ASW May2016

AIRPORT PEER REVIEWS
Analyzing Issue Trends

RESTORING PRIVILEGES
Exiting the EU Blacklist
SMOKE, FIRE AND FUMES
Changing Airline Checklists
SILENT TREATMENT
A PILOTS UNDISCLOSED PSYCHOSIS

THE JOURNAL OF FLIGHT SAFETY FOUNDATION
MAY 2016
IS THERE
SAFETY
IN NUMBERS?
ABSOLUTELY
7 decades
150 countries
1,100 members
1st International Air Safety Summit
Civil aviation accident workshop
Pilot safety global reporting system
Worldwide distribution of malfunction reports
BARS Offshore Helicopter Standard
30 ALAR regional workshops

100+ issues of AeroSafety World since 2006
350 BARS audits completed
40 awards of excellence
30+ industry collaborations
4 annual Air Safety Summits
JOIN TODAY
flightsafety.org
PRESIDENTSMESSAGE
SAFELY TAPPING THE POTENTIAL OF
UAS
N
ot a day goes by when there isnt

some new development positive
or negative about unmanned
aircraft systems (UAS) and their
growing presence in national airspace systems. As this issue of AeroSafety World was
going to press, there were unconfirmed
reports out of London that a British Airways Airbus A320 on approach to Londons Heathrow Airport may have been
struck by a drone. The airplane landed
safely, and an investigation was launched
as were dozens of stories about the
growing number of UAS aircraft sightings by airline pilots and the threat that
UAS may pose to aviation safety.
On the other end of the spectrum are
persistent calls for regulators to speed up
the promulgation of rules governing the
safe operation of UAS in civilian airspace.
The rationale for the urgency often revolves around the potential commercial,
humanitarian and efficiency benefits that
society may realize once UAS, known in
International Civil Aviation Organization parlance as remotely piloted aircraft
systems or RPAS, are widely accepted
and operated.
Like many organizations in the aviation community, Flight Safety Foundation
FLIGHTSAFETY.ORG | AEROSAFETYWORLD | MAY 2016
is tracking RPAS developments closely,

and we are considering how best to add
value to the ongoing safety discussion. In
Melbourne, Australia, the Foundations
Basic Aviation Risk Standard (BARS)
program office, under the leadership
of Managing Director David Anderson
and in consultation with a variety of
stakeholders including BARS member
organizations (BMOs), manufacturers,
insurance companies and UAS aircraft
operators is developing an RPAS audit
protocol. Like BARS, the RPAS standard
will be risk-based and will not be based
on material drawn or sourced from any
particular regulatory document. The
process of developing the RPAS standard
started with asking the question, What
are the risks in operating RPAS? and
then determining what controls would
be needed to address the identified risks.
The BARS Technical Advisory Committee, which comprises representatives
from the BMOs, is scheduled to meet in
early May to review the RPAS work done
to date and to start another round of discussions and consultations on the controls
and defenses needed for such an industry
standard. In essence, this continues work
on the RPAS bow tie diagram. In a recent
update briefing on the development work,

David said, The challenge as we see it
now is to derive something useful for
most sizes of operations: micro RPAS
through to the large aircraft that can use
multiple controllers and operate beyond
visual line of sight.
UAS/RPAS represent a significant
portion of the aviation industrys future.
To realize their potential and ensure
safe operation, all sectors of the aviation industry need to work together to
develop reasonable, well-conceived risk
mitigations.
Jon L. Beatty
President and CEO
Flight Safety Foundation
|1
AeroSafetyWORLD
contents
May 2016 Vol 11 Issue 4
features
12
InSight | Safety Space and Drift
12
CoverStory | Analysis of Germanwings Flight 9525
18
AirportOps | Seeking Trends in Peer Reviews
23
StrategicIssues | Lessons in Every CFIT Crash
28
AviationResearch | Simulators Add Icing Encounters
33
SafetyOversight | Revisiting the EU Air Safety List
39
SafetyStandards | Smoke-Fire-Fumes Checklists Vary
departments
18
2|
PresidentsMessage | Safely Tapping the Potential of UAS
EditorialPage | Personal Relationships
SafetyCalendar | Industry Events
FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | MAY 2016
23 28
9
InBrief | Safety News
46
DataLink | U.S. GA Fatalities Decline
50
OnRecord | Unsafe to Fly
56
SmokeFireFumes | U.S. and Canadian Events
About the Cover

Crash investigators who studied
the first officers suicidal actions on
Germanwings Flight 9525 urge clear
guidelines for weighing medical privacy
against the threat to public safety.
Composite illustration by Jennifer Moore
Main image: osmanpek | AdobeStock
Airplane: Alexzabusik | Dreamstime.com
33
39
AeroSafetyWORLD
telephone: +1 703.739.6700
Frank Jackman, editor-in-chief,

FSF vice president, communications
jackman@flightsafety.org, ext. 116
Wayne Rosenkrans, senior editor

rosenkrans@flightsafety.org, ext. 115
We Encourage Reprints (For permissions, go to <flightsafety.org/aerosafety-world-magazine>)
Linda Werfelman, senior editor

werfelman@flightsafety.org, ext. 122
Share Your Knowledge

If you have an article proposal, manuscript or technical paper that you believe would make a useful contribution to the ongoing dialogue about aviation safety, we will be
glad to consider it. Send it to Editor-In-Chief Frank Jackman, 701 N. Fairfax St., Suite 250, Alexandria, VA 22314-2058 USA or jackman@flightsafety.org.
The publications staff reserves the right to edit all submissions for publication. Copyright must be transferred to the Foundation for a contribution to be published, and
payment is made to the author upon publication.
Mark Lacagnina, contributing editor

mmlacagnina@aol.com
Jennifer Moore, art director
Sales Contact
jennifer@emeraldmediaus.com
Emerald Media
Cheryl Goldsby, cheryl@emeraldmediaus.com +1 703.737.6753
Kelly Murphy, kelly@emeraldmediaus.com +1 703.716.0503
Susan D. Reed, graphic designer

reed@flightsafety.org, ext. 123
Subscriptions: All members of Flight Safety Foundation automatically get a subscription to AeroSafety World magazine. For more information, please contact the
membership department, Flight Safety Foundation, 701 N. Fairfax St., Suite 250, Alexandria, VA 22314-2058 USA, +1 703.739.6700 or membership@flightsafety.org.
AeroSafety World Copyright 2016 by Flight Safety Foundation Inc. All rights reserved. ISSN 1934-4015 (print)/ ISSN 1937-0830 (digital). Published 10 times a year.
Suggestions and opinions expressed in AeroSafety World are not necessarily endorsed by Flight Safety Foundation.
Nothing in these pages is intended to supersede operators or manufacturers policies, practices or requirements, or to supersede government regulations.
|3
CCoocckkppiitt SS m
m oo kk ee P
P rr oo tt ee cc tt ii oo nn
When
cockpit...
When smoke
smoke lls
lls your
your cockpit...
Will
Will you
you be
be protected?
protected?
18,000+
Reportsof
ofsmoke,
smoke, re,
re, fumes,
fumes, or
Reports
or explosions
explosions have
have
beenrecorded
recorded by
by the
the FAA
FAA between
between 2000
been
2000 -- 2015.
2015.
InteractiveSmoke
SmokeDemos
Demos || EBACE
EBACE booth
booth #
Interactive
# Y067
Y067 || May
May 24
24 through
through26
26
VisionSafe.com
VisionSafe.com
E
V
A
S
mergency
ision
ssurance
ystem
E mergency V ision A ssurance S ystem
1-844-FLY-EVAS
1-844-FLY-EVAS
(359-3827)
(359-3827)
EDITORIALPAGE
Personal
RELATIONSHIPS
ince mid-March, Flight Safety Foundation

staff and contractors, led by Vice President,
Technical, Mark Millam and Vice President, Global Programs, Greg Marshall have
traveled tens of thousands of miles conducting
workshops as part of our ongoing Global Safety
Information Project (GSIP). As I write this, Greg
and I are in Hong Kong getting ready to kick off
the second day of a two-day GSIP workshop, and
Mark has just returned from a week in Brazil,
where he conducted workshops in Rio de Janeiro
and So Paulo. As April drew to a close, the Foundation had conducted seven workshops, with at
least six still to come.
What were doing on each trip is talking to stakeholders about safety data collection, processing and
sharing opportunities and challenges, about information protection, and about tools and strategies
to detect threats and assess risk. The Foundation
is formulating strategies and approaches to better
collect, analyze and share safety data in order to
reduce risk, and we are developing a GSIP tool
kit and online resources that will embody these
strategies. At our workshops, we are learning
what stakeholders already are doing along these
lines, and we are introducing some of our tool kit
concepts and soliciting feedback on the work weve
done so far, which will help us further refine the
tool kits. More information on GSIP is available
at <www.fsfgsip.org>.
One thing that has become clear to me is the

value of personal relationships on a number of levels
when it comes to aviation safety. Workshop participants have expressed to us that they appreciate the
forum we are providing for them to meet with their
peers from other organizations in a neutral setting
to discuss issues of mutual concern and to learn how
different organizations approach risk assessment.
Also, in listening to the discussions during the
workshops and last years GSIP focus groups, and
in casual conversations with individual participants,
Ive heard it mentioned multiple times that personal
relationships with counterparts at a regulatory authority or air navigation service provider or another
operator, for example, make it easier to pick up the
phone and to talk through issues. Some situations
are more easily resolved, or at least understood, by
taking a less formal approach, and its easier to be
less formal if you already know the person with
whom you are dealing.
Frank Jackman
Editor-in-Chief, ASW
|5
Serving Aviation Safety Interests

for Nearly 70 Years
OFFICERS AND STAFF
Chairman
Board of Governors
Kenneth J. Hylander
President and CEO
Jon L. Beatty
General Counsel
and Secretary
Treasurer
Kenneth P. Quinn, Esq.

David J. Barger
FINANCE
Vice President, Finance
Brett S. Eastham
Controller, GSIP Grants

Administrator
Ron Meyers
ince 1947, Flight Safety Foundation has helped save lives around the world. The
Foundation is an international nonprofit organization whose sole purpose is to
provide impartial, independent, expert safety guidance and resources for the aviation
and aerospace industry. The Foundation is in a unique position to identify global safety
issues, set priorities and serve as a catalyst to address the issues through data collection
and information sharing, education, advocacy and communications. The Foundations
effectiveness in bridging cultural and political differences in the common cause of safety
has earned worldwide respect. Today, membership includes more than 1,000 organizations
and individuals in 150 countries.
MEMBERSHIP AND BUSINESS DEVELOPMENT
Vice President,
Business Operations
Susan M. Lausch
Senior Manager of
Events and Marketing
Christopher Rochette
Manager, Conferences
and Exhibits
Namratha Apparao
Membership
Services Coordinator
Consultant,
Special Projects
MemberGuide
701 N. Fairfax St., Suite 250, Alexandria VA 22314-2058 USA
tel +1 703.739.6700 fax +1 703.739.6708 flightsafety.org
Member enrollment
Ahlam Wahdan
Caren Waddell
ext. 102
wahdan@flightsafety.org
Ahlam Wahdan, membership services coordinator
Seminar registration
ext. 101
apparao@flightsafety.org
Namratha Apparao, manager, conferences and exhibits
Donations/Endowments
COMMUNICATIONS
Vice President,
Communications
ext. 112
lausch@flightsafety.org
Susan M. Lausch, vice president, business operations
Technical product orders

Frank Jackman
ext. 101
Seminar proceedings
TECHNICAL
Vice President,
Technical
Mark Millam
ext. 101
Website
ext. 116
jackman@flightsafety.org
Frank Jackman, vice president, communications
Basic Aviation Risk Standard

David Anderson, BARS managing director
GLOBAL PROGRAMS
Vice President,
Global Programs
anderson@flightsafety.org
BARS Program Office: 16/356 Collins Street, Melbourne, Victoria 3000 Australia
tel +61 1300.557.162 fax +61 1300.557.182 bars@flightsafety.org
Greg Marshall
BASIC AVIATION RISK STANDARD
BARS
Managing Director
David Anderson
facebook.com/flightsafetyfoundation
Past President
Founder
Capt. Kevin L. Hiatt

Jerome Lederer
19022004
@flightsafety
www.linkedin.com/groups?gid=1804478
SAFETYCALENDAR
MAY 56 Business Aviation Safety

Summit 2016 (BASS 2016). Flight Safety
Foundation. Austin, Texas, U.S. Namratha
Apparao, <apparao@flightsafety.org>,
+1 703.739.6700, ext. 101.
MAY 912 RAA 41st Annual Convention.
Regional Airline Association. Charlotte, North
Carolina, U.S. <raa.org>.
MAY 1012 Cabin Operations Safety
Conference. International Air Transport
Association (IATA). Miami. <iata.org>.
MAY 1112 Global Safety Information
Project (GSIP) Workshop. Flight Safety
Foundation. Kuala Lumpur, Malaysia.
<fsfgsip.org>.
MAY 1518 88th Annual AAAE Conference
and Exposition. American Association of Airport
Executives (AAAE). Houston. <aaae.org>.
MAY 1518 29th IATA Ground Handling
Conference. International Air Transport
Association (IATA). Toronto. <iata.org>.
Foundation. Jakarta, Indonesia. <fsfgsip.org>.

Foundation. Panama City, Panama. <fsfgsip.org>.
JUNE 78 2016 Safety Forum. Eurocontrol,
Flight Safety Foundation, European Regions
Airline Association. Brussels. <skybrary.aero>.
JUNE 89 Global Safety Information
Foundation. Lima, Peru. <fsfgsip.org>.
JUNE 910 Global Safety Information
Foundation. New Delhi. <fsfgsip.org>.
JUNE 2022 Inflight Emergency Response
(IER) 2016. Green Light Ltd. Riga, Latvia. SarahJane Prew, <editor@cabinsafetyupdate.com>,
<inflightemergencyresponse.com>.
JUNE 2023 7th Pan American Aviation
Safety Summit. Latin American and Caribbean
Air Transport Association (ALTA). Panama City,
Panama. <alta.aero>.
JUNE 2024 Master Class Human Factors and
Safety with Prof. Sydney Dekker. Aviation Academy
of the Amsterdam University of Applied Sciences.
Amsterdam. <amsterdamuas.com/aviation/events>.
Aviation safety event coming up?

Tell industry leaders about it.
If you have a safety-related conference,
seminar or meeting, well list it. Get the
information to us early. Send listings
to Frank Jackman at Flight Safety
Foundation, 701 N. Fairfax St., Suite
250, Alexandria, VA 22314-2058 USA, or
<jackman@flightsafety.org>.
Be sure to include a phone number,
website, and/or an email address for
readers to contact you about the event.
JUNE 2628 ASA 2016. Aviation Suppliers
Association (ASA) Annual Conference. Las Vegas.
<aviationsuppliers.org>.
JULY 417 Summer School Human Factors
& Safety. Aviation Academy of the Amsterdam
University of Applied Sciences. Amsterdam.
<amsterdamuas.com/aviation/events>.
JULY 1314 Global Safety Information
Foundation. Mexico City. <fsfgsip.org>.
JULY 28 Flight Safety Foundation Annual
Dinner. Flight Safety Foundation. Washington.
Namratha Apparao, <apparao@flightsafety.org>.
|7
INSIGHT
BY BOB BARON
The Safety Space

and Practical Drift
n everyday operations, aviation organizations operate in what is known as

the safety space. The safety space is
a continuum between baseline performance on the left of the continuum
and an accident on the right (Figure 1).
Fortunately, the safety space is quite wide
and has a large margin of error tolerance.
Within this safety space, practical
drift inevitably occurs. Practical drift
is dynamic and can shift significantly
within a short period of time. When
theres right drift, safety is deteriorating,
which may lead to an accident. When
theres left drift, safety is improving, possibly to baseline performance. Baseline
performance means that an organization
is doing everything by the book. All policies, rules, regulations, procedures, etc.
are being followed to the letter. Thus,
theoretically, the chance of having an
accident or incident is extremely low. In
reality, an organization rarely achieves,
and/or maintains, baseline performance.

The closest an organization may come to
baseline performance is when operations first begin, during external audits,
during inspections by the U.S. Federal
Aviation Administration, or immediately following an accident or incident.
In a perfect world, all organizations
would perform at baseline all the time.
In practicality, this will not happen.
People tend to deviate from, and/or fail
to follow, policies, rules, regulations and
procedures. Most accidents occur not
because of a lack of procedures, policies,
checklists, etc., but rather because those
procedures and policies are not being
used. To make matters worse, deviations
from written procedures tend to become
cultural norms (routine violations).
If practical drift progresses too
far to the right of the scale, then the
likelihood of an accident or incident
increases. If an accident occurs, then
Practical Drift
Practical drift
Baseline
performance
Accident
The safety space
Source: Bob Baron
Figure 1
8|
typically the organization will make

immediate corrections to try to achieve
baseline performance. In other words,
the needle will go from the extreme
right side of the scale to the extreme left
side in a very short period of time. This
was the case in the crash of Continental
Express Flight 2574, an Embraer 120
that crashed in Texas in 1991, killing all
on board. The crash occurred because,
during a shift turnover, the outgoing
maintenance shift did not inform the
incoming shift that 47 screws needed to
be put back on the horizontal stabilizer.
Slack shift turnovers were the norm, and
although there were procedures in place
to safely conduct shift turnovers, they
were not being used. This is an example
of practical drift in which the needle
goes too far to the right and an accident
occurs. Unsurprisingly, the airline attempted to go back to baseline performance immediately after the accident.
Unfortunately, even with accidents
and significant safety events, organizations will, over time, drift back to the
right. The question is where is your organization in the safety space right now? If
the needle is too far to the right, you may
want to start making a left correction!
Bob Baron, Ph.D., is the president and chief
consultant of The Aviation Consulting Group
(TACG), and specializes in human factors,
safety management systems, crew resource
management, line operations safety audits and
fatigue risk management.
The opinions expressed are the authors and
do not necessarily reflect the Flight Safety
Foundations views.
Safety News
P
INBRIEF
No Sudden Moves
ilots of some Boeing 787s are being cautioned against making abrupt flight control inputs in response to an unrealistic sudden
drop in displayed airspeed.
The U.S. Federal Aviation Administration (FAA) said in early April that it is adopting a new airworthiness directive (AD)
for all 787-8 and 787-9 airplanes, calling for revision of the airplane flight manual to instruct flight crews to avoid abrupt inputs,
which the FAA said could exceed an airplanes structural capability, and to reinforce the need to disconnect the autopilot before
making any manual flight control inputs.
The FAA said the AD was prompted by reports indicating that in certain weather conditions with high moisture content or
possible icing, erroneous low airspeed may be displayed to the flight crew before detection and annunciation via engine indicating
and crew alerting system (EICAS) messages. The FAA added that it had received three reports of such in-service anomalies and
that the agency and Boeing were continuing to investigate the problem.
However, the anomalous behavior is consistent with significant water ingestion or simultaneous icing of two or three of the pitot probes, the AD said. During each of the reported events, the displayed airspeed rapidly dropped significantly below the actual
airplane airspeed.
The AD noted that, during normal
operations, displays for both the captain and the first officer show the same
airspeed, but during one of the in-service
events, when the autopilot was engaged,
the pilot made significant nose-down
manual control inputs after observing the
erroneous low airspeed on the display.
The FAA said it considered the AD to
be an interim response and that Boeing
was developing modifications that would
address the problem.
Boeing
Preventing Turbine Hub Failure
he U.S. Federal Aviation Administration (FAA) says it

plans to adopt an airworthiness directive (AD) aimed at
preventing high-pressure turbine hub failures on some
International Aero Engines (IAE) jet engines.
The proposed AD was published in the April 5 Federal
Register. The FAA said it would accept public comments on the
proposal until June 6.
The proposed AD calls for inspections of the high-pressure
turbine stage 1 and stage 2 hubs in the affected engines and
replacement of parts, if necessary. The FAA said the inspections
are necessary to prevent failure of the hubs, which could result

in uncontained [high-pressure turbine] blade release, damage
to the engine and damage to the airplane.
The FAAs action was prompted by a Sept. 18, 2014, incident in which a JetBlue Airbus A320 experienced an engine
failure and under-cowling fire after departure from Long
Beach, California, U.S. The crew returned to Long Beach for
landing. None of the 147 passengers and crew was injured in
the incident.
The U.S. National Transportation Safety Board said in its
final report that the probable cause of the engine failure and fire
was the fatigue fracture of a high-pressure turbine stage 2 disk
blade retaining lug. When the lug fractured, it released two
blades, which struck the low-pressure turbine case and broke a
fuel line. Fuel then sprayed onto the engine cases and ignited.
A manufacturing defect led to the fatigue fracture, the
NTSB said.
The FAA estimated that the proposed AD would affect 947
stage 1 and stage 2 hubs on 668 engines installed in airplanes
registered in the United States.
The proposed AD would apply to IAE V2522-A5, V2524A5, V2525-D5, V2527-A5, V2527E-A5, V2527M-A5, V2528D5, V2530-A5, and V2533-A5 turbofan engines.
International Aero Engines
|9
INBRIEF
Recommended Changes for DHC-8
he U.S. National Transportation Safety Board (NTSB) has recommended training, maintenance and design changes as a result of
its investigation of a June 5, 2015, in-flight fire in a United Express
Bombardier DHC-8.
None of the 37 passengers and crew in the airplane was injured as a
result of the fire at the right windshield terminal block during approach
to Bradley International Airport in Windsor Locks, Connecticut, U.S.
The crew declared an emergency, landed the airplane and conducted
an emergency evacuation. The crews attempts to extinguish the flames
were unsuccessful, but the fire eventually extinguished itself, the NTSB
said in its final report on the accident.
The report said the probable cause was an arcing failure of the
windshield heat power wire due to unknown reasons and that contributing factors included the lack of training or guidance provided to
the crew for selecting the windshield heat to OFF. That action would
have cut power to the circuit, the report said.
The NTSBs recommendations called for the redesign of the windshield heat power connection on DHC-8s to provide a mechanically
secure, low-resistance electrical connection, and the addition of an
emergency procedure checklist to specifically instruct flight crews as
a memory item, to immediately turn off windshield heat in the event
of a windshield arcing, smoke, fire or overheating. Training manuals
should be revised to incorporate the same change, the NTSB said.
Other recommendations called for changes in DHC-8 maintenance task cards to include more frequent inspections and more
specific inspection tasks that focus on the degradation of windshield
components.
Maintenance records showed that the operator had complied with
all inspections recommended by the aircraft manufacturer. Nevertheless, the aircraft manufacturer recommends inspections at longer
intervals than are recommended by the windshield manufacturer, the
report said.
Alexander Novikov | AdobeStock
Conflict Zone InformationSharing
European task force is calling for increased

cooperation within the European Union to
share information about threats to aviation
from flights over conflict zones.
The European High Level Task Force
on Conflict Zones said in March, in its
final report to European Commissioner for
Transport Violeta Bulc, that methods should
be developed for a common European risk
assessment of conflict zones and a quick-alert
mechanism to notify the aviation community.
The task force was established after the
crash of Malaysia Airlines Flight 17, a Boeing
777-200ER that investigators said was shot
down over Ukraine on July 17, 2014, killing
all 298 passengers and crew.
The task force recommendations, which
were submitted to the Presidency of the
Council of the European Union for approval,
call for EU member states to establish national
systems for addressing risks to aviation from
conflict zones and sharing the information
with aircraft operators. Another recommendation says the European Aviation Safety Agency
should establish a process for publishing
information and recommendations on conflict
zone risks based on EU risk assessments or
threat information.
Daniel Betts_WikiMedia_CC BY-SA 2.0
10 |
INBRIEF
New Roles for UAS
nmanned aircraft systems (UAS) are taking on new roles

in at least two arenas insect control in Ethiopia and
emergency supply delivery in the United States.
The Ethiopia project involves use of UAS to reduce populations of tsetse flies, responsible for the spread of sleeping sickness
(trypanosomiasis).
Manufacturer Embention says it has developed a UAS system
that releases sterile male tsetse flies in areas where the population of the insects must be controlled. The Drones Against Tsetse
project calls for the weekly release of 100 sterile males per square
kilometer (0.6 mi), Embention says. The flies are carried to the
affected areas in temperature-controlled under-wing pods that
are automatically released at appropriate intervals.
The project is managed by the International Atomic Energy
Agency, the Ethiopian Ministry of Livestock and the U.N. Food
and Agriculture Organization.
In Hawthorne, Nevada, U.S., the independent drone delivery company Flirtey said it has accomplished the first delivery
in an urban area of a package of emergency supplies bottled
water, food and a first aid kit.
The company said the urban delivery demonstrated that
advanced drone systems allow aerial vehicles to safely navigate
around buildings and deliver packages with precision within a
populated area.
Flirtey
Inaccurate Forecasts
nnual forecasts by the U.S. Federal Aviation Administration (FAA) of aviation activity in the United States have
consistently been inaccurate, the U.S. Government Accountability Office (GAO) says.
In a report issued in March, the GAO said that the errors
typically are largest in forecasts that reach farthest into the
future.
For example, the GAO said, for aerospace passenger
enplanement forecasts made between fiscal year 2004 and
2014, the mean percentage error was less than 1 percent for
one-year-ahead forecasts, 15 percent for five-year-ahead forecasts and 31 percent for 10-year-ahead forecasts.
A major factor behind the errors was the inaccuracy in
factors such as gross domestic product and fuel prices that the
FAA uses in developing its aerospace forecasts and terminal
area forecast summaries, the GAO report said.
Given FAAs reliance on forecasts for decision making, the
report said, managing and understanding the nature of uncertainty is important to good decision making.
The report recommended that the FAA establish errorresponse thresholds for its forecasts and document the methods
and assumptions used in its forecasting models.
In Other News
The Civil Aviation Safety Authority of Australia says it will relax a number of regulatory requirements for operators of very small
unmanned aircraft systems. The changes, which will take effect in September, are intended to recognise the different safety
risks posed by different types of remotely piloted aircraft, CASA Director of Aviation Safety Mark Skidmore said. The European
Aviation Safety Agency has published regulatory changes to update requirements for performance-based navigation procedures and equipment and for holders of multi-crew pilot licenses. The U.S. Federal Aviation Administration (FAA) has begun
an initiative to improve public access to FAA data. The External Data Access Initiative is intended to encourage the development of
new services and ultimately, advance the safety and efficiency of the aviation industry, the FAA says.
Compiled and edited by Linda Werfelman.
| 11
COVERSTORY
Germanwings crash investigators urge clear guidelines
for weighing medical privacy against the threat to public safety.
Photo composite: Susan Reed;

Sky: ecco|Adobe Stock;
Mountains: Sbastien Thbault|Wikimedia CC-BY-SA 4.0;
Rain effect: Lonely11|VectorStock
BY LINDA WERFELMAN
12 |
COVERSTORY
he Germanwings first officer who intentionally flew his Airbus A320 into
the ground in the French Alps had been
diagnosed with a possible psychosis and
given antidepressants days before the crash, but
neither his employer nor civil aviation authorities were told about his mental state, crash
investigators say.
The French Bureau dEnqutes et dAnalyses
(BEA) in its final report on the March 24,
2015, crash of Flight 9525 during a flight from
Barcelona, Spain, to Dsseldorf, Germany
said that the collision with the ground was
due to the deliberate and planned action of the
copilot, who decided to commit suicide while
alone in the cockpit.
The copilot was killed in the crash, along with
all five other crewmembers and all 144 passengers.
A post-crash examination of tissue taken from
the copilot revealed the presence of two types of
antidepressants as well as a sleep medication.
The BEA report, released in mid-March,
singled out the medical certification process for
pilots especially the requirement for selfreporting in case of decrease in medical fitness
as unsuccessful in preventing the copilot
from flying even though he was experiencing
mental disorder with psychotic symptoms.
Among factors that may have contributed,
the report said, were the lack of clear guidelines
in German regulations on when a threat to

public safety outweighs the requirements of
medical confidentiality, the copilots probable
fear of losing his ability to fly as a professional
pilot if he had reported his medical problem to
an aviation medical examiner, and the potential
financial consequences stemming from the
resulting loss of income.
The report said flight recorders showed that
the airplanes descent which eventually varied
between 1,700 and 5,000 fpm began around
0930 local time, within seconds after the captain
walked out of the cockpit, and continued until
the crash at 0941.
At 0930:53, the selected altitude on the flight
control unit changed in one second from 38,000
ft to 100 ft, the lowest value that can be selected in
the A320. Then, the autopilot changed to OPEN
DES (open descent mode, in which the autopilot
acts on the attitude of the aircraft to reach and
maintain the target speed), and the autothrust
changed to THR IDLE (thrust idle) mode.
The copilot failed to respond to radio calls
from civil and military air traffic controllers
and the pilots of another airplane, and did not
open the cockpit door when the buzzer sounded
repeatedly to request access, when someone
was heard knocking on the door, when cabin
crewmembers called on the interphone or when
a voice asked for the door to be opened.
At 0940:41, the ground-proximity warning
systems aural warning Terrain, Terrain, Pull
Up, Pull Up was triggered and continued
until the cockpit voice recorder stopped recording at 0941:06, the moment of impact.
| 13
Hans135797531|Wikimedia CC-BY-SA 4.0
COVERSTORY
A memorial of flowers
Special Conditions
and candles honors
The copilot was 27, had a multi-crew pilot

license (MPL) and had accumulated 919 flight
hours, including 540 hours in A320s.
He began basic training in September 2008
with Lufthansa but suspended training two
months later for medical reasons a bout of
depression that had begun in August. The report
said that, during this severe depressive episode,
he had no psychotic symptoms. He had suicidal
thoughts, however, and was hospitalized, receiving antidepressant medications and psychotherapy. In July 2009, his psychiatrist said he had
fully recovered.
Flight training resumed in August 2009. He
received his private pilot license in March 2011
and his MPL in February 2014, the report said.
He received his A320 type rating in December
2013 and joined Germanwings the same month,
receiving the operators conversion training and
flying under supervision until June 2014, when
he was appointed a copilot. During training
and in recurrent checks, his instructors and
examiners rated his professional level as above
standard, the report said.
None of the pilots or instructors interviewed during the investigation who flew with
him in the months preceding the accident indicated any concern about his attitude or behaviour during flights, the report said.
His initial medical certificate was a Class 1
certificate issued without restrictions in April
2008 and good for 12 months. In April 2009,
those killed in the

March 24, 2015, crash
of Germanwings
Flight 9525.
14 |
it was not revalidated due to depression and

the taking of medication to treat it, the report
said. On July 14, 2009, his request for certificate
renewal was denied by the Lufthansa medical
center, but two weeks later, on July 28, a new
Class 1 medical certificate was issued, good for
12 months, with a waiver that said the certificate
would become invalid if the depression recurred.
At the time of the crash, he held a Class 1
medical certificate issued in July 2014, and an
MPL with a notation that the report interpreted
to mean specific regular medical examinations
contact the licence-issuing authority. The
report added that this notation requires that
the aeromedical examiner (AME) contact the
licence-issuing authority before proceeding with
a medical evaluation relating to any extension or
renewal of the medical certificate. This may involve medical history about which the AME must
be informed before undertaking the evaluation.
All Lufthansa AMEs who examined the
copilot from 2009 until 2014 were aware of the
limitation and they all assessed his psychological and psychiatric fitness through observation
of behaviour and discussions, the report said.
None of the responses provided by the copilot
raised any concern among the AMEs about a
mood, neurotic, personality, mental or behavioural disorder that would have required further
psychiatric evaluation.
In December 2014, about five months after
the most recent revalidation of his medical
certificate, the copilot experienced symptoms
that the report said were possibly associated to
a psychotic depressive episode and consulted
several doctors, including a psychiatrist who
prescribed antidepressant medication. Although
European Union regulations specify that pilots
should not fly while taking medication that
could interfere with the safe exercise of their
flight privileges and that they should promptly
discuss their conditions with AMEs, the copilot
did not consult an AME and continued flying
during dozens of flights between December
2014 and the day of the crash, the report said.
In February 2015, a private physician diagnosed a psychosomatic disorder and an anxiety
COVERSTORY
Intentional Acts From the Past
he French Bureau dEnqutes et dAnalyses (BEA) identified 12

public transport occurrences from 1980 through 2015 that resulted
from intentional action by a flight crewmember or some related
situation. The following are among the identified events.1,2
The Jan. 18, 2015, diversion of a Condor Airbus A320, 60 nm (111
km) from Lisbon, Portugal, after the copilot became incapacitated
and could not perform his duties. The airplane was diverted to Faro
for an uneventful landing, and the copilot was hospitalized and exhibited behaviour during the following days that raised psychiatric
concerns, the BEA said in its summary.
The Nov. 29, 2013, crash of a Linhas Areas de Moambique (LAM
Mozambique Airlines) ERJ-190 in Namibia. The copilot left the cockpit for the lavatory, leaving the captain alone in the cockpit. On three
occasions, different altitudes were selected to order a descent to the
ground with autopilot, the BEA said. Aural warnings and the sounds
of repeated knocking and calls corresponding to attempts to get into
the cockpit were heard on the cockpit voice recorder. All 33 people in
the airplane were killed.
The March 27, 2012, diversion of a JetBlue A320 by its first officer,
who took control after the captain became incoherent, announced
that the flight would not go to its destination and began yelling
about religion and terrorists. The captain was restrained as the airplane landed in Amarillo, Texas, U.S., and subsequently was taken to
a facility for medical evaluation.
The Oct. 31, 1999, crash of an EgyptAir Boeing 767 into the
Atlantic Ocean, killing all 217 passengers and crew. After the captain
left the cockpit, the relief copilot disengaged the autopilot, put
the airplane into a descent and shut off the engines. The captain
returned and tried to regain control of the airplane, but the copilot
continued to command the elevator to pitch nose down, the BEA
said in its summary.
The Aug. 21, 1994, crash of a Royal Air Maroc ATR-42 in Morocco,
killing all 44 passengers and crew. The BEA summary said that the
captain disengaged the autopilot and deliberately directed the
aircraft towards the ground. The copilot was unable to take control
of the airplane.
LW
Notes
1.
BEA. Final Report: Accident on 24 March 2015 at Prads-Haute-Blone (Alpesde-Haute-Provence, France) to the Airbus A320-211, Registered D-AIPX,
Operated by Germanwings. March 2016. Available at <www.bea.aero>.
2.
The BEA cited two other conditions: accidents or incidents in which it was
not possible to rule out the hypothesis of intentional manoeuvres by
one of the crewmembers that [were] intended to lead to the loss of the
aircraft and its occupants, or where the behaviour of one crewmember
was significantly affected by a mental disorder and had an impact on the
safety of the flight. The BEA said that its list does not include events that
resulted from terrorist attacks.
disorder and referred the copilot to a psychotherapist and a psychiatrist, and in March 2015,
the same physician diagnosed a possible psychosis and recommended that the copilot obtain
treatment in a psychiatric hospital. A psychiatrist
prescribed antidepressants and sleep medication.
During February and March, the copilot
received several sick leave certificates from
the private physician and other doctors, but he
failed to submit some of the certificates to Germanwings and continued to fly.
Neither of those health care providers, who
were probably aware of the copilots profession,
informed any aviation authority, nor any other
authority, about the copilots mental state, the
report said, noting that the physicians were adhering to widely accepted principles of medical
confidentiality.
On the day of the accident, the copilot
suffering from possibly a psychotic depressive
episode and taking psychotropic medication
would have been considered unfit to fly, the
report said.
No action could have been taken by authorities and/or his employer to prevent him
from flying that day because they were informed
by neither the copilot himself nor by anybody
else, such as a physician, a colleague or a family
member.
The copilots medical files made available
to the German Federal Bureau of Aircraft Accident Investigation and reviewed by German,
French and British experts in psychiatry and
aviation medicine contained limited medical
and personal information, the report said. As
a result, the experts were unable to make an
unambiguous psychiatric diagnosis, the report
added.
However, the majority of the team of
experts consulted by the BEA agreed that the
limited medical information available may be
consistent with the copilot having suffered from
a psychotic depressive episode that started in
December 2014, which lasted until the day of
the accident. Other forms of mental ill health
cannot be excluded, and a personality disorder
is also a possibility.
| 15
COVERSTORY
The report noted that the copilot
had said, in an email message written in
December 2014, that having that notation attached to his medical certificate
was interfering with his attempts to
purchase insurance to cover potential
loss of income in case he eventually was
found unfit to fly.
He already had loss-of-license
insurance contracted by Germanwings for all of its pilots under age 35
and with less than 10 years of service.
That insurance would have provided
a one-time payment of 58,799 (about
US$67,000) if he had become permanently unfit to fly in his first five years
with the company, the report said.
The copilot flew an average of two
to four flights a day for 11 days in
December 2014, nine days in January
2015, seven days in February 2015 and
eight days in March 2015. He was out
on sick leave from Feb. 2224 and again
from March 1622. The day before the
crash, he was on reserve and conducted
an early morning ferry flight that
lasted about an hour; he then returned
to Dsseldorf, flying as a passenger,
around 0820.
The day of the accident, he flew
from Dsseldorf to Barcelona, arriving
around 0800. Accident investigators
said flight data indicated that actions
on the autopilot system during that
flight could be interpreted as a rehearsal for the suicidal mission carried
out on the return flight, which departed
from Barcelona at 0900.
About half an hour after departure,
the captain read back a clearance to air
traffic control (ATC) and thanked the
controller. There were no further communications between the crew and ATC.
Common Disorder
Depression characterized by sadness,
feelings of low self-worth, difficulty
16 |
concentrating and, in severe cases,

suicidal thoughts is one of the most
common psychiatric disorders, experienced by about 10 percent of the general population at some time in their
lives, the report said. Often, depression
first appears during late adolescence or
early adulthood.
Although civil aviation authorities
vary in the ways they deal with pilots
who have been diagnosed with depression and/or who are taking medication
to treat the disorder, in many countries,
these pilots are denied medical certification. Other civil aviation authorities
allow pilots taking some antidepressants to continue flying, provided they
receive regular medical follow-up care.
However, pilots with a psychotic
disorder or psychosis, characterized by a loss of connectedness with
reality, often in the form of delusions, hallucinations or disorganized
thoughts should not be permitted
to act as flight crewmembers, because of unpredictable recurrences of
psychotic episodes, as well as the side
effects of antipsychotic medications,
the report said.
ConfidentialityPublic Safety Balance

In one of several safety recommendations contained in the report, the BEA
urged the United Nations World Health
Organization (WHO) and the European Commission (EC) to help determine

the appropriate balance between medical confidentiality and public safety.
Legal frameworks in most countries
allow doctors to breach medical confidentiality and warn authorities if the disclosure of personal information would
lessen or prevent a serious and/or imminent danger or a threat to public safety,
the report said. WHO should help
develop guidelines for member states,
and the EC should work with European
Union member states to formulate clear
rules to require health care providers to
inform the appropriate authorities when
a specific patients health is very likely to
impact public safety, including when the
patient refuses to consent.
The report also called on the European Aviation Safety Agency (EASA)
to require that, when a Class 1 medical
certificate is issued to someone with a
history of psychological/psychiatric
trouble of any sort, follow-up conditions be clearly defined. EASA also
should define the ways in which pilots
might be permitted to fly while taking
antidepressant medications under
medical supervision, another recommendation said.
Other recommendations called for
better collection and analysis of data
involving in-flight incapacitation, with
particular attention to psychological
issues; development of measures to
better mitigate the socio-economic
risks related to a loss of licence for
medical reasons; and the promotion of
peer support groups to aid pilots with
personal and mental health issues.
This article is based on the BEAs Final Report:
Accident on 24 March 2015 at Prads-HauteBlone (Alpes-de-Haute-Provence, France)
to the Airbus A320-211, Registered D-AIPX,
Operated by Germanwings. March 2016.
Available at <www.bea.aero>.
AIRPORTOPS
Airports Council International will dive

into five years of data to share insights
from peer reviews of 50 airports.
Trend Spotting
BY WAYNE ROSENKRANS
he global community of airport safety professionals has benefited from an Airports

Council International (ACI) initiative
that harnesses the interpersonal dynamics of their peer group. ACIs Airport Excellence (APEX) in Safety program conducts peer
safety reviews in which safety partner airport
volunteers joined by subject matter experts
from other aviation stakeholder entities lend
specialized expertise and problem-solving
18 |
experience to a host airport (ASW, 4/12, p. 22).

This year, a new phase of the program aims to
refine identification of airport safety trends and
to disseminate specific lessons learned beyond
the host airports.
The program served 50 host airports from
early 2011 to early 2016, says David Gamper,
director, safety, technical and legal affairs, ACI
World (the airport organizations headquarters
in Montreal). Safety partner airport volunteers
Soekarno-Hatta International Airport, Jakarta, Indonesia

Andrew Hunt | AirTeamImages
AIRPORTOPS
often report that involvement helped them
become more flexible and creative in developing solutions to safety problems at their own
airports, he said.
In an update brieng for AeroSafety World,
Gamper described steps toward evolutionary
refinements in safety trending and how safety
review teams help host airports to close gaps
in compliance with international standards
or in safety performance indicators. APEX in
Safety was introduced in a pilot phase that ran
from September 2011 through August 2012,
and began its operational phase in 2013. The
initial objective was improved runway safety,
but ACI also responded to its members requests for assistance with airport certification,
airport emergency plans, measurement of
runway friction characteristics, and compliance
with International Civil Aviation Organization
(ICAO) standards and recommended practices
for safety-critical airport infrastructure such
as pavement markings, lighting and signs.
We have done roughly 40 percent of the
peer reviews in Africa, 15 percent in the Latin
America and Caribbean region, 20 percent in
the Asia-Pacific region, 12 percent in North
America and 12 percent in Europe. That does
demonstrate the programs value to a wide spectrum of airports, he said.
Marking the programs five-year point, ACI
World said, APEX in Safety is an industryrecognized programme that supports airports in
their efforts of continuous operational safety improvement. It is designed to help airports identify and mitigate safety vulnerabilities through
peer review missions, education, mentoring and
best practice guidance. It is an approach that is
relevant for all airports, large or small, in developed, emerging or developing markets. The
programme also helps airports along the road to
aerodrome certication.
The current APEX in Safety Reference Document adds, The programme is based on ICAO
standards, as well as ACI best practices. The
overarching APEX in Safety goal of improving safety is reached when the host airport acts
upon the proposed mitigating measures.1
The document adds that the overall mission is: To assist airports in their efforts to
improve their safety performance; to implement
safety management systems [SMS]; to establish
indicators and tools for the reduction of safety
incidents, as well as tailor ACI engagement to
the airports operating environment, regional
aviation safety goals, requirements for airport
certification, and establishment of runway safety
teams. To increase the level of compliance with
applicable standards and foster the sharing
of best safety practices amongst the airport
community.2
Standard focus areas during each safety
review are runway safety; SMS; aerodrome
certification; wildlife hazard management;
markings, signs and lighting; aircraft rescue
and fire fighting (ARFF); emergency response;
airside driver and vehicle management; management of ground handlers; improvement of the
aerodrome manual and all related safety documentation; low-visibility procedures; obstacle
management; winter operations; foreign object/
debris management; movement area maintenance; movement area access; aerodrome works
(construction) safety; apron safety management;
removal of disabled aircraft; hazardous material
handling; and contractual and legal issues.
Tailored Missions
All safety reviews originate from a request by
a prospective host airport reflecting the
philosophy of being candid and open about
operational risk factors that inevitably will surface (Figure 2, p. 21). ACI similarly encourages
the host airports to specify a few areas for extra
emphasis by the visiting team. Results of every
review are reported to the host airport in a verbal
debrief and a written report, and ACI and ICAO
subsequently study the data collected, on a confidential basis, to aid their own program planning.
Gamper sees APEX in Safety becoming
mature in several respects including its data
analysis as evidenced by the annual number
of peer reviews done (17 in 2015), diversification into airport security and possibly introducing risk areas requested by ACI-member
| 19
AIRPORTOPS
High-Risk Occurrence Categories, Airport Safety Context, 2014
Fatalities
Fatal accidents
Accidents
5%
Controlled flight into terrain
14%
2%
31%
Loss of controlin flight
29%
2%
0%
Runway safetyrelated
14%
54%
0%
10%
20%
30%
40%
50%
60%
70%
Notes: Runway safetyrelated accidents accounted for the majority (54 percent) of all
accidents in global commercial air transport during 2014 but only a single fatal accident with
one fatality, according to ICAO.
Source: International Civil Aviation Organization (ICAO), Safety Report 2015 Edition
Figure 1
airports. Were generally very pleased with its
progress, he said. The peer reviews will remain
the focus. We do some of the education and mentoring and best practice guidance on the mission
the actual week that we spend with the host
airport. If SMS is the gap they have, we will bring
a specialist onto the team, so that might involve
an SMS tutorial of some sort during the week to
help them get up to speed. With other airports,
weve done education on the spot for example,
on wildlife issues or how to interpret ICAO
Annex 14, Aerodromes, Volume I, Aerodrome
Design and Operations.
Specific training/mentoring and ACI best
practice guidance on a subject may be provided by
arrangements during or often after the safety
review. As one example, where paint markings are
inadequate, ACI can provide hands-on training of
the painting staff, with the help of a safety partner.
Each airport involved in a review also is
free to decide whether the host airport and any
safety partners will continue their advisory
relationship. From my experience, these relationships usually are fairly short-term, ending
within a year, for example, Gamper said. But it
could turn into a long-term relationship or even
a decision to become a sister airport a pairing
of some sort where these airports collaborate.
Such an extended relationship developed and
20 |
reinforced newly acquired knowledge and

operational confidence, for example, in Africa
between a large safety partner airport and the
small host airport that had common interest in
wildlife hazard management, he said.
Angela Gittens, director general, ACI World,
said the aviation security component will be added
to APEX in Safety during 2016 because it has
become clear that the peer review formula we have
established is benecial to all players involved.
Alertness for Safety Trends

In 2016, APEX in Safety will see increased
collaboration with ACIs Safety and Technical
Standing Committee in the form of sharing of
information about observed best practices, gap
analysis and regional trends, ACI said.
All host airports are reviewed based on the
template issues noted, with options to look at
their high-priority subjects in greater detail. Some
frequent requests are for a special emphasis by
the visiting team on pavement-management help;
SMS help, especially when the SMS has yet to be
implemented; ARFF; and management of wildlife threats. Its not an audit. This is an attempt
to help our members to implement best practice
and to correct any gaps that they may have with
Annex 14 such as infrastructure deficiencies,
including visual aids, according to Gamper.
Procedures in the host airports aerodrome
manual, as certified by the civil aviation authority (CAA), also are a much-requested special
focus. In some cases, were going to airports
where that manual hasnt been completed or
is out of date, or the airport hasnt been certificated. We can help them to improve their
aerodrome manual, to work with their CAA to
get that certification, and also to improve their
other manuals and procedures, he said. By
keeping their aerodrome manuals up to date,
airports strongly encourage their CAAs to do
the same for the national AIP, he said.
ACI operational safety focus areas typically
correspond to those of an associated ICAO regional aviation safety group (RASG), he added.
An ICAO regional officeraerodromes and
other ICAO safety experts are an integral part
AIRPORTOPS
began to pursue acceptable new ways of widely
presenting lessons learned and safety trends. The
exercise looked at relatively broad categories, but
it became clear that the airport community could
gain from deeper analysis of the existing APEX in
Safety database.
Well start going into quite a lot of detail
to compare findings, he said. Ten committee members will be looking at the results of
the reviews, and they also will have to respect
confidentiality. Were going to take it down to the
level of individual findings and look for commonality, look for gaps in knowledge, gaps in best
practices worldwide, for example areas where
airports need a lot of guidance and then how
we can help to fill those gaps. Weve just set up
an advisory task force within the ACI Safety and
Technical Standing Committee to look at APEX
in Safety and to work with the safety practitioners who are actually doing the peer reviews. My
section is looking at safety guidance material,
working with ICAO on safety standards.
What were aiming to do is look for
regional trends,
particularly those
Overall Timeline for Peer Safety Review by ACI Airport Excellence (APEX) in Safety Program
that may focus our
Host
On-site
Organize safety
Host
efforts in providing
airport
safety
review and review
airport
request
review
help and more guidteam members
ance. We are really
Host airport
Identify
Review team
Final
signs
safety
in the early stages.
report
teleconference
agreement
review team
We are looking very
closely through the
previous reviews
Safety
Host airport
that we have done,
Review of
partners sign
submits
proposed
and we now will
agreements
APEX advance
mitigating
questionnaire
measures
be looking on an
and OPS
context
ongoing basis at
Safety
Follow-up
ACI
ACI
ICAO
awareness
training,
World
reg.
HQ/reg. partners
form
each review we do
assistance
office
office
and progress
at what else needs to
monitoring
On-site Meetings with
Draft
be put in place, for
team
local DGCA,
report
briefing
CAA, etc.
example, to address
the problems of that
ACI = Airports Council International; ACI World = Montreal headquarters; CAA = civil aviation authority; DGCA = directorate
general of civil aviation; HQ = headquarters; ICAO = International Civil Aviation Organization; OPS = operational; reg. = regional
airport.
Notes: Typically, 16 weeks elapse from a host airports initial request for the peer safety review until APEX in Safety delivers a
We have the
final written report to the host airport.
intention to share
Source: Airports Council International, APEX in Safety Reference Document, Version 2.3, Sept. 1, 2015
more lessons learned
Figure 2
on a deidentified
of peer reviews, so it does play into what RASGs
are doing. The same ICAO regional officer
participates in the regions RASG, so he can give
the host airport a broad picture of what all the
CAAs in the region are doing, and at the same
time, were feeding back to ICAO a broader
picture of what airport authorities are doing,
Gamper said.
Each safety review generates 100 to 200 recommendations to the host airport from simple
measures to complex mid-term and long-term infrastructure projects all stored in a deidentified
database for authorized uses. When you think
that we did 17 reviews last year, for example, thats
a lot of recommendations coming out, he said.
The APEX in Safety Reference Document
explains why ACI will not publish or disclose
identifiable content of the safety review reports.
Thats a confidential document given to the host
airport, not something we can put online or give
to other people, Gamper said. However, a recent
trend-seeking ACI exercise using deidentified data
from these reports showed promise, so ACI World
| 21
AIRPORTOPS
basis that allows talking about details
and trends. Were also looking at all the
recommendations coming out of the
reviews.
Gaps or Trends?
So far, the effort has identified a few
gaps in compliance with Annex 14 that
eventually may be regarded as safety
trends of the global airport community. ARFF seems to be identified as a
gap by several airports reviewed even
though thats actually an area where
ICAO has a lot of guidance mainly
aimed at states, he said, noting that
there is also guidance from the U.S.
National Fire Protection Association
and other entities. But there really
isnt anything written by airports for
airports so were going to produce
a handbook on that subject next year.
One of the biggest common gaps that
we have found is SMS implementation.
In April, we published an SMS handbook by airports for airports.
Other gaps that might point to
airport safety trends are deviations from
ICAO standards in airfield markings,
signs and lighting; inadequate pavement
management; and lack of effective practices for the oversight of aircraft ground
handlers. Continually updated ACI
guidance on these subjects includes the
late-2015 ACI Apron Safety Handbook.
Early on, APEX in Safety got aviation industry attention primarily for its
assistance to relatively small airports
with limited resources. The program
actually is open to all ACI members
from large airports in developed countries to the smallest airports in emerging and developing markets.
The vast majority of the airports
that have been reviewed are smaller
airports or small-to-medium size,
Gamper said, but large airports with
advanced safety systems have requested
22 |
peer safety reviews for various reasons. For some, it was to benchmark
themselves against best practice of an
airport that already has a high level
of safety. They still might want to
get some input from peers, and thats
something we can provide in this program. They may be at a point where
they have to make some decisions, or
they have a new senior management
which wants to get a good picture
of safety level compared with other
airports around the world.
A number of recent requests for
peer reviews from European host
airports mentioned a new airportcertification process initiated by the
European Aviation Safety Agency. In
North America, weve done quite a few
peer reviews now, and some of those
have focused on airport SMS, especially
in the USA, Gamper said, noting that
U.S. Federal Aviation Administration
guidance on implementation of SMS at
airports has been incomplete.
Runway Safety Teams

Runway safety remains an inextricable
element of APEX in Safety. One of
the things we always do, when we go
on any review, is to check whether
they have a runway safety team at the
airport, and if they dont, we help them
to set one up, Gamper said. The local
runway safety team is a very powerful
idea that gets combined support from
ACI and ICAO, he said.
A runway incident [Figure 1, p. 20]
is probably the most serious of incidents
that occur at an airport. They have the
potential to cause consequences up to
an aircraft loss. Incidents during ground
handling or on the apron involve risk of
injury, damaged aircraft or damage to
equipment. But theyre not life-threatening in the way that runway safety events
can be, he said.
ACI will begin this year to monitor

risk metrics and safety performance
indicators at the airport level, which
differs significantly from ICAOs audits
of state airport oversight.
Considerable work has yet to be
done by airports to effectively collect
and monitor safety data, especially details of what occurred in incidents and
accidents, Gamper said. Every time
we go on one of these APEX in Safety
reviews, we are looking at whether they
have access to information, whether
they collect data on incidents and accidents, and also at precursors, as one of
the key elements of SMS, Gamper said.
Without data, you cant manage safety
to reduce the level of risk.
Whenever state guidance to airports is sparse, ACI promotes the use
of ICAOs and ACIs runway safety
materials as a primary source for ways
of improving runway safety and using
model standard operating procedures
for safe airport operations.
Theres nothing to stop an airport
operator going beyond what is required
in their country, Gamper said. The
CAA may be concentrating on certain
very important areas like flight operations and air operator certificates for
airlines with maybe a little bit of a
detriment to aerodrome regulation. So
an airport may not be able to go to its
CAA and ask for guidance.
Notes
1. ACI World. APEX in Safety Reference
Document, Version 2.3, Sept. 1, 2015.
2. The programs standardized safety
review comprises the host airports selfassessment of the safety level using the
APEX Advance Questionnaire and the
Operational Context Awareness Form,
gap analysis, recommended solutions
and the collaborative design of a corrective action plan.
STRATEGICISSUES
TIPPING
POINTS
BY WAYNE ROSENKRANS
The convergence of familiar factors in a

2012 CFIT accident underscores why ever Bildagentur Zoonar GmbH| | Shutterstock
present vulnerabilities must be mitigated.
errain awareness and warning system (TAWS) technology with significant enhancements scheduled
to debut in December 20161 enables flight crews to
escape from imminent controlled flight into terrain
(CFIT) so reliably that subject matter experts remind the
aviation community of other risk mitigations. One is to
combine the last-chance technology with preventive flight
planning strategies, standard operating procedures (SOPs)
and training. For TAWS itself, the reminders are to continually update equipment with the latest software; keep the
terrain/obstacle/runway database current; install global
positioning system (GPS) receivers; activate geometric altitude; and train flight crews to select at least one side of the
display in the terrain mode.
The full range of CFIT risk mitigations can be studied
and implemented from resources such as Flight Safety
Foundations CFIT Training Aid and Approach and
Landing Accident Reduction Tool Kit, and from CFITfocused safety enhancements, adaptable to the global
airline industry, published by the U.S. Commercial
Aviation Safety Team at <www.skybrary.aero/index.php/
Portal:CAST_SE_Plan>.
| 23
STRATEGICISSUES
The International Civil Aviation Organization
(ICAO) says commercial air transport accidents
categorized as CFIT were responsible for 14 percent of fatal accidents analyzed in 2014,2 its latest
year of published data analysis. The corresponding fraction for 2013 was 13 percent. ICAOs
harmonized accident category3 says [CFIT]
includes all instances where the aircraft was flown
into terrain in a controlled manner, regardless
of the crews situational awareness. [CFIT] does
not include undershoots, overshoots or collisions
with obstacles on takeoff and landing, which are
included in runway safety.
Editors of Eurocontrols SKYbrary website,
looking at recent CFIT accidents, have compiled a
list of key CFIT defenses4 that includes: adherence to SOPs; installation, software upgrades
and terrain database updates (as noted); initial
and continuing flight crew training to respond
to TAWS warnings; and enhancing situational
awareness of terrain among pilots and air traffic
controllers. They suggest breaking down the
complexities of CFIT into pilot-induced situations,
such as those in which the flight crew descends below the charted minimum safe altitude (MSA) in
an area of low visibility; and air traffic controller
induced situations, such as incorrect or mistimed
vectoring for an instrument approach procedure,
often involving distraction, miscommunication,
task saturation and other human factors.
Study of CFIT accidents has enabled a large
number of accident precursors to be identified.
These precursors are not necessarily contributing
factors, though some may be; but they are warnings revealing that a weakness has been detected
in existing defence mechanisms, they said.
Approach design and documentation issues
identified in recent years also have turned attention to the depiction of an approach, and particularly stepdown fixes, on terminal approach
procedures [that] may not be clear. Approaches
may take aircraft close to high terrain in order
to comply with diplomatic or noise abatement
constraints, or to deconflict with departure
routes, SKYbrary editors said.
In commercial air transport, some civil aviation authorities have concluded that nothing
24 |
substitutes for TAWS equipage/updating of fleets;

a higher routine level of awareness of approach
and landing risks; upgrading legacy stepdown
procedures to constant angle/continuous descent
final approaches; and having consistently high
availability of minimum safe altitude warning
systems at air traffic control (ATC) facilities.
All Things Reconsidered

Eurocontrol cited a Royal Norwegian Air Force
C-130J-30 Super Hercules accident in Sweden
as a significant example of interrelated CFIT
factors, and this accident also was presented as
a human factorsregulatory case study at the
FSF International Air Safety Summit (IASS) in
November 2015 in Miami Beach, Florida, U.S.
The purpose of the accident flight was to pick
up troops and equipment that had participated
in a North Atlantic Treaty Organization exercise
and return to Norway.
The final report on the March 15, 2012, crash
by the Swedish Accident Investigation Authority said, The accident was caused by the crew
[of aircraft call sign] HAZE 01 not noticing the
shortcomings in the clearances issued by the air
traffic controllers and [by] the risks of following
these clearances, which resulted in the aircraft
coming to leave controlled airspace and [by being] flown at an altitude that was lower than the
surrounding terrain. Contributing factors were
that the operator had not ensured that the flight
crews working methods would prevent flight
below the minimum safe flight level on the route,
and that the air navigation service provider had
not fully ensured that relevant flight information was provided and that clearances were only
issued within controlled airspace during flight
under instrument flight rules (IFR) unless the
pilot specifically requested otherwise.
CFIT on Mount Kebnekaise

Britt-Marie Karlin, flight safety analyst, Swedish
Transport Agency, told IASS attendees that from
the regulators point of view, the safety recommendations derived from this event, which killed
all five occupants near the two peaks of Mount
Kebnekaise, underscore that the entire aviation
STRATEGICISSUES
Peak 2,104 m (6,903 ft)

Crash site
North
Glacier
HAZE 01 leveled out at Flight Level 70 at

[1457]. Half a minute later, the aircraft collided
with the terrain between the north and south
peaks on the west side of [Mount] Kebnekaise.
Data from the aircrafts recording equipment
[cockpit voice recorder and digital flight data
recorder] showed that HAZE 01 was flying in
level flight at a ground speed of approximately
280 kt prior to the moment of collision and that
the crew was not aware of the imminent danger
of underlying terrain.
Swedish Transport Agency
community must learn something from every

accident even though this one received less public attention outside Scandinavia than a civilian
airline CFIT accident would receive.
Airspace differences in Sweden compared
with other states of Europe and other world
regions were noted by the investigators. Pilots
operating in this airspace change their altimeter
settings passing 9,500 ft to transition from using
a reported setting that displays altitude above sea
level to constant pressure altitude to accurately
display flight levels. However, an exception exists
in a small area of northwest Sweden, where this
transition altitude is 12,500 ft. These practices affected the minimum flight level assigned by ATC
for flight under IFR, Karlin said.
The final report5 on the accident said the
planned 40-minute flight was from Harstad/
Narvik Airport (Evenes) in Norway to Kiruna
Airport in Sweden, with two pilots, two loadmasters and one passenger. [After takeoff,] the
aircraft climbed to Flight Level 130 and assumed
a holding pattern south of Evenes. After one
hour, the flight continued towards Kiruna Airport. The Norwegian air traffic control [ATC]
had radar contact and handed over the aircraft
to the [ATC] on the Swedish side. Swedish
[ATC] cleared HAZE 01 to descend to Flight
Level 100 when ready and instructed the crew
to contact Kiruna Tower. The crew acknowledged the clearance and directly thereafter, the
aircraft left Flight Level 130 towards Flight Level
100. The lower limit of controlled airspace at the
location in question is Flight Level 125.
HAZE 01 informed Kiruna Tower that the
aircraft was 50 nm [93 km] west of Kiruna and
requested a visual approach when approaching.
Kiruna Tower cleared HAZE 01, which was then
in uncontrolled airspace, to Flight Level 70, and
the aircraft continued to descend towards the
cleared flight level.
Neither [Area Control Center] Stockholm
nor Kiruna Tower had any radar contact with
the aircraft during the sequence of events
because the Swedish air navigation services do
not have radar coverage at the altitudes at which
HAZE 01 was situated.
Kebnekaise is the
highest mountain
in Sweden.
Regulators Perspective
The Swedish Transport Agencys Karlin said
that because the sky was clear while the aircraft
was in the holding pattern at Flight Level 130
over Norway, the flight crew probably could see
their destination, Kiruna, on the Swedish side
and this probably influenced their preparation
for a visual approach. But en route to Kiruna at
the time of the accident, visibility was less than
1 km (0.6 mi) in cloud and snow showers, the
report said. Cloud cover was overcast (8 oktas)
with the cloud base variable at 1,000 to 4,000 ft
and the cloud tops reported at Flight Levels 090
and 100.
The flight crews conversation included
comments that they would go tactical rather
than use TAWS that is, intentionally suppress
civilian terrain warnings, normally to eliminate
nuisance warnings when entering combat but
| 25
STRATEGICISSUES
one effect was to deny them terrain
data north of latitude 60 degrees N.
Karlin noted that after leaving
holding, the flight crew was flying west
to east, but the air traffic controller at
Kiruna, accustomed to separating aircraft in a north-south traffic flow, had
never controlled an aircraft arriving
from the mountainous area in the West.
The controller cleared the flight
crew to descend to 10,000 ft instead of
keeping the aircraft at Flight Level 130,
the minimum safe altitude, she said.
Was it simply forgotten? I dont know.
About [that time], the first officer
turned to the captain and asked Is it
right that the elevation of the mountains up here is 7,000 ft? As noted in
the report, they then were cleared to
descend to 7,000 ft despite the MSA
and subsequently cleared to 5,000 ft
(before the controller was informed of
the crash).
What happened here? What was
the thinking both from the controller and the pilots? Karlin asked.
Except when you are radar vectored,
you are always as a pilot responsible for knowing where the terrain is.
It makes you wonder if the controller
thought they were in [visual meteorological] conditions but they were [operating under] IFR and [IFR operation]
was never canceled.
The Royal Norwegian Air Force
used a flight-planning method depicting terrain elevation above sea level on
paper route charts with a symbol and
numbers, called a dog house, including
the emergency safe altitude (2,000 ft
above the highest obstacle within 22
nm [41 km]), and the altitude/flight
level for the starting point of each route
section. However, she said, the flight
crews minimum obstacle-free altitude
depiction disappeared at the Swedish
border, possibly visually reinforcing the
26 |
idea that the mountainous terrain was

higher in Norway than in Sweden.
Nobody [in the crew] knew there
was no [terrain] database when you are
in tactical [mode] north of 60. They had
been trained in Little Rock, Arkansas,
[U.S.]. They had no idea. [If] they
had had a [warning] signal, even had
a lesser [warning] in tactical mode,
chances are they could [have cleared] the
mountain they were that close, Karlin said. They were in cloud. There was
no hope they would see that mountain.
The most significant safety recommendation to emerge from the accident
investigation and reduce CFIT risk
pertained to airspace structure, she
said. All IFR procedures in the whole of
Sweden now, unlike under a prior exception, have to have enough controlled
airspace to be conducted entirely in the
controlled airspace, she said.
Safety recommendations, addressed
to several organizations, focused on
ensuring that SOPs prevent aircraft from
being flown below the minimum safe altitude or flight level while en route under
IFR; ensuring that the flight crews knowledge and operating procedures support
their safe use of TAWS; and examining
practices and verifying that crewmembers
flying the aircraft safely perform flight
planning with accurate terrain depiction
for the area of operation.
Others were clarifying rules, manuals and procedures so that they effectively mitigate CFIT risk; investigating
the air navigation service providers
safety culture and CFIT perspective;
and redesigning airspace as noted.
Moreover, the investigation called for
training controllers to develop sufficient CFIT-related expertise and skill
with performance aids to manage
situations that do not frequently occur
and resolving discrepancies and ambiguities among the regulatory provisions
affecting area-type controlled airspace,

including the lowest usable flight level,
area minimum altitudes and flight
levels above 3,000 ft.
Notes
1. RTCA Staff. Consensus-Building Key
to Updated TAWS Standards. Volunteer
Spotlight. Feb. 4, 2015. Since May 2014,
RTCAs Special Committee 231, Terrain
Awareness and Warning System, has been
developing a new minimum operations
performance standard that will update the
standards and guidance published in 1976
and in the late 1990s. The committees task
expanded in 2014 to encompass a request
from the U.S. National Transportation
Safety Board to update TAWS requirements for situations when an airplane is
congured for landing near an airport,
including descending at high rates with
rising terrain near an airport, RTCA said.
2. ICAO. ICAO Safety Report, 2015 Edition,
July 23, 2015.
3. The Global Safety Information Exchange
in 2011 introduced a harmonized method
of analyzing commercial airline accident
data (scheduled and non-scheduled
flights). Members are the U.S. Department
of Transportation, the European
Commission, the International Air
Transport Association and ICAO.
4. SKYbrary. Accident and Serious Incident
Reports: CFIT. <www.skybrary.aero/index.php/Accident_and_Serious_Incident_
Reports:_CFIT>. Accessed April 18, 2016.
5. Swedish Accident Investigation Authority
(Statens haverikomission). Accident involving a Royal Norwegian Air Force aircraft
of type C-130 with call sign HAZE 01, on
15 March 2012 at Kebnekaise, Norrbotten
County, Sweden. Final report RM
2013:02e, Oct. 22, 2013, (English translation of original Swedish report).
6. Tactical mode, designed for combat
entry, substitutes military terrain warning
technology for TAWS; in this mode, the
flight crew relies on hearing pings as a
reminder that normal TAWS functionality
with the civilian terrain database has been
suspended.
AVIATIONRESEARCH
Training can help pilots prepare

for hazardous aircraft icing.
Simulating Encounters With ICE

A
hazardous ice formation is one that can

substantially degrade aircraft performance, cause handling problems, and,
in the extreme, result in a stall or loss
of controlin flight (LOC-I). Such a formation
is characterized by its size or volume, shape,
and location, especially when ice accretes on
wings and tail surfaces. The cause may be an
ice-protection system failure, pilot error or a
28 |
severe icing condition such as the presence of

super-cooled large droplets that overwhelms
the protection system.
In a 2010 technical memorandum regarding LOC-I events, the U.S. National Aeronautics
and Space Administration (NASA) called icing
arguably the most significant environmental
hazard for triggering LOC accidents, and noted
that it was a factor in 54 percent of 40 accidents
jamesbenet | iStockphoto
BY RICHARD J. RANAUDO
AVIATIONRESEARCH
involving U.S. Federal Aviation Regulations
(FARs) Part 121 (air carrier) and scheduled
Part 135 (commuter) aircraft between 1988
and 2004. During the same period, icing also
factored in 27 percent of the 159 accidents
involving unscheduled (on-demand) Part 135
accidents and 6 percent of the 4,287 accidents
involving Part 91 general aviation aircraft.1
The development of a hazardous icing condition can be insidious.
Important cues for recognizing the onset of
in-flight icing conditions are visible icing formations on the aircraft, performance degradation
and unusual control response that develops over
time with the exact amount of time depending on the icing rate.
The ability of a pilot to assess these cues
and take appropriate action depends on the
individuals training and experience. Experience
comes with time in the cockpit, but training can
offset an experience deficit. The safest and most
efficient way to train pilots for hazardous icing
conditions is in a flight simulator that can represent cues and handling characteristics, including
stalls and upsets, for the type aircraft they are
operating. Without this kind of training, pilots
are not prepared to react properly when encountering a real-world hazardous icing event.
Simulators qualified under FARs that are
currently in use to train commercial pilots
do not have this capability, but new rules will
change that. A 2010 law directs the U.S. Federal
Aviation Administration (FAA) to require
stall and upset training for flight crewmembers
using ground training, flight training or flight
simulator training. The law also required stick
pusher training, an evaluation of this training capability for weather-related events such
as icing conditions and training in stall and
post-stall behavior related to icing conditions.
The FAA filed a notice of proposed rulemaking
in 2014 outlining how it plans to accomplish
those goals.2
Is the capability to train for an icing event a
practical objective? Would this training provide better situational awareness and positive
habit transfer for real-world aircraft handling
problems or a stall event? These questions can

be addressed by studying NASAs success in
developing a unique flight simulator for icingrelated pilot training, the Ice Contamination
Effects Flight Training Device (ICEFTD).
Training Needs
Pilot training simulators are designed to incorporate the flight characteristics of an aircrafts
normal flight envelope. Therefore, if a pilot
encounters a real-world flight condition outside
that normal flight envelope, he or she may not
have had the training or experience to handle it
properly.
The U.S. National Transportation Safety
Board (NTSB) took note of this in its final report on the Feb. 12, 2009, fatal crash of a Colgan
Air Bombardier Q400 on approach to Buffalo
Niagara (New York, U.S.) International Airport:3
[A]s pilots transition to larger, autopilotequipped, transport-category airplanes,
they rarely, if ever, receive reinforcement
on how actual stalls feel and how they are
to be handled because air carrier training
does not require pilots to practice recoveries from fully developed stalls.
Pilots have only seconds to prevent an incipient
stall from developing into a full stall or upset. If
airframe ice contamination is a factor, the cues
and characteristics of an impending stall can
differ from the cues and characteristics of an
incipient stall involving a clean airframe. This
reinforces the argument for providing training
through simulation. It is far too dangerous and
costly to provide icing-induced upset training
in an actual aircraft with ice shapes attached to
wings and tail surfaces.
Advances in Simulator Technology

Research in the 1980s and 1990s in several
areas development of simulators to enable
practicing recovery from upset conditions,
improved understanding of tail stall upsets and
recovery procedures, and flight tests in natural
icing clouds to assess the aerodynamic effects
of icing on aircraft performance and handling
qualities laid the groundwork for new designs
| 29
NASA
AVIATIONRESEARCH
The ICEFTD is set

up to simulate flight
characteristics of the
NASA Twin Otter Icing
Research Aircraft.
and training aids to help prevent incidents

and accidents caused by icing on the horizontal stabilizer. As a result of this research, the
Tailplane Icing Program was established, with
elements that incorporated all of its icing research assets, including NASAs research using
a DHC-6 Twin Otter an aircraft known to
be prone to tail stalls.4
ICEFTD Development
Development of the ICEFTD itself began in
1998. The NASA Glenn Research Center teamed
with Bihrle Applied Research of Hampton,
Virginia, U.S., and Wichita (Kansas) State
University to advance flight simulator technology and to explore the feasibility of developing
a flight-training device for icing-related pilot
training. The objectives were twofold: to evaluate a methodology for developing simulator
models and to build a concept demonstrator to
evaluate its utility for training pilots for hazardous icing conditions. NASA postulated that if
this methodology proved feasible, it could be
applied to existing flight-training simulators,
30 |
resulting in an important safety-related training

capability.
The ICEFTD simulates the flight characteristics of the NASA Twin Otter Icing Research
Aircraft in a no-ice baseline and in two icing
configurations. One configuration simulates
horizontal stabilizer icing, and the other simulates ice on both the wings and the horizontal
stabilizer.
NASA configured the Twin Otter research
aircraft with artificial ice shapes on the wings
and horizontal tail surfaces, and NASA test
pilots flew stall and upset maneuvers, recorded
critical aerodynamic measurements and used
that information to adjust the simulator model
where necessary. The final product, shown in
the photo above, was an economic compromise
between form and function, with function winning out.
The ICEFTD consists of a raised platform,
a pilot seat, a control yoke, rudder pedals and
a twin-turboprop throttle quadrant. There are
three flat-panel monitors for out-the-window
graphics and one more flat panel to provide
AVIATIONRESEARCH
instrument panel graphics. The control
column connects to a programmable
elevator control loading system that
provides tactile control feedback to the
pilot. These feedback cues are essential
to support the learning objectives in the
training scenario.
Ailerons and rudder do not have
force feedback and simply use a mechanical spring resistance system.
Two commercial off-the-shelf personal computers support the simulation
model and the graphics, and a third
computer supports the control force
loader.
An instructor station, set up on
a table directly behind the ICEFTD,
includes a laptop computer to provide control of the simulation (initial
conditions, start, stop, etc.), video
recording and monitoring devices, and
an intercom system for communication between the training pilot and the
instructor. A second laptop computer
records pilot comments during the
simulation sessions.
A Bihrle commercial off-the-shelf
simulation environment known as
D-Six controls the ICEFTD simulation.
The device is not a full flight simulator,
but provides a very high fidelity representation of icing effects on aircraft
handling characteristics, as well as wing
and tail stall upsets. To enhance reality,
the pilot is isolated from distractions
during the training session by curtains
that are drawn around the simulator.
The operating system also records and
displays time histories of control deflection and elevator force, which is useful
for debriefing pilots after training for a
stall or upset event.
Pilot Training Evaluations

Initially, four formal demonstrations of
the simulator were conducted between
October 2004 and November 2005.
The first two demonstrations took

place in an aircraft icing short course
sponsored by the University of Tennessee Space Institute (UTSI) in Tullahoma, Tennessee, U.S. Twenty-four pilots
and flight test engineers from Bombardier, Cessna, Raytheon, the U.S. Army,
U.S. Forestry Service, the FAA, and the
Transportation Safety Board of Canada
attended these courses, which consisted
of lectures and a simulator session in
NASAs ICEFTD.
Course participants also trained
in the universitys variable stability
aircraft, which simulated only icingrelated handling effects. Feedback
from many participants on simulation
fidelity highlighted the complementary
nature of the aircraft and ICEFTD.
However, participants also reported
that the ICEFTD offered more capability because it could simulate stalls and
upsets. It also could provide a more
realistic training scenario.
The third demonstration took
place at the National Test Pilot School
(NTPS) in Mojave, California, U.S., in
October 2005. This demonstration was
part of an NTPS one-year professional
test pilot program. Nineteen pilots and
flight test engineers experienced the
effects of icing on stall and controllability. Control difficulties caused by icing
surprised many participating pilots.
The fourth demonstration, in
November 2005, was part of another UTSI aircraft icing short course
in Wichita. Eighty-nine pilots and
engineers from Bombardier, Cessna,
Raytheon and the FAA attended this
short course, consisting of two days
of lectures, followed by a one-hour
ICEFTD simulator session for 41 of the
participants. This demonstration, which
benefited from the feedback in previous
demonstrations, was the most extensive
of the four. A number of participants
especially those with experience

flying aircraft with ice shapes during
development and certification flighttesting said the simulation reflected
real-world encounters with icing.
Others, who had little experience with
icing, were unprepared for the difficulty
they had dealing with the control forces
and pitching characteristics during
impending-stall and upset conditions.
Training Syllabus
In 2014, the aircraft icing short course
was moved to Embry-Riddle Aeronautical University in Daytona Beach,
Florida, U.S. The ICEFTD remains the
centerpiece of this course for hands-on
icing-effects pilot training.
A typical training session begins
with basic handling familiarization
exercises for the non-iced condition,
including wing stalls and practice
instrument approach procedures.
Next, the pilot performs the same tasks
with ice to experience the difference between clean and iced-wing stall
characteristics.
Participants learn to develop an
awareness of a low-speed condition and
abnormal control response that precedes a stall. They develop proficiency
recovering from a full stall and learn
to manage angle-of-attack to regain
elevator effectiveness and effect a safe
recovery.
Recognizing and recovering
safely from an incipient or full icinginduced wing stall is an important
training objective because it emphasizes recognition cues and appropriate
control technique. The photo on p. 32
is a snapshot from the ICEFTD cockpit
video camera showing an out-thewindow view of a pilot recovering from
a stall upset due to wing icing. Note the
extreme roll angle, which is very realistic, as well as the pilots yoke position.
| 31
AVIATIONRESEARCH
civil pilot training programs is essential
to reinforce certain automatic behaviors, especially for events requiring
immediate action such as an engine
failure during takeoff.
Positive habit transfer from simulator training has greatly improved flight
safety in these events. However, providing simulator capabilities that train
pilots to recognize, prevent or recover
from icing-induced upsets raises the
bar considerably.
This photo, taken from the ICEFTD cockpit video, shows what the
pilot sees during recovery from a stall caused by wing icing.
Richard J. Ranaudo was aNASAresearch pilot

for 25 years and the lead project test pilot in the
icing research program for 16 years.After retiring from NASA, he spent five years as manager
of Canadair flight test programs, and conducted
icing development and certification testing on
prototype business and regional jet aircraft.
Notes
32 |
Once the basic training exercises

are completed, the pilot conducts an
instrument approach procedure in an
icing scenario that simulates a failed
ice-protection system. The profile
requires the pilot, in the final phase of
the approach, to use airspeed and wing
flap settings that will induce a tail stall
upset. The critical moment comes as
the pilot breaks out of the clouds at
approach minimums, and selects the
wing flaps down. The inevitable tail
stall occurs.
Many pilots who experience this
upset for the first time are startled by
the event. Some take appropriate control action, and some revert to instinct,
continuing to fight overwhelming elevator control forces before crashing.
Repeating the training exercise is
sometimes required to reinforce upset
recognition cues and highlight the
differences between wing stalls and tail
stalls.
Without question, flight simulators
play a dominant role in pilot training
today. Their use in both military and
1. Reehorst, Andrew L.; Addy, Harold E. Jr.;

Colantonio, Renato O. NASA/TM-2010216912, Examination of Icing Induced
Loss of Control and Its Mitigations. Nov.
1, 2010.
2. FAA. Flight Simulation Training Device
Qualification Standards for Extended
Envelope and Adverse Weather Event
Training Tasks. Federal Register. July 10,
2014. Available at <www.federalregister.
gov>.
3. NTSB. Accident Report NTSB/AAR10/01, Loss of Control on Approach;
Colgan Air, Inc., Operating as Continental
Connection Flight 3407; Bombardier
DHC-8-400, N200WQ; Clarence Center,
New York, February 12, 2009. Feb. 2,
2010. Available at <www.ntsb.gov>.
The accident killed all 49 people in the
airplane and one person on the ground
and destroyed the airplane. The NTSB
identified the probable cause as the
captains inappropriate response to the
activation of the stick shaker, which led
to an aerodynamic stall from which the
airplane did not recover.
4. Additional information about NASAs
icing research is available at <aircrafticing.
grc.nasa.gov/COURSES.html>.
Richard J. Ranaudo
After the wing stall exercise is

completed, tail stall upset training
begins with a wing-flap transition
maneuver. This maneuver emphasizes
how increasing wing flap deflection induces a pitch upset. Pilot cues
include sudden and rapid pitch down,
extremely high downward elevator
control force-feedback, and increasing
airspeed. Here, the instructor emphasizes cue differences between wing
stall and tail stall upsets.
Diagnosing these differences correctly is essential for eliciting appropriate recovery actions by pilots. In
the wing stall case, elevator control is
relaxed to reduce angle-of-attack, but
in the tail stall case, the pilot must hold
a substantial pull force on the elevator
while raising the wing flaps.
Correctly recognizing the type of
upset is an aspect of the training that
has received more emphasis in recent
course offerings. The purpose is to
eliminate any confusion the pilot may
experience in differentiating between
these two events.
SAFETYOVERSIGHT
n the early 2000s, a number of European citizens died in aviation accidents

involving air carriers from outside of
the European Union (EU), including
Egyptian carrier Flash Airlines, Tunisias
Tuninter, Colombias West Caribbean
Airways, TANS from Peru and Mandala
Airlines from Indonesia.1 According to the
European Commission (EC), the investigations into these accidents revealed that
inadequate safety oversight by the operators and the authorities was a common
factor. The EU determined there was a

need for a tool to prevent unsafe airlines
from operating to, from and within the
EU and to warn the travelling public when
flying outside of the EU. The result was
Regulation 2111/2005, approved by the
European Parliament in December 2005,
which created the EU Air Safety List (ASL)
sometimes known as the EU blacklist.
The ASL includes air carriers from nonEU countries that are assessed as failing to
adhere to applicable international safety
A Place on
THE LIST
BY MARIO PIEROBON
European authorities see

the EUs Air Safety List
as crucial in improving
aviation safety.
| 33
SAFETYOVERSIGHT
standards. The carriers on the ASL are banned,
either partially or completely, from operating
to, from and within the EU. Carriers that do
not operate into the EU also have been put on
the ASL, which the EC says is done in order to
warn Europeans travelling outside the EU about
possible safety deficiencies in these operations.
Another aspect of the ASL is that if the safety
authorities of a non-EU country are assessed as
unable to fulfill their international safety oversight obligations, all the carriers certificated in
that country can be put on the ASL.
The ASL is updated periodically with the
publication of two annexes: A and B. The air
carriers mentioned in Annex A are subject to a
total ban, and are not permitted to fly into, out
of or over the EU. Annex B lists the air carriers that are subject to restrictions but not an
outright ban. Such restrictions, for example,
may permit these companies to use only specific
aircraft, or specific aircraft types, to operate into
the EU.
The two annexes are regularly updated by
the EC following meetings of the EU Air Safety
Committee (ASC), which comprises safety
experts from all member states and is chaired by
the EC and supported by the European Aviation
Safety Agency (EASA). The EC and the ASC use
a variety of information sources when assessing
whether international safety standards are being
met. Information sources include the International Civil Aviation Organization (ICAO), the
U.S. Federal Aviation Administration (FAA),
EASA and safety assessment of foreign aircraft
(SAFA) reports, as well as information gathered
by individual member states and the EC itself.
The SAFA program conducts inspections of
aircraft landing at EU airports for compliance
with ICAO standards. The results are analyzed
by EASA, and the data are used to assist in
determining the safety performance non-EU air
carriers, according to the EC.
The air carriers currently on the list are
there mainly due to failings of their oversight
authority, pointing to a lack of implementation of ICAO standards and recommended
practices (SARPs); however, there are also air
34 |
carriers included in the list due to individual

causes, says the EC. It is very difficult to say
if there is one general area where authorities or
air carriers need to improve. This all depends
on the situation of the country, the authorities
and the air carriers and the environment they
operate in. Elements of focus can be the proper
implementation of air operator certification,
personnel licensing and the airworthiness of
aircraft, as well as the resolution of safety concerns. These are examples of areas the aviation
authorities may need to focus on, but this is
certainly not an exhaustive list. For air carriers, examples are the actual operations, proper
manuals, safety management, coping with
changing circumstances (market changes, expansion, etc.) and the recruitment and training
of operational personnel. The most important
thing is that the parties involved search for the
fundamental, underlying root causes, identify
them and correct these root causes in a sustainable manner.
The challenge for banned carriers and their
oversight authorities is meeting high industry
and regulatory standards to improve their safety
and oversight records. This challenge is being addressed in Africa, for example, although
much progress still needs to be made, some
regional experts say.
Chris Zweigenthal, chief executive of the
Airlines Association of Southern Africa (AASA)
believes that the role of ICAO is of key importance in this respect. ICAO is the custodian of
international SARPS, and whilst each jurisdiction, such as the EU, has the right to impose
certain additional conditions on states or their
carriers to permit them to operate to the EU, the
ICAO SARPS must be an important consideration. ICAO also undertakes regular audits
on states and, if there are concerns, they issue
findings and require states and their airlines
to attend to these findings before they give the
state an approved audit, he says.
States should contract experts to assist them
to address the deficiencies, whether it be to
restructure their civil aviation authorities to improve efficiencies and rectify oversight concerns
[I]f the safety

authorities of a
non-EU country
are assessed
as unable to
fulfill their
international
safety oversight
obligations,
all the carriers
certificated in
that country
can be put on
the ASL.
SAFETYOVERSIGHT
or address other issues. These experts
can be ICAO or suitably qualified
consultants. Such interventions will
naturally come at a cost, but if states
want an aviation industry, they need to
invest in their industry and obtain necessary funding, whether it be through
their state budget process, external
donor funding or a fair and reasonable
user charge system, says Zweigenthal.
The challenge of upgrading a
countrys aviation system to international standards is complicated by
the fact that often the entities that
find themselves on the ASL operate
in environments characterized by significant government budgetary and
geo-political issues.
According to Tom Kok, director of
the AviAssist Foundation, some countries whose carriers are on the list have
a strong link to a European country
(e.g., as a former colonial power) and so
might get support from that country to
maintain air links between both communities. Other countries, however, do
not get such an opportunity. Kok notes
that a working group of the European
Civil Aviation Conference (ECAC) has
been developing plans for a system of
pairing up civil aviation authorities to
help countries that struggle with safety
oversight. Such an initiative could
provide in-country training courses
in disciplines that do not require large
infrastructure investment, such as
safety and quality management, human
factors and crew resource management, to help build capacity in aviation
training centers in countries on the
ASL. Kok says the new ICAO Program
for Aviation Volunteers (IPAV) also can
help build competencies in countries
with developing aviation systems. IPAV
aims to deploy aviation professional
volunteers to assist states in developing
capabilities to implement ICAO SARPs,
backed by voluntary financial contributions to fund the program.

The new ICAO IPAV program is
another of our recent No Country Left
Behind initiatives, says ICAO Technical Cooperation Bureau Director Ivan
Galan. The basic approach will see
aviation professionals, from a variety of
disciplines, providing short-term assistance to states on a voluntary basis. The
overall goal with IPAV is to help ensure
our member states can satisfactorily
and cost-effectively address shortcomings that may have been identified
during ICAO safety and security audits,
he says.
Making a Plan
From a project management perspective, one of the first initiatives a
national government should consider is
developing a suitable national aviation
system plan that is harmonized with
international standards and, together
with that, manage relations with
international bodies to solidify their
assessment of the states credibility and
commitment.
AviAssist found, in working with
EASA in Malawi two years ago, that
there needs to be a better understanding of the types of limitations that
governments face in countries affected
by the ASL. For example, recommending the use of costly project management software to organize the setup of
an action plan may not be helpful if it
is beyond the financial capabilities of
some countries. Even if a less expensive
or free version is used, as was done in
Malawi, the already-overwhelmed staff
may not be well versed in its use, says
Kok.
It also should be recognized that
countries on the ASL may have a more
hierarchal command and communication structure than is common in the
Western world, says Kok. This makes

national aviation authorities (NAA)
staff reluctant to communicate with
their technical international counterparts. The credibility of actions by
NAAs on the ASL to strengthen their
safety oversight will be less if they only
communicate on a very sporadic basis.
This will lead the ASC to the impression that countries are not working
hard enough on resolving the findings
that led to them ending up in the list.
If NAAs were enabled to communicate
on a much more regular basis, that
would add credibility to their actions
and may avoid the impression of
window dressing coming from very
sporadic communication on massive
steps forward, says Kok. Cross-cultural work requires an interest in each
others culture and working practices
that goes beyond mere aviation technical issues.
Zweigenthal stresses that all states
with deficiencies in safety oversight
are members of ICAO, and that ICAO
should be involved in development of
an aviation system plan. The ICAO No
Country Left Behind program focuses
on ensuring that all states develop
their regulatory oversight to the point
of being able to also reap the socioeconomic benefits of aviation for their
state, carriers and people, he says.
ICAO has always performed an
essential role by forging consensus
on international civil aviation SARPs,
adds ICAO Air Navigation Bureau
Director Stephen Creamer, but we had
also begun to identify gaps with respect
to the tools, capacities and assistance
which many states need in order to
effectively implement ICAO provisions.
No Country Left Behind is part of how
we are addressing those gaps, and it
has been a very useful initiative to rally
the support and commitments needed
| 35
SAFETYOVERSIGHT
both internally and externally to ICAO
toward that success.
For an aviation system plan to be
effective, it is important that it be complemented by a strong commitment to
the execution stage. The reality is that
often the political will is lacking. The
International Air Transport Association
(IATA) notes that in Africa, under the
Abuja Declaration, it was agreed that
states would require all their operators to undergo the IATA Operational
Safety Audit (IOSA) by 31 December
2015, which would have worked as a
form of alternative means of compliance (AMC). Unfortunately this has
not happened, says Perry Flint, IATAs
head of corporate communications for
the Americas.
State Safety Programs

In accordance with ICAOs safety management requirements, national governments must develop a state safety
program (SSP) that defines the safety
performance objectives of the aviation system under their oversight. The
SSP must be thorough, realistic and of
achievable implementation, but according to Kok, state safety programming
may be difficult, given institutional
capacity limitations. He also points
out that developing SSPs has proven
time-consuming and difficult, even in
the most economically developed countries. Perhaps some of the assistance
of the international community should
be focused not on technical skills but
on administrative and leadership skills.
Only then will organizations be enabled
to build capacity to move from stacking
technical skills to changing the course
of a countrys air transport and aviation
safety policies, he says.
Zweigenthal believes that countries
that have SSPs can assist neighboring
states that are lagging behind. Clearly,
36 |
it is in the interest of all states that their

neighbors are compliant with the necessary international safety standards.
Regional safety oversight organizations
(RSOOs) have been and are being
established around Africa, where the
expertise of states within a community
can be used for the benefit of all. It is
a safety imperative to work together in
this area, he says.
Sourcing Inspectors
Inspectors play a vital role in safety
oversight, as they are the interface
between the regulatory authority and
the industry. Very often, states on the
ASL do not have inspectors available to
perform the industry safety oversight
function. One way to overcome this
institutional limitation is to source
qualified interim external inspectors
for purposes of know-how transfer to
national inspectors who have a local
perspective.
According to Zweigenthal, ICAOs
No Country Left Behind program, as
well as the IPAV initiative, together
with resources available from RSOOs,
could provide a platform for the sourcing of such interim aviation inspectors.
I believe that part of a states strategy
to support an aviation sector is to have
a skills-development program able to
support identification, training and
development of necessary new talent.
Where there may be shortages, there
may be opportunities to source inspectors through the RSOO system, and
also from neighboring states on a temporary or permanent basis. Ultimately,
for the long term, each state should
develop the capacity to perform these
important functions, he says.
Kok believes sourcing inspectors
could be achieved by targeted measures
through regional organizations such
as the East African Community Civil
Aviation Safety and Security Oversight Agency or the Southern African

Development Community Aviation
Safety Organization and ICAOs AFI
(Africa and Indian Ocean) Cooperative
Inspectors Scheme (CIS).
The AFI-CIS project was launched
in 2011 by the African Civil Aviation
Commission (AFCAC) with technical
support from ICAO. The project was
established for creating a pool of qualified and experienced inspectors from
within Africa to provide assistance to
African states in achieving a 10 percent
annual reduction in their lack of effective implementation of ICAO SARPs.
According to AFCAC, as of May
2014, 34 states and one RSOO had
signed the AFI-CIS memorandum
of understanding, with 18 assistance
missions conducted in nine states.
Although the project has achieved
some critical mass with the majority
of African states signing up, AFCAC
notes that operational challenges include a lack of feedback from states,
late responses on the acceptability
of planned missions, a shortage of
qualified inspectors and a lack of
funding.
Exiting the Black List

It is possible for states and air carriers
to be removed from the ASL. In December, Kazakh carrier Air Astana was
removed from Annex B, the partial ban
list. On the other hand, Iraqi Airways
was added to the ASL due to unaddressed safety concerns, according to
an EU news release.
The EC says even the possibility
of being placed on the ASL has been
enough to persuade some countries
to accept safety dialogues with the
EC. Thailand recently has received
help from the EU to improve its safety
situation and to make sure that it is not
Weimeng | AirTeamImages
HAMFive | AirTeamImages
SAFETYOVERSIGHT
The air safety list is

updated regularly
and carriers are
removed from, and
added to, the list.
For example, Air
Astana recently
was removed from
the ASL while Iraqi
Airways was added
due to unaddressed
safety concerns.
placed on the list in the future. Technical meetings have been organized, and there is an EU
technical assistance program ongoing, according
to the EC.
Europe has several technical assistance
mechanisms available to support other countries in the development of their aviation safety
systems. Most of this technical assistance is
channeled through EASA, which since 2009 has
conducted more than 30 missions to countries
in Africa, Asia, the Middle East and Latin
America.
Only air carriers whose regulatory authorities take active steps to address the fundamental
safety issues that led to a ban in the first place
can eventually be fully removed from the ASL.
If a carrier commits to substantially improve its
operational safety performance, but receives no
support from its regulatory authority, the airline
remains on the list with operational restrictions

but is not subject to an outright ban.
According to IATA, in situations in which
the effectiveness of regulation and oversight is
in doubt, operators must follow proven industry
safety practices. At the same time, the oversight
authorities are all subject to the ICAO USOAP
[Universal Safety Oversight Audit Program,
Continuous Monitoring Approach] audits as a
minimum, and therefore should focus on addressing any deficiencies highlighted through
the USOAP process to avoid being placed on
the list of states with significant safety concerns
(SSCs), says IATAs Flint.
IOSA registration can be a valuable tool for
improving safety practices and enabling operations into the EU. According to Flint, having an
industry best safety practice program like IOSA
is an assurance that an operator exceeds the
minimum regulatory requirements as per ICAO
SARPs. Operators need to be certified and not
stop there, but work on a continuous improvement program, he says.
According to Zweigenthal, airlines that are
not IATA members should be encouraged to go
through an IOSA audit to identify what areas
they need to work on. The states, in turn, need
to be made clearly aware of the EUs findings
and to work together with the EU and ICAO to
implement remedial measures according to the
findings, he says.
Mario Pierobon is a safety management consultant and
content producer.
Note
1.
The accidents included the January 2004 crash of

a Boeing 737 operated by Egyptian carrier Flash
Airlines with 148 fatalities; the August 2005 crash of
an ATR 72 flown by Tunisian carrier Tuninter that
resulted in 16 fatalities; the August 2005 crash of a
West Caribbean Airways (Colombia) McDonnell
Douglas MD-82 with 160 fatalities; the August
2005 crash of a 737 operated by Peruvian carrier
TANS (Transportes Areos Nacionales de la Selva)
with 40 fatalities; and the September 2005 crash of
a Mandala Airlines (Indonesia) 737 with 149 occupant and ground fatalities. Source: Aviation Safety
Network
| 37
BARS:
SAFETY IN NUMBERS
400 external third-party quality controlled and assured audits

28 Industry participants governing standard
140 aircraft operators over 29 countries and 5 continents
10,000 audit ndings now with 100% closure assurance
Program participants lowest accident numbers in resource sector
BARS Program Office

16/356 Collins Street
Melbourne, Victoria 3000
Australia
Tel.: +61 1300 557 162
Fax: +61 1300 557 182
bars@ightsafety.org

Headquarters:
701 N. Fairfax Street, Suite 250
Alexandria, Virginia 22314-1774
U.S.A.
Tel.: +1 703.739.6700
Fax: +1 703.739.6708
ightsafety.org/bars
ightsafety.org
flightsafety.org
SAFETYSTANDARDS
n Sept. 2, 1998, Swissair

Flight 111 experienced an
in-flight fire and crashed into
the Atlantic Ocean off the coast
of Peggys Cove, Nova Scotia, Canada,
killing all 229 passengers and crew.1
That accident, almost more than any
previous one, was responsible for the
industrys reconsideration of the type of
guidance given to flight crews when responding to in-flight, un-alerted smoke,
fire and fumes (SFF) events, such as air
conditioning smoke or electrical fires.
This thinking was ultimately codified in a template to guide the structure
and content of checklists for these

conditions.2 As can be seen in Table 1
(p. 41), the template differs from what
had been the traditional approach for
the design of these checklists in five
important ways.
First, instead of separate checklists
for each type of un-alerted smoke or
fire, the template suggests development
of a single, integrated checklist containing items for all types of un-alerted SFF.
Thus, crews will not have to determine
what type of SFF they are dealing with
before being able to identify the correct
checklist to access.
Second, the first item on a checklist developed as per the template is

a reminder to pilots that a diversion
may be necessary. Furthermore, the
template suggests a diversion if the
source is not immediately obvious,
easily accessible and able to be confirmed as extinguished. This appears
early in the checklist a departure
from older checklists in which diversion or landing as soon as possible was
included as the last item, if it appeared
on the checklist at all.3
Third, after the reminder that a
diversion might be required (first item)
BY BARBARA K. BURIAN
CHECKING THE
Checklists
A review of integrated checklists
for un-alerted smoke, fire and fumes
| 39
SAFETYSTANDARDS
and the accomplishment of crew protection and communication items, such
as donning oxygen masks and establishing communication, the template
suggests the inclusion of items called
manufacturers initial steps. These are
items that direct the de-powering or
isolation of equipment that has been
determined, through historical records,
to be the most likely causes of SFF on
that aircraft type. Therefore, without
analysis or troubleshooting, pilots will
quickly address the most likely cause(s)
of their SFF event.
Fourth, checklists developed according to template guidance will
address situations in which the source
of the SFF is immediately obvious and
accessible for example, burning
food in a galley oven as well as those
conditions that are not for example,
a hidden fire in an aircraft attic area.
Much like older SFF checklists, conditions for which the source is not obvious are addressed in template-guided
checklists through accomplishment of
a series of system-specific actions not
performed earlier as part of the manufacturers initial steps.
Finally, template-inspired checklists
include items to help crews maintain a
big-picture perspective on their situation. For example, crews are reminded
that any time smoke becomes the
greatest threat, they should leave the
SFF checklist and instead complete the
checklist for smoke removal. Under
the high stress and workload typical of
these events, it can be easy to lose track
of managing the overall situation. Similarly, checklist items associated with
diversion and descent also contribute
to assisting pilots in managing their
overall situations.
It has been almost 11 years since
the template and the rationale behind it
were developed and published in Flight
40 |
Safety Foundations Flight Safety Digest,

a predecessor of AeroSafety World.4
To determine the degree to which
the content, structure and underlying
philosophy of un-alerted SFF checklists
in current use are consistent with the
template guidance, the author recently
completed analyses of these checklists in 11 quick reference handbooks
(QRHs) used by seven North American
air carriers.
These paper checklists (no electronic versions were evaluated) were
developed for use in five aircraft
types: the Airbus A320 three QRHs
evaluated; and the Boeing 737NG and
777, the Bombardier CRJ700 and the
Embraer EMB190 two QRHs evaluated apiece.5
In addition to compliance with template guidance, the author evaluated
other characteristics of these checklists
that could affect their use during the
response to one of these events, such
the inclusion of memory items and the
checklists length.
A Novel Concept
When the template was developed, the
concept of a single, integrated checklist
to be used for response to all types of
un-alerted SFF events was relatively novel. It was not uncommon to see several
separate checklists for un-alerted SFF
events occurring in specific locations
or involving different aircraft systems:
air conditioning, electrical, cabin, galley,
lavatory, avionics, engine tailpipe, cargo,
and unknown or hidden source.
In the aircraft types included in this
study, SFF involving avionics or cargo,
or those occurring in lavatories, are
now most often alerted through flight
deck caution and warning systems,
such as an engine indicating and crew
alerting system or an electronic centralized aircraft monitor.
Of the 11 QRHs analyzed in this

study, integrated actions for response to the SFF types that remain
un-alerted were found in 10 (engine
tailpipe fire was excluded, because of
the unique nature of such fires). One
of the three A320 QRHs did not have
a main integrated SFF checklist and
included separate checklists for cabin
smoke and fire, and air conditioning
smoke or fire. The other two A320
QRHs, as well as all QRHs for the
other four aircraft types, integrated
the response to these un-alerted conditions, along with others, such as
electrical smoke or fire, into a single
checklist. Furthermore, the other
two A320 un-alerted SFF checklists
included items for alerted avionics SFF.
Similarly, both EMB190 un-alerted
SFF checklists included items for
alerted cargo compartment fires.
Based upon this small sample of
QRHs and checklists currently in use,
it appears that the concept of providing a single, integrated checklist for
many types of un-alerted SFFs, and on
occasion some types of alerted SFFs,
has gained some acceptance within the
industry, at least in North America and
across the four major U.S. Federal Aviation Regulations Part 25 (transportcategory) manufacturers.
However, some separate un-alerted
SFF checklists were identified in a few
of the 10 QRHs that also contained a
main integrated checklist for un-alerted
SFF for example, one QRH had a
separate checklist for aft avionics rack
smoke, and two QRHs had separate
checklists for electronic flight bag
(EFB) computer overheat/fire.
With the exception of tailpipe fire,
it is not known why the air carriers or
manufacturers that developed these
checklists chose to keep them separate
from the main integrated checklist for
SAFETYSTANDARDS
Template for Un-alerted Smoke Fire and Fumes Template1 (FSF, 2005)
Initial Actions: Crew Protection and Communication
Diversion may be required
Oxygen Masks (if required) . . . . . . . . . . . . . . . . . . . . . . . . . . . . ON, 100%
Smoke Goggles (if required) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .ON
Crew and Cabin Communications . . . . . . . . . . . . . . . . . . . . . . Establish
Initial Source Elimination Steps

Manufacturers initial steps . . . . . . . . . . . . . . . . . . . . . . . . . . Accomplish
5
Smoke
Removal
Reminder
6
At any time smoke or fumes becomes the greatest threat accomplish SMOKE OR FUMES REMOVAL checklist page x.x.
Source is immediately obvious and can be quickly extinguished

If Yes, go to Step 7
If No, go to Step 9
Extinguish the source.
If possible, remove power from affected equipment by switch or circuit breaker on the flight deck or in the cabin.
Source is visually confirmed to be extinguished:
If Yes, consider reversing initial manufacturer steps
Go to Step 17
If No, Go to Step 9
Remaining minimal essential manufacturer action steps (do not meet initial step criteria but are probably ignition
sources based on historical fleet data or analysis)
Other Items of Operational Significance
10
Warning
11
Initiate a diversion to the nearest suitable airport while continuing the checklist
If the SFF situation becomes unmanageable consider an immediate landing
Landing is imminent:
If Yes, go to Step 16
If No, go to Step 12
Additional Source Identification/Elimination Steps
12
XX system actions2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Accomplish

[Further actions to control/extinguish source]
13
If dissipating . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Go to Step 16
YY system actions2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Accomplish
14
ZZ system actions2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Accomplish
15
Smoke/fire/fumes continue after all system related steps are accomplished:
Consider Landing Immediately
Go to Step 16
Follow-up Actions
16
Review Operational Considerations
17
Accomplish Smoke Removal Checklist, if required, page x.x
18
End of Checklist
Notes
1. More than one step or action in the actual SFF checklists that are developed may be included as part of a single step on the template.
2. XX, YY, and ZZ are placeholders for the names of sources of SFF (e.g., air conditioning, electrical, galley, etc.).
Table 1
| 41
SAFETYSTANDARDS
un-alerted SFF. It is possible that their
exclusion was an oversight. However, it
may have been intentional, if the decision was prompted by the thought that
the sources for these events were easily
identifiable for example, EFB computer overheat/fire and warranted
a different approach to isolating and
extinguishing them than the approach
put forth by the template. It is also possible the developers of new checklists,
particularly at air carriers, are unaware
of the template and the rationale for
integrating items for un-alerted SFF
into one checklist.
On May 27, 2008, the U.S. Federal Aviation Administration (FAA)
published a single-page Information
for Operators (InFO) 08034, Design
and Content of Checklists for In-Flight
Smoke, Fire and Fumes (SFF),6 which
brought attention to the template and
its rationale and provided a link to the
Flight Safety Digest in which it appeared.
However, eight years have passed since
the publication of InFO 08034, and no
reference to it or to the template has
been made in other relevant documents, such as Advisory Circular 12080A, In-Flight Fires.7
Checklist developers will need
to carefully weigh the pros and cons
when deciding that new un-alerted SFF
checklists should remain separate, lest
at some point in the future, pilots again
find themselves searching through a
long list of un-alerted SFF checklists to
find the correct one.
Diversions
The template includes two items regarding a diversion. Step 1 establishes
the mindset that a diversion may be
necessary, and Step 10 indicates that a
diversion to the nearest suitable airport
should be initiated while continuing
with the checklist.
42 |
The diversion is prescribed if the

initial manufacturers actions have
proved unsuccessful and if the source
is not immediately obvious or if
it is immediately obvious but the fire
cannot be visually confirmed to have
been extinguished. Thus, the diversion
is directed after some steps have been
taken quickly but have proved unsuccessful, and prior to the pilots accomplishing more analytical actions in the
system-specific sections. In analyzing
the checklists, the author distinguished
between items worded as reminders or
suggestions (e.g., Consider a diversion)
relatively consistent with the intent of
the templates Step 1 and items that
actually directed that a diversion be
initiated consistent with Step 10.
The degree to which the checklists conformed to these two template
steps varied, although all of the main
un-alerted SFF checklists addressed
diversion, usually going beyond what is
suggested by the template. Five checklists included a reminder that diversion
may be necessary at or near the beginning of the checklist, and six checklists
made such reminders three of them
for the second time in the middle of
the checklist. Three checklists directed
the initiation of a diversion, or stated
Land Immediately/ASAP (as soon
as possible), at or near the beginning
of the checklist, and the other seven
directed the initiation of a diversion in
the middle of the checklist, similar to
placement of this direction in the templates Step 10. One CRJ700 checklist
directed a diversion nine times, often
at the end of sets of items designated
to be completed in the system-specific
sections.
Just prior to the system-specific
items (Steps 12-14), six of the checklists
instructed the pilots to divert/descend
while completing the remaining items,
and five checklists explicitly stated

that the diversion/landing should not
be delayed to complete remaining
checklist items excellent guidance,
although neither item is included in the
template. After addressing a source that
was obvious and easily accessible, five
of the integrated checklists also said
that the flight could be continued if
the source could be visually confirmed
to be extinguished and the smoke was
decreasing also guidance that is not
included in the template.
A Novel Concept
Another novel concept in the template
suggests that flight crews should isolate
and eliminate the most likely sources of
un-alerted SFF without first determining if they are, in fact, the cause. All 10
QRHs that included a single, integrated
checklist for most types of un-alerted
SFF included these initial manufacturers steps, which, according to the
supplementary information provided
with the template, are quick, simple,
and reversible; will not make the situation worse or inhibit further assessment
of the situation; and do not require
analysis by the crew.
All four of the Boeing checklists and
one EMB190 checklist included an item
stating that, at the captains discretion,
actions just performed (i.e., manufacturers initial steps or the elimination
of an obvious and quickly extinguishable source) could be reversed if the
SFF could be confirmed to have been
extinguished and the smoke/fumes
were dissipating. Reversing actions just
taken is not included in the template.
All of the integrated SFF checklists
included system-specific items for the
step-by-step identification and isolation
of the source. However, the checklists
for a CRJ700 differed from the others
in that pilots were to make their best
SAFETYSTANDARDS
assessment as to which system was involved and
complete the source identification/elimination
actions associated with only that system, even if
it turned out to not be the SFF source just as
pilots had to do before integrated SFF checklists
were developed.
Fire Fighting vs. Diverting
All of the
integrated
SFF checklists
addresed the
issue of smoke
or toxic fumes
removal .
In seven of the 10 integrated checklists, the

manufacturers or air carriers attempted to address the amount of attention given to fighting
the fire and checklist accomplishment versus the
attention given to diversion/landing. This was
accomplished in three different ways, only one
of which (for an EMB190) was somewhat close
to matching the guidance stated in Step 11 of
the template by directing actions to take if an
airport was nearby.
Five checklists that instructed pilots to
continue to complete checklist items but not to
delay the descent and landing allowed greater
flexibility in choosing to opt out of the checklist than did the guidance in the template (Step
11). This flexibility places the onus on the pilots
for keeping the big picture in mind while also
focusing narrowly on checklist accomplishment
and deciding where in the procedures to break
off relative to landing two demands on pilot
situation awareness and cognition meant to
be alleviated through the directed evaluation
and checklist suspension incorporated in the
template.
Of greater concern was the direction in one
of the CRJ700 checklists that as many items
as possible on the SFF checklist should be
accomplished before turning attention to the
completion of Descent and Before Landing
checklists. Such guidance could actually have
the effect of delaying the descent and landing in
an effort to complete the SFF checklist something that contradicts template guidance.
All 10 of the integrated checklists either directed crews at or near the beginning of the
checklist to land as soon as possible or to
consider an immediate landing if the situation
became unmanageable prior to the completion of system-specific items. Interestingly, two
of the checklists (one for a 777 and one for

an A320) said nothing about considering an
immediate landing if the SFF continued after
all SFF elimination items on the checklist were
accomplished.
All of the integrated SFF checklists addressed
the issue of smoke or toxic fumes removal, almost always by reminding crews to complete the
Smoke/Fumes Removal checklist whenever
necessary.
Deviations from Template Guidance

Numerous deviations from the template guidance were observed in addition to those already
mentioned. In many cases, they were relatively
minor wording differences or differences associated with aircraft-specific requirements such
as initiating a descent early so that potential
smoke/fumes removal, requiring a depressurized aircraft, could be accomplished.
Other deviations from the template guidance were more significant. In some instances,
this involved the inclusion of items or information that could help crews, such as caution statements in an A320 checklist that crews should
not shut down air conditioning packs or reduce
ventilation in an attempt to smother a fire and
should not deploy the passenger oxygen masks
if fire is suspected in the cabin (although this
second caution statement does not appear in the
Cabin Fire section of the integrated checklist
where it might be most useful).
Design and Content

A variety of other issues pertaining to SFF
checklist design and content are not addressed by the template but are likely to affect
their use.
For example, the template does not mention
performing any of its steps from memory but
includes items related to crew protection and
establishing crew communication (Steps 24)
that often were to be performed from memory
when older SFF checklists were in use. All of
the integrated SFF checklists analyzed in this
study included these items, and they were to be
performed from memory on six of them.
| 43
SAFETYSTANDARDS
Number of Checklist Items to Be Read/Accomplished in Different Un-Alerted SFF Situations1,2

N of
CLs3
Situation/Source
A320
a
B737NG
c
B777
a
CRJ700
b
EMB190
Mean
Median
Greatest total number to

accomplish4
10
164
100
59
42
61
49
91
70
108
81
83
76
Landing is imminent5
10
164
100
59
42
61
49
91
18
75
51
71
60
Source cannot be
identified6
10
132a
60
59
42
61
49
88
18
108
81
70
61
Electrical smoke/fire
36
42
43
49
91
70
108
81
52
60
Cabin smoke/fire
67b
24
43c
22
47
41
43
Avionics7
92
52
60
68
60
Galley
39
42
41
41
51
59
42
61
49
58
55
69
53
57
Air conditioning
smoke/fire
10
64
20
CL = checklist; QRH = quick reference handbook; SFF = smoke, fire and fumes
Notes
1. Includes all types of action items, conditional/decision items, notes, cautions, warnings, checklist titles, condition statements (if any), objective of checklist
items (if any), continued on next page indicators (if any), and checklist flow charting symbology to facilitate checklist navigation (if any). Does not include
repetition of checklist titles on subsequent pages or jumping to/accomplishing items on Smoke/Fumes Removal checklists.
2. Does include counts from system-specific checklists in the QRH that did not contain a single integrated SFF checklist.
3. The number of checklists included in analysis/the number of checklists that had specific sections to address this source.
4. The greatest number of items on the checklist the pilot would need to accomplish if the source was not obvious and all attempts/actions to identify, isolate,
and extinguish the source had been unsuccessful.
5. Focuses solely on the guidance for this situation included in the checklist (if any) and assumes that at no point is the checklist abandoned by the pilots
to focus on landing. In the checklists that did not address this situation, these numbers match the greatest number of items that pilots would have to
accomplish (i.e., assumes source has not been identified and all actions have been unsuccessful).
6. Many checklists did not address this situation, so this number matches the greatest number of items that pilots would have to accomplish.
7. Avionics smoke/fire is an alerted condition on the A320 but two of the QRHs analyzed included items to address avionics smoke/fire in the single, integrated
checklist.
a. N = 164 items if the user does not know that the source is unknown and accomplishes items for Air Conditioning Smoke and Cabin Electrical Smoke/Fire first.
b. If COMMERCIAL pushbutton is installed (n = 72 items if pushbutton is not installed)
c. If COMMERCIAL pushbutton is installed (n = 46 items if pushbutton is not installed)
d. Unknown, but it appears that at least a few items for air conditioning SFF are included in the Smoke/Fumes Removal checklist.
Source: Barbara K. Burian
Table 2
The length of SFF checklists not
only their physical length but also their
timing length (the time required to accomplish the items) has been a topic
of discussion in the industry.
The physical lengths of the checklists were more easily evaluated, and
best assessed by counting the actual
number of items that crews would
need to read and/or accomplish for
different types of un-alerted SFF
events. This information is presented
in Table 2. It is most informative to
44 |
compare the number of items only

within a specific aircraft type, as
aircraft design has a significant effect
on the number of actions required.
And, keep in mind that equipage
differences might help explain some
differences in the number of items to
be accomplished. Nonetheless, differences in the number of items for some
SFF situations, even within an aircraft
type, were sometimes astounding. For
example, note the Table 2 A320 entry
for Source cannot be identified.
The premise of the get-in, stay-in

philosophy of checklist design8 is that
all needed items from other checklists
or other materials are integrated into a
non-normal checklist, particularly for a
condition that has implications through
the remainder of a flight. Doing so
eliminates the need for pilots to jump
around among checklists or materials
and reduces the amount of time needed
for checklist accomplishment and the
likelihood of errors such as accessing
the wrong material.
SAFETYSTANDARDS
In this study, all normal checklists
were co-located with the SFF checklist
in one EMB190 QRH, and normal
checklist items associated with flap
setting and approach speeds were
incorporated into the other EMB190
SFF checklist. No other SFF checklist
or QRH incorporated or co-located
items found on the air carriers normal
approach or landing checklists.
None of the SFF checklists incorporated, co-located, or even mentioned
non-normal checklists for emergency
landing, ditching or evacuation, with
the exception of one CRJ700 SFF
checklist that referred the user to the
evacuation checklist in the QRH if
needed.
Addressing Shortcomings
To a large degree, the content and
structure of the checklists/QRHs were
consistent with the guidance proposed
by the template, with a few notable
exceptions. One A320 QRH did not
include a single, integrated checklist,
and in one CRJ700 integrated checklist, if the source was unknown, crews
were to focus on landing preparation
and not complete any system-specific
or similar items. Additionally, in both
of the CRJ700 integrated checklists,
crews were instructed to perform only
the system-specific actions for the one
system thought to be the source, even if
those actions were ultimately unsuccessful in terminating the SFF.
Only one EMB190 integrated
checklist came close to complying
with template guidance in telling
crews about what to do if landing was
imminent (Step 11). Studies of actual
crew use of the checklists that do not
conform to this template step could
help determine if specific guidance
about when to opt out of the checklist
is necessary. In any event, wording
of items in these checklists should

be scrutinized so as not to give the
impression that crews are to actually
delay landing in an effort to accomplish
checklist actions.
It was surprising that so little
information about various operational considerations identified in the
template supporting documentation (e.g., overweight landings) was
included in the checklists. However,
the advantages of the get-in, stay-in
philosophy of non-normal checklist
design are not well known across the
industry, so it was not unexpected
that there was almost no mention, let
alone inclusion, of checklists or actions associated with situations such
as ditching or evacuation. Crews may
well find the inclusion of items related
to these operational considerations or
situations to be beneficial, as well as
specific guidance about what to do if
the source is unknown. Furthermore,
the data presented in Table 2 suggest
that there may be some benefit in carefully analyzing the content in these
checklists to find the optimal lengths/
number of items to provide needed
guidance and support without unduly
adding to crew workload. These are
all good opportunities for checklist
refinement; the template guidance appears to have gone a long way toward
addressing the many shortcomings
identified in earlier approaches to
un-alerted SFF checklist design and
content.
Barbara K. Burian, Ph.D., is a senior research
psychologist at NASA Ames Research Center.
This work was conducted under the NASA
Aeronautics Research Mission Directorate. The
author wishes to express her appreciation to
the air carriers that participated in the study
by providing checklists and QRHs, and to
Harry (Boomer) Bombardi, Key Dismukes and
Mary Connors, who reviewed earlier versions
of this article. The complete NASA Technical

Memorandum on which this article is based
can be found at <humansystems.arc.nasa.gov/
flightcognition/publications.html>.
Notes
1. Transportation Safety Board of Canada
(TSB). Aviation Investigation Report
A98H0003, In-flight Fire Leading to
Collision with Water; Swissair Transport
Limited, McDonnell Douglas MD-11,
HB-IWF; Peggys Cove, Nova Scotia
5nm SW; 2 September 1998. Gatineau,
Quebec, Canada. 2003. Available at
<www.tsb.gc.ca>. The TSB said that regulations at the time did not require that
checklists for isolating smoke or odours
that could be related to an overheating
condition be designed to be completed
in a time frame that minimizes the possibility of an in-flight fire being ignited
or sustained.
2. FSF Editorial Staff. Flight Crew
Procedures Streamlined for Smoke/Fire/
Fumes. Flight Safety Digest Volume
24 (June 2005): 3136. Available at
<flightsafety.org>.
3. Burian, B.K. Do You Smell Smoke?
Issues in the Design and Content of
Checklists for Smoke, Fire, and Fumes.
In Proceedings: International Society
of Air Safety Investigators (ISASI) 2005
Conference. Fort Worth, Texas, U.S.:
ISASI, 2005.
4. FSF Editorial Staff.
5. All QRHs and checklists were in use when
they were provided by air carriers, though
it is possible that revisions have since been
made.
6. FAA. (2008). InFO 08034, Design and
Content of Checklists for In-Flight Smoke,
Fire and Fumes (SFF). Available at <www.
faa.gov>.
7. FAA. Advisory Circular 120-80A, In-Flight
Fires. Available at <www.faa.gov>.
8. Burian, B.K. NASA Technical
Memorandum (NASA/TM) 2014-218382,
Factors affecting the use of emergency and
abnormal checklists: Implications for current and NextGen operations. 2014.
| 45
DATALINK
Trending Downward
BY FRANK JACKMAN
46 |
of 1.09 per 100,000 flight hours in fiscal year

2014 and which represents the lowest rate in the
past six fiscal years (Figure 1).
The number of fatal GA accidents declined
5.6 percent in fiscal 2015 to 238, from 252 the
previous year. GA fatal accidents are down 12.5
percent from fiscal 2010 (Figure 2). FAA noted
in the fact sheet that while the number of GA
fatal accidents has declined over the past decade,
so have the estimated total GA flight hours,
which the agency said is likely due to economic
factors. The number of GA accident fatalities
declined 11.7 percent in fiscal 2015 to 384,
down from 435 fatalities the previous year, and
18.5 percent from 471 fatalities in fiscal 2010
(Figure 3).
U.S. General Aviation Fatal Accident Rates
1.14
1.12
Fatal accidents per
100,000 flight hours
or the second year in a row, the fatal accident rate, the number of fatal accidents and
the number of fatalities all declined in U.S.
general aviation (GA) in fiscal year 2015,
the 12 months ended Sept. 30, 2015, according
to preliminary data released in late March by the
Federal Aviation Administration (FAA).
While the fatal accident rate is beginning to
decline, too many lives are still being lost, FAA
Deputy Administrator Mike Whitaker said in
releasing the statistics. [T]he GA Joint Steering
Committees (GAJSC) work on voluntary safety
measures is making a difference. The GAJSC was
formed in the mid-1990s and recently renewed its
efforts to combat GA fatal accidents, FAA said.
Reducing GA fatalities is a top priority of
the agency, and its goal is to reduce the fatal accident rate by 10 percent over a 10-year period
(20092018), FAA said in a fact sheet on its
website <www.faa.gov>. FAA said it is focused
on reducing GA accidents by using a primarily
non-regulatory, proactive and data-driven strategy to get results, which it said is similar to the
strategy it is using with commercial air transport. FAA estimates the size of the GA fleet in
the United States at more than 220,000 aircraft,
including amateur-built aircraft, rotorcraft, balloons and turbojets.
FAA estimates that in fiscal year 2015, the
GA fatal accident rate was 1.03 accidents per
100,000 flight hours, which is down from a rate
1.10
1.08
1.06
1.04
1.02
1.00
0.98
FY10
FY11
FY12
FY13
FY14
FY15 (est.)
Fiscal year beginning Oct. 1 and ending Sept. 30

Source: U.S. Federal Aviation Administration
Figure 1
DATALINK
Loss of controlin flight (LOC-I), primarily resulting from stalls, accounts for the largest
number of GA fatal accidents, FAA said. For the
period 2001 through 2013, FAA lists the top 10
leading causes of fatal GA accidents as LOC-I,
controlled flight into terrain, system component
failurepowerplant, low altitude operations, other, system component failurenon-powerplant,
fuel related, unknown or undetermined, wind
shear or thunderstorm, and midair collisions.
U.S. General Aviation Fatal Accidents
Number of fatal accidents
290
280
270
260
250
240
230
220
210
FY10
FY11
FY12
FY13
FY14
FY15 (est.)
Helicopter Accident Rates

Figure 2
U.S. General Aviation Accident Fatalities
Number of fatalities
500
400
300
200
100
0
FY10
FY11
FY12
FY13
FY14
FY15 (est.)

Figure 3
U.S. Civil Helicopter Accidents
Number of accidents
200 185
150
171
152
154
143
100
50
148
134
129
146
138
123
Trendline
0
2001 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015
2005
Year
Source: U.S. Federal Aviation Administration, International Helicopter Safety Team and U.S. Helicopter Safety Team
Figure 4
U.S. civil helicopters were involved in 123 accidents in fiscal 2015, down from 138 in 2014,
according to FAA. Seventeen of those accidents
were fatal accidents that resulted in 28 fatalities, down from 21 fatal accidents and 37 fatalities in 2014.
FAA uses the period 20012005 as a baseline
against which to measure progress. During that
period, U.S. civil helicopters averaged 184 accidents, 29 fatal accidents and 55 fatalities per
year. Since then, the trend has been generally
downward, although there have been some upward spikes. For example, accidents declined to
129 in 2011, according to a compilation of FAA,
International Helicopter Safety Team (IHST)
and U.S. Helicopter Safety Team (USHT) data,
but then spiked to 148 in 2012. The number
of accidents has fallen each year since (Figure
4). Likewise, the number of fatal accidents has
been trending downward since the 20012005
baseline period, but not as sharply. The 30 fatal
accidents in 2013 were the most since 2008, but
last years 17 was the lowest during the period
measured (Figure 5, p. 48).
Both the civil helicopter accident rate and
the fatal accident rate have declined over the
past two years (Figure 6, p. 48). The accident
rate for fiscal 2015 was 3.67 accidents per
100,000 flight hours, down from 4.26 in 2014
and 4.95 in 2013, according to FAA. The fatal
accident rate in 2015 was 0.51 per 100,000 flight
hours, down from 0.65 in 2014 and 1.02 in 2013.
| 47
DATALINK
U.S. Civil Helicopter Fatal Accidents

40
35
Fatal accidents
30
29
30
25
24
20
24
23
20
10
21
19
17
Trendline
0
2001 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015
2005
Year
Figure 5
U.S. Civil Helicopter Accident and Fatal Accident Rates
40
Per 100,00 flight hours
7.97
Accident rate
Fatal accident rate
30
5.27
5.06
4.47
20
4.46
4.44
3.94
4.95
4.26
3.87
3.67
10
1.31
0.73
0.74
1.09
0.67
0.85
0.56
0.67
1.02
0.65
0.51
0
2001 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015
2005
Year
Figure 6
FAA partners with IHST and USHST to
promote safety and to reduce civil helicopter
accidents and fatalities worldwide. IHST was
formed in 2005 to lead a governmentindustry
effort to address factors contributing to helicopter accidents. According to FAA, prior to
2006, the number of worldwide civil helicopter
accidents was rising at a rate of 2.5 percent per
year. Since then, however, the worldwide civil
helicopter fleet has grown by 30 percent, but
the number of accidents has decreased in some
global regions by 30 to 50 percent.
In April, USHST said that over the next
four years, its focus will be on reducing the U.S.
48 |
civil helicopter accident rate by 20 percent. As

its baseline for comparison, USHST is using
0.76 fatal accidents per 100,000 flight hours,
which is the average rate for periods within the
previous five years that have final and reliable
data (20092010 and 20122014). This means
USHSTs target fatal accident rate is 0.61 per
100,000 flight hours.
Declines in helicopter accidents also have
been recorded in other parts of the world, according to IHST. In Europe, accidents involving
helicopters registered in European Aviation
Safety Agency (EASA) member states fell nearly
39 percent to 60 from 98 the previous year, according to IHST-supplied data. The number of
fatal accidents last year declined to 10 from 15
in 2014. European accidents declined 54 percent
from 2006 when there were 130.
The helicopter fleet in Brazil has grown 49
percent in the past four years, but the accident
rate is declining, IHST said. Last year, Brazil
recorded 6.6 accidents per 1,000 aircraft, a decline of more than 62 percent from 2011, when
the rate was 17.5 accidents per 1,000 aircraft.
In 2015, Brazil had 17 accidents and seven fatal
accidents. In the previous year, there were 20 accidents and six fatal accidents. Last years total of
seven fatal accidents was the highest since 2011,
when there were eight accidents with fatalities.
IHST said the overall decline in the accident
rate coincides with an IHST-sponsored safety
campaign launched in 2011 by the Brazilian
Helicopter Safety Team.
In New Zealand, a recent regional partner
of IHST, safety initiatives have focused on lowflying operations and wire strike issues, and
a proactive safety education and communications program aimed at operators and pilots
has been developed, IHST said. In 2000, there
were 21 helicopter accidents in New Zealand
and an accident rate of 14 per 100,000 flight
hours. In 2015, there were 16 accidents and
the rate was 8.0 accidents per 100,000 flight
hours.
SKYbrary Partners
SKYbrary was initiated by EUROCONTROL in partnership with the following organisations:
ICAO
The initiative aims at developing a comprehensive source of aviation safety information and
make it available to users worldwide.
www.SKYbrary.aero
ONRECORD
Unsafe to Fly
The captain decided to reject the takeoff after the A320 lifted off the runway.
BY MARK LACAGNINA
The following information provides an awareness of problems that might be avoided in the future. The information is based on final reports by official investigative authorities on aircraft accidents and incidents.
JETS
Computer Misprogrammed
Airbus A320-214. Substantial damage. Two minor injuries.
he automatic terminal information service

(ATIS) indicated that the weather was clear
and that Runway 27L was being used for departures from Philadelphia (Pennsylvania, U.S.)
International Airport the afternoon of March
13, 2014.
However, while programming the A320s
flight management computer (FMC) for departure, the first officer mistakenly entered Runway
27R, rather than 27L. As the captain taxied onto
Runway 27L for departure, he noticed that the
wrong runway was entered in the FMC, said
the report by the U.S. National Transportation
Safety Board (NTSB).
The captain asked the first officer to correct
the runway entry in the FMC, which she completed about 27 seconds before the beginning of
the takeoff roll, the report said. However, she did
not enter the flex temperature for the newly
entered runway or upload the related V-speeds.
As a result, the FMCs ability to execute a
flex power takeoff was invalidated and V-speeds
did not appear on the primary flight display or
the multipurpose control display unit during the
takeoff roll.
(A flex flexible or assumed temperature is the calculated highest air temperature at
50 |
which the engines will produce enough thrust to

meet takeoff performance requirements. Simply
stated, a flex thrust setting is less than what
would be required at maximum takeoff weight
and the ambient air temperature, and results in
less noise and engine wear.)
The captain initiated the takeoff by placing the thrust levers in the FLEX position. He
initially perceived that the takeoff was progressing normally. However, as the A320 accelerated
through 56 kt, two chimes sounded and the
electronic centralized aircraft monitor (ECAM)
displayed a message that the thrust was not set
correctly.
The first officer called engine thrust levers
not set. The required response was to move
the thrust levers to the takeoff/go-around
(TOGA) position, the report said. However,
the captain replied theyre set and moved the
thrust levers to the CLIMB position and then
back to FLEX.
The airplane was accelerating through 86 kt
when an aural retard alert began to sound repeatedly. According to Airbus, the retard alert
is designed to occur at 20 ft radio altitude on
landing and advise the pilot to reduce the thrust
levers to idle, the report said.
The captain later reported that he had never
heard an aural retard alert on takeoff and
ONRECORD
did not know what it was telling him.
He did not plan to reject the takeoff
because they were in a high-speed
regime, they had no red warning lights
and there was nothing to suggest that
the takeoff should be rejected.
The report noted that the flight
crew training manual at the time provided no guidance on how to respond
to a retard alert on takeoff. The airline later issued a bulletin stating that
the alert can be silenced by moving the
thrust levers to the TOGA position.
The first officer made no airspeed
callouts during the takeoff roll. She
later told investigators that she had
assumed the captain would not continue the takeoff with the absence of
V-speed displays.
Recorded flight data indicated
that the airplane was rotated at 164 kt.
However, in a post-accident interview, the captain stated that he had
the perception that the aircraft was
unsafe to fly and that he decided the
safest action was not to continue, the
report said.
Airspeed was 167 kt (10 kt
above V1) and the airplane was in a
6.7-degree nose-up attitude when the
captain moved the thrust levers to the
IDLE position and moved the control
column forward. The nose landing
gear struck the runway, and the A320
bounced about 15 ft into the air.
The tail of the airplane then struck
the runway surface, followed by the
main landing gear, then the nose landing gear, resulting in its fracture, the
report said. The airplane slid to its
final resting position on the left side of
Runway 27L.
Damage was substantial, and two
passengers sustained minor injuries
while exiting the airplane on evacuation
slides. None of the other 147 passengers
or five crewmembers was hurt.
Although simulator testing indicated that the airplane was capable of

sustaining flight after liftoff, it is likely
that the cascading alerts (the ECAM
message and the retard alert) and the
lack of V-speed callouts eventually led
the captain to have a heightened concern for the airplanes state as rotation
occurred, the report said.
The NTSB concluded that the
probable cause of the accident was the
captains decision to reject the takeoff
after the airplane had rotated. Contributing factors were the flight crews
failure to follow standard operating
procedures by not verifying that the airplanes [FMC] was properly configured
for takeoff and the captains failure to
perform the correct action in response
to the [ECAM] alert.
Contaminated Bleed Air

BAe Avro 146-RJ85. No damage. No injuries.
bout five minutes after departing

from Dublin with 48 passengers
and two cabin crewmembers for
a scheduled flight to London on the
morning of May 22, 2014, the flight
crew noticed fumes and smoke entering
the cockpit.
Fumes and smoke were also reported in the passenger cabin, said the
report by the Air Accident Investigation
Unit of Ireland (AAIU). The flight
crew donned their oxygen masks and
smoke goggles and carried out the appropriate emergency checklist actions.
The crew returned to Dublin and
landed the Avro without further incident. The aircraft then was taxied to
a parking stand, where the passengers
disembarked normally.
Subsequent examination of the no.
4 engine found a leak in an oil supply
pipe, which is likely to have caused oil
contamination of the bleed air supply
used for air conditioning, the report
said. The operator informed [investigators] that, due to the location of the
oil supply pipe, it was not possible to
carry out a routine examination of the
area, either visually or by borescope.
Fuel Leaked From Coupling

Bombardier CJ200. Minor damage. No injuries.
hile taxiing the aircraft after

landing at Osaka (Japan)
International Airport the
afternoon of May 6, 2013, the flight
crew received a caution message about
failure of the right engine fire detection system, followed by a warning of a
right engine fire.
The pilots probably believed that
the fire warning was a false alarm, said
the report by the Japan Transport Safety
Board (JTSB). Rather than stopping,
as called for by the checklist, the crew
continued taxiing to the gate while
shutting down the engine, activating
the fire extinguishing system and completing other checklist actions.
None of the 52 passengers and
three crewmembers were hurt during
the incident.
Examination of the CJ200 revealed
evidence of a fire in the right engine. It
is highly probable that the cause of this
serious incident was that the coupling
nut connecting the right engine fuel
manifold (fuel supply piping) and fuel
injector (fuel injection nozzle) no. 14
was loose, [and] fuel leaked from this
area and was ignited by the heat of
the engine, which resulted in fire, the
report said.
Although it is somewhat likely that
the reason why the coupling nut was
loose was the insufficient tightening
force on the coupling nut, resulting in
gradual loosening caused by factors
such as engine vibration, the [JTSB]
couldnt determine the cause of the
loosening.
| 51
ONRECORD
TURBOPROPS
Inappropriate Rudder Input

Beech King Air B200. Destroyed. Four fatalities, two serious injuries,
four minor injuries.
hortly after taking off from Runway 01R at

Wichita (Kansas, U.S.) Mid-Continent Airport
for a positioning flight to Arkansas the morning of Oct. 30, 2014, the pilot declared an emergency and said that he had lost the left engine.
The airplane climbed to about 120 ft above
ground level, and witnesses reported seeing it
in a left turn with the landing gear extended,
the NTSB report said. The airplane continued
turning left and descended into a building on
the airfield.
The pilot and three people inside the building (a flight training center) were killed. Two
others inside the training center were seriously
injured, and four sustained minor injuries. The
King Air was destroyed by the impact and postimpact fire.
Postaccident examinations of the airplane,
engines and propellers did not reveal any
anomalies that would have precluded normal
operation, the report said. Impact and thermal
damage precluded examination of the rudderboost system. The report provided no specific
information on whether the propeller autofeather system had been armed.
Investigators determined that the left engine
likely was producing low to moderate power and
that the right engine was producing moderate
to high power on impact. Neither propeller was
feathered.
The evidence indicates that the pilot did not
follow the emergency procedures for an engine
failure during takeoff, which included retracting
the landing gear and feathering the propeller,
the report said.
Moreover, the King Air was found to have
been in a nose-left sideslip of 29 degrees before
impact, indicating that the pilot was applying
substantial left rudder input.
The cause of the power loss was not determined, but the report noted that a sudden, uncommanded engine power loss without flameout
52 |
can result from a fuel control unit failure or a

loose compressor discharge pressure (P3) line.
The NTSB concluded that the probable
causes of the accident were the pilots failure to
maintain lateral control of the airplane after a
reduction in left engine power and his application of inappropriate rudder input.
Devoid of Fuel
Embraer Bandeirante. Minor damage. No injuries.
he pilot requested that 1,000 lb (454 kg) of

fuel be added to each of the Bandeirantes
tanks the night before he departed from
Manchester, New Hampshire, U.S., the morning
of May 21, 2014, for a cargo flight to Burlington,
Vermont.
He later told investigators that, during
preflight preparations, he determined that there
were 1,000 lb of fuel in each tank, the NTSB
report said.
However, the airplane had not been refueled
the night before, and calculations based on its
known activity since the last refueling indicated
that the Bandeirante had a total of 500 lb (227 kg)
of fuel aboard when it departed from Manchester.
The airplane was in cruise flight at 8,000
ft when the low-fuel-pressure warning lights
illuminated, followed shortly thereafter by the
flameouts of both engines. The pilot diverted
the flight to what he described as the closest airport within gliding distance: Warren, Vermont,
which has a 2,575-ft (785-m) runway.
Upon touchdown, the pilot used aggressive
braking, the report said. The left tire subsequently deflated, the airplane veered left, the left
main landing gear departed the paved portion of
the runway, and then the right tire deflated, the
report said. Examination of the airplanes fuel
system showed it to be devoid of fuel.
Wing Strut Buckled

Aerocomp Comp Air 8. Destroyed. Eight fatalities, two serious injuries.
he airplane, a kit-built single turboprop,

departed from Jmijrvi, Finland, the
afternoon of April 20, 2014, for its eighth
ONRECORD
skydiving flight of the day. Aboard were 10 skydivers in addition to the pilot.
The kitplane was 9 kg (20 lb) below gross
takeoff weight, and the center-of-gravity likely
was outside the aft limit, said the English translation of the report by the Safety Investigation
Authority of Finland.
The drop was intended to occur over the
airfield at about 4,000 m (13,123 ft). However,
after the airplane reached that altitude, the
skydivers noticed that they had overshot the
jump run and requested a new one from the
pilot, the report said.
As the pilot maneuvered to establish the
airplane on the jump run, the right wing strut
buckled, and the wing folded down against the
jump door. The airplane lost its controllability
instantaneously and began to rotate around its
vertical axis in a flight condition resembling an
inverted spin, the report said.
The pilot and two skydivers sitting at the

front of the airplane bailed out through the pilots
door. The others did not have enough time to bail
out. They died in the collision with the ground.
The pilot and one of the skydivers who
bailed out sustained serious injuries to their
lower extremities. The other skydiver was not
seriously hurt.
Examination of the Comp Air revealed a
fatigue crack in the inner surface of the failed
wing strut. The crack had formed over a long
period of time, and it was impossible to detect in
visual inspections, the report said.
Investigators found that the airplane had
been modified with winglets, which were not included in the kitplanes build permit. The modifications increased the aerodynamic loads on
the airplane but their effects on the kitplanes
structural strength and flight characteristics
[had not] been established, the report said.
PISTON AIRPLANES
Wrong Distance Information

Beech B55 Baron. Destroyed. Two fatalities.
he pilot had departed from Inverness, Scotland, under instrument flight rules the morning of May 3, 2015, to transport the Baron to
Dundee for an annual maintenance inspection.
Dundee had 5,000 m (about 3 mi) visibility
in moderate to heavy rain and a broken ceiling
at 800 ft. The pilot requested and received clearance for the instrument landing system/distance
measuring equipment (ILS/DME) approach to
Runway 09.
The pilot made a radio transmission reporting he was 4 nm [7 km] to the west of the runway,
on final approach, but the aircraft failed to arrive,
said the report by the U.K. Air Accidents Investigation Branch (AAIB). A search-and-rescue
helicopter located the aircraft wreckage on high
ground 6.7 nm [12 km] west of the airport.
Examination of the pilots horizontal situation indicator (HSI) showed that it had been
displaying navigation information from the aircrafts global positioning system (GPS) receiver
during the approach.
The report said that the pilot might have

forgotten to change from the GPS mode to the
course deviation indicator (CDI) mode. Thus,
the glideslope indicator in the HSI would have
remained flagged, and the pilot likely resorted to
flying the published localizer approach.
Apparently not realizing that the HSI was
displaying information from the GPS receiver
rather than from the ILS receiver, the pilot inadvertently flew the approach using the displayed
distance to the nondirectional beacon (NDB)
that served as the final approach fix rather than
the DME distance from the runway, the report
said, noting that the NDB was located 2.6 nm
(4.8 km) west of the runway.
Delayed Go-Around
Cessna 207A. Substantial damage. Four minor injuries.
he pilot had attempted to conduct a scheduled commuter flight from Bethel, Alaska,
U.S., to Newtok under visual flight rules
(VFR) the morning of May 4, 2013, but had
to return to Bethel because of adverse weather
conditions at the destination.
| 53
ONRECORD
During the second attempt in the early
afternoon, the pilot radioed that he was 4 nm
from Newtok in visual meteorological conditions. However, the single-engine airplane
entered fog that reduced visibility as it neared
the airport.
The pilot then initiated a gradual descent
over an area of featureless, snow-covered terrain,
which made it difficult to discern any topographic terrain features due to flat light conditions, the NTSB report said.
Although the pilot had the airport in sight,

he became uncomfortable with the approach
and initiated a go-around, the report said. The
207 struck a snow-covered river, incurring damage to the wings and fuselage. The three passengers and the pilot sustained minor injuries.
The NTSB concluded that the probable
cause of the accident was the pilots continued
flight into adverse weather and that a contributing factor was his delayed decision to initiate
a go-around.
HELICOPTERS
Contaminated Fuel
Robinson R22 Beta. Substantial damage. Two fatalities.
he pilot and a passenger had departed from

the pilots property near Green River, Utah,
U.S., the morning of April 6, 2014, to look
for shed elk antlers. The R22 was reported overdue from the flight late that afternoon.
The wreckage of the helicopter was found the
next day on the side of a gully. On-site wreckage documentation revealed that the main rotor
blades did not show evidence of rotation at the
time of ground contact, the NTSB report said.
Examination of the wreckage indicated
that the power loss had been caused by fuel
contamination. The gascolator container was
stained an orange/brown color, the report said.
Fluid drained from the gascolator was colorless but murky and had a faint smell of gasoline.
A water/alcohol-indicating paste test revealed
water contamination in the sample.
If the pilot had drained fuel from the
helicopters fuel tank or gascolator before the
flight, he would most likely have discovered the
contamination.
Investigators found that the pilot stored
aviation fuel in a barrel on his property and used
5-gal (19-L) plastic cans to transfer fuel to the helicopter. Testing of the fluid in some of the cans
revealed significant water contamination, the
report said. One of the cans contained a mixture
of about 50 percent aviation fuel and 50 percent
water, and another contained a mixture of about
85 percent aviation fuel and 15 percent water.
54 |
The report said that the pilot likely had been

maneuvering at low altitude to search for antlers
and had little time to react to the power loss or
locate a suitable site in the rough terrain for an
emergency landing.
Case Cracks Overlooked

Bell 206L-4. Substantial damage. No injuries.
he engine lost power shortly after the

LongRanger lifted off a trailer at Beverly
(Massachusetts, U.S.) Municipal Airport for
a local aerial photography flight the morning of
May 21, 2014.
The pilot attempted an autorotation to a
taxiway but chose to land in the grass adjacent
to it when it became apparent that the helicopter
would not reach the taxiway, the NTSB report
said. During the flare and landing, the main
rotor blades contacted the tail boom, severing it
just aft of the horizontal stabilizer.
Examination of the engine revealed a
rupture in the outer combustion case that had
resulted from fatigue cracks. Maintenance
records indicated that a procedure to detect
case cracks was performed during a scheduled inspection about a month earlier, when
the engine had accumulated 11,142 hours of
service.
It is likely that maintenance personnel
did not adequately inspect the engine at that
time, which resulted in their failure to detect
the fatigue cracks in the combustion case, the
report said.
ONRECORD
Preliminary Reports, February 2016
Date
Location
Aircraft Type
Aircraft Damage
Injuries
Feb. 1
Florianpolis, Brazil
Socata TBM-900
destroyed
2 fatal
The TBM crashed in the sea off Campeche Island shortly after departing from Florianpolis for a night flight.
Feb. 2
Mogadishu, Somalia
Airbus A321-111
substantial
1 fatal, 2 serious, 78 none
One passenger was ejected from the A321 and two passengers were injured when an explosion blew a hole in the right side of the fuselage at 12,000
ft about 15 minutes after departure. The flight crew returned to Mogadishu and landed the aircraft without further incident.
Feb. 3
Mont-Joli, Quebec, Canada
de Havilland Dash 8-100
none
27 none
The flight crew temporarily lost control while descending in icing conditions. The captain regained control after increasing airspeed and landed
the Dash 8 without further incident. The pilots subsequently found that the deicing systems for the left wing and left horizontal stabilizer were not
working.
Feb. 6
Saverovka, Russia
Antonov 2R
destroyed
3 fatal
substantial
1 serious, 1 none
The aircraft struck a snow-covered field during a pipeline-patrol flight.

Feb. 6
Linden, New Jersey, U.S.
Bell 206B
The student pilot was seriously injured when the JetRanger rolled over while taking off from a dolly for an instructional flight.
Feb. 6
Bejucal, Venezuela
Bell 206L-3
destroyed
1 fatal
substantial
none
substantial
2 none
The LongRanger crashed out of control during a cross-country flight.

Feb. 7
Chambry, France
Cessna CJ2
The CitationJet rolled backward into a rain gutter after the wheel chocks were removed.
Feb. 9
Williamsport, Pennsylvania, U.S.
Piper Seneca
The pilot said that he was maneuvering to avoid deteriorating weather conditions when the Seneca struck a tree. He was able to land the airplane at a
nearby airport, where the wings and windshield were found to be damaged.
Feb. 9
Dallas, Texas, U.S.
Cessna Citation 560
none
5 none
The flight crew experienced an uncommanded right roll and were not able to move the aileron trim control during departure. They declared an
emergency and returned to the airport. As airspeed was decreased during approach, the roll tendency decreased and the trim control was freed.
Feb. 10
Naypyidaw, Myanmar
Beech 1900D
destroyed
5 fatal
substantial
5 none
The 1900, operated by the Myanmar air force, struck terrain shortly after takeoff.
Feb. 12
Iliamna, Alaska, U.S.
Lockheed 382G
The airplane, a civilian version of the C-130 Hercules, experienced a rapid decompression while climbing through 24,500 ft during a cargo flight from
Bethel to Anchorage. The crew initiated an emergency descent, diverted to Iliamna and landed without further incident. A large hole was found in the
forward pressure bulkhead.
Feb. 14
Townsville, Queensland, Australia
Robinson R44
destroyed
1 none
Bell 206B
substantial
1 fatal, 3 serious, 1 minor
The R44 crashed after striking powerlines on takeoff.

Feb. 18
Honolulu, Hawaii, U.S.
The pilot was conducting an air tour when he heard a grinding noise and a loud bang, and saw rotor speed decreasing. One passenger was killed
during the subsequent ditching close to the shoreline.
Feb. 20
Roma, Queensland, Australia
Robinson R22
destroyed
1 serious
substantial
1 none
The R22 crashed after striking powerlines during an aerial mustering flight.
Feb. 23
Torrance, California, U.S.
Robinson R66
The pilot performed an autorotative landing after feeling vibrations during a maximum-performance takeoff. The main rotor blades struck the tail
boom on touchdown.
Feb. 24
Dana, Nepal
Viking Air Twin Otter 400
destroyed
23 fatal
Visual meteorological conditions prevailed when the Twin Otter struck a mountain during a scheduled flight from Pokhara to Jomsom.
Feb. 26
Kuala Selangor, Malaysia
CASA 235M
destroyed
1 fatal, 1 serious, 7 none
The copilot was injured when the aircraft crashed in a swamp after an engine failed during an air force training flight. A fisherman drowned while
attempting to assist.
Feb. 26
Chilkhaya, Nepal
Pacific Aerospace 750XL
destroyed
2 fatal, 9 serious
Both pilots were killed when the aircraft struck terrain during a scheduled flight from Nepalgunj to Jumla.
This information, gathered from various government and media sources, is subject to change as the investigations of the accidents and incidents are completed.
| 55
SMOKEFIREFUMES
Selected Smoke, Fire and Fumes Events, OctoberDecember 2014
Date
Flight Phase
Airport
Classification
Subclassification
Aircraft
Operator
Oct. 22
Climb
Air distribution system

Smoke
Boeing 717
Delta Air Lines
Crew reported smoke in the cockpit after departing. An emergency was declared, the aircraft diverted and emergency equipment met the flight.
Smoke dissipated. Maintenance performed smoke/fumes inspection in accordance with the aircraft maintenance manual with no defects noted. A
duct burnout was performed and all checked normal. Maintenance replaced a forward galley oven due to a strange odor when used.
Nov. 2
Takeoff
Engine
Smoke
Boeing 737
American Airlines
During takeoff, an odor was reported in cabin. Emergency declared, the aircraft returned, landing was uneventful, although aircraft was overweight.
During walk-around, it was discovered no. 1 engine had a bird strike. Bird strike inspection accomplished. Performed borescope inspection; no
damage noted in accordance with the maintenance manual. Performed overweight landing inspection. Removed bird remains, performed engine
run-up, no defects noted. No unusual smell noted. Aircraft OK for service.
Nov. 8
Cruise
Air distribution fan

Smoke
Boeing 767
Continental Airlines
Electric fumes detected in cockpit. Aircraft diverted. Inspections accomplished in accordance with aircraft maintenance manual. Odor limited to
cockpit. Inspected cockpit circuit breaker and panels front and back; no discrepancies noted. Found forward exhaust equipment cooling fan failed.
Replaced fan, replaced left and right recirculation filters, ran both engines at idle with packs on, no odor noted. Also inspected cargo pits, cockpit
window heat connections and cockpit door lock solenoid. Loaded entire electrical system in cockpit and cabin for hours, no odor present.
Nov. 15
Climb

Smoke
CL600
SkyWest Airlines
After rotation, the cabin and cockpit filled with white smoke. Turned off packs, smoke stopped, landed unpressurized. Did not declare an emergency,
suspect de-ice fluid in auxiliary power unit (APU) intake. Cycled packs on and off five times for 10 minutes each with APU bleed air. Also ran packs with
engine bleed air during taxi. Ops check OK with no smoke present at this time.
Nov. 22
Cruise

Smoke
Boeing 777
Omni Air Express
During cruise at Flight Level 410, crew noticed fumes in cockpit. Fumes cleared with left pack in operation. High heat noticed from overhead
panel above floodlight. Hot air exhausting from overhead panel. Once on ground, fumes cleared and heat from overhead was reduced. Window
heaters were selected off as soon as fumes were noticed. Exit lights also selected off to remove a potential ignition source. Fumes were strongest
on flight deck. Mechanic also reported fumes smell at aft side of electronics and equipment bay. Found no. 1 equipment cooling fan with dragging
bearings, removed and replaced. Found left duct clamp and boot loose at mix manifold near lower recirculating fans, tightened in accordance with
maintenance manual, initiated several mat tests for ATA Chapter 21, recirculating equipment.
Dec. 1
Climb
Smoke detection
Smoke
Boeing 767
American Airlines
During climb, a burning odor was detected in cabin and cockpit. Quick reference handbook procedure performed. Emergency declared, aircraft
returned and made uneventful overweight landing. Odor and fumes were intermittent during approach. Maintenance performed engine and
APU runs with no odor findings. Inspected cargo and electronics compartments with no odor findings. Found forward cargo smoke detector fan
inoperative. Removed and replaced fan. System checked normal.
Dec. 1
Unknown

Smoke
Embraer 145LR
American Eagle Airlines
Smoke was detected in cockpit or cabin after pack no. 2 selected on. After landing, using APU, performed operations check of no. 2 pack in accordance
with aircraft maintenance manual. Operations checked good, no defects noted at this time.
Dec. 4
Climb
Turbine engine oil system

Smoke
Boeing 757
Delta Air Lines
While climbing through 14,000 ft, crew reported flight deck and cabin began to fill with smoke. Left engine oil temperature increasing and oil pressure
dropping, crew diverted. Engine was not shut down. Maintenance found high saturation of oil just aft of fan. Dry motoring confirmed oil leak from 123
compartment. Replaced no. 1 engine.
Dec. 6
Cruise

Smoke
Boeing 737
Southwest Airlines
Smell of smoke in cabin at overwing exits. Emergency declared and aircraft diverted. Maintenance found right pack conditioned air duct broken.
Removed and replaced pack conditioned air duct assembly in accordance with maintenance manual.
Dec. 9
Climb

Smoke
Airbus A320
Frontier Airlines
Climbing out of 15,000 ft, smoke smell occurred in cockpit and cabin. Removed and replaced extract fan. Operations tested good.
Dec. 9
Climb
Cabin cooling system

Smoke
Embraer ERJ-170
Shuttle America
During climbout, crew smelled smoke and could see a haze in the cockpit. Flight attendant also detected smoke and saw a haze in the forward cabin.
Ran the quick reference handbook in accordance with procedures but source of smoke was unidentified. Declared emergency, returned to field,
landed without incident. Removed and replaced no. 1 air cycle machine.
Dec. 9
Cruise
Hydraulic system, auxiliary

Smoke
Embraer ERJ-170
Shuttle America
Smoke detected in the cockpit. Ram air turbine (RAT) was deployed as a precaution. During deployment, the RAT door rod end washer locking tab
lock feature failed, allowing the rod end to separate from the RAT door rod assembly. This led to the RAT propeller striking the RAT door. Both the RAT
and the RAT door were replaced.
Dec. 11
Climb

Smoke
Airbus A320
TACA Airlines
After takeoff, the pilot reported smoke in passenger cabin so the aircraft was returned to airport. After landing, the pilot reported overweight
landing 66.6 tons. Both air conditioning packs found as the probable cause. Performed inspection for oil leak in the air conditioning system; no leaks
detected. In addition, inspection for electrical burning smell or fumes found in cabin, cockpit, cargo or avionics compartment was performed with no
discrepancies found. With respect to overweight landing and in accordance with the aircraft maintenance manual, the digital flight data recorder data
was read out and analyzed and found no overweight landing exceedance.
56 |
The Foundation would like to give special recognition to our BARS Benefactors, Benefactor
and Patron members. We value your membership and your high levels of commitment
to the world of safety. Without your support, the Foundations mission of the
continuous improvement of global aviation safety would not be possible.
bars benefactors
benefactors
patrons
Thank you for your support

PLATINUM SPONSOR
SILVER SPONSORS
BRONZE SPONSORS
As of April 20, 2016

ASW May2016

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ASW May2016

Uploaded by

Copyright:

Available Formats

AIRPORT PEER REVIEWS

Analyzing Issue Trends

A PILOTS UNDISCLOSED PSYCHOSIS

30 ALAR regional workshops

SAFELY TAPPING THE POTENTIAL OF

ot a day goes by when there isnt

is tracking RPAS developments closely,

update briefing on the development work,

May 2016 Vol 11 Issue 4

InSight | Safety Space and Drift

CoverStory | Analysis of Germanwings Flight 9525

AirportOps | Seeking Trends in Peer Reviews

StrategicIssues | Lessons in Every CFIT Crash

AviationResearch | Simulators Add Icing Encounters

SafetyOversight | Revisiting the EU Air Safety List

SafetyStandards | Smoke-Fire-Fumes Checklists Vary

PresidentsMessage | Safely Tapping the Potential of UAS

EditorialPage | Personal Relationships

SafetyCalendar | Industry Events

FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | MAY 2016

InBrief | Safety News

DataLink | U.S. GA Fatalities Decline

OnRecord | Unsafe to Fly

SmokeFireFumes | U.S. and Canadian Events

About the Cover

Frank Jackman, editor-in-chief,

Wayne Rosenkrans, senior editor

Linda Werfelman, senior editor

Share Your Knowledge

Mark Lacagnina, contributing editor

Jennifer Moore, art director

Susan D. Reed, graphic designer

FLIGHTSAFETY.ORG | AEROSAFETYWORLD | MAY 2016

E mergency V ision A ssurance S ystem

ince mid-March, Flight Safety Foundation

FLIGHTSAFETY.ORG | AEROSAFETYWORLD | MAY 2016

One thing that has become clear to me is the

Serving Aviation Safety Interests

President and CEO

Kenneth P. Quinn, Esq.

Vice President, Finance

Controller, GSIP Grants

MEMBERSHIP AND BUSINESS DEVELOPMENT

Ahlam Wahdan, membership services coordinator

Namratha Apparao, manager, conferences and exhibits

Susan M. Lausch, vice president, business operations

Technical product orders

Namratha Apparao, manager, conferences and exhibits

Namratha Apparao, manager, conferences and exhibits

Frank Jackman, vice president, communications

Basic Aviation Risk Standard

BASIC AVIATION RISK STANDARD

Capt. Kevin L. Hiatt

FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | MAY 2016

MAY 56 Business Aviation Safety

FLIGHTSAFETY.ORG | AEROSAFETYWORLD | MAY 2016

MAY 1819 Global Safety Information

Aviation safety event coming up?

The Safety Space

n everyday operations, aviation organizations operate in what is known as

and/or maintains, baseline performance.

The safety space

Source: Bob Baron

typically the organization will make