Bristol Wind-blown plume model Mark Woodhouse, Andrew Hogg, Jeremy Phillips and Steve Sparks.
ON COMMERCIAL AVIATION SAFETY AUTUMN 2002 48.pdfe-mail: [email protected] Web Site: Office Hours:...
Transcript of ON COMMERCIAL AVIATION SAFETY AUTUMN 2002 48.pdfe-mail: [email protected] Web Site: Office Hours:...
1
O N C O M M E R C I A L A V I A T I O N S A F E T Y
ISSUE 48 THE OFFICIAL PUBLICATION OF THEUNITED KINGDOM FLIGHT SAFETY COMMITTEE ISSN 1355-1523
AUTUMN 2002
Making Every Mission Possible
Jeppesen continues to set the standard for
accurate and up-to-date flight information. We
are leading the way with innovative digital
charting solutions that can give your operation
distinct advantages in performance, safety, and
overall effectiveness.
Whether you use JeppView, JeppView FliteDeck,
or our digital charts in an integrated avionics
system, our goal is to provide you the highest
level of convenience and capability now and in
the future.
When it comes to mission critical flight
information, it’s nice to know you have
Jeppesen OnBoard.
chartingcharting
new courses.new courses.
For more information aboutJeppesen digital charts
visit us on the internet atwww.jeppesen.com
or call us:
1-800-621-5377or 303-799-9090
(Western Hemisphere)
+49 6102 5070(Eastern Hemisphere)
+61 3 9706 0022 (Australasia)
DigitalChartingSolutions
The Official Publication ofTHE UNITED KINGDOM FLIGHT SAFETY COMMITTEE
ISSN: 1355-1523 AUTUMN 2002 ON COMMERCIAL AVIATION SAFETY
contentsEditorial 2
Chairman’s Column 3
Preventing Hard Nosegear Touchdowns 4
Level Busts – ACEing the hazard 8
Safety Culture: The Ultimate Goal 12
Professor Patrick Hudson
Book Review 15
CRM: Celluar Resource Management 15
What to do about Maintenance Error Incidents? 16
Wg Cdr Dave McCormick
Safe and Sound 20
Merran Williams
On Track – Pushing your ideas forward 22
and looking for more!!
UKFSC Members List 24
FOCUS on Commercial Aviation Safety
is published quarterly by The UK Flight Safety
Committee.
Editorial Office:
Ed Paintin
The Graham Suite
Fairoaks Airport, Chobham, Woking,
Surrey. GU24 8HX
Tel: 01276-855193 Fax: 855195
e-mail: [email protected]
Web Site: www.ukfsc.co.uk
Office Hours: 0900-1630 Monday-Friday
Advertisement Sales Office:
Andrew Phillips
Andrew Phillips Partnership
39 Hale Reeds,
Farnham, Surrey. GU9 9BN
Tel: 01252-642695 Mobile: 07836-677377
Printed by Woking Print & Publicity Ltd
The Print Works, St.Johns Lye, St.Johns
Woking, Surrey GU21 1RS
Tel: 01483-884884 Fax: 01483-884880
ISDN: 01483-598501
Email: [email protected]
Web: www.wokingprint.com
FOCUS on Commercial Aviation Safety is
circulated to commercial pilots, flight engineers
and air traffic control officers holding current
licences. It is also available on subscription to
organisations or individuals at a cost of £12
(+p&p) per annum.
FOCUS is produced solely for the purpose of
improving flight safety and, unless copyright is
indicated, articles may be reproduced providing
that the source of material is acknowledged.
Opinions expressed by individual authors or in
advertisements appearing in FOCUS are those
of the author or advertiser and do not necessarily
reflect the views and endorsements of this journal,
the editor or the UK Flight Safety Committee.
The mention of specific companies or products
in articles or advertisements does not imply that
they are endorsed or recommended by FOCUSor its publisher in preference to any others.
1
UK FLIGHT SAFETY COMMITTEE OBJECTIVES
■ To pursue the highest standards of flight safety for public transport operations.
■ To constitute a body of experienced aviaition flight safety personnel available for advice and consultation.
■ To facilitate the exchange of urgent or significant flight safety data.
■ To maintain a liaison with all aviation authorities on matters affecting the safety of the flight-crew, ground-crew, the aircraft
and passengers.
■ To provide advice and assistance to operators setting up a flight safety organisation.
Editorial
2
Taking Advantage of Aviation Expansion in the UK
The recent announcement by theMinister for Transport that additionalrunway capacity will be provided in theUK and in particular in the South East ofthe country has been greeted with greatenthusiasm by the aviation industry. Bycoincidence the Freedom to Fly NationalConference 2002 was held on the 24thJuly, the day following the announcementby the government.
Commercial organisations are alwaysenthusiastic about an opportunity to makemore profit, after all, that is what businessis all about. The chance of expanding thebusiness does not present itself all thatoften and if the United Kingdom is tomaintain its position as the gateway toEurope then there is a real need to graspthis opportunity with both hands.
Wherever the new runways are to be builtthere is going to be a need for animprovement to the infrastructure. We cannot expect the existing infrastructure tocope, most of it is already working atcapacity. Road and rail links, terminalbuildings, hangar, and otheraccommodation will need to beconstructed. This is all good for theeconomy and job creation will bewelcomed by many but think for amoment about the following issues.
The environmental lobby has over theyears become very active and the delayin the construction of Terminal 5 atHeathrow is proof of how they slow downnew developments. Every environmentalactivist in the country will be jumping onthis bandwagon.
The national railway infrastructure iscurrently in a less than good state and willbe expected to provide resources to buildnew railway lines and facilities at any newor currently un-serviced sites chosen. Ifthis work is contracted to privateorganisations they will have to recruittrained staff. Where will they come from?Will this requirement draw staff from theexisting railway organisation? Who willtrain new staff if recruited?
More runway capacity inevitably meansmore aircraft operating in our airspace.This will require additional air trafficcontrollers. We are told that there isalready a shortage of trained andexperienced air traffic controllers and thatthe recruitment of new staff is not keepingpace with the current demand. Where willthe additional staff be found and wherewill they be trained?
The downturn in passenger trafficfollowing the 11th September 2001disaster meant the airlines and supportingservices shed staff in order to try tobalance their books. These folk have bynow found work in other industries andare unlikely to return to aviation becausethere is an upturn in the industry. Who isgoing to train additional aircraft engineersand supporting ground staff?
Adopting a positive attitude to thispotential expansion is very necessary andcould well have a long term affect on thefuture of aviation in the UK. It doeshowever require both the government andthe aviation industry to play their part inthis complicated process.
Firstly, we need to see the governmentprovide the necessary infrastructure forthe development of the selected areas. Tothis end there will be a very real need forit to exercise its so called “joined upthinking” so that all the involveddepartments plan adequately and delivertheir promises on time and to budget.Recent history has shown that we willneed to try much harder if we are toachieve this.
Secondly, there is a need for theoperators and service providers includingair traffic control to ensure that they trainsufficient people, to the correct standard,in a timely manner in order that we cantake advantage of this opportunity. Thismay mean that operators take a moreactive role in staff training of their serviceproviders. Failing to do so would meanthat the United Kingdom would lose its“Gateway to Europe” status and thebenefits that accrue from it.
UK FLIGHT SAFETY COMMITTEE OBJECTIVES
■ To pursue the highest standards of flight safety for public transport operations.
■ To constitute a body of experienced aviation flight safety personnel available for advice and consultation.
■ To facilitate the exchange of urgent or significant flight safety data.
■ To maintain a liaison with all aviation authorities on matters affecting the safety of the flight-crew, ground-crew, the aircraft
and passengers.
■ To provide assistance to operators setting up a flight safety organisation.
Chairman’s Column
3
Conflict
“The Russians were at fault” was theinitial speculative response of the mediaand the aviation “experts” to the tragicevents over Southern Germany on 1st July2002. The loss of 71 lives in the mid aircollision between the DHL Boeing 757 andthe Bashkirian Airlines Tupolov Tu 154 wasa stark reminder of the complexity andvulnerability of the aviation safety chain.As the professional Air Accident Inspectorsmoved in and began their task of siftingthrough the data and wreckage a differenttale of the causal issues involved in themid-air collision have begun to emerge.
The similarities between this tragedy andthe extremely close call between two JALaircraft over Tokyo on 31st January 2001should serve as a catalyst to a soul-searching debate within our industry. Bothevents have uncovered seriousshortcomings in the system; theopportunity to address those issuesshould not be missed.
The why’s and wherefores of why thesystem safety net defences (in the form ofidentifying the aircraft when they initiallyenter the controller’s sector, a switched offshort-term conflict alert system, oneperson in the control room, a busytelephone line, operating the 4-5 aircraft inhis sector on two different screens on twodifferent frequencies) were stripped awayon the night in classic “Reason Model”style will no doubt be explored andreported on in detail by the AccidentInvestigation team. This area will no doubtbe the focus of effort as these safety netsshould prevent us ever getting to a TrafficAlert and Collision Avoidance Systemwarning scenario.
But once those system safety nets werebreached the controller and the two crewswere placed in a situation where no oneperson actually had the total picture of theunfolding scenario. In those last secondsdid the controller and the two crewsactually make the “right” decision based ontheir own limited perspective of thescenario as they saw it? The controllerdoes not know if “his” aircraft are TCAS
equipped, if the TCAS is functioning and ifthe crew are responding correctly to anyTCAS warning. The crews of both aircraftappear to have responded to the situationin a manner aligned to their differenttraining and SOP philosophies. Thecontroller also only has a schematic planview of events with a digitised “label”providing the transponder data. In closeconflict situations this “label” informationfrom the two aircraft can merge causing ablurred image depriving the controller of asignificant part of the overall conflictpicture. Coupled to that is the refresh rateof the controllers screen which can be 2 – 5seconds behind the actual aircraft position.
If we started today with a clean sheet ofpaper and were tasked with designing arobust safety system from scratch perhapswe would consider addressing some ofthe following points:
■ ATC and TCAS separation are twoindependent and non-complementarysystems. What guidance should ICAOprovide about which separation systemhas the final authority, at what pointwould this authority become absoluteand how will that guidance bedisseminated and implemented?
■ Can TCAS tell us what the aircraft isabout to do or is it limited to telling uswhat the aircraft is actually doing atthat moment, i.e. is it a predictive or aresponsive system?
■ TCAS is the final safety net and itcomes into play when all the othersystem defences have been breached.Should the official guidelines reflectand reinforce this aspect?
■ If we do elect to rely solely on TCASwhat have we done to ensure thesystems integrity prior to each andevery departure. After all we still seeaccidents involving crossed flyingcontrols so how do we ensure that theTCAS system “sense” is as per thedesign intent and keep Murphy at bay?
■ Can TCAS adequately differentiatebetween high rates of decent andrapid closure to cleared altitudes andavoid false or erroneous TCAS alerts.
■ How can we ensure that the players allhave the same mental picture of theactivities in their immediate vicinity?
■ RVSM allows aircraft to fly moreaccurately to barometric references.Does this barometric accuracy (bydefault) potentially increase the risk ofcollision by placing aircraft at the samevertical reference point in the sky?
■ Is the TCAS Resolution Advisoryavoidance manoeuvre the optimum?Currently it’s a mirror-image pitchmanoeuvre. How does a mirror imageroll manoeuvre compare in bothevasive and passenger safety terms?
■ How much traffic is predicted over thenext 40 years, how can we develop asystem that can tolerate that muchtraffic and at the same time tolerateour own human idiosyncrasies? Isautomatic en-route guidanceappropriate?
■ How should the air lanes be laid out tooptimise traffic flow rates?
Recent CHIRP reports have discussed theperceived pressures on the system. Let’snot forget that our safety systems are onlyas good as the weakest link in that safetychain. Can the system cope with theweakest link?
by John Dunne, Airclaims
4
In recent years, there has been anincrease in the incidence of significantstructural damage to commercialairplanes from hard nosegear touchdown.In most cases, the main gear touchdownswere relatively normal. The damageresulted from high nose-down pitch ratesgenerated by full or nearly full forwardcontrol column application beforenosegear touchdown. Flight crews needto be aware of the potential for significantstructural damage from hard nosegearcontact and know which actions to taketo prevent such incidents.
Hard nosegear landings can produceheavy loads on the nosegear and itssupport structure. The resulting highstresses in the forward fuselage uppercrown and between the flight deck andwing front spar can cause the fuselagestructure to buckle. Appropriate actionsby the flight crew can help prevent suchincidents. Understanding which actionsare appropriate requires a discussion ofthe following:
1. Incidents of hard nosegear landings.2. Structural design requirements.3. Airplane control during landing and
derotation.
1. Incidents of hard nosegearlandings
Recent incidents of hard nosegeartouchdown share two characteristics.First, a relatively normal main geartouchdown is followed by full or nearly fullforward control column application, whichresults in overderotation and hard
nosegear contact. Second, the resultingairplane damage is significant andrequires lengthy and expensive repairs.(The location and type of damagedepend on the particular model ofairplane.)
Three representative incidents ofstructural damage incurred from hardnosegear contact with the runway aredescribed below.
An airplane was on approach to arelatively short runway in gustyconditions. The airplane experienced anormal main gear touchdown, but the fullforward column movement applied by theflight crew caused very hard nosegearcontact with the runway. Resultingdamage included displaced nosegear,bent axles, and a buckled and crackedfuselage structure (fig. 1). In addition, thecockpit door, forward lavatory doors, andforward passenger doors were jammedclosed.
Preventing Hard Nosegear Touchdowns
5
An airplane returned to the departureairport following an in-flight engineshutdown. The airplane landed firmly onthe main gear. Recordings by the digitalflight data recorder ended abruptlybecause of damage from the nosegearcontact; however, the last data pointshowed that considerable forward controlcolumn movement had been applied. Thenosegear was rotated aft and to the left ofits normal position, resulting in damage tothe lower fuselage and nosegear wheelwell area (fig. 2).
An airplane landing in strong crosswindsand turbulent conditions touched downon the main gear firmly, but notabnormally for the conditions. Theairplane bounced, full forward columnmovement was applied, and thenosegear contacted the runway veryhard, causing the nosegear to fail androtate upward in the aft direction. Thenosegear wheel assembly penetrated theelectronics bay and caused considerabledamage (fig. 3).
2. Structural design requirements
Boeing first recognized that heavy loadson the nosegear could damage thefuselage structure during the 727-200flight-test program in the 1960s. Flight-test data from various landings with highnose-down pitch rates led Boeing toenhance design requirements. These newrequirements enabled the nosegear andfuselage structure to withstand hardernosegear contacts. All Boeing-designedairplane models meet theserequirements.
The most recent design enhancementsinvolve the 767. The 767-300 nosegearmetering pin has been further optimizedto absorb the energy produced duringoverderotation events, thereby loweringthe load on the nosegear (fig. 4). Themetering pin device controls the flow ofhydraulic fluid within the nosegear oleostrut. The design enhancement wasincorporated into production airplanes inAugust 1994 and is available for retrofiton earlier 767-300s.
In addition, the upper crown stringers onthe forward fuselage of the 767-300 havebeen strengthened in the area wherebuckling often occurs followingoverderotation. This design enhancementwas incorporated into productionairplanes in January 1995. No retrofit isavailable for this design enhancement.
3. Airplane control during landing andderotation
In the last several years, there has beenan increase in the incidence of airframedamage from hard nosegear contacts.Examination of airplane flight recorderdata from these incidents revealed that, in
6
each case, full or nearly full forwardcolumn movement was applied betweenthe time of main gear contact and
nosegear touchdown. Figure 5 shows thatenough nose-down elevator authorityexists to damage the airframe structure if
the airplane is rapidlyderotated following maingear touchdown. This ispossible because themaximum nose-downelevator authority is designedto control go-arounds, whichrequire considerably morelongitudinal control than thelanding maneuver.
In response to recentincidents, Boeing hasproduced a training video toincrease flight crewawareness of the potentialfor both nosegear andairframe damage as aconsequence ofoverderotation. Based on asuccessful training effort in1994 and 1995 thatsignificantly reduced hardnosegear landings worldwidefor several years, the videoserves as a refresher forflight crews. The nine-minutevideo has been sent to all
Boeing airline customers. (For informationon how to obtain additional copies, referto the editor’s note at the end of thisarticle.)
Many factors influence a successfullanding and derotation. First, theapproach must be stabilized, as definedby the Flight Safety Foundation (table 1).If these criteria are not met at any timebefore touchdown, the flight crew shouldinitiate a go-around.
On approach, the speed-brake levershould be armed for landing and theautobrakes should be set for the runwaysurface conditions. The landing derotationshould be performed so that the flightcrew immediately starts flying thenosewheels smoothly onto the runwaywhen the main wheels touch down.
Flight crews can accomplish this bycontrolling the airplane pitch rate whilerelaxing aft column pressure. When heavybrake applications are needed, with andwithout autobrakes, increased aft columnpressure may be required to slow the
Airstaff Associatesin association with
Nigel Bauer & Associates
QUALITY MANAGEMENT FOR OPERATORS *JAR-OPS Quality Systems, documentation & auditing
5 days - LGW - 23 Sep, 25 Nov, 27 Jan
SAFETY MANAGEMENT SYSTEMSSMS course for air & ground operators
2 days - LGW - 29 Oct
AUDITING IN AN OPERATIONAL ENVIRONMENT *Air & ground operations auditing
3 days - on request or ‘in-company’
AUDIT IMPROVEMENT WORKSHOPExperience sharing & improvement of audit process
2 days - LGW - 31 Oct
QUALITY FOR SENIOR MANAGEMENTNew Course - JAR Quality Management Accountability
2 days - ‘in-company’ only
For further details including In-Company courses and consultancyor auditing services please contact:
Airstaff Associates:Tel +44 (0) 1780 721223 e-mail: [email protected] +44 (0) 1780 720032 www.airstaff.co.uk
Nigel Bauer & Associates:Tel +44 (0) 1243 778121 e-mail: [email protected] +44 (0) 1243 789121 www.nb-a.demon.co.uk
* Incorporating Nigel Bauer & Associates IRCA certificated Internal Auditor Training course
7
derotation rate. Flight crews should nothold the nose up in the touchdownattitude or allow the nose to rise becauseeither could result in a tail strike. Controlcolumn movement forward of the neutralposition should not be needed. Figure 6illustrates this smooth relaxation ofcolumn force as the nose is lowered. Thefigure compares the radio altitude, pitchangle, and control column forces for bothnormal landings and landings duringwhich airframe damage occurred. With the nose down, spoilers up, andthrust reversers deployed, the airplane isin the correct stopping configuration.This should be established as soon as ispractical during landing. Forward columnmovement should not be applied tolower the nose rapidly in an effort toimprove landing performance ordirectional control. The rudder providesthe required directional control until theairplane is at a relatively low speed, thenrudder pedal nosewheel steering is usedto complete the landing rollout. Largeforward column displacement does notimprove the effectiveness of nosewheelsteering and may reduce theeffectiveness of main-wheel brakingbecause it reduces the amount of weighton the main gear.If the airplane bounces, the flight crewshould hold or reestablish a normallanding attitude and add thrust asnecessary to control the rate of descent.Thrust need not be added for a shallowbounce or skip. When a high, hardbounce occurs, the flight crew shouldinitiate a go-around.
Summary
Flight crews can reduce the chances ofairplane damage from hard nosegearcontact by avoiding high derotation ratesand excessive forward column inputs. Inthe event of a hard landing, the flightcrew should report the event to the
engineering and maintenancedepartments so that the airplane can beinspected for potential structural damage.
Editor’s note: A Boeing training video,“Airplane Derotation: A Matter ofSeconds,” covers the material presentedin this article. Copies of the nine-minutevideo have been sent to all commercialairplane customers. Additional copies areavailable from the director of FlightTechnical Services, Boeing CommercialAirplanes, P.O. Box 3707, Mail Code 20-
97, Seattle, WA 98124-2207, USA;telephone 206-662-7800. Additionalinformation on hard nosegear contact isavailable in Boeing Commercial AirplanesFlight Operations Technical Bulletins nos.757-48 and 767-47, Feb. 1, 1993.AeroCopyright © 2002 The Boeing Company.All rights reserved.
Reprinted from AERO magazine bypermission of The Boeing Company
The Flight Safety Foundation suggeststhat operators consider adopting thefollowing definition of a stabilizedapproach: All flights shall be stabilizedby the 1,000ft height above touchdown(HAT) in instrument meteorologicalconditions and by the 500 -ft HAT invisual meteorological conditions.
An approach is considered stabilizedby the Flight Safety Foundation whenthe following criteria have been met:
■ The airplane is on the correct flightpath.
■ Only small changes in heading andpitch are required to maintain thatpath.
■ The airplane speed is not higherthan Vref + 20kt indicated airspeedand not lower than Vref.
■ The airplane is in the proper landingconfiguration.
■ The sink rate is not more than 1,000ft/min. If an approach requires ahigher sink rate, a special briefingshould be performed.
Table 1
■ The power setting is appropriate forthe configuration and not below theminimum power for approach asdefined by the airplane operationsmanual.
■ All briefings and checklists havebeen performed.
■ Specific types of approaches areconsidered stabilized if they alsofulfill the following:
i Instrument landing system – Theairplane must be flown withinone dot of the glideslope orlocalizer.
ii Category I or II – The airplanemust be flown within theexpanded localizer band.
iii Visual – The wings must be levelon final approach when theairplane reaches the 500 -ft HAT.
iv Circuling – The wings must belevel on final approach when theairplane reaches the 300 -ft HAT.
v Unique – A special briefing isrequired.
Elements of a Stabilized Approach
Source:Flight Safety Foundation Approach and Landing Accident Reduction(ALAR) Task Force
8
Since September 2001, a UK National AirTraffic Services ACE project team hasbeen examining level busts, searching fortheir causes, and planning strategies formitigation. At the 346th meeting of theUKFSC in May 2002, team members gavea presentation, describing the work doneto date, and explaining future plans…
Level busts have a real potential to claimlives. The mid-air collision near New Delhiin 1996 killed 349 people, and was theresult of a simple level bust. In the UK,there are approximately 300 level busts ayear, many of which do not result inlosses of separation, though all have thepotential for very serious outcomes.
What is a level bust? A level bust occurswhen an aircraft deviates from the correctlevel by more than 300ft. Normally verticalseparation between aircraft is 1000ft. Thisproject did not address level busts causedby TCAS events, nor instances of ‘late re-clearance’ where an aircraft passesthrough a new cleared level under ATCinstruction before stabilising at that level.
Modern ATC equipment, including ShortTerm Conflict Alert (STCA), high qualityradar, well-trained and experiencedcontrollers, and up-to-date aircraft fittedwith Traffic Alert & Collision AvoidanceSystem (TCAS) flown by competentcrews, should afford better protection.Despite this, a mid-air collision (not, itseems, the result of a level bust) occurredover Ueberlingen, Germany earlier thisyear. This proves that reliance uponpresent collision avoidance techniques isnot sufficient; accepting level busts andtrusting that a collision will be avoided isnot enough; new ways of eliminating levelbusts must be found.
Recognising the nature and potentialseverity of the hazard, UK National AirTraffic Services set up an ACE (Action for
Continuous Excellence) project inSeptember 2001. The Level Bust ACEteam, chaired by a Terminal Control WatchManager, included ATC managers andsafety investigators, representatives ofSafety Regulation Group, a human factorsscientist, and pilots from British Airwaysand easyJet. The project is sponsored atNATS board level, and has an unrestrictedbrief. An ‘ACE agent’ oversees andfacilitates the group’s work, providingguidance and administrative support, andensuring the group retains its focus andthat effective progress is made.
ACE projects address difficult problemsthat need to be solved. The process,developed from an analysis of industrybest practice in problem solving, usesmulti-disciplined teams and a structuredapproach, focusing on taking action andimplementing solutions.
Over a series of one-day workshops, theteam carried out a practical analysis of theroot causes of level busts, and prioritisedthese causes, before discussing andidentifying forty possible solutions. Thesesolutions were themselves prioritised andmatched against causes, in a matrix,before further work to specify solutions foraction took place.
Solutions identified for action rangedwidely in their simplicity of developmentand implementation, cost, and potentialbenefits in addressing issues other thanlevel busts.
Education and Awareness
The most important solution identified isthe need for an education and awarenessprogramme for ATCOs and pilots. Itbecame clear that many, if not all, levelbusts would be avoided if crews andcontrollers complied with currentregulations and ‘best practice’. A new
working group, incorporating members ofthe ACE project team, together with ATCtraining experts, is developing thiscampaign. The campaign will be rolledout through summer and autumn thisyear. It is hoped that a concerted effort toimprove SOP adherence, RTF discipline,and the use of ‘best practice’, may bringabout a significant improvement in thelevel bust statistics.
Alphanumeric Callsigns
Data from ATC safety investigationsidentified that callsign confusion, asignificant cause of level busts, is muchreduced by the use of alphanumericcallsigns. This solution is being furtherexamined, in order to establish that thereare no unknown risks associated withalphanumeric callsigns. Once this iscomplete, consideration may be given toseeking regulatory action to mandate theuse of alphanumeric callsigns.
RTF Phraseology
Much discussion took place regardingsome of the RTF phraseology in currentuse. Whilst it was felt that mostcommunication difficulties arose from poortechnique or assumption, rather than fromquestionable phraseology, someopportunities for improvement wereidentified. The words ‘Flight Level WunHundred’ have been used in place of ‘wunzero zero’ on a trial basis for some time,and with success. This phraseology hasbeen extended to other levels (200, 300,and 400). Other phraseology changes,such as the use of the word ‘degrees’ afterheadings, in order to differentiate fromflight levels, are still under consideration.
Level Busts – ACEing the hazard
9
The UK air traffic controller’s ‘bible’, theManual of Air Traffic Services Part One,gives a full account of standard RTFphraseology as used in the UK. Otherstates use slightly different phraseology.The Manual is available online at www.caa.co.uk/docs/33/CAP493_Part1.pdf,and Appendix E is the appropriatesection. The UK AIP also gives relevantinformation atwww.ais.org.uk/uk_aip/pdf/enr/2010103.pdf.CAP413 gives an overview of RTFtechniques at www.caa.co.uk/docs/33/CAP413.pdf.
Chart Deficiencies
Many pilots reported level busts as aconsequence of mis-reading SID charts.In particular, one chart manufacturer’s
depiction of step climb SIDs was felt tobe unclear. Representations have beenmade to the manufacturer concerned,and work is ongoing to achieve changes.
FMC Software Modification
Modern aircraft such as the Boeing 737-NG and Airbus family have an alertingfeature, which warns crews of climbing ordescending through transition altitudewithout re-setting the altimeters.Investigations have been carried out toascertain whether the FMC on olderaircraft (such as the Boeing 737 EFIS,757, and 767) could be modified toprovide a similar alert. Initial indicationsare that this is feasible, and presentationswill be made to FMC manufacturers indue course. One major operator has
found that their Boeing 737 EFIS fleetexperiences ten times more level bustswith altimeter setting errors as theircause, than their A320 family fleet.(Industry support for this proposal issought – interested parties should contactthe author [email protected]).
Distraction-Free Flight Deck
The project group identified thatdistraction, causing breakdown of SOPs,was a common factor in level busts, andconcluded that a distraction-free flightdeck is an environment in which levelbusts are less likely. Of course this is amatter of discipline, and some companiesalready operate a ‘sterile’ flight deck. Mostoperators are believed to be aware of theissue, and when the security implications
10
of ‘locked door’ policies were considered,it was decided not to pursue this solutionfurther for the moment.
Risk Analysis
It was decided that further formal riskassessment should be carried out. NATSSafety Analysis experts have studiedsubstantial amounts of radar data,evaluating the possible consequences oflevel busts involving aircraft passingthrough or levelling at incorrect levels, thisevaluation being carried out for variousbands of flight levels. Whilst this work isongoing, early indications are that theconclusions will enable betterprioritisation of mitigating techniques. Thework undertaken so far has alreadyidentified that some classes of level bust
are far riskier than others – some of theriskiest being those involving altimetermis-setting or mis-read SID charts. Thisknowledge allows greater priority to begiven to eliminating these errors.
Mode S Implementation, and sub-scale setting
Consideration of the manner in whichMode S might help to reduce the levelbust risk led to the project group’sidentifying that Mode S should beimplemented without delay. Moreover, itwas decided that Mode S selectedaltitude data could be of considerablymore value, if altimeter sub-scale settingwere also a down-linked parameter.Although the present Mode S plans donot incorporate sub-scale setting, NATS
has expressed adesire that it should.
London TMADesign
The design of theLondon TMA wasoften cited as beingcritical to the numberand nature of levelbusts. In particular,the fact that mostSIDs climb under theholding stacks,makes certain typesof level bustparticularlyhazardous. Whilst it isclearly a long-termobjective, the projectgroup felt that aschanges to the TMAare made any suchre-design shouldhave, as its aim theneed to avoid thetypes of interaction
between arrival and departure routes thatpresently exist. Such a re-design mightnot reduce the number of level busts, butwould certainly reduce the likelihood of alevel bust causing a collision.
Datalink Communications
Datalink communications (CPDLC)provide an opportunity to eliminate manyhuman errors in the communicationchain. However, other forms of humaninter-action with data received byelectronic means will take place, andcareful assessment of other areas of riskwill need to be carried out. CPDLC trialsare ongoing in various locationsworldwide, and it is hoped that a robustand reliable form of technology will bearrived at. The project team agreed thatCPDLC had significant potential.
Transition Altitude
The transition altitude in the UK variesbetween 3000ft and 6000ft, dependingupon location. These different values, andthe fact that our transition altitude isrelatively low, not only add to the risk of
School ofEngineering
Air Safety Management - an exciting new careerdevelopment opportunity Introducing a brand new course designed for those rising intheir careers in airlines, air traffic control, airports, aircraft andsystems manufacturing and related industries.
MSc Air Safety Management is for those who have an interestin or a significant level of responsibility for defining andimplementing the management of air safety in all areas of theindustry - not just operations, but also aircraft and equipmentdesign and manufacture. This course has been initiated inresponse to the needs of both the industry and the regulatoryauthorities. The course is:
• Businesslike - modules are taught by leaders in the industry• Flexible - modules last three mid-week days• Practical - study at your own pace to fit your own schedule• Outward looking - with interest coming from many
companies, there are excellent opportunities for networking• Modules run in London and Dubai
For further information, please contact: The Courses Officer,School of Engineering, City University, Northampton Square,London EC1V 0HB. Tel: +44 (0)20 7040 8112; fax: +44 (0)20 7040 8101; e-mail: [email protected]/atm
The University for business and the professions
11
level busts occurring, but make thosewhich do occur, more likely to result in anencounter with another aircraft. For thesereasons, the project group recommendedthe implementation of a 24000ft TransitionAltitude throughout the UK FIRs, incompliance with the European SingleSkies concept. A further working groupwill study this issue in due course, and itswork will be monitored.
Conclusions
Level Busts represent a significanthazard. Much of the mitigation relies uponhuman endeavour – there is notechnological remedy. The education andawareness programme mentioned abovewill aim to ensure that everyone exposedto the level bust hazard has a clearunderstanding of the problem, and knowshow to reduce their risk. This programme,
together with the other solutions raised bythe ACE team, may go some way toimproving the statistics, though greaterawareness will also lead to morewidespread reporting of non-safety-significant events. The only true measureof success available relates to level bustsinvolving losses of separation, which are
almost invariably detected. This statisticwill be closely monitored, and will prove ameasure of success of the ACE project’swork, and other work presently beingundertaken elsewhere.
50%45%40%35%30%25%20%15%10%
5%0%
% L
evel
Bus
ts
Causal Factors - all Level Busts(a level bust may have more than one cause)
Stepp
ed o
ut o
f SOPs
Mis
read
SID
char
t
Autop
ilot n
ot ca
ptur
ing le
vel
Lack
of e
quipm
ent f
or m
itigat
ion
1st le
vel g
iven
to d
epar
ture
cont
rolle
r
Call si
gn co
nfus
ion
Late
chan
ge to
SPS
Inpu
t erro
r to
FMS
Wor
kload
dur
ing o
pera
tiona
l diffi
cultie
s
Climbin
g/de
scen
ding
to a
hea
ding
Cleare
d FL1
10, D
esce
nt F
L100
Confu
sion
not c
heck
ed w
ith A
TCAir Transport Avionics Ltd
AVIONIC REPAIR OVERHAUL SUPPLY AND EXCHANGETCAS EQUIPMENT SUPPLIED AND INSTALLED, F.D.R. AND C.V.R. REPLAYS
8.33 KHz AND FM IMMUNITY MODIFICATIONS FOR ARINC AND GA AIRCRAFTFROM COMPS TO CALIBRATION, OUR LARGE CAPABILITY LIST IS AVAILABLE ON LINE
WWW.AIRTRANSPORT.CO.UK
JAR 145, FAR 145 ISO9002 Approved Workshops next to HeathrowFAA Repair Station CF5Y 777M JAR 145 No. CAA0016
Local Sales Representatives Worldwide
7-9 Willow Rd, Poyle trading Estate, Colnbrook, Berkshire SL3 OBX, England.Tel:- +44 1753 682 654 Fax:- +44 1753 684 166 A.O.G:- +44 603 457 / 67
E-Mail :- [email protected]
12
Safety management systems can makea big difference to any business. Thebenefits of taking a systematic approachto safety are obvious: the hazards of thebusiness are known, understood anddemonstrably controlled.
However, the possession of a safetymanagement system, no matter howthorough and systematic it may be, is notsufficient to guarantee sustained safetyperformance.
To proceed further it is necessary todevelop organisational cultures thatsupport higher processes such as“thinking the unthinkable” and beingintrinsically motivated to be safe, evenwhen there seems no obvious reason todo this. What is needed is a safetyculture that supports the managementsystem and allows it to flourish.
The bad news is that creating a healthysafety culture and keeping it alive requireseffort. The good news is that less effort isrequired in smaller organisations, andsafety cultures are worthwhile, both interms of lives and profits.
Safety for profit
There is considerable evidence that themost safety-minded companies are alsoamongst the most profitable.
Safety cultures are characterised by goodcommunication between managementand the rest of the company. This notonly enhances safety, but can elevatemorale and in some cases, productivity.As communication failures are alwaysidentified as a source of problems fororganisations, having a definitive focus forimproving communication can only resultin improved performance at all levels.
The other main reason why safetycultures make money lies in the fact that,if one has the safety enhancement that aneffective safety culture can provide, thenone can devote resources moreeffectively and take (profitable) risks thatothers dare not run.
What costs money is not safety, but badsafety management. Once themanagement of an organisation realisesthat safety is financially rewarding andthat the costs incurred have to be seenas investments with a positive return, theroad to a full safety culture is open.
What is a safety culture?
Every organisation has some commoncharacteristics we call its “culture”. Thesecharacteristics have often becomeinvisible to those inside, but may bestartling to outsiders coming from adifferent culture. The notion of anorganisational culture is difficult to define.I take a very general approach and seethe organisational culture as, roughly:“Who and what we are, what we findimportant, and how we go about doingthings round here”.
In one sense, safety always has a placein an organisation’s culture, which canthen be referred to as the safety culture,but it is only past a certain stage ofdevelopment that an organisation can besaid to take safety sufficiently seriously tobe labelled as a safety culture.
“What costs money is not safetybut bad safety management.”
From worst to best
Organisations can be distinguished alonga line from pathological to generative:
■ Pathological: the organisation caresless about safety than about not beingcaught.
by Professor Patrick Hudson
Safety Culture: The Ultimate Goal
PATHOLOGICALWho cares as long as
were not caught
REACTIVESafety as important, we do a loteverytime we have an accident
CALCULATIVEWe have systems in place to
manage all hazards
PROACTIVEWe work on the problems
that we still find
GENERATIVESafety is how we do
business around here
INCREASINGLYINFORMED
INCREASINGTRUST
13
■ Reactive: The organisation looks forfixes to accidents and incidents afterthey happen.
■ Calculative: The organisation hassystems in place to manage hazards;however the system is appliedmechanically. Staff and managementfollow the procedures but do notnecessarily believe those proceduresare critically important to their jobs orthe operation.
■ Proactive: The organisation hassystems in place to manage hazardsand staff and management havebegun to acquire beliefs that safety isgenuinely worthwhile.
■ Generative: Safety behaviour is fullyintegrated into everything theorganisation does. The value systemassociated with safety and safeworking is fully internalised as beliefs,almost to the point of invisibility.
A safety culture can only be consideredseriously in the later stages of thisevolutionary line. Prior to that, up to andincluding the calculative stage, the termsafety culture is best reserved to“describe formal and superficialstructures” rather than an integral part ofthe overall culture, pervading how theorganisation goes about its work. In theearly stages, top management believesaccidents to be caused by stupidity,inattention and, even wilfulness on thepart of their employees. Many messagesmay flow from on high, but the majoritystill reflect the organisation’s primaryproduction goals, often with “and besafe” tacked on at the end.
A true safety culture is one thattranscends the calculative level. Even so,it is at this stage that the foundations arelaid for acquiring beliefs that safety isworthwhile in its own right.
By constructing deliberate procedures, anorganisation can force itself into takingsafety seriously. At this stage the values
are not yet fully internalised, the methodsare still new and individual beliefsgenerally lag behind corporate intentions.However, a safety culture can only arisewhen the necessary technical steps andprocedures are already in place and inoperation.
An organisation needs to implement amanaged change process so it candevelop along the line towards thegenerative or true safety cultures. Thenext culture defines where we want to goto, the change model determines how weget there. (See “Change, for safety’ssake”, in box).
A cultural change is drastic and nevertakes place overnight. If a safetychampion leaves, there is often no-one totake up the fight and the crucial top-downimpetus is lost. But even without apersonnel change there aretwo threats to the successfultransition to a higher level ofsafety culture. One issuccess, the other failure.
In the case of success,effective processes, toolsand systems may bedropped, because theproblem is perceived to havegone away. In the case offailure, old-fashionedapproaches may be retrievedon the grounds that theyworked before. But in bothof these cases, the new, andoften fragile, beliefs andpractices may not havebecome sufficientlyinternalised to survivechanges at the top.
Management has to be trulycommitted to themaintenance of an advancedculture in the face of successand/or failure, and suchcommitment is rare.
Change is hard
One final underlying reason why culturalchange often fails to succeed is that thenew situation is unknown to theparticipants. If this is added to existingbeliefs, such as the belief that the currentsituation is as good as it gets, then thereis little real need to change and failure isalmost certain. If these failures are at thelevel of the workforce, then strongmanagement commitment may save theday. If the problems lie withmanagement, then there is little hopebecause they will enforce the oldsituation, which feels most comfortable,on the most proactive of workforces.
A colleague has likened this to learning anew golf swing by changing the grip andthe stance. At first the new position isuncomfortable. However, to improve your
For information contactMiSu International LimitedTel: +44 (0) 01638 780154Fax: +44 (0) 01638 781218E-mail: [email protected]
■ measures of excellence
■ independence
■ standards of quality
■ unsurpassed in experience
Development of Audit Systems & Procedures
Operation and Management of Audit Systems
Professional guidance on regulatory requirements
Operational cost reduction
Global benchmarking and audit specialistsMeeting the needs of Dynamic Industries
14
swing you have to trust the pro, do thework and be patient. (One advantage ofthis metaphor is that managers often playgolf and can transfer their experience oflearning a new swing to learning tomanage an advancing culture. Changeagents are like golf professionals: theycan help develop a person’s game, butthey can’t play it for them.)
Not too difficult
Given the financial inducements, why don’torganisations try and develop the mostadvanced forms of safety culture? Theanswer seems to be contained in the typeof culture the organisation has at the time.
Pathological organisations just don’t care.Reactive organisations think that there is
nothing better and anyone who claimsbetter performance is probably lying.They do what they feel is as good as canbe done. Calculative organisations arehard to move because they arecomfortable, even if they know thatimprovement is possible. Largeorganisations will inevitably be heavilycalculative unless active steps are takento counter that tendency.
Small organisations are more likely to beable to develop past the calculative stageand become generative. The greatestsingle barrier to success for smallerorganisations however, is the belief that itis too difficult. On the contrary, in thelong term, it is more difficult, anddangerous, not to.
Professor Patrick Hudson is recognisedinternationally for his work on safetymanagement systems. He is based atLeiden University in Amsterdam and is anactive member of the ICAO HumanFactors Awareness Group.
Reprinted with kind permission of AirSafety Letter Issue 2/2002
The following model was developed formanaging successful change withinorganisations. Its strength comes fromthe fact that it is intended to changeboth the individuals and theorganisations they constitute, andrealises that changing one without theother is impossible. The model putstogether the requirements for changeof individual beliefs that are so crucialin cultural development. It can apply tosafety, but it can also apply to anyother desirable development in anorganisation. It gives substance to theoft-heard cries for workforceinvolvement and shows where and whysuch involvement is crucial, especiallyin the later stages of evolution towardsa full safety culture:
Awareness
■ Awareness: Knowledge of a betteralternative than the current state.
■ Creation of need: Active desire toachieve the new state.
■ Making the outcome believable:Believing that the state is sensiblefor those involved.
■ Making the outcome achievable:Making the process of achievingthe new state credible for thoseinvolved.
■ Information about successes:Provision of information aboutothers who have succeeded.
■ Personal vision: Definition by thoseinvolved of what they expect thechange to be.
Planning
■ Plan construction: All peopleinvolved in the change create theirown action plan.
■ Measurement points: Indicators ofsuccess in the process are defined.
■ Commitment: Staff andmanagement sign up to the plan.
Action
■ Do: Start implementing actionplans.
■ Review: Progress is reviewed withconcentration upon successfuloutcomes.
■ Correct: Plan is modified wherenecessary.
Maintenance
■ Review: Management reviewschange process at regular (anddefined in advance) intervals.
■ Outcome: Checks to see whethernew values and beliefs havebecome second nature.
Change, for safety’s sake
15
Barry Strauch applies contemporaryerror theory to the needs of investigatorsand of anyone attempting to understandwhy someone made a critical error, howthat error led to an incident or accident,and how to prevent such errors in thefuture. Students and investigators ofhuman error will gain an appreciation ofthe literature, with numerous references toboth scientific research and investigatereports in a wide variety of applications,from airplane accidents, to bus accidents,to bonfire disasters. The book:
■ includes an easy to follow step bystep approach to conducting errorinvestigations that even those new tothe field can readily apply.
■ summarizes recent transportationaccidents and human factors literatureand relates them to the cause ofhuman error in accidents.
■ provides an approach to investigatinghuman error that will be of interest toboth human factors psychology andindustrial engineering students andinstructors, as well as investigators ofaccidents in aviation, masstransportation, nuclear power, or anyindustry that is to the adverse effectsof error.
Using his 18 years of experience as anaccident investigator and instructor ofboth aircraft accident investigationtechniques and human factorspsychology, the author reviews recenthuman factors literature, summarizesmajor transportation accidents, andshows how to investigate the types oferrors that typically occur in high riskindustries. He presents a model ofhuman error causation influenced largelyby James Reason and Neville Moray, and
relates it to error investigations with stepby step guidelines for data collection andanalysis that investigators can readilyapply as needed.
Hardback 1 84014 9310 £45.00
Book Review
Investigating Human Error: Incidents, Accidents and Complex Systemsby Barry Strauch
Commercial airline passengers arereminded during every preflight briefing toturn off electronic devices that mayinterfere with aircraft systems – includingcell phones. Now here’s a report thatsuggests what’s good for the cabin, isgood for the cockpit, too.
The Captain filed the flight plan late so Icould not pick up the clearance until just
before the passengers showed up. Wewere issued the SID with transition. I didnot have time to look up the SID becausethe Captain was in a hurry to taxi. Hewas making calls on a cell phone whilehe taxied out so I still could not talk tohim. Tower put us in position and holdon Runway 30L while I yelled for theCaptain to turn off his cell phone. Hefinally did when they cleared us fortakeoff. We never did brief the takeoff orthe SID.
Once airborne, the Captain asked mewhat we were supposed to do. I triedreading the text and gave him some ofthe instructions as I read them. I gotconfused at one point about how to jointhe transition and told the Captain. Heturned the wrong way. ATC asked whatradial we were trying to join. They told usto turn right 140° to continue the SID and
to call Approach once on the ground.
This would never have happened if theCaptain had not been in such a hurry toget going, and if he had been payingattention to flying duties while taxiing out,instead of talking on his cell phone.
We’re sure this type of event is rare, but itnonetheless illustrates the importance ofeffective cockpit management skills (andtraining). In effective CRM, flight crewsmake flying duties their first priority, andFirst Officers participate constructively inresolving problems.
With acknowledgement to NASA’s AviationSafety Reporting System. Callback #249,Mar 00
CRM: Cellular Resource Management
16
What to do about Maintenance Error Incidents?
“Maintenance error” is not a popularphrase amongst aircraft engineers. Weare the kind of people who live by hardfacts, drawings and numbers. Conceptslike people making mistakes are easilydealt with by others, but in maintenancewe train our personnel and writeprocedures to ensure that mistakes donot happen. The fact that a competentmaintainer following a good procedurecould make a mistake is a figment of
nightmares to most engineers. However,people make mistakes. It is an inevitableconsequence of being a human being!Nothing we do can prevent all mistakesabsolutely. Therefore, error tolerance is abasic characteristic of safe systems ofwork. Despite trying to design errortolerant maintenance systems,maintenance error incidents will occur.This article is about how you might dealwith maintenance error incidents. I’d like
to start by assumingthat this routinemaintenance errorhas not caused adisaster. In that case,other procedures maywell be forced on youby the AAIB and, inthe worst case, thecoroner!The first problem isfinding out that anundesirable incidenthas occurred. If theincident hassignificantconsequences, I haveno doubt that youhave a system inplace to make youaware. However,most maintenanceerror incidents couldgo unreportedbecause theconsequences wouldbe mitigated bydetection. For
example, a failure to seat an electronicbox correctly may well be discoveredduring pre-flight checks and rectifiedbefore the departure time. Would youknow? Is the reporting system detailedenough for you to find out? Even if it is,would you investigate such an incident?You should because finding out why thisincident occurred and preventingrecurrence could avoid a more seriousincident later. Systems for developingopen reporting cultures could be thesubject of another article. This article isabout a system to deal with reportedmaintenance error incidents.
Having discovered that an incident hasoccurred, you must always initiate aninvestigation. At this stage, the key is notto focus on the individual or theconsequences of his action. In almostevery case of maintenance error, there willbe a sequence of events and decisionsleading to the error. It is useful toconstruct a flow diagram to record whathappened and why. The diagram opositeshows the sequence of events leading toa hypothetical maintenance error incident.(I admit that the hypothetical event isbased on a picture and a one linedescription of a US military aircraftincident, but I have used my imaginationto help make a few points.) The aircrafthad come out of deep maintenance somedays before and had flown a few tripsbefore the structural failure of an aircraftwing during refuel. I am convinced that, ifthis was to happen to one of your aircraft,your immediate reaction would be similar
by Wing Commander Dave McCormickSO1 Engineering Policy, Defence Aviation Safety Centre
I know many of you will find this hard to believe, but I started writing this article before the Potters Bar rail accident.Currently, the investigation is underway and, as usual, the media are after a culprit. Initially, they were happy to blamethe Secretary of State for Transport; now, they are looking for the rail maintainer who made the mistake. In my opinion,
the question that society must ask is summarised below.
Which is the higher priority: preventing recurrence or taking punitive sanctions against the individual whomade a human error?
FOCUS Subscription Application
UK Flight Safety CommitteeThe Graham Suite, Fairoaks Airport,
Chobham, Woking, Surrey. GU 24 8HXTel: 01276-855193 Fax: 855195
email: [email protected]
Name
Job Title
Company Name
Address
Tel/Fax No
Nature of Business
Please enter my subscription to FOCUS from the next issue. I enclose a sterlingcheque made payable to Flight Safety Committee or invoice me for the annual
Subscription Rate of £12.00 for 4 issues.Plus P & P £2.60 for UK - overseas P & P on application.
Signature
17
to mine: “What was the pratt doing therefuel up to?” Instinctively, we tend toblame the unfortunate individual at thescene of the incident. Reality can be verydifferent, as in this hypothetical case, andwe must restrain our instinct and producean accurate sequence of events. In thediagram, boxes portray the events thatoccurred within the sequence. Alwaysstart with the undesirable incident as thefirst event box. The lines portray thereverse sequence and show the linkbetween events and their causes. Inproducing your sequence of events, try toapply these 5 rules:
Do not allocate or imply blame withinthe sequence. This can lead tounreasonable conclusions. So canemotive language, so don’t use it.Statements like “the tradesman failedto…” or “the supervisor did not deem
to…” add no value to your investigationand colour the readers’ views. It wouldbe much better to say “the tradesman didnot…” in one box and explain why in thenext!
Ensure each link in the sequence isclear and logical. There should be noreason for the most inexpert reader to askwhy one event leads to another.
Ensure that the sequence iscomprehensive but concise. It is easyto overlook contributions that onlyaggravate the outcome or are not theprime cause of the incident. Within theconstraints of the rules, include onlyrelevant facts. Never use 2 words whereone would do!
Ensure that no human error event isat the end of a sequence. In thiscontext, human error includes any failureto follow a procedure. You must alwaysexplain fully why the human erroroccurred. Record the reason of theindividual who made the error; not yourown reason!
Stop the sequence when there isnothing left to investigate. You mayfind that the sequence is just recordingnormal events or comes to a natural end.Do not keep recording the sequence forthe sake of it.
Once you have completed thisinvestigation, you should have defined thecircumstances of the incident and thereasons for it. Highlight the classificationin some way. In the example, I have usedthe following code:
18
Serial(a)
1
2
3
4
5
6
7
8
9
10
11
12
13
Recommendation(b)
Company executives must emphasise importance ofairworthy product as well as timely output to all staff.
Technical staff must have importance of followingestablished work procedures and drawings
explained in terms of airworthiness of product.
Continuation training should emphasise the level ofrecording required on aircraft technical
documentation including need for any deviationsfrom established procedures or drawings to be
recorded.
Company procedures to include requirement tofollow established technical procedures and
drawings unless alternative approved by ChiefEngineer.
Company policy to define level of recording requiredon aircraft technical documentation including needfor any deviations from established procedures or
drawings to be recorded.
Company procedures to require repair drawings tobe vetted by engineering plans section prior to issue
to production department.
Company policy and continuation training to includeimportance of workforce taking responsibility for
arriving at work fit for duty in terms of alcohol, drugs,health and fatigue.
This incident and the lessons identified should bepublished widely to all departments in the company.
All staff in engineering planning section to be trainedto request repair drawings from OEM so that
holidays have no impact on output.
Driver continuation training to emphasise all reasonsfor not parking under aircraft wings.
Company procedures to require documentationdelivered after normal office hours to be held incustody by company security until start of next
working day unless alternative approved bynominated managers.
When repair drawings requested from OEM,engineering plans section should specify materials
available at the work location and ask for use ofthose materials if possible.
Lighting level in production hangars to be improvedto achieve HSE published inspection standards.
Importance(c)
Vital
Very Important
Very Important
Very Important
Very Important
Important
Important
Important
Important
Not Important
Not Important
Not Important
Not Important
Priority(e)
1
2
2
3
3
4
4
4
5
6
6
7
8
Ease(d)
Easy
Easy
Easy
Easy
Easy
Easy
Easy
Easy
Difficulty
Easy
Easy
Difficult
Very Difficult
19
The original undesirable event = blackwith white print.
Normal and acceptableevents = green with white print.
The primary causal chain that made theundesirable event occur = red with whiteprint.
The contributory causes that set up therest of the circumstances for theundesirable event = yellow with blackprint.
The aggravating causes that made theoutcome of the undesirable event worsebut did not contribute to it = amber withwhite print.
Now all you have to do is look at theevent box at the end of each sequenceand decide what you could do to theorganisation to prevent that event fromcontributing to the incident. For someevents, there will be no action that willsuffice; in these cases, try the previousevent. Again try not to focus your actionson any individual. For example, if a maninvolved in an incident has an inadequateunderstanding of how the system works,the same is probably true of otherpersonnel in your organisation. The issuenow becomes one of organisationalcompetence requirements and needs to
be addressed accordingly.
Once you have recorded all thepreventative options, rate them forimpact; that is, the ability of the actionconcerned to prevent recurrence of thefinal incident. Now rate them for howquickly they could be implemented ifaccepted. Record them in a tableshowing priority for implementation basedon importance and ease; a table mightlook like the one oposite for the incidentin the example sequence.
You have now done your investigationfocusing on preventing recurrence ratherthan blame. Subject to the appropriateline managers implementing yourrecommendations, the risk of recurrenceof this incident should be significantlyreduced.
I should include a “health warning” aboutmalicious acts and wilful negligence.Hopefully everyone will know what I meanby malicious acts. In my parlance, wilfulnegligence involves and individual being
aware that he has a duty to perform atask, being competent to carry out thetask and deciding not to carry out thetask or carrying out the task without due
care and attention. In the case ofmalicious acts and wilful
negligence, I am in no doubt that the
company disciplinarypolicy should beimplemented, possibly
with employment sanctions. Inmost incidents, individuals making
errors are involved in other behaviour,such as errors of judgement orunintentional negligence. In these cases,organisational cures are more effective inpreventing recurrence than sanctionsagainst the individual. Remember, youcan not deter an unintentional act! Also,using discipline against an employee tomotivate others to take more care onlyworks temporarily and may antagoniseyour staff.
All this is based on my learning in the last21/2 years. I apologise to ProfessorReason, David Marx and many otherleading experts in the field of humanfactors for plagiarising their ideas and forany misinterpretation they perceive;however, it works for me!
The views expressed in this article are notthose of the Ministry of Defence, the RoyalAir Force or the Defence Aviation SafetyCentre, but are the opinions of the authoronly.
20
It only took a moment. Alan turned hisback on the trolley he was using to loadfreight into the wing locker, and the prop-wash from a nearby plane sent the trolleyrattling across the tarmac towardsanother plane that was about to taxi.
Fortunately, he turned in time to grab thewayward trolley and prevented what couldhave been an expensive incident forQueensland regional airline, Skytrans. Ifthe trolley had crashed into a propeller,the company estimated damage couldhave cost more than $50,000.
Worried about the possibility of anotherincident, Alan took immediate action toensure the trolley was chocked andunlikely to move when loading. He alsotook his concerns to Skytrans’ safetymanager, who gave a commitment toresolve the problem and asked Alan toraise the issue at the airline’s next safetycommittee meeting.
Alan did so, and told other members ofthe committee it would cost only $200 pertrolley to fit handbrakes. All were inagreement. For the cost of just $600, thecompany has potentially savedthousands of dollars in repair bills andlost aircraft time.
According to CASA Aviation Safety
Promotion general manager, Mike Smith,Skytrans is an excellent example of anaviation business that has tailored asuccessful safety management programto fit is needs.
“Skytrans has truly benefited fromformalising its safety managementsystem,” Smith said. “There are directcost benefits in both flight operations andmaintenance. There is a real sense ofownership which reflects a prosperingsafety culture.”
Skytrans managing director, DavidBarnard has seen this firsthand. “Havinga safety management system for Skytranshas been absolutely great,” he said. “It’sallowed input from staff into safety andoperational matters. It provides us with apositive marketing tool. It helps createbusiness opportunities by providingcustomers with a known high level ofservice and safety.”
Managing director of Network Aviation,Lindsay Evans agrees. We believe thesafety management system we have inplace is actually saving us money thoughbetter practices,” he said. “The peoplewho work for us have a betterappreciation of safety in general.”
A small business servicing remote areas
of Western Australia, Network has beenrunning a safety management system forthree years. The company won anAviation Safety Foundation Australiaaward this year for safety excellence.New employees spend half a day of theirtwo-day induction program learning howthe program works and the contributionthey can make to workplace safety.
Positive morale: “We emphasise thatstaff will not be penalised and no punitiveaction will be taken if they put somethingforward that might be a little delicate,”Evans said. “That means we’vesucceeded in having free flowinginformation up and down the chain.”
Chief pilot, Richard Hurd concurs. “Theemployees now have a lot of trust andbelieve when they report something that itwill be looked at carefully,” he said.
Hurd has seen many benefits flow fromNetwork’s safety management system,including the development of acomprehensive business plan.
“Having it in place has helped us gainadditional contracts, created a positivemorale within the company and made it asafer and more enjoyable place to work,”he said.
Mike Smith is not surprised at theadvantages Network has received fromsafety management.
“Their system has developed from areactive one, to one which actively seeksto identify hazards and put in placeappropriate solutions.”
Smith sees company-wide commitmentas the key to successful safetymanagement. “Everyone from the CEOdown needs to be involved,” he said.
“One of the failings that I see with
Safe & Soundby Merran Williams
21
systems in some companies is that theyhave the process to identify the hazard,they have a process to decide whatthey’re going to do about it, if anything.But they don’t have good feedbackmechanisms that go back to the reporterand the rest of the organisation. Thisfeedback needs to say: We’ve identifiedthis hazard and have put in place thismitigation for it. Or, we identified thishazard and we are not going to mitigatebecause re recognise that this is a riskthat we’re going to accept in the conductof our business. It is this feedback loopthat is vital if staff are going to have anongoing commitment to the system.”
Business information: Smith saysbusinesses might be surprised at whatthey find when they develop a safetysystem. “Putting in place a good safetymanagement system gives you a formalprocess to review the safety of yourbusiness,” he said. “In doing this youfind out an awful lot of other informationabout how your business is running, suchas what things are costing you moneyand the opportunities for savings.”
Smith points out that some companieswill only allow their employees to fly withairlines that have a formal safetymanagement system in place.
“The mining industry is one that is keen tosee the systems in place, largely becausethey have them themselves,” he said.“The concept of safety management fromthe oil and gas industry was furtherdeveloped by the industry following anaccident on a North Sea oil rig (PiperAlpha).
“The subsequent inquiry further the viewthat companies have safety systems inplace for the benefit of the organisation,its staff, customers and shareholders, notjust the regulator.”Safety management expert, James
Reason, sees effective safetymanagement as more about thecompany’s mindset and they way it treatsworkplace hazards, than about cost.
“If you’re a small operator then thereis going to be a call upon resources,but it doesn’t have to be a call upon
money... .You have tremendousadvantages if you are small.”
“If you’re a small operators then there isgoing to be a call upon resources,” heacknowledged. “But it doesn’t have to bea call upon money, because you’re aflexible organisation – you havetremendous advantages if you are small.
“What you’ve got to do is build a systemthat’s not something which seems like anextra job to do. It should be integratedinto the actual management process.
“Ideally the safety system should behomegrown and full integrated into thecurrent task so that in a year’s time itdoesn’t feel like doing it is an extra job;it’s part of how you do your business.”
Sunstate Airlines Qantas Link, a regionalpassenger airline providing servicesacross Queensland, has found this to bethe case. It formalised its safetymanagement system in 1996 with theappointment of a flight safety manager.Former flight operations manager andchief pilot, Arch Van Dongen says safetymanagement has become an integral partof managing the airline.
“I don’t think you can afford to run abusiness without managing safety,” hesaid. “I don’t think it costs that much. Itcosts some time and resources butcertainly the alternatives aren’t verypalatable. And once you have the systemin place, it becomes easier to manage
and gives you a lot of useful informationabout running your business.”
It’s about people: Chief engineer, PaulLee-Horn likes the unity that hasdeveloped within Sunstate since theimplementation of safety management.
“What I’ve found is the success of thesafety management system has been theability to bring all the departments of theairline together with a single goal,” hesaid. “That is, to achieve the best safetyrecord possible for this airline.”
For Mike Smith, safety management isabout people. “It’s about makingorganisations, big and small, value theinputs of their people and actually dealwith them in a way that addresses thehazards and safety problems,” he said.“Many companies have experience withquality systems and there is a lot ofcommon ground here. I simplify thedistinction between a quality system anda safety system by observing that aquality systems is about product andprocess, a safety system is aboutpeople.”
He sees integrated safety managementas the next big step in aviation safety.“We’ve concentrated in aviation on notharming our passengers and our crew,”he said. “Safety management takes thata step or two further, and the spin-off ofimproving the integration of a safetysystem within your business is makingsavings that flow to the bottom line.”
Reprinted with acklowedgement to FlightSafety Australia.
22
Since the project got under way late lastyear the On Track team have been veryencouraged by the response from the GApilot and the ATC community. Some 800inputs from you by fax, telephone, e-mailand, of course, the ‘Your Say’ section ofour website at www.flyontrack.co.uk whichgets a lot of good opinion and some hotair going!! You’ve come up with somegreat ideas about the reasons behindinfringements, but most important, soundadvice from you on how to improve thesystem and avoid the problem.
While you have been busy suggestingideas, the team have been running yourinputs through the various CAA and NATSagencies, such as the Safety RegulationGroup, the Directorate of Airspace Policyand LATCC. We have also been incontact with other companies andagencies such as Garmin and theAustralian CASA to discuss products thatcould be relevant to the solutions youthink we need to adopt. Finally we havebeen spreading the word at symposiumsand seminars throughout the country. Ifwe have not come your way yet and youwant to see us, please let us know.Because we are independent from theCAA we can delve as deeply as we likeinto any agency, and it’s good to reportthat we have so far received a mostpositive response from all our contacts.
Here are some of the main ideas that youhave given us so far. Although it’s tooearly for many results we can give yousome idea of the response we’ve had toyour suggestions:
LARS
■ Dedicated GA LARS controller at eachof the major airfields
■ US style Flight Following Service(frequency + radar + squawk)
■ Specific radar service to cover thenotorious Stapleford/Stansted/Lutonrouting
Progress - Funding for LARS beingreviewed – report:www.aviation.dtlr.gov.uk/lars/index.htm.
ATC
■ Review Class A airspace for possibledowngrade to Class D
■ Review base heights of airspace togain more GA airspace especiallyStansted stub
■ Review Regional Pressure Settingprocedures to avoid verticalinfringement
■ Improve communication between ATCand the GA community
Response - ATC are aware of thecommunication problem with GA trafficand are supporting all suggestions yougave to improve this – the initial messagesuggestion was theirs. They will bereviewing the length of the long messageat the next R/T meeting. DAP willcontinue to review airspace. Stansted willbe looked at again!
Maps and Charts
■ Strong support for an on-line chartfacility – freely downloadable to coverthe “hot areas” around London,Manchester and Southampton. TheAustralian VFR guide and CD ROMsuggested as an excellent role model
■ ICAO codes and frequencies shouldbe shown on charts next to airfields
■ Single sheet (A4) map size to coverLondon area – freely downloadable
■ Specific Mil maps with informationonly required below FL100 or FL55
■ VFR routes (e.g. Note 8 route) shouldbe better marked with downloadableguide & pictures
■ Zones and Control Areas should beredrawn so that boundaries followgeographical features
■ Circular boundaries for Zones andAreas (easy to read and avoid whenusing DME)
Result - A very positive response here. Aseries of prototype charts and otherproducts have already been started.
GPS
■ CAA should recognise GPS and issueguidelines for its use and a trainingsyllabus
■ Instruction manuals are too complex.Need to be simple and practical
■ Ensure all data bases are updated –possible CAA involvement to monitor
■ GPS training to be introduced afterbasic PPL navigation instructioncomplete
■ Pilots should use other navaids(including a map!) in addition to GPS
Result - Flight examiners are in theprocess of drafting guidelines forapproved GPS courses. The next step willbe for schools to produce a syllabus.Some schools already do informal GPStraining
On Track - Pushing your ideas forward and looking for more !!
23
R/T
■ Standard of R/T is poor – a practicaltraining syllabus and a basic PPL R/TPamphlet are essential
■ Sub-standard training in someschools
■ PPL confidence level when talking toATC is low - performance is poor
■ Schools should encourage studentsto use the radio as soon as possible
■ Calling ATC - always use the initial R/Tmessage – it gives you a betterchance of getting a service
■ Long R/T message needs to beshortened
Result - R/T Ground training will bereviewed. PPL R/T pamphlet beingpursued.
Navigation
■ Review JAR PPL syllabus for basicNavigation training
■ Ensure minimum number ofMATZ/CTA/CTR crossings are taught
■ Formalise navigation ground training-don’t rely on self study
Result - Publicity to be given to schoolson importance of comprehensivenavigation training to teach good basicnavigation - particularly to include Zoneand MATZ crossings
Communication
■ A GA VFR start up pack should beissued free to all new PPLs
■ AIC format for Air shows & Ralliesneed an overhaul. They’re toocomplex and not user friendly. Foreign
guides concentrate more on assistingthe pilot with colour illustrations /frequencies etc.
Result - CAA has recently introduced aSafety Information Book.
The Australian system showing easierrouting information has been adopted byDAP and they will be producing their ownversion.
So far so good, but there is a long way togo - the On Track team will continue topush forward your suggestions. However,we are still looking for more ideas fromyou in time for our report at the end ofthis year.
Please contact us:Website – www.flyontrack.co.uke-mail – [email protected]/fax -0800 328 0792Mail – “Freepost Fly On Track”Dave, Mike & ChrisThe On Track Team Pilots
ExperienceWith nearly thirty years experience, we can easilyclaim to be one of Europe’s leading providers of aircraft services.
Air ContractorsThe Plaza, New StreetSwords, Co. DublinIreland
Tel +353 1 812 1900 Fax +353 1 812 [email protected]
www.aircontractors.com
24
Full members
ChairmanAirclaimsJohn Dunne
Vice-Chairmanflybe british europeanStuart McKie-Smith
TreasurerAir 2000Capt. Martin Pitt
External Affairs OfficerRAeSPeter Richards
Aer LingusCapt. Tom Croke
Aerostructures HambleDr. Marvin Curtiss
AIG AviationJonathan Woodrow
Air ContractorsCapt. Tony Barrett-Jolley
Air MauritiusCapt. Francois Marion
Air ScandicPaul Ridgard
Air SeychellesCapt. Curtis Allcorn
Air Transport AvionicsColin Buck
ALAEDave Morrison
Astraeus LtdCapt. Nick Carter
BAA plcFrancis Richards
BAC ExpressCapt. Steve Thursfield
BAE SYSTEMS Reg. A/CDan Gurney
BALPACarolyn Evans
bmi regionalCapt. Steve Saint
British AirwaysSteve Hull
British Airways CitiExpress LtdCapt. Ed Pooley
British InternationalCapt. Terry Green
British Mediterranean AirwaysRobin Berry
CAADave Lewis - MRPSChrys Hadjiantonis - Safety Data Dept.Brian Synnott - Flight OperationsAlison Thomas - Intl. Services
Cardiff International AirportGraeme Gamble
CargoLuxCapt. David Martin
Cathay PacificCapt. Richard Howell
Channel ExpressRob Trayhurn
CityJetCapt. Mick O’Connor
Cougar LeasingShaun Harborne
DHL AirPeter Naz
DragonairAlex Dawson
Eastern Airways UK LtdCapt. Jacqueline Mills
EasyJetCapt. Tim Atkinson
Emerald AirwaysCapt. Roley Bevan
European Aviation Air CharterDavid Wilkinson
EVA AirwaysAlex Reid
Excel AirwaysPeter Williams
FlightLineCapt. Derek Murphy
GAPANCapt. Chris Hodgkinson
GATCORichard Dawson
GO FLY LtdCapt. Simon Searle
HeavyLift CargoCapt. Mike Jenvey
Independent Pilots AssociationCapt. Mike Nash
Irish Aviation AuthorityCapt. Bob Tweedy
JMC AirlinesCapt. Graham Clarke
LAD (Aviation) LtdSteve Flowers
LoganairDoug Akhurst
London-Manston AirportWally Walker
Maersk AirCapt. Robin Evans
Manchester Airport plcPeter Hampson
Middle East AirlinesCapt. Mohammed Aziz
Monarch AirlinesCapt. Gavin Rowden
MyTravelCapt. Tom Mackle
NATSPaul Jones
PrivatAirCapt. Boris Beuc
RyanairCapt. Gerry Conway
Members of
25
SBACJohn McCulloch - SecretariatBryan Cowin - BAE SYSTEMSVic Lockwood -FR Aviation
Schriener AirwaysArnoud Schriener
ServisairEric Nobbs
Shell AircraftCliff Edwards
The Boeing Co.Edward Berthiaume
TRW Aeronautical SystemsKeith Joyner
Virgin Atlantic AirwaysCapt. Jason Holt
Willis AerospaceIan Crowe
Group members
bmi british midlandCapt. Ian Mattimoe
bmi british midland Eng.Peter Horner
Bristow HelicoptersCapt. Derek Whatling
Bristow Helicopters Eng.Richard Tudge
Britannia AirwaysJez Last
Britannia Airways Eng.Adrian Vaughan
CHC ScotiaCapt. David Bailey
CHC Scotia Eng.Colin Brown
EurocypriaCapt. Constantinos Pitsillides
Cyprus AirwaysCapt. Spyros Papouis
FLS Aerospace (IRL)Frank Buggie
FLS Aerospace (UK)Andrew Hoad
flybe british eropeanStuart McKie-Smith
flybe british european eng.Chris Clark
Ford AirF/O Paul Stevens
Ford Motor Co. EngSteve Laven
GB AirwaysCapt. Aaron Cambridge
GB Airways Eng.Terry Scott
KLM ukDean Godfrey
KLM uk Eng.Andy Beale
Lufthansa Cargo AGCapt. Nigel Ironside
Condor/Lufthansa & CityLine
MODDASC Col. Arthur GibsonDASC Eng.HQ STC MOD - Sqn Ldr Jeff Collier
RAeSPeter Richards
RAeS Eng.Jack Carter
Co-opted Advisers
AAIBPhil Gilmartin
CHIRPPeter Tait
GASCoJohn Campbell
Royal Met. SocietyDr John Stewart