Air Safety Through Investigation APRIL-JUNE 2016

Air Safety Through InvestigationJournal of the International Society of Air Safety Investigators

APRIL-JUNE 2016

Page 4 Commentary: Unmanned Aerial Systems Will Reduce Fatalities but Will Disrupt Aviation in the Process

Page 12 Beware the Threat to Independence and Impartiality

Page 6 B-787 Lithium Battery Incidents: Complex Investigations, Boeing’s Role

Page 16 A Family Affair: AirAsia Group in Light of Indonesia AirAsia Flight QZ8501

Page 22 Fixing the Holes: Infrastructure, Training, and Oversight

Page 19 Is It a Space Plane or Rocket?

Page 24 A Small Accident but a Very Complex Investigation

2 • April-June 2016 ISASI Forum

CONTENTS

Publisher Frank Del Gandio Editorial Advisor Richard B. Stone

Editor Esperison Martinez Design Editor Jesica Ferry

Associate Editor Susan Fager

Volume 49, Number 2

ISASI Forum (ISSN 1088-8128) is published quar-terly by the International Society of Air Safety Investigators. Opinions expressed by authors do not necessarily represent official ISASI position or policy.

Editorial Offices: Park Center, 107 East Holly Avenue, Suite 11, Sterling, VA 20164-5405. Tele-phone 703-430-9668. Fax 703-430-4970. E-mail address, [email protected]; for editor, [email protected]. Internet website: www.isasi.org. ISASI Forum is not responsible for unsolicited manuscripts, photographs, or other materials. Unsolicited materials will be returned only if submitted with a self-addressed, stamped enve-lope. ISASI Forum reserves the right to reject, delete, summarize, or edit for space con- siderations any submitted article. To facilitate editorial production processes, American Eng-lish spelling of words is used.

Copyright © 2016—International Society of Air Safety Investigators, all rights reserved. Publica-tion in any form is prohibited without permis-sion. ISASI Forum registered U.S. Patent and T.M. Office. Opinions expressed by authors do not necessarily represent official ISASI position or policy. Permission to reprint is available upon application to the editorial offices.

Publisher’s Editorial Profile: ISASI Forum is print-ed in the United States and published for profes-sional air safety investigators who are members of the International Society of Air Safety Inves-tigators. Editorial content emphasizes accident investigation findings, investigative techniques and experiences, regulatory issues, industry ac-cident prevention developments, and ISASI and member involvement and information.

Subscriptions: A subscription to members is pro-vided as a portion of dues. Rate for nonmem-bers (domestic and Canada) is US$28; Rate for nonmember international is US$30. Rate for all libraries and schools is US$24. For subscription information, call 703-430-9668. Additional or replacement ISASI Forum issues: Domestic and Canada US$4; international member US$4; do-mestic and Canada nonmember US$6; interna-tional nonmember US$8.

INCORPORATED AUGUST 31, 1964

Air Safety Through InvestigationJournal of the International Society of Air Safety Investigators

FEATURES

DEPARTMENTS

ABOUT THE COVER

4 Commentary: Unmanned Aerial Systems Will Reduce Fatalities but Will Disrupt Aviation in the ProcessBy Dr. Robert Matthews, Ph.D., Independent Consultant—The author says that unmanned aerial systems offer good news for aviation safety, but not without some disruption to some sectors of aviation.

6 B-787 Lithium Battery Incidents: Complex Investigations, Boeing’s RoleBy Lori Anglin, Air Safety Investigations, Boeing Commercial Airplanes, and John R. Lowell, Boeing Research and Technology—Two Boeing 787-8 lithium-ion battery failures only nine days apart grounded the fleet. Boeing’s response was swift in designing plans to assist in the investigation, and establishing three teams to conquer the tasks at hand.12 Beware the Threat to Independence and Impartiality By Robert Vickery, CEng MIET, UK Air Accidents Investigation Branch Senior Inspector (Engineering)—The author offers thought and encourages debate regarding the close working relationships among investigators, manufacturers, and operators to understand the events leading to an accident.

22 Fixing the Holes: Infrastructure, Training, and OversightBy Alain Agnesett and Arnaud Desjardin, Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (BEA), France—The investigation demonstrates the spir-it of independence that has to be the basis for the work of any investigation authority involved in aviation safety.

19 Is It a Space Plane or Rocket?By E. Lorenda Ward, Senior Investigator-in-Charge, U.S. NTSB—On Oct. 31, 2014, Scaled Composites’ SpaceShipTwo, a suborbital rocket, broke into multiple pieces over a five-mile area near Koehn Dry Lake, California. But SS2 was also referred to as a “space plane,” and WhiteKnightTwo was referred to as the “mother ship.” The author discusses the unique aspects of a commercial space accident investigation.

16 A Family Affair: AirAsia Group in Light of Indonesia AirAsia Flight QZ8501 By Tony Fernandes, Group CEO and Founder of AirAsia Group—AirAsia Group’s CEO thanks ISASI members for the efforts of their profession and relates what was done before, during, and after the accident to address emerging issues.

24 A Small Accident but a Very Complex Investigation By Leo P. Murray, Inspector of Air Accidents (Operations), Air Accident Investi-gations Unit–Ireland—The European Commission Directorate for Commercial Air Transport noted that safety recommendations also underline the importance of sharing safety-related information among authorities.

2 Contents3 President’s View—ISASI Serves on International Observer’s Panel30 ISASI Information32 Who’s Who—Southwest Airlines Enters 45th Year of Service

Scaled Composites’ SpaceShipTwo (SS2) is launched from the WhiteKnightTwo carrier aircraft, N348MS, about 13 seconds before the SS2 broke into multiple pieces during its fourth rocket-powered flight test and impacted terrain over a five-mile area near Koehn Dry Lake, California. One test pilot (the copilot) was fatally injured, and the other test pilot was seriously injured. See page 19. (Photo: NTSB)

April-June 2016 ISASI Forum • 3

took place on December 18 at the headquarters of the Russian Interstate Avia-tion Committee (IAC), which is in charge of civil aircraft accident investigations for the 12 republics of the Commonwealth of Independent States. It’s also been an ISASI corporate member since 1994. The process started with a press conference involving 22 cameras and more than 50 reporters. Russian Air Force generals made opening remarks and described the procedures for the opening and readout. A video of the open-ing remarks and venue can be found at https://youtu.be/5EtVnvRTh80.

Ron and I were in the laboratory and observed the opening of the recorder. The entire process was fed by live video feed to a large screen for the news media rep-resentatives in the conference room. The recorder showed severe impact damage but no evidence of fire. It was evident that the recorder had not been opened earlier. Unfortunately, when the memory module was uncased, it was clear that it had been deformed by impact forces, making a readout using normal procedures impos-sible. There appeared to be two to three chips still intact; however, they didn’t reveal any data. Further examinations are being planned that may reveal some data, but these will require considerable time and resources. Ron and I believe that the initial process was conducted to pro-fessional standards and was completely transparent.

Following the flight data recorder examination, we met with Tatyana Anodina, chairperson of the IAC. To read about the meeting with Anodina, go to http://tass.ru/en/world/845400 and http://mak-iac.org/en/press/2015/114734/. For more info, videos, and photos, go to http://m.sputniknews.com/rus-sia/20151218/1031938653/russia-su24-black-boxes.html.

PRESIDENT’S VIEWISASI Serves on International Observer’s Panel

On Nov. 24, 2015, an AIM-9 Side-winder missile fired by a Turkish F-16 fighter jet struck a Russian SU-24M fighter bomber conduct-

ing an air-to-ground mission against rebel forces; it crashed on Syrian soil. Both pi-lots ejected. One was killed, and the other was rescued. The shoot-down sparked a diplomatic controversy between Russia and Turkey. Turkey claimed the Russian jet penetrated Turkish airspace; Russia contended the aircraft never left Syrian airspace.

The aircraft’s flight data recorder was recovered and transported to Moscow for evaluation, in hopes that it would reveal the precise geographical location of the aircraft when it was hit by the missile. Russian President Vladimir Putin ordered the Russian Defense minister not to open

the recorder until an international team of experts had been convened to observe the process.

On December 12, I received a request from Alexander Neradko, director of the Federal Air Transport Agency (FATA) of Russia, the equivalent of our FAA, to send ISASI experts to observe the opening and subsequent readout of the recorder to confirm that the readout was accomplished by using internationally recognized processes for commercial aircraft accident investigations—and to verify that the opening and readout were conducted with complete transparency and objectivity.

Other international representatives in-vited to observe the process included Lu Chanvei, chief engineer of the Scientific Research Institute of the People’s Liber-

ation Army of China; Gillespie Jon-athan, advisor to the CEO of JSC Gates Aviation Ltd; and Kolyada Oleg Mykhay-lovych, chief of the Flight Security and Flight Tests Board of the Open Joint Stock Compa-ny (OJSC) Mil Moscow Hel-icopter Plant in the Russian Federation.

Ron Schleede and I represented ISASI. We departed for Moscow on December 16. The record-er opening and readout

By Frank Del Gandio, President

Ron Schleede, left, and President Frank Del Gandio, center, observe the flight data recorder being removed from its case.

The flight data recorder is examined by laboratory technicians.


Pick your favorite term: unmanned aerial systems (UAS), unmanned aerial vehicles (UAVs), remotely piloted aircraft (RPA), or sim-

ply drones. All these terms identify an industry that is still in its infancy, but the baby is growing rapidly. Depending on whose estimate we choose, up to a million UAVs were sold in the United States in 2015, and sales approached 1.5 million worldwide. That may double in 2016. As the industry matures, it promises to be a disruptive technology but also one that produces significant net safety benefits in aviation and elsewhere.

Take the disruptive elements first. Most UAS products sold today are essentially flying toys, but that likely will change. Most of the recent public attention has focused on the toy portion of the UAS market and so, too, has much of the current concern about public safety. A combination of pure ignorance and con-scious irresponsibility has led too many new owners to operate their aircraft-toys in sensitive airspace. That risk will endure as this market niche continues to boom at least for a while beyond most observ-ers’ wildest expectations.

Regardless of how humble some of these toys may be, we need to add only some light equipment for photography and data transmission, then stick a cell phone in our pocket or leave our laptop running at home, and suddenly we have at least a much more interesting toy. The same more interesting toy also suddenly becomes a tool for certain business and commercial applications. If we upgrade the UAV or the camera, or add various kinds of sensors and other tools for data collection or for remote navigation, we suddenly have serious tools that a broad range of industries can use in business or in commercial applications.

As with most infant industries, we cannot yet anticipate all the possible applications of the technology or just how ubiquitous the industry’s products and services may become. However, the UAS industry has the capacity to be a profoundly disruptive technology. It likely will create entirely new activities and ex-pand some current commercial activities in ways we could not have imagined just a few years ago. It also is likely to become a classic “substitutive technology” that displaces or substitutes for some existing

technologies, including some aviation sectors.

Disruptive technologies typically have generated huge net increases in employ-ment, but not without some damage to existing employment opportunities. The birth of the automobile more than a cen-tury ago is the classic example. Learned folks of that era regularly expressed concern about how the automobile would devastate a major source of employment in carriage and wagon building, saddle making, whip manufacturing, black-smiths, stables, etc. The automobile in fact did devastate those fields, but it also became the world’s largest employer, by far, as early as 1920—by which time it had already provided 50 times as many jobs as it had displaced. UAVs may not produce new jobs on a scale to rival the impact that the auto industry had on economic structures in the 20th century, but it likely will increase total employment by a fair amount. For starters, consider new jobs in aerospace design and engineering, manufacturing, and operations. Perhaps the biggest new gold mine will be in processing the tsunami of new data that UAVs will generate.

Business applications already have be-come rather varied, but, thus far, they are dominated by surveys and observation in agriculture and film making, plus pho-tography, real estate or property surveys, and sales. Other uses already include some surveys to support mineral explora-tion, the inspection of wind turbines, and multiple other uses. These early applica-tions tell us that many functions tradi-tionally performed by light aircraft are prime candidates for this new substitute technology.

The current flight activities most at risk include agricultural applications, pest control, pipeline surveillance, traffic observation, some search-and-rescue functions, monitoring or fighting forest fires, photography and film, inspection of powerlines, wildlife surveys, herding or mustering, mineral exploration, etc. As civil UAVs become more capable of com-bining durability with heavy payloads, such as pesticides, water, or chemicals for firefighting, etc., with precision flight at reasonable capital costs, UAVs likely will start to penetrate cargo operations in small aircraft, particularly in remote regions such as Alaska, the Yukon, the Northwest Territories, and Nunavut.

In sum, this new technology that is still in its infancy will include applications that we do not yet foresee but plenty of applications that already are under way or soon will be. UAVs will generate new economic activity and will become the preferred means for accomplishing multiple tasks that already are common in the economy. In the process, UAVs may eventually generate lots of new employ-ment but will simultaneously replace whole sectors of long-established aviation activities and put the economic interests of several classes of pilots, mechanics, and perhaps some aircraft manufacturers at risk.

All this volatility and transition has real implications for aviation safety, some negative but in fact mostly positive. A fair amount of literature already exists on the new risks that may be imposed on avia-tion and the public. Within the aviation safety community, most of the attention has focused on the risks of mid-air col-lisions with manned aircraft, the risk to

COMMENTARYUNMANNED AERIAL SYSTEMS WILL REDUCE FATALITIES BUT

WILL DISRUPT AVIATION IN THE PROCESS

By Dr. Robert Matthews, Ph.D., Independent Consultant


property or to people on the ground, and methods of investigating accidents and incidents. Those risks are real, and they are certainly greater than zero. Yet UAVs also have the potential to improve avia-tion safety overall and to improve worker safety throughout the economy.

Yet beyond generalized observations, UAV advocates have dedicated little effort to quantifying the potential safety benefits that UAS may offer. Reductions in fatalities and serious injuries are unlikely to appear dramatic when placed within the context of total aviation fatalities; but the reductions will be significant even at that level, and they may well be dramatic in certain sectors of aviation.

Agricultural application, firefighting, and other aviation flight activities that were noted above as most vulnerable to displacement also will be the source of significant reductions in aviation fatal-ities and injuries. Those flight regimes typically require low-level flight at low speeds and often include abrupt maneu-vers. Aviation safety professionals do not like to hear “low” and “slow” in the same sentence. Add the possibility of abrupt maneuvers and possible inflight distrac-tions, and we begin to understand why these flight regimes have high accident rates. Over the past 10 years, by my count, the flight activities that are most ripe for displacement have produced 283 fatali-ties in the U.S. and 70 in Canada, or about 35 fatalities per year in total in the two countries, plus about 30 serious injuries.

Those 35 annual fatalities represent the maximum possible “saves” among the more obvious flight activities. That maximum may never be achieved in

full because UAVs are unlikely ever to completely displace all of the associated aviation activity. However, if UAVs eventu-ally displace at least a significant portion of such flights, and they likely will, the number of saves will be significant. If UAVs eventually begin to substitute for small aircraft that currently deliver cargo to remote areas with little to no infra-structure, the number of saves will only increase, especially in those remote areas that also have harsh climates and moun-tainous terrain, such as Alaska and much of northernmost Canada.

Still more safety benefits should be realized in other industries as UAVs begin to perform more dangerous tasks in con-fined spaces and begin to replace more and more people on ladders performing dangerous tasks. UAVs already are being used to inspect wind turbines, the con-fined interiors of mines, ships’ hulls, and who knows what else. The safety gains in such industries likely will exceed gains achieved in aviation, but we will leave the quantification of those potential savings to professionals in workplace safety. At a minimum, to complete the reference to economic changes brought by the automobile, UAVs will produce improved safety in aviation and other industries without the automobile’s environmen-tal costs or the 1.25 million road deaths reported each year around the world.

Nevertheless, to the degree that UAVs displace agricultural flying, observation flights, surveillance flights, etc., em-ployment prospects for some segments of pilots and aircraft mechanics will disappear. That, in turn, can further re-duce entry-level employment in aviation

and ultimately may further aggravate the airline industry’s ability to find new pilots and mechanics with at least some experience. At some point, the disruption brought by UAVs could also weaken demand for new agricultural aircraft, which has been one of the few market niches in which some manufacturers of general aviation

aircraft have been consistently profitable. The option, of course, is for those manu-facturers to adjust to any changes in the market.

The bottom line for UAVs seems fairly clear. The risk will remain of amateurs operating recreational UAVs in airspace where they simply do not belong. UAVs also could further disrupt the already struggling pipeline for pilots and mechan-ics. However, as the technology displaces some high-risk flight regimes, a meaning-ful number of aviation fatalities will be eliminated. Even if UAVs do not replace all such flying, the U.S. and Canada alone could soon see a reduction of 20 to 30 fatalities per year, along with a compara-ble number of serious injuries, and those numbers will increase if UAVs penetrate existing cargo markets served by small aircraft. The prospects for reducing workplace fatalities may be even greater in other industries. In short, on balance, UAVs offer good news for overall safety and for aviation safety, albeit not without some disruption and pain for some sectors of aviation.

Dr. Robert Matthews began working at the FAA in 1989 but is now retired from the agency. Up until his retirement, he was the senior safety analyst in the Office of Accident Investigation. His previous professional experience includes nine years in

national transportation legislation with the U.S. Department of Transportation, two years as a consultant with the Organization of Economic Cooperation and Development in Paris, and several years as an aviation analyst for the Office of the Secretary at the U.S. Department of Transportation. His academic credentials in-clude a Ph.D. in political economy from Virginia Tech’s Center for Public Administration and Policy Analysis, and he was an adjunct assistant professor at the University of Maryland from 1987 through 2002. He is currently an independ-ent consultant providing analysis of airline and general aviation accidents and accident trends.


On the morning of Jan. 7, 2013, at about 10:21 a.m. local time, a Japan Airlines (JAL) Boeing 787-8 experienced an auxiliary power

unit (APU) battery failure while parked at a gate at Logan International Airport in Boston, Massachusetts. The event result-ed in smoke emanating from the lower fuselage. Upon inspection of the APU battery in the aft electronic equipment bay, minor damage to the surrounding airplane structure was also observed, yet none of the adjacent electronic systems were compromised. No passengers or crewmembers were aboard the airplane at the time, and none of the maintenance or cleaning personnel aboard the airplane were injured. One responding firefighter experienced a minor injury.

The National Transportation Safety Board (NTSB) sent a senior systems staff engineer to Boston to document

the event. As the airplane was not being readied for flight, the event did not fit the NTSB’s investigation criteria so the event was not initially classified as an accident or an incident. The NTSB initially deemed the event as a Special Attention (SA) event. This is a category used by the NTSB to scope out potential events of interest without having to open a formal inves-tigation. The NTSB invited Boeing, the Federal Aviation Administration (FAA), the Bureau d’Enquêtes et d’Analyses pour la sécurité e l’aviation civile (BEA), JAL and Thales to participate in their SA documentation. All parties, including a Boeing air safety investigator (ASI) and several technical staff members, traveled to Boston, and the fact gathering and documentation began on Jan. 8, 2013, and continued through January 10, as shown in Figure 1.

The B-787-8 has two large-format lithi-

Lori Anglin was named an airplane accident investigator in air safety investigation, part of Boeing Commercial Airplanes engineering, in June 2006. In this role, Lori represents The Boeing Company to government investigative authorities

around the world. During an accident investiga-tion, she serves as the single point of contact for Boeing and leads the Boeing support team on site. Most recently, she served as a field service representative for Boeing Commercial Airplanes Commercial Aviation Services, providing onsite support to airlines at their location, including airplane troubleshooting, training, spare parts, and engineering support, with assignments in Atlanta, Georgia; Buenos Aires, Argentina; Raleigh, North Carolina; Mexico City, Mexico; Sao Paulo, Brazil; and Dallas, Texas. Previously, Lori, as a Boeing liaison engineer, designed re-pairs and addressed issues during the preflight, test flight, and delivery phases for Boeing 747 and 767 airplanes. She holds a degree in me-chanical engineering from the Georgia Institute of Technology.

Dr. John R. (Jay) Lowell is a technical fellow in Boeing Research & Technology (BR&T). In this role, he has led efforts to improve the aircraft electromagnetic effects protection systems on Boeing commercial airplanes. He supported the B-787 battery incident

response as a member of the root cause cor-rective action effort and assisted the air safety investigation team as a technical interface with the NTSB. Finally, during his time with BR&T, he championed the incorporation and development of several new technologies within the Boeing enterprise. Jay has a Ph.D. in atomic physics from the University of Virginia and degrees from The Ohio State University and the United States Air Force Academy. His technical background focuses on electromagnetic and electro-optic effects and includes work in remote sensing, precision measurements of time and frequency, inertial measurements, laser/matter inter-actions, photonics, optical signal processing, medical diagnostic development, and software development.

B-787 Lithium Battery IncidentsCOMPLEX INVESTIGATIONS, BOEING’S ROLETwo Boeing 787-8 lithium-ion battery failures only nine days apart grounded the fleet. Boeing’s response was swift in designing plans to assist in the investigation, and establishing three teams to conquer the tasks at hand.

By Lori Anglin, Airplane Accident Investigator, Air Safety Investigation, Boeing Commercial Airplanes, and John R. Lowell, Technical Fellow, Boeing Research and Technology

(Adapted with permission from the authors’ technical paper entitled 787 Lithium Battery Incidents: Boeing Activities to Support Multiple Complex Investigations presented at ISASI 2015 held in Augsburg, Germany, Aug. 24-27, 2015, which carried the theme “Independence Does Not Mean Isolation.” The full presentation, including charts and cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2015 Technical Papers.” —Editor)

Figure 1. Time line of B-787-8 battery events and early investigation response. All times and dates are UTC.


um-ion batteries installed on the airplane: the main battery and the APU battery. Both batteries are identical but perform different functions. The main battery provides power during ground mainte-nance operations when no other sources are available (e.g., power up, refueling, braking, and navigation lights during tow-ing) and provides backup electrical power while airborne. The APU battery provides power to start and operate the APU. The APU may be used on the ground or in flight to generate electrical power.

Nine days after the Boston event, on the morning of January 16 at 8:27 a.m. local time (or 11:27 p.m. UTC on January 15) an All Nippon Airways (ANA) B-787-8 experienced a main battery failure in flight. The crew made a decision to divert to Takamatsu Airport and, after consult-ing with the tower, elected to evacuate the airplane after stopping on a taxiway. There was no airplane structural damage or compromised systems in this event; however, four occupants received minor injuries during the evacuation from the airplane. The Japan Transport Safety Board (JTSB) quickly opened an Interna-tional Civil Aviation Organization (ICAO) Annex 13 investigation and sent person-nel to the site. Promptly after learning of this event, a Boeing ASI and a battery engineer traveled to Japan to support the JTSB investigation, as did the NTSB and the FAA, arriving on the morning of Jan-uary 18 local time. At this time, the NTSB also decided to conduct an ICAO Annex 13 investigation of the Boston event.

On Jan. 16, 2013, the same day as the

Takamatsu event, the FAA issued Emer-gency Airworthiness Directive (AD) 2013-02-51, applicable to all Boeing U.S. (or N-registered) model 787-8 airplanes. This AD required a modification of the battery system approved by the Seattle Aircraft Certification Office prior to further flight. Other international regulatory bodies likewise issued their own ADs, thereby effectively grounding all 50 B-787s in service. Regulatory action also prevented any further deliveries of new airplanes.

Boeing organization of responseEven before the issuance of the AD, Boe-ing had gathered executive management, technical experts, and project engineers in daily teleconferences to review facts and establish the next steps. Once the AD was issued, a kick-off meeting was held on January 19 to organize an expanded response. At that point, battery experts from all Boeing divisions (who were not already at the NTSB or on scene with the JTSB) traveled to Everett, Washington, for the kick-off meeting. The response charter was twofold: to support the NTSB and JTSB investigations and to create a solution to get the B-787 back in the air.

After much consideration, it was decided that three technical teams were needed to conquer the tasks at hand:

• Team 1—Return to Flight. This team was chartered to focus on the logistics needed to support the fleet that was on the ground throughout the world. It worked with suppliers to ensure that the design changes could be implemented on the fleet to return

them to flight as quickly as possible.

• Team 2—Root Cause and Corrective Action (RCCA). This team was char-tered to support both the NTSB and the JTSB investigations using a formal RCCA process, as well as provide rec-ommendations for corrective actions to prevent future battery failures.

• Team 3—Alternative Design Actions. This team was chartered to design and implement the corrective action recommendations from Team 2 and produce a resulting set of design changes along with supporting mate-rial needed to address the FAA AD.

Talent was drawn from across the en-tire Boeing enterprise. A clear demarca-tion of team responsibilities helped keep the teams focused and allowed for the development of a comprehensive set of solutions in a very short timeframe. Clear team charters also ensured effective lines of communication to the FAA, the JTSB, and the NTSB. The teams were loosely organized as shown in Figure 2.

In order to effectively coordinate and communicate the activities of the RCCA team with the external investigations, it was clear that more than the two ASI rep-resentatives colocated with the NTSB and the JTSB investigations would be needed. The size of the RCCA team quickly grew to several hundred experts; so four addi-tional ASIs relocated to the same building as the RCCA team to maximize commu-nication throughout the response and en-sure seven-day-a-week coverage. As seen in Figure 1, NTSB and JTSB activities were being held in Japan and Washington, D.C., as well as at vendor locations in Phoenix, Arizona, and France. A rotation schedule was developed to ensure support to all of these activities; for the first few months of the investigations, there was at least one Boeing ASI representative in Washington, D.C., supporting the NTSB and at least one Boeing ASI representative in Japan supporting the JTSB, except for a few days where travel schedule changes interfered.

With so much activity spread across the world, communication among parties was vitally important to keep everyone up to date. For instance, several NTSB staff members traveled to Seattle, Washington, to participate in RCCA team activities.

Figure 2. Organization of Boeing response.


team. Figure 3 shows a high-level depic-tion of this process.

1. Use of cause and effect diagram—The first of these tools centrally used by the team was a detailed cause and effect (C&E) diagram. A C&E diagram (some-times called a 5-Why diagram) is a branch diagram that proceeds from the observed effect to a set of high-level causes, each of which is presumed to be the effect of an underlying cause. By continuing this process down through multiple levels, finer and finer levels of detail are exposed until the lowest-level (i.e., root) cause is uncovered. The final diagram shows how lowest-level causes result in effects, which, in turn or in combination with other factors, cause further effects that eventually result in the airplane-level observed behavior.

Although an existing failure modes and effects analysis (FMEA) existed for the battery system, it was decided by the team to perform a new, independent analysis for this activity and then consult the existing analysis after the team felt it had neared completion. The rationale for this approach was that it was more likely that the team would uncover new potential failure modes if it did not start its work with a list of investigated faults. Additionally, any modes missed dur-ing the brainstorming session could be readily added by consulting the existing analysis.

During an initial brainstorming session, the team developed a number of high-lev-el possible causes for the events and then proceeded to examine the causes for each of those possibilities. This resulted in a

returned to service. The remainder of this section describes

the general root cause investigation pro-cess utilized by the RCCA team.

A. Problem identification—The first step in any root cause and corrective action process is to clearly identify the problem that is trying to be addressed. An early decision was made by the RCCA team to treat the two events as if they could have been the result of a common root cause, and then verify this hypothe-sis during the course of the investigation. This allowed for centralized management of the root cause investigative process and efficient use of limited resources (such as technical experts within the company), but also required extra dili-gence during analysis of potential root causes.

B. Causal analysis—Analysis of potential root causes proceeded in several stages throughout the investigation, but a common element of all stages was the disciplined use of a number of tools to help keep track of the full range of possible causes, clarify the state of understanding for each potential cause, and help assess what actions were needed by the

As the investigation progressed, NTSB staff members would rotate in and out of Seattle but maintained a presence throughout the effort; the NTSB also had staff members in Japan to support the JTSB investigation directly. ASI repre-sentatives participated in multiple RCCA team technical meetings each day so that any investigation-related information was rapidly assimilated. Daily phone calls were held with the NTSB and the JTSB home office staff to update them with any new investigation-related information, determine any needed actions, and follow up on those actions assigned earlier.

Root cause and corrective actionsIn the assembly of the company response to the events, it became clear that the RCCA team would need to coordinate closely with the ongoing investigations by the NTSB and the JTSB. However, the RCCA team also had a responsibility to provide corrective action recommenda-tions and assist with producing test data needed to address the FAA AD. Thus, the RCCA team effort formed a technical hub that aligned Boeing activities with the external investigation efforts.

The RCCA team started out as a mod-erately sized collection (about 50 people) drawn from throughout The Boeing Company with a variety of engineering backgrounds. Over the course of the next several months, the team grew to several hundred people distributed among the multiple sub-teams shown in Figure 2, page 7, and subsequently drew down to a single, small team as the B-787 was

Figure 3. Root cause and corrective action process overview.

Figure 4. Notional cause and effect diagram.


tables containing fields that enabled reconstruction of the thought process that went into TRB decisions. Using this approach, the RCCA team was able to expand and contract rapidly to accom-modate the required workload. As stated previously, at its peak, the RCCA team totaled more than 500 people. This pro-cess also enabled organized tracking of all activities in light of their contribution to the overall understanding of probable root cause. By having the TRB responsible for work assignments and disposition of completed assignments, quality control and centralized record keeping were able to be exercised throughout the effort. In fact, the number of items in the possible root cause category was tracked through-out the RCCA team activity to ensure that the efforts of the team drove it to smaller and smaller numbers.

D. Evaluate potential corrective action—After work assignments were completed, the results were briefed back

out with an evaluation of “possible root cause” (see Table 1). The team, during the TRB meetings, would reach consensus on work assignments that could fill in the need-to-know facts regarding that element—usually in the form of desired tests or analyses. In some cases, simple reference searches were able to fill in unknowns—that is, they were known to some, but not to those on the team. Work assignments were then managed by a number of sub-teams—mechanical, electrical, etc.—until they were ready for further review by the TRB. Due to the limited number of test facilities and batteries available for testing, all tests were managed through a test sub-team. This ensured that all tests were prior-itized against available resources and the increase in knowledge associated with the test. A detailed depiction of this part of the RCCA process is shown in Figure 5; a high-level view is shown in Figure 3.

The C&E diagram records included

complicated C&E diagram, as many items on the chart could alternately be initial causes or effects of other causal events. Over the course of the investigation, the team developed and repeatedly modified an extensive C&E diagram that detailed more than 200 potential causal factors for the battery failures. Careful configuration control was exercised to ensure that all activity was captured and updated over the course of the investigation and held within the diagram. Figure 4 shows a notional version of the C&E diagram used by the team, which was printed as a large poster on the wall of the room in which daily RCCA team technical meetings occurred. Both the scale of activity and the complexity of the potential causes are immediately apparent in the structure of the diagram.

2. Assess factual knowledge regard-ing C&E diagram elements—Having laid out potential causes and effects into an organized C&E diagram, the team worked through each item in the diagram to assess what was known and what needed to be known about each element. This extensive task served several purpos-es: first, it ensured that the organization of the C&E diagram was accurate and self-consistent with the current state of knowledge; second, the “need-to-know” list was used as a starting point for work assignments; and finally, the activity ensured that incoming information could be rapidly sifted and applied to the right concept or set of concepts. This process is depicted in the third process lane of Figure 3.

C. Evaluate potential relevance—A dedicated technical review board (TRB) was formed, which convened daily to re-view factual assessments of C&E diagram elements and coordinate other activities of the RCCA team. The TRB was com-prised of a core set of RCCA team mem-bers, managers, and technical experts; members of the NTSB, the JTSB, and the FAA were invited and often attended these meetings. In particular, the TRB also oversaw evaluations of the potential relevance of a causal element on the C&E diagram. Chart elements were evaluated as being in one of the following categories and were shown by color coding C&E diagram elements.

From a process perspective, every causal element on the diagram started

Table 1

Category Description

Eliminated/Improbable Element not given further consideration as a root cause for the incidents under investigation. [Terminal categorization]

Undesirable Condition Elements in this category were not root causes but potential contributory conditions that could alter the probability of a cause or set of causes.[Terminal categorization]

Possible Root Cause Elements in this category were still under consideration, awaiting disposition into either probable or improbable category. [This transitive categorization was reassessed until a determination could be made to place it elsewhere]

Probable Root Cause Elements in this category were the set of most likely root causes. [Terminal categorization]

Figure 5. Process for evaluation of potential relevance of an identified casual element. Items in gray included NTSB or JTSB participation or observations, typically during technical review board meetings.


event sequences that were consistent with the entire corpus of data availa-ble. Each event sequence started with a probable root cause and then described a chain of events (including reference to the supporting forensic and test evidence) that would result in one (or both) of the incident events. These sequences greatly streamlined the explanation of the inci-dent events and made them accessible to a wider audience. The developed event sequences were reviewed by the TRB, and presented to both the NTSB and the JTSB for consideration.

Additional investigation support• NTSB hearing and battery forum

support—While the RCCA work described above was in progress, and concurrent with the release of the interim report on March 7, the NTSB announced it would hold a public investigative hearing covering the battery investigation and a forum entitled “Lithium Ion Batteries in Transportation,” both in April 2013. As party to the NTSB Investigation, Boeing was required to participate in the hearing; Boeing representatives attended the forum. Although both public hearings and transportation safety forums are within the NTSB’s operating charter, they are not nor-mally held so close together. These activities required additional support and coordination with the JTSB inves-tigation and Team 3 activities.

• Continued fact-finding support—After the NTSB public investigative hearing concluded, both the NTSB and the JTSB investigations devel-oped a series of tests to refine their assessments of root cause; these tests occurred throughout the latter part of 2013 and through the spring of 2014. Note that on April 19, 2013, the FAA certified a new battery design and installation for the B-787. After this time, all B-787 aircraft were either retrofitted with this new design or were delivered with the new design in place. Thus, the NTSB and JTSB tests conducted during this period were performed on batteries that were no longer in service. In some cases, these tests were refinements of test activities performed by the

was determined, that information was communicated back to those investiga-tions. In all, the Team 3 engineering work served as an input for the subsequent re-certification effort for the battery system. This process is shown in Figure 6, and an overview is shown in Figure 3, page 8.

E. Event sequence development and communication—While the causal analysis was going on as described above, a small group of experts were closely involved with the detailed NTSB and JTSB forensic investigation efforts, which focused on trying to reconstruct the sequence of events that occurred during each incident. While each agency employs a different investigative pro-cess, both attempt to determine root cause through temporally structuring a sequence of events based on analysis of forensic evidence. This required sepa-rately placing technical staff members (and ASI investigators) on site with each investigative agency’s designated analysis laboratory, in Washington, D.C., for the NTSB and in Japan for the JTSB. These people, along with Boeing’s ASI team, worked directly with those organizations and facilitated communication and coor-dination with activities ongoing at Boeing facilities.

As described above, the Boeing RCCA process considers all possible causes and eliminates those that are improbable given the available data, with the idea being that the probable cause will survive and the process will ensure that nothing is overlooked. This process, however, does not necessarily produce a temporal forensic sequence of events similar to what the NTSB and the JTSB investiga-tions are trying to produce. Therefore, after the C&E diagram came into suffi-cient focus, the team produced a set of

to the TRB; often this occurred many days after the work assignment was made. For items that had not been eliminated as improbable, an assessment was made regarding the potential need to make a corrective action to address that particu-lar cause. Corrective action changes were considered desired if the pool of available data indicated a clear method either to reduce the likelihood of the particular cause occurring or to mitigate the effect or chain of effects that would result from that particular cause. The C&E diagram enabled the team to focus on recom-mended actions that addressed contrib-uting elements to multiple pathways, or mitigating the effects of numerous root causes, thereby making substantial improvements in the overall safety of the battery system despite having not arrived at a single root cause at the time. These determinations fell into three categories (see Table 2).

If an item was determined to have a de-sired change, a description of the element under consideration and the desired change was given to Team 3 (design alter-natives) for their evaluation. Members of that team would determine alternative approaches consistent with the desired change, develop an alternate design, and perform engineering analysis and testing to validate their design. Due to limited availability of test resources, Team 3 tests were coordinated through the RCCA test team; however, their tests used a combi-nation of RCCA test team members and embedded members of Team 3 to ensure the tests were able to validate the needed elements of the alternative design. Team 3 tests were reviewed at a later time to determine if data relevant to the NTSB or the JTSB investigations were pro-duced during the course of testing. If this

Table 2

Change Descriptor Description

Not Desired Available data not indicative of clear potential change that addresses the cause under consideration.

Change Desired Available data indicate clear potential for change(s) that result in either (a) a reduced likelihood that the cause under consid-eration could occur or (b) a reduction in the severity of the ef-fect(s) that would result from the element under consideration should it occur. Items in this category were communicated to Team 3 for assessment of design alternatives.

Change Implemented A desired change that resulted in an alternative design and subsequent recertification activity was deemed implemented.


were able to collect comments and rec-ommendations from non-U.S. parties and forward them back to the NTSB (typical for all Annex 13 investigations). As a rule, the NTSB does not provide this opportu-nity to U.S. parties of their investigations, a marked difference from the typical ICAO Annex 13 investigation process. After receiving this feedback from the other ICAO organizations, the NTSB staff forwarded the draft report to the safety board members, who approved the final report for publication on Nov. 21, 2014.

ConclusionsThe RCCA process worked alongside the NTSB and the JTSB investigations and required constant communication among all parties. However, from a process perspective, the net result of the RCCA process was a set of recommendations that served as the basis for subsequent battery improvements. Those design and manufacturing changes have been implemented in all in-service B-787 airplanes and prevent possible air-plane-level safety effects and ensure safe flight and landing in the event of any main or APU battery venting event.

approximately 20 documents contain-ing more than 1,700 pages of content. Additionally, a proprietary information review of the same set of documents was conducted with a goal of limiting the release of proprietary information in the NTSB factual reports. The net output of these two reviews was a final set of NTSB factual reports agreed upon by all parties to the investigation that were released to the investigation docket.

The NTSB factual reports then served as the foundation for each party to pro-duce a submission report to the inves-tigation, should they choose to do so. The submission report summarizes each party’s analysis and interpretation of the collected and agreed-upon facts, their findings of probable root cause, and any proposed safety recommendations. Again, Boeing RCCA and ASIs worked together to write this document. In most cases, the parties have 30 days to produce their submission from the time the factual review is completed; however, in this investigation, the extended factual and proprietary reviews overlapped with a substantial portion of that period of time and made accurate citation of source material difficult.

The NTSB staff used the factual reports in the public docket to produce a draft final report. U.S. participants such as Boeing were not able to participate in the analysis or writing of this report; however, the draft report was shared with non-U.S. participants in the investigation who

Boeing RCCA team. In other cases, tests were devised to probe alternate hypotheses regarding the root cause of the battery events. The resulting se-ries of tests and meetings took place at multiple locations in the United States, Asia, and Europe. For each test or meeting, a Boeing RCCA team representative and an ASI worked with the NTSB and the JTSB investi-gation teams to devise and refine test purpose, procedures, and instrumen-tation; participated or observed test activities; and went over post-test analysis.

• Investigation close-out activities—The NTSB and the JTSB had very different close-out processes that required different levels of input, attention, and coordination from Boeing. The JTSB process is a typical ICAO Annex 13 process in which the JTSB produces a draft investigation report documenting the findings and recommendations based on material collected throughout the investiga-tion. In this case, the RCCA team had produced a number of presentations and report summaries that had been shared with the NTSB and the JTSB throughout the investigation. After the JTSB produced its draft report, participants were requested to pro-vide comments on the draft report per typical Annex 13 procedures. Again, Boeing RCCA team members and Boeing ASIs worked together to produce a single set of comments that were returned via the NTSB to the JTSB for its consideration prior to publication of the final investigation-report on Sept. 25, 2014.

The NTSB investigation close-out process is substantially more involved. The NTSB first conducts a factual review of all documents produced during the course of the investigation. During this review, all parties are requested to verify the factual accuracy of and identify any factual inconsistencies in the produced documents; based on that input, they should also suggest revisions that are more representative of agreed-upon facts. For this investigation, that review took place during two separate in-person meetings at the NTSB and considered Figure 6. Process for evaluating potential corrective actions and developing alternative designs.


An accident occurred to a police EC135 helicopter G-SPAO on Nov. 29, 2013, in the center of a major city within the UK, result-

ing in a significant loss of life. The investi-gation was carried out under intense pub-lic and police interest and very significant political attention. This adapted article offers thought and hopefully encourages debate regarding the close working rela-tionships among investigators, manufac-turers, and operators to understand the events leading to an accident. It ex-plores the idea that a very close working relationship may threaten investigative independence and impartiality. It uses the G-SPAO accident (see Figure 1) to set the context and background by which to discuss the topic.

InteractionThis investigation required investigators to choreograph and carry out a complex set of tasks, tests, and research using the manufacturer’s and operator’s expertise, resources, and facilities. For this and any investigation to be credible and withstand scrutiny, it has to establish the facts as far as possible beyond doubt. With modern complex aircraft systems, structures, and materials, this can only be done with the help of manufacturers and access to their intellectual property.

This means investigators have to spend a great deal of time working very closely with the manufacturer, often within areas of high commercial sensitivity. At the same time, the investigator is exposed subliminally to the ethos of an organiza-tion and the stress it is under from the aircraft operators, public, and the news media to get results. These factors could be seen as a threat to the impartiality and independence of the investigator.

The riskA number of years ago, a bank robbery was taking place that started to go badly wrong for the perpetrators. It ended up as a hostage situation, a very unsavory

situation for all concerned. However, this incident would have drifted into history had it not been for a very interesting rela-tionship that developed between the hos-tages and their captors. The relationship manifested itself as a form of bonding and empathy between the hostages and their captors to the extent that they saw things from the captors’ point of view, even defending them after they were released. This event became the subject of a num-ber of psychological studies and became known as the Stockholm Syndrome. How then does this relate to accident investigation?

As far as the human liberty and free-dom aspect of the case is concerned, it doesn’t; however, if human psychology is considered, it might—especially consid-ering the bonding and empathy idea. To explain further, the days of the lone air accident investigator working unaided to understand all the aspects of an accident are gone, even if they ever existed in the first place. The vast majority of significant accident investigations involve teams and multiple agencies, governments, and cor-porations and are dealing with modern and highly complex aircraft and multi- layer systems. Investigators cannot prop-erly investigate on his or her own; they are duty bound to carry out a thorough investigation and look at every aspect in detail. In order to do this, they have to work very closely with manufacturers and operators. The investigator also has to remain impartial and independent throughout.

The case in pointWork has just been completed on the technical aspects of the G-SPAO acci-dent. Very sadly, this accident resulted in 10 fatalities, including the three crew-members. I do not propose to go into the details and findings of the accident; suffice to say there was a mix of human factors and technical aspects. It immedi-ately became a very high profile accident

Beware the Threat to Independence and ImpartialityThe author offers thought and encourages debate regarding the close working relationships among investigators, manufacturers, and operators to understand the events leading to an accident.

By Robert Vickery, CEng MIET, UK Air Accidents Investigations Branch Senior Inspector (Engineering)

(Adapted with permission from the au-thor’s technical paper entitled The Threat to Independence and Impartiality When Using Manufacturer’s Resources and Expertise presented at ISASI 2015 held in Augsburg, Germany, Aug. 24–27, 2015, which carried the theme “Independence Does Not Mean Isolation.” The full presentation, including charts and cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2015 Technical Papers.”—Editor)

Figure 1. G-SPAO accident site.


in that it was an aircraft operated by an instrument of state, Police Scotland, that crashed, causing bystander fatalities dur-ing a period of highly significant political debate and discussion regarding the very future of the UK.

It was understandable that an accident as serious as this caused all concerned to want “answers,” and the resultant emotional atmosphere added enormous pressure to the investigation. The inves-tigation initially focused on both engines flaming out within less than one minute of each other and the disposition of the fuel within the aircraft leading to that sit-uation. It was clear that this was not go-ing to be a simple investigation and would require the immediate involvement of the aircraft and engine manufacturers—in this case, Turbomeca and Airbus Helicop-ters (Deutschland). Representatives of those two companies were nominated as advisors to the German Federal Bureau of Aircraft Accident Investigation (BFU) and the French Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (BEA) accredited representatives and joined the Air Accidents Investigation Branch (AAIB) team at the accident site a day after the accident—day one of what was to become a long and “intimate” relationship. It soon became very clear that the two Turbomeca Arrius engines were not causal to the accident and had

flamed out as a result of fuel starvation, so the focus turned very much toward all aspects of the helicopter fuel system.

Control?As an observation, and I think one that all investigators can relate to, at the accident site the state investigators have command and control and have various “tools” at their disposal by which that can be maintained. I think it is true to say that manufacturer and operator representa-tives understand this and, in my experi-ence, willingly comply with the authority gradient. As the investigation progresses, it will inevitably involve work at the man-ufacturer’s facility.

In this case, the lines of inquiry meant complex testing procedures were required that needed significant investment of time and resources, notwithstanding disruption to other product test programs. In fact, it ultimately required the construction of a fully functional EC135 fuel system mount-ed on an articulated platform (see Figure 2). Work of this magnitude will often involve other individuals from various company departments, not just the safety team. These people often have long careers within the organization, and unsurprising-ly they are highly loyal to the company and will therefore naturally be very protective of their product and its reputation. I must stress that is not a criticism!

At the same time, the public pressure on the investigator remained, but now, by osmosis, the commercial and reputation-al pressures felt by the manufacturer are also brought to bear. I would suggest that in similar situations all investigators have experienced this to some degree.

Psychological pressureWith this and many other accidents, subliminal psychological pressure on the investigator may also be present. To explain, all investigators have at some point in their work arrived at the man-ufacturer’s facility and been faced with buildings of various types, large and small. Often, but not always, the size of the building and its facade is in direct proportion to the company ethos and ego. The visitor, the investigator, should be impressed. Why? Because he or she is meant to be. On entry to the building, you are then faced with the foyer and reception, in which there is an air of calm authority and power. You are greeted by smart and often uniformed reception staff, male or female, who seem, again in my experience, to have been specially se-lected for that role because of their style, presentability, and people skills. Still im-pressed? You are meant to be! Although you perhaps don’t know it, you are being disarmed, and the authority gradient is subtly changing. You will also be given a piece of “uniform,” the security pass with the company logo that you exchanged for your passport!

You may not be aware, but the scene is now set for the next stage. You are led to a meeting room again set with the

Robert Vickery is an aircraft engi-neer who has been involved in a wide variety of maritime and land-based military aviation. In 2007, he was appointed as the

senior investigator within the Royal Navy Flight Safety and Accident Investigation Centre, and in 2011 he became the senior engineer of the newly formed tri-service Military Air Accident Investigation Branch. On completion of military service in 2013, he joined the UK AAIB as an engineering inspector.

Figure 2. AH(D) EC135 fuel system articulated test rig.


in some cases can never be recovered. So the stakes are high.

A fine line has now to be trodden: hin-der the investigator by noncooperation or time wasting and it will soon become apparent in the accident report; a simple line of fact, for example, words such as “the data were not made available to the investigation.” So the company is left with no option but assist the investigator with agreement in the common cause.

So here we are during an investigation and let us assume it is a complex inves-tigation, EC135 G-SPAO, one in which the answer does not immediately jump out. So there will be a number of lines of inquiry. Some will be simple and discount themselves very quickly; others will require multiple layers of work, frequent meetings, and hours spent in workshops and test facilities.

At each step, the manufacturer will have a view it will be able to back up with compelling evidence presented with the weight and gravitas of the corporate machine. Remember, the manufacturer, too, has safety in mind; but it is shared with the need to protect a hard-won reputation.

So what about the EC135 G-SPAO in-vestigation? I have to say that the cooper-ation from all the manufacturers and the operator has been exemplary throughout. Access to intellectual property and the investment in time and equipment have been extraordinary. At the AAIB’s request, Airbus Helicopters built a fully functional articulated EC135 fuel system test rig and then carried out hundreds of man hours in test and research (see Figures 3 and 4). At each stage, the investigation team was fully involved and was given open and free access to the relevant information. Gradually the many factors leading up to the accident were understood. Although not unknown in general, the test rig demonstrated a phenomenon that could produce, in some cases, the unexpected effect of erroneous readings from the EC135 fuel indication system. But the test rig work showed it could. The knowledge gained during this work will drive safety changes. But as far as the accident was concerned, it told us what was possible, but in this case not the cause.

Pressure and actionThe pressure on the investigators in this

agreement in a common cause and demonstrate they that can be relied upon and trusted. Trust often includes friendship; and when looked at that way, we can perhaps see a risk and threat to independence and impar-tiality.

If we look at the phrase “agreement in a common cause,” I think that in all cas-es the safety investigative bodies within manufactur-ers’ common

cause is to make their product safer and better, thus enhancing their reputation. However, in a world where blame and litigation are endemic, factions within a company outside the safety investigation sphere are looking to protect themselves from liability, punitive measures, and resultant reputational damage. The inves-tigator, when viewed with the company lawyer’s eye, is seen differently and often seen as a threat.

The credibility and reputation of the investigators as seen by those outside the company, e.g., the general public and news media, mean that their report usu-ally has weight and gravitas and therefore is seen as fact—hence a threat by compa-ny lawyers. If the report gives facts that show a company in a bad light or, even by reader deduction, at fault, it will not be long before third-party litigation starts or the news media launches attacks on the company reputation. Litigation, as we know, can come from a variety of quar-ters: victims, relatives, property owners, insurers, and so on. It will inevitably be costly in monetary terms. The cost in reputational terms can be far greater and

trappings of company power. You will be greeted and treated with respect, invited to have coffee and sit down where the company free pen and note pad or other “goodies,” perhaps, will be in front of you. This whole scenario is part of a world-wide standard procedure, subtle or not so subtle, applied by companies to obtain and keep customers. It is just that now it is automatically being applied to you, the investigator. Hostage and captor? Could be.

Inner sanctumsAs on many occasions in the past, in order to progress the investigation, access was required into the manufacturer’s intellectual property. This is an area that can be fraught with difficulty because intellectual property, in stark commercial terms, has value, and it is something that is, of course, very closely guarded by the owner. To smooth the path, there has to be a high degree of mutual trust between the investigator and manufacturer, and that trust has to be built. And as we know, some of the many ways in which trust can be built is for individuals to show an

Figure 3. Test rig top view.


in place, although they may not always be obvious. Many investigators know to “take things with a pinch of salt,” a little phrase that means they are naturally skeptical and question everything. Don’t worry about the cor-porate ego and little free gifts. It’s all part of the game that is applied to all visitors, so it could be seen as impolite to vehemently resist, just don’t worry. Never underestimate the experienced investigator’s sixth sense, that uneasy feeling that all is not what it seems, as a slick, all too-well-tuned presentation takes shape.

Then there’s the debate, the moment when an investigator returns and pre-sents the findings to peers and the de-bate finds the holes in the argument. That debate and discussion work, too, with the company and should be encouraged. It may be that differences are never resolved, but there can often be common ground.

To conclude, yes there is a risk to impartiality and independence when an investigator is closely working with a large cooperate machine over a long period of time. But, actually, modern investigative team working processes, discussion, debate, and the freedom to test ideas and theories elsewhere guard against this as they did with G-SPAO.

Why was this so? In part be-cause additional work was carried out using other resources, and the results from all aspects were tested, by peer debate, against each other (see Figure 5). These debates were also extended to the manufacturers and the other inves-tigative bodies. Needless to say, there were some very lively debates as opinions and

stances were presented, agreed, and/or countered throughout the whole process.

So true or false?True, there is a risk to impartiality and independence; it would be naive to think otherwise. It would be all too easy to be swept along in the company ethos as an investigator is exposed to the cooperate machine. Friendships develop along with agreement in the common cause, and gradually the investigator’s view becomes tarnished.

However, there are subtle protections

high-profile investigation had an inter-esting dynamic. Clearly the manufacturer was concerned about its products and systems, and by mutual agreement they were able to issue Information Notices and Service Bulletins. Additional political pressure was brought to bear during a historical and political debate with ques-tions posed at very high political levels. Needless to say, those questions had no influence on the conduct of the investiga-tion but, nevertheless, were an unneces-sary hindrance. Added to this, certainly in the early stages, was the intense and con-stant news media pressure. It would have been all too easy to suffer an erosion of the independence and impartiality of the investigation had these pressures been allowed to influence the process. It is true to say the investigation team resisted all these pressures very well, with no leaks to the press or adverse public statements.

In practiceOf course the company hospitality system was in place and running; of course the manufacturer had very well-founded and clear views and compelling theories that came across in its communications. Despite the close interaction, the inves-tigator independence was unaffected, and the evidence for this comes from an interesting corner. A comment was made at later stages of the investigation by the manufacturer, expressing surprise that there seemed to be a difference of opinion on some of the detail even though work was carried out very closely together.

Figure 4. Test rig detail.

Figure 5. EC135 additional fuel system testing.


We view ourselves as a family, and my management approach has always been hands-on, where every employee has ac-cess to me. I am responsible to them, and they are responsible to me. Consequently, I believe it’s my responsibility to share this information directly with the investiga-tors of the world, but also on behalf of my staff and team members to present them to you as credible people worthy of being considered as credible technical advisors in any international event. I am account-able to them and am doing this on their behalf. That said, some of them will also be addressing you during the tutorials you have organized here.

Third, I want to thank you for the op-portunity to appear as a presenter in this prestigious group of industry experts. I will say once again, I represent the entire AirAsia management team. I believe we did a good job under very challenging circumstances. Our team, individually and collectively, proved to be profession-al, competent, and credible providing technical expertise to the investigators.

Before I tell you about what we did

again. I wanted to come before this group and say thank you for the efforts of your profession, and also to tell you what we did in advance, and what we did during and after the accident, to address emerg-ing issues. Hopefully, our actions and mistakes will stand as lessons learned for our industry.

Second, I am not just the CEO of the AirAsia Group. I am the founder and one of the owners, so my heart is in this organization. AirAsia is a family—a family of airlines that operates like a self-con-tained alliance. The AirAsia Group con-sists of individual air operator certificates (AOCs), each with separate management teams. We support each other, and we share certain functions and programs. However, we remain as separate AOCs. Let me make clear that this accident in-volved Indonesia AirAsia. I have to do this because, unfortunately, this event was frequently misrepresented as a Malaysian event—it was not. It involved Indonesia AirAsia, but it affected us as a group, and we rose to the challenge as a group and as a family.

In the aftermath of Flight QZ8501, I was frequently described by the news media as “AirAsia’s brash CEO” or “flamboyant AirAsia boss” or the

“ebullient tycoon” Tony Fernandes. I can tell you that when you have to look a family member in the eye as they ask you about their loved one, or when I stood next to the family of my own crew as they bury their child in their own hometown, I didn’t feel like an ebullient tycoon or any of those labels. On Dec. 28, 2014, for Indonesia AirAsia, for me, and for the entire AirAsia family, the day we hoped would never happen did happen, and we suddenly found ourselves in the midst of an accident investigation while caring for the needs of the families of our passen-gers, colleagues, and our employees.

There are several reasons why I wanted to present this paper to ISASI. First, this terrible tragedy and everything that the AirAsia family has gone through certainly underscored to me that there are people, like you, who on a daily basis go to work to get to the bottom of these terrible trag-edies to prevent them from happening

A Family Affair: AirAsia Group In Light of Indonesia AirAsia Flight QZ8501

By Tony Fernandes, Group CEO and Founder of AirAsia Group

(Adapted with permission from the author’s remarks presented at ISASI 2015 held in Augsburg, Germany, Aug. 24–27, 2015, which carried the theme “Independence Does Not Mean Isolation.” The full presentation, including cited references to support the points made, can be found on the ISASI web-site at www.isasi.org under the tag “ISASI 2015 Technical Papers.”—Editor)


phone number to family members. But I have always been accessible to AirAsia staff and our guests, so in this case it wouldn’t have been out of character for me to do so. In addition, I used social media to communicate directly with the families. There were many questions I couldn’t answer, and it broke my heart not being able to let the families know. However, I realize these are things that only the investigators can answer.

Regulatory strategyAs a certificated airline, we have com-pulsory engagements with regulators over standard matters. But as part of the Process Improvement Project of three years prior, we established the GRACE program. GRACE program stands for government, regulatory, and certification envoys. The GRACE Team Project was de-signed in 2012 to establish a group strat-egy consistent with the AirAsia business philosophy and approach to dealing with regulatory and certification issues within the AirAsia Group. One specific and im-portant objective was to reinforce the role of AOC safety directors as stronger and more active government liaisons. It wasn’t to deal with standard regulatory issues, because we always had that capability with our regulators. Rather GRACE aims to enhance channels of communication in a proactive and preventative way and to make our safety leaders “safety entrepreneurs.”

Once the project was formalized, we used this format to visit our AOC regu-lators in the aftermath of QZ8501 to tell

investigation.In terms of general communication,

thanks to social media I was able to go directly to the audiences I wanted to reach. When I had to face conventional news media, I was very conscious to not tailor my message to them, but rather to make sure I stuck with and communicat-ed the four-point formula through the news media to which they were channe-ling the news to. I’m proud to say that our Indonesia AirAsia chief executive, Sunu Widyatmoko, used the same strategy and that as a team we did not deviate from this.

Family assistance strategyThree years ago, we began the process of strengthening our emergency response plans and doing special assistance team training. But no amount of training could fully prepare us for the tragic event that was the biggest challenge of my profes-sional and personal experience. It was a physical and emotional experience that I know all of you, as investigators, have gone through many times, trying to get to the bottom of these terrible tragedies for the rest of us. This is why I knew that of all the groups I speak with, all the audiences I interface with, ISASI was an event that I could not, and should not, miss.

In our plan, although we don’t fly into the United States, we nevertheless familiarized ourselves with the Family Assistance Act. AirAsia chose to comply with the elements of these requirements because it was the right thing to do, even though we weren’t required to do so. We also knew we couldn’t rely on the partnership offered by a formal alliance of airlines. Consequently, we employed our own group structure as an informal, self-contained alliance. Although we had an outside consultant initially guide us through the process of writing our man-uals and training our special assistance teams, we didn’t hire away our respon-sibility to an outside firm to execute the plan if and when the time came. We had to rely on each other. The CEOs of the affiliate partners came to Indonesia to take their place as care-team members. I know it’s unusual for CEOs to actually be care-team members, but we operate as a family, and this is what family does.

Another thing that I’ve been told was unusual was to give my personal mobile

during the incident, let me go back to the planning stage. Three years prior to this tragedy, AirAsia engaged in a Pro-cess Improvement Project. Its objective was to achieve the highest standards of safety in our organization through safety accountability at every level of management and in every division of our organization. Therefore, we brought together a cross-section of the workforce from across the group and broke them into teams to identify issues, recommend solutions, and develop action plans. The teams dealt with

• communication and infrastructure,• emergency response and family

assistance,• safety and operations,• safety and investigation, and • regulation and certification.The strategies we used in handling all

the involved parties were developed in 2012—well before the recent incident—through this Process Improvement Pro-ject. Let me explain what they were.

News media strategyI’ll start with what most people refer to as a news media strategy, but I prefer to call it our general communications strategy. Let me give you some background about what that was. The most important point for AirAsia as it relates to QZ8501 is that our communications strategy recog-nizes that we are involved in an aircraft accident investigation, not a news media event, and that we conduct our efforts to reach out accordingly. Because it was an investigation, there would be very little we could or would say to the news media except to express our empathy on behalf of the families and the families of our crew and defer everything else to the investigators.

We prepared a communication manual for all AirAsia staff three years ago. Under the manual, emergency response is part of overall communication, not the other way around. But rather than just cover-ing the worst-case scenario, our manual covers all situations, including the inter-national accident investigation process. This is because it’s clear to us that an emergency may happen once in a while, but the need to communicate effectively happens every day. In this manual, we use a four-point formula to communicate what is appropriate during an accident

Tony Fernandes is group CEO and founder of AirAsia Group.


vent the wheel?

Investigation strategyThe most important objective to AirAsia in light of an incident or accident is to participate professionally in an investi-gation and not to do anything that would jeopardize its outcome. The most impor-tant thing I can do as a chief executive is to make sure that the AirAsia team has the training and credibility to be accepted by investigators as technical advisors to the investigation. In keeping with those aims and through our GRACE Program, AirAsia has a career development pro-gram that will be putting key members of staff through various parts of the accident investigation and leadership programs at Cranfield University.

I have a responsibility to you to come here and tell you about our efforts, but I also have accountability to my team—and my AirAsia family—to come here on their behalf and tell you about what they did and continue to do. It’s not enough to stand back on the outside and say that things were handled right or wrong in one area or another without knowing the background or why. That’s why you, the investigators, are the most important audience I can speak with. And on behalf of my team members, who are here with me today, I would like to thank you for giving me the opportunity to do so.

the formation of our own internal group audit team, which will be shadowing the external assessment team we brought in to review our own system as part of on-the-job training.

GRACE team visits to our AOC regu-lators have been followed by team visits to regulators in countries where we don’t hold AOCs, but where we have significant route presence, such as Korea, Taiwan, China, and soon Australia.

Commercial aviation and travel in Asia is exploding. Asia is under constant scrutiny. We see what Europe has done, which is to harmonize safety standards and coordinate regulation. While the AirAsia team is out building commu-nication channels with the regulatory community, I’m doing my part to make a case at the highest levels of government for the 10 member states of the Associ-ation of South-East Nations (ASEAN) to similarly establish a single aviation mar-ket based on an integrated framework of regulations. In this regard, I’m pushing especially hard for the formation of a single regulatory body for ASEAN. This will benefit everyone by building a safer foundation based on standardization and harmonization of regulations. It’s not just an ASEAN issue but any airline that part-ners with an ASEAN airline. If such efforts have reduced the accident rates in the European Union, why should Asia rein-

them what we knew and what we had done. Although the final report hasn’t yet been issued and we therefore couldn’t give conclusions and preempt our inves-tigators, we could tell them what we had done in the immediate aftermath of the incident.

What we did was to update them on our reasoning and strategies behind how we handled our communication and fam-ily interface, our strategy to comply with the elements of the Family Assistance Act, and our plan on what we would do if a tragedy were to happen to any of our other AOCs. Our most important message to the regulators was that our objective in Indonesia was to preserve the integrity of the investigation, and that would be our objective when it came to communica-tion and families in their jurisdictions.

The first step we took following the incident in December was to bring in external experts, former regulators, to do an assessment of our processes and sys-tems to see if there was anything system-ically that wasn’t in line. There are many organizations that could have provided this information. However, we felt it was important to bring in former regulators from the U.S. Federal Aviation Adminis-tration with relevant background in this area to advise us on how to strengthen our system of checks and balances. In addition, the GRACE Project is driving


assembly with twin tail booms upward from the vehicle’s normal configuration or unfeathered (0 degrees) to 60 degrees to stabilize SS2’s attitude and increase drag during reentry into the earth’s atmos-phere (see Figure 3, page 20).

After release from WK2 at an alti-tude of about 46,400 feet, SS2 entered the boost phase of flight (see Figure 4, page 20). During this phase, SS2’s rocket motor would propel the vehicle from a gliding flight attitude to an almost-ver-tical attitude, and the vehicle would accelerate from subsonic speeds through the transonic region (0.9 to 1.1 Mach) to supersonic speeds. The flight test data card used during the accident flight indi-cated that the copilot was to unlock the feather during the boost phase when SS2 reached a speed of 1.4 Mach. However, a forward-facing cockpit camera and flight data showed that the copilot unlocked the feather just after SS2 passed through a speed of 0.8 Mach (see Figure 5, page 21). Afterward, the aerodynamic and inertial loads imposed on the feather flap assembly were sufficient to overcome the system; as a result, the feather extended uncommanded, causing the catastrophic structural failure.

As a result of this inves-tigation, the NTSB issued safety rec-ommenda-tions to the FAA and the Commercial Spaceflight Federation. For more information about the SS2 accident investiga-tion, see the NTSB’s web-site, www.

On Oct. 31, 2014, the Scaled Com-posites SpaceShipTwo (SS2) re-usable suborbital rocket, N339SS, broke into multiple pieces during

its fourth rocket-powered flight test and impacted terrain over a five-mile area near Koehn Dry Lake, California. One test pilot (the copilot) was fatally injured, and the other test pilot was seriously injured. SS2 had launched from the WhiteKnight-Two (WK2) carrier aircraft, N348MS, about 13 seconds before the breakup (see Figure 1). SS2 was destroyed (see Figure 2), and WK2 made an uneventful landing. Scaled Composites was operating SS2 under an experimental permit issued by the U.S. Federal Aviation Administration (FAA) Office of Commercial Space Trans-portation (AST) under the provisions of 14 Code of Federal Regulations (CFR) Part 437.

The NTSB launched a go-team to begin the first fatal commercial space accident investigation. There was a lot of interna-tional interest in the investigation, and the SS2 investigative report was adopted on July 28, 2015, nine months after the accident. This was not an easy undertak-ing since the SS2 investigation had unique aspects, which included investigating a commercial space vehicle, working with parties that had not participated in an NTSB investigation and were unfamiliar with our processes, dealing with propri-etary data and U.S. laws regarding the export of defense- and military-related technologies, learning new terminology, understanding the differences between space and aviation regulations, and the “learning period” the U.S. Congress had established.

Accident overviewScaled Composites developed WK2 and was developing SS2 for Virgin Galactic, which planned to use the vehicles to con-duct future commercial space suborbital operations. SS2 was equipped with a feather system that rotated a feather flap

E. Lorenda Ward was hired by the National Transportation Safety Board in November 1998 as an aerospace engineer specializing in aircraft structures. In May 2001, she was promoted to investi-gator-in-charge. She has served as the IIC for numer-

ous major aircraft accident investigations, including the recent commercial space inves-tigation of SpaceShipTwo. She has also served as the U.S. accredited representative for foreign accident and incident investigations all over the world. She received both her bachelor and master of aerospace engineering degrees from Auburn University in Auburn, Alabama. Before beginning work with the NTSB, Ward worked as a civilian aerospace engineer for the U.S. Navy.

Figure 1. SpaceShipTwo release from WhiteKnightTwo.

(Adapted with permission from the author’s technical paper entitled Is It a Space Plane or Rocket? The Unique Aspects of a Commercial Space Accident Investigation presented at ISASI 2015 held in Augsburg, Germany, Aug. 24–27, 2015, which carried the theme “Independence Does Not Mean Isolation.” The full presentation, including charts and cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2015 Technical Papers.”—Editor)

On Oct. 31, 2014, Scaled Composites’ SpaceShipTwo (SS2), a suborbital rocket, broke into multiple pieces over a five-mile area near Koehn Dry Lake, California. But SS2 was also referred to as a “space plane,” and WhiteKnightTwo was referred to as the “mother ship.” The NTSB’s accident IIC discusses the unique aspects of a commercial space accident investigation.

Is It a Space Plane or Rocket?By E. Lorenda Ward, Senior Investigator-in-Charge (IIC), U.S. National Transportation Safety Board (NTSB)

Figure 2. SpaceShipTwo wreckage.


of the feather and Mach numbers, would have been unavailable to the NTSB.

TerminologyWe had to determine the similarities and differences among various commercial space terms. For example, in Scaled Com-posites’ experimental permit application, SS2 was referred to as a “space plane,” and WK2 was referred to as the “mother ship.” However, SS2 is also referred to as a reusable suborbital rocket. Also, when WK2 and SS2 were conducting a glide flight, the flight was operating under an experimental certificate from the aviation side of the FAA. When WK2 and SS2 were conducting a powered flight in which the rocket motor was going to be fired, the launch was being conducted under an ex-perimental permit from the commercial space side of the FAA.

Remote wreckage locationIn order to protect the public, the operat-ing area for SS2 was in a remote location. The main wreckage debris fell within a five-mile area with seven different sites, separated by some distance, which made it hard to maintain security. Smaller debris was found up to 33 miles away and was collected when the public reported an object that might be from SS2. The remote location did not allow for cell phone coverage so communication was challenging for the groups working at the wreckage site. The on-site team had to drive to a different location to make a call. If the team at the command post wanted to contact the team in the field, messages had to be relayed through the sheriff ’s office. Wreckage was difficult to access so off-road and four-wheel-drive vehicles were used. Removal and transportation

If we did not have their profes-sionalism, openness, respon-siveness, and their willingness to trust our process, we would not have been able to com-plete this investigation within nine months.

Lack of certification regulationsUnlike commercial aviation, the FAA has a very limited role in commercial space. Because commercial space is an emerging transportation industry, the U.S. Congress established a “learning period” that lim-ited the FAA’s involvement to protecting the public and property during commer-cial space launches and encouraging, facilitating, and promoting the commer-cial space industry. The learning period is currently set to expire on Oct. 1, 2015, but there is working legislation in the U.S. Senate and U.S. House of Representatives to extend the date to at least 2020. As a result, the FAA was not responsible for certifying commercial space vehicles, and it appears that the FAA will not have such authority any time in the near future.

Data—lots and lots of dataAlthough there was no requirement for crash-protected data recorders on com-mercial space vehicles, there was a lot of data to be gathered. There were videos and telemetry data from SS2, videos from WK2, photos from the Extra-300 chase plane, and ground-based videos and photos from range facilities and private photographers. SS2 had a forward-facing cockpit camera that provided teleme-try video to Scaled Composites’ control room. We were able to watch this video the first day on scene, and it was very useful in determining the events that led to the accident.

SS2’s flight test data instru-mentation system, referred to as the Strap on Data Acquisi-tion System (SODAS), was the main source of flight data used during the investigation of this accident. SODAS telemetered data from SS2 to ground-based stations and was the only source of information for numerous vehicle performance and system operating status parameters. Without SODAS, critical investi-gative data, including the status

ntsb.gov, and access the public docket for this investigation (DCA15MA019) and/or the final report (NTSB/AAR-15/02).

Why was the investigation unique? At the time of the accident, Scaled Compos-ites had built and was testing SS2 and had delivered WK2 to Virgin Galactic. Scaled Composites had planned on transitioning SS2 to Virgin Galactic toward the end of the 2014. After the accident, Virgin Galactic took over the building and testing responsibility for the second SS2 vehicle. So which organization gets the recommendations when the organization that was operating the vehicle would no longer build or test it and the organiza-tion that is now building the vehicle was not operating the accident vehicle? Do you investigate the commercial space industry or just this accident?

Organizational relationshipsScaled Composites, Virgin Galactic, But-ler Parachute Systems, and the FAA were parties to the investigation. Although the FAA’s Office of Accident Investigation and Prevention was very familiar with our investigative process, the FAA’s Office of Commercial Space Transportation was not. In addition, the parties were famil-iar with each other but not with us. It is not unusual to have at least one party’s organization unfamiliar with the NTSB investigative process, but it was a chal-lenge, initially, to have all of the parties unfamiliar.

To overcome this challenge, some things had to be repeated. We had to move group members around to different groups for a better fit and made sure that questions or concerns were addressed quickly. There were growing pains, but in the end the parties stated that the investigation was better because we were leading it and they also learned from us. They also hoped that we had learned from them. They stated that they felt like their voice was heard and that they felt like they had participated—and that even when there were small disagreements, our rationale was fully explained to them.

Figure 3. Normal and feathered configuration.

Figure 4. Mission profile.


of the wreckage were difficult due to the soft sand and heavy pieces. A semi-truck got stuck a few times and had to be dug out. Wreckage was moved at night due to size of the truck and public road permits to get the truck from accident site to recovery hangar.

How not to go to jailOn scene there was extreme sensitivity about releasing photos and videos of the wreckage site due to company propri-etary concerns and U.S. International Traffic in Arms Regulations (ITAR). In addition, there were discussions about being able to hold an open board meet-ing or opening a public docket because of ITAR. What information would we be able to release to the public, and would there be enough information to support the findings, probable cause, and recom-mendations? Our general counsel worked closely with the legal counsel from both Scaled Composites and Virgin Galactic and multiple U.S. government agencies, including the Defense Office of Prepubli-cation and Security Review (DOPSR), the Defense Technology Security Administra-tion (DITSA), the National Aeronautics and Space Administration (NASA), and the Department of State (DOS). Multiple meetings were held to review the group chairmen’s factual reports and attach-ments. We were fortunate that DOPSR, DITSA, NASA, and DOS worked our reviews into their schedules so they could give us a quick response. In the end, the agencies determined that the redactions that we had done to protect company

proprietary information were sufficient to protect ITAR concerns as well.

How did we get prepared? The NTSB signed a memorandum of agreement with the Office of Commercial Space Transportation, then under the secretary of the Department of Trans-portation, in 1989, which established the relationship, notification procedures, coordination requirements, and reporting responsibilities for each of the agencies for a commercial space accident inves-tigation. The NTSB’s Office of Aviation Safety, Major Investigation Division, then spent more than 20 years preparing for a commercial space accident. This work included identifying a core “space” team within the NTSB, arranging advocacy visits, attending industry conferences, and participating in training and tabletop activities. In addition, a tri-chair working group was established with the NTSB, the Office of Commercial Space Transporta-tion (AST) within the FAA, and NASA. The group has monthly telephone conferences and quarterly meetings.

Interestingly enough, this was not the first space investigation that the NTSB conducted. We completed a special investigations report into the Feb. 9, 1993, commercial space launch incident of an Orbital Sciences Corporation (Orbit-al), now Orbital ATK, Pegasus launch procedure anomaly. As a result, the NTSB made safety recommendations to the Department of Transportation, NASA, and Orbital.

What does the future hold? Since 1989, there have been 238 licensed launches, with 23 U.S. launches (11 commercial) in 2014. According to the FAA’s Commercial Space Transportation Year in Review, “In 2014, the United States, Russia, Europe, China, Japan, India, Israel, and multinational provider Sea Launch conducted a total of 92 orbital launches, 23 of which were commercial.” Three of the 92 launches failed, one of which was a commercial launch. The numbers do not include the SS2 launch accident because it was a permitted launch and not a licensed launch. The commercial space industry continues to grow and may be the next major mode of transportation. Is your agency ready to answer the call?

Safety Issues • Lack of human factors guidance

for commercial space operators.• Efficacy and timing of pre-appli-

cation consultation process.• Limited interactions between the

FAA/AST and applicants during the experimental permit evalua-tion process.

• Missed opportunities during the FAA/AST’s evaluations of hazard analyses and waivers from regu-latory requirements.

• Limited inspector familiarity with commercial space operators.

• Incomplete commercial space flight database for mishap les-sons learned.

• Need for improved emergency response planning.

Probable Cause • Scaled Composites’ failure to

consider and protect against the possibility that a single human error could result in a catastroph-ic hazard to the SpaceShipTwo vehicle. This failure set the stage for the copilot’s premature unlocking of the feather system as a result of time pressure and vibration and loads that he had not recently experienced, which led to uncommanded feather extension and the subsequent aerodynamic overload and in-flight breakup of the vehicle.

Figure 5. Feather lock handle–unlocked position.


On the evening of March 29, 2013, the crew of an Airbus A321 made a return flight from Dakar (Senegal) to Lyon–Saint Exupéry

(France) as part of a nonscheduled public transport passenger flight chartered by a French airline. The airport was under low-visibility procedures conditions. The aircraft landed about 1,600 meters past the threshold of Runway 36R and overran the runway. During the approach, the crew did not manage the speed effectively, and there was a strong tailwind. Further-more, on short final, the crewmembers faced an unexpected increase in engine power, which they did not identify. Landing with a 100-foot ceiling and in a fog bank the captain, who was the pilot monitoring, steered the airplane around an ILS antenna and braked to stop the airplane. The airplane came to a halt 308 meters past the end of the runway, short of a 15-meter-deep hole in the ground (see Figure 1). No passengers or crew were injured. However, if the aircraft had con-tinued its roll and fallen into the hole, it is likely that it would have caused injuries or even fatalities.

Filling in that hole after the accident was one of the actions that resulted from the safety lessons drawn from this acci-dent. It was the most obvious and direct one, but the safety investigation recom-mended fixing other “holes” as well—namely, those discovered in the operator’s organization and in the oversight system.

FindingsThe investigation conducted by the BEA quickly highlighted

• an excessive flight duty period (14 hours and 50 minutes),

• excessive speed during the approach,

• a long landing,

• crew performance below expected standards for an approach or landing, and

• an FMGC software glitch that con-tributed to an engine power increase during the landing phase.

These initial findings led us to gather more information regarding the airline’s organization, its crew recruitment and training process, and oversight of the air-line by the National Aviation Authority as well as oversight of the National Aviation Authority by the European Aviation Safety Agency (EASA). A previous serious inci-dent had occurred in Lyon in April 2012 involving the same operator: a GPWS (ground proximity warning system) alert and two MSAW (minimum safe attitude warning) alerts triggered during ap-proach. The investigation revealed similar crew performance, operational, and organizational issues.

TrainingThe information gathered during the two investigations revealed a low level of crew performance. During approach, the crews neither adequately managed the speed

nor applied the standard operating proce-dures as expected. The following factors adversely influenced crew performance.

Both crews had limited experience with the aircraft type and in their functions. In the first event in April 2012, the left-seat pilot, trained as a captain, had a total of about 25 flying hours on the Airbus A320. The airline’s operations manual made it possible to recruit and train the pilots based on two different conditions: part A of the manual states that to be a captain, no minimum experience on the aircraft type is required. The manual also indi-cates that the airline management might allow a pilot to become a captain if he was considered “outstanding.”

• The copilot of the March 2013 event had limited overall experience and disrupted flying activity.

• The recruiting criteria for employ-ment as a pilot were variable accord-ing to the airline’s needs.

• The operator’s conversion course, in particular line flying under supervision, was not sufficient to compensate for the copilot’s lack of experience when he was recruited. Long breaks during the copilot’s line training probably disrupted the nor-mal learning process.

• CRM training was not representative of the specific operational conditions and did not adequately raise crew awareness of potential risks.

• Fatigued crewmembers, who had a particularly long duty period on the day of the second event. The crew-members began their activity at 5:45 a.m., took off at 6:44 a.m., and landed in Lyon at 8:45 p.m. after a technical stop in Agadir, Morocco, where the copilot touched down 900 meters past the threshold.

• A poor level of English that pre-vented the copilot from precisely understanding the ATIS message, in particular in relation to the wind, and

(Adapted with permission from the authors’ technical paper entitled Runway Overrun in Lyon, France: Fixing the Holes: Infrastructure, Training, and Oversight presented at ISASI 2015 held in Augsburg, Germany, Aug. 24–27, 2015, which carried the theme “Independence Does Not Mean Isolation.” The full presentation, including charts and cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2015 Technical Papers.”—Editor)

Fixing the Holes: Infrastructure, Training, and Oversight

The investigation demonstrates the spirit of independence that has to be the basis for the work of any investigation authority involved in aviation safety….

By Alain Agnesetti. Senior Safety Investigator; and Arnaud Desjardin, Deputy Head Investigations Department, Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (BEA), France

Figure 1.


that degraded the quality of commu-nication between captain and copilot.

• The inappropriateness of the simu-lator training for the specific risks involved in this situation, such as exercises for go-around, rejected landing, and dual inputs.

The conditions under which the op-erator began its activities in public air transport exposed it simultaneously to difficulties in crew recruitment, training, and skill checks. These difficulties were also accentuated by the rapid growth in the fleet and the seasonal nature of its activities.

Even though both the captain and the copilot theoretically met—with little or no margin on each criteria—the mini-mum regulatory training requirements, the investigation identified weaknesses that impacted the crew’s performance. The investigation showed that crews were not adequately trained in specific proce-dures such as rejecting a landing below 50 feet and emergency evacuations, and more generally that the training provid-ed was not in line with the operational situations encountered in service. The operator had identified some safety weak-nesses (captains and copilots with little experience on type and in the position, dual inputs, unstabilized approaches), but had not adapted its initial training and re-current training to these risks and did not have the tools required to really ensure the safety performance of its operations.

Oversight of the airline by the national aviation authorityThe airline, based in Greece, started its activity with only one airplane. In 2012, the owner of the airline, who also owned an airline in France, transferred four airplanes from the French airline to the Greek sister airline in order to start oper-ations as rapidly as possible. The airline had to find qualified crew urgently—since it did not transfer the French airline crews for cost reasons—while at the same time organizing the planning of oper-ations and preparing consistent docu-mentation compliant with the regulatory requirements.

The operations manual produced by the Greek airline under these conditions was approved in its entirety by the Greek National Aviation Authority at the end of November 2011, despite inconsistencies in the requirements to fly as copilot or

captain and the note authorizing the op-erator not to meet its criteria if need be. This last inconsistency was not detected by the National Aviation Authority. A new operations manual correcting all the inconsistencies and differences was filed with the authority at the end of 2012 and approved after the accident.

EASA audit and inspectionIdentifying a certain number of these fac-tors relating to the organization of flight safety, the recruitment process for crews, and their training and checks then led the BEA to examine the work of the oversight authorities.

In 2012, EASA conducted an audit of the National Aviation Authority respon-sible for oversight of the operator. During the same period, EASA carried out an inspection of the airline. It pointed out the difficulties of the National Aviation Authority in conducting oversight of the activity of airlines based in Greece, as the oversight authority had issued an air operator certificate without putting in place a suitable oversight program that would have made it possible to detect op-erational weaknesses. It appears that the conditions for flight crew recruitment, outsourced training, and rapid expansion should have led the National Aviation Authority to establish an appropriate oversight program.

The audit results from EASA were made available, after some difficulty, to the BEA, thanks to the provisions of Commission Implementing Regulation (EU) No. 628/2013, on working methods of EASA for conducting standardiza-tion inspections and for monitoring the application of the rules of Regulation (EC) No. 216/2008 of the European Parliament and of the council. It specifies in Article 21 “Access to information contained in inspection reports”:

“3. Where information contained in an inspection report relates to ongoing safe-ty investigations conducted in accord-ance with Regulation (EU) No. 996/2010 of the European Parliament and of the council, that information shall be made available without delay to the authority in charge of the safety investigation.”

This provision and others make it possible to foster the independence of safety investigation authorities like the BEA. It allows for a better understanding of systemic issues that may contribute to

accidents or serious incidents. This is how valuable lessons can be drawn for the improvement of aviation safety. Howev-er, audit or inspection results should be considered as protected information, for fear that this safety tool, designed for and used by oversight authorities, could lose some of its effectiveness.

ConclusionThis investigation could not have been undertaken without the cooperation of a large number of organizations. The findings would not have been possible if the BEA had worked in isolation. The active and fruitful cooperation of the accredited representative from Greece was essential. The investigation also demonstrated the spirit of independence that has to be the basis for the work of any investigation authority involved in aviation safety, but also of all the other participating organizations or authorities within the scope of their responsibilities. It enabled the 15-meter hole at Lyon–Saint Exupéry Airport to be filled to prevent the recurrence of a similar accident, but also pinpointed other holes at the systemic level and in the function-ing of oversight.

Alain Agnesetti is a former Air Force pilot instructor. As a flight safety officer and accident investigator in the French Air Force, he led various military accident investigations. A retired ma-jor with more than 6,000 fly-ing hours, Agnesetti joined the Bureau d’Enquêtes et d’Analyses pour la sécurité

de l’aviation civile (BEA) in 1999 as a safety inves-tigator. He has been the investigator-in-charge on a number of national and foreign investigations and accredited representative on major investiga-tions abroad. He has a professional pilot’s license. He is a Chevalier de l’Ordre National du Mérite and holds the Médaille de l’Aéronautique.

Amaud Desjardin has a master’s degree in aero-nautics from the French National Civil Aviation School (ENAC). He joined the Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile (BEA) in 2005 and is now the deputy head of the Investigations

Department. He has participated in major inter-national investigations, including as the investi-gator-in-charge for the Germanwings accident.


On Feb.10, 2011, a Fairchild SA 227-BC with 10 passengers and two flightcrew members on board crashed in dense fog while making

a third attempt to land at Cork Airport (EICK) in Ireland. Four passengers and both flight crew lost their lives, and four of the surviving passengers suffered seri-ous injuries. The accident occurred on an intra-community–scheduled passenger service operated by a licensed community air carrier.

The Inspector of Air Accidents (AAIU) is an operationally independent unit within the Department of Transport, Tourism, and Sport and is the safety in-vestigation authority in Ireland that inves-tigates accidents, serious incidents, and incidents into air accidents in the state. This particular investigation was the most challenging of the more than 500 investigations that had been completed at that time by the AAIU since its formation in 1994. The complexity of the accident sequence; examination of components at overseas locations; the international dimension of the operation, including the intricate relationship between the various agencies and associated undertakings;

translation of technical documents; and natural justice obligations determined the time taken to finalize the report following a three-year investigation.

Follow-up of the safety recommenda-tions took another year. The final 238-page report made a total of 54 findings, concluded the probable cause and nine contributory causes, and made 11 safety recommendations. This adapted article provides a summary of the AAIU final report published on Jan. 28, 2014 (AAIU Formal Report No. 2014-001, available at www.aaiu.ie).

Background to the operationThe aircraft was engaged on a scheduled passenger flight from Belfast City (in the UK) to Cork Airport. The flight was op-erated by a Spanish air carrier based in Barcelona, Spain, which was the holder of an air operator certificate (AOC) and an operating license. The aircraft was owned by a separate Spanish company based in Seville; the flightcrew mem-bers were employees of this company. Tickets for the scheduled service were sold by another company based in Isle of Man.

A SMALL ACCIDENT BUT A VERY COMPLEX INVESTIGATION

Leo Murray has 17 years’ operational ex-perience with a number of European airlines, including Aer Lingus, joining that airline in 1990. He was promoted to command in 2000 on the Fokker 50 and sub-sequently on the Boeing

737. Following a six-week short course in air accident investigation at Cranfield University, Murray was appointed air safety officer and line training captain with SkyNet Airlines in Shannon, Ireland, serving from 2002 to 2004. He joined Channel Express (Air Services) in 2004 and served as line captain and base flight safety officer. Murray was appointed as inspector of air accidents (Operations) in March 2007 with the Air Accident Investigation Unit (Ireland).

By Leo P. Murray, Inspector of Air Accidents (Operations), Air Accident Investigation Unit Ireland

(Adapted with permission from the author’s technical paper entitled A Small Accident but a Very Complex Investigation present-ed at ISASI 2015 held in Augsburg, Germany, Aug. 24–27, 2015, which carried the theme “Independence Does Not Mean Isolation.” The full presentation, including charts and cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2015 Technical Papers.”—Editor)

Figure 1. This Fairchild SA 227-BC was registered in Spain as EC-ITP. (Photo credit: Antonio Muñiz Zaragüeta via Airliners.net)


Aircraft descriptionThe aircraft involved was a Fairchild SA 227-BC Metro III built in 1992 and was first registered in Spain as EC-ITP in 2004 (see Figure 1). At the time of the accident, the aircraft was configured with 18 pas-senger seats and had a crew of two pilots. No cabin crewmembers were required to be carried, and safety briefings were demonstrated by the copilot prior to departure. The aircraft can be flown by either pilot; however, it was not equipped with an autopilot or a flight director. The aircraft and flight crew were capable of making ILS approaches to CAT I standard only.

The Metro III is powered by two TPE 331 turboprop engines. The engines are controlled by sets of levers positioned be-tween the pilots to control the power and the rpms on each engine. In addition, a set of latches adjacent to the main power levers allow the main power levers to be brought into “beta range” to provide re-verse thrust on the ground after landing.

Events prior to the accident flightPrior to the accident flight, the aircraft operated a series of night cargo char-ters from Belfast Aldergrove, Ireland, to Edinburgh, Scotland, to Inverness, Scotland, and back to Belfast Aldergrove. These flights were operated by a different flight crew than the accident flight crew and required the removal of all passenger seats in the aircraft. On arrival at Belfast Aldergrove at 5:10 a.m. on Feb. 10, 2011, the passenger seats were reinstalled by the flight crew that operated the night cargo charter.

The flight crew involved in the accident, the commander and the copilot, com-menced duty at Belfast Aldergrove at 6:15 a.m. Their planned duty that day was to

position the aircraft empty to Belfast City and operate two return flights to Cork, finishing at Belfast City. Flight documen-tation required for the flight sectors was downloaded in a handling agent’s briefing office at 6:25 a.m., including flight logs for each sector, meteorological information, and NOTAM information. The weather documentation did not have any current weather for Waterford Airport (EIWF), the only alternate airport declared on the flight plan.

The aircraft departed Belfast Alder-grove at 6:40 a.m. and arrived at Belfast City at 07:15 a.m. On arrival, a fuel uplift of 800 liters of Jet A1 fuel was made with a total fuel quantity of 3,000 pounds recorded in the technical log. Boarding was delayed; the handling agent wit-nessed the flight crew working toward the rear of the aircraft with torches on the floor. The flight crew did not obtain or request a weather update during the turnaround. A total of 10 passengers boarded the aircraft and took their seats at random. Two pieces of baggage were loaded into the aft hold.

The accident flightThe aircraft was airborne enroute to Cork at 8:10 a.m. and climbed to a cruising level of Flight Level 120. The flight con-tacted Shannon Control at 8:34 a.m., and, following release for descent, the flight was handed over to Cork Approach at 8:48 a.m. Following initial contact, the flight crew was given the latest weather conditions, including the IRVR. The flight crew was advised that a CAT II approach was available for Runway 17 and given the choice of runway.

The flight crew carried out two ILS ap-proaches, both of which were conducted with conditions below the required min-

ima. The flight crew required a visibility of at least 550 meters when the aircraft passed the outer marker equivalent point (3.5 nm on the approach). On both of these approaches, descent was continued below the decision height, which was followed by a missed approach.

The aircraft then entered a holding pattern for approximately 25 minutes. While in the holding pattern, Cork ATC obtained up-to-date weather reports for the flight crew for Waterford, Shannon, Dublin, and Kerry Airports. Waterford and Shannon were similar to Cork with fog, and Dublin had fog patches but was operational. Kerry Airport (EIKY), how-ever, had good weather with visibility in excess of 10 kilometers.

Although a diversion to Kerry Airport was considered briefly, as evidenced by the cockpit voice recorder (CVR), the commander decided to make a third ILS approach as the visibility was report-ed to be improving slightly. While the touchdown RVR improved briefly to 550 meters, the final approach was made with conditions below the required minima. This approach was continued below the decision height, and a missed approach was again initiated. Approaching the run-way threshold, the aircraft rolled to the left, followed by a rapid roll to the right, during which the right wingtip contacted the runway surface. The aircraft contin-ued to roll and impacted the runway in an inverted position. The aircraft departed the runway surface to the right and came to rest in soft ground. Post-impact fires occurred in both engine nacelles.

The investigation noted from ATC and CVR recordings that ATC personnel at EICK actively assisted the flight crew following requests for weather informa-tion and were proactive in identifying an operational alternate for the flight crew. Following the accident and loss of communications with the aircraft, ATC immediately activated the crash alarm.

Accident siteInspection of the runway surface and the flight data recorder (FDR) showed that the aircraft initially struck the runway with its right wingtip at a roll angle of 97 degrees (past the vertical), where it continued to roll impacting the runway surface inverted. Three of the right and one of the left propeller blades detached

“This safety recommendation also underlines the importance of sharing safety-related information between authorities. Further improvement of risk-based oversight and the lessons learned from this situation will be taken into account in the commission’s policy initiative on aviation safety…. The lessons learned from this tragic accident will not be forgotten.”—European Commission Directorate for Commercial Air Transport


as contact was made with the runway surface; the blades were found at various distances from the main wreckage. The aircraft left the paved area and decel-erated rapidly in soft ground. During the deceleration, the fuselage fractured, allowing a large amount of soil to enter the forward cabin.

Principal questions for the investigationEvidence showed that a catastrophic loss of control had occurred within the 10 seconds prior to impact. The AAIU inves-tigation then had two principal questions to answer: Firstly, what caused the loss of control in the final moments of the third approach, and secondly, why did the flight crew not divert to Kerry Airport following two abortive attempts to land?

To help answer the first question, the investigation examined the following scenarios that may have contributed to the loss of control:

• A flight control problem.

• A primary instrument failure on the aircraft.

• Unreliable signals from the ILS ground-based equipment.

• Incorrect display of ILS signals.

• Incapacitation of one or both of the flightcrew members

• Powerplant anomaly (the engines, propellers, or the engine control components).

The flight controls were examined at the accident site, and the investigation was satisfied that the aircraft’s flight control system was not a factor in the accident. Likewise, the investigation was also satisfied that the ground-based ILS signals were radiating correctly at the time of the accident and that the horizon-tal situation indicator (the primary ref-erence instrument that would have been used by the copilot) did not contribute to the loss of control. The investigation also discounted the possibility of subtle or sudden incapacitation of the flight crew.

The final factor that may have contrib-uted to a loss of control was the pow-erplant. Examination of the propellers showed that, at the moment of impact, the blades of both propellers were at pitch angles of approximately 40 degrees, which was appropriate for a power setting com-mensurate with a go-around. No pre-ac-

cident defects were found with any of the propeller blades, and all evidence indicat-ed that the propellers were functioning correctly at the moment of impact.

Data and evidence relating to the operation of the engines were contained in the flight recorders. Both the FDR and the CVR were recovered from the wreck-age and downloaded. The FDR contained data in digital format for the previous 106 hours of aircraft operation until the unit ceased recording due to the impact. The CVR contained recording for 29 min-utes until the unit ceased recording at impact. The FDR contained a total of 11 parameters. Examination of the FDR data showed that up to approximately nine seconds prior to impact all recorded pa-rameters were normal except for a slight difference between the recorded engine torque values.

Evidence shows that the final approach was flown at approximately 140 knots, an indicated airspeed consistent with engine power settings, expected aircraft perfor-mance, and proper control of the aircraft. According to the airplane flight manual (AFM), the zero bank stall speed calculat-ed for the aircraft in the approach config-uration was 88 knots. Although the stall warning horn activated during the final seconds of the flight, various combina-tions of airspeed decay and load factors, coupled with the aerodynamic distur-bance associated with the loss of control, were the likely causes of its activation.

The first significant event was a reduc-tion of delivered engine torque from both engines, commencing approximately nine seconds before impact, accompanied by a decrease in airspeed. Coinciding with the reducing torque val-ues, the aircraft began a roll to 40 degrees to the left. As both engine torques in-creased (approximate-ly five seconds before impact), the pitch attitude increased and the airspeed continued to decay. Concurrently, the aircraft commenced a roll to the right past the vertical as torque

values increased toward 100 percent. Following impact, the data values become unreliable.

Examination of the FDR data showed that from the earliest available data (106 hours prior to the accident) there was a mismatch between the recorded torques being delivered by the two engines. In general, the data showed that the torque being delivered by the No. 2 engine ex-ceeded that being delivered by the No. 1 engine by up to 5 percent.

It was also noted that, as the pow-er levers for both engines were being advanced prior to takeoff, the torque response for the No. 2 engine was faster than that for the No. 1 engine. FDR data also showed that prior to and on the day of the accident, the power levers were manually adjusted in normal flight to compensate for the engine torque differential.

During laboratory examination of the engine control components under the oversight of the investigation, an anomaly was found on the PT2/TT2 (pressure/temperature) sensor associated with the No. 2 engine. This sensor, which is located in the inlet to the first stage compressor, provides total pressure and total temper-ature information for the scheduling of the associated fuel control unit (FCU). The bellows of the sensor (see Figure 2) when examined was found to be consid-erably shorter than required by the man-ufacturer’s specification. Subsequently, a leak within the system was identified, due to a crack found in the coil of the sensor bulb. The exact cause of the crack initi-ation could not be determined and may

Figure 2. Note the shortened bellows length on the No. 2 engine compared to the bellows length on the No. 1 engine.


have been related to several contributors, such as interface corrosion and in-service stresses. The crack appeared to have been present for some time as evidenced by corrosion found on the fracture surface.

Laboratory testing demonstrated that, as a consequence of this defect, the pressure/temperature sensor in the No. 2 engine was outputting a tempera-ture value up to 135 degrees F below the actual total temperature to the No. 2 fuel control unit. This cold temperature signal resulted in incorrect scheduling of fuel flow to the No. 2 engine. This, in turn, had three effects on engine performance, all of which were in evidence throughout the FDR data. These were

1. slower engine speed response when the speed lever was advanced.

2. faster engine torque response when the power lever was advanced.

3. higher torque for a given power lever angle.

The respective fuel flow rates were then used to calculate the power lever angles during this phase of flight. The data indi-cate that during the final approach up to a time approximately nine seconds before impact, both power levers were at angles in the range 50 degrees to 52 degrees. The power levers were then simultaneously moved below the flight idle position of 40 degrees in the period from approximately eight seconds to six seconds before im-pact. Calculations indicate that the power lever angles at this time were in the range of 31 degrees to 33 degrees, i.e., below the flight idle position and in the beta range of operation.

Loss of controlThe evidence from the CVR, beta mode latch (see Figure 3), and FDR engine parameters is consistent with a simulta-neous retardation of both power levers below the flight idle stops. Operating one or more power levers below flight idle in flight, an action prohibited in the AFM, produces high drag conditions, which may result in excessive airspeed deceler-ation and may induce an uncontrollable roll rate due to asymmetric thrust and drag. These rapid and asymmetric torque and drag variations coincided with the initial stages of loss of control, i.e., a rapid roll to the left to an angle of 40 degrees. Upon application of go-around power, the

aircraft commenced a rapid roll to the right, during which the right wingtip came into contact with the runway.

At the time the power levers were operated below flight idle, the FDR shows a decrease in airspeed and rapid rolling, probably as a result of asymmetric thrust—which may have been exacerbated by the latent fault identified with the pressure/temperature sensor of the No. 2 engine.

The anomaly identified with the pressure/temperature sensor on the No. 2 engine existed for more than 106 hours of aircraft operation, including the two go-arounds that had been conducted prior to the final approach. It is the opinion of the investigation that this anomaly did not materially affect the normal operation of the aircraft; however, when the aircraft entered a regime prohibited by the AFM, this anomaly became significant.

The CVR indicates that the commander took control of the power levers during the final approach. This action was ac-knowledged by the copilot (pilot flying). This was significant, as both power levers were subsequently retarded below flight idle—an action that would have been un-expected by the PF. It is possible that the PF may have made a control wheel input to the right in response to the unantici-pated left roll. However, without the FDR parameters of control wheel or control surface position, the investigation cannot determine if such input was made.

The subsequent application of power to commence the go-around, at approx-imately 100 feet, coincided with the commencement of a rapid roll to the right and loss of control. This roll continued through the vertical; the right wingtip struck the runway, and the aircraft invert-ed.

The investigation identified three prin-cipal factors that contributed to the loss of control:

• Uncoordinated operation of the power levers and the flight controls, which were being operated by differ-ent flightcrew members.

• The retardation of the power levers below flight idle, an action prohibited in flight, and the subsequent appli-cation of power are likely to have induced an uncontrollable roll rate due to asymmetric thrust and drag.

• A torque split between the power-plants, caused by a defective pres-sure/temperature sensor, became significant when the power levers were retarded below flight idle and the No. 1 powerplant entered a neg-ative torque regime. Subsequently, when the power levers were rapidly advanced during the attempted go-around, this probably further contrib-uted to the roll behavior as recorded on the FDR.

The probable cause of the accident was determined to be a loss of control of the aircraft at a low height, from which recov-ery was not possible. The approach was continued despite not having the required minima, and the aircraft descended be-low the decision height without adequate visual reference. Loss of control was initiated by the retardation of the power levers below flight idle, a maneuver pro-hibited in flight as such a maneuver may result in excessive airspeed deceleration

Figure 3. Beta mode latch.


and may induce an uncontrollable roll rate due to asymmetric thrust and drag.

Option to divertThe second question the investigation needed to address was why the flightcrew members did not divert to Kerry Airport following two abortive attempts to land. While the aircraft was holding at point ROVAL, Cork ATC obtained the weather conditions at Kerry Airport, which were good, and passed them to the flight crew. In addition, Cork ATC also made the flight crew aware of the proximity of Ker-ry. The fact that the opportunity to divert was not taken prompted the investigation to examine the training and experience of the flight crew and how that may have affected the decisions taken.

The commander held a JAA commercial pilot license (CPL, airplanes) issued in Spain. His SA 227 type rating was valid to June 30, 2011, and his Class I medical cer-tificate was valid to May 7, 2011. Records show that he had a total flying time of 1,801 hours with 1,600 hours on type.

The commander began flying in 2007 and completed his basic training on single- and multi-engine piston types; his total general aviation flight time was 201 hours. He then completed an SA 227 type rating with a type rating training organization (TRTO) in Barcelona and commenced employment as a copilot on the type. Between Dec. 7, 2009, and Dec. 16, 2009, his personal logbook showed that he completed nine sectors totaling 15 hours and 10 minutes as P1/S (pi-lot-in-command under supervision). This command training was discontinued, and he returned to flying as a copilot.

He flew as a copilot for the operator until Feb. 2, 2011, when he completed an operator proficiency check (OPC), during which he occupied the left-hand seat. This OPC took place at Reus (LERS), Spain, and was recorded as lasting 40 minutes, during which two landings were complet-ed. The operator’s procedures require a flight of two hours’ duration and at least four landings/touchdowns. Following sev-en sectors under supervision, he complet-ed two line check (LC) sectors, one sector on Feb. 4, 2013, and a second the follow-ing day, and he was promoted to the rank of commander. Following this, he traveled from Spain to Belfast to commence duty as commander.

His first flight in command was on Feb, 6, 2011, four days prior to the accident. His total experience in command on the SA 227 was 25 hours. Records show that the commander operated as a copilot into EICK on 61 occasions between Sept. 8, 2010, and Jan. 30, 2011. Between Feb. 6, 2011, and Feb. 9, 2011, he operated into EICK on seven occasions as commander. The investigation found no records of a diversion for operational or weather rea-sons on any of these flights into EICK. In addition, his logbook showed that he had never operated into either EIWF or EIKY.

The copilot had completed an SA 227 type rating in Spain and had accumulated a total of 270 hours experience on the type. Following an initial operator pro-ficiency check on Jan. 8, 2011, he flew as copilot with commanders who were not instructors. At the time of the accident, he had flown a total of 19 hours with the operator but had not completed an initial line check.

In summary, the investigation found that the aircraft commander was inade-quately trained in the command role and thus was ill prepared for the situation in which he found himself on the day of the accident.

Operational issuesIt is recognized that tiredness and fatigue can adversely affect the performance of an individual to such an extent that the decision-making and evaluation of a situation are compromised. Both flight-crew members commenced duty without the prescribed rest, and it is likely that the commander and copilot were suffering from tiredness and fatigue at the time of the accident.

The investigation determined that the aircraft commander was inadequately trained in the command role. Poor eval-uation of the weather conditions, lack of CRM, and inappropriate decision-making are largely attributable to the inadequate command training given to the com-mander. In addition, the copilot, who had only recently joined the operation, had not been line checked, yet was paired with the newly appointed commander. This inappropriate pairing resulted in a flat cockpit authority gradient with little formal command in evidence.

The copilot’s duty change was made without the knowledge of the operator,

although preparation and oversight of flight duty times were solely its respon-sibility. While the operator stated it did not pair the flight crew together, there was no procedure in its operations man-ual to prevent this occurring, contrary to the provisions of EU-OPS. Such a crew pairing is not conducive to flight safety and came about due to the operator not exercising appropriate control over its crew rosters and its lack of operational control and effective oversight.

Flight time limitations transgressions and the inadequate training provided to both flightcrew members illustrate that this lack of oversight was not confined to the remote operation.

Organizational issuesThe granting of an AOC requires that an operator satisfies the competent authority that it is able to conduct safe operations, that its organization and management are matched to the scale and scope of the operation, and that pro-cedures for the supervision of operations are defined.

The introduction of the intra-commu-nity–scheduled passenger air service was a significant departure from the operator’s core activity of cargo flights. Sufficient scrutiny of this proposed remote operation by the operator should have identified and managed the addi-tional resources and challenges while mitigating any risks identified. The lack of a contract or contact between the operator and the ticket seller illustrates that this did not take place.

The ticket seller, which was not based within the European Union, accrued rev-enue from scheduled intra-community air services. The investigation found no evidence of a direct link between it and the operator, the holder of the operating license providing the air services. The UK Civil Aviation Authority (CAA) stated that there were concerns that the ticket seller was allowing the impression to be created that it was a licensed airline in its own right. The CAA addressed these concerns by requesting the ticket seller to amend its website. The investi-gation notes that the term “airline” was not defined or addressed in EU regulations.

The investigation formed the opinion that the ticket seller, an “air carriage


contractor” as defined in Regulation (EC) No. 2111/2005, Article 2 (c), was portray-ing itself as an airline. The investigation further considered that in the eyes of the traveling public, an “airline” is synony-mous with an “air carrier,” an entity that is required to hold a valid operating license. Such an operating license can only be held by the holder of a valid AOC.

The de-facto operation of the aircraft by the owner (the Seville-based company, which is not an air carrier) and the Isle of Man-based ticket seller appearing to be an airline, was facilitated by the operator in providing air service through the use of its AOC. Furthermore, as there was no contract between the operator and the ticket seller (the unsigned agreement being between the owner and the ticket seller), the operator was isolated from the activities associated with the operation and became just a service provider. The operational oversight of this arrangement would be difficult to administer, with each undertaking carrying out various tasks, but with no overall effective over-sight of the operation being carried out by the AOC holder.

Regulatory oversightIn its oversight responsibility, the com-petent authority conducted operational and engineering audits on a regular basis. The investigation considers that the findings of these audits were superficial. Specifically, it did not identify the remote operation or its inadequate resources.

Furthermore, the state audit carried out by International Civil Aviation Organ-ization (ICAO) and the standardization audit by the European Aviation Safety Agency (EASA) also found weaknesses in the ability of the competent authority to conduct effective oversight.

Intra-community air servicesThis accident flight was an intra-com-munity air service as defined in Regula-tion (EC) No. 1008/2008, and under the requirement for “a high and uniform level of protection of the European citizen through the adoption of common safety rules,” as detailed in Regulation (EC) No. 216/2008. Neither the ticket seller nor the owner had any accountability under these regulations, as neither held either an operating license or an air operator certificate.

Whereas Regulation (EC) No. 1008/2008 provides for the operation of an intra-community air service by a community air carrier, the oversight role of member states, except the state that has issued the air operator certificate and operating license, appears to be limited: “Member states shall not subject the operation of intra-community air services by a community air carrier to any permit or authorization. Member states shall not require community air carriers to provide any documents or information that they have already supplied to the competent licensing authority, provided that the relevant information may be obtained from the competent licensing authority in due time.”

The investigation was concerned that the commercial model of an intra-com-munity air service provided by a ticket seller was not in the best interests of passenger safety as it could facilitate utili-zation of resource-constrained undertak-ings to provide air services, thus allowing a ticket seller to exercise an inappropri-ate and disproportionate role with no accountability regarding air safety. The responsibilities of an air carrier are set out in Regulation (EC) No. 1008/2008, but the role of a ticket seller, the investigation found, is not clear nor are its activities defined.

SummaryThe investigation determined that the probable cause was “loss of control during an attempted go-around initiated below decision height in instrument me-teorological conditions.” The investigation identified the following factors as being significant:

• The approach was continued in con-ditions of poor visibility below those required.

• The descent was continued below the decision height without adequate visual reference being acquired.

• Uncoordinated operation of the flight and engine controls when a go-around was attempted.

• The engine power levers were retard-ed below the normal inflight opera-tional range, an action prohibited in flight.

• A power difference between the engines became significant when the

engine power levers were retarded below the normal inflight range.

• Tiredness and fatigue on the part of the flightcrew members. Inadequate command training and checking.

• Inappropriate pairing of flightcrew members and inadequate oversight of the remote operation by the operator and the state of the operator.

• Systemic deficiencies at the opera-tional, organizational, and regulatory levels were also identified by the in-vestigation. Such deficiencies includ-ed pilot training, scheduling of flight crews, maintenance, and inadequate oversight of the operation by the op-erator and the state of registration.

In accordance with the investigation’s objective of preventing future accidents and incidents, a total of 11 safety rec-ommendations (SR) have been made to various entities as follows:

• Three were made to the EASA regarding the number of successive instrument approaches that can be conducted to an aerodrome in cer-tain meteorological conditions, the syllabus for appointment to com-mander, and the process by which air operator certificate variations are granted (all but one SR was accepted; however, a safety information bulletin was issued by EASA in respect to IRLD2014-002 regarding successive instrument approaches).

• Two were made to the operator, Flightline S.L., regarding its opera-tional policy and training (both SRs were accepted).

• One was made to Agencia Estatal de Seguridad Aérea (AESA), the Spanish Civil Aviation Regulatory Authority, regarding oversight of air carriers (SR was accepted).

• One was made to ICAO regarding the inclusion of the approach capability of aircraft/flight crew on flight plans (SR was accepted).

• Four were made to the European Commission Directorate responsible for commercial air transport regard-ing flight time limitations, the role of the ticket seller, the improvement of safety oversight, and the oversight of operating licenses.

All but one SR to the European com-

(Continued on page 30)


ISASI InformationOFFICERS President, Frank Del Gandio ([email protected])Executive Advisor, Richard Stone ([email protected])Vice President, Ron Schleede ([email protected])Secretary, Chad Balentine ([email protected])Treasurer, Robert MacIntosh, Jr. ([email protected])

COUNCILLORSAustralian, Richard Sellers ([email protected])Canadian, Barbara Dunn ([email protected])European, Olivier Ferrante ([email protected])International, Caj Frostell ([email protected])New Zealand, Alister Buckingham ([email protected])Pakistan, Wg. Cdr. (Ret.) Naseem Syed Ahmed ([email protected])United States, Toby Carroll ([email protected])

NATIONAL AND REGIONALSOCIETY PRESIDENTSAsiaSASI, Chan Wing Keong ([email protected])Australian, Richard Sellers ([email protected])Canadian, Barbara Dunn ([email protected])European, Keith Conradi ([email protected])Korean, Dr. Tachwan Cho (contact: Dr. Jenny Yoo—[email protected])Latin American, Guillermo J. Palacia (Mexico)Middle East North Africa, Ismaeil Mohammed Abdul (contact: Mohammed Aziz— [email protected])New Zealand, Alister Buckingham ([email protected])Pakistan, Wg. Cdr. (Ret.) Naseem Syed Ahmed ([email protected])Russian, Vsvolod E. Overharov ([email protected])United States, Toby Carroll ([email protected])

UNITED STATES REGIONALCHAPTER PRESIDENTSAlaska, Craig Bledsoe ([email protected])Arizona, Bill Waldock ([email protected])Dallas-Ft. Worth, Tim Logan ([email protected])Great Lakes, Matthew Kenner ([email protected])Mid-Atlantic, Ron Schleede ([email protected])Northeast, Luke Schiada ([email protected])Northern California, Kevin Darcy ([email protected])Pacific Northwest, Kevin Darcy

A SMALL ACCIDENT BUT A VERY COMPLEX INVESTIGATION

mission was accepted. However, regarding the SR made related to the role of the ticket seller, the Euro-pean commission kindly remarked the following in communications to the AAIU during 2014: “This safety recommendation also underlines the importance of sharing safety-relat-ed information between authorities. Further improvement of risk-based oversight and the lessons learned from this situation will be taken into account in the commission’s policy initiative on aviation safety that is highlighted at the end of this letter.

“From a general perspective, the lessons learned from this valuable report will be used in future legislative activities. More specifically, the safety recommendations will also be exploited during the process with regard to the commission’s policy initiative on avi-ation safety and a possible revision of Regulation (EC) No. 216/2008 on com-mon rules in the field of civil aviation

(Continued from page 29)

and establishing a European Aviation Safety Agency. Under this initiative, the roadmap includes considering a possible strengthening of the oversight system to better respond to today’s needs, such as the growing share of remote operations. Among the options to be examined will be the expansion of mechanisms for cooperative oversight, including the possi-bility to delegate oversight duties to other national aviation authorities or to EASA, where appropriate.… I would like to confirm that the issues that you raised in your final report have been discussed on a regular basis within my services in the context of future legislative activities. The lessons learned from this tragic accident will not be forgotten.”

The AAIU welcomes and appreciates the closing remarks made by the commission regarding its policy on aviation safety and future legislative activities and that a high and uniform level of safety is achieved and main-tained for the traveling public.

Test Your Memory: The names of the persons shown in this photo of the first graduating class from the U.S. National Transportation Safety Board’s Aircraft Accident Investigation School at Dulles, Virginia, in 1972 are unknown. Can you identify any of the persons in the photo? If so, list the names by row, left to right, and send your answer to [email protected]. The reader who identifies the most people in the photo will be included in an upcoming issue of Forum.—Editor


ISASI Information ([email protected])Rocky Mountain, David Harper ([email protected])Southeastern, Robert Rendzio ([email protected])Southern California, Thomas Anthony ([email protected])

COMMITTEE CHAIRMENAudit, Dr. Michael K. Hynes ([email protected])Award, Gale E. Braden ([email protected])Ballot Certification, Tom McCarthy ([email protected])Board of Fellows, Curt Lewis ([email protected])Bylaws, Darren T. Gaines ([email protected])Code of Ethics, Jeff Edwards ([email protected])Membership, Tom McCarthy ([email protected])Mentoring Program, Anthony Brickhouse ([email protected])Nominating, Troy Jackson ([email protected])Reachout, Glenn Jones ([email protected])Scholarship Committee, Chad Balentine ([email protected]) Seminar, Barbara Dunn ([email protected])

WORKING GROUP CHAIRMENAir Traffic Services, Scott Dunham (Chair) ([email protected]) Ladislav Mika (Co-Chair) ([email protected])Airports, David Gleave ([email protected]) Cabin Safety, Joann E. Matley ([email protected])Corporate Affairs, Erin Carroll ([email protected])Critical Incident Stress Management (CISM), David Rye--([email protected])Flight Recorder, Michael R. Poole ([email protected])General Aviation, Steve Sparks ([email protected]) Co-Chair, Doug Cavannah ([email protected])Government Air Safety Facilitator, Marcus Costa ([email protected])Human Factors, Richard Stone ([email protected])Investigators Training & Education, Graham R. Braithwaite ([email protected])Military Air Safety Investigator, Bret Tesson ([email protected])Unmanned Aerial Systems, Tom Farrier ([email protected])

CORPORATE MEMBERSAAIU, Ministry of TransportAccident Investigation Board NorwayAccident Investigation Bureau NigeriaAdministration des Enquêtes TechniquesAero RepublicaAerovias De Mexico, S.A. De C.V.Air Accident Investigation Bureau of MongoliaAir Accident Investigation Bureau of SingaporeAir Accident Investigation Unit-IrelandAir Accident Investigation Sector, GCAA, UAE

Air Accidents Investigation Branch-UKAir Asia GroupAir Astana JSCAir CanadaAir Canada Pilots AssociationAir Line Pilots AssociationAirbusAirclaims LimitedAirways New ZealandAlitalia SpAAll Nippon Airways Co., Ltd. (ANA)AllianzAllied Pilots AssociationAloft Aviation ConsultingAramco Associated CompanyASPA de MexicoASSET Aviation International Pty. Ltd.Association of Professional Flight AttendantsAustralian and International Pilots’ Association (AIPA)Australian Transport Safety BureauAviation Investigation Bureau, Jeddah, Kingdom of Saudi ArabiaAviation Safety CouncilAvisureBecker Helicopters Pty. Ltd.Bundesstelle fur Flugunfalluntersuchung (BFU)Bureau d’Enquêtes et d’Analyses (BEA)CAE FlightscapeCathay Pacific Airways LimitedCharles Taylor AviationChina AirlinesCivil Aviation Authority, Macao, ChinaCivil Aviation Department HeadquartersCivil Aviation Safety Authority AustraliaCivil Aviation Safety Investigation and Analysis Center Colegio Oficial de Pilotos de la Aviación Comercial (COPAC)Cranfield Safety & Accident Investigation CentreCurt Lewis & Associates, LLCDassault AviationDDAAFSDefence Science and Technology Organisation (DSTO)Defense Conseil International (DCI/IFSA)Delta Air Lines, Inc.Directorate of Flight Safety (Canadian Forces)Dombroff Gilmore Jaques & French P.C.DRS C3 & Aviation Company, Avionics Line of BusinessDubai Air WingDutch Airline Pilots AssociationDutch Safety BoardEclipse Group, Inc.Education and Training Center for Aviation SafetyEL AL Israel AirlinesEmbraer-Empresa Brasileira de Aeronautica S.A.Embry-Riddle Aeronautical UniversityEtihad AirwaysEuropean Aviation Safety Agency (EASA)EVA Airways CorporationExecutive Development & Management AdvisorFinnair PlcFinnish Military Aviation AuthorityFlight Data Services Ltd.Flight Data Systems Pty. Ltd.Flight Safety FoundationGE AviationGeneral Aviation Manufacturers Association

Global Aerospace, Inc.Grup Air Med S.A.Gulfstream Aerospace CorporationHall & Associates LLCHNZ New Zealand LimitedHoneywell AerospaceHong Kong Airline Pilots AssociationHuman Factors Training Solutions Pty. LtdIndependent Pilots AssociationInsitu, Inc.Interstate Aviation CommitteeIrish Air CorpsIrish Aviation AuthorityJapan Transport Safety BoardJones DayKLM Royal Dutch AirlinesKorea Aviation & Railway Accident Investigation BoardL-3 Aviation RecordersLearjet/Bombardier AerospaceLion Mentari Airlines, PTLockheed Martin Aeronautics CompanyMiddle East AirlinesMilitary Air Accident Investigation BranchNational Aerospace Laboratory, NLRNational Institute of Aviation Safety and ServicesNational Transportation Safety BoardNational Transportation Safety Committee- Indonesia (KNKT)NAV CANADAPakistan Air Force-Institute of Air SafetyPakistan Airline Pilots’ Association (PALPA)Pakistan International Airlines Corporation (PIA)Papua New Guinea Accident Investigation Commission (PNG AIC)Parker AerospacePhoenix International Inc.Plane Sciences, Inc., Ottawa, CanadaPratt & WhitneyPT Merpati Nusantara AirlinesQatar AirwaysRepublic of Singapore Air Force (RSAF)Rolls-Royce PLCRoyal Danish Air Force, Tactical Air CommandRoyal Netherlands Air ForceRoyal New Zealand Air ForceRTI Group, LLCSaudia Airlines-SafetyScandinavian Airlines SystemSikorsky Aircraft CorporationSingapore Airlines LimitedSkyTrac Systems LtdSouthwest Airlines CompanySouthwest Airlines Pilots’ AssociationSpanish Airline Pilots’ Association (SEPLA)State of IsraelStatens haverikommissionSwiss Accident Investigation Board (SAIB)The Air GroupThe Boeing CompanyThe Japanese Aviation Insurance Pool (JAIP)Transportation Safety Board of CanadaTurbomecaUND AerospaceUnited AirlinesUnited States Aircraft Insurance GroupUniversity of Southern CaliforniaVirgin AmericaWestJet


Southwest.com/citizenship.Southwest Airlines was incorporated in

Texas and commenced customer service on June 18, 1971, with three B-737s serving three Texas cities—Houston, Dallas, and San Antonio—and grew to become a major airline in 1989 when it exceeded the billion-dollar revenue mark. In 1994, Southwest became the first major airline to offer ticketless travel. In 1996, Southwest became the first major airline to post a website with the launch of its “Home Gate.” Southwest topped the monthly domestic originating passenger rankings for the first time in May 2003. In 2013, Southwest started its first service to a destination outside the 48 contiguous states with service to San Juan, Puerto Rico. In July 2014, Southwest began its first international flights to Nassau, Bahamas; Montego Bay, Jamaica; and Aruba. Later in the year, Southwest continued its international launch with service to Mexico and the Dominican Republic. In 2015, Southwest’s interna-tional service grew to seven countries, with new service to San Jose, Costa Rica, in March. Service to Puerto Vallarta, Mexico, began in June; Belize City, Belize, in October; and Liberia, Costa Rica in November.

ISASI

WHO’S WHO

INCORPORATED AUGUST 31, 1964

In its 45th year of service, Dallas, Tex.-based Southwest Airlines (NYSE: LUV) continues to differentiate itself from other air carriers with exempla-

ry customer service delivered by more than 48,000 employees to more than 100 million customers annually. Southwest proudly operates a network of 97 destina-tions across the United States and seven additional countries with more than 3,900 departures a day during peak travel season.

Based on the U.S. Department of Trans-portation’s most recent data, Southwest Airlines is the nation’s largest carrier in terms of originating domestic passengers boarded. The company operates the larg-est fleet of Boeing aircraft in the world—the majority of which are equipped with satellite-based Wi-Fi, providing gate-to-gate connectivity. That connectivity enables customers to use their personal devices to view video on-demand movies and television shows, as well as nearly 20 channels of free, live TV compliments of our valued partners.

Southwest created Transfarencysm, a philosophy based on treating customers honestly and fairly and keeping fare prices low. Southwest is the only ma-jor U.S. airline to offer Bags Fly Free® to

Southwest Airlines Enters 45th Year of Service

107 E. Holly Ave., Suite 11Sterling, VA 20164-5405 USACHANGE SERVICE REQUESTED

everyone ( first and second checked pieces of luggage, size and weight limits apply; some airlines may allow free checked bags on select routes or for qualified circumstances), and there are no change fees, though fare differences might apply.

In 2014, the airline proudly unveiled a bold new look: Heart. The new aircraft livery, airport experience, and logo showcase the dedication of South-west employees to connect customers with what’s important in their lives. From its first flights on June 18, 1971, Southwest Airlines launched an era of unprecedented affordability in air travel described by the U.S. Department of Transportation as “the Southwest Ef-fect,” a lowering of fares and increase in passenger traffic whenever the carrier enters new markets.

With 42 consecutive years of profita-bility, Southwest is one of the most hon-ored airlines in the world, known for a triple-bottom-line approach that contributes to the carrier’s performance and productivity, the importance of its people and the communities it serves, and an overall commitment to efficien-cy and the planet. The 2014 Southwest Airlines One Report™ can be found at

(Who’s Who is a brief profile prepared by the represented ISASI corporate member organization to provide a more thorough understanding of the organization’s role and function.—Editor)

Documents

Air Safety Through Investigation APRIL-JUNE 2016