APRIL–JUNE 2010

Probable cause: The lack of a positive (normal) response from the use of the brakes following the explosion and damage of tires No. 1 and 2 of the left main undercarriage during the takeoff run.

The Accident ‘CAUSE’ Statement—Is It Beyond Its Time? (Page 5) Making General Aviation Safer (Page 10) Examining Accident Cost Analysis (Page 14) A Review of Fly-by-Wire Accidents (Page 18) Using ADS-B for Accident Investigation And Prevention (Page 23) CONTENTS

Volume 43, Number 2 Publisher Frank Del Gandio Editorial Advisor Richard B. Stone FEATURES Editor Esperison Martinez Design Editor William A. Ford 5 The Accident ‘CAUSE’ Statement— Associate Editor Susan Fager Is It Beyond Its Time? Annual Report Editor Ron Schleede By Robert MacIntosh (MO0996), NTSB—After many years of use, and abuse, ISASI Forum (ISSN 1088-8128) is published is it time to omit this traditional step in the Annex 13 investigation process? quarterly by International Society of Air Safety Investigators. Opinions expressed by 10 Making General Aviation Safer authors do not necessarily represent official ISASI position or policy. By Philippe Plantin de Hugues, Bureau d’Enquêtes et d’Analyses pour la sécurité Editorial Offices: Park Center, 107 East de l’aviation civile—The author shows how accident prevention in general aviation Holly Avenue, Suite 11, Sterling, VA (GA) could be improved by more widespread use of lightweight flight recorders. 20164-5405. Telephone (703) 430-9668. Fax (703) 430-4970. E-mail address isasi@ 14 Examining Accident Cost Analysis erols.com; for editor, espmart@comcast. By Dr. Simon Mitchell, RTI Ltd, London, and Graham Braithwaite, Cranfield net. Internet website: www.isasi.org. ISASI Forum is not responsible for unso- University Safety, UK—The authors illustrate how the accident cost methodology licited manuscripts, photographs, or other used by the legal profession, namely primary, secondary, and tertiary cost catego- materials. Unsolicited materials will be rization, can greatly enhance an aviation accident investigator’s ability to frame returned only if submitted with a self-ad- dressed, stamped envelope. ISASI Forum compelling, well-argued, and fully justified safety recommendations. reserves the right to reject, delete, sum- marize, or edit for space considerations 18 A Review of Fly-by-Wire Accidents any submitted article. To facilitate editorial By Dr. R.L. (Dick) Newman and A.A. (Tony) Lambregts, FAA—In this history of production processes, American-English spelling of words will be used. fly-by-wire (FBW) airplanes, the authors examine the service history of civil FBW Copyright © 2010—International Society of airplanes, using several databases for FBW accidents and serious incidents. Air Safety Investigators, all rights reserved. Publication in any form prohibited without 23 Using ADS-B for Accident Investigation permission. ISASI Forum registered U.S. Patent and T.M. Office. Opinions expressed And Prevention by authors do not necessarily represent of- By David Zwegers, Embry-Riddle Aeronautical University—The author ficial ISASI position or policy. Permission to examines Automatic Dependent Surveillance Broadcast (ADS-B) workings reprint is available upon application to the and use at ERAU to show how its versatility of use can help bring a new level editorial offices. Publisher’s Editorial Profile: ISASI of safety in the air and on the ground. Forum is printed in the United States and published for professional air safety investigators who are members of the In- DEPARTMENTS ternational Society of Air Safety Investiga- 2 Contents tors. Editorial content emphasizes accident investigation findings, investigative tech- 3 President’s View niques and experiences, regulatory issues, 26 ISASI RoundUp industry accident prevention developments, 30 ISASI Information and ISASI and member involvement and information. 32 Who’s Who—A brief corporate member profile of Subscriptions: Subscription to members Parker Aerospace is provided as a portion of dues. Rate for nonmembers (Domestic and Canada )is US$28.00; Rate for nonmember interna- About the Cover tional is $US30.00. Rate for all libraries This TAME Ecuador Fokker F-28 Fellowship 4000, Flight 120, was on a regular sched- and schools is $US24. 00. For subscription uled flight from Quito to Cali on Jan. 17, 2003. For initial departure at Mariscal Sucre information, call (703) 430-9668. Additional or replacement ISASI Forum issues: Do- Airport (UIO) (Ecuador), the takeoff was on Runway 35, a 3,120-meters-long asphalt run- mestic and Canada US$4.00; international way. At 2,110 meters down the runway, while the airplane was accelerating through 125 member $US4.00; domestic and Canada knots IAS, both tires of the left-hand main undercarriage blew. Abandoning the takeoff, nonmember $US 6.00; and international the pilots managed to keep the airplane on the runway. As the airplane overran the end of nonmember $US8.00. the runway, the nose gear collapsed. The aircraft came to rest 81 meters past the end of the runway. A small fire erupted in the area of the left-hand main gear. This was quickly contained by the fire service. There were no fatalities among the 77 occupants. The aircraft was damaged beyond repair. Probable cause: The lack of a positive (normal) re- sponse from the use of the brakes following the explosion and damage of tires No. 1 and 2 of the left main undercarriage during the takeoff run. Photo: ISASI Proceedings 2009

2 • ISASI Forum April–June 2010 PRESIDENT’S VIEW

ISASI Adopts ‘Criminalization’ Position By Frank Del Gandio, ISASI President I am very pleased to report that our Society terviewed during the course of safety investigations is valuable has become a signatory to the Joint Resolu- and that such information, if used by criminal investigators or tion Regarding Criminalization of Aviation prosecutors for the purpose of assessing guilt and punishment, Accidents, originally jointly published in the could discourage persons from providing accident information, fall of 2006. The criminalization resolution was thereby adversely affecting flight safety; originally developed through the efforts of the Recognizing that under certain circumstances including acts Flight Safety Foundation, the Civil Air Navi- of sabotage and willful or particularly egregious reckless gation Services Organisation (CANSO), the Royal Aeronauti- conduct, criminal investigations and prosecutions may be ap- cal Society (RAeS), and the Academie Nationale de l’Air et de propriate; l’Espace (ANAE) in France. Signatories have expanded over Concerned with the growing trend to criminalize acts and the years to include the European Regions Airline Association, the Professional Aviation Maintenance Association, and the In- ternational Federation of Air Traffic Controllers Associations. he Joint Resolution Regarding Your International Council first began discussing the sub- TCriminalization of Aviation Accidents was ject of criminalization of accident investigations at its Sept. 7, originally developed through the efforts of 2008, meeting in Halifax. Discussion pointed out that there is significant variance among the world’s legal systems, leading the Flight Safety Foundation, the Civil Air to a variety of State approaches to this issue. Any position Navigation Services Organisation (CANSO), the ISASI might take must accommodate these differences, and Royal Aeronautical Society (RAeS), and the ISASI could not attempt to limit the statutory authority of a Academie Nationale de l’Air et de l’Espace sovereign State. Accordingly, the joint criminalization resolution was cir- (ANAE) in France. Signatories have expanded culated among the Council members for study. Dave King, over the years to include the European European Society president, and Peter Williams, New Zealand Regions Airline Association, the Professional councillor, consolidated Council member comments and began Aviation Maintenance Association, and drafting an ISASI position for discussion at the May 2009 Council meeting. That gathering produced another lengthy the International Federation of Air Traffic discussion of the subject. The Council reviewed cases of Controllers Associations. persons prosecuted or being charged and agreed on the threat such practices by some States pose to occurrence investiga- omissions of parties involved in aviation accidents and tions. Council members were asked to thoroughly review the incidents; joint resolution document for possible adoption by ISASI. The Recognizing that the sole purpose of protecting safety vote to adopt was unanimous. information from inappropriate use is to ensure its continued The joint resolution reads, in part, as shown below. availability to take proper and timely preventative actions and “Recognizing the importance in civil aviation accident inves- to improve aviation safety; tigations in securing the free flow of information to determine Considering that numerous incentives, including disciplinary, the cause of accidents and incidents and to prevent future civil, and administrative penalties, already exist to prevent and accidents and incidents; deter accidents without the threat of criminal sanctions; Recognizing the actions taken recently by the International Being mindful that a predominant risk of criminalization Civil Aviation Organization in promoting amendments to of aviation accidents is the refusal of witnesses to cooperate Annex 13–Aircraft Accident and Incident Investigations to with investigations, as individuals invoke rights to protect the Convention on International Civil Aviation, encouraging themselves from criminal prosecution, and choose not to freely Contracting States to adopt by November 2006 certain actions admit mistakes in the spirit of ICAO Annex 13 for the purpose to protect the sources of safety information; of preventing recurrence; Recognizing the importance of preventing the inappropriate Considering that the vast majority of aviation accidents result use of safety information, including the increasing use of such from inadvertent, and often multiple, human errors; information in criminal proceedings against operational per- Being convinced that criminal investigations and prosecu- sonnel, managerial officers, and safety regulatory officials; tions in the wake of aviation accidents can interfere with the Recognizing that information given voluntarily by persons in- efficient and effective investigation of accidents and prevent

April–June 2010 ISASI Forum • 3 PRESIDENT’S VIEW Continued . . .

by pursuit of claims through civil justice systems to obtain riminal investigations can and do hinder compensation. the critical information gathering portions 4. Urge States to safeguard the safety investigation report and C probable cause/contributing factor conclusions from prema- of an accident investigation, and subsequently ture disclosure and use directly in civil or criminal proceed- interfere with successful prevention of future ings. Although use of official accident reports may save crimi- aviation industry accidents. nal investigators the considerable expense of conducting an entire separate investigation, a considerable and serious risk the timely and accurate determination of probable cause and exists of diverting these reports from their original purpose, issuance of recommendations to prevent recurrence; as technical causes often cannot be equated to legal causes necessary when establishing either civil or criminal liability. BE IT THEREFORE RESOLVED that the below In addition, use of relatively untrained and inexperienced organizations: technical “experts” by prosecutorial or judicial authorities, 1. Declare that the paramount consideration in an aviation as compared to official accident investigating authorities, can accident investigation should be to determine the probable result in flawed technical analyses and a miscarriage of justice, cause of and contributing factors in the accident, not to punish while interfering with the official accident investigation. criminally flight crews, maintenance employees, airline or 5. Urge national aviation and accident investigating authorities manufacturer management executives, regulatory officials, or to: (i) assert strong control over accident investigations, free air traffic controllers. By identifying the “what” and the “why” from undue interference from law enforcement authorities; (ii) of an accident, aviation safety professionals will be better invite international cooperation in the accident investigation equipped to address accident prevention for the future. Crimi- nal investigations can and do hinder the critical information gathering portions of an accident investigation, and subse- ndorsement of this joint criminalization quently interfere with successful prevention of future aviation Eresolution demonstrates our belief that industry accidents. the current trend of criminalizing aviation 2. Declare that, absent acts of sabotage and willful or par- ticularly egregious reckless misconduct (including misuse accidents has a deleterious effect on the of alcohol or substance abuse), criminalization of aviation appropriate investigation of said occurrences, accidents is not an effective deterrent or in the public interest. the finding of contributing factors and Professionals in the aviation industry face abundant incentives probable causation, and the formulation of for the safe operation of flight. The aviation industry every day puts its safety reputation and human lives on the line, and has recommendations to prevent recurrence. a remarkable safety record that is due in large measure to the under Annex 13; (iii) conduct professional investigations to current willingness of operators and manufacturers to cooper- identify probable cause and contributing factors and develop ate fully and frankly with the investigating authorities. The recommendations in a deliberative manner, avoiding any “rush benefit of gaining accurate information to increase safety stan- to judgment”; (iv) ensure the free and voluntary flow of es- dards and reduce recurring accidents greatly outweighs the sential safety information; (v) provide victims’ loved ones and retributive satisfaction of a criminal prosecution, conviction, their families with full, accurate, and precise information at and punishment. Increasing safety in the aviation industry is the earliest possible time; and (vi) address swiftly any acts or a greater benefit to society than seeking criminal punishment omissions in violation of aviation standards.” for those “guilty” of human error or tragic mistakes. Endorsement of this joint criminalization resolution dem- 3. Urge States to exercise far greater restraint and adopt onstrates our belief that the current trend of criminalizing stricter guidelines before officials initiate criminal investiga- aviation accidents has a deleterious effect on the appropriate tions or bring criminal prosecutions in the wake of aviation investigation of said occurrences, the finding of contributing disasters. Without any indicia of proper justification for a factors and probable causation, and the formulation of recom- criminal investigation or charges, the aviation system and mendations to prevent recurrence. air disaster victims and their loved ones are better served by resort to strong regulatory oversight and rigorous enforce- The resolution may be viewed in its entirety on the Society’s ment by national and international aviation authorities, and website: www.isasi.org. ◆

4 • ISASI Forum April–June 2010 The Accident ‘CAUSE’ Statement Is It Beyond Its Time? (This article is adapted with permission Navigation Commission and the Council from the author’s paper entitled The Acci- for consideration. The final product titled dent “CAUSE” Statement—Is It Beyond After many years Aircraft Accident Inquiry was adopted as Its Time? presented at the ISASI 2009 Annex 13 to the Convention and became seminar held in Orlando, Fla., Sept. 14-18, of use, and abuse, effective Sept. 1, 1951. 2009, which carried the theme “Accident The new Annex 13, first edition, con- Prevention Beyond Investigations.” The is it time to omit sisted of only four pages of text. There were full presentation, including cited refer- three definitions: aircraft, aircraft accident, ences to support the points made, can be this traditional and state of registry. There was a note found on the ISASI website at www.isasi. indicating the report on the inquiry would org. The opinion, facts, and conclusions step in the Annex normally include, in addition to the findings, expressed in this article are those of the a summary of evidence, and other essential author; the content is not a product of 13 investigation information on which the findings were the U.S. National Transportation Safety process? based. There was no mention of “cause” in Board.—Editor) that first edition of Annex 13, and that ver- By Robert MacIntosh (MO0996), sion prevailed for the next 15 years. he recent ICAO Accident Investiga­ Chief Advisor, International So how was the idea of cause introduced? tion and Prevention Meeting, AIG Safety Affairs, National It was the second edition of Annex 13, ef- 2008, conducted in Montreal in Transportation Safety Board, fective in August 1966, that defined the October 2008, presented an op- Washington, D.C., USA inquiry as “the process leading to determi- portunityT for 190 Member States and nation of the cause of an aircraft accident observer organizations to review any investigative efforts by various groups and including the completion of the relevant needed changes in the protocols of An- the public. For example, the news media, report.” This second edition further ex- nex 13, Aircraft Accident and Incident legislators, consumer groups, and families panded the inquiry definition to include Investigation. The agenda included a topic of victims all expect their government to in the SARPs a Paragraph 5.4 as follows: of frequent and long-standing discussion conduct an investigation and provide an- “The inquiry instituted by a State shall among air safety investigators, the issue swers to the “how and why” of any major include the investigation and the obtain- surrounding determination of “causes” or accident. Therein lies a question, “How ing and recording of all available relevant “probable cause” related to Annex 13 air best can the final report meet the expecta- information; the analysis of the evidence; safety investigations. tions of the public and other groups while the determination, if possible, of the cause; The subject was discussed in consider- meeting the very focused and sole objec- completion of the report; and the making able detail in two sessions of the AIG 2008 tive of Annex 13, ‘an investigation for the of recommendations when appropriate.” meeting. Some attendees commented that prevention of accidents, not to apportion Further, this second edition of Annex 13 it was essential to emphasize “risk mitiga- blame or liability’?” provided the format of a report calling for tion and accident prevention” in concert In aviation circles, it has been a long tra- separate paragraphs: one containing (a) with Safety Management System (SMS) dition that we continue to learn from the the most significant determinations of the principles rather than to focus directly on past. Therefore, let’s indulge for a moment causation. In addition, many opinions were in the history surrounding the Convention Robert MacIntosh has a expressed by several State delegations on International Civil Aviation (Chicago long career in the avia- and international organizations regard- 1944) and the guidance developed for ac- tion industry, including ing both the use and misuse of a causal cident investigation. Following the initial NTSB investigator-in- statement. meetings of those pioneers, by 1946 a charge, airline director of Of particular concern within the air newly formed Accident Investigation Divi- safety, airplane manufac- safety community is the entry of final ac- sion proposed some applicable standards turer staff engineer/acci- cident reports into the judicial process in and recommended practices (SARPs) to dent investigator, and 22 years as a U.S. various States. However, outside our in- the Air Navigation Commission. In the Air Force officer pilot and safety director. vestigator community, we must recognize administrative practice still used today, He has more than 8,000 hours of flying that there continue to be major expecta- the proposals went to the Member States experience and holds resident bachelor of tions regarding the results of the Annex 13 for comment and then back to the Air arts and master of business degrees.

April–June 2010 ISASI Forum • 5 The Accident ‘CAUSE’ Statement Is It Beyond Its Time?

fact finding and analysis and (b) the cause experts have made to the safety improve- son’s Model of Accident Causation. We or probable cause(s), and a final paragraph ments enjoyed in commercial air transpor- focus not only on the front line actions of containing recommendations. From this tation. The hull loss rates have gone from flight crews, air traffic controllers, ground history, one can see that the issues of cause the historic 10 per million departures at engineers, dispatchers, and other support and safety recommendations have been in- the full entry into the jet age to below 5 staff, but also on the working conditions, terrelated within ICAO Annex 13 protocols per million in the mid 1970s to less than organizational processes, levels of over- for more than 40 years. 0.1 per million departures in today’s air sight, and the management decisions from Before we move on from the histori- transport fleet. These efforts are laud- airplane design all the way to the final ele- cal perspective we should note one more able, and remarkable as commercial jet ment of delivering the passengers to the interesting development. The fourth edi- transport airplanes have opened up the air airline terminal at their destination. tion of Annex 13, which became effective transportation scene around the world. We are able to gather much more data April 1976, changed the title to Aircraft Like most modern advances, these than in the past, and we are now moti­ Accident Investigation, replacing the word civil aviation achievements have come with vated to attempt to understand the deeper “Inquiry” with “Investigation,” and add- some consequences and the Annex 13 ac- systemic issues associated with an ac- ing more inclusive definitions of investiga- cident investigation process has its critics. cident. These systemic issues include the tion, safety recommendation, and cause. The formal process of investigation has management decisions that provide the At that time, the plurality of cause was been described by some as simply a search background for the operational environ- recognized and reflected in a further defi- for flaws and shortcomings in technology ment. We are influenced by SMS concepts nition as, “action(s) omission(s), event(s), or errors committed by operational per- and the overarching safety culture of the conditions(s), or a combination thereof, sonnel, i.e., pilot error. As a consequence, organizations involved, and we endeavor which led to the accident or incident.” the causal statement in the traditional era to involve a much broader scope than limit So with this brief view of the background of investigation came to indicate blame our investigation to the specific organi- of the developing issues surrounding in different degrees and under different zation most closely associated with the “cause,” what are the benefits and draw- guises. Critics allege that very little em- operator. We look at the manufacturer’s backs surrounding the pronouncement of phasis has been placed on the “why” and design philosophy, concepts of task sharing, cause? Does a causal statement serve the “how” of an accident scenario. checklist construction, and follow through intended purpose of Annex 13—to promote In the evolution of safety thinking, to examine the regulatory process that the prevention of accidents and incidents; we passed into another era, the “human permits the airplane to go into service. We or is a causal statement simply an adjunct era” of CRM and LOFT and TEM. We’ve look at the training programs for crew and item working to the detriment of the stated studied the aspects of the cockpit social ground personnel and the operating com- purpose, instead providing support for gradient, recognized the copilot or pilot pany management practices required for blame and liability? Depending upon your not flying as the “pilot monitoring,” intro- their operating certificate. And, of course, perspective of the process of accident and duced training efforts to inspire advocacy we focus on the working environment of all serious incident investigation, there are for all crewmembers, and upgraded the those front line air and ground personnel many answers to that question. regulatory efforts in certification and who may be associated with the accident. And it is useful at this point to update operations. In the maintenance area we After such an encompassing look at all ourselves and examine the evolution of recognized the need to clearly state the these aspects, many will argue that it is thinking that has taken place since the task instructions, work cards, quality unreasonable to single out one front line 1970s. The current edition of the ICAO control and oversight of critical tasks, and action and form a causal statement, that Safety Management Manual (SMM) pro- shift turnover procedures, etc. However, narrowly focused last act or omission vides an interesting overview comprised of the omnipresent “cause” word continued that may be only a very small part of the three periods of air safety investigation— to appear in the aviation safety lexicon complete chain of events. This point is the traditional era, the human era, and the and in the thinking associated with our well stated in the International Federation organizational era. Despite the description accident investigation process. of Airline Pilots’ Associations submis- of a “traditional era” safety investigation Now we have transitioned toward the sion to the ICAO Accident Investigation as an activity for “funereal purposes,” “organizational era.” We are inclined to Group Divisional Meeting of 2008. The the SMM does recognize the historic focus our investigative attention much Association reiterated the need to high- contribution that the safety professionals, more broadly, in no small part based on light the multiple issues in the accident engineers, regulators, and flight training the foundations in Professor James Rea- scenario—in order to achieve the Annex

6 • ISASI Forum April–June 2010 What Happened and Why?

and seems to like it. Counterpoint—Per- haps if the public knew of the difficulties resulting from special emphasis causes, they might change their attitude? Point—Cause(s) provide a simple an- swer for the public. Counterpoint—The public seems to thrive on one cause, not a multiplicity of them. Can a well-considered press release overcome this tendency? Another valuable contribution address- ISASI PROCEEDINGS 2009 ing public interest comes from our former 13 goals of corrective actions and safety Jerome F. “Jerry” Lederer, president ISASI Forum editor Ira Rimson in an ar- recommendations to address a broad emeritus of the Flight Safety Foundation ticle titled Investigating Causes presented range of causal issues and to mitigate the and recognized throughout the industry at the ISASI seminar (Barcelona) in 1998. associated risks. as the “father of aviation safety,” in 1992 His paragraph titled “Customers and ac- Any discussion of the “cause” subject wrote, “Would not the adoption of ‘Find- countability” highlights the United States would be incomplete without a search of ings,’ ‘Significant Factors,’ and ‘Recom- Aviation Disaster Family Assistance Act the opinions of our close ISASI colleagues, mendations’ remove the contentiousness and the obligation of investigators within and the bibliography of the ISASI Forum now surrounding ‘Probable Cause’ without the government investigation agency to publications provides a treasure trove of detracting from the lessons learned to keep the victims’ families and the public articles on the subject. From the late 1970s improve the safety of flight?” informed. to the present, there are 20 “Cause(s)” One conclusion can be drawn from the People in modern democratic societ- titles in our ISASI library authored by input of some of our colleagues within the ies are affected by the “communications well-known safety advocates. air transport industry—those motivated to moment” of a major air accident. They In 1979, ISASI member Tom H. Davis write about causes. Many persons closely participate in open government whereby wrote an ISASI Forum article describ- associated with the investigative process citizens are able to maintain trust in their ing probable cause as a misnomer that uniformly argue that causal statements government through this interaction, detracts from the investigator’s role of contribute toward blame and liability, and and they expect to be informed on such finding all the causes. He offered the con- therefore they opine that such statements events. The open government features of clusion that “...there is no ‘the probable should not appear in the final report. society embodied by “Freedom of Infor- cause,’ but only a multitude of probable Offering an added perspective, two well- mation initiatives” continue to proliferate causes….” respected contributors to ISASI activities, in a number of States. A keystone of the Fellow ISASI member Professor Rich- while condemning the ills of causal state- trust and confidence in government is the ard H. Wood, referring to the fundamental ments, found it appropriate to include the free flow of information. And a national accident prevention objective of Annex expectations of the public in the investiga- catastrophe such as a major air accident 13, at the ISASI seminar (Vancouver) in tion process. Dr. C.O. Miller’s article Down puts this issue in sharp focus with high 1988, stated that “The fact is, though, the with Probable Cause presented at the public expectations directed to the in- results of an aircraft accident investiga- ISASI seminar (Canberra) in 1991 offers vestigation. tion are used to assess blame whether we a thorough and encompassing study of the The traveling public in most of the like it or not.” evolution of cause, the pros and cons, and developed world (certainly those States Swedish AIB investigator Aage Roed concludes with suggestions on “what can represented in the ISASI community) in 1989 wrote, “During my 9 years at the and should be done.” Dr. Miller highlights is an informed and interactive group; Board of Accident Investigation, I have a most important group of consumers (the they read various news media outlets, continuously repeated the mistake of public), whose interests are frequently they blog, they twitter! Many of them writing one single accident cause in my overlooked in the causal discussion among are national legislators, political figures, reports. These cause determinations those within the air safety investigation news media representatives, or success- are often useless in accident prevention community. He offers a point-counterpoint ful business executives. As a result, they work since they do not provide any ideas summarized as follows: have high interest in aviation, and some for accident prevention.” Point—The public is used to it (cause) of them are the customers of our final

April–June 2010 ISASI Forum • 7 reports. They can be an ally or a foe to the air transport industry. They can be an advocate for our investigative process and safety recommendations or, on the contrary, they can lose confidence in the What Happened and Why? accident investigation authority’s ability ISASI PROCEEDINGS 2009 to provide meaningful information and become adversarial to the industry and to pare two recent and well-based initiatives. national legislative initiatives intended to the existing government oversight. One is the ICAO Manual of Aircraft Ac- moderate or eliminate the appearance of We have seen the demise of airline cident and Incident Investigation, Part IV, “causes” in their final report of accidents. companies and key government officials Reporting, Doc. 9756, published in 2003. In Australia, the Transport Safety Inves- replaced as a result of circumstances associ- The guidance material in this Manual was tigation Act of 2003 (TSI Act) as recently ated with a major accident. If the public and compiled by some very learned safety amended directs the Australian Transport the other stakeholders outside the close- practitioners brought together by the Safety Bureau (ATSB) to identify factors knit aviation community are kept informed ICAO AIG Office. The causal statement is that contribute to transport safety mat- and if they regard our investigative work the subject of several pages of guidance, ters and communicate/publish a report to as credible, they can support our safety including a table of exemplar wording tai- the relevant sectors of the transportation objectives. If they think we are withholding lored to indicate how to avoid language of industry. The ATSB eliminated the cause information, keeping secrets, and taking a blame-setting nature that is focused on word from its investigation reports since sides, unable to call out the truth, they will an individual person. Rather, this guidance 2006. Australian reports contain only be our detractors. The same observation focuses on the task not accomplished or “contributing safety factors” to avoid any can be applied to the press, legislators, and the inadequacy of a facility or a program. language grounded in legal liability or legal victims’ families. If they believe accident This guidance is intended to deflect and contributions. New Zealand follows a simi- investigation authorities are credible, they disassociate causal statements from the lar practice. Korea provided a further ini- will advocate for us. Otherwise? connotation of blame. It is quickly evident tiative at the AIG 2008 Divisional Meeting A final report lacking understandable to a reader that use of this guidance will making the point that a final report contain- causal factors may lose the confidence of provide an informative causal statement, ing only direct cause factors may omit other these public customers. Regrettably these yet one that is less attractive to misuse deficient safety factors needing correction. stakeholders simply may not be prepared in judicial or administrative actions. An Brazil’s CENIPA final report on the Sept. to comprehend and accept the issues of example from the Manual follows: 29, 2006, GOL Airlines Boeing 737/EMB- multiple causation, as we in the industry 135 BJ Legacy airplane mid-air collision is would desire. In the event of a national One accident—same cause(s) published with a Paragraph 5 conclusion catastrophe (perhaps an air accident of – failure of the airport management to section listing facts and contributing fac- 50-250 fatalities) public expectations identify and correct airport drainage tors in lieu of any mention of a cause. And from the official accident investigation versus the TSB of Canada has for several years and final report will run high, and include + the known and uncorrected lack of used a somewhat different approach to its all manner of questions about “how and runway drainage conclusions using the term “Findings as to why” this tragedy happened. Accident in- – the flight crew’s mismanagement of final Causes and Contributing Factors” in lieu of vestigation authorities that provide to the approach airspeed a specific causal statement. public a final report devoid of causes, or versus As a result of the discussions at the offer convoluted findings and factors, set +aircraft crossed the threshold 16 knots AIG 2008 Divisional Meeting, the ICAO the stage for a variety of parties, all with above Vref secretary general circulated a letter to vested interests, to step in to pronounce – the flight crew’s mismanagement of the Member States in May 2009 containing a cause(s) as they see fit...to their benefit. thrust reversers proposed amendment to Annex 13 to be Confusion regarding causal factors in a versus applicable on Nov. 18, 2010. The proposed major event provides a perfect setting for + the late application of reverse thrust amendment includes language to provide tabloid journalism to run amuck. Another somewhat different initiative for the determination of cause(s) “and/or” This somewhat untenable background has been undertaken by several ICAO contributing factors in a final report. The provides us with an opportunity to com- Member States. They have promoted proposal will affect both the definition of

8 • ISASI Forum April–June 2010 The Accident ‘CAUSE’ Statement Is It Beyond Its Time?

an investigation and the format of the final necessary to overcome resistance and gain most suitable answer is to better educate report. Left unanswered is the important positive action on many safety proposals. the judicial officials (and the news media task to provide a definition of “contribut- That value-added emphasis may provide and public) about the overall objectives ing factors” in the context of Annex 13. the extra momentum necessary to over- of the ICAO protocols and encourage na- States will be able to use either “causes” come financial and political obstacles and tional legislation to protect the final report or “contributing factors,” or both, in the may outweigh the undesirable effects of from misuse. conclusions to the final report. Also, ad- causal statements. Lastly, a final accident report devoid of ditional States participating in the inves- Some will argue that we can better meet any defined causes may prove deficient tigation and entitled to provide accredited a wider range of objectives toward reduc- to an affected community of users. The representative comments to the draft final ing or eliminating risk without the causal broad community that is receiving a final report (consultation) will be free to use the statement. This premise is based on the report of a major tragedy holds strong and/or option in their response consistent fact that a causal statement is self limit- expectations that a publicly funded in- with their national protocols regarding the ing and sharply focused, allowing some/ dependent investigation will provide a causal issue. Following these many, many many contributing factors to be dismissed causal statement. Many of these report years of discussions about causal factors, or relegated to less importance—possibly users (customers) will not be satisfied the changes proposed by the secretary never seeing corrective action until they with a convoluted or oblique statement general are expected to be accepted by resurface as causal in another accident. of causes. If their expectations regarding a majority of responding states. For the Although well substantiated in select causes are not met, they can be expected future, guided by national legislation, case studies, this deficit can be reduced if to turn elsewhere for causal answers. the introduction or omission of cause(s) the written report offers a continuum of This search may produce self-serving will rest with the accident investigation detailed contributing factors. and erroneous statements of cause and authority of each State. How can we reduce the misuse of a unintended consequences and may erode final report to assess blame? Educating a the credibility of the investigation and Summary sensationalist press is a never-ending task; serve to undermine the reputation of the Is the accident cause statement beyond its some of our former members seem to en- investigation authority. time? After many years of use, and abuse, joy participating in tabloidism. However, So after more than 40 years of providing is it time to omit this traditional step in the ICAO has recognized the importance of cause(s) in the ICAO final report, we have Annex 13 investigation process? To review, editorial style to reduce inappropriate use come to a choice, a fork in the road. The can the overall objectives of instigating of the final report and provided guidance ultimate objective of Annex 13 will remain safety actions to reduce or eliminate risk in the ICAO Manual of Aircraft Accident as always, to promote risk reduction initia- still be accomplished without naming the Investigation, Part IV, Doc. 9756. tives to make a safe air travel system even cause(s) of the accident? Will the state- Language should not be of a blame- safer. However, with recognition of the ment of cause(s) be missed? If so, by setting nature but rather focus on func- cultural differences and national legisla- whom, and with what result? tions not performed. Investigators who tion of individual States, some accident Of course we can meet the objectives of draft the reports and officials who approve investigation authorities will continue to reducing or eliminating risk without pro- of the final report can make strides toward recognize the need to fulfill expectations viding a causal statement. Simply put, it avoiding misuse if they will follow this of various interests and provide cause(s) does not take an accident to provide an op- guidance. It has been further suggested in final reports while other investigation portunity to initiate a safety action or ac- that to eliminate the word cause within authorities will find it appropriate within complish a formal safety recommendation. the final report will make it less valuable the needs of their society to provide a final In fact, this is what we envision to some to those desiring to misuse the report. report listing factors. Both methods will degree in the future with the introduction This may be true in some societies, but be acceptable in the “and/or” ICAO for- of SMS, continuous monitoring, and pro- one should ask, is it appropriate that the mat. Only time will tell us how the public, active and predictive risk reduction pro- Annex 13 report be altered? Or should the legislators, and the professional aviation grams. However, if desired safety actions society be better educated on the safety community will regard these different or recommendations are preceded by an objectives of Annex 13 and should the approaches—and how the credibility of accident causal statement, tradition may national law of that society be altered to our government air safety investigation indicate that a causal statement provides better reflect those same safety objectives process and documentation will be re- value-added emphasis to the justification (not to apportion blame or liability)? The garded in the future. ◆

April–June 2010 ISASI Forum • 9 MakingGeneral Safer

The authorAv shows how accidentiati prevention in generalo aviationn (GA) could be improved by more widespread use of lightweight flight recorders, especially through flight data monitoring, instruction, flight simulation, and leisure activities. By Philippe Plantin de Hugues, Ph.D., Head of Flight Recorders and Avionics Systems Division, Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (This article is adapted with permission BEA has chaired a working group of 120 recorded (84 fatalities), the causes were from the author’s paper entitled Safety specialists from 12 countries that has now not established with any certainty (causes Strides Foreseen with Lightweight Flight defined specifications for lightweight flight probable or unknown). Recorders for GA presented at the ISASI recorder systems. Any future regulations In the majority of events, the only usable 2009 seminar held in Orlando, Fla., Sept. applicable to small aircraft under 5.7 tons flight data for investigative bodies are those 14-18, 2009, which carried the theme “Ac- will reference these specifications. Accord- that can be read out from onboard comput- cident Prevention Beyond Investigation.” ing to EASA, almost 79,000 aircraft under ers, such as from a GPS. To download data The full presentation, including cited ref- 5.7 tons are active in Europe, and accord- from electronic cards in damaged comput- erences to support the points made, can be ing to GAMA nearly three times as many ers, the BEA’s laboratory has developed found on the ISASI website at www.isasi. are active in the United States. some very effective software. This expertise org.—Editor) The graph (Figure 1) shows the number has, for example, allowed 3-D trajectories of accidents, including fatal accidents, in to be elaborated. Nevertheless, the data tatistics on general aviation (GA) the last 10 years. It is noticeable that fatal are not always sufficient to determine the during the last 10 years in Europe accidents have stabilized at around 100 a causes of accidents. Sand the United States indicate year. The same regrettable stagnation has that the number of fatal accidents has happened in the United States. Equipment available on the market not fallen despite innovations related to The graph of fatal accidents in Europe The aeronautical industry has taken pro- technological evolutions. was not easy to develop as a result of active steps in the production of low-cost, At present, data are often insufficient different procedures used for entering lightweight flight recorders. The BEA during investigations, even though low- database information. In order to present was approached in 2004 and 2005 by pilots cost audio, parameter, and video recorders validated data, only the annual databases and manufacturers to find out which pa- have become available recently for the GA from the three European countries men- environment. For more than 2 years, the tioned (France, Germany, the UK) were Philippe Plantin de used. It wasn’t possible to Hugues was awarded distinguish the accidents in his Ph.D. in fluid relation to the age or the mechanics in 1991. In technology of the airplanes. 1992 he spent one year It was, however, apparent at the NASA Ames Re- that for airplanes defined as search Center and then “modern” the percentage of joined the BEA Engineering Depart- accidents was no lower. ment in 1993 to oversee acoustic analy- As regards France, the sis. He has participated in all the major analysis of the ECCAIRS international investigations involving database used by the BEA France since then. He has been the between 2003 and 2007 for chairman and French representative aircraft under 5.7 tons (air- on the OACI /FLIRECP, the chairman planes, helicopters, gliders, of the EUROCAE WG-50 (ED-112), and Figure 1. Number of accidents during the last 10 years. micro-lights) shows that for the chairman of the EUROCAE WG-77, (Source: BEA, BFU, and CAA) half of the 126 fatal accidents which published ED-155.

10 • ISASI Forum April–June 2010 Figure 2 Figure 3

• The takeoff run speed of the airplane was deduced from the visual passage of the white lines (20 meters long and 20 meters between them). • The value of some parameters shown on the airplane instruments. • The right wing leading edge had an ir- regular distortion that could be attributed to an ice deposit. • After takeoff, the airplane leveled off, then climbed toward about 150/200 feet, rameters would be the most relevant for less expensive solutions in the context of followed by a turn on a 300° heading with recordings that could bring the greatest an aircraft retrofit. In fact, the analysis a low rate of bank. understanding of the causes of accidents. of images makes it possible to capture all • The airplane continued more or less in This approach led to the creation of the the information provided to pilots via the level flight at the same height without giv- EUROCAE working group by the BEA airplane’s instrument panel. ing the impression of gaining speed. on lightweight flight recorders, details of Some manufacturers even offer image • The loss of control occurred with a which follow. analysis (Figure 2) that makes possible the sharp roll to the right, associated with a There are more than 20 manufacturers automatic extraction of parameters linked high nose-down attitude. around the world, including five in France, to the instruments with which the image The spectral analysis of the audio re- that produce flight recorders aimed at gen- is recorded. These recordings can capture cording on the videotape made it possible eral aviation. The more proactive manufac- the airplane parameters as well as the to deduce the following: turers consider that improved safety can atmosphere in the cockpit and some types • The engine RPM. be achieved by using recorders for flight of human behavior that can be crucial to • The frequency of the wheel (38 centi- data monitoring (FDM), maintenance, or understanding accidents. meters diameter) rotation during the run, even flight management. These record- and thus a precise figure for the airplane ers weigh just a few hundred grams, and Investigation using an audio takeoff run speed. several hundred units are already flying and video recording In addition, the following elements in France. They can record a wide range Shortly after takeoff on Jan. 6, 2003, at were recorded without any specific signal of data: attitude, position, speed, accelera- Chambéry Challes the Eaux (France), treatment: tion, altitude pressure, temperatures, etc. the DR400 registered F-GGJR with two • The warnings. The data can be acquired in several ways persons on board stalled and crashed • Speech of those on board. according to the airplane’s technology and into a hangar 800 meters from the end of Thus, based on these elements, the the objective: Runway 33. The passenger had a video history of the flight could be established • In a standalone manner when the re- camera and filmed the flight from takeoff precisely and can be listed as follows: corder itself has gyroscopic sensors, GPS until impact (Figure 3). • Start of takeoff run at T=0. positioning, or accelerometers. The camera tape was not badly damaged • The takeoff occurred at T + 28 sec- • From the installation of sensors dedi- during the accident, and analysis of the onds. cated to recording. Manufacturers say video recording revealed the following: • At T + 60 seconds, the engine RPM that it takes one or two man-days to install • Start-up was difficult, then the pilot dropped and stabilized at 2,220 RPM. them. started the takeoff run. • At T + 66.5 seconds, the airplane slowly • Fy recovering all the data passing • The run lasted about 72 seconds over a began to roll and lost altitude. through the bus installed on more recent distance of 600 meters. • At T + 67 seconds, the stall warning aircraft. • The pilot was holding a mobile phone sounded. These data can be completed by image in his hand from time to time during the • At T + 69 seconds, the stall warning and sound recordings, which can represent takeoff run. sounded again and continued until the

April–June 2010 ISASI Forum • 11 improvement in the benefit for the FDM on 1,000 hours of standard of everyday flight for various types of aircraft. airplane operations. The overall aim of EUROCAE Document ED-155 this study was to dem- EUROCAE is an international non-profit onstrate the capabil- European organization. Membership is ity of a low-cost flight open to manufacturers and users in Europe data monitoring sys- of equipment for aeronautics, trade asso- tem for single-engine ciations, national civil aviation administra- light airplanes. The tions, and non-European organizations. Its predetermined goal work program is principally directed to the was that the budget preparation of performance specifications of less than 5.000¤ and guidance documents for civil aviation Figure 4 per installed system equipment for adoption and use at Euro- and 2¤ per flight hour pean and worldwide levels. EUROCAE has impact with the ground. The airplane had direct operating costs (DOC) for post produced standards used in the certification about a 30° bank to the right, 10° nose flight data analysis services should not of avionics and approval of ATM equipment down, and lost altitude. The airplane was be exceeded. and applications for more than 45 years. diving at a very steep rate with a roll The conclusion of the study is that The EUROCAE Document MOPS angle. • Flight data monitoring as part of Safety (Minimum Operation Performance Speci- • At T + 75 seconds, the airplane struck Management Systems (SMS) can improve fication) ED-155 defines the minimum the ground. the safety of light airplane aviation. specification to be met for small aircraft Wreckage examination showed a heavy • Different types of data must be taken required to carry lightweight flight re- airplane that was balanced to the aft, into account: additional sensors, digital corders that may record flight data, cock- with the flaps in the landing position. Fortunately, analysis of the video and audio recordings also made it possible The need to define specifications to determine with certainty that with a degraded aerodynamic wing profile, the for lightweight recorders has plane had stalled after a slight reduction in thrust. become obvious for general aviation

The regulations safety investigations. Since 2006, the ICAO FLIRECP (FLIght sources (regular instrumentation), im- pit audio, images, and datalink messages RECorder Panel) has worked on improv- ages, and audio. in a crash-survivable recording medium ing the flight recorders section of Annex • The flight trials showed reasonable for the purposes of the investigation of an 6. In the final meetings, it was decided to results with the use of low-cost sensors occurrence (accident or incident). propose fitting lightweight flight recorders so that maneuvers could be indentified This document was produced by the to airplanes under 5.7 tons. clearly. EUROCAE Working Group WG-77 with These propositions were developed using • It is possible to provide the desired more than 120 members coming from cost-benefit analysis, with an evaluation of systems for a target price of less than investigation authorities, regulatory the safety benefits implying an underlying 5,000¤ and 2¤/hour DOC without the use bodies, manufacturers, and associations value to human life. This led to comparing of crash-proof data storage. worldwide. The MOPS has a common the implementation cost with the benefits • In all cases, potentially unauthorized section for crash and fire survivability, that could accrue in terms of reductions in misuse by policing parties must be pre- etc., and separate sections for specific accidents, in damage, and deaths avoided cluded. functions such as flight data, audio, image, rather than in simple economic terms. The • User acceptance is an essential neces- and datalink recording. new proposition for Annex 6 was sent for sity for a purposeful FDM. The primary objective of this docu- consultation to States in July 2009. This • Broad user acceptance would be greatly ment is to provide specifications to be document will refer to the EUROCAE improved if the system can be used for referenced by a regulatory authority, but ED-155 document described later . multiple tasks (e.g., maintenance and it has four other objectives, some of which At the same time, thanks to recommen- training or TBO elongation). fall outside the scope of any regulation. We dations issued by the AAIB, EASA carried • Compared to a retrofit system for older hope to develop a single standard meeting out in 2008 a study entitled “Investigation airplanes (additional sensors required), these other objectives of the Technical Feasibility and Safety a modern airplane with only digital • For the certification authorities who Benefit of a Light Airplane Operational systems will facilitate the use of a FDM participated in the development of the Flight Data Monitoring (FDM) System.” drastically. specifications, the recognized ED-155 will Experience gained during many years has In the continuity of this study, another be referenced. shown that FDM can make a continuing study has been launched to see the real • When a pilot, a company, or an aero club

12 • ISASI Forum April–June 2010 Figure 5 (left) and Figure 6 (right) wishes to equip an airplane or a helicopter improved by more widespread use The advantages for leisure flights with a lightweight recorder, the recorder’s of lightweight flight recorders, even From a leisure perspective, a private pilot conformity with ED-155 will ensure ad- outside a mandatory framework espe- might wish to show his family and friends herence to a recognized standard. cially through flight data monitoring, the places that he has flown over. The im- • For the manufacturer, ED-155 will, for instruction, flight simulation, and leisure age recorder (see Figure 6) would allow example, allow all the appropriate parame- activities. There are a large number of him to do this with a presentation of an ters to be known for the analysis of flights, actors in the world of general aviation. outside view from within the cabin interior. dedicated to investigations into accidents, If we seek to inform pilots, associations, However, the presence of the instrument as well as defining image resolution. This clubs, and small companies, we need to panel would be vital for any technical document must be an aid to development get each of them involved so that they investigation. of recorders, even if they are installed become aware of the benefits of carrying During first flights, an image recorder without a regulatory requirement. a recorder. with an easily downloadable memory could • A type ED-155 recorder will provide potentially provide an excellent additional investigators with information that is The advantages for businesses product to customers, as well as being very useful to the understanding of the causes It is essential to show how a recorder will useful in case of an investigation. of accidents. allow a company to First flights, leisure flights, and instruc- If these four goals are achieved with the • optimize maintenance costs, tion flights can all benefit from advances increase in lightweight recorders installa- • optimize potential, in technology that would be, in parallel, a tion, safety will be improved and the unit • optimize maintenance of onboard vital tool for any investigation. The soft- cost of recorders will fall. equipment, ware associated with recorders permits The document also lists the parameters • perform systematic flight analysis downloading and easy reuse of recorded in aircraft data recording systems (ADRS) with automatic detection in which safety data. These new tools are thus usable by useful for an investigation, those useful thresholds are exceeded (see Figure 4), all pilots. for FDM, the image resolution needed to • achieve precise billing of flying hours, Some lightweight flight recorder manu- capture the instruments on the instrument • effect simplification of management and facturers have been able to reach agree- panel of airborne image recording systems administrative structure, ments with insurers that reduce insurance (AIRS), and the audio quality to capture • secure a drop in insurance premiums. premiums, which could mean that the initial the voices of the pilots on cockpit audio investment is offset in a few short years. recording systems (CARS). The advantages for training The need to define specifications for From a pedagogical perspective, in the con- Conclusion lightweight recorders has become obvious text of aero clubs the instructor could help A new approach must be adopted to high- for general aviation safety investigations. his students returning after a flight with a light the advantages of new data recording At the increasingly important global level, debriefing (see Figure 5) including systems to all those who operate or use small changes in the ICAO processes, including • simple simulation of the training flight with planes or helicopters. Associations and aero funding issues, and a desire to reduce the software associated with the recorders, clubs all over the world are the core public level of detail contained in ICAO stan- • the visualization of flight trajectories to be addressed in this approach. dards lead to a greater reliance on closer overlaid on an aeronautical or satellite Over and above its use as a final re- relationships with key aviation standards chart, cord to be analyzed by investigators, the bodies such as EUROCAE and RTCA. • the visualization of flight parameters, recording of a flight could be viewed as a • the study of the students gestures, source for optimizing the management of Aviation safety advantages • and as much more as can be imagined a fleet, for improving pilot training, or as Accident prevention in GA could be by instructors. a teaching tool for an instructor. ◆

April–June 2010 ISASI Forum • 13 Examining Accident Cost Analysis The authors illustrate how the accident cost methodology used by the legal profession, namely primary, secondary, and tertiary cost categorization, results in an easily understood relationship between costs and technological remedy, costs and regulatory remedy, and costs and investigative remedy and how it can greatly enhance an aviation accident investigator’s ability to frame compelling, well-argued, and fully justified safety recommendations. By Dr. Simon Mitchell, Aviation Director, RTI Ltd, London, UK, and Visiting Fellow, Cranfield University, UK, and Professor Graham Braithwaite, Director, Cranfield University Safety and Accident Investigation Centre, UK (This article is adapted with permission ments. The most appropriate analogy makers effectively toward factors most from the authors’ paper entitled Using the to this is management accounting (also requiring attention. Best Cost Analysis for Effective Safety known as managerial accounting), which • Whether the means of measurement is Recommendations presented at the ISASI is concerned with providing timely, ac- valid, consistent, and reliable. 2009 seminar held in Orlando, Fla., Sept. curate, and relevant information to those 14-18, 2009, which carried the theme “Ac- charged with making decisions that affect ICAO guidance cident Prevention Beyond Investigation.” the financial well-being of an organization. ICAO has published useful guidance on The full presentation, including cited ref- The value of a management accounting collecting and analyzing accident cost in- erences to support the points made, can be system will be assessed on formation, most notably in the first edition found on the ISASI website at www.isasi. • Whether the information provided is of Doc. 9859, “Safety Management Man- org.—Editor) received in good time to make a balanced ual” (2006). Paragraph 1.3.2 underscores judgment, as clearly any information the value of understanding the true cost of ccident investigators play a key role received after a deadline to make the deci- accidents rather than relying on the safety in improving the safety of the air sion is just another cost. blanket of insurance: Accidents (and inci- Atransport industry through pains- • Whether the information provided dents) cost money. Although purchasing taking analysis of serious incidents and clearly identifies those factors (cost driv- “insurance” can spread the costs of an accidents. Myriad skills are exercised by ers) that will be affected by the decision accident over time, accidents make bad investigators in their thorough and im- in hand and does not become confused by business sense. While insurance may cover partial collection of evidence, analysis of mixing other cost drivers that will remain specified risks, there are many uninsured it, and preparation of final reports. Yet as unaffected. Related to this is whether the costs. In addition, there are less tangible those who work within the independence information provided guides decision- (but no less important) costs such as the advocated by ICAO Annex 13 know all too well, poorly prepared recommendations Dr. Simon Mitchell’s safety risk management, fault, regula- may mean that the painful lessons of an aviation career spans 20 tion, and cost benefit. occurrence are not learned. Misdirected, years and includes 5,400 impractical, or ambiguous recommenda- professional helicopter Professor Graham tions may provide an excuse for inaction flying hours, combined Braithwaite is the by an air transport system that is un- with doctoral research head of the Department convinced by its merit. Careful analysis into accident cost analy- of Air Transport and of recommendations published by many sis and the economics of safety. He has director of the Safety ICAO State investigation reports reveals experience in all the key helicopter in- and Accident Investiga- the difficulty most investigators find in dustry sectors: military flying, offshore tion Centre at Cranfield preparing them. oil support, police pilot, and corporate University. He holds a Ph.D. from The research presented in this article pilot and safety manager. He is a visit- Loughborough University in safety is concerned with using cost information ing fellow with the Cranfield Univer- management and is responsible for the about accidents to aid decision-makers sity Safety and Accident Investigation aircraft accident investigation courses who seek to avoid or mitigate future Centre. At RTI Ltd he serves as avia- that run at Cranfield in collaboration costs—in other words, to properly assess tion director, which includes oversight with the UK Air Accidents Investiga- the value of proposed safety improve- of business concerned with issues of tion Branch.

14 • ISASI Forum April–June 2010 Examining Accident Cost Analysis definitions is given inSafety Management Cost Item ICAO Calabresi Manual (2nd Edition, 2008), Chapter 5, Paragraphs 5.3.8-5.3.9. However, for our Hull Damage Direct Primary purposes, we will assume that readers are Medical Treatment Direct Primary familiar with applying this direct/indirect Property Damage Direct Primary Loss of Business Indirect Economic Loss* cost classification system that has been Damage to Reputation Indirect Economic Loss* endorsed by ICAO and other regulatory Loss of Use of Equipment Indirect Primary bodies for some time. From here on, the Loss of Staff Productivity Indirect Primary objective will be to summarize the prin- Investigation and Clean-up Indirect Tertiary ciples of the alternative system and high- Insurance Deductibles Indirect Secondary Legal Action Indirect Tertiary light the key advantages to be gained. Compensation and Damage Claims Indirect Secondary and Tertiary It is important to recognize that the Fines and Citations Indirect Primary and Tertiary definition and priority given to any cost *Note: The addition of a classification for “Economic Losses” is a contribution will change according to your viewpoint; to the system made by Steven Shavell (1987). and in the case of aircraft accidents, these viewpoints (and related stakeholders) are Table 1: Accident Cost Classification often in conflict. The air transport indus- try has many stakeholders, but for the loss of confidence of the travelling public. sive an accident really is once all of the purposes of accident cost (and associated An understanding of the total costs of an costs are considered. It was in developing safety cost) analysis, they can be reduced accident is fundamental to understanding the cost model that the following method- to three broad groups, identifiable by the the economics of safety. (ICAO, 2006) ology was reviewed and adopted. primary interest of members. Acknowledging that air transport has developed to be predominantly about Alternative cost analysis system Stakeholders businesses rather than the social provision When it comes to assessing cost informa- According to Calabresi and Shavell, there of transport, ICAO also recognizes that tion, the ICAO guidance (along with that are three identifiable categories of stake- viability is not ensured. With competition from other regulatory bodies) is useful holder. The “industry” clearly forms one from high-speed rail, increased car owner- but not optimal. An alternative system is major group, whose members will include ship, and alternatives such as video confer- one that has been widely adopted by the operators, maintenance organizations, encing, aviation should be clear of one of legal profession for analyzing the costs and manufacturers. “Society” forms the advantages that it has long enjoyed— of accidents, described in the Hon. Guido the second, made up of both individual its safety performance. However, as ICAO Calabresi’s seminal work The Costs of protagonists, community groups, and notes, the industry needs to take care of Accidents (1970). The author proposes a the wider population. The third group the customer’s perceptions of safety. framework of analysis that clearly appor- is “administration,” comprised of execu- Paragraph 1.3.3 The air transporta- tions costs according to the interests of the tive, legislative, and judicial authorities tion industry’s future viability may well stakeholder most concerned. charged with the duties of ensuring long- be predicated on its ability to sustain the A summary of ICAO’s system and the term social efficiency and justice. public’s perceived safety while travelling. comparison with Calabresi’s works is Having recognized these differing and The management of safety is therefore a shown in Table 1. sometimes competing interests, Calabresi prerequisite for a sustainable aviation While the list of cost items shown is found that greatly improved analysis of business. obviously not exhaustive, it is sufficiently accident cost reduction strategies would In author Mitchell’s doctoral thesis, the indicative and also mirrors the list in result once a clear set of goals (justice and economics of safety were examined using the ICAO Safety Management Manual cost reduction) and associated sub-goals the case study of North Sea passenger (2006), Section 4.8, Cost Considerations. (e.g., reducing administrative costs) are helicopter operations. Cost analysis of a A working definition of direct costs are first identified. Underpinning the whole of fatal helicopter accident revealed not only those items for which it may be possible this framework of analysis is the concept how little cost data are collated following to get insurance coverage, and indirect of classifying costs into three groups: 1) an occurrence, but also once a thorough costs being those costs outside any insur- primary, 2) secondary, and 3) tertiary. It is analysis had been completed, how expen- ance coverage. A more detailed set of worth noting that it is this third classifica-

April–June 2010 ISASI Forum • 15 CATEGORY ACCIDENT COST SAFETY KEY RECOMMENDATION STAKEHOLDER

PRIMARY Fixed asset loss/damage, Improved reliability Industry (operators, human capital loss/damage measured against service providers, probability of failure and OEMs) SECONDARY Market instability, Reputational measures Legislative branches compensation targeted to enhance of government trust and confidence TERTIARY Investigation costs, Tools to minimize or Executive branches regulation, court resolve uncertainty and of government tion of “tertiary” costs that is the source of administration ambiguity, enhance and judiciary most advantages of the Calabresi system social efficiency over the direct/indirect system. ECONOMIC Specific business Corporate governance Shareholders Primary costs of accidents—These are LOSS issue risks the most obvious and directly related group of costs. By definition, an accident Figure 1. Accident cost/safety recommendation framework. is an unplanned, unintended event that results in harm or damage, and therefore enced a cost, just that individual operator. secondary costs. If, for example, excluding losses (which result in costs). These costs On the other hand, if that business is lost all aircraft that were not multi-jet-pow- range from damage to equipment to dam- altogether, then that is a cost to the indus- ered reduced the frequency of accidents, age to property and/or infrastructure and try. Another example might be when there this might also result in costs to society may culminate in injuries to people. Equip- is an accident causing injury to a very high- (e.g., severely restricting “feeder”-type ment needs to be repaired or replaced; net-worth passenger, potentially owning airlines). Similarly, if all accidents were damaged property needs to be secured, assets worth many billions of dollars. This perfectly compensated (secondary cost repaired, or rebuilt; infrastructure needs may well justify extraordinary measures reduction), there would be reduced incen- to be stabilized and reinstated; injuries to but is clearly a very particular and specific tives to avoid accidents (primary costs). victims require medical attention. set of circumstances rather than a matter Calabresi in his The Costs of Accidents Secondary costs of accidents—Second- for industry stakeholders. (1970) writes “It should be noted in ary costs are the “societal costs” arising Another advantage of Calabresi’s ac- advance that these sub-goals [primary/ from accidents. These costs include the cident cost categorization system is that secondary/tertiary cost reduction] are various compensations to victims and/or it becomes easier to identify the interac- not fully consistent with each other…. We the families of victims. It also includes tion between different actions and any cannot have more than a certain amount activities that are aimed at managing unintended consequences that might of reduction in one category without for- long-term psychological and related social result. An initiative solely targeted at going some reduction in the other, just as impacts, through counseling, government, one category of cost will not necessarily we cannot reduce all accident costs beyond and community support. be sympathetic with another, and so the a certain point without incurring costs in Tertiary costs of accidents—Coping overall effect may be to actually increase achieving the reduction that are greater with accidents involves organizing the overall accident costs. than the reduction is worth. Our aim must resources of multiple parties and organiza- be to find the best combination of primary, tions and arbitrating competing interests. Directionality secondary, and tertiary cost reduction This gives rise to a set of costs concerned An appreciation of the concept of di- taking into account what must be given with administrating the system, and, in the rectionality is probably the strongest up to achieve that reduction.” case of aviation accidents, includes such argument for adopting this framework items as accident investigation, safety of cost analysis over any other. The clos- Application regulation, and legal proceedings. est analogy is an understanding of the While it is not always obvious where interaction between zero lift drag and lift distinctions should be made between Economic loss induced drag on total drag in aerodynam- these categorizations, the process of clas- The issue of “economic loss,” as distinct ics—where reductions in one through an sification does direct the attention of the from other accident costs, is a way to high- increase in speed may produce an overall relevant stakeholders toward the relevant light particular circumstances of a situation advantage in total drag up until an opti- issues of concern in their areas of control that will not be generally true for others, mal point and, thereafter, be negated by most effectively. In this way, whether or or for consideration by the air transport increases in the other to create an overall not absolute consistency is achieved in the system as a whole. Inclusion of these items detrimental impact on total drag. classification process, the overall objective as costs might distort or otherwise impose In a similar fashion, it is important to will be largely achieved. a bias on the decision-making process. An note that reducing any one group of costs Diagrammatically the system can be example of this would be an individual will not always result in an overall reduc- summarized as illustrated in Figure 1. operator’s loss of business where another tion in the costs of accidents. In some cir- The important thing to recognize is operator picks up that business. In this cumstances, targeting the primary costs, that not every objective concerned with case, the industry, per se, has not experi- for example, will result in an increase in maintaining a stable and sustainable air

16 • ISASI Forum April–June 2010 transport industry is concerned with the Pan Am 103, Dec. 21, 1988, Lockerbie. • Boeing 737, US Air 427, Sept. 8, 1994, probability of failure and an associated • The 9/11 attacks in New York. Pennsylvania, where the investigation was justification predicated on the expected However, it is also possible to see these frustrated by the lack of data concerning value of saving life (even if that is the “secondary” factors evident in less cata- the loss of control. ultimate objective). Therefore, it is im- clysmic situations as well, for example, • Boeing 747, TWA 800, July 17, 1996, portant to separate the various goals and • AAIB, Special Bulletin, S3/2009, Euro- Atlantic Ocean near New York, resulting in sub-goals in order to match the safety copter EC225, G-REDU, Feb. 18, 2009: a highly complex and costly investigation recommendation to the appropriate costs. “Because of the importance of helicopter process because of a lack of objective data. Consequently, the validity of any associ- operations in support of the offshore oil ated cost-benefit analysis will be greatly and gas industry, it is considered appro- Summary strengthened, without resource to emotive priate to disseminate the results of the ini- In the face of any accident aftermath, reasoning. tial investigation as soon as possible. No there is a clear and recognized need to ful- analysis of the facts has been attempted.” fill obligations and responsibilities toward Some illustrative examples multiple parties, each with its own set of 1. Past accidents in which primary 3. Past accidents in which tertiary priorities and goals. The recommendation factors are of preeminent concern. factors are of preeminent concern. remains the most powerful weapon in the A safety recommendation concerned with A safety recommendation concerned with arsenal of the investigator but should be primary cost will be fully justifiable on the addressing a tertiary cost might well be used wisely. Although this should not be existing basis of cost-benefit analysis— justified on the investigation costs saved a primary driver in deciding whether to namely, probability of failure and expected should better quality information be make a recommendation, understanding cost of damages or loss of life. There are available, or avoiding damaging public the cost implication may assist investiga- many examples of accident investigation disagreement and resolving contentious tors in directing them. This is particularly that highlighted some previously unknown differences of opinion efficiently. Addition- important where costs are less visible, failure mode or issue of reliability. Two ally, it will be a justification made against as is often the case with secondary and recent cases are system-based costs (recognizing the tertiary costs. • Boeing 777, G-YMMM, Jan. 17, 2008, agents of State as legitimate stakeholders, A cost categorization and classification London Heathrow, with new knowledge with specific roles and with financial in- system that best matches these goals and about the formation of ice reliability in terests) rather than attempting to justify priorities will likely aid more socially ef- the fuel system. cost-benefit on the level of each and every ficient decision-making than alternative • AS332 L2, Super Puma, G-REDL, Apr. individual operator. systems. The authors have compared 1, 2009, with a focus on the reliability of Probably the most pressing tertiary fac- these two systems in great detail and the main gearbox. tor for accident investigation is concerned are of the opinion that the accident cost with flight data recorders (FDR). There classification system based on Calabresi’s 2. Past accidents in which secondary have been numerous accidents that cannot The Costs of Accidents (1970), modified by factors are of preeminent concern. be resolved satisfactorily because of the Shavell’s Economic Analysis of Accidents A safety recommendation concerned with lack of adequate data, to the extent that Law (1987), is superior in this regard. Due addressing a secondary cost might well be the International Helicopter Safety Team to the principles on which the framework is justified on the basis of the expected loss in (IHST) has made wider use of FDR a key- founded, it encourages the accident inves- passenger demand (or a scenario analysis stone of its strategy to reduce helicopter tigator or safety analyst to represent the based on a range of values) or the neces- accidents by 80% by 2016 [see Forum, problem from different viewpoints. In this sary ticket price changes (temporary or January-March, page 16]. However, it is way, it is also a very useful aid for structur- permanent) to maintain yields. It should evident that to demonstrate the full finan- ing the whole safety analysis along logical be recognized that these secondary (social) cial value of this initiative, the issue needs pathways, without adding any significant factors are the ones with real potential to to be considered at a system level rather complexity for the analyst. It is for these place the industry into crisis. Examples of that at an individual operator level. Possibly reasons of effectiveness, clarity, and ease accident investigation that have significant the highest profile examples that illustrate of use that accident investigators should market potential often involve some major the potential value of proper allocation of give serious consideration to adopting this political event, most notably resources to tertiary factors (in practical technique when identifying and framing • The terrorist bombing of Boeing 747, terms, aids to investigation) are safety recommendations. ◆

April–June 2010 ISASI Forum • 17 A Review of

Fly-byAccidents-Wire In this history of fly-by-wire (FBW) airplanes, the authors place an emphasis on the certification requirements found in Part 25. They examine the service history of civil FBW airplanes, using several databases for FBW accidents and serious incidents, excluding those with no flight control involvement. They use the term “incident” to describe “accidents and serious incident” events. By Dr. R.L. (Dick) Newman and A.A. (Tony) Lambregts, Chief Scientist-Advanced Controls, FAA

(This article is adapted with permission surfaces, such as the ailerons or elevators. from the authors’ paper entitled A Review Most, if not all, new transport airplanes Abbreviations of Fly-by-Wire Accidents presented at the have FBW flight control systems. For the ADIRU—Air data inertial reference unit ISASI 2009 seminar held in Orlando, Fla., manufacturers, elimination of the cable ASRS—Aviation Safety Reporting System (NASA) Sept. 14-18, 2009, which carried the theme and pulleys means a significant weight FBW—Fly-by-wire FCS—Flight control system “Accident Prevention Beyond Investiga- savings, which translates to increased FL—Flight level tion.” The full presentation, including payload or fuel savings. It also greatly re- MEL—Minimum equipment list cited references to support the points duces the manufacturing and maintenance MMO—Maximum operating Mach made, can be found on the ISASI website manpower requirements. Any airplane PF—Pilot flying at www.isasi.org.—Editor) mechanic will tell you that control rigging PIO—Pilot induced oscillation PNF—Pilot not flying can be time consuming. TCAS—Traffic Advisory and Collision Avoidance n October 2008, Qantas The first civil transport with FBW was System ◆ Flight 072 experienced a the Concorde, which entered service in flight control malfunction 1976. Control rigging was the driving is- flying between Singapore sue since the fuselage grew by some 10-12 The flight control computers in a FBW I and Perth. The airplane inches during supersonic cruise. airplane design can be used to augment pitched over abruptly seriously injuring Modern FBW flight controls use on- the airplane’s stability, handling qualities, a total of 14 passengers and cabin crew. board digital computers to modify the and maneuverability to the desired level, The flight diverted to an Australian Air pilot’s control inputs before sending the when the operational center of gravity of Force base, and the injured were flown by signal to the actual control surfaces. the airplane is moved aft to reduce air- helicopter to the hospital. The first operational use of FBW flight plane drag. In transport airplanes, such This accident gave impetus to efforts to controls was on the military F-16 fighter. as the Airbus A320 or Boeing 777, this review the certification requirements deal- ing with fly-by-wire (FBW) flight controls. Dick Newman re- Tony Lambregts is the The certifying authorities have been certi- cently retired from the Photo FAA’s chief scientific fying FBW airplanes using special condi- FAA where he was an not and technical advisor tions to augment the traditional airworthi- aerospace engineer in available for advanced control ness requirements for flight controls in the Transport Airplane systems. He has more areas where these existing requirements Directorate. Prior to than 40 years of experi- are inappropriate or inadequate. joining the FAA, Dr. ence, 29 with the Boeing Newman was an associate professor Company, where he worked on a wide Background of safety science at Embry-Riddle variety of production and research FBW is the description of airplane flight Aeronautical University in Prescott, projects. Prior to joining the FAA, he controls in which there is no direct me- Ariz. Prior to that, he was a consulting worked for a year with Fokker Aircraft chanical connection between the pilot’s engineer, a test pilot, and an airline on fly-by-wire design and taught at the stick and rudder and the flight control pilot. Delft University of Technology.

18 • ISASI Forum April–June 2010 Table I: Civil Transport FBW Models Table III: FBW Incidents in Civil Aircraft Manufacturer Certified Models Proposed Models Model Accidents Incidents Total Rate* Airbus A320, A330, A340, A380 A350 A320 7 13 20 0.30 Boeing 777 787 A330/340 2 2 4 0.26 Bombardier C-series B-777 0 2 2 0.12 Dassault 7X SMS E170/190 0 1 1 0.16 Embraer E170, E190 All Others 0 0 0 --0 Gulfstream G-VI, G-250 Total 9 18 27 Ilyushin Il-96 * Rate is events per million flight hours. Misubishi RJ Sukhoi SSJ-100 Tupolev Tu-204 Models 10 Current 8 Proposed Table IV: Types of FBW Incidents Type of Incident Number Comments Table II: Accidents Caused by FBW Systems Uncommanded pitch/bank 11 8 Pitch, 3 Bank Date Model Location Phase Description Injuries Damage Abrupt maneuver 6 Dual control input 02/07/01 A320 LEBB Landing Abrupt 1 serious Pilot Induced Oscillation 4 Maneuver 25 minor Write off Collision with terrain/obstacle 3 1-Dual control input 03/17/01 A320 KDTW Rotation Pilot Induced 3 minor Substantial 2-Envelope protection misused Oscillation FCS mode reversion 2 10/07/08 A330 YPLM Cruise Uncommanded 14 Serious Minor Tailstrike 1 Pitch Total 27 can mean burning less fuel or being able designs. Envelope protection designs resentative of civil aircraft. to carry more payload. range from full authority (Airbus) through We grouped airplanes using virtually In addition, the flight control system limited authority (Boeing) to minimal en- identical FBW control systems, such as can be designed to make the airplane’s velope protection (Embraer). Table I lists the A330/340 and E170/190. Only airplanes handling qualities appear the same to the the current and proposed civil airplane in line operations were considered (test pilot across the range of speed, altitude, FBW aircraft. The next section outlines flights were excluded). These incidents and aircraft loading. Different airplanes the methodology used to examine the were manually reviewed to exclude those can be designed to fly with virtually identi- service history. (See Table 1.) with no flight control involvement. Sec- cal handling qualities, thus reducing pilot ondary flight controls (i.e., flaps) were not training costs. Method considered. Individual examination of each Most FBW flight control system designs One of the problems with examining safety record was used to cull those with no FBW also include flight envelope protection problems with extremely safe systems is involvement. features. If present, envelope protection the lack of many examples. We found only can help prevent the pilot from reaching three accidents caused by FBW systems Results unsafe flight conditions, such as stalling, (shown in Table II). We found 29 accidents and serious inci- overspeeding, overstressing, or overbank- With such systems, one cannot examine dents involving FBW systems. It must be ing the airplane. As one NASA test pilot accidents but must search for precursors. emphasized that these accidents and inci- said, “This results in carefree handling.” Therefore, we reviewed the service history dents involved FBW, not necessarily that In other words, with full authority enve- of civil FBW airplanes, using several data- FBW was the cause. In fact, in one case, lope protection, you just fly the airplane bases for FBW accidents and serious inci- FBW prevented an incident from being and don’t worry about losing control. dents. The databases used were the U.S., catastrophic. Table A (see Appendix, page Certification requirements for airplane British, Australian, and Canadian data- 22) lists the incidents obtained from this flight controls were developed for tra- bases. We also used two private databases: review. Table III summarizes the data. ditional mechanical systems. They have the Aviation Safety Network and Flight The principal types of FBW inci- not been updated to cover FBW designs. Simulation Systems databases. Once the dents are uncommanded pitch or bank, The certification rules still speak of stick- event was identified, we examined publicly abrupt maneuver, or pilot induced oscil- and-rudder motion and forces in terms of available information, such as the accident lations (PIO) accounting for 22 of the 27 direct mechanical systems. None of the report from the investigating agency. We incidents. There were three collision with current transport FBW airplane designs did not include anonymous reports, such as terrain accidents. These were not caused meet all of the Part 25 requirements. All the NASA ASRS because of the inability by FBW, merely influenced by the system modelsAirbus, Boeing, Dassault, and to verify information. design choices. Two incidents (cases a and Embraerhave employed special condi- Flight test reports were not included b in Table A) were caused by the pilot ap- tions for the flight control system. for several reasons. It is difficult to obtain parently relying on envelope protection There are currently 10 civil airplane reliable data, and the data may not be to provide terrain clearance. The third designs with FBW flight controls. These releasable. Further, the aircraft may not incident (case x) was apparently caused include designs with full stability aug- be typical of the in-service configuration. by spatial disorientation, but was com- mentation, such as the Airbus or Boeing Military safety data were not used for the pounded by conflicting control inputs from designs, and simpler designs without sta- same reasons. In addition, many military the two sidesticks. bility augmentation, such as the Embraer aircraft designs and missions are not rep- There were three reported instances

April–June 2010 ISASI Forum • 19 Abrupt maneuvers: The issue of dual control inputs should be studied to determine if simple summing of the pilot inputs is the best solution for designs using sidesticks with passive feel forces.

of the flight controls dropping back into Table V. Factors in 11 Uncommanded Pitch or Bank Incidents alternate or direct law (cases n and Cause of Incident Number Case In Table A Comments Flight Control Electronics 4 (e) (f) (g) (n) v)relatively minor events. However, Flight Control Software Implementation 3 (k) (q) (w) they are included because of the potential Sensor Error Detection and Isolation 3 (q) (w) (aa) 2 Sensor, 1 Electrical consequences. System Annunciations 3 (f) (w) (aa) Multiple Warnings Cockpit Ergonomics 2 (n) (y) Sidestick Issues Uncommanded pitch/bank: The predomi- Envelope Protection Implementation 2 (k) (aa) nant causes were specific component fail- Maintenance Error 2 (c) (n) ures (flight control electronics or incorrect Dual Control Input 1 (y) Flight Control Mode Reversion 1 (c) wiring) often coupled with design errors Inadvertent Control Input 1 (y) in flight control software implementa- Reversed Controls 1 (n) Maintenance Error tion. Fault detection and isolation design Undetermined 1 (z) errors seem to be a major contributor as well. Many of these involved dispatch with can saturate the control surface actuator resolution advisory was received. The first known bad components and subsequent rate or displacement authority without officer (PF) responded. The captain (PNF) mishandling of an additional failure. Table pilot awareness, a particular problem with also responded. This resulted in accelera- V summarizes the factors. digital FBW airplanes. In two instances, tions in the aft galley of +2.3g, changing Cockpit ergonomics (sidestick) factors ice accretion on unprotected flaps affecting to -0.8g. Four flight attendants received are interesting. In one incident (case y), the aircraft response was a factor (cases r serious injuries (case h). the first officer (PNF) unintentionally de- and s). Table VII summarizes the factors A340 pitch up: On Oct. 2, 2000, an A340 pressed the takeover button on his sidestick in PIO incidents. was cruising at FL360 over the North while the captain was flaring for landing, Pilot misuse of envelope protection: Atlantic in turbulence. A longitudinal causing a hard landing. In another inci- Early in the service of FBW transports, gust caused an airspeed increase to Mach dent (case n), the captain’s sidestick was there were two accidents in which it ap- 0.882 (MMO+0.02), which disconnected wired backwards laterally. The airplane pears that the crew used the envelope the autopilot. The autothrottle also was about to drag a wingtip just after lift- protection inappropriately. At the time, disengaged and the pilot reduced power off, and the first officer (PNF) took over, many airline instructors were pointing to idle, apparently to prevent another preventing a catastrophic accident. out the features of envelope protection overspeed. Subsequently the airspeed Abrupt maneuver: These are caused by and may have led pilots to either become fell off sharply and the angle of attack both pilots applying inputs to the sidestick complacent or actually use the system to reached Alpha-prot, which engaged al- on an Airbus-type FBW design. When command a go-around. These incidents do pha protection. In alpha protection, the both pilots make inputs, the two inputs are not reflect on the FBW systems as much sidestick commands alpha directly. With summed, not averaged, to form the output as on crew training (cases a and b). no pilot stick input, angle of attack is held control action. These incidents typically Multiple warnings: In many of these to Alpha-prot. At some point, power was occur when one pilot (PF) is responding incidents, the crew was presented with advanced to take off power, either by the to an event, such as a TCAS resolution multiple failure/fault indications. One flight crew or possibly because Alpha- advisory (RA), and the other pilot (PNF) report states there was “no recognizable floor was triggered. When alpha reaches gets on the control to help. They also occur failure” (case p). In addition to the trig- Alpha-floor, the power is automatically when one pilot follows through during a gering failure/fault, there are cascading advanced to takeoff power. The airplane landing flare. Usually, it is the captain who annunciations, making the crew’s job in pitched up and zoomed to FL384. To dis- adds his control input to the first officer’s. troubleshooting difficult (cases f, p, v, w, engage the Alpha-prot mode, the flight Table VI summarizes the factors in abrupt and aa). crew must command a nose-down stick, maneuver incidents. which the crew eventually did, to return Pilot induced oscillation: These incidents Representative incidents the airplane to the assigned flight level. occur when the aircraft responses that the Space does not permit a complete review The result was a near miss with an A330 pilot is trying to control get out of phase of all FBW incidents. The following seven at FL370 (case k). with the pilot’s control input. While this incidents are representative of the list: A320 landing accident: On Feb. 7, 2001, happens in non-FBW airplanes, the added A340 abrupt maneuver: On June 21, 1996, an A320 was attempting to land at Bilbao lag of the digital computers and the high an A340 was departing Dallas-Fort Worth. when it encountered strong vertical gusts. dynamic amplitude of the digital signals During the climb at 13,800 ft, a TCAS The crew attempted to go around, but the

20 • ISASI Forum April–June 2010 Abrupt maneuvers: The issue of dual control inputs should be studied to determine if simple summing of the pilot inputs is the best solution for designs using sidesticks with passive feel forces.

alpha protection logic was triggered by and then to direct law when the gear was Conclusions a high angle-of-attack rate and the dual extended. The fault was found to be in the The three main types of FBW inci- control input by both pilots. The result pitot tube, not in any of the ADIRUs. Had dents, uncommanded pitch/bank, abrupt was a hard landing, which damaged the all three ADIRUs been operative, voting maneuvers, and pilot induced oscillations airplane beyond repair. Subsequently the would have detected the error as it did have different causes. alpha protection engage logic was modi- during the previous flight (case p). Uncommanded pitch/bank: To address fied (case l). Pitch up over Indian Ocean: On Aug. these events, improvements in system “Backwards” sidestick: On March 20, 1, 2005, a B-777 crew received erroneous fault detection and isolation are required, 2001, an A320 rolled left at liftoff. The airspeed and sideslip information during particularly for second failures of the captain (PF) compensated with right stick climb. At FL380, simultaneous overspeed same kind and combinations of differ- input. The left roll increased. The first offi- and stall warnings occurred, and the ent types of failures. It is unlikely that cer instinctively took control. The airplane autopilot disengaged. This was followed we can achieve the requisite reliability returned safely to Frankfurt. It was the by a pitch up to FL410. In June 2001, ac- without better fault management. At the first flight following maintenance in which celerometer No. 5 had failed with the flight same time, more attention should be paid one of the two elevator aileron computers control system ignoring its output. In the to the effect of dispatch with faulty or was replaced. During this replacement, intervening 4 years, the flight controls inoperative system components (allowed a connector pin was bent and the con- continued to ignore this latent failure until by MEL) on the probability of success- nector replaced. Two pairs of wires were a second failure occurred at which point fully coping with subsequent additional reversed. In effect, the captain’s sidestick the system began to use the faulty accel- failures (e.g., correct handling of a second failure). Also there have been a number of inci- Table VI. Factors in Six Abrupt Maneuver Incidents Cause of Incident Number Case in Table A Comments dents and accidents related to envelope Dual Control Input 6 (h) (i) (l) (o) (t) (u) protection functions design in which the Crew Training 1 (h) TCAS Maneuver envelope protection activated due to Envelope Protection Implementation 1 (l) deficient engage logic design or faulty information fed into the envelope protec- tion function, causing an undesired sharp Table VII. Factors in Four Pilot-Induced Oscillation Incidents Cause of Incident Number Case in Table A Comments “pushover,” as appears to have recently Flight Control Gains 3 (d) (r) (s) happened in the Qantas accident men- Contaminated Airfoil 2 (r) (s) Ice on Flaps tioned at the beginning of this article. Rate Limiting 1 (m) During Takeoff Envelope protection designs in which the envelope protection function mode was wired backwards. The independent erometer No. 5 again. As a result of this change latches and remains in effect after sidesticks allowed the first officer to fly incident, the failure detection and isolation the threat of airplane departure from the the airplane safely (case h). software was modified to prevent the use safe flight envelope has passed and which Dispatch with inoperative ADIRU: On of known bad sensors (case w). require flight crew action to restore the Aug. 9, 2001, an A319 had an apparent Pitch down over Indian Ocean: On Oct. 7, normal flight modes are not satisfactory ADIRU-1 failure. After landing at an 2008, an A330 autopilot disconnected dur- and possibly unsafe (cases h and l). This outstation with no spare parts, the Nos. ing cruise with multiple failure indications. area will require research to establish 1 and 3 ADIRUs were exchanged. The While the crew was troubleshooting, the satisfactory envelope protection system minimum equipment list (MEL) permits aircraft abruptly pitched down at -0.8g. functional and design safety requirements dispatch with an inoperative ADIRU-3, There was a second pitch down at +0.2g. for certification. but not with either of the others inopera- ADIRU-1 had many spikes in the output Abrupt maneuvers: The issue of dual con- tive. ADIRU-3 was rendered inoperative data stream and had flagged its output as trol inputs should be studied to determine per the MEL. During the subsequent leg, invalid. Both pitch downs were associated if simple summing of the pilot inputs is the there were multiple failures and warn- with angle-of-attack spikes to more than best solution for designs using sidesticks ings. The report describes the symptoms 50 degrees alpha. The flight diverted to with passive feel forces. This will require as having no “recognizable failure.” The an air force base. Twelve serious injuries some research and careful assessment of flight controls switched to alternate law occurred (case aa). the consequences of dual inputs. At this

April–June 2010 ISASI Forum • 21 We must not forget that overall FBW and envelope protection have prevented accidents and saved lives. In the past 15 years, there have been 27 stall accidents in commercial transport operations with 848 fatalities—not one was a FBW airplane.

time, however, we are reluctant to recommend any alternative Appendix to simple summing of the pilot Table A: Accident Listing Civil FBW in Service Incidents inputs in view of the incident at Case Date Model Registration Where Flight Phase Description Frankfurt (case n). (a) 26Jun88 A320 F-GFKC LFGB Manuevering Collision with Terrain More research is also needed to (b) 14Feb90 A320 VT-EPN VOBG Landing Collision with Terrain establish sidestick safety require- (c) 26Aug93 A320 G-KMAM EGKK Initial Climb Uncommanded Bank ments related to (d) 27Apr95 A320 N-331NW KDCA Approach Pilot Induced Oscillation (PIO) • stick maneuver command sen- (e) 28Apr95 A320 N-331NW KMSP Climb Uncommanded Bank sitivity, (f) 18Mar96 A320 N-340NW KDTW Cruise Uncommanded Pitch • the scheduling of the maneuver (g) 14Jun96 A320 N-347NW KBOS Climb Uncommanded Pitch command authority for large stick (h) 21Jun96 A340 D-AIBE KDFW Climb Abrupt Maneuver deflections appropriate to the (i) 14Aug98 A320 G-MIDA EIDW Landing Flare Abrupt Maneuver flight condition and, (j) 5Nov99 B-777 N-784UA EGLL Rotation Abrupt Maneuver • harmonization between the (k) 2Oct00 A340 TC-JDN N Atlantic Cruise Uncommanded Pitch displacement maneuver com- (l) 7Feb01 A320 EC-HKJ LEBB Landing Abrupt Maneuver mands and the required deflection (m) 17Mar01 A320 N-357NW KDTW Rotation Pilot Induced Oscillation (PIO) forces. (n) 20Mar01 A320 D-AIPW EDFF Initial Climb Uncommanded Bank Similar issues with respect to (o) 15Jun01 A320 N-561AW KSAN Maneuvering Abrupt Maneuver FBW rudder control system de- (p) 9Aug01 A320 G-EUPV EGLL Approach FCS Mode Reversion signs also need to be addressed. (q) 14Jun02 A330 C-GHLM EDDF Approach Uncommanded Pitch Pilot induced oscillations: Final- (r) 7Dec02 A320 C-GIUF CYYZ Approach Pilot Induced Oscillation (PIO) ly, PIOs will continue to be an is- (s) 7Dec02 A320 C-GJVX CYYZ Approach Pilot Induced Oscillation (PIO) sue. Current flight test evaluation (t) 16Jun03 A320 C-GTDK EGGD Landing Flare Abrupt Maneuver is addressing this by requiring (u) 15Apr04 A320 G-TTOA LEMG Descent Abrupt Maneuver evaluation in those areas where (v) 25Jun05 A320 I-BIKE EGLL Approach FCS Mode Reversion PIO is likely. Various prevention (w) 1Aug05 B-777 9M-MRG YPPH Climb Uncommanded Pitch (x) 3May06 A320 EK-32009 URSS Missed Approach Collision with Terrain approaches have been proposed to (y) 23Oct06 A320 N-924FR KDEN Landing Flare Uncommanded Pitch develop system design attributes (z) 27Mar07 E170 HZ-AEN OERK Descent Uncommanded Pitch to reduce susceptibility to PIO or (aa) 7Oct08 A330 VH-QPA YPLM Cruise Uncommanded Pitch to detect PIO and change gains accordingly. ficult. It would be much easier if all used intervention is required. Certification Accident databases the aircraft registration. office personnel will need to be trained During the course of reviewing these ac- to identify potential FBW system design cidents and incidents, we noted that there Closing issues and to work with the applicants to is no consistent nomenclature of citing ac- It is clear that FBW systems are becoming ensure satisfactory resolution of potential cidents and incidents. Accidents are vari- increasingly complicated. These systems design safety issues and to verify compli- ously cited by airline and flight number, are difficult to design and test. The fed- ance. A special FBW incident and accident by aircraft registration, or by the city in eral airworthiness requirements must be investigation board could be helpful in which they occur. In the U.S., generally, we updated to include FBW system require- establishing future certification require- use airline and flight number or the city. ments. The current special conditions ments and best design practices. Even use of the city is clouded by using a used for FBW system certification are In spite of today’s summary of FBW inci- suburb (such as Roselawn or Aliquippa) incomplete. The flight crews have difficulty dents, we must not forget that overall FBW in place of the airport involved. Most coping with a sudden change in the control and envelope protection have prevented foreign agencies use aircraft registration, system behavior due to unexplained/unan- accidents and saved lives. In the past 15 although some hide the registration or air- nounced mode changes: “What’s it doing years, there have been 27 stall accidents in line. Manufacturers use the serial number, now?” Training may need to be improved commercial transport operations with 848 which can make tracing the incident dif- for situations in which immediate pilot fatalities—not one was a FBW airplane. ◆

22 • ISASI Forum April–June 2010 Using ADS-B for Accident Investigation And Prevention The author examines Auto- surveillance services, much like radar. matic Dependent Surveillance Broadcast—It continu- Broadcast (ADS-B) workings ously broadcasts aircraft and use at ERAU to show how position and other data its versatility of use can help to any aircraft or ground station equipped to receive bring a new level of safety in ADS-B. the air and on the ground. Another important fea- By David Zwegers, Director ture of ADS-B is that it pro- of Aviation Safety, Embry-Riddle vides crews with terrain and Aeronautical University, graphical and text weather Daytona Beach, Fla., USA information (FIS-B). ADS-B-equipped aircraft (This article is adapted with permission Figure A broadcast their precise po- from the author’s paper entitled Using ADS- sition in space via a digital B for Accident Investigation and Prevention, datalink along with other data, an Embry-Riddle Aeronautical University including airspeed, altitude, and Perspective presented at the ISASI 2009 whether the aircraft is turning, seminar held in Orlando, Fla., Sept. 14–18, climbing, or descending. 2009, which carried the theme “Accident Unlike conventional radar, ADS- Prevention Beyond Investigation.” The full B works at low altitudes and on the presentation, including cited references to ground so that it can also be used support the points made, can be found on the to monitor traffic on the taxiways ISASI website at www.isasi.org.—Editor) and runways of an airport. It’s also effective in remote areas or in ccident investigation and preven- mountainous terrain in which there tion go hand in hand. Current is no radar coverage or where ra- Atechnologies allow investigators an Figure B dar coverage is limited. unprecedented view and understanding of events leading to an accident. Automatic How does it work? David Zwegers is the di- Dependent Surveillance Broadcast (ADS- ADS-B relies on the satellite-based global rector of aviation safety B) uses conventional global navigation positioning system to determine an air- at ERAU Daytona Beach satellite system (GNSS) technology and craft’s precise location in space (see Figure campus. He` has more a relatively simple broadcast communica- A). The system then converts the position than 3,500 accident-free tions link as its fundamental components. into a digital code, which is combined hours of flight time with It is a very cost-effective method to pro- with other information such as the type of almost 3,000 hours of vide traffic and weather information in aircraft, its speed, its flight number, and flight instructor time. He holds a BS in remote areas of the world. whether it’s turning, climbing, or descend- aeronautical science from ERAU and ADS-B is a new technology that allows ing. The digital code containing all of this is completing his MS in aeronautics. pilots in the cockpit and air traffic control- information is updated several times a He graduated from the NTSB Train- lers on the ground to “see” aircraft traffic second and broadcast from the aircraft ing Center, is a NAFI master CFI, and (TIS-B) with much more precision than on a discrete frequency called a datalink. holds a commercial pilot certificate with has been possible before. This information is then displayed in the SEL, MEL, instrument airplane, and Automatic—It’s always ON and requires cockpit on a multifunction display (MFD) CFI, CFII, and MEI. In October 2008, no operator intervention. (see Figures B and C). It is more accurate he was awarded the John K. Lauber Dependent—It depends on an accurate and precise than traditional radar. Safety Award by the University Avia- GNSS signal for position data. Other aircraft and ground stations tion Association. Surveillance—It provides “radar-like” within about 150 miles receive the datalink

April–June 2010 ISASI Forum • 23 Figure 1

Figure C (above) ing closed pattern operations at KDAB, Figure D (upper right) using Runway 7R. At approximately 2137 Figure 1 (right) EDT, while the pilot was attempting her first landing out of a scheduled 10, the broadcasts and display the information aircraft bounced multiple times and the in a user-friendly format on a computer propeller struck the runway. The aircraft screen. ERAU uses software developed by came to rest at the northeast corner of the Johns Hopkins University called CRABS intersection of Runway 16/34 and 7R. (Comprehensive Real-time Analysis of Visual meteorological conditions pre- Broadcasting Systems) (see Figure D). vailed at the time and no flight plan was ERAU is currently working on developing filed for the 14 CFR Part 91 instructional its own customized and enhanced version flights. There were no injuries reported to called SOFIA (Surveillance and Operations radar coverage (low altitudes and ground the private-rated pilot, but N462ER was of Flight and Interactive Analysis), which operations) avoiding mid-air collisions and substantially damaged. will also provide live ATC audio and links to runway incursions. The NTSB probable cause: Pilot’s im- operations software (maintenance, schedul- • providing pilots graphical and textual proper flare at night. Contributing factor ing, etc.) among other features. weather information. was a lack of recent night experience. • providing operators real-time informa- CRABS data were extensively used Why ERAU? tion of aircraft location for planning pur- during the investigation and a key factor During the past 20 years, the threat of a poses (spreading out aircraft to minimize in determining errors at the organiza- mid-air collision occurring on a commercial congestion), and flight following (tracking) tional and supervisory levels. Several flight has been virtually non-existent, pri- (see Figure 2). changes were implemented to eliminate marily due to the implementation of TCAS. • recording all data that can be used future reoccurrence, like improved com- General aviation accounts for almost all by the operator to increase safety and munications among instructors and staff, mid-air collisions, and many of them hap- efficiency practices (accident/incident changes to training syllabi with emphasis pen with student pilots on board. TCAS sys- investigation, study pattern flows in/out on transition courses and visual illusions tems are impractical for small GA aircraft of airspace, address noise complaints, and airport/runway familiarity, changes due to their size and prohibitive cost. etc). It has taken the guesswork out of the to standard operating procedures with At a cost of about $20,000 per aircraft preexisting conditions. emphasis on stabilized approaches, etc. installed, ERAU has ADS-B on its entire ADS-B software also serves as a variant All 13 recommendations implemented by fleet of 100 training aircraft at both the of a flight data recorder, without the need of Flight Evaluation Board were adopted by Daytona Beach, Fla., and Prescott, Ariz., any additional equipment installation. Addi- the Flight Department. campuses since 2003. tionally, the data are safely collected on the ADS-B has dramatically decreased ground and always accessible, regardless of Case #2. 712ER and 496ER August the risk of mid-air collisions for ERAU in the location of the aircraft wreckage. 2008. High wing vs. low wing. very congested airspace and has, without During busy closed traffic operations in a doubt, saved lives by Examples of practical applications daylight VFR, a Cessna 172 is climbing on • providing pilots real-time traffic in- Case #1. N462ER May 2007. Hard upwind and a Piper PA28-R is at pattern formation and a much greater margin in landing. altitude turning downwind when a blocked which to implement conflict detection and On the night of May 4, 2007, at approxi- transmission from ATC causes confusion resolution, especially important below mately 2100 EDT, a student was conduct- and separation is compromised. ADS-B

24 • ISASI Forum April–June 2010 Figure 2 (above) in aviation for decades to come. Figure 3 (right) Software and hardware engi- Figure 4 (upper right) neering will advance rapidly, making this system even more alerted the pilots on both aircraft of the con- accessible and its use more flict. This increased situational awareness common worldwide, signaling was used for the initial avoidance maneuver the end of radar. Embry-Riddle as both aircraft did not have visual contact is actively participating with due the inherent restrictions in their design. the FAA and ITT in the imple- CRABS data contributed to implementa- mentation of ADS-B service tion of procedures at KDAB to reduce the volumes nationwide. The avia- risks of traffic pattern saturation. Specific tion industry will soon benefit transponder codes for non-ADS-B-equipped from a technology that allows aircraft will allow transponders to remain in safer and more efficient and re- ALT mode, therefore making them “visible” liable air traffic management on to ADS-B. fication or unjust noise complaints (see the ground and in the air. Pilots will have Figure 3). a level of situational awareness at their Case #3. Recreation of flight path fingertips that is affordable and compre- leading to fatal GA accidents. Case #5. Flight following and hensive, especially in general aviation. Twin Commander May 2009. A Twin overdue aircraft response. commander departs KDAB on VFR con- The value of flight training is enhanced by Conclusion ditions and declares emergency shortly the ability to debrief the conduct of a flight ADS-B gives pilots, controllers, and opera- after takeoff. Aircraft crashes minutes more accurately. Dual and solo flights can tors a new level of situational awareness. later just short of the runway with one be monitored by fight operations for ad- Since its inception, it has given crews vital fatality and one injury. CRABS assisted ditional safety and improved communica- traffic and weather information previously investigators in determining probable tions (see Figure 4). unavailable even in the most remote areas. cause (see Figure 1). This level of situational awareness ADS-B hardware and software are evolv- SR-20 February 2009. During a training on the ground allows flight operators to ing rapidly and becoming more available flight that originated in KSFB, a Cirrus prevent or reduce airport surface and and viable for general aviation. ADS-B SR-20 impacts the ground fatally injuring airspace saturation, adapt dispatching is accurate, reliable, comprehensive, and both occupants. The aircraft is located limitations to current conditions, and interactive. In combination with ATC the next day in a wooded area with the many more efficiency measures. audio recording, recording of ADS-B data parachute deployed. CRABS aided inves- Overdue aircraft response is mostly lim- can be a valuable investigative tool and tigators in reconstructing the profile of the ited to positively identifying overdue aircraft give a much better picture of the events flight (see Figure 2). on the computer followed by establishing leading to an accident, taking much of the communications with the crew. Many cases guesswork out and reducing hindsight Case #4. Noise complaints and are just due to ATC delay vectors. bias. You now have an unprecedented look airspace violations. into the history of a flight to better help ADS-B assists ERAU in enforcing noise Future of ADS-B you understand the steps that lead to an abatement agreements and also protects With the advent of NexGen and other tech- event, not limited to large aircraft and pilots and operators against false identi- nologies, ADS-B will be an essential tool operators anymore. ◆

April–June 2010 ISASI Forum • 25 ISASI ROUNDUP

ISASI 2010 Registration Opens

ISASI 2010, the Society’s 41st annual charge, and 5% tax. The Royton’s fee is ber: $395, after April 1 $445. Methods international seminar on air accident 11.500 yen (single person in a twin-bed of payment are explained on ASASI’s investigation, is now open for registra- room) and 16.000 yen (two persons in a website. Hotel registration is open. tion according to Mamoru Sugimura, twin-bed room). ANA’s fee is 10,500 yen For more information contact Paul chairperson of Japan Local Seminar (single person in a twin-bed room) and Mayes at e-mail [email protected] Committee (JLSC), which is hosting 16.800 yen (two persons in a twin-bed or Lindsay Naylor at e-mail lnaylor@ the event to be held in Sapporo, Japan, room). Prince’s fee is 13.500 yen (single spitfire.com.au.◆ September 6-9. He welcomes delegates person in a twin-bed room) and 18.900 to the city of Sapporo saying that they yen (two persons in a twin-bed room). At Etihad Airways Hosts will not only have a learning experience press time, the exchange rate was US$1 at the seminar, but also enjoy pleasant to the Japanese yen 93.588. Reachout No. 35 weather, delicious food, and Japanese Social aspects of the conference Etihad Airways hosted the 35th culture during their stay. will see the companion program doing ISASI Reachout workshop on incident The conference theme, “Investigat- sightseeing near Sapporo, making a visit investigation and human factors in Abu ing ASIA in Mind—Accurate, Speedy, to the Central Wholesale Market, and Dhabi, United Arab Emirates (UAE), in Independent, and Authentic,” will be attending a cultural program including November 2009. Capts. Paolo La Cava, reflected in the 25 to 30 technical papers Kimono dressing, a tea ceremony, and a manager of flight safety, and Adrian to be presented. The day-long tutorial flower arrangement. The Tuesday even- Aliyuddin, manager of safety assurance, program will feature “Investigat- ing dinner will involve a delicious dinner opened the workshop. ing Human Factors, Human/Machine at Sapporo Bier Garten with fresh beer Approximately 20 participants from Interface,” and “Aircraft Numbers Are brewed by Sapporo Beer Company, Etihad Airways covered all operational Increasing Worldwide—How Do We one of Japan’s leading beer companies. areas, including pilots (involved in com- Prevent Accidents?” And the Friday optional tour will take pany safety management), maintenance The seminar program registration fee attendees to Noboribetsu hot spring, and quality engineers, aviation security (in U.S. dollars) by August 20 is member, which offers a relaxing change of pace personnel, and cabin crew. An invitation $595; non-member, $645; student mem- and provides a refreshed feeling in both to the workshop had also been extended ber, $200. If registration is made after mind and body. ◆ to other operators in Abu Dhabi; there August 20, the fees are $620, $670, and were two participants from Abu Dhabi $225, respectively. Day pass fee for any ANZSASI 2009 Opens June Aviation. ISASI certificates were pre- of the 3 days is $200. The companion fee sented to all the participants. is $350 by August 20 and $375 there- 4 at Canberra, Australia Caj Frostell, ISASI international after. The member fee for the one-day The Australian and New Zealand Societ- councillor, and Mike Doiron served as tutorial is $165; student member, $100. ies of Air Safety Investigators joint 2010 the ISASI instructors. Presentations Fee for a single event: welcome recep- regional air safety seminar opens June were provided on tion $50, Tuesday night dinner $100, and 4 at the Rydges Lakeside Hotel, Can- • international requirements for SMS awards banquet $100. berra, Australia. The regional air safety and airline safety programs, The seminar’s website, through seminar is hosted alternately by the two which conference and hotel registration societies. will be made, is accessible through the The seminar will include reports on ISASI website, www.isasi.org. All areas contemporary transport safety including of delegate interest are easily identi- recent investigations (road, rail, marine, fied and accessed on the site. The hotel aviation) and on the issues facing safety reservation page is being maintained investigators in the future. by the Japan Travel Bureau (JTB), one Registration instructions for both the of the leading travel agencies in Japan. seminar and hotel accommodations are The reservation page lists three hotels: available at the Australian SASI web- Royton Sapporo, Sapporo ANA Hotel, site, www.asasi.org. Seminar registration Participants at the 35th ISASI Reachout and Prince Hotel. Fees (payable in costs are (in Australian dollars): mem- workshop in Abu Dhabi, United Arab Japanese yen) include breakfast, service ber: $345, after April 1, $395; non-mem- Emirates.

26 • ISASI Forum April–June 2010 2009 Annual Seminar Proceedings Now Available

Active members in good standing and ISASI web page at http://www.isasi.org. ROM for US$75. A limited number of corporate members may acquire, on a The seminar papers can be found in the paper copies of Proceedings 2009 are no-fee basis, a copy of the Proceedings “Members” section. Alternatively, active available at a cost of US$150. Checks of the 40th International Seminar, held members may purchase the Proceedings should accompany the request and be in Orlando, Fla., USA, Sept. 14–18, on a CD-ROM for the nominal fee of $15, made payable to ISASI. Mail to ISASI, 2009, by downloading the information which covers postage and handling. Non- 107 E. Holly Ave., Suite 11, Sterling, VA from the appropriate section of the ISASI members may acquire the CD- USA 20164-5405. ◆

Preface: Accident Prevention of Psychology, National Defense University, Thursday, September 17 Beyond Investigation Taiwan; Don Harris, Director of Flight Deck A Review of Fly-by-Wire Accidents By Frank Del Gandio, President, ISASI Design and Aviation Safety Group in Human By Dr. R.L. (Dick) Newman, Seattle, Wash., Keynote Address: What Is Next? Factors Department, Cranfield University, and A.A. (Tony) Lambregts, Chief Scientist- By Deborah Hersman, Chairman, U.S. United Kingdom; Neville A. Stanton, Chair Advanced Controls, FAA, Renton, Wash., USA National Transportation Board, in the Human Factors of Transport, School Simulation of Emergency Evacuation Washington, D.C., USA of Civil Engineering and the Environment, Factors in Transport-Category Aircraft Lederer Award: Two Receive 2009 Jerome University of Southampton, United Kingdom; By Dr. Eric Robert Savage, Assistant Pro- F. Lederer Award Yueh-Ling Hsu, Professor in the Department fessor, ERAU, Prescott, Ariz., and By Esperison Martinez, Editor, ISASI Forum of Air Transportation, Kainan University, Erich Skoor, Graduate Student, ERAU, Taiwan; Danny Chang, Head of Training Prescott, Ariz., USA Tuesday, September 15 Division, China Airlines, Taiwan; Thomas The Accident “CAUSE” Statement— Closing the Gap Between Accident Wang, Director of Flight Safety Division, Is It Beyond Its Time? Investigation and Training Aviation Safety Council, Taiwan; Hong-Tsu By Robert MacIntosh (MO0996), Chief By Michael Poole, Executive Director and Young, Managing Director of the Executive Advisor, International Safety Affairs, U.S. Chief Investigator, and Lou Németh, Chief Yuan, Aviation Safety Council, Taiwan National Transportation Safety Board, Safety Officer, CAE Flightscape An Analysis of Human Factor Aspects in Washington, D.C., USA How Significant Is the Inflight Loss of Post-Maintenance Flight Test Accident Prevention: Pushing the Limits Control Threat? By Capt. Claudio Daniel Caceres, Senior Safety By Bernard Bourdon, Accident By Capt. John M. Cox, FRAeS, and Capt. Advisor, Continuous Safety®, Switzerland Investigation Manager, European Aviation Jack H. Casey, FRAeS, Safety Operating Findings of Using Human Factors Analysis Safety Agency, EU Systems, L.L.C., Washington, D.C. and Classification System (HFACS) as a Tool Seminar Summary of ISASI 2009: Reducing the Risk of Runway Excursions for Human Factors Investigation Accident Prevention Beyond Investigation By Jim Burin, Director of Technical By Yung-An Cheng, Engineer Flight Safety By John Guselli, JCG Aviation Services and Programs, Flight Safety Foundation Division, Aviation Safety Council (ASC), Chairman of ISASI’s Reachout Committee Developing Investigations to Enhance Taiwan; Thomas Wang, Director of Flight Safety Worldwide Safety Division, ASC, Taiwan; Jenn-Yuan Liu, Guest Speakers By Marcus Costa, Chief, Accident Investiga- Engineer Flight Safety Division, ASC, Taiwan; Communication Challenges After the tion and Prevention Section, ICAO Chi-Liang Yang, Associate Engineer, Flight Air France Flight 447 Accident A Comparison Study of GPS Data Safety Division, ASC, Taiwan; Dr. Wen-Chin By Marine Del Bono, Head of Public Affairs and CDR Radar Data Using a Fully Li, Head of Graduate School of Psychology, Division, Bureau d’Enquêtes et d’Analyses Instrumented Flight Test National Defense University, Republic of China (BEA), France By Ryan M. Graue, Aeronautical Engineer, Closing the Loop on the System Safety The United Kingdom Experience AvSafe, LLC; Jean H. Slane, Senior Consul- Process: The Human Factors Intervention By David Miller, UK Deputy Chief Inspector of tant, Engineering Systems Inc.; Dr. Robert Matrix (HFIX) Air Accidents, Air Accidents Division Branch C. Winn, Principal Engineer, Engineering By Dr. Scott Shappell, Professor, Clemson Initial Investigation of Serous Accidents: Systems Inc.; W. Jeffrey Edwards, Presi- University, Clemson, S.C., and Dr. Douglas The JTSB’s Experience dent, AvSafe, LLC; and Krista B. Kumley, Wiegmann, Associate Professor, University of Ikuo Takagi, Investigator General for Consultant, Engineering Systems Inc. Wisconsin, Madison, Wisc. Aircraft Accident, the Japan Transporta- Safety Strides Foreseen with Lightweight At What Cost? A Comprehensive and Statis-­ tion Safety Board Flight Recorders for GA tical Analysis of EMS Helicopter Accidents The Continuous Challenge for U.S. By Philippe Plantin de Hugues, Ph D., in the United States from 1985 to 2007 Air Safety Investigators Assisting in Bureau d’Enquêtes and d’Analyses pour the By Christine Negroni (FO5208) and International Investigations sécurité of l’aviation civile, Head of Flight Dr. Patrick Veillette By Dujuan B. Sevillian, 2009 Rudolf Recorders and Avionic Systems Division Sifting Lessons from the Ashes: Avoiding Kapustin Memorial Scholarship Winner Using ADS-B for Accident Investigation Lost Learning Opportunities Caring for the Mental Health of and Prevention, an Embry-Riddle By Ludwig Benner, Jr., Principal, Starline Air Safety Investigators Aeronautical University Perspective Software Ltd., Oakton, Va., USA, and Ira J. By Brian Dyer, 2009 Rudolf Kapustin By David Zwegers, Director of Aviation Rimson, Forensic Engineer, Albuquerque, Memorial Scholarship Winner Safety, Embry-Riddle Aeronautical N.M., USA Challenges to ASI Investigations University, Daytona Beach, Fla., USA Using the Best Cost Analysis for Effective By Murtaza Teyla, 2009 Rudolf Kapustin Safety Recommendations Memorial Scholarship Winner Wednesday, September 16 By Dr. Simon Mitchell, Aviation Director, RTI Human Error Prevention: Using the Ltd, London, UK, and Visiting Fellow, Cranfield (Editor’s note: Text unavailable for Human Error Template to Analyze Errors University, UK, and Professor Graham presentations by Paul Arsianian, Robert in a Large Transport Aircraft for Human Braithwaite, Director, Cranfield University Sumwalt, and Mark Clitsome.) Factors Considerations Safety and Accidents Investigation Centre, UK By Wen-Chin Li, Head of Graduate School Safety: A Function of Leadership By Gary D. Braman, System Safety Engineer; Sikorsky Aircraft Corporation, Huntsville, Ala., USA

April–June 2010 ISASI Forum • 27 ISASI ROUNDUP Continued . . .

• introduction to SMS and lessons navigation service providers focused learned, In Memoriam on environmental stewardship in the • developing the right safety culture, region. The ASPIRE partnership is a • human performance, Roscoe M. Holderman (LM2479), Lillian, comprehensive approach to environ- Ala., USA, May 29, 2009 • stress and fatigue, Felix H. Medak (LM0628), North Holly- mental stewardship in a region in which • SHELL model, wood, Calif., USA, July 15, 2009 significant disparities exist in the level • non-punitive safety programs, Edwin L. Shaw (LM2801), Ventura, Calif., of available service provision. Under USA, unknown month, 2008 ◆ • incident reporting within an airline, ASPIRE, current and future partners • in-house incident investigations, pledge to adopt and promote best practi- • SMS hazard identification and risk • human factors analysis classification ces that have demonstrated and proven management, system, successful in reducing greenhouse • safety analysis, • weather-related risks, and gases and developing work programs to • automation: friend or foe, • SMS action plan. promote future gains with respect to the • threat and error management, The ISASI instructors prepared their environment. • naturalistic decision-making (accident training material comprising paper Other signatories of the ASPIRE prevention), handouts and a CD with published joint agreement are the U.S. Federal • incident investigation case studies, manuals and booklets. Each participant Aviation Administration (February received copies of the documents and 2008), Airways New Zealand (February a CD with considerable background 2008), Airservices Australia (Febru- materials for future reference. ISASI ary 2008), and the Japan Civil Aviation membership forms and corporate mem- Bureau (October 2009). ◆ Moving? bership forms were made available to Please Let Us Know the participants. President Nominates Member Number______The arrangements at Etihad Airways and in Abu Dhabi were accomplished by Weener for NTSB Fax this form to 1-703-430-4970 or mail to Capt. Aliyuddin. The outstanding assist- President ISASI, Park Center 107 E. Holly Avenue, Suite 11 ance rendered to the instructors was in- Obama has Sterling, VA USA 20164-5405 valuable in all aspects. Instructor travel nominated and accommodations, in Abu Dhabi was Earl F. Weener Old Address (or attach label) provided by Etihad Airways. Etihad for a seat on Name______Airways management and the partici- the National Address______pants expressed high appreciation to Transportation City______ISASI for again bringing the Reachout Safety Board. workshop program to Abu Dhabi. ◆ Weener is a State/Prov.______fellow at the Zip______Flight Safety Country______CAAS joins ASPIRE Foundation New Address* The Civil Aviation Authority of Singa- in Alexandria, Va. While a member of pore (CAAS) has joined the Asia and the Foundation, he worked on runway Name______Pacific Initiative to Reduce Emissions safety, ground accident prevention, and Address______(ASPIRE) partnership by signing the approach and landing accident reduc- City______joint agreement on February 1. AS- tion. Before his retirement from Boeing State/Prov.______PIRE was initiated by the U.S. Federal in 1999, Weener’s positions included Aviation Administration (FAA), Airways chief engineer for airworthiness, reli- Zip______New Zealand, and Airservices Australia. ability, maintainability and safety; chief Country______The Japan Civil Aviation Bureau joined engineer of systems engineering; and E-mail______ASPIRE when it signed the joint agree- chief engineer for safety technology *Do not forget to change employment and ment in October 2009 in Osaka, Japan. development. e-mail address. ASPIRE is a partnership of air Weener is also a licensed commercial

28 • ISASI Forum April–June 2010

NEW MEMBERS Corporate Hetherington, Kathryn, J., Edina, USA, MN Nova Aerospace, Australia Huddle, Jr., David, W., Melbourne, USA, FL Brett Martin, Systems Engineer Khoo, Steven, Singapore, Singapore Seamus Miller, Systems Engineer King, Robert, D., Daytona Beach, USA, FL Flight Data Services Ltd., United Kingdom Lopes, Nicolas, Covina, USA, CA a barrage of data. The agreement also Capt. Simon Searle, Safety Projects Lozano, Juan, C., Madrid, Spain Manager Madden, Gregory, M., Chapman, Australia, ACT calls for follow-on efforts to resolve Dave Jesse, CEO Mascheroni, Roberto, Bensalem, USA, PA technical, legal, and confidentiality Matsch, Katherine, M., Lakewood, USA, WA issues, as well as to develop new ways Individual Miller, Andrew, B., Bieldside, United Kingdom Akhand, Imam, HMA, Whitby, Canada, ON Mohr, Brittany, D., Orange Park, USA, FL to disseminate lessons learned after Anthony, Kristine, E., Prescott, USA, AZ Musselman, Brian, T., North Beach, USA, MD analyzing the data. Balac-Moreira, Tiago, G.C., Singapore, Nail, Martyn, P., Palmerston North, Still, the latest development is widely Singapore New Zealand Barry, David, J., Walton on Thames, Surrey, Parker, Simon, M., Cable Beach, Australia, WA seen as an important building block to United Kingdom Patrick, Trudy, Port of Spain, Trinidad, Tobago reach the next phase of commercial avia- Bennett, Derrick, D., Wichita, USA, KS Pontes, Mauricio, F., Sao Paulo, Brazil, S.P. tion safety: identifying and eliminating Bevis, Philip, A., Basingstoke, Hampshire, Popek, Matthew, M., Savage, USA, MN United Kingdom Ruiz Zaera, Isabel, Prescott, USA, AZ incipient hazards before they can cause Blacklock, Thomas, L., Crossfield, Canada, Shade, Tomas, Melbourne, USA, FL dangerous incidents or crashes. Sifting AB Stas, Olivia, Anchorage, USA, AK through global data, for example, could Blankenstein, Eric, Brisbane, Australia, Sunny, De Paul, Daytona Beach, FL QLD Svavarsson, Jon, Kopovog, Iceland provide early warnings about a pattern Brown, David, H., Cook, Australia, ACT Taufa, Samiu, Port Moresby, Papua New Guinea, of dangerously fast or steep approaches Cant, Andrew, Auckland, New Zealand N.C.D. to certain airports. It also might help Carty, Belinda, R., Emerald, Australia, QLD Tocwish, Timothy, C., Joliet, USA, IL Chen, Kuan-Yu (Kevin), Port Orange, Turyamubona, Ronald, Entebbe, Uganda regulators better understand the causes USA, FL Voss, David, J., Brisbane, Australia, QLD of some engine or flight computer mal- Chiu, Kevin, I, Taipei, Taiwan Ward, Kevin, Waitakere, Auckland, functions before the problems become Demko, Jill, M., Seymour, USA, CT New Zealand Dimoutsikos, Evan, D., Chicago, USA, IL Westgate, Benjamin, A., Forestdale, USA, MA more frequent and pose a greater haz- Duprie, Terry, L., Lake Charles, USA, LA Whiteis, Barnabas, G., DPO, USA, AA ard to passengers. Eiser, Abraham, D., Marietta, USA, GA Wicksteed, Jason, Cairns, Australia, QLD Each of the participating organiza- Findlay, Leanne, K., Richmond, Australia, Wong, Wai-Yee (Maggie), Daytona Beach, VIC USA, FL tion already has its own information- Gannot, Yair, H., Alfei Menashe, Israel Yellman, Ted, W., Bellevue, USA, WA gathering and analysis system, but the Garstang, John, H., Ladysmith, Canada, BC York, John, P., Tyndall AFB, USA, FL databases aren’t complementary and Greenwood, Robert, E., Calgary, Canada, AB Yurdakul, Hakan, Antalya, Turkey, Harvey, Beverley, Ottawa, Canada, ON Zabawa, Douglas, J., Bristol, USA, CT ◆ detailed results often aren’t shared across continents. Initially, the focus will be on sharing pilot and flight and ground instructor. and the United Nations International audits of airlines and the effectiveness He received a doctorate in aerospace Civil Aviation Organization will link up of oversight by air safety regulators in engineering from the University of with the airline industry’s International individual countries. The FAA and the Michigan. ◆ Air Transport Association to establish a European Commission, for instance, common information-sharing network. conduct separate assessments of foreign Global Aviation Regulators One aim of the agreement is to help carrier safety, but now there is no regulators and carriers in developed formal way to compare data. Similarly, Agree to Share Safety Data countries confront subtle hazards that the FAA has faced obstacles recruiting A broad alliance of aviation regulators otherwise might go undetected. Another European and other foreign carriers to and industry groups recently signed an benefit is expected to be enhanced safety contribute their closely guarded data to agreement to collect and jointly analyze programs in parts of Africa, Latin Amer- the agency’s most comprehensive safety airline safety data from around the ica, and other regions in which cutting- analysis project. world, a move that has the potential to edge data analysis often isn’t available If the initiative succeeds, proponents produce major advances in responding and accident rates historically have been ultimately see broader applications. to safety threats, reported Flight Safety much higher than in North America or They envision a worldwide repository of Information, an online aviation report- Europe. voluntary reports of pilot mistakes, oth- ing site. Proponents agree that many difficult er operational problems, maintenance Under the “declaration of intent” hurdles remain and that a full-scale slip ups and lapses by air traffic control- signed at an aviation conference in implementation is likely years away. lers. Better data sharing could also help Montreal, the Federal Aviation Admin- One challenge is creating sophisticated airlines avoid issues such as collisions on istration, the European Commission, new computer tools able to sort through the tarmac between planes and airport

April–June 2010 ISASI Forum • 29 ISASI ROUNDUP ISASI Information Continued . . .

service vehicles, a problem that costs category aircraft and for smaller aircraft airlines about $4 billion annually. ◆ that do not otherwise have recording OFFICERS devices. This issue was designated red. President, Frank Del Gandio ([email protected]) NTSB Releases Federal “Improve the Safety of Emergency Executive Advisor, Richard Stone Medical Services Flights”—The Board ([email protected]) Vice-President, Ron Schleede ‘Most Wanted List’ has issued a series of recommendations ([email protected]) The U.S. National Transportation Safety aimed at improving the safety of this Secretary, Chris Baum ([email protected]) Board (NTSB) recently issued its 2010 vital service to the public. The FAA has Treasurer, Tom McCarthy Most Wanted List of Transportation announced it will issue a proposed rule ([email protected]) Safety Improvements, adding rail, avia- that will address some of these concerns, tion, and marine issues and updating the and the Board has upgraded the desig- COUNCILLORS Australian, Lindsay Naylor status of other issues on the list. nation for this issue from red to yellow. ([email protected]) “Every one of the hundreds of cur- “Improve Runway Safety”—The Canadian, Barbara Dunn ([email protected]) rently open safety recommendations deadliest accident in aviation history European, Anne Evans address concerns that the Safety Board was a runway collision in 1977. Run- ([email protected]) International, Caj Frostell has uncovered in its accident investiga- way accidents and incidents continue ([email protected]) tions,” NTSB Chairman Deborah A.P. to occur, including a fatal regional jet New Zealand, Peter Williams ([email protected]) Hersman said. “But the recommenda- accident in Kentucky in 2006 and an United States, Toby Carroll tions on the Most Wanted List represent incident last year in which an airliner ([email protected]) those improvements that can have the landed on a taxiway in Atlanta. The widest benefit.” NTSB has a series of recommenda- NATIONAL AND REGIONAL Besides removing two issue areas tions aimed at preventing such occur- SOCIETY PRESIDENTS Australian, Lindsay Naylor on the list, the Board reviewed the rences, including requiring moving map ([email protected]) remaining 13 issue areas on the list and displays in the cockpit, giving immedi- Canadian, Barbara M. Dunn ([email protected]) added two new ones. Each issue area is ate warnings to the cockpit of impend- European, David King color coded by the NTSB to designate ing incursions, and requiring landing ([email protected]) Latin American, Guillermo J. Palacia its action/timeliness: red for unaccept- distance assessments with an adequate (Mexico) able response; yellow for acceptable safety margin for every landing. The New Zealand, Peter Williams ([email protected]) response, progressing slowly; and green designation remains red. Russian, Vsvolod E. Overharov for acceptable response, progressing in a “Reduce Dangers to Aircraft Flying in ([email protected]) SESA-France Chapter,Vincent Fave timely manner. Icing Conditions”—An airliner crash ([email protected]) The 2010 Most Wanted List as it per- in 1994 prompted the NTSB to examine United States, Toby Carroll ([email protected]) tains to aviation follows: the issue of airframe structural icing “Improve Oversight of Pilot and conclude that certification standards UNITED STATES REGIONAL Proficiency”—This new issue area have been inadequate. The NTSB con- CHAPTER PRESIDENTS added by the Board contains two 2005 tinues to believe that the FAA has failed Alaska, Craig Bledsoe recommendations calling on the FAA to make adequate progress in this area ([email protected]) Arizona, Bill Waldock to require airlines to obtain histories of and has kept the designation at red. ([email protected]) flight check failures by pilot applicants “Crew Resource Management for Dallas-Ft. Worth, Tim Logan ([email protected]) and to require special training programs Part 135 Carriers”—Federal regula- Great Lakes, Matthew Kenner for pilots who have demonstrated per- tions require Part 121 and Scheduled ([email protected]) Los Angeles, Inactive formance deficiencies. The designation Part 135 operators to provide pilots with Mid-Atlantic, Ron Schleede is red. crew resource management training. ([email protected]) Northeast, David W. Graham “Require Image Recorders”—Although The NTSB has investigated a number ([email protected]) cockpit voice recorders and flight data of Part 135 on-demand operations in Pacific Northwest, Kevin Darcy ([email protected]) recorders record sounds and relatively which such training was not provided Rocky Mountain, David Harper comprehensive airplane data during an and errors by the crew led to accidents. ([email protected]) San Francisco, Peter Axelrod emergency, they do not show the critical The FAA has proposed to require a form ([email protected]) cockpit environment leading up to the of CRM training for these carriers, and Southeastern, Robert Rendzio emergency. The Board has requested the Board has upgraded the designation ([email protected]) image recorders for large transport- from red to yellow. ◆

30 • ISASI Forum April–June 2010 Allied Pilots Association Hong Kong Civil Aviation Department COMMITTEE CHAIRMEN IFALPA Audit, Dr. Michael K. Hynes American Eagle Airlines ([email protected]) American Underwater Search & Survey, Ltd. Independent Pilots Association Award, Gale E. Braden ([email protected]) AmSafe Aviation Int’l Assoc. of Mach. & Aerospace Workers Ballot Certification, Tom McCarthy Aramco Associated Company Interstate Aviation Committee ([email protected]) ASPA de Mexico Irish Air Corps Board of Fellows, Ludi Benner ([email protected]) Association of Professional Flight Attendants Irish Aviation Authority Bylaws, Darren T. Gaines ([email protected]) Atlantic Southeast Airlines—Delta Connection Japan Airlines Domestic Co., LTD Code of Ethics, Jeff Edwards Australian and International Pilots Association (AIPA), Japanese Aviation Insurance Pool ([email protected]) Australia Australian Transport Safety Bureau Jeppesen Membership, Tom McCarthy Aviation Safety Council JetBlue Airways ([email protected]) Aviation Safety Investigations, UK Jones Day Nominating, Tom McCarthy Avions de Transp ort Regional (ATR) KLM Royal Dutch Airlines ([email protected]) AVISURE, Australia Korea Air Force Safety Ctr. Reachout, John Guselli BEA-Bureau D’Enquetes et D’Analyses Korea Aviation & Railway Accident Investigation ([email protected]) Board Seminar, Barbara Dunn ([email protected]) Board of Accident Investigation—Sweden Boeing Commercial Airplanes Kreindler & Kreindler, LLP Bombardier Aerospace L-3 Communications Aviation Recorders WORKING GROUP CHAIRMEN Bundesstelle fur Flugunfalluntersuchung—BFU Learjet, Inc. Air Traffic Services, Scott Dunham (Chair) CAE-Flightscape, Inc. Lockheed Martin Corporation ([email protected]) Cathay Pacific Airways Limited Lufthansa German Airlines Ladislav Mika (Co-Chair) ([email protected]) Cavok Group, Inc. MyTravel Airways Cabin Safety, Joann E. Matley ([email protected]) Centurion, Inc. National Aerospace Laboratory, NLR Corporate Affairs, Erin Carroll Charles Taylor Aviation, Singapore National Air Traffic Controllers Assn. ([email protected]) China Airlines National Business Aviation Association Flight Recorder, Michael R. Poole National Transportation Safety Board ([email protected]) Cirrus Design Civil Aviation Safety Authority Australia NAV Canada General Aviation, Randall S. Mainquist Nigerian Ministry of Aviation and Accident ([email protected]) Colegio De Pilotos Aviadores De Mexico, A.C. Government Air Safety, Willaim L. McNease Comair, Inc. Investigation Bureau ([email protected]) Continental Airlines Northwest Airlines Human Factors, Richard Stone Continental Express Nova Aerospace, Australia Parker Aerospace ([email protected]) COPAC/Colegio Oficial de Pilotos de la Aviacion Comercial Phoenix International, Inc. Investigators Training & Education, Cranfield Safety & Accident Investigation Centre Pratt & Whitney Graham R. Braithwaite Curt Lewis & Associates, LLC Qantas Airways Limited ([email protected]) DCI/Branch AIRCO Qatar Airways Unmanned Aerial Systems, Tom Farrier Defence Science and Technology Organization (DSTO) Qwila Air (Pty), Ltd. ([email protected]) Delta Air Lines, Inc. Raytheon Company Directorate of Aircraft Accident Investigations— Republic of Singapore Air Force Namibia Rolls-Royce, PLC CORPORATE MEMBERS Directorate of Flight Safety (Canadian Forces) Royal Netherlands Air Force Directorate of Flying Safety—ADF Royal New Zealand Air Force AAIU Ministry of Transport Bulgaria Dombroff Gilmore Jaques & French P.C. RTI Group, LLC Accident Investigation Board, Finland Dutch Airline Pilots Association Sandia National Laboratories Accident Investigation Board/Norway Dutch Transport Safety Board SAS Braathens Accident Investigation & Prevention Bureau EL AL Israel Airlines Saudi Arabian Airlines Administration des Enquêtes Techniques Embraer-Empresa Brasileira de Aeronautica S.A. SICOFAA/SPS (Luxembourg) Embry-Riddle Aeronautical University Sikorsky Aircraft Corporation Aeronautical & Maritime Research Laboratory Emirates Airline Skyservice Airlines, Ltd. AeroVeritas Aviation Safety Consulting, Ltd. Era Aviation, Inc. Singapore Airlines, Ltd. Aerovias De Mexico, S.A.De C.V. European Aviation Safety Agency SNECMA Moteurs Air Accident Investigation Bureau of Singapore EVA Airways Corporation South African Airways Air Accident Investigation Unit—Ireland Exponent, Inc. South African Civil Aviation Authority Air Accidents Investigation Branch—U.K. Federal Aviation Administration Southern California Safety Institute Air Astana (Kazakhstan) Finnair Oyj Southwest Airlines Company Air Canada Pilots Association Finnish Military Aviation Authority Southwest Airlines Pilots’ Association Air Line Pilots Association Flight Attendant Training Institute at Melville College Star Navigation Systems Group, Ltd. Air New Zealand, Ltd. Flight Data Services Ltd., United Kingdom State of Israel Airbus S.A.S. Flight Safety Foundation Transport Canada Airclaims Limited Flight Safety Foundation—Taiwan Transportation Safety Board of Canada Aircraft Accident Investigation Bureau—Switzerland Galaxy Scientific Corporation U.K. Civil Aviation Authority Aircraft Mechanics Fraternal Association General Aviation Manufacturers Association UND Aerospace Aircraft & Railway Accident Investigation Commission GE Transportation/Aircraft Engines University of NSW Aviation Airservices Australia Global Aerospace, Inc. University of Southern California AirTran Airways Gulf Flight Safety Committee, Azaiba, Oman Volvo Aero Corporation Airways New Zealand Hall & Associates, LLC WestJet ◆ Alaska Airlines Hellenic Air Accident Investigation Alitalia Airlines—Flight Safety Dept. & Aviation Safety Board Allianz Aviation Managers, LLC, USA Honeywell All Nippon Airways Company Limited Hong Kong Airline Pilots Association

April–June 2010 ISASI Forum • 31 Non-Profit ISASI Org. U.S. Postage 107 E. Holly Ave., Suite 11 PAID Sterling, VA 20164-5405 USA Permit #273 CHANGE SERVICE REQUESTED ANNAPOLIS, MD

WHO’S WHO Parker Aerospace

(Who’s Who is a brief profile prepared by forward from Lindbergh’s Atlantic flight sists of an air safety officer and a “go the represented ISASI corporate member to every manned lunar landing and on to team” consisting of design, reliability, organization to provide a more thorough today’s international space station mis- and aftermarket engineers knowledge- understanding of the organization’s role sions. During that time, it has contributed able in the design, manufacture, and use and functions.—Editor) to making flight and space travel more of all Parker product lines. All go-team reliable, faster, more secure, and above all members are trained and ready to assist arker Aerospace is an operating safer. In addition to flight surface controls, investigations of Parker Aerospace prod- segment of Parker Hannifin Corpor-­ Parker manufactures systems for hy- ucts both on site and during examinations Pation and designs, manufactures, draulic power, fuel supply and balancing, at Parker facilities. and services hydraulic, fuel, flight control, engine fuel combustion, cabin and cargo All Parker facilities have secured and pneumatic components and systems area surveillance, heating and cooling storage for components for testing and and related electronic controls for aero- examination, space and other high-technology markets. ensuring that Based in Irvine, Calif., Parker Aero- packages are space operates eight divisions consisting of received un- 23 facilities in the Americas, Europe, and opened and Asia. Divisions include aircraft wheel and that all com- brake in Avon, Ohio; electronic systems controls, and systems intended for safety ponents remain intact and unaltered for in Long Island, N.Y.; gas turbine fuel sys- such as fuel tank inerting. an examination. Parker Aerospace has tems in Mentor, Ohio; hydraulic systems in Several decades ago, Parker pioneered participated in accident and incident in- Kalamazoo, Mich.; stratoflex products in the use of fuel inerting on military aircraft vestigations, and information and lessons Ft. Worth, Tex.; and fluid systems, control by inserting inert gas in the ullage of a fuel learned in these investigations have been systems, and customer support operations tank to suppress combustion. Using this incorporated to improve the safety of in Irvine, Calif. knowledge and experience, Parker played component and system operation. Parker products are used on virtually a key role in applying this technology to ISASI membership has proven to every aircraft manufactured throughout commercial aircraft tanks and developing be very beneficial to Parker Aerospace the world today, including commercial the onboard inert gas generating systems for networking with industry peers and transports, military fixed-wing planes, (OBIGGS) to prevent disastrous ignition operators alike to learn best practices in regional and business aircraft, helicopters, of a fuel tank. occurrence investigation and the latest missiles, and unmanned aerial vehicles. An air safety department at Parker best practices of proactive safety man- Parker’s history in aerospace extends Aerospace was created in 2006 and con- agement. ◆

32 • ISASI Forum April–June 2010