JANUARY-MARCH 2016 Journal of the International Society of Air Safety Investigators

Air Safety Through Investigation JANUARY-MARCH 2016 Journal of the International Society of Air Safety Investigators

Independence Does Not Mean Isolation Page 4 A New Tool for Analyzing the Potential Influence of Vestibular Illusions Page 6 Investigating the Voyager Pitch-Down Incident Page 13 Investigating Human Fatigue Factors: A Tale of Two Accidents Page 18 Unstable Approaches: A Global Problem Page 22

January-March 2016 ISASI Forum • 1 CONTENTS

Air Safety Through Investigation Journal of the International Society of Air Safety Investigators FEATURES Volume 49, Number 1 4 Independence Does Not Mean Isolation Publisher Frank Del Gandio Richard B. Stone By Rémi Jouty, Director, Bureau d’Enquêtes et d’Analyses pour la sécurité de Editorial Advisor Editor Esperison Martinez l’aviation civile (BEA), France—Remarks presented by Director Jouty in his keynote Design Editor Jesica Ferry address to the delegates of the ISASI 46th annual international conference on air safety Associate Editor Susan Fager accident investigation. ISASI Forum (ISSN 1088-8128) is published quar- terly by the International Society of Air Safety 6 A New Tool for Analyzing the Potential Influence of Investigators. Opinions expressed by authors do Vestibular Illusions not necessarily represent official ISASI position or policy. By Randall J. Mumaw, Associate Technical Fellow, Human Factors, Boeing; Eric Groen, Senior Scientist, TNO; Lars Fucke, Lead Engineer, Boeing; Richard Editorial Offices:Park Center, 107 East Holly Anderson, Senior Accident Investigator, Boeing; Jelte Bos, Senior Scientist, TNO Avenue, Suite 11, Sterling, VA 20164-5405. Tele- phone 703-430-9668. Fax 703-430-4970. E-mail and Professor, VU University; and Mark Houben, Research Scientist, TNO— address, [email protected]; for editor, espmart@ Boeing saw the need for a valid, accessible tool that allows investigators to look at comcast.net. Internet website: www.isasi.org. flight data and determine if spatial disorientation may have contributed to pilot ISASI Forum is not responsible for unsolicited control inputs. manuscripts, photographs, or other materials. Unsolicited materials will be returned only if submitted with a self-addressed, stamped enve- 13 Investigating the Voyager Pitch-Down Incident lope. ISASI Forum reserves the right to reject, By Col. Crispin Orr, Head of the UK Military Air Accident Investigation Branch— delete, summarize, or edit for space con- siderations any submitted article. To facilitate The Voyager investigation is a case study of civil/military cooperation demonstrating editorial production processes, American Eng- that independence most certainly does not mean isolation. lish spelling of words is used. 18 Investigating Human Fatigue Factors: A Tale of Two Copyright © 2016—International Society of Air Safety Investigators, all rights reserved. Publica- Accidents tion in any form is prohibited without permis- By Katherine Wilson, Ph.D., Human Performance and Survival Factors Division, sion. ISASI Forum registered U.S. Patent and T.M. Office. Opinions expressed by authors do U.S. National Transportaton Safety Board—The key to any robust investigation is not necessarily represent official ISASI position to ask the right questions and gather as much data as possible to ensure important or policy. Permission to reprint is available upon fatigue-related factors are not being missed. application to the editorial offices. 22 Unstable Approaches: A Global Problem Publisher’s Editorial Profile: ISASI Forum is print- ed in the United States and published for profes- By David Ross (MO5600), Senior Regional Operations Investigator, Transporta- sional air safety investigators who are members tion Safety Board of Canada—Teamwork is essential in every investigation, and of the International Society of Air Safety Inves- investigators should be encouraged to surround themselves with experts and to tigators. Editorial content emphasizes accident investigation findings, investigative techniques collaborate with them. and experiences, regulatory issues, industry accident prevention developments, and ISASI and member involvement and information. DEPARTMENTS Subscriptions: A subscription to members is pro- 2 Contents vided as a portion of dues. Rate for nonmem- 3 President’s View—ISASI Welcomes New Year bers (domestic and Canada) is US$28; Rate for nonmember international is US$30. Rate for all 30 ISASI Information libraries and schools is US$24. For subscription 32 Who’s Who—Embry-Riddle Aeronautical University information, call 703-430-9668. Additional or replacement ISASI Forum issues: Domestic and Canada US$4; international member US$4; domestic and Canada nonmember US$6; interna- ABOUT THE COVER tional nonmember US$8. The shown engineering flight animation was one of the components of the Transportation Safety Board (TSB) of Canada investigation process in the development of the sequence of events leading to the unstable approach accident of the Boeing 737-210C operating as First Air Flight 6560 from Yellowknife, Northwest Territories, to Resolute Bay, Nunavut, on Aug. 20, 2011 (see page 22).

TSB photo. INCORPORATED AUGUST 31, 1964 2 • January-March 2016 ISASI Forum PRESIDENT’S VIEW

ISASI Welcomes New Year By Frank Del Gandio, President

n behalf of all your elected ISASI by the UAS Working Group, achieved who spoke about officers and appointed chair- continuing growth of students selected to developing inves- men of committees and working receive ISASI’S Kapustin memorial schol- tigative capabil- Ogroups, I wish all Society mem- arships, celebrated the award of the first ities. Another 13 bers and supporters a healthy, prosper- ISASI–Robertson Family Aviation Safety presentations ous, and happy new year. Fellowship endowed by ISASI’s Lederer covered biohaz- I am sure that 2016 will bring collec- Award recipient Dr. Harry Robertson, and ards, investigator tive and individual challenges as we go saw continuing growth in safety confer- safety, analysis, about our tasks of making the skies safer ences conducted by our ISASI societies. manufacturer through analytic, thorough, and con- In this regard, I attended the Middle support, chal- clusive accident investigations aimed at East and North Africa Society (MENA- lenges of sea determining cause and not blame. I am SASI) third annual seminar in November search and recovery operations, and equally sure that we are up to the task of 2015. The seminar was held at the Inter- family assistance. meeting such challenges. continental Hotel Festival City in Dubai, “Young Investigators Presentations” In 2015, the Society enlarged its scope United Arab Emirates (UAE). The event, were given by Fatima Al Mansoori of Abu of activities to service the broader land- hosted by the general civil aviation au- Dhabi University and Crystal Ioannou scape of air safety. For example, we have thority, with sponsorship from Airbus, Eti- of the Emirates Aviation University. Al achieved unprecedented involvement in had Airways, Emirates Airline, flydubai, Mansoori gave a presentation titled “As- International Civil Aviation Organiza- and the Gulf Aviation Academy, attracted similating Western-Based Crew Resource tion (ICAO) deliberations, seen greater 120 attendees. Management into a Middle Eastern attention to issues in both our working Speakers included Marcus Costa, chief Culture—A Personal Perspective,” and groups and committees, established two of air accident investigation for ICAO, Ioannou gave her presentation on “The new working groups: Airports and Critical who updated the delegates on control Good, the Bad, and the Ugly: The True Incident Stress Management (CISM), of information initiatives at ICAO; Keith Story Between SMS and Reality.” published the ISASI Unmanned Aircraft Conradi, chief inspector of the UK Air Workshops on aviation insurance and System (UAS) Handbook and Accident/ Accidents Investigation Branch, who human factors were held prior to the Incident Investigation Guidelines prepared discussed a series of North Sea helicopter seminar. These were very informative and accidents; Dr. were attended by more than 80 delegates. Edna Naddaf, MENASASI is growing very rapidly a corporate in both individual and corporate mem- and aviation bership. The next MENASASI seminar is psychology scheduled to take place in November 2016 consultancy, in Rabat, Morocco. The 2017 MENASASI who gave an seminar will be held in Saudi Arabia. The interesting MENASASI group has committed and is presentation currently planning to host the interna- on the role tional ISASI conference to be held in fall of aviation 2018 in Dubai, UAE. psychology Since its founding in August 2013, in building MENASASI has exhibited phenomenal a culture of growth. This is recognition of ISASI’s safety; and international value and a tribute to Capt. Ibrahim MENASASI President Ismaeil Al Hosani Koshy, direc- and his colleagues at the Air Accident tor general of Investigation Sector of the UAE General the Aviation Civil Aviation Authority. Investigation I close this message with the knowledge Shown are some of the 120 participants who attended the Middle East Bureau of the that with your help our Society will move and North Africa Society’s third annual conference held in Dubai, United Kingdom of forward into 2016 in a positive and Arab Emirates. Saudi Arabia, productive way.

January-March 2016 ISASI Forum • 3 opportunity to improve safety.” This is obviously our domain, we safety INDEPENDENCE investigators. It is also a domain in which reg- DOES NOT MEAN ISOLATION ulators, manufacturers, airlines, and pilots will By Rémi Jouty, Director, Bureau d’Enquêtes et d’Analyses pour la sécurité want to be involved as de l’aviation civile (BEA), France they deal with safeguarding or improving safety in the course of their daily business (Remarks presented by Director Jouty in his keynote address to the delegates of the ISASI 46th annu- activity. al international conference on air safety accident investigation on Aug. 26, 2015, held in Augsburg, Germany.—Editor) So considering all those reactions, where improvements in safety appear ith the theme of this year’s developing meaningful data by gathering only at the end, we have to reconsider the conference being “Independ- information that may not yet be available. question, “What is the purpose of a safety ence Does Not Mean Isola- The next question is, “Whose fault is it, investigation?” Can it be, as [the Interna- Wtion,” I will try to develop some who is to blame?” I feel that this question tional Civil Aviation Organization] ICAO thoughts on the words “independence” is perceived as more and more important says that its sole objective is to prevent and “isolation” based on the BEA’s expe- in our societies, which seems to be out accidents? Can we ignore other reactions rience. of phase with our purpose of working and expectations? How can we handle As to the question of isolation, recent solely for safety improvements, and with these other groups with an interest in this months have shown that the BEA certain- aviation promoting the concepts of just accident and their typical reactions? ly does not work in isolation, if I judge culture and protection of sensitive infor- Let’s review our relationship with these this, for example, by the news media ex- mation. This question is asked by fami- various groups. Let’s start with manu- posure we have been subject to recently! lies of victims, and we obviously cannot facturers, airlines, regulators, and pilots’ Next, to discuss the need for inde- blame them from asking this question. groups. As I said before, they will be moti- pendence, I think it is useful to ask, “Why The question is also highlighted by the vated by the need to preserve their repu- should a safety investigation be independ- news media—which often tends to prefer tation, to reassure their customers, to de- ent?” Is there a difficulty or some issue in the “simple answer” of saying who is to fend the honor of their members. Can we, having an independent safety investiga- blame, rather than entering into complex or indeed should we, work and undertake tion? As we all know only too well, as per technical explanations, which may be our investigation without them? I believe Annex 13, the sole objective of the safety more relevant when dealing with improv- not. Accident investigation is a technical investigation is accident prevention, and ing safety. And, of course, lawyers and activity and requires data, knowledge, its purpose is not to apportion blame or judicial authorities also ask this question, and expertise from manufacturers, op- liability. What could the obstacles to an though in this they are simply doing their erators, pilots (although not necessarily independent investigation be? Could any- job. pilots’ unions), and regulators. All of these body want to oppose the goal of prevent- The next reaction of “I want or I need organizations or groups of persons also ing future accidents? Who could want to to show that I care and that I am doing have the goal of improving safety in their influence our investigation activity? Why? something about it” coming from political daily business. How? leaders seems to be an increasing trend. Does this limit our independence? To address those questions, we need This has been noted during a tutorial on Maybe, and maybe not. But we cannot to consider the wider context in which Monday and definitely has an influence do without them, and we have to use this a safety investigation takes place, which on other actors and on the context in knowledge while taking care not to be bi- was called “the social context of an inves- which we try to undertake the safety ased or influenced in our analyses. Annex tigation” during one of the ISASI tutorials investigation. 13 provides a framework for that, which on Monday. Another reaction is, “I need to preserve has proven to be effective over the years. So what are the reactions after an my reputation and reassure my custom- The next question is, “Whose fault is accident? ers.” This reaction may come from the it? Who is to blame? Those asking these The first question is obviously, for operator, manufacturer, and/or regulato- questions are families, the news media, everyone, “What happened?” In these ry authority. Another motivation for this and, obviously, lawyers and judicial au- days of instant communication, social reaction could be the feeling of the need thorities. As I said before, these questions media, and wide access to various data, to avoid being blamed or found liable. seem to be of increasing importance. The a large number of information, data, A variant to this reaction is, “I need to way these questions are handled may be rumors, and statements circulate publicly preserve the reputation and honor of my different in different countries, according very early. So here the difficulty is more members,” which may come from pilots’ to the laws and social traditions. to sort out the true information from unions. In France, some years ago, when things unfounded affirmations, of validating And at the very end, there is the went wrong, the popular reaction was data, of putting things into perspective, of reaction of “I want to take this as an to cut off heads, preferably of somebody

4 • January-March 2016 ISASI Forum important and visible like a king or some- situation, I feel it is difficult for the safety independence has limitations in several body with the power to influence events. investigation to ignore the question. The ways because a safety investigation takes Things have changed a little bit, but it safety investigation will then be expect- place in a wider framework involving is still very much in our culture to want ed to, at least implicitly, help answer to many other entities that are interested, to designate somebody to be personally the question. In such a situation, can for many different reasons, in the acci- blamed and to be sentenced to jail. In we still say that the sole objective of the dent and from which either we cannot, or other countries, expectations may take safety investigation is improving safety? should not, be isolated. different forms, like public designation of I noted with interest that in countries in As a footnote to the above, I found this an entity or a person to blame, or assign- which there is no criminal investigation, sentence that could be interesting in ing punitive damages, or putting the em- or where the judicial investigation is not this discussion on the independence of phasis on monetary compensation to be “visible,” the safety investigation pro- safety investigations: “l’indépendance est paid by those found responsible. However, cedures sometimes bear some striking un statut, l’impartialité est une vertu”— I think that all over the world the “Whose formal similarity to judicial procedures, which I would translate as “independence fault is it?” reaction is there and has to be as if it were trying to mimic judicial pro- is statutory, impartiality is a virtue.” This dealt with one way or another. cedure in order to achieve a similar social sentence is said to have been formulated There is thus a wide variety of situa- objective. by Robert Badinter, who was a French tions, and the international safety inves- Let’s now look at the reaction “I want lawyer, minister of Justice, and then chair- tigation system, defined by ICAO Annex to show that I care and that I am doing man of the Constitutional Court. He is 13 and by European Regulation 996/2010, something about it,” which we seem to see famous for having fought that nasty habit has to accommodate these situations. more and more often these days. It makes the French had of cutting off heads when To clarify, I will contrast various possible sense for political leaders to show their something went wrong; as minister of situations. compassion for victims after a disaster, Justice he led the decision to abolish the The first one, which I know best be- and it has always been a reaction to be death penalty in France. He pronounced cause it corresponds to my country, is expected from them. However, nowadays this sentence when he was appointed where the judicial, criminal investigation we sometimes see them going a step chairman of the Constitutional Court, at is systematic in the case of a fatal aviation further and being seen to be in control a time when there was a debate on the accident and takes place in parallel, but of the investigation, and communicating degree of independence of this court, at the same time, as the safety investiga- on technical details on what they believe notably in relation to political leaders. tion. This may be seen as an undesirable could have happened, with sometimes This shows that this debate on the situation from the point of view of the inaccurate or nonvalidated information. limits of independence is present even safety investigation and just culture, but it This may easily cast some doubts on the for the judicial authorities for whom one may nevertheless have the positive effect reputation of independence of the safety would see independence as being taken of relieving some pressure on the safety investigation. for granted and not subject to debate. I investigation authority. When you get the What can we do about this? From my would like to take this sentence on board question, “Whose fault is it?” you simply perspective, it would appear to me that and conclude that what we should really answer, “That’s part of the judicial proce- little can be done about this. Informing aim at is impartiality. Some degree of dure!” However, it creates other problems. political leaders or their closest advisors independence is one means, clearly nec- The judicial investigation (or the investi- of what a safety investigation is and why it essary to achieve impartiality; but as you gating judge) is independent, and he may is important to preserve its independence have seen, I feel that perfection cannot be see the safety investigation as a threat to may be helpful. However, those involved reached in this area. his independence. And, indeed, judicial may sometimes be inclined to protect Independence is not enough in itself and safety investigations have to agree their own interests in the short term, to ensure impartiality. It also requires, on ways to share evidence, including regardless of future consequences. perhaps more importantly, technical sensitive data, which should, ideally, be Another course of action that could be competence. This in turn requires having dedicated to safety only. And both have to considered would be to delay communi- access to technical capabilities, whether compromise their own independence to cation on the safety investigation for a few in house or through other organizations, find ways to permit both investigations to days or weeks, as the period of time when and here we touch on the idea of coop- progress at the same time from basically political leaders are engaged in commu- eration and mutual assistance, which Ulf the same facts and data. nicating on the event does not usually Kramer, and then Johann Reuss, raised in In some other countries, there is no last long. I believe this is not usually an an earlier session. judicial investigation, or the judicial option, since nowadays a lot of informa- Thus, when we undertake an investiga- investigation, usually more targeted at tion or rumors circulate very early, and tion impartially and on a sound technical civil litigation, is less visible, or takes there is a need for the safety investigation basis, we need to ensure that the outcome place only after the safety investigation. to put the facts straight right away to of the investigation reaches its target, and Nevertheless, the “Who is to blame” reac- avoid false information and speculative for this we need credibility. Credibility will tion is still there, from the first day after scenarios being remembered as being result from our past performance, notably the accident, and the appetite for answers what actually happened. in terms of technical value and good to the question is still very strong. In that So in conclusion, I would say that our communication.

January-March 2016 ISASI Forum • 5 A New Tool for Analyzing The Potential Influence of Vestibular Illusions Boeing saw the need for a valid, accessible tool that allows investigators to look at flight data and determine if spatial disorientation may have contributed to pilot control inputs.

By Randall J. Mumaw, Associate Technical Fellow, Human Factors, Boeing; Eric Groen, Senior Scientist, TNO; Lars Fucke, Lead Engineer, Boeing; Richard Anderson, Senior Accident Investigator, Boeing; Jelte Bos, Senior Scientist, TNO, and Professor, VU University; and Mark Houben, Research Scientist, TNO (Adapted with permission from the authors’ technical paper entitled A New Tool for Analyzing the Potential Influence of Vestibular Illusions presented at ISASI 2015 held in Augsburg, Germany, Aug. 24–27, 2015, which carried the theme “Independence Does Not Mean Isolation.” The full presentation, including cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2015 Technical Papers.”—Editor)

n January 2004, a B-737-300 crashed this event, the captain seemed unable to minutes after takeoff from Sharm el- determine which way to roll the airplane Sheikh, Egypt. The departure was on a to restore it to wings level—at one point Idark night, over the Red Sea, and there trying to engage the autopilot to get were few, if any, visible cultural land- assistance in recovering from the upset. marks that could be used to orient to the The investigation reached the conclusion horizon. The captain (the pilot flying, PF) that the pilot was spatially disoriented. had initiated a long left climbing turn, but (Of course, virtually every accident is the partway through that turn the airplane result of a chain of events and failures, had actually made a slow transition from and, in Boeing’s analyses, no accident a left bank to a right bank (20 degrees was judged to be caused solely by a pilot’s and increasing slowly). The first officer spatial disorientation.) Dr. Randy Mumaw, a cognitive scientist, has (F/O) informed the captain that they were This event and the findings of the recently taken a research position at NASA turning right in this exchange: F/O: Turn- investigation were surprising for many Ames. During his 18 years at Boeing, he worked ing right, sir. Captain: What? F/O: Aircraft safety experts studying commercial jet in aviation safety and accident investigation. turning right. Captain: Turning right? How transports: spatial disorientation (SD) Most recently, he has focused on loss of control turning right? was not considered a significant hazard events, especially those involving loss of situ- At this point, the captain was making in airline operations. SD was known to be ational awareness regarding airplane state. control inputs on the wheel to roll further a risk in high-speed, highly maneuverable Dr. Eric Groen, an aerospace physiologist, Dr. Jelte Bos, a physicist, and Dr. Mark Houben, a to the right, and continued doing so. The military jets. But in the relatively stable biomedical engineer, work as scientists at TNO airplane eventually rolled to about 110 world of commercial jet transports, SD and share research interest in the areas of pilot degrees to the right before substantial was not considered a threat. At this point, spatial disorientation, upset recovery, motion control inputs in the opposite direction the findings from Flash Air seemed to sickness, and flight simulator technology. Lars were made, which were made too late to be a “one off ” event. Unfortunately, two Fucke is an R&D lead with Boeing (Madrid), avoid the crash into the Red Sea. During more similar B-737 accidents happened working in the areas of system and flight deck operations safety. Richard Anderson has been a Boeing accident investigator since 1997.

6 • January-March 2016 ISASI Forum in 2007 (Adam Air at Sulawesi, Indonesia; level. Then, for various reasons, the typically occurs on a go-around Kenya Airways in Douala, Cameroon). In airplane rolled away from that ori- when the airplane transitions from a each case, the PF made control inputs entation at a rate less than 5 degrees slowing down to a rapid acceleration away from wings level, resulting in a loss per second. Roll rates this slow fall and pitch up. The vestibular sys- of control (LOC) and fatal crash. below the vestibular system’s ability tem cannot distinguish between an In 2008, Boeing took a closer look at the to detect, hence the name sub-thresh- inertial acceleration and a compo- influence of SD in commercial transport old. Further, load factors during the nent of gravity, and the rapid accel- accidents. We established a clear defini- roll were less than 1.2 g’s, indicating eration can be misinterpreted as a tion of SD for this context and searched both that pilots were not loading up further pitching-up moment. Again, for accidents and major incidents that the airplane during an intentional poor-visibility conditions contribute fit that definition. In some cases, acci- turn and that their somatosensory by removing valid visual inputs. As dent reports, especially reports from (or “seat-of-the-pants”) input would the airplane begins the go-around, not have been significantly different the pilot perceives that the airplane before 1990, did not provide sufficient from level flight. Pilots were unaware is pitching-up considerably and starts detail to place the event conclusively in of the change in orientation and then to push the nose downward to com- the SD category. However, this extensive suddenly found their airplane banked pensate. This can result in an actual search identified 16 SD-related accidents at 35 degrees or beyond. In this nose-down attitude and descent into and one major incident in the period of situation, these pilots were apparent- the ground. 1991–2007; roughly one event per year ly confused about which direction (see Figure 1). Also, 2008 produced anoth- to roll back to wings level, and they er B-737 accident (Aeroflot Nord at Perm, Commercial Aviation Safety Team rolled the airplane in the wrong These insights from the 2008 work led Russia) that had the same signature of the direction. These inappropriate pilot Boeing to engage the larger aviation safe- PF rolling away from wings level. Further, inputs were key because the airplane since 2008, other accidents and incidents was not initially in an unrecoverable ty community. In 2009, we approached around the world have been linked to attitude. Note that it is possible that the Commercial Aviation Safety Team SD—e.g., Afriqiyah A330 at Tripoli, Libya a post-roll illusion could also have (CAST) to share our findings on SD in May 2010, and the Scat CRJ200 near influenced the progressively inappro- events. CAST takes the role of bringing Almaty, Kazakhstan, in January 2013. priate control inputs. together government and industry to analyze safety issues, generate potential One important finding of this review of • Somatogravic illusion—This illu- accidents and incidents was the iden- sion is quite different from the first. solutions, assess the feasibility of those tification of two very different SD phe- Sub-threshold roll relies on the solutions, and adopt the solutions that nomena that were contributing to these vestibular system failing to detect a are both effective and feasible. These accidents: change to the airplane. The somato- solutions become the official CAST safety • Sub-threshold roll—In these cas- gravic illusion, on the other hand, is enhancements, which are then imple- es, the pilot had an understanding the result of a misinterpretation of mented by CAST members. or expectation of the airplane’s a very noticeable sensation related CAST agreed to study this issue be- orientation; typically, it was wings to linear acceleration. This illusion ginning in 2010 and combined it with

Figure 1. Identified SD events.

January-March 2016 ISASI Forum • 7 aspects of crew performance. Most relevant here was the inability of the flightcrew member who was NOT disoriented to intervene or take control from the PF. An authority gradient was at play in several of these events, as well as poor understanding or exe- cution of managing an incapacitated pilot (i.e., the disoriented pilot). The one event that was not an accident was a case in which the pilot monitoring (PM) grabbed the wheel and column and fought hard (against the PF) to bring the airplane out of the dive (at about 320 feet above ground level). The CAST work led to a number of proposed safety enhancements tied to Figure 2. Outline of TNO perception model showing the neural mechanism to resolve changes to airplane design, operational the perceptual ambiguity in the sensed specific force f into the subjective vertical (SV) Legend: OTO=otoliths; SCC=semicircular canals; FLW=optic flow; F&P=visual frame and procedures, and pilot training. It also polarity; IV=idiotropic vector (i); R=rotation matrix, LP = low-pass filter. called out specific needs in the areas of aviation safety R&D and safety data another group of LOC events tied to • Aeroflot-Nord, B-737-500, July 14, management [CAST’s final report on this energy state. The larger theme for CAST 2008, Perm, Russia. analysis of airplanes state awareness was the pilot’s loss of awareness regarding The CAST analysis identified a number events can be found at www.skybrary. airplane state: loss of attitude awareness of other issues that contributed to many aero/index.php/Commercial_Aviation_ (SD) and loss of energy state awareness. of these events. The most relevant of these Safety_Team_(CAST)_Reports]. More generally, it was called airplane for the SD events were For the SD events, the safety enhance- state awareness. The group given this • Lack of external visual references—In ments ideally address both the PF’s charge included members from Boeing, these SD-related events, due to dark- inappropriate control inputs and the Airbus, Embraer, Bombardier, Honeywell, ness or IMC, flightcrew members had PM’s reluctance or inability to intervene Rockwell Collins, MITRE, Airlines for no clear view of the horizon through when the PF is incapacitated by SD. One America, the Regional Airline Associa- the flight deck windows and, there- specific safety enhancement that Boeing fore, lacked normal orientation and tion, the National Air Carrier Association, is pursuing is a roll arrow that provides the FAA, NASA, and pilots’ unions (ALPA self-motion cues, such as perspective, alerting and roll guidance to the pilot and the APA). depression angle, optical flow, and when bank angle exceeds 45 degrees. We This group conducted a detailed anal- motion parallax. A visible horizon believe this enhancement addresses both ysis of the following SD-related events, can establish “visual dominance,” a guidance for control inputs and more which was meant to be a representative well-known perceptual phenomenon in which the visual input can over- effective intervention. set, not an exhaustive set of SD-related come a vestibular illusion. events. • Formosa Airlines, Saab 340, March 18, • Crew distraction—While some form Accident investigation and analysis 1998, Hsin-Chu, Taiwan. of distraction occurs on virtually all While the CAST work identified a broad flights, it is successfully managed • Korean Air, Boeing B-747-200, Dec. set of safety enhancements, it failed to by flight crews in the vast majority 22, 1999, Stansted Airport, London, touch on accident investigation. In large of cases. Flight crews are trained to England. part, the investigation agencies that try to eliminate and/or manage distrac- make sense of pilot actions have no capa- • Gulf Air, Airbus A320, Aug. 23, 2000, tions. In the events we analyzed, the bility to assess the potential for SD. A few Bahrain. basic task of aviating was neglected, of the events mentioned above were sub- • Icelandair, B-757-200, Jan. 22, 2002, attention was not given to critical Oslo, Norway. alerts or displays, or decision-making jected to this type of analysis because the was hindered. A major component of investigating agency hired outside experts • Flash Air, B-737-300, Jan. 3, 2004, to apply their perceptual models to the Sharm el-Sheik, Egypt. this failure of attention was chan- nelized attention, a phenomenon in flight data. Other investigation reports • Armavia Airlines, Airbus A320, May 3, which a pilot becomes completely have only speculated about the possible 2006, Sochi, Russia. focused on some task or issue and is influence of SD on the pilot’s actions and • Adam Air, B-737-400, Jan. 1, 2007, unable to shift attention to other im- have provided no analysis. Boeing saw Sulawesi, Indonesia. portant tasks—in this case, aviating. the need for a valid, accessible tool that • Kenya Airways, B-737-800, May 5, • Crew resource management—CRM allows investigators to look at flight data 2007, Douala, Cameroon. is a broad term and covers many and determine if SD may have contribut-

8 • January-March 2016 ISASI Forum angular accelerations of the head, and their output codes for angular velocity (ɷ). Within the visual system, the optic flow (FLW) in the retinal image typically carries information on head velocity. In addition, horizontal and vertical elements in the retinal image provide a visual frame (F), and together with polarity (P) cues about what is “up” and what is “down” these determine the visual orientation of the head with respect to Earth (p). Still, these vestibular and visual cues do Figure 3. Model-predicted response of the semicircular canals (dotted line) to a roll input not fully account for human orientation. (solid line) that is maintained for several seconds. The shaded area indicates the thresh- Human subjects typically underestimate old that must be exceeded before angular motion is being perceived. their self-tilt, a phenomenon called the ed to pilot control inputs. We turned to a parison between recordings of aircraft A- or Aubert effect. To explain this bias group with expertise in modeling percep- motion and attitude (model input), and toward the longitudinal body axis, which tual systems and illusions: the Nether- the way this is being perceived accord- is considered a somatosensory phenom- lands Organization for Applied Scientific ing to the model (model output), should enon, Mittelstaedt in his 1983 writing A Research, or TNO. [TNO is the acronym help identify the phases of flight that are New Solution to the Problem of the Subjec- for the Dutch version of this long title.] prone to induce spatial disorientation. tive Vertical assumed a body-fixed “idio- TNO, with a long tradition in vestibular In its current state, the interpretation of tropic vector” (IV and i), which is added research, developed a general perception the model output in terms of SD requires vectorially to the vestibular vertical. model to predict and analyze human a subject-matter expert. The objective The neural integration of these sensory motion perception in environments of the project was to make the model signals has been implemented as follows. such as airplanes, cars, ships, and also applicable and accessible for accident in- As stated, the otoliths respond to specific moving-base simulators. Its state-of- vestigators by 1) implementing a module force (f), i.e., the vector sum of the free- the-art model consists of mathematical that automatically recognizes SD events fall acceleration determined by gravity representations of the sensory systems in the data, also referred to as detection (g), and inertial accelerations determined involved in motion perception (i.e., visual and identification, and 2) adding a user by linear motion (a), hence f = g+a. Al- and vestibular system) as well as their friendly interface. though of different origin, accelerations neural interaction. The model takes in due to gravity and inertia are inherently time histories of self-motion and -orien- Basic perception model indistinguishable (Einstein’s equivalence tation and predicts how they are being The perception model consists of the principle). According to R. Mayne’s A perceived. With respect to spatial orien- relevant sensory transfer functions and Systems Concept of the Vestibular Organs tation in aviation, the dominant issue is the visual-vestibular interactions that (1974), our brain seems capable of making the perceived self-orientation relative to play a role in human spatial orientation the distinction by a neural process that gravity. Essentially, the model takes the (see Figure 2). In this model, the organs behaves like a low-pass filter (LP). Assum- pilot’s point of view—i.e., the orientation of balance within our inner ears sensing ing that the brain “knows” that gravity is of perceived gravity with respect to the physical motions are divided into otoliths constant, and accelerations due to head self. Moreover, it is essential to under- (OTO) and semicircular canals (SCC). motion are relatively variable, a low-pass stand that the human sensors are not The otoliths typically respond to specific filter adequately separates both compo- perfect, and the central nervous system force (f) and code for linear acceleration, nents from the otolith output (f). Addi- (CNS) does not reckon all laws of physics, and the semicircular canals respond to tional information on angular motion of such as Newton’s second law, and the differential relationship between position, velocity, and acceleration. This allows for perceptual ambiguities that basically determine spatial disorientation. The TNO model has been successfully applied to predict motion sickness incidence and to evaluate motion cueing in flight simulators. We used the TNO perception model as the starting point for the collaborative development of a standalone software tool Figure 4. Model response to (simplified) sustained longitudinal acceleration. The tilted specific force vector (solid line) gradually induces a sensation of self-tilt (dotted line), i.e., to support the analysis of SD events from the somatogravic illusion. The shaded area indicates the perceptual threshold that must flight data. The basic idea is that com- be exceeded before the illusory tilt is being perceived.

January-March 2016 ISASI Forum • 9 after-sensation may prompt the pilot to make inappropriate control inputs. In the case of roll motion, it has been shown that the post-roll effect induces pilots to overshoot the bank angle. Hence, this vestibular effect also contributes to the crew’s confusion about the direction in which an aircraft is banking. The “somatogravic illusion” is related to the functioning of the otoliths and the Figure 5. Flow of automatic detection and identification of SD events from the flight data perceptual ambiguity of the specific force. recorder. The illusion has been studied during sus- the head, coming from the semicircular perceptual threshold, but also false (af- tained centrifugation, where the constant canals and visual flow, is included in the ter-) sensations of motion when the real tilt of the specific force is gradually being model, not only to estimate subjective (aircraft) motion has stopped. Examples perceived as “vertical.” For example, a rotation (SR), but also to apply the re- of the latter are the “post-roll illusion” subject who is seated upright and facing quired rotations (R and R-1) for estimating and the “graveyard spin.” Figure 3, page 9, the center of the centrifuge soon feels the specific force components relative to shows the response of the semicircular him- or herself tilted backwards, similar Earth. This is required because the spe- canals to a step input of roll motion that to the effect that a pilot may experience cific force is sensed in a head-fixed frame is sustained for several seconds before it during a go-around maneuver. Figure 4, of reference, while gravity is constant in abruptly ends again. Since the semicircu- page 9, illustrates the model output in an Earth-fixed frame of reference. Using a lar canals behave like a high-pass filter, such a (simplified) situation. weighted vector addition, the resulting in- they only respond to changes in angular ternal estimate of gravity (g) is combined motion and not to constant rates. Hence, SD detection and identification with the visual and idiotropic vectors to as the figure illustrates, the pilot accu- The SD detection and identification determine the subjective vertical, or SV. rately perceives the onset of roll motion, module includes logic that discriminates In order to make the model applicable but this sensation gradually fades as the between the various SD illusions (see as a standalone tool for the detection of motion continues at a constant rate. Figure 5). The module first computes the SD illusions from flight data, three en- Eventually, the sensation may become mismatch between the perceived attitude hancements were needed: 1) a “detection sub-threshold even though the aircraft (the subjective vertical) and the true ori- and identification module” to automati- is still turning at a rate that is above the entation of the aircraft relative to Earth, cally recognize SD; 2) visualization of the perceptual threshold. When the turn is as well as the mismatch between the model output; and 3) a user interface to stopped, however, an after-sensation perceived (subjective rotation) and angu- allow interaction with the input and out- appears in the opposite direction of the lar rates. When one of these mismatches put. These enhancements are discussed in original aircraft motion. This illusory exceeds a critical value, another logic is the next sections.

SD categories Based on the results of the aforemen- tioned Boeing study, the current project focused on automatic detection of vestibular illusions, in particular sub-threshold roll motion and the somatogravic illusion. More complicated vestibular illusions (e.g., the Coriolis illusion), as well as visual illusions tied to motion and orientation (e.g., “black hole,” vection illusion), fell outside the scope of this project, as these require information that is not available from the flight data recorder, such as the pilot’s head movements (Coriolis) and visual inputs. Sub-threshold roll motion is related to the functioning of the semicircular canals and falls in the category of “somatogyral Figure 6. Screenshot of the model output during analysis of a coordinated turn. The illusions.” This involves misperceptions of bottom tracks “attitude,” “gyral,” and “sub” indicate that the maneuver induces a misper- angular motion in general, not only un- ception of attitude, a somatogyral illusion, and also contains an episode of sub-threshold detected motions that remain below the motion.

10 • January-March 2016 ISASI Forum applied to identify whether a misperception of attitude results from the somatogravic illusion or from a cumulative effect of misperceived angular motion. Further, computations are being made to differ- entiate whether a somatogyral illusion occurs during aircraft motion (when the perceived angular rate drops below a threshold value) or after aircraft motion (the post-roll effect, when the after-sensation exceeds the same threshold value). Looking at Figure 3, page 9, this means that although the perceived angular rate starts fading quite soon during the roll motion, it is only identified as SD when it drops below the threshold. Similarly, at the stop of the airplane roll, the illusory aftereffect is only designated a post-roll illusion as long as the model-output exceeds the threshold. In addition, aircraft motions that do not exceed the thresh- Figure 7. Example of model output during takeoff. The bottom tracks “attitude” and “gravic” indicate the somatogravic illusion. old value at all are being identified as sub-threshold motion. The critical values bottom right of the window contains an gravitational acceleration causes the used for identification are based on TNO animation of aircraft attitude (solid air- specific force to be perceived as vertical. research as well as the open literature and craft icon) and perceived attitude (trans- Eventually this results in the feeling of can be adjusted to optimize the model’s parent aircraft icon); the view can be “level flight” while in reality the aircraft is signal-to-noise ratio. toggled between aft and side view. When banked relative to the Earth. Finally, after there is a misperception of attitude, these 10 seconds, the sub-threshold label is activated because the actual roll rate has The TNO software tool two deviate. The animation can be controlled with play, pause, and stop buttons. dropped below the perception threshold. The software application takes in time The vertical black line in the time series at Figure 7 shows another screenshot histories of flight data (e.g., from a flight the left part of the GUI shows the current produced from data of a takeoff flown data recorder) selected in the “Input time of the animation. in a flight simulator. Due to the forward and Settings” tab (see Figure 6) that also The example in Figure 6 corresponds acceleration of the aircraft (solid line in allows the user to set critical values. The to a coordinated turn to the right at 30 upper plot), a false perception of pitch- model then computes the perceived mo- degree angle of bank. Around t=7 s, the ing up arises (dotted line in bottom plot) tion, and labels the SD categories, that are perceived roll rate (dotted line in the up- while the aircraft stays level (i.e., zero shown on the “Results” tab together. The per time history) starts to wane due to the pitch). From about t=13 s, the mismatch model output can be saved to file on the dynamics of the semicircular canals. This between perceived and actual pitch is “Outputs” tab. Figure 6 shows a screen- results in a mismatch between actual and large enough (criterion set at 8 degrees) to shot of the “Results” tab of the graphical perceived bank angle (more specifically, be identified as the somatogravic illusion, user interface (GUI). The plots on the left an underestimation of bank angle), as in- as well as misperceived attitude. These part of the window show time histories dicated by the “attitude” track at the bot- two examples show that both the somato- of rotation and attitude in three cardinal tom. Between t=8.5 s and 10 s, the label gyral and the somatogravic illusions can directions (x-axis = roll, or surge; y-axis = “gyral” is also activated, indicating that lead to misperceived attitude. In the case pitch, or sway; z-axis = yaw, or heave). The the perceived roll rate has dropped below of the somatogyral illusion, this is due to solid lines reflect actual aircraft motion the threshold (3 degrees per second) the time integral of misperceived angular (model input), and the dotted lines reflect while the aircraft is still rolling at a rate motion. the perceived motion (model output). The above this threshold (hence, the somato- area between aircraft and perceived mo- gyral illusion). Being a coordinated turn, A case study tion is shaded to indicate the mismatch the aircraft’s specific force banks with This analysis, driven by the TNO model, that is input into the SD detection. The the airplane up to about 30 degrees, and shows that the vestibular system can upper right part of the window shows the hence remains aligned with the body axis often be fooled by airplane flight, and we criteria settings. The bottom tracks show throughout the maneuver (solid line in know that virtually every pilot has expe- various SD labels that have been identi- the bottom time history). The model out- rienced at least momentary confusion fied by the model: “attitude” (mismatch in put (dotted line) in the same plot shows about orientation. However, we also know perceived attitude), “grav” (somatogravic that the pilot briefly perceives banking that pilots are rarely so disoriented that illusion), “gyral” (somatogyral illusion), to the right, but then the low-pass filter they make inappropriate flight control “sub” (sub-threshold angular motion). The that distinguishes between inertial and inputs because, typically, the visual infor- January-March 2016 ISASI Forum • 11 mation environment is rich enough and familiar enough to trump the vestibular inputs. Accidents and incidents (from the Boeing analysis), however, demonstrate that there are rare cases in which a degraded visual environment can lead to a greater susceptibility to SD. The role of this tool in accident investigation is to help us understand why inappropriate control inputs—rolling away from wings level or pushing the nose down at a low altitude—were made. Figure 8 shows a brief illustration (part of a larger case study) using data from a B-737-300 accident highlighting this capability. The airplane took off on a dark night over water, so there were few visible cultural landmarks to support orientation. The PF had initiated a long left-climbing turn, but partway through that turn the airplane made a slow tran- Figure 8. Model analysis of a B-737 LOC accident showing 140 s of actual and perceived sition from a left bank to a right bank. angular motion (upper time history) and actual and perceived roll and pitch attitude (lower time history). The SD tracks indicate issues with perceived attitude as well as sub-thresh- This period of transition from about 20 old angular motion through the larger part of recorded flight. degrees left bank to 20 degrees right bank took about 70 seconds, and the airplane to the shaded area in the bottom time context, and, in some cases, that con- was pitching up and slowing down 15–20 history, there was little or no vestibular text should include the sensory systems’ knots during this period. feedback about the change in heading inputs to the pilot’s overall situation The model analysis indicates that, (perceived yaw angle remained around 0 awareness. The long history of aviation during this period, there was no vestibu- degrees), but since heading does not af- safety has shown that SD occurs and lar feedback on the airplane’s orientation fect the orientation relative to gravity, it is can have fatal consequences. The TNO and motion, which, without strong visual not included in the determination of SD. tool offers a method to more completely input on orientation, would have led to During this 70-second period, also, examine that context. It shows what the the PF’s confusion about the airplane’s the PF became confused and distract- pilot’s vestibular system was telling the orientation. The SD track “sub” shows ed by some unexpected behavior from pilot about his or her orientation and that the transition from banked left to the autoflight system. This distraction motion. Certainly, this input is only part banked right was almost completely probably reduced his awareness of his of the whole picture; but when there is sub-threshold, meaning that the pilots slow, perhaps inadvertent, control inputs a degraded visual environment, we have did not feel the airplane’s roll motion. to roll right. When the PF was told that seen that the vestibular inputs can drive Second, similar to the example in Figure he was turning right, he became confused the pilot’s actions into a larger upset and 7, page 11, the specific force vector during about his orientation and how to return loss of control. In some cases, the reality this coordinated flight remained aligned to wings level. Subsequent roll inputs generated by these false perceptions can with the airplane’s z-axis, which from a were strongly to the right, leading to a be strong and enduring and, unless there vestibular perspective is undistinguisha- loss of control and fatal crash. is a rapid and forceful response from the ble from wings level. Hence, there was no This short illustration of the model’s PM, can lead to a crash. meaningful vestibular information about analysis capability shows how it can be These SD events will probably continue the airplane’s change in attitude, which combined with the cockpit voice recorder, explains the SD track “attitude” in Figure 8. flight data recorder, and environmental to occur in the short term. The recom- Looking in more detail at the figure, the data inputs to create a more complete mendations from CAST advocate for sub-track is interrupted at places where picture of the pilot’s understanding of the changes to airplane design, operations, the model output for roll rate temporarily state of the airplane. This data integration and flight crew training to address some exceeded the threshold (refer to Figures and analysis is at the heart of accident in- of the factors that contribute to turning 3 and 4, page 9, to see how the inter- vestigation and allows us to explain flight SD into accidents. We hope that, eventu- nal threshold determines whether the control inputs more completely. ally, these changes will significantly model output activates an SD label). The reduce the risk of SD turning into a LOC interruptions of the attitude track corre- Conclusions event. In the meantime, the tool devel- spond to periods where the mismatch in Any accident investigation that impli- oped by Boeing and TNO can become an perceived attitude was smaller than the cates human performance issues (“pilot essential element of the accident/ criterion of 8 degrees. Note that according error”) needs to consider performance in incident investigation process. I

12 • January-March 2016 ISASI Forum Figure 1. Airbus A330 Voyager aircraft. Investigating the Voyager Pitch-Down Incident The Voyager investigation is a case study of civil/military cooperation demonstrating that independence most certainly does not mean isolation. By Col. Crispin Orr, Head of the UK Military Air Accident Investigation Branch

n Feb. 9, 2014, a Royal Air Force (RAF) Airbus A330 Voyager aircraft, (Adapted with permission from the author’s ZZ333 (see Figure 1), with 189 passengers and 9 crewmembers on technical paper entitled Investigating the board, was flying on its first-ever nonstop routing to Afghanistan. At Voyager Pitch-Down Incident—A Case Study in Civil/Military Cooperation presented 1549 UTC (night time) the aircraft was in cruise at FL330 over Tur- O at ISASI 2015 held in Augsburg, Germany, key with Autopilot 1 engaged. The captain was alone on the flight deck as the Aug. 24–27, 2015, which carried the theme copilot had left his seat for a break and was in the forward galley. Suddenly and “Independence Does Not Mean Isolation.” The without warning, the aircraft pitched down violently, throwing unrestrained full presentation, including cited references to passengers and crew to the ceiling. The captain attempted to take control by support the points made, can be found on the pulling back on his side-stick controller and pressing the autopilot (AP) dis- ISASI website at www.isasi.org under the tag “ISASI 2015 Technical Papers.”—Editor) connect button, but these actions were ineffective. The aircraft lost 4,400 feet in 27 seconds, registering a maximum rate of descent of 15,800 feet/minute and Col. Crispin Orr is head reaching Mach 0.9 as the crew wrestled with what they thought to be an auto- of the UK Military Air pilot malfunction. Fortunately, the aircraft was brought back under control and Accident Investigation diverted successfully to Incirlik Airbase in Southern Turkey. Twenty-five passen- Branch. He is by back- gers and 7 crewmembers reported minor injuries; however, the consequences, ground an Army Air Corps had the incident occurred closer to the ground, could have been catastrophic. reconnaissance and attack This adapted article will outline the investigation undertaken by the UK’s Mili- helicopter pilot. As a tary Air Accident Investigation Branch (MilAAIB) in support of a service inquiry military test pilot, he has flown more than 50 fixed- to establish the cause of the incident and make recommendations to prevent a and rotary-wing types, and he has commanded recurrence. It is a case study of civil/military cooperation demonstrating that both operational and flight test squadrons. independence most certainly does not mean isolation. He has an MSc in defense technology and is The MilAAIB was established in 2011 following Charles Haddon-Cave working toward an MSc in safety and accident Queen’s Counsel independent review of the broader issues surrounding the investigation. loss of the RAF Nimrod aircraft XV230 in Afghanistan in 2006. Among his many criticism of the Ministry of Defense’s (MOD) airworthiness regime, he made a number of specific recommendations with respect to accident investigation. Consequently, the MilAAIB was established as a professional and joint military air accident investigation branch, completely independent of the Army, the Royal Navy, and the Royal Air Force. The branch was established at Farnbor- ough alongside the civilian Air Accident Investigation Branch (AAIB) to ensure maximum benefit from their corporate knowledge and experience gained from 100 years of investigations since Capt. George Cockburn of the Royal Flying Corps was appointed as the very first inspector of air accidents. Operating

January-March 2016 ISASI Forum • 13 Figure 2. DFDR trace showing pitch commands from the captain’s side-stick.

under a charter from the with extensive experience of the A330 in downloaded the DFDR and CVR data State for Defense secretary the team of three who deployed. for us, and the DFDR data were sent to and reporting directly to Their immediate task was to secure the Toulouse, France, for detailed examina- the director general of the vulnerable and perishable evidence and tion by Airbus flight control specialists. In Defense Safety Authority provide an initial assessment of the situ- parallel, the side-stick unit (SSU), which (DG DSA), the MilAAIB is ation. The quick access data PCMIA card, had passed all functional checks, was as independent as it can be, the digital flight data recorder (DFDR), returned to the UK for a more detailed while also employing military and cockpit voice recorder (CVR) were forensic technical examination. experts who can deploy at a returned to the UK for download and The breakthrough came a few days moment’s notice to accidents analysis, concurrent with initial technical later when one of the MilAAIB investi- worldwide, including to oper- investigation and interviews in Turkey. gators was listening (for the 100th time) ational theatres. Incredibly, there was very little damage to to the CVR and detected a distinct noise the aircraft, and it soon became apparent on the cockpit area microphone chan- Initial investigation that the crew’s diagnosis of an autopilot nel, 1 minute and 44 seconds before the When notification came in fault was not supported by the physical pitch-down event. This corresponded of the Voyager incident, the and data evidence, which indicated that with a very small forward displacement MilAAIB was ideally placed to the event was triggered by a full-scale of the captain’s side-stick that was too coordinate any response with deflection of the captain’s side-stick small to cause the autopilot to disengage and so did not result in any disturbance the AAIB. The Voyager is an controller (see Figure 2), at which point to the aircraft. The noise reoccurred just Airbus A330 aircraft modified the autopilot had disengaged. Following before the pitch-down event, and spectral to provide a multi-role tanker the MilAAIB’s initial report on February analysis confirmed that the sound exactly transport capability to the 12, the DG DSA elected to convene a full matched the electric motor used to move RAF. The aircraft are owned service inquiry. the captain’s seat forward. and operated by Air Tanker This temporal and directional correla- What caused the pitch down? Ltd, a joint venture made up tion between seat and side-stick move- of Cobham, Airbus, Rolls- The initial focus for the inquiry was to ment was compelling, and the investiga- Royce, Thales, and Babcock, determine what caused the pitch-down tion sought to establish how they could but the majority of deploy- event, as this was still unknown and there be connected. The small initial displace- able personnel (aircrew were a wide range of possibilities. There ment of the side-stick and the subsequent and engineers) are military. was some urgency to this as Air Officer linear ramp to full-scale deflection in the Each aircraft must be able to Commanding 2 Group, the operational fore-aft axis without any lateral input switch between the civil air- duty holder, had elected to “pause” Voy- could not be recreated by human pilot craft register and the military ager flying, and there was considerable input, so the panel’s focus turned to the aircraft register depending on public interest given the huge number possibility of an object connecting the how it is being used. On Feb- of A330 aircraft flying worldwide. From seat to the side-stick. All official items ruary 9, ZZ333 was operating the outset, we had full engagement and and personal effects that had been on the as a military aircraft, so the support from the operator (Air Tanker) flight deck at the time were examined, lead for any investigation fell and the OEMs (Airbus and Rolls-Royce), with particular interest in the captain’s to the MilAAIB. However, we with these companies providing valuable camera, which had been seen in the were delighted to be able to assistance to the investigation in Turkey vicinity of the captain’s side-stick shortly include an AAIB investigator and back in the UK. The AAIB kindly

14 • January-March 2016 ISASI Forum before the event. pitch-down event, but with the likelihood the AP disconnect button on the side- Twenty-eight photographs had been of a technical cause diminishing and stick (although the autopilot had in fact, taken of the cockpit in the eight minutes Airbus coming under increasing pressure already disconnected). prior to the incident, with the last photo from worldwide customers to clarify the The copilot, who had hauled himself taken 1 minute and 35 seconds before the situation, urgent safety advice was issued back into the cockpit, also pulled back on initial side-stick displacement. Analysis of to the RAF and to Airbus on February 28, his side-stick. Reacting to the captain’s the CVR revealed that four seconds after confirming that human factors was the shouts that he couldn’t get the autopilot the last photo was taken, the purser had probable cause of the Voyager pitch-down out, the copilot pressed his AP Discon- come onto the flight deck and had a short event and highlighting the magnitude of nect button repeatedly. The button has conversation with the captain before the risk presented by foreign objects in a dual function, and when the autopilot returning to the cabin. On close exami- the immediate vicinity of the side-stick. is disconnected, as it was in this case, nation, the camera was found to have a This was followed by an interim report the button switches the priority stick large dent on its right-hand side. This was that was published on the Gov.uk website input to the Flight Control System (FCS) mapped forensically using surface pro- a couple of weeks later. between the LHS captain’s side-stick and filometry and found to be a perfect match Once all other possibilities had been the RHS copilot side-stick. Had control with the hand grip flange at the base of eliminated, the panel concluded that the been formally handed to the copilot, the the side-stick. Furthermore, chemical cause of the pitch-down event was an captain’s inputs would have been locked analysis indicated that trace amounts of inadvertent physical input to the captain’s out and the problem neutralized. But in material in the indentation matched the side-stick by means of a physical obstruc- the confusion of the event, on a darkened material type of the side-stick. tion (a camera) that jammed between the flight deck, in a negative “g” bunt, the Using the Voyager simulator, the team left armrest and the side-stick unit when crew became fixated on trying to get the placed a copy of the camera between the captain’s seat was moved forward. autopilot out and control priority kept the armrest, which had been adjusted to switching back to the fully deflected left the captain’s preferred setting, and the How was the aircraft recovered? stick. side-stick. When the seat was motored Having established the potential for the Fortunately, the A330 fly-by-wire FCS forward, the camera pushed the side-stick camera to geometrically lock in place, the incorporates overspeed and pitch-down fully forward and became geometrically investigation sought to establish how the self-protection features to prevent ex- locked in place (see Figure 3). The hand aircraft was recovered. When the aircraft ceedance of flight envelope limitations. control base plate was perfectly aligned pitched down, the captain’s instinctive re- Three seconds after the initiation of the with the position of the dent in the cap- action was to pull back on the side-stick. pitch down, the FCS acted to limit the tain’s camera. The reconstruction took This can be seen clearly from the DFDR pitch attitude to 15 degrees nose down, only a few seconds to set up and could be traces, albeit the side-stick remained and 10 seconds later the high-speed repeated time and again. substantially blocked in the forward protection feature activated to reduce the The investigation continued to examine position. Convinced it was an autopilot engine thrust to idle and pitch the aircraft all other possible explanations for the malfunction, the pilot repeatedly pressed up at approximately 1.75 g’s (see Figure 4, page 16). The aircraft flew itself out of the dive. Thirty-three seconds after the pitch down, the obstruction was cleared, the captain’s side-stick sprung back to the neutral position, and the crew regained full control of the aircraft. The investigation considered whether the obstruction was cleared by a movement of the side- stick, the seat, the armrest, the camera, or a combination of these. Extensive simulator tests were conducted, and the evidence strongly suggested that the camera was physically manipulated from behind the side-stick, but the crew was unable to clarify this. It is noteworthy that during the pitch down, the captain, in his desperation to regain control, considered switching off the Air Data and Inertial Reference Units Figure 3. Reconstruction of camera behind captain’s side-stick. (ADIRU) in order to place the aircraft

January-March 2016 ISASI Forum • 15 Figure 4. Activation of pitch and high-speed protection features. into “direct law” control presence was consistent with normalized likely and therefore was a contributory mode. Had he done this, the behavior regarding loose articles on RAF factor. aircraft’s pitch and overspeed air transport aircraft. This behavior had The placing of the camera behind the self-protection features would itself been the subject of a safety inves- side-stick created a hazard that was un- have been disabled, and the tigation at RAF Brize Norton, following recognized and subsequently led directly aircraft would almost certain- concern at the number of loose articles to the pitch down. The distraction of the ly have exceeded its certified found by maintenance personnel on the captain by the purser entering the flight flight envelop limits by a con- flight deck of C130 aircraft. The Voyager deck may have contributed to this. The siderable margin, potentially crew was required to take a large number minimum distance between the armrest leading to significant damage of items with them, including two sets of and the side-stick was 50 millimeters; but to the aircraft. body armor, combat survival waistcoats, as this incident proved, the two could be crew weapons, aircraft documentation, coupled by a foreign object placed in the Human factors analysis two route bags, and worldwide navigation space between. Although there had been Having established “what” charts—and there was little dedicated no recorded incidents of this happen- happened during the incident, storage for these items. With the accept- ing in 190 million flying hours of Airbus deeper analysis was undertak- ance of a large number of official items aircraft, inadvertent disconnection of the en with the assistance of the on the flight deck, the carriage of a small autopilot by knocking the side-stick had human factors experts from number of personal effects was not con- occurred 26 times on the Voyager in the the RAF Centre of Aviation sidered unreasonable. previous two years—none of which had Medicine to probe “why” Equally, there was no specific rule been reported. it had happened to enable that prohibited use of the camera during The Airbus Flight Crew Training Man- formulation of recommenda- flight. The captain was a photography ual advocated a clean cockpit: “objects tions to prevent recurrence. enthusiast and had often taken pictures not stored in their dedicated area in the The pertinent sequence of on the flight deck. However, the Voyager cockpit may fall and cause hazards such events was that the camera Operations Manual did state that “flight as damage the equipment or accidentally was taken onto the flight crew must refrain from nonrelevant operate controls or pushbuttons.” And deck, the camera was used, duties while the other pilot is away from MAA Regulatory Article 2309 directs the camera was placed behind the active ATC frequency,” and this proce- “that the aircraft commander should the side-stick, and the seat dural defense was breached by the pilot ensure that all loose articles and stores was then moved without any taking 28 photos when alone on the flight are properly stowed such that there is no appreciation of the potential deck. It was a very quiet period of the possibility of fouling the flying controls.” outcome. flight, and it was assessed that low pilot However, the risk regarding flight deck Carriage of the camera workload and boredom, compounded by control interference on the Voyager had was not prohibited by any the presence of only a single person on not been specifically identified and was rules or regulations, and the flight deck for an extended period of therefore not being actively managed by the investigation found its time, all made the use of the camera more the duty holder.

16 • January-March 2016 ISASI Forum The final link in the chain was the a loose article close to the aircraft • Independence—It is my contention movement of the seat, which is a routine controls could develop quickly into a that independence is very important, occurrence in flight on the A330. The in- catastrophic event. On this occasion, especially in the leadership of a major vestigation considered that the time delay the A330 automatic self-protection investigation. The investigation must between the captain putting the camera features likely prevented a disaster of be protected from improper interfer- down when the purser entered the flight significant scale. Fortunately, there ence, and investigators must have the deck, and his separate action to adjust was no accident, but the occurrence freedom of maneuver to conduct the his seat position 104 seconds later using was nonetheless investigated to the investigation without fear or favor. a switch in a different area of the flight same degree by the MilAAIB and oth- But it is our experience that this does deck, meant that the resultant change in ers in support of a full service inquiry. not mean and cannot mean isolation. aircraft attitude would have been ex- • No-blame safety investigation We in the MilAAIB recognize that tremely unexpected. It is not surprising focused on identifying carefully we are dependent on other agencies. that the captain did not see the connec- targeted recommendations to en- Some are independent, and some are tion between these events at the time. hance safety—The investigation was not, but we highly value their neces- a no-blame safety investigation, so sary expert contribution regardless. Recommendations to while others outside our community Hence, we go to some lengths to de- enhance safety may focus on the rights or wrongs of velop our support network, and ISASI This incident was an extraordinary and the crew’s actions on the day, we were seminars are a marvelous opportuni- possibly unprecedented event. However able to probe the underlying human ty to further cultivate that! unlikely an exact recurrence may seem, factors and organizational issues and • Transparency—We also recognize, the consequences of flight control inter- illuminate wider cultural concerns that despite being a military unit ference can be catastrophic. The service that need to be addressed to prevent engaged on very sensitive work, there inquiry illuminated a number of underly- other loose-article-related events. The is a balance to be struck between ing issues that warranted attention and recommendations made have been protecting sensitive information and made 24 recommendations to enhance carefully targeted at those senior sharing information that can enhance flight safety. Some of these issues are not post holders in defense who have the safety. In this we draw a distinction unique to the Voyager (or indeed to mili- means to effect the changes required. between protecting the inputs to an tary aviation in the UK), and the following Their implementation will be tracked investigation (confidential witness recommendations may be of interest: to completion and may only be closed testimony, for example) and provid- • Implement a comprehensive strate- by DG DSA. ing maximum transparency of the gy to effect a positive change in the • Thorough and expert team effort— process and the outputs. Following safety culture with respect to loose The inquiry was undertaken impar- the Voyager pitch-down incident, articles on the flight deck. tially by a panel and a professional there was legitimate concern from • Take steps to minimize what is car- investigation branch that were com- Airbus operators worldwide until the ried on the flight deck and maximize pletely independent of the operator, probable cause was established and the use of designated stowage areas. the regulator, the manufacturer, et communicated. It was therefore al. However, a thorough and evi- beholden on us to promulgate that • Review the rules governing minimum dence-based investigation could not safety advice to stakeholders as soon crewmembers at their station. have been completed effectively with- as we had something tangible to • Take measures to further strengthen out the full cooperation of Air Tanker release. At the end of an investigation, the reporting culture. Ltd and the MOD Project Team, the we always publish the final report on • Ensure that the critical importance full support of the civil AAIB and the the Internet. But with the Voyager, in of a clear handover of control in side- Airbus Investigation Team, the tech- a first for us, we also published an stick equipped aircraft is emphasized nical assistance of Rolls-Royce, the interim report on the Internet as throughout training. forensic laboratory capabilities of the soon as the probable cause was Materials Integrity Group, the 1710 established and while the investiga- • Examine ways of managing low inflight pilot workload. Naval Air Squadron, the data-fusion tion was still ongoing. This public capabilities of QinetiQ, the evalua- release was hugely effective in • If possible, implement measures that tion skills of test pilots from the Air defusing public concern and is a could help prevent the placing of Warfare Centre and Airbus, and the practice that we have now adopted as loose articles in close proximity to the human factors expertise residing in an SOP. We think this transparency of side-stick. the RAFCAM. Working together as process and output help to demon- a team, we were able to resolve the strate our independence without in Concluding remarks apparent conflict between the crew’s any way compromising it. We • The incident—This incident was a perception of what happened and the steadfastly defend that independ- very serious near miss and serves as evidence from the DFDR and under- ence, but we also strongly support the a timely reminder that one simple stand what was initially a perplexing view that independence does not and unthinking act such as placing mystery. mean isolation.

January-March 2016 ISASI Forum • 17 Investigating Human Fatigue Factors: A Tale of Two Accidents

The key to any robust investigation is to ask the right questions and gather as much data as possible to ensure important fatigue-related factors are not being missed.

he 24/7 nature of aviation means that Sundance Helicopters on a sightseeing trip fatigue will always be a consideration that crashed near Las Vegas, Nevada. in accident investigations. Fatigue is a Tcondition characterized by increased What do we look for? discomfort with lessened capacity for work, Before delving into the case studies, it is (Adapted with permission from the reduced efficiency of accomplishment, and loss author’s technical paper entitled important to understand what investiga- Investigating Human Fatigue of power or capacity to respond to stimulation, tors look for to determine whether fatigue Factors: A Tale of Two Accidents and is accompanied by a feeling of weariness played a role in an accident. There are five presented at ISASI 2015 held in and tiredness (FAA pilot safety brochure Fatigue factors that can lead to a fatigued state that Augsburg, Germany, Aug.24–27, in Aviation. Publication # OK-07-193). A group are considered in each accident investi- 2015, which carried the theme of international human performance experts gation: 1) circadian factors; 2) time since “Independence Does Not Mean conceded “fatigue…is the largest identifiable awakening; 3) quantity of sleep; 4) quality of Isolation.” The full presentation, and preventable cause of accidents in transport sleep; and 5) sleep disorders. including cited references to support operations.” Circadian factors are those factors the points made, can be found on The adverse effects of fatigue on human per- the ISASI website at www.isasi.org affecting an individual’s normal circadi- under the tag “ISASI 2015 Technical formance have been demonstrated in scientific an rhythm, such as a schedule inversion/ Papers.”—Editor) research and accident and incident investiga- rotation or crossing multiple time zones. tions. These effects include slowed response Humans naturally follow a diurnal sched- time, reduced vigilance, and poor decision- ule, and the primary circadian trough is making. No one is immune, and fatigued avi- about midnight to 0600, with the window of Dr. Katherine ation personnel put themselves and others at circadian low generally occurring between A. Wilson is a risk. However, the ability to collect and analyze 0300 and 0500. However, shift work and senior human data to conclusively identify fatigue as a causal/ long-distance flights across multiple time performance contributing factor in accidents is challenging, investigator zones can disrupt this sequence. While with the Office as fatigue can be subtle and there is no “blood research suggests that it is possible to shift of Aviation test” to provide a positive-negative indicator. one’s circadian clock about 1 hour per day, Safety at the Investigators must not only determine if persons the ideal conditions required are difficult U.S. National involved were experiencing fatigue at the time to obtain and the shift is often less. Further, Transportation Safety Board (NTSB), of the accident, but also whether their actions personal obligations often result in the joining the NTSB in 2008. She recent- were consistent with the known fatigue-related shift worker reverting to a diurnal schedule ly served as the human performance performance decrements. when off duty, thus negating any circadian investigator for the Virgin Galactic Over the last decade, tools and techniques shift that may have occurred. SpaceShipTwo accident in Mojave, for investigating fatigue have evolved, and the California, and has supported nu- Time since awakening refers to the num- merous domestic and international number of potential data sources useful to eval- ber of hours the individual has been awake accident/incident investigations. She uate fatigue in an operator have increased. Here since a last major sleep opportunity of three holds a Ph.D. in applied experimen- we will highlight the “nuts and bolts” of fatigue hours or more. According to the National tal and human factors psychology investigation in the context of two accident Sleep Foundation’s “How much sleep do and a M.S. in modeling and simu- investigations in which the U.S. National Trans- we really need?” on average, individuals lation, both from the University of portation Safety Board (NTSB), an independent need seven to nine hours of sleep per night Central Florida. She has more than agency, collaborated with the operators, the to feel rested upon awakening, resulting 15 years of experience studying crew Federal Aviation Administration (FAA), and the in 15–17 hours of wakefulness each day. resource management in aviation Bureau d’Enquêtes et d’Analyses pour la Sécurité and health care and holds a private Research quantifying performance impair- pilot certificate. de l’Aviation Civile (BEA) in accordance with ment associated with sustained wake- the provisions of Annex 13 to the Convention fulness found that performance remains on International Civil Aviation. Specifically, UPS relatively stable throughout the time that Flight 1354, an Airbus A300 that crashed on coincides with a normal waking day, but approach to Birmingham–Shuttlesworth Inter- that prolonged wakefulness of 17 hours can national Airport in Birmingham, Alabama, and result in measurable performance impair- a Eurocopter AS350-B2 helicopter operated by ment (comparable to having a blood alco-

18 • January-March 2016 ISASI Forum Investigating Human Fatigue Factors: A Tale of Two Accidents

By Katherine Wilson, Ph.D., Human Performance and Survival Factors Division, U.S. National Transportation Safety Board (NTSB)

hol concentration of 0.05 percent). Other research Figure 1. UPS Flight 1354 wreckage. suggests that being awake for 18 hours can decrease performance by 30 percent. An NTSB safety study found that flightcrew members involved in accidents made more procedural errors, tactile decision errors, and errors of omission when awake for more than 12 hours compared to crewmembers awake fewer than 12 hours. Quantity of sleep is the number of hours slept during each major sleep period in the days preceding an accident. A minimum of three nights’ sleep activity should be documented, but data should be collected for as far ability, memory limitations, perishable evidence, time-stamp back as is considered to be reliable from the source. An individ- irregularities (time zone differences, noncalibrated clocks), and ual’s normal sleep patterns should also be documented to deter- legal hurdles that must be considered. mine the number of hours needed to be wake rested. Knowing Once the data are collected, they must be organized and the “normal” amount of sleep is very important to investigators, analyzed to determine whether the operator was fatigued at the as it allows a comparison to be made between the number of time of the accident. If it is determined that the operator was hours slept and the individual’s normal sleep requirements to fatigued, it then must be determined whether the actions taken quantify acute and chronic sleep debt. Just two hours of sleep by the operator that led to the accident are consistent with the loss can result in reduced performance and alertness. known performance decrements of fatigue. If the operator’s Quality of sleep, or how well the individual slept, can further actions are consistent with being fatigued, fatigue likely caused help investigators understand an individual’s fatigued state. It or contributed to the accident. While fatigue is the focus of this should be determined whether the individual’s sleep was frag- discussion, other factors may also be causal or contributory to mented (e.g., multiple sleep periods in a given 24 hours) and/or the accident sequence, such as workload, training inadequacies, disturbed (e.g., awakenings during a sleep period). Factors that or previous operator performance deficiencies, to name a few, can influence quality of sleep include environmental reasons that should be considered. such as noise, light, and phone calls and medical reasons such In the following two case studies, fatigue was determined to as heartburn or headache and internal reasons such as life have a role in the accident. stressors. Sleep disorders and medical factors, including physical and A tale of two accidents. What role did fatigue play? mental disorders, and medications can impair sleep and lead to UPS Flight 1354—On Aug. 14, 2013, about 0447 Central Day- a fatigued state. Physical and mental disorders can include pain, light Time (CDT), UPS Flight 1354, an Airbus A300-600, crashed urinary frequency, neurological disease (e.g., Parkinson’s disease, short of Runway 18 during a localizer nonprecision approach to dementia), cough/shortness of breath, and psychiatric disease. Runway 18 at Birmingham–Shuttlesworth International Airport Medications for conditions such as depression, hypertension, (BHM) in Birmingham, Alabama, fatally injuring the captain osteoporosis, and seizures (among others) can also interfere and first officer (see Figure 1). At the time of the accident, dark with an individual’s sleep. Finally, sleep disorders, including night visual meteorological conditions prevailed at the airport; sleep apnea, restless leg syndrome, and narcolepsy, can result in however, variable instrument meteorological conditions with a restless night’s sleep and a fatigued state. The most common a variable ceiling were present on the approach north of the sleep disorder, sleep apnea, affects 10–20 percent of the adult runway. The flight had departed from Louisville International population. Airport–Standiford Field (SDF) in Louisville, Kentucky, about 44 The data needed to examine these factors should be collected minutes before the accident. from as many sources as possible. Key evidence sources include, As the pilot flying (PF), the captain was responsible for mon- but are not limited to, interviews with the individual opera- itoring the airplane systems and flight path, and as the pilot tor or those who have knowledge about the individual, work monitoring (PM), the first officer was responsible for monitoring schedules/logbooks, cellular telephone records, audio/video/ and cross-checking the PF. The takeoff, climb, and cruise phases data recordings, other time-stamped records (e.g., hotel records, of the flight were normal, and the crew completed all required company badge access), and medical records. However, there checklists. The flight was cleared direct to BHM, which the crew are challenges to collecting such data such as operator avail- entered into the flight management computer (FMC). While

January-March 2016 ISASI Forum • 19 established at their cruising altitude, neither callout was made and the flight was unusually demanding, and it did not the first officer tuned in the ATIS and crew did not recognize that the flight result in an extended duty day or reduced reported to the captain that Runway descended below minimums. About eight rest period the day before the accident. 18 was in use at BHM. Shortly thereaf- seconds before impact with trees, the In addition, he took steps to be fit for ter, the captain briefed and set up the crew received a sink rate alert, and four duty and to mitigate the effects of fatigue approach per UPS procedure using the seconds before impact stated they had when flying during the overnight hours profile approach briefing guide. the airport in sight. The first point of im- by napping prior to returning to duty and When descending to 3,000 feet, BHM pact with trees was about 6,387 feet north securing a sleep room at the UPS facility approach control directed the flight of the Runway 18 threshold. during his two duty periods before the crew to turn 10 degrees right to join the Postaccident examination found no accident. Although he had an adequate localizer. Both crewmembers recognized evidence of any structural, engine, or sleep opportunity the day before the ac- that the localizer was captured. How- system failure or anomaly occurring cident, daytime sleep can be less restor- ever, about this time, the first officer prior to impact, and the airplane met all ative than nocturnal sleep. He had also failed to “clean up” the approach in the FAA regulations and the manufacturer’s previously reported to colleagues that FMC, which required her to remove the recommended maintenance program. he had a difficult time adjusting when direct to BHM so that only the localizer approach to Runway 18 was available. Because she did not complete this step, a route discontinuity was present in the FMC. The flight crew failed to recognize the route discontinuity in the FMC for the remainder of the flight, which did not allow the FMC to capture the computer-generated flight path, also known as the profile, for vertical guidance to the runway. When the automation did not capture the profile, the captain reverted to vertical speed mode to descend toward the runway; however, he did not communicate this to the first officer. About one minute before the airplane impacted trees, the first officer stated, “Let’s see you’re in…vertical speed… okay” to which the captain stated, “… yeah I’m gonna do vertical speed. Yeah he kept us high.” The airplane was Figure 2. Main helicopter wreckage. descending at 1,000 feet per minute (fpm), which was increased to 1,500 fpm Therefore, the investigation focused on returning to night flying. shortly thereafter, but again was not the flight crew. A review of company The first officer had a 62-hour sched- verbalized by the captain. records revealed that the flight crew had uled layover prior to returning for duty About 30 seconds before impact, the adequate experience and was properly the day before the accident. During the first officer made the appropriate 1,000 trained for the flight. While the investi- period, the first officer visited a friend in foot callout, and the captain respond- gation also focused on the flight crew’s a nearby city and reverted to a diurnal ed, “Alright ah DA [decision altitude] workload and expectation of weather schedule. On the subsequent nights lead- is twelve ah hundred.” Neither crew- conditions, the information presented ing up to the accident flight, a review of member recognized that the flight was here will focus on flight crew fatigue. data from the first officer’s mobile devic- descending at 1,500 fpm, which ex- Data were used to determine wheth- es revealed that she did not have ample ceeded the stabilized approach criteria er the flight crew fatigue was causal or sleep opportunity to obtain adequate rest below 1,000 feet of a maximum of 1,000 contributing to the accident. Data were prior to resuming duty and returned to fpm descent. At this point, a go-around gathered through interviews, company duty with an estimated three-hour sleep should have been executed. The first of- records, hotel records, cellular telephone debt. The first officer was aware of her ficer confirmed the DA, and the captain records, and information retrieved from fatigued state as evident in text messages stated, “two miles,” which coincided six personal electronic devices found in retrieved from her cellular phone at the with the distance to the runway when the crewmembers’ personal possessions. end of this duty period; she was estimat- the DA should be crossed. About this The captain had been off duty for seven ed to have a nine-hour sleep debt. During same time, the first officer should have days prior to returning for duty the day her 14-hour-and-30-minute layover the made the approaching minimums and before the accident. There was nothing day before the accident, she had less than five seconds later the minimums callout; from the previous day’s schedule that a five-hour-and-30 minute sleep opportu-

20 • January-March 2016 ISASI Forum nity due to electronic device usage and and included unknown activities outside of her hotel a combina- room. tion of visual, At the time of the accident, the flight condition, crew had been on duty about eight hours and measure- and 30 minutes. The captain had been ment checks awake about 14 hours, and the first throughout officer had been awake for more than 18 the helicop- hours. Although the duty day was not ter. These unusually long, the first officer, particu- checks were larly, had been awake for an extended specified in period of time. In addition, the accident the 100-hour occurred about 0447, and the flight crew checklist con- Figure 3. A properly installed nut and split/cotter pin of the fore/aft servo input rod connection. was awake in opposition to their normal tained in the circadian rhythm. Neither flightcrew Eurocopter member had a known sleep disorder or Aircraft Maintenance Manual. In addition, chanic and inspector who replaced then reported difficulty sleeping to their family maintenance performed included the inspected, respectively, the fore/aft servo during their off-duty periods. replacement of the tail rotor servo, the the day before the accident. It was the The investigation determined that the engine, and the main rotor fore/aft servo mechanic’s responsibility to connect the errors made by the flight crew during with a new (zero hour) unit. Follow- input rod to the servocontrol distributor the approach (e.g., failing to clean up the ing the maintenance, a quality control by 1) installing the pin, washer, and nut, FMC, missing callouts, continuation of an (QC) inspector inspected the work and 2) torqueing the nut, and 3) securing the unstabilized approach) were consistent completed a ground run and checks. nut with the split/cotter pin (see Figure with the known effects of fatigue. There- On the morning of the accident, a check 3). If the nut meets the torqueing require- fore, the NTSB cited the crewmembers’ pilot performed a before first flight (BFF) ments per Eurocopter, it can be reused, fatigue due to operating during the win- check (an external inspection of the otherwise it must be replaced with a new dow of circadian low [circadian factors], helicopter), where he found the hydraulic nut. During postaccident interviews, and the first officer’s ineffective off-duty belt loose, conducted a post-maintenance the mechanic indicated that the nut was time management and acute sleep loss flight check, and then flew a tour flight airworthy and could be reused. After re- [quantity of sleep and time since awaken- in the accident helicopter. The accident assembly, he said he torqued and safe tied ing] as contributing to the continuation pilot flew the accident helicopter on one everything, including securing the input of an unstabilized approach. As a result tour flight before the accident flight. rod connection with a split pin. of this investigation, the NTSB made one Examination of the wreckage found The inspector reported that he in- safety recommendation to the FAA and that the flight control input rod was not spected the fore/aft servo input rod, two companion recommendations to connected to one of the three hydraulic hardware, and split pin and marked them UPS and the Independent Pilots Associa- servos that provides input to the main with a torque pen and that he inspected tion related to fatigue. [See the full report rotor. Missing from the wreckage were the hydraulic lines that connect to the at http://www.ntsb.gov/investigations/ the bolt, washer, self-locking nut, and manifold; he did not find any problems AccidentReports/Reports/AAR1402.pdf.] split/cotter pin that normally secure the during the inspections. The inspector also input rod to the main rotor/aft servo. performed ground run and checks with Sundance Helicopters sightseeing trip— Postcrash examination of likely scenarios the mechanic’s assistance. The checks On Dec. 7, 2011, a Sundance Helicopters for why the helicopter experienced a loss took about 40–45 minutes to complete sightseeing tour Eurocopter AS350-B2 of control in flight determined that the and were completed about 1800 the day helicopter crashed near Las Vegas, Ne- disengagement of the fore/aft servo bolt before the accident. vada, about 1630 Pacific Standard Time, was most likely. Further testing of the Despite the statements made by the fatally injuring all aboard (see Figure most likely explanation for how the bolt mechanic and inspector, the evidence 2). The helicopter was operating as a disengaged during flight determined that indicates that the split/cotter pin was “twilight tour” sightseeing trip. Dusk light the hardware was improperly secured not present or not installed improperly; and visual meteorological conditions during the previous day’s maintenance. however, neither the mechanic nor the prevailed at the time of the accident. The Specifically, the split/cotter pin was not inspector recognized this. There were helicopter had departed from Las Vegas installed or not installed correctly, allow- no significant issues in either of their McCarran International Airport (LAS) in ing the self-locking nut to separate from performance histories, time pressure, Las Vegas, Nevada, about nine minutes the bolt, and then the bolt to work its way or environmental issues to explain the before the crash. out of the joint due to normal inflight vi- performance lapses. Although the inves- Maintenance was performed and com- bratory forces. At this time, the input rod tigation also focused on the maintenance pleted on the accident helicopter the day would have separated from the linkage work cards, the information presented before the accident, including a 100-hour and the helicopter would have become in this example will focus on the role of inspection. The 100-hour inspection was uncontrollable. fatigue on the performance of these indi- to be completed every 100 flight hours The investigation focused on the me- viduals. Data sources included interviews

January-March 2016 ISASI Forum • 21 Teamwork is essential and company records. Both the mechanic and inspector were contacted on December 5 to report for in every investigation, work the next day (December 6), although they were both previously scheduled off duty. The mechanic reported that his normal bedtime was about 0200, and he would and investigators wake up between 1000 and 1200. On December 5, he went to bed about 2200, but should be encouraged had difficulty falling asleep until about 0000 and received about five hours of sleep. The QC inspector reported that his normal bedtime was about 2200 or 2300, and to surround themselves he would wake up about 0730 or 0800. On the night of December 5, he went to bed with experts and to about 2100 and awoke at 0400. When he conducted the inspection on December 6, he had been awake more than 14 hours. collaborate with them. Both the mechanic’s and inspector’s work shift normally began at 1200, but on De- cember 6 they reported for duty about six hours earlier (see Table 1). Research shows that adjusting to an early-morning shift (phase advance) can be more difficult than adjusting from a day shift to a night shift (phase delay). In addition, the mechanic (Adapted with permission from the began his duty day with a three-hour sleep debt. The investigation also found that author’s technical paper entitled maintenance personnel did not receive human factors training, which should have Unstable Approaches: A Global Problem presented at ISASI 2015 held in Augsburg, included causes of fatigue, its effects, and effective countermeasures. Germany, Aug. 24–27, 2015, which carried the theme “Independence Does Not Personnel Normal Shift Shift Originally Scheduled Actual December for December 6 6 Shift Mean Isolation.” The full presentation, Mechanic 1200 to 2300 Off duty 0550 to 1846 including cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag Inspector 1200 to 2300 Off duty 0531 to 1855 “ISASI 2015 Technical Papers.”—Editor)

Table 1. The mechanic’s and inspector’s shift information David Ross joined the Transportation Although the investigation could not determine the specific sequence of events Safety Board of that led to the maintenance errors on the part of the mechanic and inspector, the Canada (TSB) staff fundamental errors of omission made are consistent with the known adverse effects as an air opera- of fatigue. Therefore, the NTSB cited the mechanic’s fatigue [circadian factors and tions investigator in quantity of sleep] as contributing to the improper or lack of installation of the split/ 1999. He previously cotter pin and the inspector’s fatigue [circadian factors] as contributing to inade- worked as a weath- quate post-maintenance inspection. As a result of this investigation, the NTSB made er observer; as a two safety recommendations to the FAA related to fatigue. [See the full report at transport pilot, training pilot, check pilot, http://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1301.pdf.] and flight operations supervisor with the Canadian Forces; and as a regional airline Conclusion pilot in western Canada. He worked as the operations team leader, and chair of the Continuous operations in aviation mean that fatigue will always be a concern, Flight Operations and Weather Groups, especially when there is an accident. As investigators, we must thoroughly gather during the TSB investigation of a Boeing and examine the data to determine what role, if any, fatigue played in an accident 737 controlled flight into terrain accident by considering the five factors that can lead to a fatigued state (circadian factors, at Resolute Bay, Nunavut, on Aug. 20, 2011. time since awakening, quantity of sleep, quality of sleep, and sleep disorders). We have highlighted two NTSB investigations in which fatigue was determined to be a contributing factor in the accident and resulted in five safety recommendations to improve flight crew and maintenance operations as well as training for fatigue. However, these accidents had vastly different circumstances, and the conclusions were made using different sources of data. The UPS investigation harvested considerable amounts of time-stamped data such as cellular telephone and hotel and company records to determine the flight crew’s sleep opportunities, which was supplemented by family and colleague interviews. The Sundance investigation, on the other hand, relied primarily on interviews with the involved individuals and some company records. There is no right or wrong way to gather and analyze fatigue-related data. Technology is becoming more commonplace, and thus the use of electronically based data to make these determinations will only continue. If organized and analyzed correctly, the data can provide additional detail and confidence to investigators about whether fatigue was a factor in an investigation. But in the end, the key to any robust investigation is to ask the right questions and gather as much data as possible to ensure important fatigue-related factors are not being missed. Disclaimer: The views expressed in this paper are not those of the NTSB and are not necessarily Figure 1. First Air Flight 6560 route map. endorsed by the safety board.

22 • January-March 2016 ISASI Forum Unstable Approaches: A Global Problem By David Ross (MO5600), Senior Regional Operations Investigator, Transportation Safety Board of Canada

he Transportation Safety Board of tial draft report, is then provid- Canada, or TSB, is an independent ed to designated reviewers who agency dedicated to advancing are asked to review and make Ttransportation safety. The TSB representations on the report. conducts independent investigations In this second collaborative of selected transportation occurrences phase, the TSB considers the to determine causes and contributing representations only for their factors, and then reports publicly on what contribution to the accuracy has been learned. and soundness of the report To instill confidence in the public and for their contribution to regarding the investigation process, it is the advancement of transpor- essential that an investigating agency be tation safety. The findings in independent and free from any conflicts the final report released to the Figure 2. Accident site looking north. of interest when conducting an investiga- public are those of the TSB. tion. As such, the TSB is an independent were recovered and transported to the agency, separate from other Canadian The accident TSB laboratory in Ottawa, Canada, where government agencies and departments. On Aug. 20, 2011, a Boeing 737-210C was another team was formed. TSB final reports and safety communi- operating as First Air Flight 6560 from ICAO Annex 13 notification provided cations are not subject to government Yellowknife, Northwest Territories, to Res- an accredited representative from the revision or approval. Our independence olute Bay, Nunavut (see Figure 1). During U.S. National Transportation Safety Board enables us to be fully objective in making the instrument landing system approach (NTSB) with technical advisors from findings as to causes and contributing to Runway 35 True at Resolute Bay, the Boeing, Pratt & Whitney, and the Federal factors, and in making transportation aircraft progressively diverged to the right Aviation Administration. Other organi- safety recommendations. of course. The crew initiated a go-around zations participating in the investigation However, while the TSB is independent after a ground proximity warning system were First Air, Transport Canada (TC), the of other organizations, we recognize that “sink rate” alert occurred, but there was Air Line Pilots Association, and the RCAF. collaboration is essential to the effective insufficient altitude and time to execute As mentioned previously, the initial conduct of an investigation. This col- the maneuvers and avoid collision with portion of the investigation focused on laborative approach is enabled through terrain. The aircraft struck a hill about data collection both at the crash site International Civil Aviation Organization one nautical mile east of the runway and and elsewhere. All of the organizations (ICAO) Annex 13, as well as the TSB legis- was destroyed by impact forces and a mentioned above participated in this col- lation, regulations, investigation policies, post-crash fire (see Figure 2). Eight pas- laborative phase, with TSB investigators and procedures. sengers and all four crewmembers died in leading functional groups. So how do we conduct an independent the crash, and the three surviving passen- investigation when we are collaborating gers were seriously injured. The accident Sequence of events with others? The collaboration is initially occurred during daylight in instrument An important part of the TSB investi- focused on meteorological conditions. gation process is the development of a data collec- sequence of events, and the identification tion under TSB response and analysis of safety-significant events. the direc- In August 2011, the TSB was conduct- Information for the sequence of events tion and ing an exercise field investigation to of this accident came primarily from the control of test equipment and procedures. The FDR, the CVR, and a military air traffic the TSB. The scenario was a simulated mid-air colli- control radar system that was operating TSB then sion at Resolute Bay with a large-scale at Resolute Bay. The sequence of events conducts its multi-department government response was depicted in several ways as follows: analysis of to a major air disaster. The TSB exercise a plan view of the flight path (see Figure the data in- team was on a Royal Canadian Air Force 3, page 24), an event sequence in the dependently (RCAF) C-17 that landed at Resolute TSB safety analysis software module (see of any other Bay about one hour after the accident. Figure 4, page 25), a word processor table organiza- The TSB team immediately shifted from (see Figure 5, page 25), FDR data plots, tion. This in- exercise to investigation mode and began and an engineering flight animation (see dependent collecting information. The TSB deployed Figure 6, page 26). While the sequence of analysis, in additional investigators to Resolute Bay events was developed in collaboration the form of and Yellowknife. The cockpit voice record- with other organizations, analysis of the Figure 1. First Air Flight 6560 route map. a confiden- er (CVR) and flight data recorder (FDR) events was done independently by TSB

January-March 2016 ISASI Forum • 23 Figure 3. Sequence of events, plan view.

24 • January-March 2016 ISASI Forum planning, the team convened in Vancou- ver, British Columbia, Canada, in March 2012, and conducted about 10 hours of simulator work over two days (see Figure 8, page 27). A key factor in the success- ful completion of this project was the collaboration of multiple organizations, each with its own expertise. The simulator project produced two key pieces of information. First, that a pilot applying sufficient force on the control wheel could cause the autopilot to shift modes without inducing any roll. Second, that use of the VOR/LOC mode resulted in either interception of or con- Figure 4. Sequence of events, safety analysis module. vergence with the localizer in every case. Both of these ultimately played a role in the analysis and findings. Follow-on meetings of the simulator team led to examination of decades-old engineering documents to establish the conditions and limitations for autopilot and flight director localizer capture. During the analysis phase, TSB investigators examined dozens of segments of the flight to make conclusions as to the likely autopilot and flight director system states and mode changes. This portion of the investigation produced two findings as to causes and contributing factors. First, that as the aircraft rolled out of the turn onto final approach, the captain likely made a Figure 5. Sequence of events, word processor table. control wheel roll input that caused the autopilot to change to a mode wherein investigators.Many events during the arrival of First ed in the limited number of parameters the aircraft rolled to and maintained Air Flight 6560 warranted further inves- on the FDR. Additionally, the operator’s wings level, and that the crew did not tigation and are described in the investi- standard operating procedures at the detect the mode change. Second, that gation report; however, this presentation time did not require crew callouts of the flight directors likely subsequently will focus on only selected events as they mode selections or changes, and none changed modes, resulting in a change of relate to crew resource management, or were recorded on the CVR. The challenge pilot roll guidance. CRM, and the continuation of an unstable to the investigation was to understand approach. There were also many events and explain how the pilots likely operated CRM that were not recorded that warranted these systems and what information they CRM was identified as a potential further investigation, especially autopilot had available during the approach. safety issue within the first week of and flight director mode changes that During the on-site work at Resolute the investigation when the initial CVR should have occurred during the ap- Bay, the NTSB accredited representative transcript became available. The CVR proach. suggested that the use of a flight simu- recording was essential to the analysis lator could be beneficial to the investi- of the role CRM played in this accident, Autopilot and flight director mode gation. The TSB accepted this idea, and and the TSB final investigation report changes a simulator project team headed by the made extensive use of those extracts of The FDR showed that the autopilot was author was formed. the CVR recording related to causes and engaged throughout the arrival of Flight In addition to TSB investigators, the contributing factors or the identification 6560. The captain would have needed to simulator team included representatives of safety deficiencies. make both autopilot and flight director from the NTSB, Boeing, the FAA, and Data collection for this portion of mode selections (see Figure 7, page 26) as First Air. The team had broad expertise the investigation involved gathering the flight approached from the southwest and included investigators, engineers, and reviewing hundreds of documents, toward the localizer. However, only the pilots, and human performance experts. conducting interviews with the peers autopilot engagement status was includ- Following several months of extensive of the occurrence pilots, observing the

January-March 2016 ISASI Forum • 25 Figure 6. Engineering flight animation.

operator’s CRM training delivery, and Ineffective workload management nication difficulties were exacerbated by carefully examinating the operator’s flight resulted in the Flight 6560 pilots becom- standard operating procedures that did operations policies and procedures. ing task-saturated and shedding tasks not specify standard phraseology to oper- TSB investigators repeatedly reviewed during the final two minutes of the flight. ationalize company operating policies for and analyzed the CVR recordings. As im- A prime example of this was an 80-second stable approaches. One example of this portant as what was said was how it was discussion on final approach about the was the first officer’s statement that they said, and the current operational cockpit flight’s divergence from the localizer (see were at three miles and not configured. context in which it was said. As with the Figure 9, page 28). During this period, the The investigation concluded that it is autopilot and flight director analysis, in- crew became immersed in the navigation- almost certain that the intended message vestigators examined dozens of segments al issue and did not action the remaining was that the approach was unstable and of the flight to understand why the pilots landing checklist items to finish config- a go-around was required. However, the did and said what they did. uring the aircraft for the approach. Once captain’s interpretation of this statement The analysis of CRM on Flight 6560 final configuration changes did occur, was that they needed to finish configur- focused on several of the mandatory CRM they were hurried and neither pilot made ing the aircraft for landing. training topics required by the Canadian all of the specified callouts. This critical miscommunication oc- Commercial Air Services Standards. Two Analysis of the sequence of events iden- curred while each crewmember likely had of these were workload management and tified many instances of ineffective com- a different mental model of the current communications. munication between the pilots. Commu- situation and the aircraft flight path. The

Figure 7. Autopilot/flight director mode control panel.

26 • January-March 2016 ISASI Forum investigation concluded that the captain’s unchanged in mental model was likely that the autopi- the intervening lot would re-intercept the localizer from years, while CRM the right and a landing would follow. best practices However, the first officer’s mental model and training was likely that Flight 6560 was full deflec- methods have tion from the localizer, was still diverging evolved through to the right of course on an unstable ap- several updated proach, and a go-around was necessary. generations. The The final report included a finding as to TSB final report causes and contributing factors that the for the Resolute crew did not maintain a shared situation- Bay investigation al awareness and that, as the approach included a find- continued, the pilots did not effectively ing that current communicate their respective perception, TC CRM training understanding, and future projection of standards and the aircraft state. guidance ma- This portion of the investigation led to terial have not several findings as to causes and contrib- been updated to uting factors. Key among them was an reflect advances overarching finding that the crew’s CRM in CRM training, was ineffective, and another finding that and there is no adaptations to standard operating pro- requirement for cedures by the crew contributed to their accreditation ineffective CRM. of CRM facili- The investigation also examined one of tators/instruc- First Air’s Boeing 737 bases to determine tors in Canada. whether any of the standard operating This situation procedure adaptations identified in Flight increases the risk 6560 existed elsewhere in the company. that flight crews The final report included a finding as will not receive to causes and contributing factors that effective CRM other B-737 pilots did employ adaptations training. and that the operator’s supervisory activi- The TSB issued ties did not detect the adaptations. a recommenda- Investigators also studied the compa- tion (A09-02) in ny’s CRM training program. The initial 2009 that the TC CRM course used presentations prepared require commer- Figure 8. Simulator interior view. by the TC in the mid-1990s, and five of the cial air operators required subjects were not presented dur- to provide contemporary CRM training another board concern that, without a ing the one-day course observed by TSB for air taxi and commuter pilots. The TC comprehensive and integrated approach investigators. The recurrent CRM course accepted the recommendation. Over the to CRM by the TC and aviation operators, was more up-to-date, including elements past five years, the TC has worked toward flight crews may not routinely practice of more recent generations of CRM train- updating the CRM training standard and effective CRM. ing but consisted of only two hours of expanding CRM training into all sectors training. The investigation made a finding of commercial flight operations. Unstable approaches as to causes and contributing factors that The TSB reassesses all recommen- As was the case with CRM, within the first the company’s initial and recurrent CRM dations annually to determine what week after the accident the investigation training did not provide the crew of Flight progress has occurred. During the 2014 had identified an unstable approach as 6560 with sufficient practical strategies to reassessment, the TSB rated TC’s progress a potential safety issue. The company enable effective CRM. on this recommendation as satisfacto- had in place both a no-fault go-around The Canadian CRM training standard ry intent, but expressed concern about policy and a stable approach policy with was also scrutinized. This standard was the slow pace of action to address this detailed criteria that became applicable brought into force in 1996 in response recommendation, especially when no during an approach in IMC at 1,000 feet to TSB Recommendation A95-11, which information was provided about when above aerodrome elevation. Initial plots called for CRM and decision-making the new standard was expected to come of the Flight 6560 FDR data showed that training to be mandatory for all operators into force. the indicated airspeed recorded at this and aircrew involved in commercial avia- When the Resolute Bay investigation point in the approach was 176 knots, 44 tion. However, the standard has remained report was released, the TSB issued knots greater than Vref. This was well in

January-March 2016 ISASI Forum • 27 figuration changes rather than initiating a go-around. Part of the TSB risk-analysis process is to identify similar occurrences. Investigators reviewed investigation reports from Canada and other countries and identified many occurrences that had an unstable approach as a contributing factor. These occurrences demonstrate that the severity can range from no injuries or damage to multiple fatalities and aircraft destruc- tion. They also demonstrate that, despite a significant industry effort to put in place defenses to mitigate the risks associated with unstable approaches and their consequences, the current defenses are not always robust enough to prevent catastrophic outcomes. Line-Oriented Safety Audits (LOSA) and flight data monitoring programs (FDM) are two means for airlines to identify risks present in their operations, including unstable approaches. However, LOSA is voluntary, and First Air has not participated in the program. At the time of the accident, First Air was putting in place a FDM monitoring program but had not yet achieved results because of data collection and quality problems. LOSA observations of more than 20,000 flights show that 4% of those flights had an unstable approach (see Figure 10), and that 97% of the unstable approaches continued to a landing (see Figure 11). On only 3% of un- Figure 9. Eighty-second discussion about divergence from localizer. stable approaches did the crews execute a go-around. excess of the company specified limit of not yet been translated into procedur- In 2013, a worldwide fleet of west- Vref + 20 knots. Once the FDR data was al guidance in the aircraft operating ern-built jet aircraft weighing greater integrated with the CVR and radar flight manuals for the company’s various fleets. than 60,000 pounds made 25.2 million path, four additional unstable parameters Consequently, when Flight 6560 entered departures. Assuming the LOSA unstable were identified. the stable approach zone, the first officer approach information is representative of Two key questions the investigation needed to improvise because he did not this fleet, that means that in 2013 almost looked into are as follows. First, why was have any standard phraseology to com- 1 million of those flights ended with an an unstable approach continued despite municate clearly to the captain that the unstable approach to a landing. This does policies in place to prevent this? Second, approach was unstable and they needed not include smaller jet aircraft and a large did continuing an unstable approach to go-around. As discussed above, the fleet of turboprop aircraft also used by introduce unacceptable risk? first officer’s attempt to communicate airlines. The investigation revealed that the this was misunderstood by the captain, In its final report on this investigation, company’s stable approach policy had who commenced the final landing con- the TSB urged the Canadian aviation

28 • January-March 2016 ISASI Forum duce the incidence of unstable approaches that continue to a landing, the risk of approach and landing accidents will persist. Therefore, the TSB issued Recom- mendation A14-01 that the TC require Canadian airline operators to monitor and reduce the incidence of unstable approaches that continue to a landing. The TC agreed with the intent of the recommendation, and, on June 27, 2014, issued a civil aviation safety alert request- ing Canadian airline operators to use their existing SMS processes to address and mitigate hazards and risks associat- Figure 10: Unstable approaches. ed with unstable approaches. This safety alert also indicated that, beginning in industry to take three steps to reduce this procedure compliance through pro- 2015–2016, the TC will, within the context risk to the system. grams such as FDM and LOSA. of normal surveillance activities, assess • First, for operators to have practi- In Canada, the TC requires airline oper- the effectiveness of the various measures cal and explicit policies, criteria, ators to have safety management systems undertaken by airlines in reducing the and standard operating procedures (SMS), CVRs, and FDRs. However, these number of unstable approaches that con- for stabilized approaches that are air carriers are not required to have an tinue to a landing, including how airlines enshrined in the company operating FDM program. Even so, many of these track, analyze, and implement corrective culture. operators routinely download their flight measures. • Second, for companies to have data to conduct FDM of normal opera- In conclusion, the TSB can emphatical- contemporary initial and recurrent tions. Air carriers with an FDM program ly state that “independence does not CRM training programs delivered by have used flight data to identify and mit- mean isolation.” Teamwork is essential in qualified trainers, and to monitor and igate many problems, including unstable every investigation, and investigators reinforce effective CRM skills in day- approaches. should be encouraged to surround to-day flight operations. In its final report, the TSB concluded themselves with experts and to collabo- • Third, to monitor standard operating that, unless further action is taken to re- rate with them.

Figure 11. Unstable approaches continued to a landing.

January-March 2016 ISASI Forum • 29 CORRECTION ISASI Information

In the Change Point Analysis Applied to SMS article by Paulo Razaboni in OFFICERS the October–December 2015 issue of the Forum, the wrong chart was President, Frank Del Gandio ([email protected]) displayed as Figure 9 on page 30. Below is the correct chart and its de- Executive Advisor, Richard Stone scription. ([email protected]) Vice President, Ron Schleede ([email protected]) Secretary, Chad Balentine ([email protected]) Treasurer, Robert MacIntosh, Jr. ([email protected]) COUNCILLORS Australian, Richard Sellers ([email protected]) Canadian, Barbara Dunn ([email protected]) European, Olivier Ferrante ([email protected]) International, Caj Frostell ([email protected]) New Zealand, Alister Buckingham ([email protected]) Pakistan, Wg. Cdr. (Ret.) Naseem Syed Ahmed ([email protected]) United States, Toby Carroll ([email protected]) NATIONAL AND REGIONAL Figure 9. Using the above data set, the algorithm reveals three changes, the latest one in Jul/2013 SOCIETY PRESIDENTS (96% confidence), earlier ones in Oct/2011 and in Jul/2012. Short-term behavior is stable, and AsiaSASI, Chan Wing Keong long-term presents a downtrend. Distribution is not normal considering the whole set. Some level of ([email protected]) seasonality may be assigned, as the sinusoidal curve roughly fits the data, the worst month identified Australian, Richard Sellers as August (42% above the average). ([email protected]) Canadian, Barbara Dunn ([email protected]) European, Keith Conradi ([email protected]) MOVING? Please Let Us Know Korean, Dr. Tachwan Cho (contact: Dr. Jenny Yoo—[email protected]) Member Number Latin American, Guillermo J. Palacia (Mexico) ______Middle East North Africa, Ismaeil Mohammed Fax this form to 703-430-4970 , or mail to Abdul (contact: Mohammed Aziz— ISASI, Park Center [email protected]) 107 E. Holly Avenue, Suite 11 New Zealand, Alister Buckingham Sterling, VA USA 20164-5405 ([email protected]) Old Address (or attach label) Pakistan, Wg. Cdr. (Ret.) Naseem Syed Ahmed ([email protected]) Name ______Russian, Vsvolod E. Overharov Address ______([email protected]) United States, Toby Carroll City ______([email protected]) State/Prov. ______UNITED STATES REGIONAL Zip ______CHAPTER PRESIDENTS Country ______Alaska, Craig Bledsoe New Address* ([email protected]) Arizona, Bill Waldock ([email protected]) Name ______Dallas-Ft. Worth, Tim Logan Address ______([email protected]) City ______Great Lakes, Matthew Kenner ([email protected]) State/Prov. ______Mid-Atlantic, Ron Schleede Zip ______([email protected]) Northeast, Luke Schiada ([email protected]) Country ______Northern California, Kevin Darcy E-mail ______([email protected]) *Do not forget to change employment and e-mail address. Pacific Northwest, Kevin Darcy ([email protected])

30 • January-March 2016 ISASI Forum ISASI Information

Rocky Mountain, David Harper Air Astana JSC Global Aerospace, Inc. ([email protected]) Air Canada Grup Air Med S.A. Southeastern, Robert Rendzio Air Canada Pilots Association Gulfstream Aerospace Corporation ([email protected]) Air Line Pilots Association Hall & Associates LLC Southern California, Thomas Anthony Airbus HNZ New Zealand Limited ([email protected]) Airclaims Limited Honeywell Aerospace Airways New Zealand Hong Kong Airline Pilots Association COMMITTEE CHAIRMEN Alitalia SpA Human Factors Training Solutions Pty. Ltd Audit, Dr. Michael K. Hynes All Nippon Airways Co., Ltd. (ANA) Independent Pilots Association ([email protected]) Allianz Interstate Aviation Committee Award, Gale E. Braden ([email protected]) Allied Pilots Association Irish Air Corps Ballot Certification, Tom McCarthy Aloft Aviation Consulting Irish Aviation Authority ([email protected]) Aramco Associated Company Japan Transport Safety Board Board of Fellows, Curt Lewis ([email protected]) ASPA de Mexico Jones Day Bylaws, Darren T. Gaines ASSET Aviation International Pty. Ltd. KLM Royal Dutch Airlines ([email protected]) Association of Professional Flight Attendants Korea Aviation & Railway Accident Australian and International Pilots’ Association Investigation Board Code of Ethics, Jeff Edwards ([email protected]) (AIPA) L-3 Aviation Recorders Membership, Tom McCarthy ([email protected]) Australian Transport Safety Bureau Learjet/Bombardier Aerospace Mentoring Program, Anthony Brickhouse Aviation Investigation Bureau, Jeddah, Lion Mentari Airlines, PT ([email protected]) Kingdom of Saudi Arabia Lockheed Martin Aeronautics Company Nominating, Troy Jackson Aviation Safety Council Middle East Airlines ([email protected]) Avisure Military Air Accident Investigation Branch Reachout, Glenn Jones ([email protected]) Becker Helicopters Pty. Ltd. National Aerospace Laboratory, NLR Scholarship Committee, Chad Balentine Bundesstelle fur Flugunfalluntersuchung (BFU) National Institute of Aviation Safety and ([email protected]) Bureau d’Enquêtes et d’Analyses (BEA) Services Seminar, Barbara Dunn ([email protected]) CAE Flightscape National Transportation Safety Board Cathay Pacific Airways Limited National Transportation Safety Committee- WORKING GROUP CHAIRMEN Charles Taylor Aviation Indonesia (KNKT) Air Traffic Services, Scott Dunham (Chair) China Airlines NAV CANADA ([email protected]) Civil Aviation Authority, Macao, China Pakistan Air Force-Institute of Air Safety Ladislav Mika (Co-Chair) ([email protected]) Civil Aviation Department Headquarters Pakistan Airline Pilots’ Association (PALPA) Airports, David Gleave ([email protected]) Civil Aviation Safety Authority Australia Pakistan International Airlines Corporation Cabin Safety, Joann E. Matley Civil Aviation Safety Investigation and Analysis (PIA) ([email protected]) Center Papua New Guinea Accident Investigation Corporate Affairs, Erin Carroll Colegio Oficial de Pilotos de la Aviación Commission (PNG AIC) ([email protected]) Comercial (COPAC) Parker Aerospace Critical Incident Stress Management (CISM), Cranfield Safety & Accident Investigation Phoenix International Inc. David Rye--([email protected]) Centre Plane Sciences, Inc., Ottawa, Canada Flight Recorder, Michael R. Poole Curt Lewis & Associates, LLC Pratt & Whitney ([email protected]) Dassault Aviation PT Merpati Nusantara Airlines DDAAFS Qatar Airways General Aviation, Steve Sparks Defence Science and Technology Organisation Republic of Singapore Air Force (RSAF) ([email protected]) (DSTO) Rolls-Royce PLC Co-Chair, Doug Cavannah Defense Conseil International (DCI/IFSA) Royal Danish Air Force, Tactical Air Command ([email protected]) Delta Air Lines, Inc. Royal Netherlands Air Force Government Air Safety Facilitator, Directorate of Flight Safety (Canadian Forces) Royal New Zealand Air Force Marcus Costa ([email protected]) Dombroff Gilmore Jaques & French P.C. RTI Group, LLC Human Factors, Richard Stone DRS C3 & Aviation Company, Avionics Line of Saudia Airlines-Safety ([email protected]) Business Scandinavian Airlines System Investigators Training & Education, Dubai Air Wing Sikorsky Aircraft Corporation Graham R. Braithwaite Dutch Airline Pilots Association Singapore Airlines Limited ([email protected]) Dutch Safety Board SkyTrac Systems Ltd Military Air Safety Investigator, Bret Tesson Eclipse Group, Inc. Southwest Airlines Company ([email protected]) Education and Training Center for Aviation Southwest Airlines Pilots’ Association Unmanned Aerial Systems, Tom Farrier Safety Spanish Airline Pilots’ Association (SEPLA) ([email protected]) EL AL Israel Airlines State of Israel Embraer-Empresa Brasileira de Aeronautica Statens haverikommission CORPORATE MEMBERS S.A. Swiss Accident Investigation Board (SAIB) AAIU, Ministry of Transport Embry-Riddle Aeronautical University The Air Group Accident Investigation Board Norway Etihad Airways The Boeing Company Accident Investigation Bureau Nigeria European Aviation Safety Agency (EASA) The Japanese Aviation Insurance Pool (JAIP) Administration des Enquêtes Techniques EVA Airways Corporation Transportation Safety Board of Canada Aero Republica Executive Development & Management Advisor Turbomeca Aerovias De Mexico, S.A. De C.V. Finnair Plc UND Aerospace Air Accident Investigation Bureau of Mongolia Finnish Military Aviation Authority United Airlines Air Accident Investigation Bureau of Singapore Flight Data Services Ltd. United States Aircraft Insurance Group Air Accident Investigation Unit-Ireland Flight Data Systems Pty. Ltd. University of Southern California Air Accident Investigation Sector, GCAA, UAE Flight Safety Foundation WestJet Air Accidents Investigation Branch-UK GE Aviation Air Asia Group General Aviation Manufacturers Association

January-March 2016 ISASI Forum • 31 ISASI 107 E. Holly Ave., Suite 11 Sterling, VA 20164-5405 USA CHANGE SERVICE REQUESTED

INCORPORATED AUGUST 31, 1964

WHO’S WHO

Alliance, SpaceX, The Boeing Company, Embry-Riddle Aeronautical University Honeywell, and Virgin Galactic. (Who’s Who is a brief profile prepared by the represented ISASI corporate member organization to Embry-Riddle’s beautiful residential provide a more thorough understanding of the organization’s role and function.—Editor) campuses in Daytona Beach, Fla., and Prescott, Ariz., offer students the choice of pioneer in aviation education since tool for the aerospace and occupational a spectacular beach setting or an amazing 1926, Embry-Riddle Aeronautical safety degree program. Current artifacts mountain community. Embry-Riddle On- AUniversity continues to be the most include several fixed-wing aircraft and a line and the Worldwide Campus operate a highly regarded institution dedicated to helicopter that have all been involved in globally recognized learning system that the field. It is the nation’s largest, oldest, actual crashes. This lab allows students leverages online and face-to-face instruc- and most comprehensive aeronautical to view and touch the wreckage while tion and a network of educational facilities university, with a curriculum at the fore- practicing the science of aircraft accident designed to support student advancement front of the industry’s developments and investigation. in the U.S. and abroad. demands for the future. Potential research topics include Students come from all 50 states and Embry-Riddle sets the standards for experiential learning techniques, forensic 125 countries around the world, and there aviation education, is involved with the imaging, metallurgical failure analyses, is one trait they all share—a determina- formulation of national and international software uses for accident scene diagrams, tion to succeed. The bonds they develop policy related to aviation, and remains powerplant system analysis, flight in- in classrooms and residence halls last a the nexus of aviation education. Every strument impact capture marks, and the lifetime. The university’s Alumni Associ- student in an aviation curriculum benefits pedagogy of wreckage layouts to maximize ation, with 120,000 members, works to from hands-on learning in new, expertly student learning. This approach can lead connect alumni with one another and with maintained aircraft, labs that replicate the students to careers in accident investiga- hundreds of employers around the globe. nation’s airspace, state-of-the-art mainte- tion; aircraft manufacturing; airport safety; This iconic institution celebrates its 90th nance and avionics repair facilities, and environmental, health, and safety; ergo- anniversary in 2016. Whether a student is unrivaled aviation simulation centers. nomics/human factors; OSHA compliance interested in applied science, aviation, However, Embry-Riddle is so much management; and risk management. business, computers and technology, more. Embry-Riddle’s storied history in flight engineering, security, intelligence and For ever-inquisitive minds, analytical education has positioned it to become safety, communications, or space, Emb- thinkers, and problem solvers, Emb- a pioneering institution for the study of ry-Riddle will continue to set the standards ry-Riddle offers applied research degree space-related endeavors. The university for aviation and aerospace education—and programs to challenge and excite. These now offers degree programs that include so much more. programs are deeply rooted in research; astronomy and astrophysics, space physics, and while some areas may be focused on and commercial space operations—the For more information, visit www.embryriddle.edu. aviation and aerospace, the fundamentals only degree of its kind in the world. Stu- can be applied to any other industry. dents benefit from building relationships For instance, the Applied Aviation with faculty and industrial professionals Sciences Department operates the Aer- and from alliances with organizations and ospace Forensics Lab, a critical teaching companies, including NASA, United Space

32 • January-March 2016 ISASI Forum