AeroSafety WORLD SAVING LIVES, SAVING MONEY SAFETY ROI
MASTERING COMPLEXITY Keeping pace with automation UNHAPPY ENDING Overrun at Jackson Hole TRAINING FOR SURPRISES Lessons from Air France 447 RETURN TO SENDER Radar for weather awareness THE JOURNAL OF FLIGHT SAFETY FOUNDATION SEPTEMBER 2012
PRESIDENT’SMESSAGE THE FOURTH Estate was winding down from engagement in an- Another reason we engage with journalists other flurry of news media stories, and think- is to advance views that are critical to the crimi- ing that many of our members probably don’t nalization issue and data protection. We focused understand Flight Safety Foundation’s relation- world attention on those subjects following the Iship with reporters, or are not even aware of all Gol mid-air in Brazil, the Concorde trial and the the things we do with the media. 15-year Air Inter prosecution. We also have been One big reason the Foundation engages ag- very vocal about rulings in Italy that have directly gressively with the media is to give safety profes- interfered with accident investigations. sionals the room they need to do their jobs. Today, Finally, we often engage with the media be- there is no shortage of people who understand cause we need to help them get the story right, or safety, but these people endure a lot of interfer- correct it when it is wrong. Following the tragic ence from politicians, judges and policymakers. crash that killed high-ranking members of the Pol- When an aviation safety event finds its way into the ish government in 2010, we had endless conversa- public spotlight, these politicians are compelled to tions with the Russian and Polish media, helping respond. That means the Foundation has to reach them understand that this horrible tragedy was an out quickly to global media outlets to provide a ordinary CFIT, not a conspiracy. More recently, we balanced viewpoint. We put the situation into a had the unpleasant job of pointing out to the world reasonable context and may suggest reasonable that the Washington Post had gotten a story wrong. actions. If people insist on being unreasonable, They took an embarrassing ATC blunder on a clear we are in a position to clearly point that out. day at Washington Reagan National Airport and Last year, a controller in Washington fell turned it into a sensational tale of a near-death asleep on duty, which resulted in public outrage. experience that made headlines around the world. The immediate political reaction was to fire a lot The result of all this is that you will see Flight of people and put in place a bunch of draconian Safety Foundation experts quoted in publications all rules. We worked with dozens of media outlets to around the world. We use our position and reputa- explain why this wouldn’t be the best decision, as tion as an international, unbiased safety organization it wouldn’t solve the problem. Our effort helped to help reporters understand the latest safety news. moderate the situation. It made room for more It is a big job influencing the way aviation safety is reasonable solutions to be heard. covered in the world. We can’t engage on every issue, There was a similar political reaction this year but if we miss an important one, please let us know. following two fatal crashes in Nigeria. Nigeria has We are not doing this for fun. We are doing it for you. been moving in a very positive direction since the tragic years of 2005 and 2006. But when the recent accidents occurred, local media and politicians threatened to undo the hard-won reforms that had already been put in place. The Foundation worked behind the scenes to shape the global coverage William R. Voss and send a strong message encouraging Nigeria President and CEO to stay the course. Flight Safety Foundation
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 1 AeroSafetyWORLD
contentsSeptember 2012 Vol 7 Issue 8 features
16 CoverStory | Real Return on Investment
20 SafetyRegulation | BEA Training Recommendations
16 24 AvWeather | Ground Radar Dependence 24 30 FlightTraining | Simulating In-Flight Ice 34 CausalFactors | Analysis of a 757 Overrun
40 HumanFactors | Safety Culture ‘Pathogens’
43 FlightDeck | More Resilient Automation departments
1 President’sMessage | The Fourth Estate
5 EditorialPage | USA Sequestration and Safety
7 Executive’sMessage | IASS 2012 — Santiago
8 AirMail | Letters From Our Readers
9 SafetyCalendar | Industry Events 30 10 FoundationFocus | Non-Punitive Is Not Easy
2 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 40
34 43
AeroSafetyWORLD telephone: +1 703.739.6700
12 InBrief | Safety News William R. Voss, publisher, FSF president and CEO v[email protected] 49 DataLink | EASA Member States Frank Jackman, editor-in-chief, FSF director of publications 52 InfoScan | Weather in Context [email protected], ext. 116
Wayne Rosenkrans, senior editor 56 OnRecord | Air Data Spikes Trigger Upset [email protected], ext. 115
Linda Werfelman, senior editor 64 SmokeFireFumes | Selected U.S. Events [email protected], ext. 122 Rick Darby, associate editor [email protected], ext. 113
Jennifer Moore, art director [email protected]
Susan D. Reed, production specialist [email protected], ext. 123
About the Cover Ramp operations at Editorial Advisory Board Reagan National Airport (DCA) © 2011 Ulf E. Wallin David North, EAB chairman, consultant
William R. Voss, president and CEO Flight Safety Foundation
Frank Jackman, EAB executive secretary We Encourage Reprints (For permissions, go to
Share Your Knowledge Steven J. Brown, senior vice president–operations If you have an article proposal, manuscript or technical paper that you believe would make a useful contribution to the ongoing dialogue about aviation safety, we will be National Business Aviation Association glad to consider it. Send it to Director of Publications Frank Jackman, 801 N. Fairfax St., Suite 400, Alexandria, VA 22314-1774 USA or [email protected]. The publications staff reserves the right to edit all submissions for publication. Copyright must be transferred to the Foundation for a contribution to be published, and Barry Eccleston, president and CEO payment is made to the author upon publication. Airbus North America Sales Contact Emerald Media Don Phillips, freelance transportation Cheryl Goldsby, [email protected] +1 703.737.6753 reporter Kelly Murphy, [email protected] +1 703.716.0503 Russell B. Rayman, M.D., executive director Subscriptions: All members of Flight Safety Foundation automatically get a subscription to AeroSafety World magazine. For more information, please contact the Aerospace Medical Association, retired membership department, Flight Safety Foundation, 801 N. Fairfax St., Suite 400, Alexandria, VA 22314-1774 USA, +1 703.739.6700 or [email protected]. AeroSafety World © Copyright 2012 by Flight Safety Foundation Inc. All rights reserved. ISSN 1934-4015 (print)/ ISSN 1937-0830 (digital). Published 11 times a year. Suggestions and opinions expressed in AeroSafety World are not necessarily endorsed by Flight Safety Foundation. Nothing in these pages is intended to supersede operators’ or manufacturers’ policies, practices or requirements, or to supersede government regulations.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 3 Select the Integrated Air Safety Management Software Solution... SMS IAMS FAA Airline Quality JSA IOSA Flight Control Safety Audits Risk Matrix Safety Integrated JSA Aviation Security IAMS SMS IOSA Environmental JSA FAA Risk Management IAMS SMS SMS IATA Operational Safety Audit Flight Control Job Safety Analysis IATA Risk Matrix Safety Management System Job Safety Analysis FAA IOSA Risk Assessment JSA Integrated Airline Management System IATA JSA Environmental Federal Aviation Administration IOSA IOSA Reporting Airline Industry IAMS Aviation Risk Assessment FAA Airline Safety JSA SMS Safety Audits Aerosafety Risk Management Flight Control Flight Control Safety Audits Safety Audits Reporting JSA Risk Matrix SMS Airline IOSA FAA SMS Airline IAMS IAMS Air Safety IATA Quality Integrated Airline Safety IOSA Reporting Flight Control Job Safety Analysis Aerosafety Safety Audits Risk Management IATA Airline Industry FAA SMS SMS JSA Aviation FAA
Best Practices: Integrated modules for Aviation Safety Management: ...with the most VALUE Document Control • Reporting • Audits • Training • Job Safety Analysis CAPA • Safety Incident Reporting • Risk Assessment ...and more! Safety Assurance: Handles daily events, hazard analysis, and controls related to Aviation Safety Management System Assessment & Corrective Action: Uses intelligent Decision trees to determine whether event conform to requirements, and take Corrective Action to known events Safety Risk Management: Intuitive process for determining potential hazards using Job Safety Analysis, FMEA and similar tools Risk Assessment: Identifies, mitigates, and prevents high-risk events in the Aviation Safety Management System Change Control: Implement Controls to mitigate risks and Change Management to change processes related to known hazards Integration: Integrates with 3rd party business systems Scalable: Readily adapts to enterprise environments, and multi-site Deployments Business Intelligence: Enterprise reporting tracks KPIs, aids in decision-making with hundreds of configurable charts and reports 800-354-4476 • [email protected] www.etq.com/airsafety EDITORIALPAGE
USA SEQUESTRATION and Safety
larm bells are ringing in Wash- Economic Impacts of FAA Budget Seques- have been very insistent in our commen- ington. They are difficult to hear tration on the U.S. Economy, which said tary that FAA will never forsake safety,” over the din of the U.S. presiden- the U.S. Federal Aviation Administration the spokesman told me. “Safety is the tial election, but aural alerts are (FAA) could see sequestration-forced cardinal rule.” Asounding as the prospect of $1.2 trillion budget cuts of $1 billion a year over nine Still, there is cause for concern. How in automatic, mandatory federal budget years. Such a loss of funding could cost does an agency absorb a blow of that poten- cuts over nine years, beginning with the country up to 132,000 aviation jobs, tial magnitude and not falter, if only briefly? the fiscal 2013 budget, grows more real. tens of millions fewer passenger enplane- If sequestration results in significant layoffs Elected officials, political appointees, ments per year and the loss of 1 billion among controllers and other safety-critical civil servants, lobbyists and special in- pounds or more of air freight annually personnel, such as inspectors, can FAA terest groups all are worried about the as system capacity shrinks because of shrink the system fast enough and effi- across-the-board budget cuts known as control tower closures, air traffic con- ciently enough to avoid a possibly danger- “sequestration” and the possible short- troller layoffs and other personnel and ous additional workload being dropped and long-term ramifications. infrastructure cutbacks. The budget cuts on the remaining professionals? And what The story behind sequestration is also could have a devastating impact on about the human factors, the stress of un- long and sordid, but basically a bipartisan full implementation of the Next Gen- certainty and its impact on performance? congressional “super committee” late eration Air Transportation System, more As former Transportation Secretary last year failed to identify $1.5 trillion commonly known as NextGen, which Norman Mineta said in August, “The in specific deficit reduction targets for currently is scheduled for 2025. FAA is a critical safety organization that fiscal year 2012, which began in October In releasing the study, which was con- regulates our national air transporta- 2011, through fiscal year 2021. The Joint ducted by Philadelphia-based economic tion system. Putting it at risk is a folly Select Committee on Deficit Reduction’s consulting firm Econsult Corp., AIA beyond comparison.” inability to overcome the Republican vs. President and CEO Marion C. Blakey The Econsult study is available at Democrat dynamic triggered sequestra- said, “With proper funding, the FAA can
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 5 Serving Aviation Safety Interests for More Than 60 Years
OFFICERS AND STAFF light Safety Foundation is an international membership organization dedicated to Chairman, the continuous improvement of aviation safety. Nonprofit and independent, the Board of Governors Lynn Brubaker Foundation was launched officially in 1947 in response to the aviation industry’s need President and CEO William R. Voss F for a neutral clearinghouse to disseminate objective safety information, and for a credible Chief Operating Officer Capt. Kevin L. Hiatt and knowledgeable body that would identify threats to safety, analyze the problems and General Counsel recommend practical solutions to them. Since its beginning, the Foundation has acted in the and Secretary Kenneth P. Quinn, Esq. public interest to produce positive influence on aviation safety. Today, the Foundation provides Treasurer David J. Barger leadership to more than 1,075 individuals and member organizations in 130 countries. ADMINISTRATIVE
Manager, Support Services and Executive Assistant Stephanie Mack MemberGuide Flight Safety Foundation MEMBERSHIP AND BUSINESS DEVELOPMENT 801 N. Fairfax St., Suite 400, Alexandria VA 22314-1774 USA tel +1 703.739.6700 fax +1 703.739.6708 flightsafety.org Senior Director of Membership and Member enrollment ext. 102 Business Development Susan M. Lausch Ahlam Wahdan, membership services coordinator [email protected] Director of Events Seminar registration ext. 101 and Seminars Kelcey Mitchell Namratha Apparao, seminar and exhibit coordinator [email protected] Seminar and Seminar sponsorships/Exhibitor opportunities ext. 105 Exhibit Coordinator Namratha Apparao Kelcey Mitchell, director of membership and seminars [email protected] Membership Donations/Endowments ext. 112 Services Coordinator Ahlam Wahdan Susan M. Lausch, director of development [email protected] FSF awards programs ext. 105 COMMUNICATIONS Kelcey Mitchell, director of membership and seminars [email protected] Director of Technical product orders ext. 101 Communications Emily McGee Namratha Apparao, seminar and exhibit coordinator [email protected]
TECHNICAL Seminar proceedings ext. 101 Namratha Apparao, seminar and exhibit coordinator [email protected] Director of Web site ext. 126 Technical Programs James M. Burin Emily McGee, director of communications [email protected] Deputy Director of Basic Aviation Risk Standard Technical Programs Rudy Quevedo Greg Marshall, BARS program director [email protected] Technical BARS Program Office: Level 6, 278 Collins Street, Melbourne, Victoria 3000 Australia Programs Specialist Norma Fields tel +61 1300.557.162 fax +61 1300.557.182
BASIC AVIATION RISK STANDARD
BARS Program Director Greg Marshall Manager of Program Development Larry Swantner
facebook.com/flightsafetyfoundation Past President Stuart Matthews @flightsafety Founder Jerome Lederer 1902–2004 www.linkedin.com/groups?gid=1804478
FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 EXECUTIVE’SMESSAGE IASS 2012 – Santiago
n a clear day, Santiago basks in one of the Meeting in conjunction with the IASS — in most spectacular settings of any city in the order to take advantage of this gathering of well- world. A mighty circle of mountains — the known presenters, interesting topics and great snowcapped Andean peaks to the east, and networking opportunities — will be the Regional Oa smaller coastal range to the west frame the Chil- Aviation Safety Group–Pan America (RASG-PA). ean capital. This will be the backdrop for the 65th RASG-PA was established in November 2008 to be annual International Air Safety Seminar (IASS) the focal point to ensure harmonization and coor- scheduled for Oct. 23–25, 2012. Coming to this dination of safety efforts aimed at reducing aviation region was a natural choice due to the partnerships safety risks in the North American, Central Ameri- the Foundation has formed over the past few years. can, Caribbean (NAM/CAR) and South American I thought I would use my operations update this (SAM) regions and to promote the implementation month to provide some insight on our partners. of safety initiatives by all stakeholders. This is an- The IASS will be presented by the Founda- other great alliance with the Foundation activities. tion and the Latin American and Caribbean Air ALTA, the International Air Transport Asso- Transport Association (ALTA). It will be hosted by ciation, the International Federation of Air Line the Directorate General of Civil Aviation (DGAC) Pilots’ Associations, the Air Line Pilots Associa- of Chile. ALTA is a private, non-profit organiza- tion, International and various other associations tion, whose member airlines represent more than also will be at IASS. 90 percent of the region’s commercial air traffic. The Foundation has not held an event in this ALTA coordinates the collaborative efforts of its region of the world since 1999, so it will definitely members to facilitate the development of safer, be the safety event to attend. As I have mentioned more efficient and environmentally friendly air previously in my articles, the seminar formats transport in the Latin American and Caribbean have been enhanced and at this one we will have region for the mutual benefit of the association’s some presentations that are oriented to this region members, their customers and the industry. It is a of the world on how some safety programs are natural fit with our Foundation activities in safety. implemented. We will have the usual high-quality The DGAC provides Chilean aviation and exhibitors there, along with a great reception at the foreign operators in Chile the necessary services National Museum of Air and Space. for the security and regularity of air naviga- Overall, this is one safety seminar that you do tion. It participates directly in the planning of not want to miss. See you in Santiago! the aeronautical infrastructure, contributing to national integration and regional development, and is responsible for the security of the civil aviation system. The organization works closely with international organizations (Flight Safety Foundation), general aviation interests, airlines, Capt. Kevin L. Hiatt maintenance centers, aviation schools and other Chief Operating Officer public services. Flight Safety Foundation
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 7 AIRMAIL
(Re)drawing the Line AeroSafety World encourages comments from readers, and will assume that letters and e-mails are meant for LS signal interference (ASW, 7/12, p. 20) is a serious publication unless otherwise stated. Correspondence is problem that has existed for decades. subject to editing for length and clarity. I To fix this, the FAA needs to draw the lines at 1,500 and 5, not 800 and 2. There is no reason a plane Write to Frank Jackman, director of publications, should be on instruments inside the final approach fix Flight Safety Foundation, 801 N. Fairfax St., Suite when the signal is not protected! 400, Alexandria, VA 22314-1774 USA, or e-mail Martin Coddington
save the date BASS 2013 58th annual business aviation safety seminar april 10–11, 2013 supported by
fairmont queen elizabeth hotel montréal, canada
For details, visit our Web site at flightsafety.org/BASS. To advertise in AeroSafety World Magazine, contact Emerald Media. To register or exhibit at the seminar, contact Namratha Apparao, Cheryl Goldsby Kelly Murphy tel.: +1.703.739.6700, ext. 101, [email protected]. [email protected] [email protected] To sponsor an event, contact Kelcey Mitchell, ext. 105, [email protected]. tel: +1 703 737 6753 tel: +1 703 716 0503 8 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 To receive membership information, contact Susan Lausch, ext. 112, [email protected]. ➤ SAFETYCALENDAR
SEPT. 17–18 ➤ Flight Safety 2012. OCT. 8–12 ➤ Aviation English for Pilots and OCT. 29–NOV. 2 ➤ Aviation Safety Program Flightglobal. London.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 9 FOUNDATIONFOCUS
NON-PUNITIVE Is Not Easy
afety management systems (SMS) voluntary reporting programs that do identify safety hazards and to manage have been required by many state not contain sufficient guidance and the risk, the very essence of SMS. The regulatory agencies for years now. limitations on how these non-punitive Foundation, in collaboration with Copa This is in compliance with the reports should be processed. As a Airlines in Panama, the Panamanian Sstandards and recommended practices result, in some cases, operators have Pilots Union and the Civil Aviation Au- (SARPs) established by the International leveraged the programs to circumvent thority of Panama, established an avia- Civil Aviation Organization (ICAO). punitive action by the civil aviation tion safety system enhancement team, Non-punitive policies that encourage authority, even in cases involving evi- which is developing a voluntary open open reporting of safety issues are crucial dence that the operator did not act in reporting program that establishes clear to an effective SMS. But the implemen- the best interests of safety. guidance and limits on non-punitive tation of non-punitive policies has had To complicate matters, operators information. mixed results for a variety of reasons. with advanced programs and docu- The project in Panama aims to Many states have established volun- mented non-punitive policies are align the state’s regulatory guidance tary reporting processes that they say sometimes found in violation by local with an operator’s reporting system to are non-punitive. However, it is impor- civil aviation authorities as a result of maximize the open exchange of infor- tant to understand the context. In some information gathered though the op- mation that can be used to enhance of these voluntary programs, informa- erator’s own safety reporting systems. safety. While the program draws on tion received by the regulatory author- In some cases, both the operator and its experience from the Federal Aviation ity must be assessed against regulatory employees are found in violation. After Administration’s Aviation Safety Ac- requirements. If a violation of civil that happens, information that could tion Program, Voluntary Disclosure aviation code exists, the information identify safety issues and hazards is not Reporting Program and other success- is processed through normal means, likely to be shared openly in the future. ful models throughout the world, the which often results in a punitive action Flight Safety Foundation, as part of team’s goal is to ensure the program is against the report submitter. Only when an effort to understand how the adop- designed specifically for the needs of no violation of aviation code is identi- tion of recommended practices at state Panama and its aviation industry. fied can a report submitter be assured levels has affected front line operations Once established in Panama, the that the information will be treated in a of operators in ICAO member states, program can be used as a model for non-punitive manner. began a project this year to evaluate the similar processes throughout the world. In other cases, regulatory au- effectiveness of safety reporting systems — Rudy Quevedo thorities have established non-punitive in capturing information that could Deputy Director of Technical Programs
10 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012
INBRIEF Safety News New UAS Rules
he International Civil Aviation Organization (ICAO) has finalized measures concerning the operation of unmanned Taircraft systems (UAS), which ICAO characterizes as remotely piloted aircraft systems (RPAS). The amendments to ICAO Annex 2 (Rules of the Air) and Annex 7 (Aircraft Nationality and Registration Marks) were developed by the ICAO Unmanned Aircraft Systems Study Group, in collaboration with a number of other organizations. “Remotely piloted aircraft are becoming very sophisti- cated very quickly,” said Mitchell Fox, chief of the ICAO Air Traffic Management Section. “Their civilian and scientific ap- plications are expanding rapidly, and states from every ICAO ©Proxy Aviation region are now developing and employing RPAS in a variety Fox said that ICAO is reviewing all standards and recom- of domains.” mendations to determine how they will be affected by the intro- The amendments discuss items that should be considered duction of UAS. when a civil aviation authority is considering authorizing “This is a completely new area that will require new clas- UAS operations, including airworthiness certificates, operator sifications and licensing, not only for aircraft but pilots as well,” certificates and remote pilot licenses. he said.
Helicopter Accident Prevention 787 Engine Failure
elicopter operators could help of flight data monitoring equipment to he contained engine failure prevent accidents by implementing provide immediate feedback to trainers, on a Boeing 787 General Henhanced pilot training, safety man- operators and pilots, and to aid in accident TElectric GEnx engine dur- agement programs, careful maintenance investigation. ing a late July test run was a practices and installation of flight data Training recommendations include result of the fracture of a fan monitoring equipment, the International improved autorotation training, the addi- mid-shaft, the U.S. National Helicopter Safety Team (IHST) says. tion of advanced maneuvers to simulator Transportation Safety Board The IHST, an international organiza- training, an emphasis on critical issues (NTSB) says. tion with a goal of reducing the helicopter awareness and more attention to emer- The engine failure occurred accident rate worldwide 80 percent by gency procedures training. during a pre-delivery taxi test in 2016, said its list of the top 10 ways to Other recommendations call for Charleston, South Carolina, U.S. prevent helicopter accidents is intended to implementation of a personal risk man- The NTSB said that metal- help pilots, owners, maintenance person- agement program and a “mission-specific” lurgical inspections and other nel, instructors and other members of the risk management program, as well as detailed examinations were helicopter community. increased emphasis on compliance with a being performed on the engine, The 10 recommendations include manufacturer’s maintenance manuals and which fractured at the forward a measure calling for the installation maintenance practices. end of the shaft, “rear of the threads where the retaining nut is installed.” The GEnx is a dual-shaft engine, with one shaft connect- ing the compressor spool to the high-pressure turbine spool and a second, longer “fan shaft” con- necting the fan and booster to the low-pressure turbine. The investigation was continuing.
Jackie (Flickr)/Wikimedia
12 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 INBRIEF
FAA Go-Ahead for Wind Farm Pilot Distraction
he 130-turbine wind farm he Australian Transport Safety Bureau planned off the coast of (ATSB), citing an Oct. 8, 2011, incident TMassachusetts presents no Tinvolving an Airbus A380-800, is warning hazard to air traffic, the U.S. of the risks of pilot distractions during flight Federal Aviation Administra- preparations. tion (FAA) said in a mid-August Rebell/istockphoto The incident involved the crew of a Qantas decision that supporters said was Department of Homeland Security A380 preparing for departure from Los Angeles the final federal approval required had warned that the “radar sig- International Airport. before the project could proceed. nature” of spinning wind turbine “Before takeoff, the captain changed the de- The FAA said a lengthy blades can sometimes create false parture runway that was entered in the aircraft’s study of the Cape Wind project images on air traffic control radar flight management system,” the ATSB said. “The determined that the wind turbines screens or block radar signals. The procedure for completing that task was not fol- would have no effect on aero- distortions generally affect older lowed exactly, resulting in the takeoff speeds not nautical operations. The project, radars, the study said. being displayed on the flight instruments.” planned for Nantucket Sound, The FAA said that, because The ATSB said that twice during the crew’s would be the first offshore wind the wind farm will be located preparations, aircraft systems had displayed a farm in the United States. more than 2.4 nm (4.4 km) from message calling for a check of the takeoff data. A report prepared by Mitre the closest radar sites, there will be “The first officer cleared the first message Corp. several years ago for the U.S. no effect on radar images. on the understanding that the takeoff data would be checked, and in the second instance, believing that it had been checked,” the ATSB said. “There were no other warnings to alert the Don’t Slam the Door crew that they were commencing the takeoff without the takeoff speeds in the aircraft’s navi- aintenance personnel must be given stronger warnings about gation systems.” the potential for injury and damage when working on or around The pilots did not realize until they had the rear cargo door on Airbus A330s, the U.S. Federal Aviation M begun the takeoff roll that the speeds were not Administration (FAA) says. being displayed and referred to their notes to The FAA issued Safety Alert for Operators (SAFO) 12004, citing an call out the correct speeds. incident involving an A330 undergoing a lengthy maintenance procedure The ATSB said that, after the incident, Air- in which the rear cargo door was kept open about four weeks. bus “updated the aircraft’s warning systems as After work in the cargo bay had been completed, maintenance part of a planned upgrade program … [to] issue technicians “selected the manual selector valve to the closed position and a warning if takeoff is commenced without the used the hand pump to close the door,” the FAA said. “The cargo door takeoff speeds having been entered.” dropped approximately 2 ft [0.6 m], damaging the floor frame … , door In addition, Qantas modified its standard actuator and actuator support frame. The door did not completely fall operating procedures to “avoid any misinter- shut or contact the fuselage.” pretation of the required actions in the case of a The SAFO said that Airbus has acknowledged that cargo door “slam- runway change,” the ATSB said. ming” can result when air is “trapped in the system actuator and lines.” The A330 maintenance manual contains a warning that calls for the cargo door system to be bled before closing if the door has been open longer than 12 hours, but the FAA said the warning is insufficient. “Due to maintenance shift changes, maintenance schedule interrup- tions and other factors, a maintenance technician may be unaware of the time [elapsed] with the door open,” the SAFO said. “Further, defects in the system may allow air to enter the system within the 12-hour margin.” To deal with the problem, Airbus issued Service Bulletin A330-52- 3065, which calls for replacement of the manual selector valve to prevent the door from slamming, and the SAFO recommended that information in the bulletin be incorporated into maintenance manuals and that a warning placard be installed near the selector valve.
Eluveitie/Wikimedia
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 13 INBRIEF
Changes for ATSAP
ajor changes will be required in the U.S. Federal problems, without fear that they might be punished for making Aviation Administration (FAA) non-punitive reporting mistakes. The system was implemented at all FAA air traffic Mprogram for air traffic controllers before the program control facilities in 2010. can effectively identify and address safety concerns, a report The OIG report also said that FAA oversight of ATSAP from a government oversight office says. “lacks effective program management controls. For example, The U.S. Department of Transportation’s Office of Inspec- FAA does not have a formal process to review the effective- tor General (OIG) said in the report that program safeguards ness of decisions made by the program’s review committees to of controller confidentiality mean that some data collected ensure that report acceptance criteria are rigorously followed through the Air Traffic Safety Action Program (ATSAP) are and that conduct issues are dealt with appropriately. Failure not validated, “raising questions about the effectiveness of these to address potential deficiencies in transparency and account- data for analyzing safety trends.” ability may lead to the perception that ATSAP is an amnesty The confidential system was designed to encourage program in which reports are automatically accepted, regardless controllers to report situations that they believe might present of whether they qualify under the program’s guidelines.”
Proposed Penalties In Other News …
he U.S. Federal Aviation viation in India is facing a Administration has pro- “multi-faceted crisis,” according Tposed a $1 million civil Ato Tony Tyler, director general penalty against Horizon Air and CEO of the International Air for its alleged operation of 22 Transport Association. Tyler says Bombardier DHC-8-402 turbo- the problems must be dealt with props on 186,000 revenue flights through coordinated government without the required solid rivets efforts to address “the crippling is- in flight deck security doors. sues of high costs, exorbitant taxes The blind rivets that were and insufficient infrastructure.” … used instead can damage wir- The Australian Civil Aviation Safety ing and other components, the Authority (CASA) is nearing the end FAA said. Dustin Brice/Wikimedia of a lengthy regulatory reform The agency said the flights effort, Aviation Safety Director John occurred between December 2007 and In a separate case, the FAA pro- McCormick says. The primary goal of June 2011, when the blind rivets were posed a $681,000 civil penalty against the regulatory overhaul, he says, has replaced. Federal Express (FedEx) for alleged been to bolster safety throughout the The FAA said that it learned of the violations of government hazardous nation’s aviation community. alleged violations of U.S. Federal Avia- materials regulations. tion Regulations when the airline “in- The FAA said that, in early August correctly modified a 23rd aircraft with 2010, FedEx improperly accepted blind rivets, and the plane experienced dozens of shipments of hazardous an in-flight wiring damage incident materials and failed to provide pilots during a non-revenue flight.” with “accurate and legible written in- The FAA also said that, even after formation” about the materials loaded Horizon was told that the airplanes into their airplanes. The agency said were not in compliance with regula- that it discovered the violations during tions, the company operated one of the an inspection of FedEx facilities in airplanes on 22 more passenger- southern California. carrying revenue flights before the Both airlines were given 30 days to blind rivets were replaced. respond to the allegations.
Prateek Karandikar/Wikimedia
Compiled and edited by Linda Werfelman.
14 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 IASS 2012 65th annual International Air Safety Seminar OCTOBER 23–25, 2012
Presented by Flight Safety Foundation and Latin American and Caribbean Air Transport Association (ALTA) Hosted by Directorate General of Civil Aviation of Chile Sheraton Santiago Hotel and Convention Center, Santiago, Chile COVERSTORY
ROI Safety The surest route to profitability is an evolving investment in safety.
BY MARIO PIEROBON
espite the sensitivity of most civil aviation managers provided more convincing busi- senior managers to safety issues, safety ness cases and harder evidence, the budgeting still is a tough sell. Many aviation safety process would be less frustrating and safety managers are seen by their chief finan- managers would see more money for their de- Dcial officers more as necessary evils than super- partments. The good news is that there is much visors of value centers. When asked to justify evidence supporting safety as a worthwhile their budget requests, their rationale sometimes investment, not only in general but also for sounds more grounded in desperation than in specific safety measures. sound business reasoning: “The regulator man- dates it. The authority strongly recommends it. Safety Pays We have to do it if we want to remain part of First, it is necessary to debunk the myth that that alliance,” are recurrent themes. safety is simply a cost. Safety goes with function- That is a pity. Safety, more than anything ality. When production systems are put in place, else, drives the reliability of an aviation organi- the expectation is that they will be functional. zation, building and strengthening its reputation Unsafe occurrences are unplanned and un-
and operational effectiveness. If airline safety desired interruptions of a production system. Wallin ©2011 Ulf E.
16 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 COVERSTORY
Safety systems are in place to control aviation organization — equipped safety performance? Because, statisti- unavoidable but necessary costs and to with some of the most technologically cally, good safety performance correlates minimize unplanned costs. sophisticated, and expensive, assets — closely with other performance indica- The view that safety has a posi- is higher. Although the study was based tors — such as productivity and quality tive contribution to operational on telephone interviews and not on raw — that bear directly on Weyerhaeuser’s efficiency is shared and reinforced by data and although the study’s reported profitability. But, even more important, safety management researcher Jose results do not specify the estimated we know our investors don’t want to see Blanco.1 Referring to his personal time frame for the ROI, knowing that people get hurt any more than we do.”4 safety management experience in an financial executives believe that “the aircraft maintenance organization, top benefits of an effective workplace Best Practices Blanco writes: “The safety management safety program are predominantly One of the most common forms of systems we set up at the time have financial in nature”3 provides additional investment by aviation safety de- survived and have delivered additional evidence that safety is a profitable partments has been the adoption of improvements for another 10 years. investment (Figure 1). industry best practices for operational Worker’s compensation dropped in Support for the idea that invest- safety management. For airlines, this half. As for the safety-efficiency ROI ing in safety management pays off can has taken the form of the International (return on investment), it is difficult be found in the 1999 annual report of Air Transport Association Operational to calculate, but it was huge because Weyerhaeuser, one of the world’s larg- Safety Audit (IOSA). For business oper- we released much ‘found capacity.’ est pulp and paper companies: “Why ations, the International Business Avia- Operating and capital budgets were should our shareholders care about our tion Council’s (IBAC’s) International still lower six or seven years into the program despite significant inflation. Workplace Safety ROI The safety and incident management systems paid in spades.” 26.7% The cost efficiency of safety 25.0% management was confirmed in more quantifiable terms by a study that explored the perceptions of corporate financial decision makers. This study 14.0% was conducted through telephone 12.8% interviews with several U.S. senior 8.7%
executives or managers responsible for of participants Percent decisions about property and casualty 5.2% risk management or insurance-related 3.5% 1.2%1.2% services of medium to large organiza- 0.6%0.6%0.6% tions — those with more than 100 0.00– 1.00– 2 3 4 5 10 252015 10050 0.99 1.99 employees and not strictly in the avia- Perceived dollar return tion business. According to this study, ROI = return on investment financial decision makers perceive Note: Data are based on a researcher’s interviews with U.S. managers in aviation and other organizations that, on average, for every dollar spent with more than 100 employees. Source: Mario Pierobon, and Huang, Y.H.; Leamon, T.B.; Courtney, T.K.; De Armond, S.; Chen, P.Y.; Blair, M.F. “Financial Decision improving safety in the workplace, Makers’ Views on Safety.” Professional Safety Volume 54 (April 2009): 36–42. about $4.41 is returned.2 We can as- sume that the return for an average Figure 1
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 17 COVERSTORY
Standard for Business Aircraft Opera- no longer a cost-justifiable safety The risk of overreliance on tried tions (IS-BAO) was introduced in 2002. enhancement. and tested solutions can be found It was designed to raise the safety bar, As the International Civil Aviation in the enormous efforts invested in in part by requiring adoption of safety Organization (ICAO) says in its Safety recent years in occurrence reporting management systems (SMS). Management Manual, a balance must systems. Accidents typically result An IBAC study of the safety value be struck between production and from a combination of factors, none of IS-BAO reviewed 500 accidents protection.6 of which by themselves can cause an that occurred between 1998 and 2003, The point is highlighted by Rene accident or even a serious incident. some 297 of which contained sufficient Amalberti, senior adviser for patient These combinations remain difficult to information to warrant further assess- safety at the Haute Autorité de Santé, detect using traditional safety analysis ment to determine the probability that, the French medical accreditation agen- logic; for the same reason, reporting if the flight department had known cy, and a doctor of aerospace medicine becomes less relevant in predicting about and implemented IS-BAO, the who also has a Ph.D. in cognitive major disasters, Amalberti said. Still, accident could have been avoided.5 The psychology. many aviation organizations, within data were de-identified, and the ac- “When an industry or an organi- their newly implemented SMS, believe cidents were rated on a five-point scale zation has a safety record that is not that they have found the solution to all ranging from certainty of prevention to particularly brilliant and it plans to no effect. implement a safety improvement initia- Probability of Prevention The IBAC study found that, assum- tive of some sort, it is generally easier ing that the operator had implemented to make an estimate of how much the IS-BAO in full, the accident could have safety improvement could be,” he said. been prevented in 107 (36 percent) of “The air transport industry has instead None 16% the 297 accidents (Figure 2). a very remarkable safety record, and Other findings were that: because of this, it is harder to make an Doubtful Certain estimate of how much a safety innova- 15% • Prevention would have been 36% tion, like a safety management system, probable in 63 accidents (21.2 can bring in terms of an improved percent); Possible safety performance.” 13% Probable • Prevention would have been In an article published in 2001, 21% possible in 38 accidents (12.8 Amalberti wrote, “Subjects running percent); into difficulty tend to escape into tried and tested solutions, setting aside dif- • Prevention would have been Note: The probability that accidents could have ficult points. They systematically and been prevented is based on an assumption that doubtful in 43 accidents 14.5 IS-BAO had been implemented. erroneously tend to carry out linear percent; and Source: Mario Pierobon and International Business Aviation extrapolations, and never sufficiently Council • There was no possibility of take into account the collateral effects prevention in 46 accidents (15.5 of the measures undertaken. ... Even Figure 2 percent). though safety no longer improves, safety managers still think of risk con- of their safety problems in a thorough Overstretching trols in terms of linear extrapolations, reporting system, thus underestimating But just because safety investments and still apply the same old solutions its limits. have had a high rate of return in the (hunting down errors and failures, add- “Mandatory and non-mandatory past does not mean that they will ing procedures) based on well-known reporting, as compared to flight data continue to yield such substantial recipes which help them to feel secure analysis, represents a limit in terms of returns indefinitely. At some point, it (tried and tested values), without taking its ability to deliver valuable informa- is no longer sensible to invest in safety into consideration the collateral effects tion for safety management decisions,” solely on this basis because there is of these overstretched measures.”7 Amalberti said.
18 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 COVERSTORY
“Flight data analysis is very good no sense to stop now. Tried and tested and could easily reach a standard of 20 because it is not based on people and solutions, whether effective or not at or 24 hours.” therefore on varying reporting sensitiv- maintaining the current safety record, He added that large airplanes on ities and situational understanding. The are not likely to produce dramatic new lengthy flights probably will experi- real problem with reporting is to derive improvements in safety performance. ence an increased number of problems an objective analysis of the reported in- What should aviation organizations do, involving sick passengers. These situa- formation. Reporting does not allow for then, to improve their safety record in tions could result in “difficult deci- automatic analysis, and it is also very the long run? sions on problematic flight diversions demanding in terms of resources. The current operational system to unsafe airports” that lack the facili- “Analysis of flight data is instead of air transportation has reached a ties to handle the influx of passengers, based on objective parameters; thus, positive but stable safety record. The he said. not only is it possible to have a very system is aging, and safety and op- Earning profits and paying returns accurate picture of what is going on erational efficiency can be improved to shareholders are priorities for air- during flight operations within the only with a major infrastructural lines. A precondition for profitability, scope of the flight data recorder, but overhaul and appropriate investments however, is providing safe and reliable the application of predictive tools in the technological upgrade of opera- flights in airworthy aircraft. also becomes valuable in terms of tional equipment. Mario Pierobon works in business identifying emerging safety and op- “Aviation will benefit sooner or development and project support at Great erational trends. later [by 2030 or 2040] from much Circle Services in Lucerne, Switzerland, and “From reporting, you cannot ex- greater guidance automation, full was formerly with the International Air pect a particular, measurable, gain in implementation of … satellite navi- Transport Association in Montreal. the safety performance. On the other gation systems, at least on the main Notes hand, the immeasurable contribution international routes, full automatic of reporting to safety should not be parallel approaches to airports, etc.,” 1. Blanco, J.A. Managing for Safety and underestimated. What you can expect Amalberti said. Profit — Report on a Thirty-Year Learning Journey. Prepared for 14th annual from reporting is an improvement “This greater automation will Federal Aviation Administration/Civil of the safety culture, whose health is probably result in improving safety Aviation Authority/Transport Canada generally testified by a high number figures to nearly 1 accident every 10 Human Factors in Aviation Maintenance of non-mandatory safety reports.” million sectors on selected interna- Symposium, Vancouver, British Columbia, tional routes/airports, although very Canada. March 2000. To the Future rare — but probably more severe 2. Huang, Y.H.; Leamon, T.B.; Courtney, The aviation industry should not be — accidents could result from this T.K.; De Armond, S.; Chen, P.Y.; Blair, complacent about its outstanding transfer of technology (larger air- M.F. “Financial Decision Makers’ Views safety performance. craft, greater risk of collisions when on Safety.” Professional Safety Volume 54 (April 2009): 36–42. The risk of maintaining the current automated systems fail totally). A accident rate is that, at the current significant effort will have to be made 3. Ibid. rate of growth in aviation operations, on the logistics and on infrastructure 4. Weyerhaeuser Corp. 1999 Annual Report. in the years from 2020 to 2030, the development, in addition, to a further Cited in Blanco. industry will suffer twice as many ac- refining of flying techniques.” 5. IBAC. Business Aviation Safety Brief. cidents as today. The public’s concern Another area that should capture Montreal. 2011. will increase because of more frequent the attention of aviation safety depart- 6. ICAO. Document 9859, Safety news about aircraft accidents, and ments is that of ultra-long-range opera- Management Manual. 2009. (The sub- flying will no longer be considered as tions, with its emerging safety threats. sequent third edition was published in safe as it is today. “One point could become critical,” 2012.) The industry has achieved a Amalberti said. “It concerns long- 7. Amalberti, R. “The Paradoxes of Almost remarkable history of improvement range and very-long-range passenger Totally Safe Transportation Systems.” in safety performance, and it makes journeys that progressively expand Safety Science Volume 37 (2001): 109–126.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 19 20 | F REGULATIONSAFETY airspeeds” —probably caused by ice inconsistency measuredrary between of events, with “tempo the beginning - A330’s crash resulted from asuccession year investigation. issued earlier course inthe of three- the in July. recommendations Other were its report on final accident, the issued two dozen safety recommendations in d’Analyses (BEA) included more than unexpected” developments during flight. — and safely cope with —“unusual and in pilot training to help crews recognize The final report concludedThe final that the The French Bureau d’Enquêtes et Airbus A330,are for calling changes Atlantic of Ocean an Air France Junethe 1,2009, crash into the rench accident investigators, citing EXPECT THE UNEXPECTED impetus forenhancedpilottraining,accidentinvestigatorssay. The 2009crashofanA330intotheAtlanticshouldbe pean Aviationpean Safety Agency (EASA) figuration problems, on calling Euro the safety recommendations on aircraft con- Brazil, for Paris. hours after from takeoff deJaneiro, Rio crash, inthe alittlekilled more than two possible” (ASW actions that would have made recovery tion and, consequently, lack the of any failure situa stall …the to- diagnose was entering and astall “the crew’s failure a to recognize that airplane the pretations of instrument indications, destabilized path,” flight the misinter were “inappropriate control inputs that and followed by what report the said clogging pitot the crystals probes — The BEA focused manyThe BEA focused of its 41 228 people airplane inthe All were , 8/12,p. 14). - FLIGHT FOUNDATION SAFETY - BY LINDAWERFELMAN parameters,” report the said. monitor and primary the trajectory the of protection and on necessity the to of reconfiguration and of level the “the precise identification of type the equately acrew’s focus attention on flight-envelope deviations. different degrees of protection against wire system, with eachone providing inherent elements of Airbus the fly-by- report said. final the account of all reconfiguration the laws,” incorporatealso “exercises that into take aircraft for are they which designed” but “take into account of specificities the the training and recurrent training not only to steps take to ensure that rating type Current training not does ad- The four reconfiguration laws are |
WORLD AEROSAFETY | SEPTEMBER 2012
© Peter ten Broecke/iStockphoto SAFETYREGULATION
The document noted that, after the auto- During the accident flight, “the startle effect pilot disconnect, control inputs by the flight played a major role in the destabilization of the crew “significantly degraded the airplane’s flight path and in the two pilots’ understanding kinetic energy.” [of] the situation,” the BEA report said. The BEA also recommended that EASA The report criticized existing initial and re- require that pilot training include exercises current training for failing to ensure that pilots to ensure that pilots possess solid theoretical can respond quickly and correctly to unexpected knowledge of flight mechanics. in-flight situations. Citing the accident flight, the BEA said, “The exercises are repetitive, well known to “The rapid exit from the flight envelope was not crews and do not enable skills in resource man- anticipated by the pilots, nor was it understood. agement to be tested outside of this context,” In the absence of any reliable speed indications, the report said. “All of the effort invested in understanding of the overall physics of flight at anticipation and predetermination of proce- high altitude could have considerably helped the dural responses does not exclude the possibility pilots to anticipate the rapid degradation of the of situations with a ‘fundamental surprise’ for situation.” which the current system does not generate the In addition, the BEA said that pilots should indispensable capacity to react.” receive initial, recurrent and type training During the accident flight, the “rapid designed to enable them to “develop and main- increase in crew workload in an unusual and tain a capacity to manage crew resources when unexpected situation led to the degradation of faced with the surprise generated by unexpect- the quality of communication and coordination ed situations.” between the pilots,” the report said. In accompanying recommendations, the Western Sahara BEA said EASA should review pilot training requirements to ensure that operators “rein-
Mauritania force [crew resource management] training to enable acquisition and maintenance of adequate Cabo Verde behavioral automatic responses in unexpected Senegal The Gambia Mali and unusual situations with a highly charged
Guinea-Bissau Guinea emotional factor.” In addition, EASA should define the criteria Sierra Suriname French Leone for selecting and training instructors to provide Guiana Air France Flight 447 Liberia a “high and standardized level of instruction,” the BEA said.
Flight Simulators Other recommendations called on EASA to ad- dress training issues for flight simulators: Recife Atlantic Ocean • To modify existing regulations to “ensure Brazil better fidelity for simulators in reproduc- ing realistic scenarios of abnormal situa- tions”; and,
Rio de Janeiro • To “ensure the introduction into the train- ing scenarios of the effects of surprise.” Illustration: Susan Reed
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 21 22
| Bureau d’Enquêtes et d’Analyses REGULATIONSAFETY the accident. for 22months after recorders continued airplane’s flight The search for the director should review examine other several oftime re-engagement.” the consistency of commands the presented at the hand, stimulate acheck on and modes the the autopilot and autothrust, the and on other the on one the hand, to lead aconsistency with the crew to re-engage automatic this system would, instinctivebeing or natural,” report the said. ciator] indynamic and stressful conditions not displaysthe on annun mode FMA[flight the - were they because “reading and assimilating ably didnot realize that had changed mode the disappeared on directors flight the and prob- that crossbars the on adisplay appeared and disappeared and reappeared. then actiontotake re-engage after them adisplay under pilots the which would required be to directorsflight to determine conditions the redisplaythe and reconnection logic” of the recommended that EASA “require of areview involving director flight displays. The agency BEAthe characterized as ergonomic issues recommendationsSeveral addressed what Ergonomics as aconsequence,” report the added. actionsreflex on controls the that can occur situationan unexpected or “inappropriate the by triggered effect encountering startle the training, pilots the are unlikely to experience said. limitations Those mean that, during unusual situations simulated,” to be report the inmost donot cases, isfactory allow certain tions of simulator, the fidelity is sat whose - on simulator, the limita thoughtechnical the - trainingtheir according to aknown scenario aircraft monitor (ECAM). warnings onspeed]” electronic the centralized appearance of “unreliable IAS [indicated air disappearancethe of airspeed information and airplane didnot of recognize significance the The report noted that pilots the of accident the The BEA said recommended the flight “It that seems requiring an actionfrom the The accident pilots might not have noticed three crewmembers had undertaken“The - crews after events donot always reveal their ty,” reports reportwritten the said. “The by uisite process inthe of improving safe flight - uted to manufacturers. crews” andthat see documents the are distrib- qualitythe of incident reports written by flight steps aimed at improving relevance the and de l’Aviationtion Generale (DGAC) Civile “take BEAthe recommended that French the Direc- would improve training procedures. In addition, events —actionthatof BEA the said in-service operational the tory and human factors analyses BEAthe said that EASA should make manda- aircraft’s minimum associated training program, holdersthe of aircraft the define certificates type Noting that programs already exist under which Feedback warning should required. be tions, slow at airspeeds, very under astall which should require actionto determine condi the - indicationa visual that is imminent a stall and aural warning stall should accompanied be by should determine conditions the an inwhich would aid pilots the diagnosis. intheir failure providing while no information that only with narrow of of the effects the aspects problem, the fied but failure the messages dealt pitotthe probes.” airplane of blockage the was in,inparticular of rapid and diagnosis effective of situation the the on ECAM“did the not allow crew the to make a of failure series the flight, messages appearing report said, noting that, during accident the of type monitoring aspecific when the begins, situation.”the gered, inorder to facilitate comprehension of monitoringwarning specific …when - is trig and “the relevance of having adedicated ate orders warning stall is the triggered” when ic “so that it disappears or presents appropri- issues, including or functional the display log- “In-service feedback is an“In-service essential prereq- Related recommendations said that EASA of airplane’s the Several systems had identi - The pilots should adedicated warning see FLIGHT FOUNDATION SAFETY |
WORLD AEROSAFETY | SEPTEMBER 2012 recommendations from BEA the to EASA and working group’s proposals were followed by wreckage, and recovering recorders. flight The ing aircraft wreckage underwater —especially ofmethods safeguarding data, flight of locat- an international working group to review after an accident at sea.” ing], recovering and reading out recorders the that encountered can be difficulties in[locat- of an accident” but “brings also to light the der to establish circumstances the and causes tance of data from recorders flight the inor that crash the not only “confirms impor the cident, and BEA the noted initsreport final ers continued for 22months after ac- the informationbasic on aircraft parameters. flight require studies of other of methods delivering crash into water deep and others that would of recorders flight inairplanes installed that cluding intended several to aid recovery inthe number of related safety recommendations,in 8/12, p. 13). and other maritime and remote areas (ASW search and South efforts inthe rescue Atlantic for report called betterfinal coordination of cohesion and effectiveness.” DGAC its review oversight “so as to improve its aeroplane handling.” ofweaknesses two the copilots inmanual ing “fragile the nature of CRM[and] the the had to failed reveal major problems, includ- andin-flight ground inspections of Air France possible to appropriate take measures.” anundertake exhaustive analysis that makes it ate associated the risks and threats and to manufacturerthe and authorities the to- evalu vestigation and for thus operator, difficult the indispensablethe elements for needed an in- makes somewhat random preservation the of or ofseverity all elements the [involved]. This FLIGHTSAFETY.ORG The crash prompted BEA the to establish The search for airplane’s the record flight - investigation,Earlier inthe BEA the issued a recommendationsOther included inthe As aresult, BEA the recommended that the The noted report also that past DGAC |
WORLD AEROSAFETY | SEPTEMBER 2012 , - - - 4/12, p. 26). dataflight transmission to operators (ASW to provideand Astrium for Services real-time developed by Star Navigation Systems Group asatellite communicationsService, data service positioning system data, and Airborne Data datatriggered streaming on global based es’ FLYHTStream, provides which on-demand Two such systems are AeroMechanical- Servic typically for maintenance or monitoring. flight automatically from aircraft to ground stations, streaming data. dataflight recorders, including of use the of delivering data the contained on aircraft going efforts to develop alternative methods first indicationthe of an emergency. tion of emergency locator transmitters, at also for studying possibility the of requiring- activa emergency situation on is detected board” and mission to facilitate localization as as an soon airplanes to enable “triggering the of data trans- quiring installation the of equipment inthese Subsequent recommendations for called re-
the
to
possibility
90
days
(from
of
requiring
the
currently
,
REGULATIONSAFETY recorders. …recovering flight review of methods working group to an international the BEAto establish The crash prompted |
Bureau d’Enquêtes et d’Analyses 23 AVWEATHER
adar has become an indispensable tool for detection and ranging, the original name of a weather forecasting and plays a critical role technology that initially was based on the use in aviation safety. Simply put, weather ra- of radio waves. Radar was developed to track dar is the best tool that meteorologists have aircraft in flight and was first widely used during Rto predict general precipitation and to develop World War II. short-term forecasts of severe weather. During the war, radar operators noticed that A weather radar display provides a compre- their equipment detected not only aircraft but also hensive picture of the weather in real time. For areas of precipitation. This presented a problem be- aviation interests, radar provides a depiction of cause the display of enemy airplanes could be lost weather hazards such as thunderstorms in detail in the “clutter” that resulted when the radio waves unavailable from any other source. were reflected by raindrops. However, meteo- Radar and aviation go way back. The rologists looked at this “problem” differently and term radar is an acronym derived from radio foresaw radar as a tool for detecting precipitation.
The CSU-CHILL Showing National Weather Radar Facility in Greeley, Colorado, Where features a nine-meter parabolic dual-offset reflector antenna Not to Go housed inside a protective, air- supported dome. Radar plays a lead role in forecasting severe weather.
BY ED BROTAK John Eisele Colorado State University State John Eisele Colorado Patrick Kennedy Colorado State University Kennedy State Colorado Patrick
24 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 AVWEATHER
By 1943, the military was successfully us- higher or more intense rainfall rates. means that a heavy snow equates to a ing radar to monitor areas of rain and to So, in addition to position and display, light to moderate rainfall. make short-range weather forecasts. the intensity of the precipitation can be The radar itself cannot discern the After the war, experimentation depicted. difference between rain and snow. The with surplus military radar equipment radar displays often seen on television, was begun to determine if radar could Color Coding which show snow in a different color, be useful in the burgeoning science of On the old monochrome radar screens, have been augmented with additional weather forecasting. In the late 1950s, the higher precipitation intensities would information. Weather Surveillance Radar System was show up simply as brighter echoes. As ra- Clouds are not detected by radar. set up in the United States with approxi- dar technology advanced and the displays The droplets or ice crystals that make mately 60 sites. The radar equipment was featured higher resolutions, the echoes up clouds are too small to reflect the updated, and more sites were added in were colorized to make differences in microwave energy. Interestingly, radar the 1970s and again in the 1990s. precipitation intensity more obvious. can detect flocks of birds or bats, and at Today, more than 150 radar sites The colors seen on a standard radar times even swarms of insects, which are operated by the U.S. National Weather display today correspond specifically to all better reflectors than clouds. Service (NWS) provide radar coverage the returned energy, technically as mea- Using radar equipment for forecast- for most of the country. sured in dBZ, or decibels of Z (a radar ing is a fairly straightforward process. term). The range of colors and their as- Meteorologists observe an area of pre- Echo Location sociated dBZ levels typically are shown cipitation over time and determine its The principle of radar is simple. A pulse in a legend on the side of the display. speed, direction of movement and any of electromagnetic energy — micro- For example, Figure 1 (p. 26) is the changes in intensity. (Precipitation sel- waves are used today — is transmitted base reflectivity image recorded by the dom simply develops over any particular from the radar site. The radar trans- radar site in Sterling, Virginia, at 0248 region. Usually, it moves into a region.) mitter does a 360-degree sweep while coordinated universal time on June 30, Once the speed, direction and intensity emitting microwaves at a constant 2012. Clearly depicted is a wavy line of trend are known, a continuity forecast elevation angle (usually 0.5 degree). red echoes with a maximum reflectivity can be made by projecting further When a portion of the energy hits an of 62 dBZ. This is the extremely power- movement of the precipitation area. object, it is reflected back to the radar ful derecho squall line system that Meteorologists can use this process to antenna. How much energy comes moved through the area that evening. forecast precipitation for the next several back and from where are recorded. The Winds at Washington Dulles Interna- hours. Short-term forecasts for severe object’s distance from the radar site can tional Airport gusted to 62 kt. storms actually can be done by comput- be determined by measuring the time For practical purposes, the display ers linked to the radar equipment. it takes for the energy to be transmitted colors correspond to rainfall rates and and to return to the antenna. to storm intensity. Blues and greens in- Cones and Clutter The reflected energy is reproduced dicate light rain. Sometimes, although There are some problems and limita- electronically on the radar screen to show it shows up on radar, this rain does not tions in using radar for short-term the object’s relative position and distance. even reach the ground and is known as forecasting. Precipitation directly above The displayed object is called a radar virga. Yellow, orange and red corre- the radar site and in the immediate sur- return, or more commonly an echo. The spond to heavier rainfall, likely associ- roundings cannot be detected; the radar image shown on a standard radar display ated with convective activity. beam does not travel upward through is called the base reflectivity. Snow can be detected by radar, but this so-called cone of silence. Radar is capable of detecting pre- it does not show up as well as rain. The Microwaves cannot penetrate solid cipitation more than 200 mi (322 km) crystal structure of snowflakes does objects; thus, we have the problem of away. Raindrops are excellent reflectors not provide a good reflective surface. ground clutter. Nearby buildings and of electromagnetic energy. The larger And snow has lower water content. The even distant mountains reflect the elec- the raindrop, the greater the reflection. old rule of thumb that 10 in (25 cm) tromagnetic energy. The resulting false Larger raindrops are associated with of snow equals 1.0 in (2.5 cm) of water echoes can be deleted automatically
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 25 AVWEATHER
Base reflectivity image from Sterling, VA 0248Z June 30, 2012 Certain atmospheric conditions, such as temperature inversions (warmer air overrunning colder air), can cause the transmitted microwaves to bend or re- fract, rather than move in straight lines. Similar to a mirage, surface objects can appear on the radar screen to be airborne. This situation often develops at night and explains the false echo area that engulfs the radar site.
Storm Detection Thunderstorms always have posed a tremendous threat to aviation. As men- tioned earlier, the idea that radar could be used to detect and track thunder- Source: U.S. National Oceanic and Atmospheric Administration storms was recognized almost immedi- ately by the aviation community. In the Figure 1 late 1940s, in addition to the establish- ment of ground-based sites, on-board Base reflectivity image from Oklahoma City, OK 2356Z May 3, 1999 radar equipment began showing up in aircraft. By 1964, all passenger airplanes in the United States were required to have on-board radar systems. Today, weather radar equipment also is stan- dard at major air traffic terminals. Interestingly, radar cannot directly tell where thunderstorms are occur- ring. It cannot detect electrical activ- ity (although some modern on-board systems now have “lightning-detection” capability). Nevertheless, rainfall rates in thunderstorms usually are extreme; therefore, it can be inferred that pre- cipitation cells with very heavy rainfall rates also may contain lightning and, Source: U.S. National Oceanic and Atmospheric Administration more importantly, extreme turbulence. Figure 2 Most standard radar displays use red to indicate echoes that likely came from the radar display, but any real Because of the tilting of the trans- from a thunderstorm. Also, if there is precipitation behind the clutter does mitter, as well as the curvature of the a possibility that thunderstorms are not show up on the screen. To allow earth, the maximum range of precipita- within range, the horizontal sweep for this, the radar transmitter is tilted tion detection is about 100 mi (161 km) can be stopped, and the radar can be slightly upward. This creates its own for most precipitation and 200 mi (322 aimed at the potential thunderstorm problem, however, because the radar km) for intense precipitation. cell to scan it vertically. This provides beam can overshoot areas of precipita- Anomalous propagation is another cloud top information that can be tion that are far away. effect that can produce false echoes. used to determine possible electrical
26 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 AVWEATHER
activity and turbulence. The higher the analysis. As was determined, whenever wind shear (ASW, 10/09, p. 12). Warn- cloud top, the greater the likelihood a line of thunderstorms curves, or bows ings can be issued when the charac- of lightning and strong turbulence. out, there likely are strong winds in the teristic vertical radar profile of a pulse Cloud top information also can be bowing part of the line. storm is detected. used by pilots to determine if flying As shown in Figure 1, the system At times, the outflow boundaries, over the storm is feasible. that affected the Washington area or gust fronts, from convective weather Hail produced by thunderstorms displayed the bowing characteristic. systems — which also can contain poses a tremendous threat of damage to In fact, this system had developed 12 strong low-level winds and wind shear aircraft. It also is indicative of extreme hours earlier in Illinois and had moved — shows up on radar. updrafts and strong turbulence. Hail southeastward during the day, continu- The strongest of all thunderstorms, has a very high reflectivity. A dBZ value ously producing bow echo thunderstorm the supercell, also has a distinct radar over 60, which shows up as purple on lines and associated strong winds. Radar image. Figure 2 shows the base reflec- the display, indicates large hail. clearly showed this, and advanced warn- tivity image produced by the Oklahoma Bow echo squall lines frequently ings certainly prevented more casualties City radar site the evening of May 3, produce the strong winds that can gen- from occurring. 1999. This massive supercell thunder- erate the extreme low-level wind shear Among other aviation hazards storm had a telltale appendage, the that is so dangerous to aircraft taking that can be detected by radar are pulse classic hook echo, indicative of strong off and landing. The phenomena of bow thunderstorms, which can quickly pro- winds, large hail and, in this case, a echoes were discovered through radar duce strong downdrafts and dangerous devastating F5 tornado.1
Stop putting aircraft and people on hold The Safegate Effect
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 27 AVWEATHER
Base velocity Doppler image from Sterling, VA 0248 Z June 30, 2012 classic example is the change in pitch of a train whistle as it approaches and then passes the station. The sound waves are impacted by the movement of the train relative to the listener. In radar application, the micro- waves reflecting off a moving target change frequency as they come back to the radar site. This change in frequency can be measured and is proportional to how fast the target is moving toward or away from the radar receiver. Simply stated, Doppler shows which way the air is moving relative to the radar site and how fast it is moving. Color is used to make the Doppler Source: U.S. National Oceanic and Atmospheric Administration display easier to interpret. Winds blow- ing toward the radar site are depicted Figure 3 with “cool” colors such as green and blue, and are given negative values. Base velocity Doppler image from Oklahoma City 2356Z May 3, 1999 “Hot” colors such as yellow and red indicate air moving away from the site and are shown as positive values. Figure 3 is the base velocity Doppler product from the Sterling radar site. As the squall line passed over the site, strong winds from the west-northwest were blowing toward the site and away from the site to the east. The strongest depicted velocities were in the 60- to 70-kt range. In addition to the depiction of strong winds, Doppler can be used in other ways to detect severe thunderstorms. Rotation is a characteristic of most strong to severe thunderstorms. Doppler can detect such Source: U.S. National Oceanic and Atmospheric Administration rotation from “couplets” of airstreams Figure 4 moving toward and away from the site in close proximity. This is depicted on the Doppler Effect precipitation. True Doppler displays radar screen as a hot color next to a cold Doppler is a term we often hear seldom are used. color. The faster the air is moving, the today when describing radar sites or Doppler’s primary purpose is the stronger the rotation and the more likely radar displays. It can be misleading. detection of potentially severe thunder- the storm will be strong to severe. The Doppler component is just one storms. The Doppler effect, or Doppler Figure 4 shows the Doppler image of many capacities that most new shift, is the change in frequency of a from the Oklahoma City storm. The radar sets have. It has nothing to do wave when there is movement between blue pixels next to the orange pixels with the detection and tracking of the wave emitter and receiver.2 The indicate its intense rotation.
28 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 ‘I’ve been in the captain’s seat myself when things go catastrophically wrong, and Richard’s
Relative velocities recorded from previous description of a well-trained crew acting to save storms are stored in the radar site’s computer lives gives a unique insight into how experience and used for comparison with current readings. When certain storm elements such as a mesocy- and judgement can avert a disaster. Anyone who clone or tornado vortex signature are detected, has flown, or is about to fly should read automatic warnings are generated. This is the origin of the now familiar phrase “Doppler- this remarkable story.’ indicated” severe weather. Meteorologists no longer have to wait for severe weather to actually CHESLEY ‘SULLY’ SULLENBERGER be observed before warnings are issued. Doppler radar presented another major breakthrough for aviation. Back in the 1970s and 1980s, a number of fatal aircraft accidents were caused by wind shear associated with in- tense thunderstorm downdrafts or microbursts. Doppler radar usually can detect this type of wind shear, but only if it is fairly close to the radar site. Microbursts can be detected out to about 20 mi (32 km). The NWS Doppler radar network estab- lished in the late 1980s and early 1990s left many areas without coverage. As mentioned, however, a number of major terminals have installed their own Doppler radars. Today, there are 45 termi- nal Doppler weather radar sites in the United States, and many aircraft are equipped with on- board Doppler radar wind shear sensors. An important consideration mentioned in the July issue of ASW (“Weather Warning,” p. 11) is to always check the time on a display of radar infor- mation. In particular, mosaic images derived from multiple Next Generation Radar (NEXRAD) sites may be as much as 20 minutes older than indi- cated on the display. This can be especially crucial for convective situations in which thunderstorms move at speeds of 50 mph.
Edward Brotak, Ph.D., retired in 2007 after 25 years as a professor and program director in the Department of Atmospheric Sciences at the University of North Carolina, Asheville.
Notes
1. F5 is the highest rating on the Fujita-Pearson Scale, indicating wind velocities greater than 261 mph and capable of causing “incredible damage.” Purchase your print copy at 2. The effect was hypothesized in 1842 by Austrian qf32.aero or download physicist Christian Doppler. the ebook from any FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 major ebook retailer
HALFPG_VERT_QF32 FA.indd 1 8/08/12 10:04 AM 30 | From Bad to Worse Aviation Training Conference and during his presentation at World the differentseveral ways,” Littman said icingin-flight can aircraft affect in manager, FlightSafety International. says Dan Littman, dynamics flight mission and automation management, today’s heightened attention to pilots’ The advancestypes. fit well into also aircraft on icingin-flight specific effects U FLIGHTTRAINING BY WAYNE ROSENKRANS |FROMORLANDO during flightsimulatorscenarios. accretion becomecrystalclear Threats from in-flightice “The natural“The phenomenon of pilot awareness of potential holds promise for reinforcing simulation training devices pgrading inflight scenarios certified for inknown flight certified icing and/ any of But this. ifyour airplane is not —you’llit used to needs be never see — and [you] equipment the use when for inknown flight is certified icing that causes …If astall. your airplane ice on leading the edge of wings the crew.flight It is [only in-flight] the upsets abrupt can be and the surprise do get ice,on particularly wings, the turned off, disabled or absent. If you in icing conditions with protection the slowly iceifflown collect enoughwill Florida, U.S., inApril. “Any aircraft Tradeshow (WATS 2012)inOrlando, FLIGHT FOUNDATION SAFETY (7.6-cm) coating of iceacross entire the together, and you say there is a3.0-in said. “If you throw relevant [the data] issue inlargeary transport airplanes, he now is regarded as anegligible/second- ly weight the of accreted ice. The weight hampered inthat considered they main- —butscenario historically, models were icing conditions —preferably inabrief increase pilot awareness of operating in [airflow], not weight the that it adds.” trouble with iceis what it to the does or disabled, watch then out. …The or your ice protection is turned off Robust to icing used models can be |
WORLD AEROSAFETY | SEPTEMBER 2012
© CAE Inc. disabled aircraft ice- tail–shaped rime-ice on theleadingedge protection systems. section inanicing flight icingeffects of anairplanetail accretion formed Above, alobster of deselectedor research tunnel. could represent rare scenarios simulating in- Left, updated methods of su ofcase Air France [Flight] 447(ASW, inoperative; was this acontributing factor inthe powered controls. flight And sensors can become for particularly graded, aircraft that have manually increases. The controllabilityspeed de- can be aircraft can The decrease. inflight. thrust The stall can increase, is which retarding the force on the …The of drag determine severity the effects. the shape and location of iceon the aircraft the which tant,” Littman said. “However, it is quantity, the principalthe hazards. risk. Twothe properties of icenormally create crewsflight must familiar be with managing as morenized of athreat aircraft, to smaller all [of 155,500lb (70,533kg)].” is 0.26percent of maximum the weight takeoff would weigh 403lb [183kg],” Littman said. “That cross-sectional area 737-800,it of a[Boeing] “the droplet-size that means spectra, on average, ture of air the rank first. Next, Littman said, are crew flight and is the which flying tempera the - water suspended atmosphere inthe through in order of significance. The amount of liquid bytermined factors, several listed can which be than of The freezing. severity iceaccretion is de- — or supercooled and surface a collecting suspended liquid water The prerequisites for are icing in-flight to occur Basic Factors aircraft is operated being correctly.” icingin-flight is] just not really aproblem ifthe of ice-protection powerful systems. [for So them, canwhich generate lots of power kinds all to run inmostwhich have cases lots of excess thrust, prone to pick up ice. have …They big engines, are they just simply efficiency; notcollection as [airfoil] leading edges means have they alow anyto collect iceat The all. large radiiof their planes] go, colder the air the has for to be [them] atfly airspeeds higher and faster …the [air icing conditions most of time,” the he said. “They FLIGHTSAFETY.ORG sceptible to in-flight icing. “They cruise above cruise sceptible to icing. in-flight “They Large commercial are jets airplanes the least “Accretion rate of impor iceis the certainly Although icingrecog in-flight has- been |
WORLD AEROSAFETY droplets —that are colder both | SEPTEMBER 2012 8/12,p. 14).” - - aircraft, have inconsistent sometimes been or simulation of for particularly icing effects, smaller equipment“[Original manufacturers’] data for increases …that just isn’t case,” the Littman said. were represented by huge and unrealistic weight lations not-so-distant inthe past, icing effects simulators have lacked realism. “[In]simu legacy - Some previous attempts at icing in scenarios Simulations Legacy ed areas.ed This can result inunforeseen effects.” … In SLD conditions, icecan form aft of protect- diameter]; it is most the dangerous form of icing. authorities as droplets larger than 40microns in … [SLD] is arare condition by [defined U.S. aerodynamicthe performance of aircraft. the I would ‘hazardous.’ call It can seriously degrade ice,’”‘bad he said. “Clear ice, on other the hand, from eachcategory. “[We] ice]the [rime call fornology training reinforces relative the threat and clearof [ice]at spectrum the other.” the tends acontinuum to be with [ice]at rime one end or SLD,” Littman said. “In reality though, icing conditionspecial supercooled we call large droplets Fahrenheit] and droplets the are and larger; a then freezing markthe [0degrees Celsius, 32degrees called colder andbe dropletsclear the [also ice smaller; into categories ice, of “rime surfaces. flying his description was of limited effects to some propellers) or sensors,” the he said. For brevity, enginethe air or inlets propellers the (ifit has ways, it airframe whether components be or differentfect of parts aircraft the indifferent much? What is shape? the And how rough is it?” about. Lastly, accrete, icedoes the when how of whatever of part aircraft the you’re talking refers mainly to radius the of leading the edge The collection of efficiency surface, the which airspeed, how fast are you through flying this? Is small? they it auniform mixture? [Then] true how big are droplets? the Are large? they Are FlightSafety International’s simplified termi- Pilot training typically groups icing in-flight The location, shape and roughness “af- glaze ice] , where air the tends to closer to be where air the tends to FLIGHTTRAINING
|
31
U.S. National Aeronautics and Space Administration, Glenn Research Center FLIGHTTRAINING
nonexistent — and the simulation effects The development strategy has been to that means that the air has to be colder are usually pretty benign.” move away from a top-down, cause- before you can actually get icing.” In response to audience questions, to-effect simulation concept in which Littman acknowledged continued dif- specific data inputs to the flight simula- Boundaries of Reality ficulties obtaining a complete in-flight, tor, defining ice accretion on a percent- These training scenarios occur in visible icing-effect data set for some simula- age scale, would produce only a generic moisture at or below 22,000 ft pressure tors, typically those for the smaller air- result for a selected intensity. altitude. “The chances of icing occur- craft used in commercial air transport In contrast, the latest model focuses ring above that altitude are pretty small and business aviation. on the two levels: a bad ice/50-percent because there is just not that much He also agreed that strong precau- icing intensity level and a hazard- water in the air above 22,000 ft,” he said. tions to prevent negative training in ous ice/100-percent icing intensity “Leading-edge ice causes early flow simulators about this subject must be in level. “The model should allocate the separation on the wing upper surfaces, place. “I didn’t have time to talk about distribution of ice according to what is and the angle-of-attack increases. It re- tailplane icing or aileron snatch, such unprotected or under-protected on the sults in a reduction of the maximum lift as befell the ATR[-72] over Roselawn, airframe,” Littman said. coefficient [CLmax]; in other words, the Indiana [U.S.], in 1994 because those Using one of these two selectable maximum lifting efficiency of that wing topics get a little bit involved,” he said. intensities in the model, the time allotted is reduced when you have ice on the “[Negative training] is an issue — for the selected effects in the in-flight leading edge. The effect of that is that which led me to try and come up with icing simulator session can vary between the stall speed goes up. … [However,] something to address it. But there’s still five minutes and 20 minutes. “Anything ice on the leading edge usually has little more work to be done.” less than five minutes is just really too effect on the lift prior to the stall.” His company’s design philosophy fast to be the least bit realistic,” Littman These implementations of icing- aimed for what he called a new and im- said. “Anything more than 20 minutes is effects data sets use U.S. National proved aircraft icing model. “There are probably too long to be used in a train- Aeronautics and Space Administra- a large number of difficult-to-predict ing session. So yes [in reality], you can tion research involving a scientific- [atmospheric] variables,” Littman said. get ice in less than five minutes, and it instrumented de Havilland DHC-6 can accrete for longer than 20 [minutes], Twin Otter and wind tunnel experi- but in terms of bounding it for a training ments. Artificial shapes representing session, we chose that range.” wing leading-edge accretions of rime Evaporative cooling effects in high ice and clear ice for various periods humidity tend to lower the temperature of time generated the data sets. For required before supercooled droplets example, these data show in part that will freeze on a surface with a tempera- two minutes of clear ice has roughly ture below freezing. The icing effects in the same aerodynamic effect as about the simulator, therefore, ideally should 17 minutes of rime ice, Littman said. reflect the quantity of ice accreted on the Graphs of the data (Figure 1) showed Rime ice specific component, but few simulations that in the most severe in-flight icing currently account for this. “The model’s condition simulated — about 22 minutes [lift coefficient] curve also includes the of clear ice accretion — the wing’s effects of evaporative cooling at 100 CLmax deteriorates to about 0.65. For percent relative humidity,” Littman said. the bad ice/rime ice condition, CLmax “Icing usually occurs in a cloud. … Also, is just below 1.0. By comparison, a clean the maximum outside air temperature wing — that is, one free of ice contami- for ice accretion is a decreasing func- nation — attains a CLmax of 1.33 in the tion of true airspeed. The faster you go, tables integrated into the simulation. Clear ice the more aerodynamic heating you get The simulation overcomes the
because of friction against the air, and former benign portrayal of practical and Space Administration National Aeronautics Illustration: U.S. Susan Reed,
32 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 FLIGHTTRAINING
consequences. “The stall, when the wing has ac- In-Flight Icing Effect Simulation — Reduced Maximum Lift creted ice, will tend to be abrupt and asymmetric
… because the ice is not going to be uniform 1.6 across the span of the wing,” he said. “It’s almost 1.4 a 100 percent chance that one wing will [stop 1.2 generating lift] before other one does because the shape won’t be exactly the same all the way 1.0 ) across. When it does let go, it is going to tend to L 0.8 let go quickly. The stall warning system may not 0.6 necessarily provide — and in many cases does 0.4 not provide — advance notice of an impending 0.2 stall with ice on the wing.” Lift coe cient (C 0.0 The simulation also now reflects that −0.2 in-flight icing has much less effect on a wing Clean wing −0.4 50% ice scenario with an extended leading-edge device. “So, in a 100% ice scenario simulator, you might have ice accreting on one −0.6 −5 0 5 10 15 20 or both wings; the leading-edge devices would Wing angle-of-attack (degrees) be retracted or not there at all,” Littman said. “For 50 percent icing … the [CLmax] is reduced Note: The lift coefficent is equal to the lift divided by the quantity comprising air density times half the velocity-squared times the wing area. By varying velocity, air density and/or wing by 20 percent. That [results] in a 12 percent stall area in a wind tunnel, lift and lift coefficient — which has no unit of measurement — can be speed increase. … For 100 percent icing, CLmax calculated to compare ice effects among wing shapes with/without ice contamination. For training purposes in flight simulators, the 50-percent ice scenario represents rime/”bad” ice is reduced by almost half, which means the stall accretion and the 100-percent ice scenario represents clear/”hazardous” ice accretion. speed goes up by 39 percent. …When you get to Source: FlightSafety International the stall, there [will] be a pronounced wing drop Figure 1 because that is what will most likely occur in the real world if this happens.” In-Flight Icing Effect Simulation — Drag Increase
Readily Apparent Drag 0.1200 Drag caused by ice on the wing varies with angle- 0.1000 of-attack. “Ice on the wing affects drag at any 0.0800 angle-of-attack, more so at higher angles,” Litt- ) D man said. “Also, drag on the aircraft can increase 0.0600 ( ∆ C when there is ice on components other than the 0.0400 wing. The simulator model should apportion the 0.0200 100% ice scenario Drag coefficient difference drag increases among the airframe components 0.0000 50% ice scenario according to their various ice-protection states. In -2-4 0 2 4 6 8 10 12 other words, ‘Is the ice protection turned on? Is Wing angle-of-attack (degrees) it turned off? Is that part of the aircraft protected Note: For training purposes in flight simulators, the 50-percent ice scenario represents at all?’” Relevant icing-effect data (Figure 2) also rime/”bad” ice accretion and the 100-percent ice scenario represents clear/”hazardous” ice accretion. “Even at the minimum drag condition, the drag increase for the ‘hazardous ice’ is show that at the 100 percent/hazardous condi- much greater,” said Dan Littman of FlightSafety International. tion, the drag increase is “much higher, much Source: FlightSafety International sooner” as the angle-of-attack increases, he said. Figure 2 Several of FlightSafety International’s icing simulations currently represent the drag this extended landing gear. “It becomes very appar- way. The data sets include the relative drag ent,” Littman said. “You have to really add lots of contributions when ice accretes on the fuselage, thrust just to keep it flying when you get to the the horizontal tail, the vertical tail and/or the 100 percent ice condition.”
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 33 34 | Double CAUSALFACTORS brakes andthrustreversers failedtodeployonlanding. A 757overranashort,contaminatedrunwayafterthespeed BY MARKLACAGNINA had prevented brakes speed the from extending a manufacturing inaclutch defect mechanism (NTSB) said that investigation the that revealed U.S.the National Transportation Safety Board (Wyoming, U.S.) In Airport. itsreport, final 2010, incident, at occurred which Jackson Hole damage to airplane the during 29, Dec. the snow.deep endthe of wet the runway and mired became in tion, 757-200—ran airplane the off —aBoeing oncally touchdown. adequate Lacking - decelera T There were no injuries and only minor speed brakesspeed had not extended automati- on command and didnot notice that the failurethe of reversers thrust the to deploy he pilots were and distracted by confused Whammy a situation brakes speed the donot inwhich “inadequate pilot training for recognition of during incident the fied investigation included reversers. thrust the distraction resulting from nondeployment the of mation that deployed had indeed they and the callout brake of speed extension without confir Contributing factors were captain’s the reflexive were cited as probable the causes of incident. the monitor and brakes extend speed the manually” touchdown. on-wheels “ground” was interrupted signal on become locked intransit weight- the when and that reversers thrust the momentarily had The report said that safety issues identi- The clutch and defect captain’s the “failure to FLIGHT FOUNDATION SAFETY |
WORLD AEROSAFETY | SEPTEMBER 2012 -
© Rick Colson NewFlight Charters CAUSALFACTORS
automatically deploy as expected after land- (1,200 m) visibility in light snow, winds from ing; lack of an alert to warn pilots when speed 190 degrees at 6 kt, a broken ceiling at 400 ft brakes have not automatically deployed dur- and an overcast at 1,000 ft. The active runway, ing the landing roll; lack of guidance for pilots 19, was wet and contaminated with snow; of certain Boeing airplanes to follow when an braking action was reported as “good” on the unintended thrust reverser lockout occurs; lack first two-thirds of the runway and as “poor” on of pilot training for multiple emergency and the last third. abnormal situations; and lack of pilot training emphasizing monitoring skills and workload Speed Brakes Armed management.” The airplane’s landing weight was 194,055 lb The NTSB made several recommendations (88,023 kg), or 3,945 lb (1,789 kg) lower than urging the U.S. Federal Aviation Administration maximum. Planning to touch down within to address these issues. (The recommendations 1,000 ft (305 m) of the approach threshold and will be discussed in the October issue of ASW.) to stop the airplane within the first two-thirds of the runway, the flight crew armed the speed ‘Special Airport’ brakes for automatic deployment and selected The 757 was en route to Jackson Hole as the “MAX AUTO” autobrake setting. American Airlines Flight 2253 from Chicago, The report indicates that the crew conducted with 179 passengers and six crewmembers the instrument landing system approach to Run- aboard. The captain had 19,645 flight hours, way 19. The 757 touched down firmly about 600 including 10,779 hours in 757s. The first officer ft (183 m) from the runway threshold. According had about 11,800 flight hours, including 3,582 to the flight crew’s performance calculations and hours in type. a study conducted by investigators, the remaining The airline had designated Jackson Hole 5,700 ft (1,737 m) of runway should have been (JAC) as a “special airport” because of its chal- sufficient to complete the landing with all systems lenging landing conditions, and both pilots had operating normally (Figure 1, p. 37). completed the extra training required to operate However, “the first officer (the pilot flying) there. Moreover, the captain had flown to JAC reported that he tried to deploy the thrust re- about 400 times. The first officer told investiga- versers promptly after touchdown, but they did tors that he had made frequent flights there, in- not initially deploy,” the report said. “After the cluding four with the captain during the month first officer made several attempts to deploy the of the incident. thrust reversers, the captain took over the thrust The airport is located at 6,491 ft in the Rocky reverser controls and eventually succeeded in Mountains of western Wyoming and has one deploying the thrust reversers with about 2,100 runway, 01/19, which is 6,300 ft (1,920 m) long. ft [640 m] of runway remaining.” The pilots told investigators that the runway is Recorded flight data indicated that the thrust usually slippery during the ski season and that reversers deployed fully about 18 seconds after high landing weights are common when operat- the airplane touched down and that full reverse ing at the airport. “As a result, they said they thrust was developed 10 seconds later. were especially vigilant and began preparing for Both pilots told investigators they were not the approach and landing at JAC early during aware that the speed brakes — six panels atop what they described as an uneventful flight,” the each wing — had not extended until the air- report said. plane came to a stop beyond the departure end During the flight, the pilots obtained sev- of the runway. “The pilots could have manually eral updates on the weather conditions at the extended the speed brakes at any time during airport. As the 757 neared JAC in late morning, the landing roll, had they recognized the nonde- weather conditions were reported as 3/4 mi ployment,” the report said.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 35 CAUSALFACTORS
reversers immediately after touchdown. … Boeing 757-200 Because of the precise timing of these events, a rare mechanical/hydraulic interaction occurred in the thrust-reverser system, and the thrust re- versers were locked in transit instead of continu- ing to deploy.” The thrust-reverser system on 757s and 767s equipped with Pratt & Whitney engines has a “sync-lock” mechanism that is intended to prevent the translating sleeves from extend- ing accidentally due to a fault in the system. “This lockout would prevent movement of the thrust reversers until about 5 seconds after a pilot moves the reverse-thrust levers back to their stowed position, allowing the thrust
© Lasse Fuss/Wikimedia reverser system to deactivate and begin deploy- ment again when commanded,” the report said. n the mid-1970s, Boeing began the development of a fuel-efficient, “During post-incident interviews, both pilots twin-engine, advanced-technology replacement for the three- engine 727, which was introduced in 1963 and set a sales record of indicated that they were unaware of a circum- I stance in which the thrust reversers could be more than 1,830 units before production was discontinued. The 727’s replacement, the 757-200, was introduced in 1982. locked in transit and were unaware of the ac- The narrowbody airplane can accommodate 178 to 239 passengers. tions needed to correct the situation.” Another model, the 757-300, was introduced in 1998 with a longer Investigators found that many other 757 fuselage designed to accommodate 243 to 280 passengers. and 767 pilots were not aware that this situation Powered by Pratt & Whitney PW2037- or PW2040-series engines, or by Rolls-Royce 535-series engines, the 757-200 has a maximum takeoff could occur. “The potential for this type of event weight of 230,000 lb (104,328 kg), a normal cruising speed of 0.80 had not been identified before this incident,” the Mach and a maximum range of 2,980 nm (5,519 km). report said. “As a result, Boeing’s 757/767 guid- After a production run of 1,050 airplanes, the last 757 was deliv- ance did not contain related guidance.” ered in November 2005. Standard operating procedure required the Sources: Boeing, Jane’s All the World’s Aircraft, The Encyclopedia of Civil Aircraft pilot monitoring — the captain in this case — to observe speed brake, thrust reverser and autobrake operations during the landing roll. Erroneous Callouts Automatic deployment of the speed brakes is in- Investigators found that the 757’s air/ground dicated in part by movement of the speed brake sensing system, which is based on proximity handle, which is on the middle left side of the sensors on the main landing gear, transitioned center console. Green “REV” annunciator lights, from “air” to “ground” when the airplane one for each engine, illuminate on the engine touched down. About one second later, however, indicating and crew alerting system (EICAS) the system cycled back to the air mode for about when the thrust reversers deploy fully. a half second. This likely occurred when one “Specifically with regard to the speed brake or both of the main gear unloaded after touch- lever, the procedures indicated that the pilot down, possibly because of a slight bounce, caus- monitoring should observe and call out the ing at least one of the proximity sensors to open. position of the speed brake lever after landing “This brief cycling of the air/ground signal and that, if the speed brakes do not automati- during a landing is not uncommon,” the report cally deploy, the captain should manually deploy said. “However, in this case, it coincided with the speed brakes (regardless of which pilot had the first officer’s attempt to deploy the thrust monitoring responsibilities),” the report said.
36 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 CAUSALFACTORS
The American Airlines 757/767 Operating Flight 2253 Overrun Manual notes that awareness of speed brake lever position is important in preventing runway excursions. “Without speed brakes deployed after touchdown, braking effectiveness may be reduced initially by as much as 60 [percent],” the manual says. Although there were no indications that ei- Approximate touchdown point ther the speed brakes or the thrust reversers had 11:37:36 MST deployed fully, the captain called out “deployed” about 2.8 seconds after touchdown and “two in reverse” 1.2 seconds later. The speed brake handle had moved slightly out of the armed position but had not contin- ued moving aft toward the extended position. “The captain’s erroneous speed brakes ‘deployed’ callout was likely made in anticipation (not in confirmation) of speed brake deployment after he observed the speed brake handle’s initial movement,” the report said. “After the ‘deployed’ callout was made, both pilots likely presumed that the reliable automatic speed brakes were functioning normally.” The slight movement of the speed brake handle coincided with the illumination of amber lights on the EICAS indicating that the thrust reversers were in transit; the green “REV” lights, Thrust reversers deployed indicating full deployment, did not illuminate. (about 2,100 ft of runway remaining) “Given the typical reliability of the thrust- reverser system, it is likely that the captain made the [‘two in reverse’] callout because he expected normal thrust reverser deployment after seeing the amber EICAS annunciation.” Despite the captain’s callout, the first officer recognized immediately that the thrust revers- ers were not functioning normally. Both pilots then “tunneled their attention on deploying the thrust reversers,” the report said. “Both pilots were distracted by, confused by, and trying to resolve the thrust reversers’ nondeployment. … Neither pilot was able to broaden his focus enough to look at the big picture and notice that the speed brakes (the Final location 400 ft more crucial deceleration tool) had not deployed.” 11:38:30 MST 100 m
Noting that multiple emergency situations Illustration: Moore Jennifer typically are not presented during pilot train- Source: U.S. National Transportation Safety Board ing, the report said, “If the incident pilots had received specific pilot training on the handling of Figure 1
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 37 CAUSALFACTORS
Speedbrake Assembly
Speedbrake lever
Auto speedbrake actuator
FWD
No-back clutch
Side view Front view Illustration: Susan Reed
Note: Investigators found that automatic deployment of the speedbrakes on the accident airplane had been prevented by a lever braking pin in the clutch mechanism that had not been secured properly during assembly.
Source: U.S. National Transportation Safety Board
Figure 2
multiple emergency or abnormal situations, they “Specifically, one of the four speed brake le- might not have focused exclusively on the thrust ver braking pins was improperly secured, which reverser nondeployment and might have been allowed it to intermittently rotate within its more likely to recognize and properly resolve the assembly and prevent the clutch from transmit- speed brake nondeployment during the landing.” ting the torque from the automatic speed brake actuator to the speed brake lever,” the report Speed Brake Defect said. “Further, it was noted that this defect only Initial examination and testing of the automatic affected the speed brakes’ automatic deployment speed brake system revealed nothing that could function and would not have prevented the pi- have prevented normal operation. However, lots from manually deploying the speed brakes.” about three months later, the speed brakes again The manufacturing defect can be found only failed to deploy automatically; the flight crew by disassembling the clutch, which is not re- in this case noticed the failure and manually quired during normal maintenance. “As a result deployed the speed brakes. of this investigation, the manufacturer clarified After this incident, the system was removed its documentation to ensure proper assembly of and examined again. This time, investigators the clutch units,” the report said. found a “latent assembly defect” in the clutch This article is based on NTSB Incident Report AAR-12-01: mechanism that intermittently prevented an ac- “Runway Overrun; American Airlines Flight 2253; Boeing tuator from driving the speed brake lever out of 757-200, N668AA; Jackson Hole, Wyoming; December 29, the “ARMED” detent to extend the speed brakes 2010.” The report is available at
38 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 © Chris Sorensen Photography contact us flightsafety.org Fax: +1703.739.6708 Tel.: +1703.739.6700 Alexandria, Virginia U.S. 22314-1774 801 N.Fairfax Street, Suite 400 Headquarters: FoundationFlight Safety conversation LeaDing the — astrong,culture. effective globalsafety Membership intheFlight Foundation Safety isyour visiblecommitment to theaviation community’s core value each member. work Our isexemplified inthe following areas: The Foundation that achieveschallengingprojects make itsgoalsby undertaking aviation safer, thereby benefitting Individual membersrange from pilotsto accident investigators to regulators andbeyond. manufacturers, educational institutions, airports, non-profit andgovernment companies. service organizations andsupport The Foundation membershipcomprises organizations from around theworld —aircarriers, businessaviation operators, umt n eiashl rudtewrd BARS– The Aviation Basic Standard Risk Globaltraining initiatives andseminarsheldaroundSummits theworld Humanitarianefforts Approach (ALAR) andLandingAccident Reduction for safetydata confidentiality Support Media outreach [email protected] Tel.: ext. 102 coordinatormembership services Ahlam Wahdan Member Enrollment
for more than65years. Join theDiaLogue AeroSafety World [email protected] Tel.: ext. 112 and businessdevelopment managing director ofmembership M.Lausch Susan Donations/Endowments/Membership … join theFlight Foundation. Safety Email: [email protected] Fax: +611300557182 Tel.: +611300557162 Melbourne VIC 3001Australia GPO Box 3026 Melbourne VIC 3000Australia Level 6|278Collins Street ProgramBAR Standard Office 40 | Flight Path-ogens Flight An SMS is a defense against safety An SMSisadefenseagainstsafety HUMANFACTORS pathogens, butnotacure. BY ROBERT I.BARON BY ROBERT R is clear. Although without ended they incident, The safety implication for eachof actions these • •
• A pilot flew anA pilot airplane flew with inoperative • charterjet operation: flight ecently, following the events at occurred a instructions for that model. borne, violated which manufacturer’s the spoilers air with flapsextended the while limitation by intentionally deploying the touched down down halfway runway. the A pilot an exceeded aircraft operating A pilot continued an unstable approach and radar through aline of convective activity. - corrective process. of abroader cultural manifestation, is key to the as individual aberrations,occurring or are part culture. violations the Determining whether are possibletheir relationship to organizational the violations are worth increased scrutiny due to and human everyday errors problematic, can be individual. erring the While violations both errorseveryday are beyond awareness the of his orchooses, her intended action.In contrast, in that violator the is aware of, and consciously tion is different from common errors everyday amples, pilot the committed aviolation. A viola- forespecially first two. the In eachof ex- these outcomesthe could have much been different, FLIGHT FOUNDATION SAFETY |
WORLD AEROSAFETY | SEPTEMBER 2012
© Andreas Rodriguez/iStockphoto HUMANFACTORS
‘Safety Disease’ Result: The pilot committed a routine viola- In the human body, pathogens can be defined as tion (everyone does it all the time) as a result disease-producing agents. Organizations such of a cultural pathogen. as flight departments can have their own “safety A pilot continued an unstable approach and disease” pathogens. touched down halfway down the runway. Depending on the size of the company, This pilot was highly experienced, with the dynamics of cultural pathogens may vary over 10,000 hours of flight time and more considerably. For instance, in a very small than 2,500 hours in type. The company was charter operation, where the owner also flies proactive about safety and required the pilots as a line pilot, the potential pathogens may be to attend an annual refresher course on ap- “right in your face.” I once knew an owner-pilot proach and landing accident reduction. On who explained to me that “you think differently this particular approach, the pilot was being when it’s your personal wallet attached to the pressured by the passenger to land even though throttles.” This comment was in response to the weather conditions were unfavorable due my question about why he made an overweight to reported wind shear. However, during the takeoff (the fuel was a few cents a gallon cheaper approach, the high-profile passenger told the than at the destination airport). pilot that he would “take good care of him” if On the other hand, in larger operations, he could assure an on-time arrival. The pilot there may be more levels of separation between succumbed to this incentive and consequently upper management and line pilots. In these cas- made an unsafe landing decision. es, the pathogens may have a longer trajectory Result: The pilot committed a situational to reach the line pilots, but, perhaps beneficially, violation — an act motivated by a specific there may be multiple opportunities for mitiga- reason such as time pressure or stress. This tion or even elimination (i.e., James Reason’s act, in itself, may not be considered a cultural Swiss cheese model). pathogen; however, if it were allowed to con- With that said, let’s refocus on the violations tinue on a regular basis with the company’s committed by the pilots in the above examples knowledge, it could then be considered a — again, behaviors that can be controlled by the cultural pathogen. pilot, as he or she freely chooses the intended A pilot exceeded an aircraft operating limi- behavior. The question, then, is why were these tation by intentionally deploying the spoilers violations committed? Here are the restated with the flaps extended while airborne, which events and the answers to that question: violated the manufacturer’s instructions for A pilot flew an airplane with inoperative that model. radar through a line of convective activity. This pilot had a known history of exceed- The company had a documented history of ing aircraft operating limitations. The company flying aircraft contrary to its minimum equip- was aware of it but did not act because the ment list (MEL). Over time, this became a company’s position was that the pilot “always company norm (everyone was doing it), and got the job done, and he was reliable.” The pilot pilots were in fact encouraged to “overlook some himself felt that aircraft operating limitations of the minor MEL issues in order to keep their were always very conservative and that there paychecks coming.” was “plenty of wiggle room.”
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 41 HUMANFACTORS
Result: The pilot committed an optimizing In the first and third examples, the patho- violation (just for kicks), which was also consid- gens were propagated at the highest levels of the ered a personal routine violation (committing organization (the second was considered a one- the same violation regularly but not necessarily time individual aberration). For some reason(s), as part of a group norm). In this case there was these pathogens were allowed to penetrate the a cultural pathogen compounded by a renegade system and reach the pilots, who in turn acti- employee with his own agenda. vated them. A healthy immune system in the human body naturally helps to fend off pathogens, Neutral Boundary whereas a weakened immune system may This company did not have a functional SMS promote them. In aviation, the corporate safety in place. If it had, would it have guaranteed that culture can be considered the immune system. these pathogens would have been contained? Just as with some Just as with the human body, a healthy immune The answer is unequivocally, no. However, system will help to fight off cultural pathogens, with a functional SMS, there would have been human vaccinations, but from time to time, the immune system can a higher level of monitoring (specifically in the become weak or compromised. At these times, proactive hazard identification and risk analysis an SMS requires the pathogens may spread quickly throughout area), which in turn might have identified these the system and affect all parts of the operation, threats and inoculated the system. This is easier booster shots with line employees affected most significantly. to do in the middle levels of the organization, to fully develop where there tends to be something of a neutral SMS as Immune System Component boundary between the upper and lower levels of its efficacy. A safety management system (SMS) can be the organizational hierarchy. considered part of the organizational immuniza- What if, however, the pathogens originate at tion process. But an initial SMS vaccination is the very top of the organizational hierarchy and only the beginning. Just as with some human the SMS is not, in reality, reaching this level? In vaccinations, an SMS requires booster shots to this situation, upper-level management, includ- fully develop its efficacy. ing the CEO, are clearly focused on revenue at the Booster shots would include, but are not expense of safety. They are purely reactive (think- limited to: ing “we’ll deal with it if we have an accident”). They will do whatever it takes, at any cost, to top • Continued high-level management buy-in, the competition. How would you, as the safety visibility and support; manager, change that mindset and make upper- • Consistently scheduled safety meetings; management truly listen, buy into, act upon and • Fostering of a non-punitive reporting support the SMS and its requisite generative safety culture; and, culture? That has been one of the most vexing questions in the SMS implementation process. • Consistent and effective safety communi- cation throughout all levels. Robert Baron, Ph.D., is the president and chief consultant of The Aviation Consulting Group and an adjunct professor Conversely, if the SMS is just a “fill in the at Embry-Riddle Aeronautical University. As a consultant, blanks” program or a “book on the shelf,” the he has assisted aviation organizations in the development of system is going to be more susceptible to un- their human factors, SMS, crew resource management and line-oriented safety audit training programs. mitigated pathogens.
42 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 FLIGHTDECK
Philosophies, policies, procedures and resilience engineering — not just pilots — defend against loss of control in flight.
BY WAYNE ROSENKRANS
n the past few years, pilot qualifications to learned that crews are not all adequately trained manage abnormal situations while operat- to handle these automated systems, especially in ing large commercial jets have dominated high-demand situations,” said Dave McKenney, discourse about loss of control–in flight a captain for United Airlines and ALPA’s direc- I(LOC–I). Yet reducing the risks in this accident tor of pilot training programs, who moderated a category at the level of resilience engineering session on automation. “Most operators recog- also is essential, several subject matter experts nize that the use of automated systems may not told the ALPA Safety Forum 2012, held in always reduce the workload but in fact may ac- August in Washington by the Air Line Pilots As- tually increase it and lead to error. And when an sociation, International. automated system fails, [we have] relied on the “While the ultimate responsibility of flying human pilots to intercede and resolve the issues.
Moore; Jennifer illustration: Photo Kujansuu/iStockphoto Tuomas © photo: the airplane remains with the pilots, we have … The automated systems must be clear [as] to
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 43 FLIGHTDECK
the message and the information they provide development, Boeing Commercial Airplanes. to the pilots. The pilots need to know the status “On the [Boeing] 787 … if both engines fail, of the aircraft at all times and be able to predict you hit [FLC, flight level control], heading select what the system is doing so they can anticipate [HS] and sit there,” he said. “The autopilot stays changes that need to be made.” engaged on the RAT [ram air turbine] and the One audience member expressed a view engines go into auto-relight.” shared by others: The industry essentially ex- Current-generation airplanes typically ‘How you build pects flight crews to “intervene during any or all provide closed-loop flight control systems with malfunctions with the aircraft system through alleviations and compensations; flight directors resilience in the the use of manual flying skills” but normally integrated with the autoflight system; full-time requires pilots to engage automation from autothrottles; engine autostart; full authority system is [by giving] takeoff until a few minutes before landing, with digital engine control (FADEC); flight manage- the pilot the same minimal or no procedures to help them main- ment computers that tune frequencies in the tain manual flying skills. navigation system as necessary; engine indicat- capability as the Presenter David Woods, an Ohio State Uni- ing and crew alerting systems; automation of versity (OSU) professor currently specializing cabin pressurization and other systems controls; automatic system.’ in complexity science1 and adaptive-systems and global positioning system receiver accuracy engineering, said that this issue has been identi- far higher than 15 years ago, with robust naviga- fied and addressed since 1996 by U.S. Federal tional redundancy from technology such as ring Aviation Administration specialists and aca- laser gyros, he said. demic researchers for the National Aeronautics On such flight decks, however, further and Space Administration (NASA), and in 2012 improvements to pilot training will have to by specialists studying related issues for the complement this handover of functions to the Department of Defense. automation. “How you build resilience in the “We pointed out that de-skilling and erosion system is [by giving] the pilot the same capa- of pilot skills would contribute to difficulties bility as the automatic system,” Carriker said. in this plan, this model of safety … that it was “Then you try to encourage the pilots to fly that brittle, it wasn’t as effective as we thought,” manual system and [to] understand what the Woods said. “And it was going to become less airplane just did on the automatic system. So effective because the automation worked so when the automatic system drops, [pilots will well. … The recommendation we made back in realize,] ‘I’ve been here before. I’ve been on ap- the middle-1990s was, ‘[Pilots] have to prac- proach. … I know the pitch attitudes. … I know tice more non-routine situations. You have to how this airplane flies.’” practice handling a cascade of events. … Initial training to proficiency was getting easier and Philosophical Origins easier, but long-term growth of expertise — the From the high-level perspective, automation de- new forms of airmanship that are necessary — sign and flight path management originate from were lagging behind. … We still have not taken philosophies written by airframe manufacturers. this seriously. We have new cases of problems in Ideally, these shape operator policies, proce- this area, and it is time we moved forward [and] dures and practices as the creators intended, got proactive.” said Helena Reidemar, a first officer with Delta The airline industry often takes for grant- Air Lines and ALPA’s director of human factors. ed in 2012 the precise autoflight guidance Sometimes, however, these “4P” elements be- of large commercial jets — including their come disjointed or even conflict with each other. automated responses to non-normal situations “We’ve been seeing way too many automa- — compared with a few decades ago, said Mike tion surprise and startle issues in recent years,” Carriker, a captain and chief pilot, new airplane she said. “We need to reverse that trend, and
44 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 FLIGHTDECK
it’s time to do that at the threshold of NextGen philosophy, policy, procedures and practice [the U.S. Next Generation Air Transportation (Figure 1). “Unfortunately, we can find ourselves System]. … In [this] near-term future, we’ll be in situations where there is no overarching working with tighter tolerances, self-separation, philosophy,” Reidemar said. “And this is truly 4-D trajectory2 — we need to maintain some problematic for the pilot and the organization. manual flying skills more than anything,” Reide- Now you are in uncharted territory. Nobody mar said. “Automated systems are a tool for the wants to be there. And it is not expected in pilot — not a replacement of us as operators or normal operations. Perhaps the aircraft is doing as monitors — and we need to consider the role something unexpected that we have no mental of the automation in the overall system. Manual model for. Think Air France [Flight] 447 or flying skills — cognitive and psychomotor skills Colgan [Air Flight] 3407. The complexity of — will degrade if they are not practiced.” component interactions can truly lead to some Any effort to update an airline’s philosophy, unanticipated systems behavior.” policies or procedures with respect to automa- While anticipating further NextGen imple- tion should begin with an understanding of the mentation, taking the high-level perspective manufacturer’s formal automation philosophy, enables all responsible entities to introduce she advised. “Manufacturers’ automation phi- flight path management as “part of an elegant losophy [in two examples] is about design … it whole for [pilot] proficiency standardization — doesn’t talk about the operation and it provides coherency in the broadest sense,” she added. little guidance for training, procedures, division This effort also requires operators to be of labor, workload management,” Reidemar said. knowledgeable, considerate and highly sensi- “Then we need to work within our own organi- tive to the limitations of current and anticipated zations to fix the disconnects.” automation. “Traditionally, we have seen [the She cited the work of NASA scientist Asaf company policy of selecting] the maximum Degani3 in flow-diagram visualizations of automation available as necessary for [the] the ideal and non-ideal relationships among phase of flight,” Reidemar said. “That’s no longer
Automation Guidance to Flight Crews: Ideal Relationship and Disconnects
Practices
Philosophy Philosophy Practices Philosophy Philosophy
Policies Practices Policies Policies Policies Procedures Procedures Procedures Procedures Practices
Ideal framework for guidance Practices disconnected Practices loosely Practices disconnected from procedures directed by philosophy from guidance
Note: Helena Reidemar’s presentation adapted a flow diagram concept by Asaf Degani. “Philosophy [of flight path management] dictates policies, policies are translated into procedures and then, at the very bottom, we have practices … every activity we perform on the flight deck,” Reidemar said.
Source: Asaf Degani, U.S. National Aeronautics and Space Administration
Figure 1
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 45 FLIGHTDECK
sufficient. … [Airlines will have to] minimize the Dutch roll, for example, for the short-period the impact on the flow of traffic, and then mode of motion, for phugoid4 and to control maximize the smoothness and elegance of the the spiral, [all of] which will allow you to fly a human-automation interaction, mode switching very precise bank angle,” Lutz said. “Whether and crew interface.” it be the sidestick controller that we use [in an She presented examples of the diversity of Airbus] airplane or the manual controller in the ‘You end up being airline automation philosophies that she has Boeing 787, you also have two [flight] axes in studied. In one case, the de-identified airline one controller. Excellent HMI [human-machine a critical ingredient used automation to a minimal degree and interface provides] for force displacement and did not revisit the practice for 30 years, until rate capability, and in pitch you find that it is in making this recognizing potential savings in time and fuel basically a pitch rate command/pitch attitude complexity work that required rewriting its philosophy, policy hold. And in roll, a roll rate command and a and procedures. “So be cautious in just changing bank angle hold. every day.’ the order or flow of things,” Reidemar said. “You “We can have an airplane today [in which] need to actually back it up and support it with you can take off at maximum gross weight, have policy, so the expectation for the pilot is clear.” an engine failure and continue to rotate and take She described two airlines operating the off and the airplane will stay wings level, main- same aircraft type, the Airbus A330, but one tain its heading and allow you to climb out and with a relatively rigid culture prohibiting open operate your normal procedures after that.” descent below 1,000 ft and another with a rela- tively flexible culture prohibiting open descent Sea of Complexity below 500 ft. “So two airlines [are] operating Thinking of pilots in an abstract way — as a the same aircraft [with] significantly different flight deck subsystem notable for unique capa- philosophical differences in their automation bility in risk management and system resil- policy,” she said. iency — yields further insights into an overall LOC–I solution, according to OSU’s Woods. Appreciating History “It’s very complex what you do … extremely Debates about automation benefit from a reality complex what you manage … under fast-paced check against the old days, said Terry Lutz, a conditions,” he told pilots attending the forum captain and experimental test pilot, Airbus. “The session. “Sudden things can happen; unexpected [pilot’s] navigation and communication roles and non-routine events occur. This is the sea of are now largely automated, but the pilot still complexity that you operate in. … You end up has to do the basic aviating task,” he said. “And being a critical ingredient in making this com- a new task has been required of the pilot … to plexity work every day.” manage the overall mission. … If you look at the Within the science of complexity and resil- flying task in 2012, you realize that there is still a ience engineering, a critical concept relevant to manual skill set required. But there is now a new aviation safety can be expressed by the terms skill set, which is extensively mental, that’s also brittleness and resilience. These academic dis- required.” He cited progress in automated flight ciplines’ goals in analyzing complex adaptive controls and “thrust-by-wire” engine controls systems, he said, include identifying failures in that should factor into safety conversations the interactions, understanding/measuring how about automated flight path management. systems are brittle, and extracting lessons about “You can view the controllers in modern sources of resilience from aviation incidents or fly-by-wire airplanes as either ‘super autopi- accidents so that extra “adaptive capacity” can lot’ controllers, or you can view them as pilot be applied to future situations. controllers where the airplane itself is compen- Commercial air transport has proven to be sating for all of the undesirable motions — for a popular example to other industry sectors of
46 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 FLIGHTDECK
how people function as a hidden source recovery button.” Lutz said, “I think environment will have enough margin of resilience. “When systems fail, they from both the Airbus and Boeing of error for emergency changes of the reveal points of brittleness and they standpoint, what we are going to see … programmed flight path by pilots. “The reveal hidden sources of resilience,” in future designs is [that] even in de- coming changes through NextGen– Woods said. “There are regularities graded modes … degraded hydraulics SESAR [Single European Sky Air Traf- about how complex adaptive systems or degraded electrics or degraded flight fic Management Research] airspace, fail. … The question is, ‘Can resilience control modes, you’re going to have and the efficiencies [that authorities be engineered into organizations that some basic protections in the airplane attempt to design] into that airspace in carry out complex activities?’” that will keep you from exiting the … order to increase the density of opera- Teams of complexity scientists have normal flight envelope. I think you’ll tions are going to force us … to rely on noted since about 2000 that “the auto- also find the ability to use the autopilot automation to the exclusion of allowing mation [in air transport] creates a layer in a lot of degraded situations.” either a human pilot or a human con- of apparent simplicity over those in- He cited an existing automated troller to intervene,” one attendee said. creasing interdependent relationships, system that maintains flight control If pilots cannot turn the airplane safely between more and more parts, so that on the Airbus A380, which is both a within the constraints of the airspace, everything looks simple and runs super hydraulically controlled and an electro- “Isn’t that the most brittle system you smooth until it doesn’t,” he said. “Then hydrostatically controlled airplane. “We can imagine?” he asked. we see cascades [pilots] have to try to can switch off eight hydraulic pumps Airbus’s Lutz reiterated that fly-by- keep up with. We see tipping points, [two on each of four engines] and wire technology compensates for the rel- we see surprises. … You have to be able still fly the airplane normally on the atively imprecise human control inputs to keep up with the cascade of events electro-hydrostatic actuators and use and aircraft type–specific aerodynamic when a sensor failure [occurs,] and the autopilot,” Lutz said. characteristics. “We also have to provide you don’t know what to trust in terms The concept of a fully automated re- [solutions] on the training side so that of cockpit indications. … You have to covery system sounds great, he added, pilots can see that they can, in fact, fly maintain a control margin [so] that you but current technology may not be up the airplane in those environments,” he can act to compensate for those unex- to the task because of the complexity. said. “And if they can’t, if manual control pected or non-routine events.” “Let’s think about it,” he said. “But to is not possible, then other measures have Taking his complex adaptive system actually flight-test it and make it hap- to be taken if traffic becomes truly that resilience approach is particularly rel- pen in the situations where you want dense in NextGen.” evant to compensating for any gradual it to happen — and then go to all the de-skilling of airline pilots. “You’ve fringe cases — is very, very difficult.” Notes gotten good [in balancing safety and Boeing’s Carriker noted that one of 1. Specialists in complexity science study how efficiency] because you have adapted,” the technology-based solutions from adaptive systems work, focusing on “how Woods said. “[But] the present is more company engineers has been the adop- people in various roles learn, recognize, precarious than we think, and it’s a tion of transient-free switches between anticipate,” Woods said. common finding from all approaches normal airplane modes of operation, 2. In NextGen and SESAR planning, 4-D to safety, from an organizational which reduces the probability of situ- trajectories are four-dimensional paths — perspective, that safe organizations are ations requiring non-normal piloting. latitude, longitude, altitude and estimated constantly on edge, recognizing that “You roll the airplane and [select] a time of arrival — that aircraft take or are past success is no guarantee of future switch in the overhead [panel] that expected to take. ultra-high safety performance.” turns on the flight controls,” he said, 3. Degani, a scientist based at the NASA describing an in-flight demonstration. Ames Research Center, has applied exper- Questions and Concerns Activating that switch causes no per- tise in human interaction with computers One attendee recalled that Airbus’s ceptible tactile-feedback change such as and automated systems to aviation safety Lutz, on another occasion, mentioned a bump or a thump, he said. contexts. people imagining large commercial jets Other attendees voiced concern 4. Phugoid refers to a long-period longitudi- equipped with a “big red button, the about whether the future airspace nal oscillation in the airplane’s flight path.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 47 help us make flying safer.
Your tax-deductible contribution to the Flight Safety Foundation endowment through the Combined Federal Campaign (CFC) supports the work of aviation safety professionals worldwide.
Flight Safety Foundation (flightsafety.org) is the only non-profit organization whose sole purpose is to provide independent, impartial, expert safety guidance and resources for the commercial and business aviation industry. Practices for safe operations are researched, initiated, and actively publicized and distributed by the Flight Safety Foundation.
However, there is always more to be done. This job is never “complete.” Please consider a gift to the Flight Safety Foundation Endowment.
Ask your CFC campaign manager or human resources department how to set up your contribution. The CFC is open to Federal civilian, postal and military employees. Your tax-deductible gifts to the Flight Safety Foundation endowment can be made by check or ongoing payroll deductions during the campaign season, September 1–December 15.
Use your powers of deduction to improve aviation safety.
Combined Federal Campaign Flight Safety Foundation CFC donor code #34228 DATALINK
BY RICK DARBY Ten Million to One EASA member states had a fatal accident rate of 0.96 per 10 million flights in 2011.
he fatal accident rate for scheduled categories based on the standardized defini- passenger and cargo flights among the tions of the Commercial Aviation Safety Team- 31 European Aviation Safety Agency International Civil Aviation Organization (EASA) member states (MS) improved inT the latest 10-year survey, and in 2011 the Fatal Accident Rates, EASA Member States vs. fatal accident rate was 0.96 per 10 million Non-Member States, 2002–2011 flights.1,2 10 For the decade 2002–2011, there were EASA MS operators 3-year average Non-MS operators 3-year average 1.6 fatal accidents per 10 million flights, the 8 same rate as for North America. As recently 6 as the 2001–2010 period, the EASA MS rate 4 had been 3.3. That was influenced by the exceptionally high rate of 11.7 in 2001. EASA accidents Fatal 2 per 10 million ights member states are the 27 European Union 0 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 states plus Iceland, Liechtenstein, Norway and Year Switzerland. One fatal accident occurred in EASA MS EASA = European Aviation Safety Agency; MS = member state commercial air transport airplanes in 2011, with Source: European Aviation Safety Agency 3 six on-board fatalities. There were no fatal acci- Figure 1 dents in the category in 2010. For the 2000–2009 decade, fatal accidents averaged four per year. Proportion of CFIT, SCF-PP and LOC-I Accidents, The number of fatal accidents was as high as five EASA Member States, 2002–2011 in both 2005 and 2006. 12 The reduction in the number of fatal ac- System or component failure–powerplant 10 Loss of control–in ight cidents does not just reflect fewer flights. The Controlled ight into terrain traffic level in 2011 was similar to the one of 8 2006, the report says. EASA MS had 32 accidents 6 in 2011, versus 28 in the previous year and an 4 all accidents Percentage of Percentage average of 30 for 2000–2009. 2 The trend, based on a three-year moving av- 0 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 erage, has improved in the most recent 10-year Year period (Figure 1). The higher rate of non-MS fatal accidents, which in 2002 and 2003 ap- CFIT = controlled flight into terrain; EASA = European Aviation Safety Agency; LOC-I = loss of control – in flight; SCF-PP = system or component failure – peared to be converging with that of EASA MS, powerplant 4 has maintained a wide gap since. Source: European Aviation Safety Agency Fatal and non-fatal accidents involving EASA MS–operated airplanes were assigned to Figure 2
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 49 DATALINK
(CAST-ICAO) Common Taxonomy Team Accident Categories, Fatal and Non-Fatal Accidents, (CICTT). Controlled flight into terrain (CFIT) EASA Member State Airplanes, 2002–2011 accidents declined as a percentage of all ac- cidents in the 2002–2011 period (Figure 2, p. MAC Fatal accidents Low altitude operations Non-fatal accidents 49). “This can be attributed to technological Fuel related improvements and to increased awareness of CTOL Abrupt maneuver situations which may lead to such accidents,” Loss of control – ground Evacuation the report says. Ground collision Similarly, accidents that involve the failure Turbulence encounter Abnormal runway contact of a system or component related to the en- Runway incursion – vehicle, aircraft or person gine (SCF-PP) have decreased as a percentage Security related Collision/near collision with bird(s) of all accidents. Fire/smoke (non-impact) Since reaching a low point in 2006, loss of Undershoot/overshoot Wind shear or thunderstorm control–in flight (LOC-I) accidents have risen as Airport a percentage of total accidents, and now exceed Runway excursion Air tra c management SCF-PP and CFIT. Other Post-impact fire and smoke, and failure of a Unknown Icing system or component not related to the engine, Ground handling were also among leading categories of fatal ac- Fire/smoke (post-impact) SCF-PP cidents (Figure 3). Abnormal runway contact SCF-NP Controlled ight into terrain was the category involved in the largest number Loss of control – in ight of accidents, none of them fatal. 0 10 20 30 40 50 60 70 Like airplane fatal accidents, helicopter Number of accidents fatal accidents involving EASA MS operators EASA = European Aviation Safety Agency; CTOL = collision with obstacle(s) during takeoff and increased year-over-year (Figure 4). There were landing ; MAC = airprox/traffic-alert and collision avoidance system alert/loss of separation/ near midair collision/midair collision; SCF-NP = system/component failure or malfunction (non- two such accidents in 2011, compared with powerplant); SCF-PP = system component failure or malfunction (powerplant) none in 2010 and an average of three per year in Source: European Aviation Safety Agency 2000–2009. In non-MS operations, the number Figure 3 increased from eight each in 2009 and 2010 to 11 in 2011 — still better than the average of 13.6 from 2002–2008. Fatal Helicopter Accidents, EASA Member States and Total EASA MS helicopter accidents also Non-Member States, 2002–2011 increased, from two in 2010 to six in 2011, aver- Fatal accidents EASA MS operators Non-MS operators 3-year average aging eight per year in 2000–2009. Fatal accidents non-MS operators EASA MS operators 3-year average In contrast with airplanes, CFIT figured 20 prominently in EASA MS helicopter accidents 5 2 1 2 15 2 — particularly fatal accidents in 2002 through 4 2 2011 (Figure 5). Low altitude operations–re- 10 5 2 lated accidents (LALT) had the second-highest 5 8 15 16 11 15 14 17 9 8 11 number of fatal accidents. The report said,
Number of accidents “This occurrence category includes accidents 0 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 which occur while the aircraft is flown inten- Year tionally at low altitude, excluding the phases of
EASA = European Aviation Safety Agency; MS = member state take-off and landing.” The largest number of accidents, comprising Source: European Aviation Safety Agency both fatal and non-fatal accidents, were cat- Figure 4 egorized as SCF-NP, system/component failure
50 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 DATALINK
Another conspicuous category in helicopter Accident Categories, Fatal and Non-Fatal Accidents, accidents was CTOL, or collision with obstacles EASA Member State Helicopters, 2002–2011 during takeoff and landing. The report said that
Undershoot/overshoot Fatal accidents referred to main or tail rotor collisions with Loss of control – ground Non-fatal accidents objects on the ground. Icing Ground collision The annual safety review includes, for the Fuel related second year, a chapter on air traffic manage- External load related occurrence ment (ATM). “The sources of the data, as Abrupt maneuver Airport well as the occurrence category definitions, Unknown differ from those of other chapters,” the report Abnormal runway contact says. “Instead of CICTT categories, in similar Security related MAC figures of this report, this chapter uses oc- Fire/smoke (post-impact) currence categories developed specifically for Wind shear or thunderstorm 5 Other ATM since 2000.” SCF-PP In 2011, the largest number of ATM-related CTOL accidents was in the category of GCOL, or col- Loss of control – in ight SCF-NP lision with aircraft moving on the ground and Low altitude operations a vehicle, person or obstruction. It also was the Controlled ight into terrain 0 2 4 68 10 12 14 most common category for the years 2005–2011, Number of accidents except for “other.” The overall number of runway incursions EASA = European Aviation Safety Agency; CTOL = collision with obstacle(s) during takeoff and landing ; MAC = airprox/traffic-alert and collision avoidance system alert/loss of separation/ reported has increased during 2002–2011 near midair collision/midair collision; SCF-NP = system/component failure or malfunction (non- powerplant); SCF-PP = system component failure or malfunction (powerplant) (Figure 6). “The rate of serious incidents (se-
Source: European Aviation Safety Agency verity A) is, in 2011, at the same level as the previous year after it showed a slight increase Figure 5 over time,” the report says. “The rate of major incidents (severity B) decreased until 2009, Runway Incursions, EASA Member ATM System, 2002–2011 but the data for 2010 showed a considerable increase. However, preliminary 2011 data in- 16 130 Total Number of total incidents dicate a possible reverse, although at a higher 14 105 Severity A 12 Severity B 90 level than 2009.” 10 75 Notes 8 60 6 45 1. EASA. Annual Safety Review 2011.
Number of severity 2. Accident and statistical information was pro- 2 15 vided to EASA by the International Civil Aviation 0 0 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 Organization. Year 3. Accidents in this category involved aircraft with a ATM = air traffic management; EASA = European Aviation Safety Agency certificated takeoff weight over 2,250 kg (4,960 lb). Note: Severity A incidents are categorized as serious. Severity B incidents are categorized as 4. As the alternative to EASA MS operators, the report major. Data for 2011 are preliminary. uses the term “third country operators,” which Source: European Aviation Safety Agency apparently includes operators in other regions Figure 6 worldwide. We have adopted the term “non-MS” in preference to “third country” for clarity.
or malfunction not related to the engine. That 5. The ATM chapter data are sourced from the included accidents related to gearbox malfunc- Eurocontrol Annual Summary Template reporting tion, the report says. system. Data for 2011 are preliminary.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 51 INFOSCAN
Weather in Context Weather-information systems should be adaptable to the needs of individual flights.
BY RICK DARBY
REPORTS The research project that led to the report Need to Know was intended to document pilot needs for Weather in the Cockpit: Priorities, Sources, Delivery, and weather information, focusing on general avia- Needs in the Next Generation Air Transport System tion and scheduled air carriers, in preparation Schvaneveldt, Roger W.; Branaghan, Russell J.; Lamonica, John; for the switch to NextGen. When NextGen is Beringer, Dennis B. U.S Federal Aviation Administration (FAA) Civil fully operational, pilots will not only be able Aerospace Medical Institute (CAMI). DOT/FAA/AM-12/7. July 2012. 33 pp. Figures, tables, references. to perform point-to-point navigation without being limited to the legacy airways, but “will he FAA Next Generation Air Transpor- be responsible for obtaining information about tation System (NextGen) is most often weather and adjusting their flight to accommo- DOT/FAA/AM-12/7 Office of Aerospace Medicine Washington, DC 20591 discussed in connection with changes in date these factors.” Weather in the Cockpit: Priorities, Sources, Delivery, and Needs in the Next Generation T Air Transportation System navigation technology. This report looks at Providing near-real-time weather informa- Roger W. Schvaneveldt and Russell J. Branaghan Arizona State University Mesa, AZ 85212 John Lamonica another side of NextGen: weather information tion to pilots and crews is known as “weather Lamonica Aviation Tucson, AZ 85718
Dennis B. Beringer FAA Civil Aerospace Medical Institute and its accessibility. in the cockpit,” the report says, quoting the P.O. Box 25082 Oklahoma City, OK 73125
July 2012 “From a human factors perspective, it is FAA’s concept: “Weather in the cockpit means
Final Report vital that pilots and controllers have the right we employ the aircraft as a node in the National information at the right time,” the report says. Airspace System’s communications, navigation “These goals, along with a concern over the and surveillance network. [It also means we] potential problem of ‘too much information,’ enable flight deck weather information technol- lead to the suggestion that weather information ogies that allow pilots and aircrews to engage systems should provide information focused in shared situational awareness and shared on the safety of flight. The information should responsibilities with controllers, dispatchers, be presented in a meaningfully integrated way, flight service station specialists and others, reflecting all types of weather and all sources of pertaining to preflight, en route and post-flight weather information.” aviation safety decisions involving weather.”
52 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 INFOSCAN
Combining a review of the research lit- The report recommends a combination erature and a new detailed study, the report’s of ground-based systems that aggregate and authors analyze weather hazards and their summarize multi-sourced information, and degree of priority at the sharp end. “The pilot’s on-board systems capable of filtering what is workload would be lighter if the information relevant to the flight and presenting it to pilots provided led directly to decisions rather than with just enough detail. requiring interpretation and inference to arrive Present sources of U.S. weather informa- ‘Too much information at the needed information,” the report says. tion are plentiful, perhaps overwhelming. Many “Ideally, weather information systems of them originate with the National Weather can make it difficult might directly indicate critical information, Service (NWS), which maintains national and e.g., the location and severity of thunder- regional centers and about 122 local weather to locate safety- storms,” the report says. “In general, the forecast offices. critical information.’ priority of weather factors together with the Some of the NWS product is tailored for state of the factors in the world determines the aviation: “The Aviation Digital Data Service criticality of each factor. For example, density provides aviation-related weather [data]. Each altitude is particularly important when the weather forecast office issues terminal aero- temperature is high or, more generally, when drome forecasts for one or more airports in the density altitude becomes too high for safe their jurisdiction. … Twenty-one NWS Center operations. Thus, density altitude only needs Weather Service Units are collocated with the to be displayed when it is above the safety- FAA ARTCCs [air route traffic control centers]. critical level.” Their main responsibility is to provide up-to- Context-specific weather information the-minute weather information and briefings would also take into account the phase of flight. to the traffic management units and control- In an adaptation of earlier research by Beringer room supervisors.” and Schvaneveldt, weather factors are cross- The NWS also operates a center that issues tabulated by the phases — planning, departure, AIRMETS (airmen’s meteorological informa- cruise and arrival — to calculate numerical tion) and SIGMETS (significant meteorological priorities, with 1 the highest. information, such as notification of thunder- “Aside from the planning phase, which storms and turbulence). is usually accomplished without severe time “The technology for delivering weather pressure, pilot concern with weather is greatest information is in an extremely active state of in the arrival phase (20 factors with priority 1), development today,” the report says. “New sys- followed by departure (13 factors with priority tems, both installed and portable, are appear- 1),” the report says. “These are the times during ing frequently.” The primary delivery systems flight when workload is highest.” pilots can use include the Internet, including Consequently, the report advocates a “need the NWS website; VHF (very high frequency) to know” criterion for information display. broadcast, which carries controller-to-pilot “Too much information can make it dif- communication and automated systems such as ficult to locate safety-critical information,” the ATIS (automatic terminal information service); report says. “An exhaustive presentation of all and satellite, such as AFIS (automated flight the weather from every possible source (includ- information system), Sirius Satellite Radio and ing other aircraft) can easily hinder the ability XM Satellite Radio. to locate the information relevant to a particular The commercial vendors that have been flight at a particular time. … What is needed getting into the picture “often provide en- are integrated systems providing safety-critical hanced means of presenting the information information without requiring a search.” in graphical form.” However, commercial
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 53 INFOSCAN
sources risk overlapping NWS-provided data, multiple sources should be integrated to the report says. provide the big picture, yet still enable “With uncertainty over the limits to what zooming in for additional information; the NWS will provide in the future, commer- • “Weather information is presented at the cial innovation may be curtailed,” the report appropriate level of detail — Pilots should says. “There is something of a quandary here not be overwhelmed by the volume of because it is vital that the government does weather information presented; what it can to promote the safety and welfare of its citizens, which suggests that the NWS • “Hazard information is provided on an provide information in the most effective exception-only basis — Hazards should forms. At the same time, innovation in the be highlighted, whereas non-hazardous commercial sector should be encouraged.” weather should not be focused on Information systems designed around the unduly; needs of individual flights are more likely to • “Weather presentation is tied to 4-D be developed by private enterprise than by the flight profile [the flight path in three- government, the report says. dimensional space plus time]. … Often it In addition, “many avionics systems now is more useful for the pilot to know not provide weather information and some ru- what the weather is like at a particular dimentary means of integrating the dispa- location now, but what it will be like when rate types of information, such as overlays, they get there”; picture-in-picture, split-screen views and zooming capabilities,” the report says. But it • “Probabilistic forecasts are provided and asks: “Do these avionics systems provide the the level of uncertainty of the information information the pilots need, when they need is indicated; [and,] it, in a useful way?” • “Recommendations are provided about The researchers reviewed several weather- how to avoid bad weather.” related avionics products: the Garmin G1000 ‘Weather from multiple (installed in the cockpit instrument panel) and All this can be summed up as giving the pilots sources should be 396/496 (portable); the Honeywell-Bendix/ the gist of the situation, the report says. At King AV8OR (portable); L3’s SmartDeck any point on the 4-D flight profile, the pilot integrated to provide (installed); and WxWorx (portable, for a needs to be able to quickly answer ques- laptop computer or tablet). These products, tions such as these: “How dangerous is the the big picture, yet the report says, are designed primarily for U.S. weather?” “Why is it dangerous?” “How long Federal Aviation Regulations Part 91 aircraft; will the danger continue?” “What should I do still enable zooming Part 121 carriers tend to use custom equip- about it?” in for additional ment. But the criteria for evaluating weather The report provides details of the research- information systems could be valid for any ers’ analysis of the five weather-information information.’ applications. The criteria were: systems. All the systems scored zero on two criteria, “suggestions provided to avoid bad • “Weather is customized by phase of flight weather” and “probabilistic information.” — Different weather information should The report says, “Most of the products do be presented or highlighted according to a good job of emphasizing hazards, indicating the phase of flight; storms in red and so on; however, they do not • “Weather source information is inte- tie it well to a 4-D profile. Though they provide grated and summarized — Weather from current weather along a three-dimensional
54 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 INFOSCAN
profile, they fail to provide current and forecast investigations showed that subjective feelings of information along a four-dimensional profile. fatigue do not necessarily correspond to objec- … None of the systems provide overt sugges- tive performance loss. It is also challenging to tions for avoiding weather hazards (i.e., possible identify the neural and psychological processes rerouting). ARTCC controllers have historically that mandate the impact of fatigue on perfor- supplied this suggestion of an alternate route, mance. Fatigue, in part, reflects fundamental and they are not likely to continue doing so changes in neural function, but also depends during NextGen.” critically on an operator’s interest in the task and the high-level cognitive processes that BOOKS regulate motivation.” Nor are the causes of fatigue as obvious The Mind-Body Problem as one might think. Not getting enough sleep The Handbook of Operator Fatigue makes us tired and craving rest or sleep — one Matthews, Gerald; Desmond, Paula A.; Neubauer, Catherine; definition of fatigue — but other sources can Hancock, P.A. (editors). Farnham, Surrey, England, and pitch in. Burlington, Vermont, U.S.: Ashgate, 2012. 527 pp. Figures, tables, references, index. “A second source derives from the 24-hour circadian cycle in wakefulness and alert- hile this book was being compiled, the ness,” the editors say. “While sleep loss and U.S. Federal Aviation Administra- circadian rhythms are distinct influences on Wtion was investigating three cases of fatigue, they are increasingly studied together. air traffic controllers falling asleep on duty … Models of this kind provide the basis for between January and April 2011. A university evaluating shift systems: night workers [such sleep specialist was quoted in a newspaper as pilots on ‘backside of the clock’ schedules] article suggesting that controllers on night face the dual penalty of sleep deprivation shifts should be allowed to take brief restor- alongside the loss of alertness driven by the ative naps. The same article quoted a U.S. circadian phase during which they are forced senator: “I think that is totally bogus. There to be active.” are so many professions that have to work Other sources of fatigue cited by the editors long hours.” include tasks requiring sustained attention; The editors comment, “Clearly, science and monotonous and high-workload performance; society do not always see the problem in the compromised neural functioning caused by same way.” Their book is a comprehensive selec- infection, sedative drugs or nutritional defi- tion of papers about how science sees the subject. cits; loud noise; uncomfortable temperatures; The editors describe fatigue as “one of even poorly designed computer displays. the most puzzling enigmas in all of psychol- “Conversely, tasks that offer high levels of ogy.” Superficially, fatigue seems like a simple challenge and intrinsic interest can be highly concept. We all know what fatigue feels like and fatigue-resistant,” the editors say. the behavioral tendencies it encourages: sub- The papers published in The Handbook of par task performance, irritability, forgetfulness Operator Fatigue are divided into eight sec- and loss of enthusiasm. tions: an introduction, “The Nature of Fatigue,” Yet, the editors say, “Many experimental “Assessment of Fatigue,” “The Neuroscience of studies show the detrimental effects of fatigue, Fatigue,” “Performance Effects of Sleep Loss but sometimes individuals who appear to and Circadian Rhythms,” “Fatigue and Health,” be highly fatigued continue to show normal “Applied Contexts for Operator Fatigue,” and levels of performance. The earliest systematic “Operational Countermeasures.”
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 55 ONRECORD Air Data Spikes Trigger Upset More than 100 people aboard the A330 were injured during a pitch excursion.
BY MARK LACAGNINA
The following information provides an aware- “Two minutes later, in response to spikes in ness of problems that might be avoided in the angle-of-attack (AOA) data, the aircraft flight future. The information is based on final reports control primary computers (FCPCs) command- by official investigative authorities on aircraft ed the aircraft to pitch down,” the report said. accidents and incidents. “Although the pitch-down command lasted less than 2 seconds, the resulting forces were suf- JETS ficient for almost all the unrestrained occupants to be thrown to the aircraft’s ceiling. … There Rare Computer Fault Cited was significant damage to overhead fittings in Airbus A330-300. Substantial damage. Twelve serious injuries, 107 the cabin.” minor injuries. A peak vertical acceleration of minus 0.80 he A330 was en route with 303 passengers g was recorded as the A330 descended 690 ft and 12 crewmembers from Singapore to within 23 seconds. The captain applied sidestick TPerth, Western Australia, when it sud- control inputs to arrest the descent and return denly pitched nose-down. “At least 110 of the the aircraft to FL 370. 303 passengers and nine of the 12 crewmem- Less than three minutes later, the A330 bers were injured; 12 of the occupants were again pitched nose-down. Apparently, no fur- seriously injured, and another 39 received ther injuries occurred during the second upset. hospital medical treatment,” said the report “The flight crew described the event as being by the Australian Transport Safety Bureau similar in nature to the first event but less (ATSB). severe,” the report said. “The captain promptly The accident occurred the morning of Oct. applied back pressure on his sidestick to arrest 7, 2008. The A330 was cruising at Flight Level the pitch-down movement.” The aircraft de- (FL) 370 (approximately 37,000 ft) over the scended 400 ft within 15 seconds before being Indian Ocean, about 154 km (83 nm) west of returned to FL 370. Learmonth, on the coast of Western Australia, The malfunctioning ADIRU was identified when “one of the aircraft’s three air data inertial and disengaged. “Due to the serious injuries and reference units (ADIRUs) started outputting their assessment that there was potential for fur- intermittent, incorrect values (spikes) on all ther pitch-downs, the [flight] crew diverted the flight parameters to other aircraft systems,” said flight to Learmonth … and declared a mayday to the report, issued last December. air traffic control,” the report said. “The aircraft The no. 1 autopilot disengaged, and nu- was landed as soon as operationally practicable” merous warning and caution messages were about 45 minutes after the upset. generated. Most of the messages, including stall The failure mode that triggered the upset warnings and overspeed warnings, were false. was rare and likely began when the Northrop The captain hand flew the aircraft briefly, then Grumman LTN-101 ADIRU’s central processor engaged the no. 2 autopilot. “combined the data value from one parameter
56 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 ONRECORD
with the label for another parameter,” the report electrical burning in the flight deck,” the report said. “The exact mechanism that produced this said. “The crew responded by donning their problem could not be determined.” oxygen masks and [smoke] goggles.” The resulting AOA spikes were 1.2 seconds The crew declared an emergency, initiated a apart, which coincidentally corresponded to the descent from FL 390 and diverted the flight to monitoring interval at which the FCPC tempo- Kavala, Greece, 38 nm (70 km) south. rarily retains, or memorizes, a previous value if a The auxiliary power unit (APU) was started, discrepancy is detected in the data generated by but it provided power to the left AC bus for only the ADIRUs. “The FCPC’s AOA algorithm could 17 seconds. “No additional attempts to supply not effectively manage a scenario where there power to the left AC bus were made, and the air- were multiple spikes such that one triggered a craft [was] landed without further incident,” the memorisation period and another was present report said. “During the final approach, it was 1.2 seconds later,” the report said. As a result, the apparent that the fumes had dissipated, and the second in each series of data spikes was accepted [219] passengers were disembarked normally.” as valid, and the erroneously high AOA values The AAIB classified the event as a serious prompted the pitch-down commands. incident. Investigators found that a similar loss “There were only three known occasions of of power to the left AC bus had occurred 13 the failure mode in over 128 million hours of flights earlier. Troubleshooting after that inci- unit operation,” the report said. “At the aircraft dent was inconclusive. “The left integrated drive manufacturer’s request, the ADIRU manufacturer generator (IDG) was disconnected, and the de- has modified the LTN-101 ADIRU to improve its fect was transferred to the list of deferred defects ability to detect data transmission failures.” in the aircraft’s technical log,” the report said. In addition, Airbus redesigned the FCPC Maintenance personnel subsequently per- software algorithms “to prevent the same type formed wiring-continuity checks and replaced of accident from occurring again,” the report the left generator control unit, the bus power said. “The occurrence was the only known control unit, the circuit breakers for the left example where this design limitation led to a generator and the left bus tie. “None of these pitch-down in over 28 million flight hours on actions were successful in resolving the defect,” The crew declared A330/A340 aircraft.” the report said. Troubleshooting on the morning of the seri- an emergency, Corrosion Causes AC Power Loss ous incident revealed an open circuit between initiated a descent Boeing 757-200. No damage. No injuries. a connector at the left engine pylon and the left he 757 was nearly three hours into a flight IDG. The wiring loom was replaced, an opera- from FL 390 and from England to Cyprus the morning of tional check was performed, and the left AC TSept. 7, 2011, when the flight crew observed generating system was declared serviceable. diverted the flight. indications that the left AC (alternating current) After the emergency landing in Greece, electrical bus and the left generator were off line, built-in test equipment indicated that the loads “along with multiple failures of flight instru- demanded by the left AC bus were not in bal- ments,” said the U.K. Air Accident Investigation ance with the left IDG’s current output. The left Branch (AAIB) report. generator control unit and bus power control The crew completed the relevant quick unit again were replaced. “The aircraft’s engines reference handbook (QRH) procedure, which were ground-run for 45 minutes, during which included resetting the left bus tie to bring the the left and right AC power-generation systems left generator back on line. This restored power operated correctly, and no electrical burning or to the left AC bus only momentarily, however. smoke was apparent,” the report said. “The second power loss was associated with About 2 1/2 hours into the subsequent a thin haze of smoke and a strong smell of ferry flight back to England, however, the left
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 57 ONRECORD
AC bus again lost power. This time, the bus The pilot flying noticed that flaring the CRJ received power from the APU for the remain- to land at Bilbao Airport required greater effort der of the flight. than usual, but the touchdown was normal. Troubleshooting again revealed indications “While taxiing, [the crew] noticed that the el- Maintenance of an open circuit between the pylon bulkhead evator control blocked at halfway pitch-up,” the connector and the left IDG. The connector’s report said. “The following flight was canceled.” technicians found backshell was found loose — a likely result Maintenance technicians found that an of threads being stripped during previous elevator control cable had broken and jammed that an elevator over-tightening of the connector. “This defect the autopilot servo. Recorded flight data control cable had allowed moisture to enter the connector, causing indicated that the cable had snapped during a corrosion of the connector’s internal compo- coupled approach to Bilbao Airport that was broken and jammed nents” and intermittent contact between two conducted by another flight crew before the crimp terminals and their associated wiring, the incident flight to Paris. The other crew had the autopilot servo. report said. The connector was replaced, and completed the approach manually after a pitch no further problems with the left AC generat- excursion occurred at 1,200 ft. “This crew ing system had occurred when the report was did not attach any great importance to this published in June 2012. behaviour and did not make a note of it in the logbook or mention it to the [incident] crew,” Broken Cable Blocks Elevator the report said. Bombardier CRJ700. Minor damage. No injuries. Investigators determined that the elevator he CRJ was climbing to cruise altitude dur- control cable likely had been installed incor- ing a flight from Bilbao, Spain, to Paris on rectly when the vertical stabilizer was assembled TJuly 12, 2010, when the flight crew noticed by a subcontractor during the manufacture of that the autopilot was unable to maintain the the aircraft. selected vertical mode and that an “AP PITCH “The investigation was not able to determine TRIM” caution message was being displayed. with certainty the link between the appearance “The crew applied the corresponding check- of the ‘AP PITCH TRIM’ message and the sys- list, which, after another unsuccessful attempt at tem condition during the flight,” the report said. [autopilot] engagement, led the crew to resume “However, it is highly probable that the caution manual control,” said the report by the French message was linked to the trim movement by Bureau d’Enquêtes et d’Analyses. the autopilot for a period that was longer than The CRJ was landed without further the threshold of the caution message trigger.” incident at Charles de Gaulle Airport. “At the stopover, the maintenance service took a variety Turbulence Tosses Cabin Crew of steps relating to the problem encountered,” Boeing 737-600. No damage. One serious injury. the report said. “No malfunctions were found. he 737 was in visual meteorological condi- Specifically, the elevator servo operational test tions (VMC) at 11,000 ft, but there were cu- was performed three times, and free clearance of Tmulonimbus clouds ahead on the approach the controls was checked.” to London Heathrow Airport the afternoon of The aircraft was released for service, and Aug. 23, 2010. The flight crew activated the seat the crew began the return flight to Bilbao with belt signs and performed a pre-landing public 65 passengers and four crewmembers aboard. address (PA) system announcement, describing “During this leg, the same problem occurred: the weather and the possibility of turbulence. the [autopilot] could not hold the vertical modes “The cabin crew were securing the cabin for and the ‘AP PITCH TRIM’ caution message landing and were not restrained at the time,” triggered,” the report said. “The flight continued the AAIB report said. “Three of the four cabin under manual control.” crewmembers, including the purser, were not
58 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 ONRECORD
aware of the weather-related comments in the Among changes affected by the airline were PA announcement.” a revision of communications between flight The aircraft encountered light turbulence as and cabin crewmembers to clarify when the the flight crew altered course to circumnavigate cabin is secure and when both the cabin and an area of precipitation displayed on the weather the cabin crew are secured, and introduction of radar. The 737 appeared to be clear of the area specific announcements to passengers, request- when it briefly encountered severe turbulence. ing that they help secure the cabin when cabin “One of the cabin crew managed to sit in an crewmembers are seated because of the possibil- empty seat but was not able to fasten the seat ity or presence of turbulence. belt before being thrown into the air and hitting the cabin roof,” the report said. “Despite this, Loading Bridge Damages Fuselage she was uninjured. Boeing 757-200. Substantial damage. No injuries. “Another cabin crewmember, seated on a he airplane was being prepared for a flight crew seat in the rear galley and making a PA from San Francisco International Airport [announcement] to the passengers, was also Tthe afternoon of June 11, 2011. After the thrown into the air. She landed back on the seat 188 passengers were boarded and the cabin and badly injured her back. The other cabin door was closed, the operator of the passenger crewmembers were uninjured and attended to loading bridge (jetway) retracted the canopy and their injured colleague, who was in considerable awaited a hand signal from a ramp worker to pain and had to remain on the galley floor for retract the bridge itself. the rest of the flight.” “The ramp employee responsible for the None of the 79 passengers was injured. After airplane pushback reported that he heard the the aircraft was landed without further incident, [loading bridge] bell ringing for about one min- the injured crewmember was taken by ambu- ute, which he thought was enough time for the lance to a hospital, where she was treated for jetway to be cleared from the airplane,” the U.S. spinal injuries. National Transportation Safety Board (NTSB) The airline required cabin crewmembers to report said. be seated, with their seat belts fastened, when According to the report, however, the bridge the seat belt signs are on, unless they are per- operator had not begun to retract the bridge, forming safety-related duties. “It was intended and the ramp worker did not signal the bridge that the cabin crew should be made aware of operator before beginning the pushback. The expected en route turbulence by the pilots, 757 struck the bridge, and a 38- by 8.5-in (97- although the method of doing so was not speci- by 21.6-cm) hole was torn in the fuselage. Frame fied,” the report said. assemblies and stringers also were damaged. The airline also required that seat belt signs The report said that the probable cause of be illuminated 10 minutes before the expected the accident was the ramp worker’s “failure to landing time in all conditions. “Illumination of visually verify the position of the jetway before the seat belt sign, during the approach but be- beginning the airplane pushback.” cause of turbulence, might therefore be misun- derstood by the cabin crew without clarification from the flight deck,” the report said. TURBOPROPS An investigation by the airline’s safety depart- Distracted Below Glideslope ment identified three similar accidents in which Bombardier Q400. No damage. No injuries. cabin crewmembers had suffered turbulence- related injuries. “In all cases, the cabin seat belt he flight crew was receiving radar vec- sign had been illuminated and the crew were tors from air traffic control (ATC) for the unsecured, preparing the aircraft for landing.” Tinstrument landing system (ILS) approach
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 59 ONRECORD
to Runway 26 at Exeter (England) Airport the shallow climb. About the same time, ATC asked afternoon of Sept. 11, 2010, when they observed the crew to confirm that they were descending a message on the engine and system integrated on the ILS glideslope. The commander replied display (ED) that one of the aircraft’s two input- that they had experienced an instrument failure output processors (IOPs) had failed. and were climbing to capture the glideslope. At the time, the Q400 was descending Recorded flight data showed that the Q400 through 3,300 ft to an assigned altitude of 2,600 had descended to 1,417 ft (700 ft AGL) before ft, the minimum safe altitude for the sector. The transitioning to a climb and that it captured the autopilot was maintaining the selected heading glideslope at 2,200 ft. The aircraft was landed and a vertical speed of 500 fpm; the altitude- without further incident, and none of the 49 hold and approach modes were armed, and passengers or four crewmembers was injured. The aircraft operator 2,600 ft had been entered in the altitude selector. The aircraft operator told investigators that The IOPs are part of the flight data process- IOP failures were common in its Q400 fleet. “In told investigators ing system, which acquires data from various the majority of cases, the operator’s experience is aircraft systems and sensors, and routes the data that resetting the relevant circuit breaker or re- that IOP failures to other systems. The failure of the no. 1 IOP installing the unit appears to solve the problem, were common in caused the indicated designations, or “bugs,” for and the unit remains in service,” the report said. the approach speeds and minimum descent alti- A number of IOPs found to be faulty and sent its Q400 fleet. tude on the commander’s primary flight display to the vendor for repair were returned with the (PFD) to be replaced by white dashes. There was notation “no fault found” but continued to cause no change to the copilot’s PFD. problems when reinstalled in the aircraft. “There are no flight crew procedures for ED The IOP that failed in the incident aircraft advisory messages relating to avionics failures had failed several times previously, but the air- such as an IOP failure, but maintenance action craft was returned to service each time after no is required prior to dispatch of the next flight,” faults were found during maintenance trouble- the AAIB report said. shooting and testing showed normal operation. Nevertheless, the commander attempted After the incident, the IOP was examined by the to restore the bugs on his PFD by selecting the manufacturer under AAIB’s supervision. X-ray no. 2 air data computer (ADC). This had no tests revealed that the intermittent failures had effect, so he switched back to the no. 1 ADC. resulted from power supply disruptions caused “The commander realised that by changing by cracked solder on two pins in a transformer. ADC selection, the approach mode had become Based on the findings of the investigation, disarmed, so … he also re-armed the approach the AAIB recommended that Thales Aerospace, mode,” the report said. The altitude-select mode which manufactures the IOPs, review its test remained disarmed. procedures to improve the detection of power- The commander then transferred control to supply failures, and that Bombardier Aerospace the copilot. The report said that both pilots were publish information in the Q400 airplane flight distracted by continuing attempts to resolve manual and QRH about the effects of IOP fail- the IOP failure when the aircraft’s enhanced ures on the operation of the aircraft. ground-proximity warning system (EGPWS) generated a “CAUTION TERRAIN” warning. Gear Retracts During RTO At the time, the aircraft was descending through Piaggio P-180 Avanti. Substantial damage. No injuries. 1,759 ft, or 1,066 ft above ground level (AGL), he flight crew was preparing for a post- in VMC. Seconds later, the EGPWS generated a maintenance functional check flight from “TERRAIN, TERRAIN, PULL UP” warning. TSt. Petersburg-Clearwater (Florida, U.S.) The copilot disengaged the autopilot, in- International Airport the afternoon of Sept. creased power to about 80 percent and began a 12, 2010, following replacement of an elevator.
60 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 ONRECORD
Several other maintenance inspections had been After an en route stop in Pickle Lake to performed, including an operational test of the refuel, the Navajo was at 9,500 ft and halfway to Avanti’s landing gear. Kashechewan when the pilot heard a “brief rum- “The pilot-in-command (PIC) later stated ble” from the left engine, said the report by the that he could not recall observing the position Transportation Safety Board of Canada (TSB). of the landing gear selector during his preflight “This was accompanied by a drop in cylinder inspection but reported that he would have head and exhaust gas temperature indications checked it,” the NTSB report said. on the no. 3 cylinder.” As the PIC rotated the airplane for takeoff, The pilot decided to return to Pickle Lake and he heard a sound similar to a tire bursting. descended to 8,500 ft. When the flight encoun- At the same time, the cockpit voice recorder tered broken clouds, the pilot descended to 4,500 “recorded a sound consistent with the hydrau- ft, or about 3,300 ft AGL, to remain in VMC. lic power pack motor operating for 2 seconds, Turbulence was encountered at that altitude. beginning gear retraction,” the report said. Shortly thereafter, the pilot heard a series of The PIC decided to conduct a rejected loud bangs and other noises emanating from the takeoff (RTO). “He reported that, as he began to left engine. “In order to preclude catastrophic retard the throttles and set the nose landing gear failure, the pilot shut the engine down … but on the runway, he realized that the airplane had [initially] did not increase power on the operat- descended below the normal wheels-on-ground ing engine,” the report said. sight line and that the belly of the aircraft had Airspeed decreased to 100 kt, and the begun to scrape the runway,” the report said. aircraft began to descend. The pilot increased “The airplane then slid for 1,000 ft [305 m] be- power on the right engine from 30 in to 35 in fore coming to rest upright on the runway with manifold pressure and propeller speed from each of the landing gear retracted.” 2,200 to 2,300 rpm. He also decreased airspeed A person who helped recover the airplane to 90 kt, the Navajo’s best single-engine rate of told investigators that he saw the landing gear climb speed, to arrest the descent. selector in the “UP” position. After the Avanti “Initially, the aircraft was able to maintain was raised and the landing gear extended, the altitude, but the airspeed decreased to 83 kt, at airplane was towed to the ramp. “Postaccident which point the aircraft began to descend again,” testing revealed no preaccident mechanical the report said. “Power was increased to 38 in failures or malfunctions of the landing gear or manifold pressure, but in the turbulent condi- landing gear position and warning system,” the tions, the airspeed fluctuated, directional control report said. “The investigation was not able to became increasingly difficult, and occasional determine who placed the landing gear selector stall buffeting was encountered.” in the ‘UP’ position.” The pilot decided to conduct an emergency landing in a swampy area 30 nm (56 km) east of Pickle Lake. The Navajo was substantially PISTON AIRPLANES damaged when it struck trees. The pilot and one passenger sustained minor injuries; the other Magneto Fault Forces Landing passengers escaped injury. Piper Navajo. Substantial damage. Two minor injuries. The engine malfunction was traced to a s part of his preflight preparations, the loose distributor block bushing on the left pilot checked the engine magnetos and magneto. The report noted that the operator of Afound no anomalies before departing the Navajo had not complied with provisions with three passengers from Red Lake, Ontario, of Teledyne Continental Service Bulletin 643B, Canada, for a company flight to Kashechewan which calls in part for checking the security of the morning of Sept. 10, 2010. the bushing every 500 hours.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 61 ONRECORD
Disorientation Suspected in CFIT the TSB report said. “As weather conditions Cessna 310R. Destroyed. One fatality. were VMC at the work site, the pilot did not bout 10 minutes after deplaning five char- think it necessary to call for a weather update. ter passengers at Bathurst Island, Northern The return flight to Chibougamau was expected ATerritory, Australia, the night of Feb. 5, to take approximately 50 minutes.” 2011, the pilot departed from Runway 33 for the The helicopter was at 1,000 ft AGL when return flight to Darwin. “Shortly after takeoff, it encountered heavy rain and thunderstorms a number of witnesses reported hearing a loud about 20 nm (37 km) from the destination. noise or seeing a light from the direction of Shortly thereafter, visibility decreased to about 1 departure,” the ATSB report said. “[The aircraft] mi (1,600 m), and the pilot decided to conduct a was found to have impacted terrain approxi- precautionary landing on a gravel road. mately 1 km [0.5 nm] from the upwind end of “On final approach, while approximately Runway 33.” 70 ft AGL at low airspeed over trees, the pilot Noting that investigators found no technical lost all visual reference with the terrain due to deficiencies that might have contributed to the heavy rain,” the report said. “While in a hover accident, the report concluded that the crash had over the trees, the helicopter descended without involved controlled flight into terrain (CFIT), the pilot realizing it and struck the trees, then likely after the pilot experienced somatogravic the ground, coming to rest on its left side.” The illusion, a physiological phenomenon that can pilot and the front-seat passenger were seriously cause a pilot to mistake the sensation of accelera- injured; the other two passengers sustained tion as the aircraft pitching nose-up and then to minor injuries. react by lowering the nose. The resulting increase in acceleration compounds the spatial disorienta- Carb Heat, Mixture Controls Confused tion caused by the illusion. Robinson R22. Substantial damage. No injuries. “The location of the wreckage, together with wo certificated rotorcraft pilots were con- the dark night conditions and the relatively light ducting a ferry flight the morning of Aug. load of the aircraft suggested that it was likely that T11, 2011. The pilot flying held an airline the pilot was influenced by the effects of somato- transport pilot license and had 2,365 flight gravic illusion following takeoff,” the report said. hours, including 1,177 hours in type. The other The report said that the accident highlights pilot held a private pilot license and had logged the importance of being aware of the conditions 54 of his 220 flight hours in R22s. in which somatogravic illusion can occur and of The helicopter was on approach for a scanning the instruments, especially the attitude refueling stop in Titusville, Florida, U.S., when indicator, to verify the aircraft’s attitude and the pilot flying asked the other pilot to apply performance when flying in such conditions. carburetor heat. “The private pilot inadvertently pulled out the engine mixture control with the HELICOPTERS mixture control guard, which resulted in an immediate total loss of engine power,” the NTSB Rain Douses Visual References report said. “The helicopter was at an altitude Eurocopter AS350 B2. Substantial damage. Two serious injuries, between 300 and 400 ft when the [pilot flying] two minor injuries. entered an autorotation while the private pilot he pilot delayed departure from a work site attempted to restart the engine.” 85 nm (157 km) northwest of Chibougam- The engine did not restart before the heli- Tau, Québec, Canada, until a line of thunder- copter struck trees and a fence, and flipped over. storms passed through the area the afternoon of The R22’s airframe and main rotor and tail rotor Sept. 1, 2010. “When the helicopter took off … drive systems were damaged on impact, but the sky had cleared and the rain had stopped,” both pilots escaped injury.
62 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 ONRECORD
Preliminary Reports, July 2012
Date Location Aircraft Type Aircraft Damage Injuries July 1 Edgemont, South Dakota, U.S. Lockheed C-130H destroyed 4 fatal, 2 serious The C-130 air tanker, operated by the U.S. Air Force, was engaged in wildfire suppression operations when it crashed under unknown circumstances. July 3 Olancho Province, Honduras Piper Cheyenne II destroyed 1 fatal, 1 serious The pilot was killed when the Cheyenne crashed under unknown circumstances. July 4 Buenos Aires, Argentina Rockwell Sabreliner 75A substantial 9 NA The Sabreliner’s left main gear collapsed on landing at El Palomar Airport. No fatalities were reported. July 4 Tallahassee, Florida, U.S. Robinson R44 substantial 1 none Night visual meteorological conditions prevailed when the pilot inadvertently initiated a descent while reaching for the circuit breaker box under his seat in response to the illumination of the clutch actuator warning light. The pilot heard the low-rotor-speed warning horn when he raised the collective control, and the R44 continued descending until it struck a lake. July 6 Espinosa, Brazil Embraer 820C Navajo destroyed 1 fatal, 2 minor The pilot was killed during a forced landing in a densely wooded area after both engines lost power during a low-altitude survey flight. July 7 Karnack, Texas, U.S. Beech E90 King Air substantial 1 fatal The King Air was on a night visual flight rules positioning flight at 14,500 ft when the pilot reported to air traffic control that he had encountered heavy precipitation. The airplane was in a right turn and descending when radar contact was lost. The wings and stabilizers apparently separated from the airplane before it struck terrain. Residents reported a severe thunderstorm in the area at the time of the accident. July 9 São Paulo, Brazil Cessna 208 Caravan substantial 1 fatal, 2 serious, 1 none Three parachutists exited the Caravan at 14,000 ft. Then, as the pilot was conducting a descent, the aircraft’s left wing struck the parachutists, killing one and seriously injuring the other two. July 9 Rangali Island, Maldives de Havilland DHC-6-300 substantial 17 none The Twin Otter’s left float collapsed when it struck a dock while taxiing during a scheduled flight. July 11 Broome, Western Australia, Australia Piper Seneca ? 1 fatal The Seneca crashed under unknown circumstances shortly after departing for a night charter flight to Port Hedland. July 11 São Paulo, Brazil Robinson R22 destroyed 2 fatal Both pilots were killed when the helicopter crashed out of control into a building during a local flight. July 12 Angra dos Reis, Brazil Embraer 121A1 Xingu destroyed 3 fatal Low visibility in heavy rain prevailed when the aircraft descended out of control into the sea on final approach. July 12 Nouakchott, Mauritania Harbin Yunshuji Y-12II destroyed 7 fatal The twin-turboprop airplane, operated by the Mauritanian air force, crashed shortly after taking off for a flight to the Tasiast Gold Mine. July 13 Nice, France Gulfstream G-IV destroyed 3 fatal The G-IV was on a positioning flight from Côte d’Azur Airport when it veered off the left side of Runway 13 at Le Castellet Airport and struck trees. July 20 Kampong Triso, Malaysia Eurocopter EC120-B NA 3 fatal, 1 none The helicopter was ditched in a river under unknown circumstances. All four occupants survived the ditching, but the three passengers subsequently drowned. July 22 Pushchino, Russia Let 410UVP-E3 substantial 2 NA Both pilots were injured when the aircraft veered off the runway after the nose landing gear collapsed on touchdown. July 26 Sedona, Arizona, U.S. Beech B60 Duke substantial 3 fatal Witnesses said that the Duke experienced engine anomalies before overrunning the runway on takeoff and crashing in a ravine. July 28 Juiz de Fora, Brazil Beech B200 King Air destroyed 8 fatal The King Air struck power lines and trees on final approach in dense fog.
NA = not available This information, gathered from various government and media sources, is subject to change as the investigations of the accidents and incidents are completed.
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | SEPTEMBER 2012 | 63 SMOKEFIREFUMES
Selected Smoke, Fire and Fumes Events, May–July 2012
Date Flight Phase Airport Classification Subclassification Model Operator May 3 Cruise — Air distribution fan Smoke Boeing 747 Atlas Air A burning smoke odor was noticed in the cabin area for approximately 10 minutes. Shortly thereafter, the engine indicating and crew alerting system status message for the lower left recirculation fan indicated a failure, the circuit breaker for the recirculation fan tripped and the odor dissipated. The crew consulted the quick reference handbook and continued with the flight. After landing, maintenance inspected the lower recirculation fan, found it inoperative and replaced it. May 4 Cruise — Equipment/furnishings wiring Smoke Boeing 757 Continental Airlines Heavy smoke and an acrid odor appeared around forward passenger seats. When electrical power was shut off, the smoke dissipated. The flight was diverted. A “smoke in the cabin” questionnaire was completed. Maintenance found a passenger’s cell phone jammed on the seat track. May 14 Cruise Rate of climb indicator Smoke Bombardier DHC-8 Henson Aviation Smoke was detected in the cockpit during flight. The pilots performed the emergency checklist. The smoke did not dissipate. The pilots declared an emergency and the aircraft was landed normally. Maintenance found the captain’s instantaneous vertical speed indicator (IVSI) inoperative and the screen blank. The IVSI was replaced. Palm Springs, McDonnell May 14 Cruise California Auxiliary power unit core engine Smoke Douglas DC-9 American Airlines The flight attendants reported odor and smoke in the cabin. The pilots declared an emergency and the flight returned to Palm Springs and landed without incident. The aircraft was removed from service. Maintenance placarded the auxiliary power unit (APU) and accomplished a pack burn. The APU was replaced and a system ground check showed normal operation. May 15 Descent — Exterior lighting Smoke Boeing 717 Southwest Airlines During arrival, a check captain pushed in the switch for the left ground floodlight, and smoke started coming out from behind the switch. Maintenance found that the left ground floor circuit breaker had tripped. They removed and replaced the switch according to the maintenance manual. May 19 Cruise — Data transmission auto call Smoke Embraer EMB-190 JetBlue Airways Smoke came out of the cockpit printer in flight. It appeared that jammed paper was smoldering. Maintenance performed an inspection and positively identified the source of the smoke and burning odor as an internal printer component. The printer was removed and replaced. An operational check was normal. Embraer May 24 Cruise — Passenger compartment lighting Smoke EMB-145LR Atlantic Southeast Airlines Flight attendants reported smoke in the cabin near a forward row and the galley coming from ceiling panels. The aircraft returned to the departure airport where it was landed without incident. Maintenance inspected the aircraft and found the forward galley light burned out, with no other evidence of burns or damage. They replaced the forward galley light bulb and operationally tested it, noting no defects. The aircraft was approved for return to service. June 4 Descent — Air distribution system Smoke Bombardier CL-600 Delta Air Lines Smoke was seen in the flight deck and cabin during final approach. Maintenance inspected the aircraft for evidence of the source of the smoke and found ceiling lights at forward rows showing signs of overheating. Both air conditioning packs were run isolated and together on each engine bleed source. No evidence of smoke was found. Embraer June 4 Climb — Engine Fluid loss, smoke EMB-145XR Atlantic Southeast Airlines The cabin crew reported smoke in the lavatory. The aircraft was returned to the departure airport and landed without incident. The engine was leaking; maintenance replaced the no. 2 engine. Overheating, June 6 Climb — Passenger compartment lighting smoke Bombardier CL-600 Atlantic Southeast Airlines The cockpit filled with electrical fumes in flight. There was a consistent dispersion increase and decrease with the thrust levers. An emergency was declared, and the flight was diverted. Maintenance found the galley light ballast had overheated. They replaced the light ballast in accordance with the aircraft maintenance manual. June 11 Cruise — Cabin cooling system Smoke Airbus A319 Spirit Airlines After liftoff, smoke was detected from ducts in the flight deck. Cabin crewmembers also saw smoke from outlets. No electronic centralized aircraft monitoring faults or smoke warnings were triggered. After the pilots selected pack no. 1 to “OFF,” smoke dissipated in the flight deck and cabin. Pack no. 2 remained on for the entire flight. Maintenance accomplished an operational test of pack no. 1 in accordance with the aircraft maintenance manual. An overheat message was observed during troubleshooting. July 3 Climb — Air distribution fan Smoke Cessna 560XL Executive Jet Aviation After takeoff, climbing through 10,000 ft, the cockpit recirculation fan was selected on “HIGH.” A strong odor of burning and melted plastic was noted. The fan was turned off, but the odor continued and seemed to get stronger. No smoke was noted. The copilot noted a rattling sound coming from the recirculation fan when it was on. Maintenance performed an engine run, with no noticeable odor of melted plastic in the cockpit or cabin. However, the cockpit recirculation fan had a defective bearing unit. Maintenance ordered new fan assembly and replaced the cockpit recirculation fan in accordance with the maintenance manual. An operational check was normal.
Source: Safety Operating Systems and Inflight Warning Systems
64 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | SEPTEMBER 2012 Scan code with mobile phone visit The Center for Aviation the CASR Safety Research at Saint Louis website. University serves as a central resource for transfer of best practices across air transportation and other high-consequence industries.
EARN A CERTIFICATION IN AVIATION SAFETY FOR MANAGERS
The Center for Aviation Safety Research (CASR) offers Aviation Safety courses to provide managers with valuable insight on how to achieve the highest level of safety within an orga- nization while improving operational performance.
CALL FOR PAPERS
Authors interested in submitting papers or articles to The International Journal of Safety Across High-Conse- quence Industries may do so online by registering at: http://www.edmgr.com/ijsahi/.
CENTER FOR AVIATION SAFETY RESEARCH
parks.slu.edu/faculty-research/casr It may take hours for your aircraft to reach its destination but its flight data will be in your hands within minutes
WIRELESS
With Teledyne Controls’ Wireless GroundLink® (WGL) solution, 100% data recovery is now possible. WGL eliminates physical media handling, putting an end to data loss. Used by hundreds of operators worldwide, the Wireless additional benefits across your organization, such as GroundLink® system (WGL) is a proven solution for fuel savings and lower maintenance costs. Even more, automating data transfer between the aircraft and your the WGL system can also be used to automate wireless flight safety department. By providing unprecedented distribution of navigation databases and other Software recovery rates and immediate access to flight data, WGL Parts to the aircraft, when used with Teledyne’s helps improve the integrity and efficiency of your Flight enhanced Airborne Data Loader (eADL). For as little as Data Monitoring (FDM) activities. With the right data $30 dollars per month* in communication costs, all at your fingertips, not only can you reduce operating your data can be quickly and securely in your hands. risk and closely monitor safety, but you can also yield * May vary based on usage, cellular provider and country
Call +1 310-765-3600 or watch a short movie at: www.teledynecontrols.com/wglmovie
Automatic Transmission Cellular Technology Secure-Encrypted Data Back Office Integration Low Operating Cost
The Wireless GroundLink system is available as a retrofit installation or factory fit from Airbus, Boeing and Embraer.
Date: 04/13/12 Client: Teledyne Job #: 04242012 File Name: 0424_TEL_WGL_adRevs_ASW_May12_r2 Page 1 of 1 Account Director: Henry Artime Editor: Designer: ha Revised By: ov Production: Color: 4C/Process Trim: 8.5"× 11" Bleed: 8.75"× 11.25" Safety: 7.035"× 9.125" Fold: none Publication(s): AeroSafety World Magazine Run Date(s): May 2012 Special Instructions: Approved By: