High Potential Runway Incursion at Shanghai 11 Oct 2016
High Potential Runway Incursion at Shanghai 11 Oct 2016 China Eastern Airlines Airbus A320-214 B-2337 (flight MU5643) had commenced takeoff from runway 36L Shanghai-Hongqiao Airport, China, just after noon local time. China Eastern Airbus A330-343 B-6506 (flight MU5106), which had landed on runway 36R, exited 36R via B3, crossed taxiway Bravo and entered the active departure runway via H3, 2400 m from the point where the A320 commenced takeoff. Preliminary reports suggest the A330 may have been cleared initially to cross runway 36L but had then been instructed to stop and hold short. The A320 is believed to have been travelling at 110 knots when the incursion was spotted. The A320 crew advanced the throttles and rotated about 300 meters before the crossing A330. The Civil Aviation Administration of China (CAAC) report that the separation was just 19 m vertical and 13 m horizontal and have released a reconstruction: UPDATE 22 October 2016: The local press report that just days into the investigation a wide range of disciplinary action has been taken: “The air traffic controllers on the control tower were to blame for the ‘serious accident symptoms,’ who forgot the planes’ movements and gave wrong orders to the pilots,” the administration said. The licenses of the controllers, who were manning the commanding and monitoring seats, were revoked — in one of the cases for life. The controller in the commanding seat was banned from ever undertaking any air traffic control jobs, the administration said. Thirteen officials with the East China Air Traffic Management Bureau as well as the bureau’s air traffic control center and safety management department were either given Party warnings, serious warnings, had demerits recorded or faced losing their positions, the administration added. It is not clear if any systemic lessons will be learnt and improvements made however. UPDATE 27 October 2016: Unconfirmed reports claim that the A330 received a runway crossing clearance at 37 seconds after the A320 was cleared for takeoff when the A320 was just beginning its takeoff. This occurrence has been classified as a serious incident. UPDATE 6 July 2017: at The 2017 Safety Forum, co-hosted by Flight Safety Foundation (FSF), EUROCONTROL and European Regions Airline Association (ERA) in Brussels 6-7 June 2017 on the topic of Preventing Runway Collisions Capt Pang Ying Qun presented on this incident. He commented that video evidence suggested the controller was fatigued. Also, he noted the tower layout restricted visibility (the controller can only see the south end of 36L if he leans his body backwards): UPDATE 6 March 2020: An uncorroborated source reports the leaked conclusions of the investigators were: The controller at the west tower of Hongqiao’s Airport issued a takeoff clearance to the A320 aircraft in violation of the Basic Flight Regulations of the People’s Republic of China and the East China Air Traffic Control’s Operations Manual, in particular he did not carry out continuous effective visual observation. He subsequently issued at runway crossing clearance to the A330 without accurately grasping the dynamics of the A320. This appears to be a blame-centric conclusion that supports the suspension of licences just days after the occurrence. It does not appear any recommendations were raised. Other Runway Incursion Resources A Runway Incursion is defined as “Any occurrence at an aerodrome involving the incorrect presence of an aircraft vehicle or person on the protected area of a surface designated for the landing and take off of aircraft” (Source: ICAO Doc 4444 – PANS-ATM). Skybrary...
read moreB747 Landing Gear Failure Due to Omission of Rig Pin During Maintenance
B747 Landing Gear Failure Due to Omission of Rig Pin During Maintenance The UK Air Accidents Investigation Branch (AAIB) has issued their report into a serious incident involving British Airways Boeing 747-436 G-CIVX on 30 January 2016. The Incident Flight The aircraft was on its first flight after replacement of the Landing Gear Control Module (LGCM), in response to a reported defect, during a scheduled A Check. The AAIB say: After retracting the landing gear following takeoff from Heathrow, the crew were unable to move the landing gear lever from the ‘UP’ to the ‘OFF’ position, as it had become jammed in the ‘UP’ detent. The crew elected to return to Heathrow and, in accordance with 747 Flight Crew Operations Manual Non-Normal Checklist procedures, the landing gear was lowered using the alternate extension system. The aircraft landed safely, with only the nose and body landing gear deployed. The aircraft stopped on Heathrow’s runway 27R, which was unavailable for about an hour until the aircraft was secured and towed off the runway. VIDEO The Aircraft Landing Gear Controls The AAIB explain: The landing gear…is mechanically commanded and hydraulically actuated. There is a three-position handle in the cockpit with the following spring-loaded detents: DN, OFF and UP. The handle must be pulled outwards against spring pressure to enable it to be moved to another position. The handle is part of the LGCM. The handle is connected to a control rod, which in turn is connected to a quadrant, and attached to the quadrant is a cable that runs to the wing gear selector valve quadrant located in the right hand body gear wheel well. Another cable runs from the wing gear selector valve quadrant to the nose/body gear selector valve quadrant located in the left‑hand body gear wheel well. The quadrant in each wheel well is connected to a selector valve by a mechanical lever. When a replacement LGCM is installed, it is a requirement in the Aircraft Maintenance Manual (AMM) to insert a rig pin in the selector valve quadrant. This video shows typical landing gear functional checks to illustrate how the wing and body gears retract and deploy: The Prior Maintenance During the A Check: The night shift had raised the task cards for the removal and re-rigging of the original LGCM; these cards included the tasks of fitting the rig pin in the selector valve quadrant, function checks and a duplicate inspection. The night shift staff removed and re-rigged the LGCM, but did not have time to compete the function checks, and the task cards were left uncertified. The re-rigged LGCM failed the function check made by the day shift, and the day shift then fitted a replacement serviceable LGCM. The task cards raised by the day shift staff for replacing the LGCM did not contain a task for the fitment and removal of the rig pins in the selector valve quadrants. The task cards raised by the night shift were used to certify the function checks. Three day shift engineers were involved in the fitting of the LGCM. They had the relevant sections of the AMM and the applicable Temporary Revision (TR) to the AMM, generated by the operator to provide additional information on the task. The engineers became focused on achieving the correct adjustment and hence were using the TR (which did not specify the need to fit the rig pins). A consequence of omitting...
read moreEASA Consult on Proposed AD on AS350B3 / H125 Hydraulics
EASA Consult on Proposed AD on AS350B3 / H125 Hydraulics The European Aviation Safety Agency (EASA) is consulting on a Proposed Airworthiness Directive (PAD 16-140) on all Airbus Helicopters AS350B3/H125 equipped with a dual hydraulic system (except those that embody mod 074719 and mod 074622). The AS350B3 is a popular type, particularly for small under slung load tasks (e.g. seismic work) and operation at high altitude due to its performance (previously demonstrated by Didier Delsalle‘s landing [twice] on the summit of Everest in 2005, a feat never achieved before or repeated since). EASA say: During the past 5 years, four in-service occurrences were reported concerning certain AS 350 B3 helicopters, equipped with a dual hydraulic system, that did not involve any component malfunction or failure, but where a crew human factor was determined to have been a contributing cause. These events were assessed from the man-machine interface standpoint, and it was recognized that a pilot could forget to reactivate the HYD switch or the ACCU TST button during a hydraulic test. This depressurises the servos. Improper setting of the HYD switch and ACCU TST button significantly increases the control load necessary to generate sufficient TR thrust for take-off. This condition, if not corrected, could cause the pilot to take off without recognising the omission, preventing safe completion of the manoeuvre, possibly resulting in damage to the helicopter and injury to occupants. Airbus Helicopters had first issued a Safety Information Notice in August 2014 in advance of initially developed a new Rotorcraft Flight Manual (RFM) procedure for the functional check of the Yaw Load Compensator. This was published in association with Service Bulletin (SB) AS350-67.00.66. At least one of the accidents is claimed a fatal HEMS accident in the US which we have discussed previously (although the US NTSB is yet to issue their final report). EASA explain: The advantage of the new procedure is that actuating the Yaw Servo Hydraulic Switch during the run-up hydraulic check is no longer necessary. Consequently, EASA issued AD 2015-0178 to require the new procedure to be incorporated in the normal procedures section of the applicable AS350 B3 RFM. However: Based on further analysis of the reported occurrences, it has been determined that, despite the RFM change introduced by AD 2015-0178, a critical scenario may still develop [due to] a human error… Fortuitously, rather than simply reply on an improved procedure Airbus Helicopters had in parallel developed mod 074622 and mod 074719 (and corresponding SB AS350-67.00.64 and SB AS350-67.00.65) which: Trigger a caution when the hydraulic switch on the collective grip is set to OFF Add an indicator light to indicate the status of the dual hydraulic system Replace the bistable ACCU TST push button with a monostable push button. Because their have been further occurrences since the RFM AD on aircraft without these modifications, EASA are now proposing making these modifications mandatory too, with a 12 month compliance time from the effective date of the AD. The Proposed AD will be closed for consultation on 28 October 2016. Irrespective of the result of this consultation, proactive operators would be wise to assess (or re-assess) the benefit of embodying these modifications. UPDATE 13 October 2016: It is worth noting that the AS350 family has now achieved an incredible 30 million flying hours: UPDATE 4 November 2016: The AD is issued: AD 2016-0220 Aerossurance has extensive air safety, helicopter /certification, airworthiness, operations and safety analysis experience. For...
read moreEDA European Military Airworthiness Certification Criteria (EMACC)
EDA European Military Airworthiness Certification Criteria (EMACC) In 2008 the European Defence Agency (EDA), an intergovernmental Agency of the European Council, created a Military Airworthiness Authorities (MAWA) Forum to help harmonise the airworthiness requirements and processes of the EDA’s 27 Participating Member States (all EU states except Denmark). This resulted in the development of a series of European Military Airworthiness Requirements (EMARs). In particular the EDA note: A significant cost driver for any aircraft programme is the costs associated with the initial airworthiness certification of the aircraft, which requires extensive Test and Evaluation (T&E) by the customer nations. If this activity could be carried out collaboratively…then significant cost and time savings could be realised. It has been recognised, therefore, that there exists a unique opportunity to agree on an EU-wide harmonisation and unification strategy for military airworthiness. An EDA funded study (conducted by Eurocopter, now Airbus Helicopters) estimated that the adoption of the EMARs would deliver a reduction of up to 50% of the development time and at least 10% of development costs up to initial-type certification. Significant further cost savings could also be achieved during the in-service phase. This resulted in the development of the EMACC Handbook as “a framework of certification criteria to assist in the determination of airworthiness”. The purpose of the EMACC Handbook is to enable a systematic selection of appropriate certification criteria to form the Type Certification Basis (TCB) for a specific Military Air System. It is not itself a set of certification requirements and the criteria are considered to be ‘non-prescriptive’. The Handbook references several existing airworthiness codes as source documents. These include the UK Def Stan 00-970, US Joint Service Specification Guides, EASA Certification Specifications and NATO STANAGs. The Handbook is orientated around the structure of US Mil-HDBK-516B (though is being being updated to reflect the new Mil-HDBK-516C). For each criterion, the EMACC Handbook identifies the relevant requirements from the referenced documents. As the criteria are considered non-prescriptive, no level of equivalence is inferred between the codes and the user developing the TCB needs to consider the relative merits of the options for their application. An example from Section 5 Structures, Sub-Section 5.1 Loads, with the criteria followed by the referenced airworthiness standards: One advantage of using the EMACC Handbook to develop a TCB is the potential to aid certification other National Military Airworthiness Authorities (NMAAs) on export programmes. Tailoring may be required to ensure the following are respected: The approach to governance and the associated contracting model(s); The approach to development, production and ongoing upkeep of the product basis of certification, including the acceptable approaches to means of compliance; Sufficient flexibility and adaptability within the criteria to met the operational needs, scenarios and role for the Product(s). This tailoring process may also involve the modification and/or addition of criteria from multiple-sources. Tailoring will differ depending on the type of product: The EMACC Handbook is supported by a Guidebook. That provides instructions for the use of the these certification criteria in a military certification programme. The Guidebook explains the difference between airworthiness and qualification, the former being related to safety requirements and the latter to functional (mission) performance requirements. The documents: EMACC Handbook Issue 2.1 (12 Oct 2015) Endorsed (Superseded document, for reference only: EMACC Handbook Edition 2.0 (24 Jan 2013) – Superseded) EMACC Guidebook Ed 1 Additionally the UK MAA has published a Regulatory Notice on use of the EMACC....
read moreMisrigged Flying Controls: Fatal Maintenance Check Flight Accident
Misrigged Flying Controls: Fatal Maintenance Check Flight Accident Time pressures, a maintenance error rigging flying control cables and a potentially non-compliant design conspired to cause a fatal accident in the US in 2015. Prior Maintenance The 6 seat Piper PA-46-350P Malibu Mirage N962DA had undergone an annual inspection at Rocket Engineering in Spokane, WA and was due for a post-maintenance check flight on 7 May 2015. The US National Transportation Safety Board (NTSB) say in their report (and the associated public docket) that: ….routine maintenance was performed, along with the replacement of the four aileron cables in the wings, and an aft elevator cable. An added complexity was that the owner had contracted another maintenance organisation to embody avionic modifications while the aircraft was at Rocket Engineering. The avionics maintenance organisation: …stated that as the upgrade progressed, the owner made multiple requests to add additional items to the work scope, and due to time constraints, not all of his requests could be accommodated. The owner reported that he had made arrangements to pick up the airplane on May 5th, however as the work progressed, he was informed that the airplane would not be ready in time, and the date was pushed back to May 7 and then May 8. The mechanic who performed and signed off on the annual inspection and who did the control cable replacement said: ….he was called multiple times by the airplanes owner for update checks during the weeks leading up to the accident. Each time additional items were discovered which needed to be repaired, further pushing back the completion date. He eventually referred the owner to the sales representative…because he felt he could be more, “diplomatic” with the owner. The mechanic…held an FAA airframe and powerplant certificate (A&P), with inspection authorization (IA). He had been an A&P mechanic for 22 years, and attained his IA rating 17 years prior. He reported replacing aileron cables in the PA-46 series about five prior times in his career. He stated that he worked exclusively on the accident airplane during the weeks leading up to the accident, and that he replaced the left and right aileron balance cables, along with the two aft aileron drive cables on May 5, 6 and 7. He reported replacing the cables in accordance with the procedures outlined in the maintenance manual, and that he removed and replaced each cable one-at-a-time to prevent inadvertent misrouting. Following completion, he checked aileron operation from both inside and outside the airplane, confirming smooth and full deflection. As part of the test procedures, he checked the neutral position on both ailerons, and then he used a protractor for angular aileron deflection measurements. [He] stated that there was no unusual rush or pressure to get the airplane finished that day [and] he was not aware of any outside pressure from the pilot to have it finished that day. The NTSB do however comment that the pilot due to do the post-maintenance check flight: …had an appointment with an FAA medical examiner the next morning (Friday), and he typically did not work on Fridays. It is likely that the mechanic and pilot felt some pressure to be finished that day so the owner could depart in the morning and the pilot could attend his appointment. The NTSB say: At the time of the...
read more‘Aggressive’ Grit Blasting Maintenance Leads to Engine Fire & IFSD
‘Aggressive’ Grit Blasting Maintenance Leads to Engine Fire & IFSD The US National Transportation Safety Board (NTSB) has issued their report on an incident that resulted in a Pratt & Whitney PW4056 engine fire and In-flight Shut Down (IFSD) on Delta Airlines Boeing 747-451 N669US on 21 September 2014. The aircraft had just taken off from Atlanta, GA (ATL): At about 400 feet above ground level (AGL), the pilots heard a loud bang, the airplane yawed, and they noted that the No. 4 engine’s cockpit instruments indicated a loss of power. The pilot’s accomplished the quick reference handbook (QRH) engine failure checklist and shutdown the No. 4 engine. At about 1,300 feet AGL, the No. 4 engine fire warning activated. The pilot’s accomplished the QRH engine fire checklist and discharged the A fire bottle into the No. 4 engine’s nacelle. When the fire warning did not go out after a minute, the pilots discharged the B fire bottle into the engine’s nacelle. The fire warning extinguished about 20 seconds after the B fire bottle was discharged. The pilots dumped 280,000 pounds of fuel and returned to ATL for a three-engine landing on Runway 27 Right without further incident. NTSB Investigation: The Damage The disassembly of the engine revealed one 5th stage compressor blade…had separated from a high cycle fatigue fracture that had originated in the aft concave side corner of the blade neck. The failed blade then caused extensive secondary damage across multiple stages. The fire was caused by hydraulic fluid that leaked from a pump B-nut loosened by vibration after the blade loss. NTSB Investigation: Prior Maintenance The maintenance records showed that the fractured 5th stage compressor blade was among a batch of 40 blades that had been overhauled by Turbine Overhaul Services (TOS), Singapore in October 2013. TOS is a joint venture between P&W and Singapore Technologies Aerospace, is an FAA-approved Part 145 repair station that specializes in the repair and overhaul of turbine engine compressor and turbine blades and vanes. As part of the overhaul process, the plasma spray coating on the blade roots was removed and replaced. As part of the preparation for the application of the plasma spray, the surface of the blade root is grit blasted with aluminum oxide media. The blade root neck is identified in the repair procedures as a no-grit blast area. TOS…conducted an audit of its PW4000 5th stage compressor blade overhaul and repair processes. The audit revealed TOS’s PW4000 5th stage compressor blade overhaul and repair processes conformed to the requirements except for the aluminum oxide grit blasting surface preparation prior to the application of the plasma coating. The audit revealed the operator held the grit blasting gun about 2 inches from the surface instead of the specified 4 to 6 inches. NTSB Probable Cause Turbine Overhaul Service’s aggressive grit blasting and incomplete masking of the blade root neck that allowed the no grit blast area being exposed during the overhaul of the blade resulting in blasting media being embedded in the blade root from which a fatigue crack developed. The fatigue crack propagated until separation of the blade occurred that resulted in a complete loss of engine power. The fire was caused by the B-nut on the hydraulic line from the fuel pump and pulsation damper loosening from engine vibration after the compressor blade separated spraying...
read moreThe Wrong Fuel: Three Misfuelling Accidents
The Wrong Fuel: Three Misfuelling Accidents Misfuelling aircraft with kerosene based Jet A-1 rather than Aviation Gasoline (AVGAS) continues to be a source of accidents. We look at three: 1) Misfuelled PA31 Accident: 15 Sept 2015 Manitoba The Canadian Transportation Safety Board (TSB) has recently released their report on the 15 September 2015 accident involving twin engined Keystone Air Service Piper PA31-350 Navajo C-FXLO at Thompson, Manitoba. The TSB say: Shortly after rotation, both engines began to lose power. The crew attempted to return to the airport, but the aircraft was unable to maintain altitude. The landing gear was extended in preparation for a forced landing on a highway southwest of the airport. Due to oncoming traffic, the forced landing was conducted in a forested area adjacent to the highway, approximately 700 metres south of the threshold of Runway 06. The descent angle through the trees to the impact point of the main landing gear was about a 10° descent angle in a nose-high, wings-level attitude. From the initial impact point, the aircraft travelled another 30 m before coming to a stop. The total length of the wreckage trail from the first tree impact was approximately 76 m. The [8] occupants sustained varying serious injuries but were able to assist each other and exit the aircraft. Prior to Flight The refuelling technician, who had been working for the fuelling company for a just over a month, and had no prior aviation experience, had fuelled another aircraft with Jet A1 before the Keystone aircraft arrived and drove the Jet A1 truck to where the PA-31 had parked. The aircraft commander had intended to relay the fuel requirements to the technician, but the Co-Pilot, who was escorting passengers, had noticed that the fuel technician was having trouble with the fuel filler openings. The Co-Pilot assisted the technician and asked for required fuel quantity. The Captain overhead this conversation and so did not talk to the refueller. Neither pilot noticed that the truck was a jet fuel truck. The technician did not spot the aircraft placard specifying aviation gasoline. When the technician couldn’t get the flared fuel filler nozzle to fit, he switched to a narrower nozzle, defeating a defence to prevent Jet A1 being used on a piston engined aircraft, but was sometimes required on aircraft that needed Jet A1. Prior to departure, the Captain returned to the fuel providers office to collect the fuel slip but it was unoccupied The crew then performed an abbreviated check before taking off without the fuel slip. TSB say: The Esso fuel dealer at Thompson Airport was Mara-Tech Aviation Fuels Ltd, which operated the Imperial Oil owned facility and equipment under an aviation dealer agreement. In addition to its day-to-day operation of the facility, Mara-Tech was responsible for staffing the facility and training the employees. Training materials were supplied by Imperial and consisted of a series of CDs or VHS tapes whose content was organized into modules. Each module was accompanied by a corresponding multiple-choice quiz. Aviation dealer agreements require that fuel dealers adhere to Imperial’s operating standards and procedures. Under the aviation dealer agreement, fuel dealers have a licence to use Imperial brand trademarks, such as Esso and Esso Aviation, in marketing their businesses. The [fuel technician’s] training consisted of reading the Imperial training material, viewing the CDs, and completing the corresponding multiple-choice quizzes. Additional certifications, such as Airside Vehicle Operator’s Permit and Transportation of Dangerous Goods, were administered by...
read moreBusiness Aviation Compliance With Pre Take-off Flight Control Checks
Business Aviation Compliance With Pre Take-off Flight Control Checks The US National Transportation Safety Board (NTSB) highlighted a number of important human performance issues in after a fatal Gulfstream G-IV N121JM business aircraft accident which occurred on 31 May 2014 at the joint civil/military Hanscom Field (BED) in Bedford, Massachusetts (final report). Aerossurance has discussed that accident previously: Gulfstream G-IV Take Off Accident & Human Factors This NTSB video illustrates the G-IV take off: The NTSB determined that the probable cause of this accident was: … the flight crewmembers’ failure to perform the flight control check before takeoff, their attempt to take off with the gust lock system engaged, and their delayed execution of a rejected takeoff after they became aware that the controls were locked. Contributing to the accident were the flight crew’s habitual noncompliance with checklists, Gulfstream Aerospace Corporation’s failure to ensure that the G-IV gust lock/throttle lever interlock system would prevent an attempted takeoff with the gust lock engaged, and the Federal Aviation Administration’s failure to detect this inadequacy during the G-IV’s certification. Aerossurance subsequently analysed a US Air Force (USAF) Lockheed Martin C-130J accident were a control check was omitted: C-130J Control Restriction Accident, Jalalabad It is noteworthy that when the NTSB reviewed flight data from the aircraft’s Quick Access Recorder (QAR), they discovered that this flight crew had failed to perform complete flight control checks before 98% of their previous 175 take offs. To the NTSB this indicated that this omission was “habitual”. The NTSB describe this a procedural drift (a topic we have discussed in our recent article: ‘Procedural Drift’: Lynx CFIT in Afghanistan). Among the NTSB recommendations was a recommendation to the National Business Aviation Association (NBAA): Work with existing business aviation flight operational quality assurance groups, such as the Corporate Flight Operational Quality Assurance Centerline Steering Committee [a Flight Safety Foundation initiated initiative], to analyze existing data for non-compliance with manufacturer-required routine flight control checks before takeoff and provide the results of this analysis to your members as part of your data-driven safety agenda for business aviation. The NBAA has now published their analysis report: Business Aviation Compliance With Manufacturer-Required Flight-Control Checks Before Takeoff The [FDM] data [analysed] shows that out of 143,756 flights conducted during the 2013 to 2015 time period, flight crews [only] conducted a partial flight-control check before takeoff (caution event) during 22,458 flights (15.62 percent). There was no flight-control check before takeoff (warning event) conducted on 2,923 flights (2.03 percent). For the three-year period covering 2013, 2014 and 2015, the overall noncompliance rate for manufacturer-required routine flight-control checks before takeoff was 17.66 percent, reflecting 25,381 events. After the accident on May 31, 2014, and the release of the preliminary report on June 13, 2014, the average warning event rate was reduced to 1.47 percent, a drop of 50 percent. That may indicate there was a positive reaction to the preliminary report finding that the Bedford crew did not perform any flight-control check before takeoff. The caution events are more variable, and there is not a significant difference in caution event rates between pre- and post-accident percentages. This report to the NBAA membership is not only intended to provide closure action to the NTSB recommendation, but also to raise awareness to the broader business aviation community that complacency and lack of procedural discipline have no place in our profession. NBAA President and CEO Ed Bolen said: As perplexing...
read moreUK CAA CAP1145: 2nd Update on North Sea Helicopter Safety (CAP1386)
UK CAA CAP 1145: 2nd Update on North Sea Helicopter Safety (CAP 1386) The UK Civil Aviation Authority (UK CAA) have issued CAP1386, their second update to their CAP1145 report (‘Safety review of offshore public transport helicopter operations in support of the exploitation of oil and gas’), issued in 20 February 2014. The first update, CAP1243, had provided an update on the 10 months to 31 Dec 2014. CAP 1386: Introduction In his introduction, Mark Swan, UK CAA Group Director Safety and Airspace Regulation, comments: We are pleased that there continues to be a strong collective commitment…evidenced by the co-operation received from all parties… …we have continued to work closely with industry and the European Aviation Safety Agency (EASA)… We are pleased to be participating in the work currently undertaken by EASA as part of their Safety Risk Portfolio – Offshore Helicopter Operations. It is clear that EASA is devoting significant energy, time and expert resources into this activity. This work provides an opportunity for real and lasting progress in this area. The majority of the actions and recommendations are now completed and we have identified a number of ongoing workstreams to ensure that we continue to see improvements in offshore helicopter safety. Swan states “The ultimate aim is for rotary wing safety performance to be on a par with large commercial fixed wing operations”. To achieve this ambitious goal: …the focus needs to be on prevention, as opposed to survival, through helicopter design improvements. In this regard, our ambition is to have a defined certification strategy where rotary wing can realistically approach commercial fixed wing safety and reliability performance. …we will continue to work closely with EASA and support all necessary EASA working groups to assist in this objective. In many ways the last comment demonstrates the critical importance to UK helicopter safety of remaining an EASA member State post-Brexit, 13 years since the UK CAA were last a ‘Competent Authority’ able to certify an offshore helicopter. CAP 1386: Passenger Safety and Survivability The UK CAA discuss a number of measures previously report in CAP 1243, and subsequently mandated by CAA Safety Directive SD-2014/001 (issued on 21 May 2014). Since then, significant progress has been made in introducing new requirements relating to the compatibility of passenger body size and underwater escape exit (window) size. Further work has also been performed in the areas of EBS [Emergency Breathing Systems] training and extending EBS to flight crew on offshore helicopters. The current Safety Directive (SD-2015/005 issued on 8 December 2015) introduced cover for support to Lighthouse Authorities and, in response to concerns raised by the industry, also introduced alleviation for the carriage of EBS for medically incapacitated passengers. An additional alleviation has been provided against the operating rules for such passengers in respect of life jackets and survival suits. They go on to discuss the activity to ensure passengers were seated next to windows compatible with their body size: From 1 April 2015, all passengers are now seated next to exits large enough for their body size and are checked by the helicopter flight and ground crews before takeoff as part of standard pre-flight procedures. They go on to say: Since 1 January 2015, all passengers have been required to wear suitable Cat A EBS (CAP 1034 Category A). In our previous progress report, we described how this had been introduced ahead of schedule for all passengers on 1 September 2014, and how the oil and...
read moreAAIB: Human Factors and the Identification of Saab 2000 Flight Control Malfunctions
AAIB: Human Factors and the Identification of Saab 2000 Flight Control Malfunctions The UK Air Accidents Investigation Branch (AAIB) has recently issued its report on a loss of control in flight incident, near Sumburgh Airport, on 15 December 2014 involving Saab 2000 G-LGNO: The aircraft was inbound to land on Runway 27 at Sumburgh when the pilots discontinued the approach because of weather to the west of the airport. As the aircraft established on a southerly heading, it was struck by lightning. When the commander made nose-up pitch inputs the aircraft did not respond as he expected. After reaching 4,000 ft amsl the aircraft pitched to a minimum of 19° nose down and exceeded the applicable maximum operating speed (VMO) by 80 kt, with a peak descent rate of 9,500 ft/min. The aircraft started to climb after reaching a minimum height of 1,100 ft above sea level. Recorded data showed that the autopilot had remained engaged, contrary to the pilots’ understanding, and the pilots’ nose-up pitch inputs were countered by the autopilot pitch trim function, which made a nose-down pitch trim input in order to regain the selected altitude. What the investigators found was that out of 22 airliner types examined, only the Saab 2000 had an autopilot which, when engaged: Applies an override force to the control column that will move the elevator but will not cause the autopilot to disengage Can trim in the opposite direction to the pilot applied control column input Has main pitch trim switches that will not cause the autopilot to disengage While the whole report is worthy of study but the AAIB discuss the identification of flight control malfunctions in a section that we feel is worth highlighting: In an aircraft with purely mechanical flying controls, a jammed flight control can be identified by resistance to movement of the control wheel or column. Failure of a control linkage will be apparent as the control will move without the usual resistance. In either case, the absence of the usual aircraft response to an input will be apparent. In this control system, the ‘loop’ from pilot input, to response felt through the controls, to aircraft response, is complete. In an aircraft with powered or fly-by-wire controls, and without any physical feedback, it may be harder to determine a malfunction because effect of control inputs can only be assessed from aircraft response. In manoeuvring flight or turbulence, this assessment may be more difficult. In the Saab 2000, the forces required to achieve particular control column displacement are greater when the autopilot is engaged, but this is not a usual mode of operation and pilots are unlikely to be familiar with it. A pilot feeling abnormal control resistance may not readily determine that the reason for the unusual forces is that the autopilot is engaged. Mental models are developed by experience and/or training, and more experience leads to more detailed mental models. Mental models guide interaction with systems: an accurate mental model can facilitate good performance, but poor mental models can lead to misunderstanding of system functioning, increasing the risk of error. AAIB note that: Designers can promote good mental models by optimising feedback, for example by providing indicators of system status and performance which are easily assimilated, even under stress. Automation surprise* can occur if the autopilot does not behave...
read more
Recent Comments