European Society of Air Safety Investigators – Regional Seminar 23/24 April 2014
CE Report
This 2 day seminar was held in Milan under the Chairmanship of Keith Conradi, Chief Inspector of Accidents AAIB and ESASI President; there was a broad range of delegates from Europe, the USA and Japan.
Constructive Co-operation in EU Accident Investigation – Luigi Candiani (Augusta Westland)
The first presentation examined some of the lessons learned from investigating accidents under the Italian legal system. Italian investigations usually involve a public prosecutor who is obliged to carry out a parallel investigation in the event of deaths or injuries. Magistrates focus on finding guilt rather than causation; an ‘aviation culpable disaster’ involving death or property damage to 3rd parties can incur a 12 year maximum jail term. The public prosecutors are appointed regionally and may therefore be investigating an aircraft accident for the first time. Investigators in Charge can be called to testify at trials as a person informed on the facts. The Italian AIB (Agenzia Nazionale per la Sicurezza del Volo) is under the direct supervision of the President of the Council of Ministers and not the Minister of Infrastructure and Transport (who owns the CAA).
Case study on co-operation:
An AW109 on an EMS flight crashed into the sea at night in Nov 2007. All survived but there was no pre-impact RT, which delayed the rescue effort. The aircraft was in a descent when it experienced high levels of vibration and shaking; application of collective at 100ft led to a low-speed impact but the helicopter rapidly capsized. It came to rest inverted but intact on the sea bed at a depth of 105m, close to the working limit for divers.
Discussions with the manufacturer (AW) indicated the best means of lifting the wreckage was via the undercarriage as there was concern about the integrity of the main rotor gearbox. The aircraft was lifted inverted into shallow water where the rotor blades were removed and the fuselage rolled upright using strops. Once on deck (about 6 months after the accident) the wreckage was immediately washed with fresh water and non-volatile memory items were immersed in clean water. By agreement with the public prosecutor the Italian Air Force conducted the inspection and analysis of the wreckage. Agreement was also required for chip cloning and data retrieval from the Data Acquisition Unit, and a successful download was achieved despite a 6-month salt water immersion.
Lessons learned: The collaborative/co-operative approach to this investigation was possible under Reg (EU) 996/2010. FDR and CVR should be fitted to all (commercial) aircraft under 27 tons, NAAs should encourage this and manufacturers should include this in their proposals to customers. FDM for lighter aircraft should be considered. FDR data needed to encompass control outputs not just inputs.
EASA NPA 2013-26: Requirements for Flight Recorders and Underwater Location Devices – Guillaum Aigoin (EASA)
The AF447 experience had prompted ICAO to update its requirements for FDR, CVR and ULDs. There were 4 issues: obsolete recording technology; CVR over-writing; ULD transmission time; and location in oceanic areas.
Many FDR and CVR were still using magnetic tapes or other ‘old’ media, and data was either missing or of poor quality in a 1/3 of all accidents and incidents. 30% of the CAT fleet (EASA MS) were still using magnetic tape and the rate of replacement was tied to the rate of fleet renewal. ICAO Annex 6 now seeks to phase out obsolete recorders by 2016 and take advantage of the increased reliability and accuracy of solid-state technology.
CVR over-run was a particular problem for incident, rather than accident, investigation. Crews often failed to deactivate the recorders to preserve data, or maintenance staff inadvertently reactivated them. This problem mainly affected large aeroplanes as few helicopters are fitted with CVRs. There have been 7 Safety Recommendations made to EASA on the subject, and 38 CVR over-runs had been reported from incident investigations. ICAO Annex 6 will require CVRs to have a minimum duration of 2 hours by 2016.
Transmission time of ULDs was insufficient at 30 days and ICAO was extending this to 90 days. ULDs with this capacity were already commercially available, and only cost around €500 more than the 30 day variants.
Locating accident sites in oceanic areas with flight tracking was very expensive and, obviously, no wreckage = no proper investigation. ICAO was mandating new long-range ULDs that would transmit on 8.8KHz; this measure would only be applicable to large CAT aircraft.
The EASA NPA has been out for consultation but the recent MH370 accident has led EASA to short-circuit the process and an Opinion will be issued to the European Commission in May/June 2014. The main provisions are:
FDR – Mandated pre-flight checks and obsolete recording media to be replaced with solid-state media by 2019.
CVR – Mandated protection procedures to be included in Flight ops Manuals; Minimum 2 hour recorders to be retrofitted to all commercial air transport aircraft by 2019; CVRs manufactured from 2019 must have 15 hours recording time.
Underwater Location Devices – Must be able to transmit for 90 days by 2020. Large commercial air transport aircraft built after 2005 to be retrofitted by 2019 with a long-range (8.8KHz) ULD or other means to locate the point of impact to within 6nm.
Regulation (EU) 996/2010 Review – Olivier Ferrante (EC)
Article 24 of the Reg requires its review by Dec 2014 and a questionnaire had therefore been sent to all EASA MS and a wide range of other stakeholders. Responses had indicated that the scope and overall functioning of 996/2010 was satisfactory but that some improvements could be made. Over half of the State Investigating Authorities (AAIB etc) either needed assistance or were unable to conduct their own investigations. Dealings with judicial authorities were variable across EASA MS, and there was a divergence on disclosure of sensitive safety information; most SIA had no problems with access to safety information but relevant medical information could be much harder to obtain. Article 21 (assistance to victims) needed improved guidance material and there was a proposal to move it (and Art 20) to other legislation.
EC long-term aim was to generate a central AIB, but all feedback suggests it is too soon to consider this now. Improved co-operation between SIAs would reap benefits in the short term. Work to align MS judicial processes could be protracted.
Co-ordination of Investigations for Similar Events – Mario Colavita (ANSV)
The ANSV recognized that there would be benefit in the timely sharing of information by SIAs between investigations into similar occurrences
An AW139 had ditched in Hong Kong in July 2010. The investigation was ongoing (with ANSV as AcRep for State of Manufacture) when 2 similar events occurred, a tail-rotor failure on the ground in Qatar (May 2011) and a fatal TR failure in flight in Brazil (August 2011). In the Qatar incident, a TR blade had detached followed by TR separation and a pylon fire; ANSV and EASA were members of the investigation committee (which was not Annex 13-compliant), and ANSV was also involved in the Brazil investigation. All events had been sudden with no prior indications of failure.
The Hong Kong CAD made an initial request for co-ordination, which ANSV offered to manage. A joint/multilateral meeting was held in Rome after the 3rd accident, which allowed all 3 investigations to reach a common understanding and alignment of activities. The analysis of the failed TR blades in Italy showed static overload failure of the blade trailing edge bottom strap and some fatigue damage. There were no quality issues and all blades were within design tolerances but there was evidence of weak bonding in the blade root area; new blades have since been certified. The Hong Kong final report is now due for publication, and the Brazil final report is expected in Q3/2014.
The co-operative approach was used again by ANSV in support of the investigations into ATR42 and ATR72 in-flight fire events, of which 3 had occurred in a 4-month period. ANSV acted as co-ordinator for the Denmark and Italy events and was the AcRep for the Bucharest event. The joint investigation found all events were due to failure of a PT1 rotor blade caused by casting defects and subsequent low-cycle fatigue damage. The teams devised short and long term targets including inspection of all pre-2008 blades and improved smoke evacuation procedures. The harmonised EU approach led to 5 joint Safety Recommendations; the reports were signed by the heads of the 3 SIA and published under a cover note by the head of the ANSV.
Small UAS for Accident Site Imaging – Stuart Hawkins (AAIB)
Police and SAR helicopter (or other platform) imagery provides good coverage of accident sites but is not always available and can’t be reviewed on-site. Commercial helicopters cost in excess of €500 per hour and are also not readily available. Commercial UAS provide high resolution and real-time imagery, and are useful for close-ups; however, costs are high (€3000/day) and availability can also be an issue.
The AAIB has been conducting a trial with a small UAS (Phantom 2 Vision) which has all the advantages of a commercial system but at a fraction of the cost (€960 to purchase). The system comes with a 14MP camera and, at <20kg, is quick and easy to deploy. AAIB ops comply with CAA regulations for small UAS, which means special clearance is required for operating in congested areas or above 400ft agl. There are some minor drawbacks with camera stabilisation and remote zoom, though this can be achieved by physically flying the system closer to the target.
AAIB limits its ops to winds
Case Study: MALEV Hypoxia Incident (HA-LOK) 23 Nov 2011 – Janos Eszes (TSB Hungary)
The incident occurred when an experienced B737 crew mis-managed the pressurisation system, leading to the pax O2 masks deploying during the climb. Main causes of insufficient cabin pressure for any aircraft are leaks, inadequate air supply and control error.
The B737 conditioning system has left and right distribution packs controlled by a 3-position switch (OFF/AUTO/HIGH). The crew failed to recognise that the switch was in the OFF position during checklist readouts, one by each pilot. When the warning horn activated during the climb, neither pilot recognised the reason for the horn, ie that it was a pressurisation warning, and the crew then failed to follow the CABIN ALT WNG/RAPID DEPRESSURIZATION checklist.
The Capt silenced the horn after 30 secs and 1 minute later started to level off. At this stage the aircraft reached its max altitude of 17,250ft, the cabin alt reached 14,000ft and the pax masks deployed. The Capt rejected the FO’s suggestion of an emergency descent but neither pilot checked the overhead panel. 2 minutes later, the Capt told the FO there was no need to don their O2 masks and 30 seconds after that he ran the AUTO FAIL checklist, at which stage the packs were switched to AUTO. The Capt then decided to descend to 12,000ft (an action he could not later explain), but eventually descended further, the aircraft and cabin altitude reaching 10,000ft 12 minutes after the initial warning. The crew then held for a while to avoid an overweight landing even though the aircraft was already below this weight at take-off.
The investigation found no technical defects and concentrated on the HF aspects. The Capt was known to be ‘very confident’ and had experienced a similar incident with a technical problem around 2 years previously. He also had a second job and was regularly tired at work, and he had taken a mobile call during the pre-flt checks. The investigation questioned whether some of the crew actions were a result of hypoxia; crew reactions during the approach were very slow and they had failed to complete all the checklists prior to touchdown.
The investigation produced several Safety Recommendations: that the HU CAA required operators to provide realistic training for cabin pressure loss; for the FAA and EASA to introduce alerts for an inactive pressurisation system, and provide alternative actions in the AFM and checklists for pressurisation problems; and that ICAO requires the inclusion of cabin pressurisation in FDR data.
Crew Monitoring – Frederic Combes (Airbus)
This presentation began with the observations that monitoring is not a natural activity, it does not stand alone and is not specifically trained. Slow changes are not attention getters and the risk of an unwanted aircraft state increases if both pilots become involved in non-monitoring tasks. Case studies were then used to illustrate instances of poor and good monitoring. These included an A321 incident where the Alpha-floor protection operated approximately one minute after the aircraft had been levelled at 4000ft with idle thrust selected and the ATHR disengaged; airspeed had been allowed to decay to VLS -26Kts, with the crew still trying to pitch the nose up when the protections activated. Poor monitoring of AP mode annunciation was a feature of this incident and another example given (A310).
In an example of better monitoring, an A330 suffered a RH engine surge at 112 kts on take-off. The FO (PF) achieved 95% rudder deflection within 0.8 secs and the Capt (PM) called the Reject 0.2 secs later; max deviation from the runway centreline was only 3.7m.
Airbus strategies for improved monitoring and situational awareness included:
– Review task in advance, anticipate
– Recognise multi-task demands and allocate areas for attention
– Share perceptions
– Manage workload
– Mentally fly the aircraft even when the AP is on
– Adapt monitoring to the speed of evolution of information
– What if…
– Assign monitoring tasks with at least an equal priority to other flight deck tasks
Runway over-runs – Mark Smith (Boeing)
The runway over-run picture has been getting worse over the last 20 years (357 from 1992-2001 compared with 973 for 2002-2011). Boeing had been conducting Runway Track Analysis using data combined from multiple sources, including time-based FDR to calculate landing positions and energy levels. The primary factors were touchdown point and speed (both variables fixed at touchdown) and deceleration. Results were presented in spreadsheet format.
Of note, 2/3 of all over-runs) were from stable approaches (sample size 39). However, the bulk of the hull losses followed unstable approaches. (Deduction: a stable approach does not guarantee you will avoid an over-run, but an unstable approach markedly increases the probability of a hull loss in the event of an over-run.) Long landings were the biggest causal factor in over-runs. Boeing advice: Land in the first 3000ft (or first 3rd) of the runway, or Go Around. Contributors to long landings included poor flightpath control (high) and delayed thrust reduction. Many fast touchdowns resulted from crews ‘ducking under’ the normal glideslope.
Some over-runs had occurred through poor use of deceleration controls, with crews delaying TR use and/or failing to use the available wheel-braking. Immediate selection of TR meant that full TR could be achieved after about 5 seconds, whereas a delay allowed engines to reduce below flight idle and thereby increasing the selection-full time to 11 seconds or more. Correct use of TR added the same deceleration effect as full braking on a MED runway (ie TR + brakes was double the effectiveness of brakes alone). Runway condition was seen as a contributor rather than a causal factor, but this also meant that good runway conditions could be masking potential over-runs. Use TR until 80 kts or until stopping is assured.
Linking Air Safety Investigations – Leonardo Ferrero
This short presentation covered the work of a student who has developed a search engine for aviation accidents that links a number of existing databases and creates a virtual library. It also has a ‘find similar’ button that aligns different taxonomies. The resource links to the FAA lessons learned library (http://lessonslearned.faa.gov) ASN and SKYbrary; the FAA resource lists 71 key accidents, grouped by themes. You can find the website at www.linkingASI.eu
Investigating Air Accidents in an Urban Environment – Sid Hawkins (AAIB)
This interesting presentation looked at the initial AAIB response to the helicopter accidents in Vauxhall and Glasgow in 2013. The Vauxhall accident was pictured on Twitter within 2 minutes of the event; traffic congestion hampered arrival of the advance party (on site @ +3 hrs) and the main recovery parties subsequently had a ‘blue light’ escort. Emergency services declared a major incident early in the process, which meant Silver command was established just off-site; AAIB has identified the need to have a permanent presence at Silver level when this form of command is being used. The Police handed control of the site to the AAIB at an early stage, which increased the management task for AAIB, but helpfully also produced a laser scan of the area that helped with wreckage plotting. Insurers and loss adjusters have a legitimate role in the process, which required them to have escorted access to the site. The site was cleared of wreckage and handed back to the emergency services 33 hrs post-crash.
The Glasgow event occurred late at night and the AAIB was not on-site until the next morning. The accident generated political and international interest which included the presence of the Scottish Deputy First Minister at an on-site meeting. The Police delegated control of the site jointly to the Fire Service and AAIB, reflecting the dangerous condition of the wreckage and building. Priorities (set by the Police) were safe ops, dignified recovery of the deceased, and recovery of evidence. Removal of the wreckage was undertaken in full public view, with only one chance to ‘get it right’. Lessons included the need for on-site storage and site security. The location was released by AAIB after 54 hrs on site.
————–
Copies of the presentations will be made available via the ESASI website and will be transferred to the UKSFC where possible.
Dai Whittingham
Chief Executive
15 May 2014