research has proved the to instruct principles broken down into made contact with the runway. The pilot advantages of learning with CBR in fields chapters that should be considered when lost control and was killed. This case has as diverse as medicine and law, only acting as pilot-in-command. Many of the several details that make it a superb exam- recently has this been studied in pilot situations pilots experience, however, ple for CBR training. One is that the pilot training. Several studies using both pilots do not have clear goals or well-defined experienced a challenge that many pilots and nonpilots have demonstrated that alternatives but rather possess an inherent face—having difficulty with touchdown. reflection on others’ experiences, training “fuzziness.” Situations with such vague and Another is that a definitive judgment call that includes CBR with RBR, and recall of undefined options are best suited for de- had to be made based on indefinite infor- critical flight events have produced pilots termination of overall similarity, opposed mation: how many failed attempts are too with more expert decision-making skills. to an exact search. Literature suggests many before deciding to go around? And Specific examples of this include “case- multiple ways to incorporate CBR and another is the severe consequences of poor based remindings play an important role reflective reasoning into current training decision-making, in this case the death of in expert pilot decision-making” and “par- practices. Taking care never to curtail the pilot. ticipants who reflected on a set of cases debriefings, using a reflective journal, and The NTSB report cites probable cause involving pilots flying into adverse weather self-describing maneuvers and tasks facili- as misjudged landing flare and improper conditions were more likely to follow the tate these practices. recovery, but for ADM purposes this could VFR rules for minimum visibility in a sim- But without giving students an unrealis- be improved upon by also stating that any ulated flight than participants who simply tically large amount of direct physical ex- flare with bounces of increasing height completed a free recall task.” perience, the best way to implement CBR should be aborted. Such cases can serve In the context of GA pilot training, CBR is with case studies. For student pilots, this to demonstrate valuable lessons in very and reflective practice enable students to includes scenarios regarding how low to real contexts, and therefore focusing on achieve higher correlation between theory fly, if and how to avoid adverse weather, the investigations of such cases and the and practice and to better identify how and others in which a decisive choice must implementation of the reports should be they learn in order to apply past problems/ be made after analyzing many variables. encouraged in GA training. failures to future actions. But despite These case studies are intended to provide For the purposes of ADM, such case the mounting evidence that the learning a framework for theoretical concepts with studies can be improved. Because humans methodology of CBR and reflective reason- practical examples that include many tend to better recall events with effective ing creates safer pilots, it contrasts with real-world instances that can be used in details, it is recommended that the case the methodology used in pilot training and ADM. studies used for ADM strongly engage the teaching of ADM currently in use. A case that could be particularly the reader with specific and emotional The current approach to GA pilot train- effective if used for ADM purposes is the details that may seem irrelevant in current ing, specifically ADM and methods aimed accident of a Cessna 441 on July 16, 2008 reports. These details are nontechnical but to address pilot error, can be significantly (NTSB Number: SEA08FA161). As the pri- add to the memorability of a given scenar- improved by the utilization of CBR, with vate pilot was touching down at Sunriver io, therefore becoming more effective for the aim of achieving its benefits. The tra- Resort Airport, the aircraft bounced on ADM purposes. There are three objectives ditional way to teach ADM differs greatly and off the runway several times with in- investigators should set in order to im-

July-September 2018 ISASI Forum • 17 ISASI Rudolf Kapustin Scholarship Essays References

Aircraft Owners and Pilots Association (AOPA). prove CBR for GA pilot training: 1.) Provide GA accident reports that give a recommen- ASF Accident Details, NTSB Number: SEA- dation similar to commercial reports, 2.) 08FA161. Consider a pilot’s CBR background while conducting investigations, and 3.) Give non- Batt, R. (2005). Aeronautical Decision-Making: fatal accidents greater detail. Experience, Training, and Behavior. University Commercial aviation accident reports of Otago, Dunedin, New Zealand. often have recommendations to address errors with the goal of avoiding them in the future. But due to a multitude of factors, Greenwell, W. (2003). Learning Lessons from GA accidents rarely get the same focus, Accidents and Incidents Involving Safety-Criti- often providing a summary with many open cal Software Systems. University of Virginia. questions for the common pilot. While the reports themselves can prove valuable for Henley, I., Bye, J. (2003). Facilitating critical learning the consequences of poor ADM, a thinking and reflective practice. In I. Henley definitive recommendation at the end can significantly increase a report’s learning val- (Ed.), Aviation Education and Training. Alder- ue. In addition, accident causes can be more shot, UK: Ashgate. readily identified by taking into account contextual details previously unconsidered, Henley, I. (2003). Using Problem-Based Learn- specifically one’s case-based background. ing to Develop Essential Skills in Aviation. In I. Although an accident can be attribut- Henley (Ed.), . ed to incorrect individual pilot inputs, an Aviation Education and Training evaluation of a pilot’s history with the given Aldershot, UK: Ashgate. scenario can shed light on why those errors occurred. For example, going off the end of Karankias, N. (2016). Do Experts Agree When a short runway can be directly attributed to Assessing Risks? An Empirical Study. Amster- many factors. But any of those factors could dam University of Applied Sciences/Aviation have occurred because of lack of experience Academy. landing at short runways. Therefore, specific factors could be encouraged to consider specifically for pilots new to that situation. McVea, M. “CBR—Case Based Reasoning.” Pur- Overall, particular caution can be due University. National Transportation Safety recommended when entering these Board. "Aviation Statistics." N.p., n.d. Web. 9 situations as a novice, therefore providing Apr. 2017. more insight into a crash than simply a pilot’s fallibility. Nonfatal accidents should Omoh, A. (2017). “AIB Publishes Accident not receive less study and analysis because nobody died. Anybody in a high-risk field Reports From Four Crashes, Makes 17 Safety can describe “near miss” situations in which Recommendations.” Nigerian Flight Deck. a disastrous result was avoided by a small margin. Two events can have equally O’Hare, R. (2010). Enhancing Aeronautical De- valuable lessons to learn even if their cision-Making Through Case-Based Reflection. outcomes are wildly different. Neglecting University of Otago, Dunedin, New Zealand. nonfatal accidents can mean neglecting relevant and beneficial insights. It would be unreasonable to declare that every aviation Wiggins, M. (2002). Expert, Intermediate, and accident be met with the same rigor and Novice Performance During Simulated Pre- resources as some of the largest incidents, flight Decision-Making. University of Western and thus it is encouraged that priority be Sydney, Australia. given based on the occurrence rate of similar accidents and the potential for fatal outcomes.

18 • July-September 2018 ISASI Forum The Role of Investigations in Creating And Implementing Safety Nets: MINDING THE GAP By Jim Burin, ISASI Member and Flight Safety Foundation Fellow

(Adapted with permission from the author’s technical paper entitled Managing a Complex Aircraft Systems Investigation presented during ISASI 2017, Aug. 22–24, 2017, in San Diego, California, USA. The theme for ISASI 2017 was “Do Safety Investigations Make a Difference?” The full presentation can be found on the ISASI website at www.isasi.org in the Library tab under Technical Presentations.— Editor)

nvestigations are the cornerstone of the superb safety record that aviation safety enjoys. The aviation safety process is the envy of many other disciplines, and its reputation is well earned. The in- Ivestigation process has evolved over the years from a reactive one that looked at one accident at a time to a proactive one that looked at multiple cause factors of multiple accidents. Today, there is a drive toward a predictive process that looks at accident, incident, and normal operational data to determine areas to reduce risk. The investigation process has thus grown from spot fixes to area fixes to system fixes. Today, investigations help create or strengthen safety nets that further reduce risk. A safety net may be a single element or a collec- Jim Burin tion of elements, all designed to reduce risk by reducing the prob- ability or severity of a specific hazard. There are actually two levels has 48 years of aviation experience and of safety nets. Tier two safety nets are used in the design, manu- 40 years of experience in the aviation facturing, and certification of aircraft and their components. Tier safety field. He is a retired Navy captain, one safety nets are safety nets that frontline aviation organizations having commanded an attack squadron utilize in day-to-day operations. and a carrier air wing during his 30- year career. He was the director of the School of Aviation Safety in Monterey, California, USA, responsible for training 650 U.S. and international military SAFETY NETS ARE CREATED BY EVERY safety officers annually. As the director of Technical Programs at the Flight Safety LEVEL OF THE AVIATION SPECTRUM, Foundation, he conducted workshops, seminars, and safety studies and led INCLUDING MANUFACTURERS, numerous international safety efforts. He spearheaded the foundation’s approach- OPERATORS, AIRPORTS, ATC, AND and-landing accident-reduction (ALAR) effort and conducted more than 40 ALAR REGULATORS. workshops around the world.

July-September 2018 ISASI Forum • 19 Safety net elements are normally the result of recom- mendations made by accident or incident investigations. The elements of a safety net can be active or passive. They can be physical elements, technological elements, proce- dural elements, or training elements. Some examples of AS THE RESULT the various types of safety net elements are a guard on a critical switch (physical), TCAS (traffic collision avoid- OF OUTSTANDING ance system) (technological), stabilized approach criteria INSTIGATIONS, (procedural), and upset prevention and recovery training (training). Safety nets are created by every level of the TODAY WE HAVE aviation spectrum, including manufacturers, operators, airports, ATC, and regulators. As an example, a safety SUPERB SAFETY net addressing the CFIT (controlled flight into terrain) challenge has elements such as TAWS (terrain awareness NETS AND THE warning system), MSAW (minimum safe altitude warning), constant angle approaches, stabilized approach criteria, ACCIDENT and the design of approaches. RECORD TO The number of accidents each year is consistently decreasing, which is good news. At the same time, the PROVE IT. availability of operational (nonaccident) data is increas- ing. Because of this, investigators need to consider what is next for investigations. What is needed is a change of paradigm. We now have the data to look at events, both significant and normal, to identify hazards and determine the risk-reduction potential of proposed safety net ele- ments without having an accident. However, the current safety system focuses on negative outcomes (i.e., an outcome resulting in damage or injuries), not events. It’s outcome-based. For example, the Air France 447 accident investigation revealed several almost identical events. However, the previous events had no negative outcome, and thus they were just part of the data. In the case of the Lexington wrong-runway departure accident, initially it seemed to be a very unique accident. However, in review- ing the data it was discovered that several very similar events had occurred. Since none of the previous events had a negative outcome, they were again just part of the data set. Some disciplines, like security, don’t require a negative outcome to act (think shoes, liquids, belts, etc.). To be effective and to continue the tradition of investi- gation excellence, investigators need to utilize the avail- ability of operational data and shift from just negative outcome–based investigations to include event-based investigations. Investigations will continue to be the backbone of reducing risk by identifying new safety net elements or exposing holes in existing safety nets. The more investi- gators analyze operational data, the better the safety nets investigations will create. The difference is that previously we learned from accidents and other negative-outcome events. In the future, we can learn from operational data. As an example, consider the fatal accident in Bedford, Massachusetts, USA, in 2014. A corporate Gulfstream IV suffered a takeoff accident caused by a late rejected take- off (RTO).

20 • July-September 2018 ISASI Forum The reason for the RTO was that the aircraft wouldn’t rotate for takeoff because the controls were locked. The controls were locked because the gust lock was engaged. A review of the aircraft’s data showed that no control check, which would have detected the engaged gust lock, had been conducted prior to takeoff. In fact, the data re- vealed that the accident crew had performed a pretakeoff control check on only two of the previous 176 flights. There was no negative outcome for 173 of those flights. Now, no control check is not a caution, a warning, or an exceedance, and it normally has no negative out- come, so it’s unlikely that it would be noticed in a normal analysis of the aircraft’s data. However, in comparing this aircraft’s data to pretakeoff operational data from thousands of flights, not conducting a pretakeoff control check would have shown up as a difference. This is an example of how operational data can be used to identify potential problem areas (e.g., no control check) before they end up as a negative-outcome event. However, creating and strengthening safety nets using operational data, although vital and necessary, may not be the primary way to reduce risk in the future. Over the past 20 years, there have been 358 commercial jet ma- jor accidents. Two stand out as ones that didn’t have an associated first-tier safety net that could have prevented them (TWA 800 and BA 038). There are probably more, but in general it’s very rare to have a major accident to- day that has no associated first-tier safety net that could have prevented it. So in addition to building and enhancing safety nets, future investigations need to also identify and address the gap between existing safety nets and implementing those safety nets. Accidents happen in those gaps. These gaps exist today, but they’re normally only found as the INVESTIGATIONS result of an investigation of an accident or other neg- ative-outcome event. Future safety investigations will WILL CONTINUE hopefully be able to identify these gaps by using normal operational data and not necessarily just negative-out- TO BE THE come events. We have the data now to identify these crit- BACKBONE OF ical gaps through investigations of normal operational data, and we don’t need the proverbial smoking hole. In REDUCING RISK fact, we can use the data to prevent the smoking hole. As the result of outstanding instigations, today we BY IDENTIFYING have superb safety nets and the accident record to prove it. However, we continue to have accidents—accidents NEW SAFETY NET that we have safety nets designed to prevent. There’s a ELEMENTS OR gap between having safety nets and using safety nets. We need to fill that gap. Some potential ways to address EXPOSING HOLES this safety net gap challenge are technology and, as a last resort, regulation. We need to start identifying the gaps IN EXISTING between creating and using safety nets, and we need to start using operational, nonnegative-outcome events SAFETY NETS. to do that. With the current and growing availability of data, we can do that. In any case, we need to mind the gap.

July-September 2018 ISASI Forum • 21 INVESTIGATIONS, RECOMMENDATIONS, AND SAFETY MANAGEMENT SYSTEMS

By Thomas A. Farrier, Senior Safety Analyst, JMA Solutions, LLC

urrent perspectives on safety SSPs has been to downplay the role of throughout at least the first century of management systems (SMS) accident investigations in the SMS en- powered flight has been fairly logical, vary widely from one country vironment, or even to disconnect them progressively moving forward through Cto the next, especially with entirely from other preventive processes. a series of sequential and sometimes respect to how they are used in the While one would expect SMS to be overlapping objectives: aviation domain. The International tightly coupled with and effective in • Keep aircraft from falling apart or Civil Aviation Organization (ICAO) integrating the work of civil aviation dropping out of the sky, performed a valuable service to the authorities (CAAs)—the regulators—and • Allow them to be operated safely in worldwide civil aviation community investigative bodies, the trend seems other than day visual meteorological with the publication of the first edition to be for the latter to be discounted as conditions, of Document 9859, Safety Management part of the larger preventive process. The • Require them to be built to protect Manual (SMM), in 2006. This landmark question is why is this the case and what their occupants in the event things document gathered together a host should be done to address where it is go wrong, and of processes that collectively offered happening? an organized structure within which For a variety of reasons, SMS and • Respond to new hazards arising safety efforts on the part of individual investigations—including the recom- from more and faster aircraft, busier states and other interested parties mendations that result from them—are airfields, and efforts to drive greater could be developed. As it stated in its not always a good fit with each other. efficiencies by reducing various his- objective (paragraph 1.2): The objec- Some relate to expectations regarding torically developed safety margins. tive of this manual is to provide states the ability of an SMS to further improve From this has flowed a whole series and product and service providers upon the level of safety achieved in flight of philosophies of and taxonomies for with operations to date. Others seem to stem safety thinking, all of which have been • an overview of safety management from how SMSs are structured and their brought to the table in pursuit of meas- fundamentals; focus on trying to identify and respond urable but incremental improvements • a summary of ICAO safety man- to “precursors” instead of dealing with in the overall safety of the aviation agement standards and recom- known issues. In short, many SMSs system as a whole. The easy wins are mend practices (SARPs) contained increasingly are inadequately positioned long behind us; the low-hanging fruit in Annexes 1, 6, 8, 11, 13, and 14; to incorporate or take action on insights has been picked from the trees. Today’s from accident investigations and the challenges are to find even more oppor- • guidance on how to develop and recommendations resulting from them. tunities for preventing accidents while implement a state safety program There are inherent tensions between trying to avoid adding risk to the system (SSP) in compliance with the the respective philosophies embodied in the quest for greater efficiencies in its relevant ICAO SARPs, including a by SMS and investigations: a focus on operation. harmonized regulatory framework what might happen versus what has Almost from the days of test flights for the oversight of product and happened; a desire to consider hazards at Kitty Hawk, North Carolina, USA, service providers’ SMS; and in the abstract instead of focusing on it became clear that aviation had to • guidance on SMS development, concrete experiences of actual loss; and, be approached somewhat differently implementation, and of course, the downplaying of “reac- from other outgrowths of the Industrial maintenance. tive” investigations against support for Revolution simply because it was subject “proactive” management efforts. Accord- ICAO’s intent in assembling a list to such novel and poorly understood ingly, this paper explores where SMSs of SMS guidelines was to offer a set hazards. Exploring those hazards led and accident investigation processes of management processes that could to accident investigations assuming come into conflict, how this has come to be adopted by SSPs, not to suggest primacy in aviation safety efforts, and happen, and how their disconnects can other preventive activities should be the ways those investigations were con- be remedied. excluded, discounted, or downplayed. ducted evolved to meet new challenges However, it has become clear that an and different fact-finding requirements. unintended outcome of ICAO’s various The rise of SMS thinking Increasingly organized study of acci- moves to consolidate guidance on The history of accident prevention dents and their causes also led to organi-

22 • July-September 2018 ISASI Forum zational responses that were completely SSPs. The term “safety management (Adapted with permission from the author’s different from current “safety manage- system” is not even in its title; the con- technical paper entitled Investigations, ment” approaches. Identified hazards cept itself is not addressed in any detail Recommendations, and Safety Management and their solutions were the focus, not until Chapter 5. There does not appear Systems presented during ISASI 2017, Aug. 22–24, 2017, in San Diego, California, USA. the instrumentalities of safety practices to be any deliberate effort to create an The theme for ISASI 2017 was “Do Safety themselves. overarching SMS, but rather to elabo- Investigations Make a Difference?” The full Those seeking improvements in rate on and make certain functions and presentation can be found on the ISASI website aviation safety have long been able to attributes associated with effective SSPs at www.isasi.org in the Library tab under identify and meet safety needs without accessible. Technical Presentations.—Editor) exerting control over the rest of the or- To some extent, the rise of SMSs in ganization of which they are a part. The their current form coincided with a most effective safety organizations have need to find new ways of dealing with a been developed in response to recog- worrisome slowing in the rate of over- nized needs, and the best of them always all improvement in the aviation safety have been created with a mandate from record. As the raw numbers of airline ac- higher up in their companies or govern- cidents steadily declined, the even faster ments and with the leadership backing growth of airline operations threatened necessary to do their jobs. Analysis of to “make the numbers look bad” despite operating hazards (for the purpose of the occurrences of accidents themselves tackling them) occurred side by side trending steadily downward. This trend, with analysis of accidents and incidents; which was observed at the same time knowledge developed from such analy- that safety thinking was moving into the ses found its way to the desks of those so-called “Organizational Era,” made the best suited to act on it. advent of wide-ranging SMSs virtually Given the above, with clear evidence inevitable. of organic development and unforced Thus, rather than simply offering a progress toward what have come to notional collection of minimum pro- be referred to as “safety policy and grammatic requirements for SSPs, objectives,” “safety risk management,” aviation-specific SMS became the and “safety promotion”—as well as the embodiment of an earnest desire on the evolution of a formal process of data part of the aviation safety community collection and the making of recommen- to address the most intractable types dations leading to action (i.e., “safety of aviation accidents: those with out- Tom Farrier assurance”)—the question becomes is comes similar to those seen in historical an SMS a natural outgrowth and consoli- accidents, but at least partially traceable has been a member of ISASI for more dation of effective preventive efforts or to the added complexities of modern than 20 years. He began his aviation was the overarching concept deliber- aircraft and the present-day aviation safety career as a U.S. Air Force ately structured or otherwise obliged system. flight safety officer, during which he to remain limited to a subset of proven On the other hand, the lineage of served as an on-scene investigator as preventive strategies and activities? SMS—both in aviation and in other well as performing prevention and ICAO’s Annex 19 to the Convention on domains—is traceable to theories of programmatic duties at wing, command, International Civil Aviation: Safety Man- “quality management,” which long have and headquarters levels. Since 2005, he agement took the form it did because been proven to be exceptionally effective has worked as a government contractor ICAO determined that a unifying theory in production-based activities but of on a variety of aerospace safety matters. He currently is the senior safety analyst of and approach to civil aviation safety extremely limited value in enterprises for JMA Solutions, LLC in Washington, was needed at an international level. in which the emphasis is on the delivery D.C., USA. The views expressed in this ICAO’s efforts in this direction started of services. Applying SMS thinking to paper are his own and do not reflect with Document 9859. That document’s certain aspects of aviation operations— official positions of JMA Solutions, LLC primary objective was standardizing say, maintenance, ramp operations, or its clients. July-September 2018 ISASI Forum • 23 and employee occupational safety and given that ICAO’s initial vision of “safety dations deserve to be brought under a health—makes perfect sense. Indeed, management” was as a starting point for “management” umbrella to ensure they Paragraph 2.9.2 of Document 9859 notes an overarching SSP, not for the develop- are properly considered and implement- more than a half-dozen “typical manage- ment of SMS as an end unto itself. ed where practical. Such handling is not ment systems” found in aviation organi- The opening paragraphs of Document facilitated by the present vision of SMS. zations, including 9859’s Chapter 5 suggest some of the ba- Annex 19 lists the following as being • a quality management system sic expectations that attend the imple- components of an SSP, not an SMS: (QMS), mentation of an SMS. These emphasize • State safety policy and objectives, • an SMS, the “proactive” outcomes expected of the SMS process and the prominence of risk • State safety risk management, • a security management system management in the overall construct. • State safety assurance, and (SeMS), However, they do not in any way sug- • State safety promotion. • an environmental management gest that any specific strategies toward system (EMS), these objectives should be preferable to Annex 19 also makes it clear that others. In particular, they do not dismiss neither an SSP nor an SMS supporting it • an occupational health and safety any initiatives or sources of data on the needs to be limited to the four elements management system (OHSMS), basis of their “reactive” natures—the alone. Appendix 2, “Framework for a • a financial management system goal is proactive, but the means to that Safety Management System" (SMS), ex- (FMS), and goal are not constrained in any way. plicitly states, "The framework compris- • a documentation management sys- The trouble is that too-rigid SMSs es four components and twelve elements tem (DMS). themselves often bring little new to the as the minimum requirements for SMS table while at the same time rejecting implementation.” [Emphasis added] Document 9859 even goes so far as some accident prevention practices At the same time, the individual defi- to assert that SMS and QMS are “com- that have been refined over time—sim- nitions of each show that many tradi- plementary.” However, each of these ply because the latter are seen as being tional aspects of aviation safety do not separate management activities tends to “reactive” or otherwise outdated. This is fit neatly under the new SMS umbrella. operate in isolation instead of coopera- shortsighted at best and self-deluding at Critically, even the amplified discussion tively since each has its own objectives, worst. of the various components in Appendix defined by its relationship to the larger Another driver of the shape SMS be- 2 leaves open a key issue: where acci- goals of the enterprise. Regardless, the gan to take was rooted in the safety pro- dent investigations actually fit into fully great virtue of anything based on quality fession’s long-standing reliance on the evolved SMSs. It also is silent on the thinking is in the consistency of docu- Heinrich Pyramid, which suggests it is question of how an SMS is supposed mentation and process it offers. Howev- possible to leverage lower-consequence to take action as a part of “assurance”: er, the hidden trap is that the limitations events for insights into the much smaller “performance monitoring and measure- of processes themselves constrain what cohort of catastrophic occurrences. It ment” is a far cry from analysis of data they are equipped to handle to what is is unwise to focus on the former to the (a basic obligation of SSPs’ “state safety known. exclusion of the latter; preventive med- assurance”). icine is practiced every day, but physi- The fact that SSP and SMS concepts The institutionalization of SMS cians don’t ignore active bleeding over have become conflated over the past At this point, a few questions start to applying cold packs to bruises. Still, the 15 years is evident in that, with the suggest themselves. emphasis on being “proactive” made this removal of the word “state,” the above • Given the stated intent of both aspect of the SMS worldview virtually SSP components are the key organizing Annex 19 and its predecessor docu- inevitable. principles for SMSs as well. In the quest ment, how did aviation SMS take the Finally, the often-desirable separation to reconcile the two, the sensitivity to an shape it has assumed in many civil between civil aviation authorities and SMS being “reactive” came to the fore. aviation authorities today? investigating authorities seems to have For example, Argentina’s Administración • Why are at least some ICAO-con- fostered an environment within which Nacional de Aviación Civil (ANAC) pub- forming SMSs so rigidly structured SMS processes are deliberately held lished SMS: Guía para la Evaluación de la in terms of both components and separate from the work of investigation. Implementación (SMS: Guide for the Eval- processes? This is explicable, but not necessarily uation of its Implementation) that makes appropriate. Investigators have a sin- two observations illustrating the sys- • What are SMSs actually expected to gular focus, and CAAs must bring other tem’s incident-oriented perspective and do? considerations to bear on the feasibility the blurring of lines between SSP and Answering these questions is not as of their proposals. However, accident SMS: “Mandatory reporting programs easy as one might expect, especially investigations findings and recommen- and incident investigation programs of

24 • July-September 2018 ISASI Forum service providers are typical examples incident—ICAO’s current approach they are superior to reports on investi- of programs for the reactive capture of to SMS seems overly prescriptive and gations of actual occurrences. That take safety data.” Internal safety [incident] tends to empower SMS as an institution bolsters the underlying philosophy of investigations “include events of an instead of making it clearly subordinate SMS as “proactive,” supports the notion operational nature that do not need to to and supportive of the SSP it should be that “safety culture” has preventive val- be investigated or reported to the state, designed to support. Thus, an SMS is the ue, and costs a lot less. for example, turbulence in flight, vehicle expected outcome of the SARPs; SSPs es- Despite this institutional mindset, events on the ramp, etc.” sentially have been relegated to the role accident investigations and the recom- On the other hand, the SMS devel- of enabling the operation of SMSs. mendations resulting from them need oped by Australia’s Civil Aviation Safety With respect to the role of accident to be properly baked into the fabric of Authority (CASA) uses exactly the same investigations in the context of SMS, current and future SMSs. “Proactive” components and guidelines, but explic- Paragraphs 2.10.5 through 2.10.7 in outcomes need not be pursued exclu- itly provides for both incident and acci- Document 9859 represent the sole ICAO sively through “proactive” sources of dent investigations as essential compo- guidance regarding the role of investiga- data; accident investigations should nents of safety assurance: “Investigating tions in an SSP (i.e., SMS) environment. form the basis for follow-on inquiry, and incidents and accidents in a structured Their inclusion strongly suggests that their recommendations should be scru- way is fundamental to an effective the role of investigations was conscious- pulously tracked and managed. More- SMS. If you do not investigate incidents ly addressed in the creation of Docu- over, any inappropriate risk acceptance thoroughly, you cannot learn from them, ment 9859, but also that much of that or inadequate risk assessment discov- and therefore will miss opportunities to thinking was not brought forward into ered during an accident investigation identify risks to your operation.” Annex 19 SARPs. needs to drive changes to the appro- Despite SMS and SSPs being based on priate SMS functionalities. This is the the same four “components,” Annex 19 How SMSs work (and don’t work) essence of “safety assurance.” calls for creation of specific SMS-related with accident investigations Unfortunately, Attachment A to Annex policies and processes—and a bureau- The failure of SMSs to provide for ac- 19 (which as noted above is not a part of cratic structure specific to their care and cident investigations and their recom- the SARPs portion of Annex 19 proper) feeding—instead of simply identifying mendations in their overall framework places accident and incident investi- what should be done in constructing eliminates an invaluable source of gations under “state safety policy and an SSP. This seems at once unnecessary knowledge for the SSP as a whole. If this objectives,” not “state safety assurance.” and overly prescriptive. U.S. Army Gen. was done in the interests of “maintain- It is far from clear why this might be George S. Patton once said, “Never tell ing investigators’ independence,” it has appropriate, since the latter explicitly people how to do something. Tell them created a far more perilous situation: a encompasses “safety oversight, safety what to do, and they will surprise you purposeful blind spot regarding the most data collection, and most especially with their ingenuity.” critical failures and actions proposed to safety data-driven targeting of oversight What’s more, Attachment A contains correct them. areas.” a qualifying remark that seems to place Perhaps part of the slippery slope What’s more, Paragraph 5.3.92 of Doc- SMS at a level at least co-equal with that led to the embrace of SMSs was ument 9859 notes that safety managers SSPs themselves: “The SSP framework the push to be “proactive” rather than should ensure that “lessons learned introduced in this attachment, and the old-fashioned “reactive.” Coinciding as from investigations and case histories SMS framework specified in Appendix 2, it did with the period of slowing rates of or experiences, both internally and from must be viewed as complementary, yet improvement in aviation accident rates, other organizations, are distributed distinct, frameworks.” In this context, this was a reasonable goal to pursue. But widely.” However, this is characterized as the disclaimer sidesteps the fundamen- to some extent, it seemed to look past a “safety promotion” function instead of tal difference between an appendix and the fact that most of the easy fixes and a core preventive activity that should be an attachment in an ICAO annex: the easy wins already had been achieved. aggressively pursued under the SMS as a former represents “material grouped The mere accumulation of large amounts function of safety assurance. separately for convenience but forming of data does not automatically translate Finally, the 11th edition (2016) of An- part of the SARPs adopted by the coun- into actions or new insights. nex 13, Aircraft Accident and Incident In- cil,” while the latter comprises “material In particular, the SMS concept seems vestigation, has been effectively scrubbed supplementary to the SARPs or included to consistently downplay the necessity clean of any remnants of references to ei- as a guide to their application.” and value of investigations in general ther SSPs or SMS. The previous edition’s In short, in addition to the SMS and accident investigations in particular. Attachment F, “Framework for the State guidance in Annex 19 failing to in- Many SMSs treat voluntarily submitted, Safety Program" (SSP), was transferred in corporate any reference whatsoever purely preliminary reports not contain- its entirety to Annex 19—which makes to investigations—either accident or ing enough info upon which to act as if sense—but there no longer is anything

July-September 2018 ISASI Forum • 25 Figure 1. AFSMS (AFI 91-202, the U.S. Air Force Mishap Prevention Program, June 24, 2015). in Annex 13 to suggest that accident should be informed by any and every • Demonstrate the proven, ongoing investigations are in any way a part or a approach to prevention available, even if value of investigations and the rec- function of SSPs themselves. such approaches lie outside the purview ommendations that flow from them, Annex 19 is essentially silent on the of those implementing the SMS itself. • Find the best fit for both the inves- roles of investigations or recommen- These examples strongly suggest that tigation process and its resulting dations in the context of proactive the very notion of accident investigation outputs in the context of the existing accident prevention. By the same token, is in danger of becoming completely SMS, and Annex 13, Chapter 6, talks a lot about delinked from the practice of aviation • Highlight every instance in which recommendations, despite the fact that safety by SMS following the ICAO model. the structure impedes the effective Annex 19 indicates it brought all of the The power and import of accident in- pursuit of safety. In other words, critical elements from Annex 13 into vestigations and recommendations are show where the SMS itself needs its SARPs for SMS. This leads one to being diffused through the various SMS fixing. wonder whether Annex 13 and Annex components instead of leveraged for 19—representing the “reactive” and the their maximum preventive value. There are positive examples all over “proactive”—actually are competing, or the world that can be pointed out as al- even in opposition with each other when ternate means of thinking about “safety it comes to a single approach to safety in The investigator’s challenges in management” that do not rely on strict civil aviation. working within (and outside) SMSs conformity to Annex 19. Some state The answer, of course, is that there As this monograph has made clear, acci- implementations of SMS are far more should be no competition at all. ICAO’s dent investigations do make a difference, flexible and inclusive than others. commitment to aviation safety is ab- but the SSPs and SMSs with which they For example, Transport Canada solute. However, there is competition need to interact and cooperate have highlights the fact that “SMS is based on between the two respective philosophies become increasingly distanced from the idea that you can always find better of accident prevention they represent, the accident investigation process and ways to prevent hazards, so the system which is unfortunate. SMS is no more products. To address this trend, the air will always be changing.” The program the “right” strategy for reducing ac- safety investigator community needs to follows a somewhat different organiza- cidents than is any other strategy. It do three things: tional structure as well, rooted in the 26 • July-September 2018 ISASI Forum “four Ps of safety management”: philos- Proposition 2: Fitting investigations In contrast to these explicit expecta- ophy, policy, procedures and practices. into an SMS framework is difficult be- tions associated with accident investi- While the first “P” embodies the gener- cause SMS often treats the requirement gations, the overseers and advocates of ally accepted principle of “safety culture” to investigate as a policy, the investi- narrowly proscribed SMSs seem to favor and the second maps reasonably well to gative process as assurance, and the a popular but untested (and to some ex- ICAO’s “policy and objectives” compo- outputs as information simply requiring tent incomplete) philosophy. A rigid SMS nent, the latter two are quite different. promotion. That portion of aviation safe- composed only of Annex 19 minimum They are described in theIntroduction to ty dependent on effective risk manage- components promises much based on Safety Management Systems (TP 13739) ment is mostly insulated from incorpo- management theories and assumptions as follows: rating or acting upon lessons learned regarding a presumed relationship be- • Procedures—What management from accidents. tween accidents and “precursors.” How- wants people to do to execute the Proposition 3: Investigations do things ever, it does not explain what should be policy: clear direction to all staff; that SMSs do not, and SSPs perform expected of it upon implementation. means for planning, organizing, and functions that cannot be subsumed Nothing in the execution of SMS as controlling; and means for monitor- under an overarching SMS. SMS should described in Annex 19 can result in any ing and assessing safety status and support SSPs, not the other way around. insights whatsoever regarding why one processes. Document 9756, Manual of Aircraft sequence of events might have a worse • Practices—What really happens on Accident and Incident Investigation, Part outcome than another except “incident” the job: following well-designed, IV: Reporting, contains three telling investigation. In most cases, the focus of effective procedures; avoiding the passages that serve to prove why SMSs such inquiries is on determining what shortcuts that can detract from safe- cannot do what investigations do: went wrong instead of what went right. ty; and taking appropriate action • 1.1.1: “The findings and the causes of Still, a forensic (“reactive”) look at such when a safety concern is identified. the final report should lead to safety events often is warranted to determine The U.S. Air Force Safety Management recommendations so that appro- why a more serious outcome did not System (AFSMS) contains a significant- priate preventive measures can be occur. ly more detailed mapping of specific taken.” The focus of investigations is Instead, lower-consequence inci- preventive activities than that of Annex not on nonconformities or exceed- dents are treated as contributing to a 19 (see Figure 1). AFSMS unequivocally ances; it is on concrete failures and “big data” understanding of hazards establishes all investigations as part of what can be done about them. that somehow is to be used to facili- the “assurance” component. It also uses • 4.3: “A safety recommendation tate proactive action. This begs a final the useful term “improvement opportu- should describe the safety problem question—What does an accumulated nities” for that subset of inputs subject and provide justification for safety database of nonevents contribute to the to analysis and assessment within the actions.” Accident investigations and prediction or prevention of more serious assurance process. This places investiga- the reports resulting from them are ones? tors’ recommendations under the same designed to explain. An SMS simply Like it or not, SMS tends to put two SMS component as the investigations checks to see if “processes” have principles in opposition instead of themselves. been followed and actions required leveraging their respective advantages. These examples show that it is pos- under those processes have been It pits the active against the passive, the sible—and even necessary—to think of taken or not, regardless of whether hard work of investigation and analysis SMSs holistically, not just as a fill-in-the- those actions were appropriate or against the easy tasks of collecting and blanks exercise in conformity to SARPs. even valid in the first place. recording. Both have their place in the Each state needs to start with Annex 19 aviation safety professional’s toolkit, but needs not stop there. • 4.4: “During aircraft accident in- and neither should be disregarded or vestigations, safety issues are often discounted. The road ahead identified that did not contribute to As SMSs and “proactive approaches” As detailed above, the current state of the accident but that, nevertheless, continue to gain prominence, the need affairs regarding accident investigations are safety deficiencies. These safety for effective investigations and in the SMS environment can be summed deficiencies should be addressed in well-founded recommendations that up in a few propositions: the final report.” You investigate, you highlight their limitations has never Proposition 1: The concept of SMSs is find things that need attention, and been greater. Too-narrow approaches to intolerant of investigations and their val- you make recommendations. Under prevention ultimately have to be consid- ue because the reactive nature of inves- SMS, if the deficiency does not fit ered in light of the old adage “when all tigations runs counter to the proactive into the pigeonholes provided, such you have is a hammer, everything looks nature asserted by SMS proponents. noncasual hazards may be lost. like a nail.” July-September 2018 ISASI Forum • 27 NEWS ROUNDUP

UAS Working Group Update tigators Hans Meyer and Mohammed Abdul Bari to share their knowledge and experience and to provide the participants with Over the past year, ISASI’s Unmanned Aircraft Systems (UAS) the awareness and knowledge of the processes of an aircraft acci- Working Group has provided major support to the Internation- dent or incident investigation. al Civil Aviation Organization’s (ICAO) Accident Investigation The participants came with a range of experiences, including Group, helping it move forward with a standalone guidance director of aviation safety and security, head of standards licens- document for the investigation of UAS accidents and incidents. ing and development, manager of emergency response planning, This effort was discussed at the last UAS Working Group meet- airworthiness inspectors, air navigation audit specialists, military ing at the 2017 ISASI annual seminar, and members subse- safety personnel, and qualified personnel from other aviation quently provided significant input to the initial and final drafts areas. developed over the following six months. The course was based on International Civil Aviation Organ- The original plan, reports Tom Farrier, UAS Working Group ization (ICAO) Annex 13 and ICAO Document 9756—Manual chair, was for this guidance to become a new chapter in ICAO of Aircraft Accident and Incident Investigation—and covered a Document 9756, Part III. However in May 2018, attendees at range of topics, including the responsibilities of the states; the objective of accident investigations; the definition of accidents, the Accident Investigation Panel meeting (AIGP/4) in Montre- serious incidents, and incidents; the role and responsibilities of al, Quebec, Canada, concluded that the sheer size of the UAS the investigator-in-charge, accredited representatives, observers, guidance (more than 120 pages) and its inclusion of context and technical advisors; the composition of investigation teams; and reference material on the unmanned sector warranted states’ accident preparedness and the notification process; the publication as a separate ICAO document. This process is now investigator’s go-kit; accident site management; the hazards at the under way at the ICAO Secretariat. accident site; accident site safety; personal protection; collection Creating standalone guidance on UAS issues that relate to of evidence; managing the news media, on-site and off-site inves- existing annexes is precedent setting for ICAO. The Remotely tigation processes; witness interviews; handling and analysis of Piloted Aircraft Systems (RPAS) Panel has been addressing evidence; handling onboard recorders; wreckage reconstruction; similar needs across the entire spectrum of aviation, from crashworthiness and survivability; human and organizational fac- pilot and aircraft (system) certification to differences in UAS tors; and findings, including causes and contributing factors. The adherence to "rules of the air." The forthcoming AIGP week finished with report writing and the importance of safety document will follow the practice established by Document recommendations. 10019, Manual on Remotely Pilot Aircraft Systems (RPAS). Its The participants discussed recent and historic accident scenari- publication date is to be determined but will be announced os and conducted group exercises in which they developed inves- through ISASI channels when known. tigation tasks flow charts, identified hazards at different accident The UAS Working Group’s next project will be to develop sites, and recommended protective measures. The participants guidelines for using UAS—both small and large—to support also identified investigation team specialties for nominated accident investigations. ISASI members have published several accidents and developed specific questions for initial witness excellent articles and papers on this subject over the last interviews. Each team nominated an “investigator-in-charge” who several years. The new initiative will gather all this valuable then presented the team’s work to the class. information, along with more current thinking and While there was a lot of information to cover in five days, the applications, into a single-source document. course was well received by participants, who are looking forward UAS Working Group members will be receiving e-mail to increasing their knowledge with advanced courses. notification of this project and available opportunities to Salah Mudara, the treasurer of the Middle East North Africa contribute later this fall. The current plan is for development Society of Air Safety Investigators (MENASASI), visited the course to proceed on a collaborative but distributed basis over six on the last day to inform the participants about ISASI’s history, to eight months and then to discuss an initial draft at a achievements, and objectives. All participants were invited to face-to-face breakout session during the 2019 ISASI annual attend the ISASI seminar in Dubai on Oct. 29, 2018. This training seminar in the Netherlands. If you’re an ISASI member and course was accepted by the MENASASI board members as part of are interested in joining this effort, please contact the working the Reachout program to enhance the investigation capabilities group’s chair at [email protected]. within the MENASASI region.

Accident Investigation Training in Bahrain New ISASI Membership Committee Chair

On April 8–12, the Aircraft Accident Investigation Sector of the On July 16, ISASI President Frank Del Gandio appointed ISASI United Arab Emirates held a basic aircraft accident investigation Vice President Ron Schleede to be the chair of the Society’s training course for aviation professionals in Bahrain. The objective Membership Committee. Schleede had been serving as acting of the training was to provide the participants with the knowledge chair for the past two years. Del Gandio expressed apprecia- and skills to take part in an incident or accident investigation as tion for his role as acting chair and noted that he was competent team members. “instrumental” in a team effort to revise ISASI’s membership The Bahrain civil aviation authority invited air accident inves- application.

28 • July-September 2018 ISASI Forum NEWS ROUNDUP

ISASI Attends Fourth ICAO AIGP subject. States will be required to forward to ICAO safety recom- mendations of a global concern, as well as the responses and safe- ISASI, as an approved International Observer Organization, ty actions taken by recipients of the recommendations. All of the participated in the fourth International Civil Aviation Organi- materials will be available to other states for accident prevention zation (ICAO) Accident Investigation Panel meeting (AIGP/4) purposes. in Montreal Quebec, Canada, on May 8–11. Ron Schleede, ISASI This is another example of ISASI’s value as an active Interna- vice president; Robert MacIntosh, ISASI treasurer; and Thomas tional Observer Organization at ICAO. Farrier, ISASI Unmanned Aircraft Systems (UAS) Working Group chair, participated in the meeting. Twenty-one states and three experts from International Observer Organizations participated ESASI 2018 Held in Latvia in the meeting. The European Society of Air Safety Investigators (ESASI) held The agenda included discussions on the following topics: ESASI 2018 in Riga/Jurmala, Latvia, on May 22–23, with more • Investigation procedures, techniques, and methodologies; than 120 delegates from Europe and neighboring regions attend- • Training guidelines; ing, including those from the Middle East North Africa Society of • Testing for use of substances; Air Safety Investigators. Ivars Gaveika, director of the Transport Accident and Incident • Investigations involving remotely piloted aircraft systems Investigation Bureau (TAIIB) of Latvia, opened the seminar. Ed- (RPAS); gars Tavars, the parliamentary secretary of the Ministry of Trans- • Accident site environmental care; port of Latvia, delivered a keynote address on the importance of • Accident investigation responsibilities—accident safety investigations in the aviation system. investigation authority versus state aviation authority; For the first time, the International Civil Aviation Organiza- • Safety recommendations of global concern; tion (ICAO) European and North Atlantic (EUR/NAT) office was • Recorded radar data; part of the ESASI program. Arnaud Desjardin, deputy head of • Guidance on final report content; the Investigations Department of France’s accident investigation bureau, highlighted the upcoming amendments to Annex 13 and • Format and content for preliminary reports; the accident and incident investigation capabilities of states in • Consultation period of draft final reports; and the ICAO EUR/NAT area of accreditation. The seminar included a • State of manufacturer of flight recorders. variety of presentations on topics such as updates on regulations (ICAO, EU), case studies, investigation techniques, family assis- All topics were of interest to ISASI members, and the ISASI tance, emergency response plans, safety management systems, delegation contributed to all discussions. Several amendments and human factors. to ICAO standards and recommended practices and updates to ESASI President Olivier Ferrante reported that this year the guidance material have resulted from the work of the AIGP over airline community was better represented than in previous years the past four years. Of particular interest to ISASI at AIGP/4 were with participants from Aer Lingus, Air Italy, Austrian Airlines, agenda items 4 and 7. Regarding item 4, Farrier had prepared a Bluebird Cargo, and British Airways. The seminar was also complete document regarding the investigation of RAPS over the marked by the formal or informal participation of neighboring past two years using the original material that he and his ISASI societies such as the Middle East North Africa Society of Air Safety working group had prepared—UAS Investigation Handbook and Investigators represented by Thomas Curran, AsiaSASI represent- Accident/Incident Investigation Guidelines, which was published in ed by Thomas Wang, PakistanSASI represented by Syed Naseem 2015. The updated materials completed by Farrier and the work- Ahmed. and the Regional Society of Air Safety Investigators ing group will be published as guidance material by ICAO. The represented by Sergey Zayko. Caj Frostell, ISASI’s international document will supplement the Manual of Accident and Incident councilor, also attended the seminar. Investigation (Document 9756). During the seminar, S.V. Zayko, first deputy to the Interstate Aviation Committee chair, presented an award to Gaveika on It was rewarding to see another ISASI working group product behalf of the Interstate Aviation Committee. This appreciation lead to the publication of ICAO guidance material—as was the echoed the thanks of the ESASI delegates for the great Latvian case with the Cabin Safety, ATC, and Investigator Selection and hospitability. Training ISASI Working Group products over the past several years. Item 7, safety recommendations of a global concern, was equal- ly rewarding and a huge success for ISASI. At AIG08, the ISASI delegation presented a working paper urging ICAO to establish a database of safety recommendations issued by states and the safety actions taken that other states could use. The ISASI work- ing paper was supported by France and other states. Over the past 10 years, additional efforts have taken place. The European Society of Air Safety Investigators (ESASI) board during a meeting with ESASI members at the end of the first day of the seminar. And at AIGP/4, several standards and recommended practices Shown from the left are Steve Hull, secretary; Brian McDermid, Technical were proposed to ICAO for adoption that will lead to significant Committee; Robert Carter, European councilor; Olivier Ferrante, president; amendments to Annex 13 and guidance materials regarding this Thorkell Augustsson, committee member; and Matt Greaves, treasurer.

July-September 2018 ISASI Forum • 29 SERC Holds 10th Annual Meeting ISASI INFORMATION The Southeast Regional Chapter (SERC) recently held its 10th meeting since OFFICERS reactivating in 2009. This year’s gathering, reports SERC Secretary Alicia Storey, President, Frank Del Gandio took place July 27–28 in Savannah, Ga., USA, and attendees experienced two ([email protected]) days of activities that provided both information and entertainment. Executive Advisor, Richard Stone Gulfstream Aerospace sponsored key events. The company provided a tour of ([email protected]) Vice President, Ron Schleede its facilities on Friday during which participants were able to view the Gulf- ([email protected]) stream 500 and 600 on the production line. Gulfstream additionally provided Secretary, Chad Balentine all transportation (via motor coach) to and from the hotel and hosted dinner ([email protected]) Treasurer, Robert MacIntosh, Jr. Friday evening at the famed National Museum of the Mighty Eighth Air Force. ([email protected]) SERC thanks Gulfstream Aerospace and, as with other past sponsors, is truly appreciative of the contributions. COUNCILORS Saturday morning began with a presentation that Dr. Bjorn Hennig led on Australian, Richard Sellers crew fatigue and then carried over with Capt. Shem Malmquist’s presentation ([email protected]) on casual analysis using STAMP. After a short break, Joe Hopkins discussed Canadian, Barbara Dunn ([email protected]) European, Rob Carter decision-making, sharing his experiences with mission safety. Andy McMinn ([email protected]) followed with a metallurgical look at a case study of the Beech K35. International, Caj Frostell After lunch, Glenn Grubb resumed the seminar with an enlightening pres- ([email protected]) New Zealand, Alister Buckingham entation on daytime black holes, Robert “Hoot” Gibson, a former astronaut, ([email protected]) covered some common accident scenarios. Gerhard Coetzee discussed runway Pakistan, Wg. Cdr. (Ret.) Naseem Syed excursions at his business location in Almaty, Kazakhstan. The presentations Ahmed ([email protected]) United States, Toby Carroll ended with Trevor Ashline introducing the concept of integrating racing safety ([email protected]) restraint systems into private aircraft. This year has been productive for SERC. In 2019, SERC will be seeking new NATIONAL AND REGIONAL officers, and the request for nominations will be coming soon. Possible SOCIETY PRESIDENTS locations for next year’s meeting include the U.S. cities of Atlanta and Savan- AsiaSASI, Chan Wing Keong nah, Ga.; Memphis, Tenn.; Charleston, S.C.; and New Orleans, La. ([email protected]) Australian, Richard Sellers ([email protected]) Canadian, Barbara Dunn ([email protected]) European, Olivier Ferrante ([email protected]) Korean, Dr. Tachwan Cho (contact: Dr. Jenny Yoo—[email protected]) Latin American, Guillermo J. Palacia (Mexico) Middle East North Africa, Khalid Al Raisi ([email protected]) New Zealand, Graham Streatfield ([email protected]) Pakistan, Wg. Cdr. (Ret.) Naseem Syed Ahmed ([email protected]) Russian, Vsvolod E. Overharov ([email protected]) United States, Toby Carroll ([email protected])

SERC 2018 participants review typical causes of air accidents. UNITED STATES REGIONAL CHAPTER PRESIDENTS Alaska, Craig Bledsoe ([email protected]) Arizona, Bill Waldock ([email protected]) Dallas-Ft. Worth, Erin Carroll MOVING? NEW E-MAIL ACCOUNT? ([email protected]) Great Lakes, Matthew Kenner Do you have a new mailing address? Have you recently ([email protected]) Mid-Atlantic, Ron Schleede changed your e-mail address? Then contact ISASI at isasi@ ([email protected]) Northeast, Steve Demko erols.com to ensure that your magazine and other ISASI ([email protected]) materials are delivered to you. Please include your previous Northern California, Kevin Darcy ([email protected]) address with your change request. Members in Canada, New Pacific Northwest, (Acting) John Purvis ([email protected]) Zealand, and Australia should contact your national society. Rocky Mountain, David Harper ([email protected])

30 • July-September 2018 ISASI Forum ISASI INFORMATION

Southeastern, Robert Rendzio Air Asia Group Hall & Associates LLC ([email protected]) Air Astana JSC Hawaiian Airlines Southern California, Thomas Anthony Air Canada HNZ New Zealand Limited ([email protected]) Air Canada Pilots Association Hogreen Air Air Line Pilots Association Honeywell Aerospace Airbus Hong Kong Airline Pilots Association COMMITTEE CHAIRMEN Airclaims Limited Human Factors Training Solutions Pty. Ltd Air New Zealand Independent Pilots Association Audit, Dr. Michael K. Hynes Airways New Zealand Insitu, Inc. ([email protected]) All Nippon Airways Co., Ltd. (ANA) Interstate Aviation Committee Award, Gale E. Braden ([email protected]) Allianz Irish Air Corps Ballot Certification, Tom McCarthy Allied Pilots Association Irish Aviation Authority ([email protected]) Aloft Aviation Consulting Japan Transport Safety Board Board of Fellows, Curt Lewis ([email protected]) Aramco Associated Company Jones Day Bylaws, Darren T. Gaines Asiana Airlines KLM Royal Dutch Airlines ASPA de Mexico ([email protected]) Korean Air ASSET Aviation International Pty. Ltd. Korea Aviation & Railway Accident Code of Ethics, Jeff Edwards ([email protected]) Association of Professional Flight Attendants Investigation Board Membership, Tom McCarthy ([email protected]) Australian and International Pilots’ Association L-3 Aviation Recorders Mentoring Program, Anthony Brickhouse (AIPA) Learjet/Bombardier Aerospace ([email protected]) Australian Transport Safety Bureau Lion Mentari Airlines, PT Nominating, Troy Jackson Aviation Investigation Bureau, Jeddah, Lockheed Martin Aeronautics Company ([email protected]) ­ Kingdom of Saudi Arabia Middle East Airlines Reachout, Glenn Jones ([email protected]) Aviation Safety Council Midwest University Scholarship Committee, Chad Balentine Avisure Military Air Accident Investigation Branch Becker Helicopters Pty. Ltd. Military Aircraft Accident & Incident ([email protected]) Bundesstelle fur Flugunfalluntersuchung (BFU) Seminar, Barbara Dunn ([email protected]) Investigation Board Bureau d’Enquêtes et d’Analyses (BEA) Ministry of Transport, Transport Safety CAE Flightscape Investigation Bureau, Singapore WORKING GROUP CHAIRMEN Cathay Pacific Airways Limited National Aerospace Laboratory, NLR Charles Taylor Aviation National Institute of Aviation Safety and Air Traffic Services, Scott Dunham (Chair) China Airlines Services ([email protected]) Civil Aviation Authority, Macao, China National Transportation Safety Board Ladislav Mika (Co-Chair) ([email protected]) Civil Aviation Department Headquarters National Transportation Safety Committee- Airports, David Gleave ([email protected]) Civil Aviation Safety Authority Australia Indonesia (KNKT) Cabin Safety, Joann E. Matley Civil Aviation Safety Investigation and Analysis NAV CANADA Center Pakistan Air Force-Institute of Air Safety ([email protected]) Colegio Oficial de Pilotos de la Aviación Corporate Affairs, Erin Carroll Pakistan Airline Pilots’ Association (PALPA) Comercial (COPAC) Pakistan International Airlines Corporation (PIA) ([email protected]) Cranfield Safety & Accident Investigation Critical Incident Stress Management (CISM), Papua New Guinea Accident Investigation Centre Commission (PNG AIC) David Rye--([email protected]) Curt Lewis & Associates, LLC Parker Aerospace Flight Recorder, Michael R. Poole Dassault Aviation Petroleum Air Services ([email protected]) DDAAFS Phoenix International Inc. General Aviation, Steve Sparks Defence Science and Technology Organisation Plane Sciences, Inc., Ottawa, Canada ([email protected]) (DSTO) Pratt & Whitney Defense Conseil International (DCI/IFSA) PT Merpati Nusantara Airlines Co-Chair, Doug Cavannah Delft University of Technology ([email protected]) Qatar Airways Delta Air Lines, Inc. Republic of Singapore Air Force (RSAF) Government Air Safety Facilitator, Directorate of Flight Safety (Canadian Forces) Marcus Costa ([email protected]) Rolls-Royce PLC Discovery Aur Defence Royal Danish Air Force, Tactical Air Command Human Factors, Edma Naddof Dombroff Gilmore Jaques & French P.C. Royal Netherlands Air Force DRS C3 & Aviation Company, Avionics Line of ([email protected]) Royal New Zealand Air Force Investigators Training & Education, Business Dubai Air Wing RTI Group, LLC Graham R. Braithwaite Saudia Airlines-Safety ([email protected]) Dutch Airline Pilots Association Dutch Safety Board Scandinavian Airlines System Military Air Safety Investigator, James W. Roberts Eclipse Group, Inc. Sikorsky Aircraft Corporation ([email protected]) Education and Training Center for Aviation Singapore Airlines Limited Unmanned Aerial Systems, Tom Farrier Safety SkyTrac Systems Ltd ([email protected]) EL AL Israel Airlines Southwest Airlines Company Embraer-Empresa Brasileira de Aeronautica Southwest Airlines Pilots’ Association S.A. Spanish Airline Pilots’ Association (SEPLA) CORPORATE MEMBERS Embry-Riddle Aeronautical University State of Israel AAIU, Ministry of Transport Etihad Airways Statens haverikommission Abakan Air European Aviation Safety Agency (EASA) Swiss Accident Investigation Board (SAIB) Accident Investigation Board (AIB) Army Aviation EVA Airways Corporation The Air Group Accident Investigation Board Norway Executive Development & Management Advisor The Boeing Company Accident Investigation Bureau Nigeria Finnair Plc The Japanese Aviation Insurance Pool (JAIP) Administration des Enquêtes Techniques Finnish Military Aviation Authority Transportation Safety Board of Canada Adnan Zuhairy Engineering Consultancy Flight Data Services Ltd. Turbomeca Aegean Airlines Flight Data Systems Pty. Ltd. Ukrainian National Bureau of Air Accidents and Aer Lingus Flight Safety Foundation Incidents of Civil Aircraft Aero Republica Fugro Survey Middle East Ltd. UND Aerospace Aerovias De Mexico, S.A. De C.V. Gangseo-gu, Republic of Korea United Airlines Agenzia Nazionale Per La Sicurezza Del Volo GE Aviation United States Aircraft Insurance Group Air Accident Investigation Bureau of Mongolia General Aviation Manufacturers Association University of Balamand/Balamand Institute of Air Accident Investigation Bureau of Singapore German Military Aviation Authority, Directorate of Aeronautics Accident Investigation Committee of Thailand ­ Aviation Safety Federal Armed Forces University of Southern California Air Accident Investigation Unit-Ireland Global Aerospace, Inc. Virgin America Air Accident Investigation Sector, GCAA, UAE Grup Air Med S.A. Virgin Galactic Air Accidents Investigation Branch-UK Gulfstream Aerospace Corporation WestJet July-September 2018 ISASI Forum • 31 ISASI 107 E. Holly Ave., Suite 11 Sterling, VA 20164-5405 USA

INCORPORATED AUGUST 31, 1964 CHANGE SERVICE REQUESTED

In Memoriam

harles "Chuck" Foster, Subsequently, he was assigned the campus of San Francisco investigator of the tragic 1979 96, a long-time pilot to the Air Force research and State University in San Fran- Chicago DC-10 crash. During and pioneer in Ameri- development program at cisco, California, USA, during the investigation, DC-10s were Ccan aviation safety, died Wright-Patterson Air Force the Vietnam War. Then Chuck grounded worldwide. on April 10, 2018, in Issaquah, Base in Dayton, Ohio, USA. was assigned to the Pentagon Working as the FAA director Washington, USA. He joined Chuck’s life-long goal, in Washington, D.C., USA. He of the Northwest Mountain ISASI in 1986 and was a Life though, was to fly for the Air retired from the Air Force in Region allowed Chuck the Associate Member. Chuck was Force. The highlight of his 1967, having been decorated opportunity to enjoy the area instrumental in creating the flying career was his tour of with the Air Force Commen- of the country he loved the successful ISASI 1995 seminar Hokkaido, Japan, and Naha dation Medal and Legion of most and continue his passion held in Seattle, Washington. Air Base, Okinawa. He com- Merit for his work in sonic for aviation. The Northwest's As a youngster, he looked manded the 16th Fighter-In- boom research. Chuck served beauty and its hunting and fishing opportunities brought WITH EVERYONE HE MET, CHUCK SHARED A STORY AND DELIGHTED THEM together his life-long joys. WITH HIS OPENNESS AND HIS GENUINE CONCERN FOR THEIR LIVES. Chuck retired in 1986 from the FAA but continued in aircraft up to see a barnstormer fly terceptor Squadron on Naha, as a U.S. representative to the consulting work and became over his hometown of Heav- where he was the first to fly international meetings of the a proud member of the Seattle ener, Oklahoma, USA. Cluck the all-weather single-seat International Civil Aviation Hanger QB. Always a pilot, his claimed this was the moment supersonic F-102A Delta Dag- Organization on aircraft noise. last air adventure occurred that forged his passion for ger. As part of the 51st Fighter He joined the U.S. Department on his 80th birthday when he aviation. Interceptor Wing, Chuck’s of Transportation as director piloted a glider. At Heavener High School, he unit was recognized by the of noise abatement. His work A memorial service was held played trombone, became an Air Force for its deployment included determining the im- for Chuck on July 28 at the Eagle Scout, and was valedic- to Taiwan in the 1958–1959 pact of supersonic transport Seattle Museum of Flight. torian of his class. A proud crisis, specifically for deploy- aircraft flying across the U.S. Sooner, Chuck graduated from ment within four hours of the Chuck continued his career the University of Oklahoma official notification. The unit in aviation with the U.S. Fed- with a BS in mechanical engi- demonstrated outstanding eral Aviation Administration neering. Upon receiving his Air night flying in weather below (FAA). He was honored at the Force commission, he served minimums, landings as low as White House by President in Nashville, Tennessee, USA, 200 feet, and 1/16th of a mile Jimmy Carter for his work and the Far East. He went on visibility. developing aviation safety and to North Carolina State Uni- His next two tours of duty certification standards, the versity to receive his master's were quite different. First he FAA's "Lead Region" concept, degree in nuclear engineering. headed the ROTC program at and for his work as the lead

32 • July-September 2018 ISASI Forum