312.630.4000   |   contact@nolan-law.com

Author Archive

Cessna 206 Medical Transport Plane Crashes in Lake Michigan

A single-engine light plane carrying a patient to the Mayo Clinic crashed into Lake Michigan on Friday, 27 July, raising concerns about the safety of general aviation. The airplane was flown by a private pilot who had volunteered to transport the patient from Alma to Rochester, MI. The airplane was not flown by an emergency medical services (EMS) company that specializes in transport/evacuation of patients. Rather, the airplane was owned by Freed Construction of Alma.

A rescue vessel receives a survivor of the crash from a small fishing boat.

A rescue vessel receives a survivor of the crash from a small fishing boat.

The Cessna 206 was regularly used on a volunteer basis to transport patients to the Mayo Clinic.

On board the aircraft was owner Jerry Freed and pilot Earl Davidson. Also on board were three other individuals, whose names are not known at this time.

The airplane crashed into the lake about 10 am off the shore of Ludington, a resort town on Michigan’s west coast. A small fishing boat rescued a survivor about two hours after the crash. At this point, the fate of the others is not known but they are presumed dead.

The airplane was equipped with an emergency locator transmitter (ELT), or radio beacon, that was activated on contact with the water. The ELT signal is detected by satellite and can be used to pinpoint the location of the wreckage.

The planned flight was some 150 miles one-way.

Pilot Davidson reported loss of engine power to an air traffic controller at Minneapolis about 10 minutes before the plane went down. The power problems apparently began about one-third of the way to Rochester; the airplane doubled back over Lake Michigan and then descended steeply near Ludington.

Coast Guard search and rescue operations are continuing.

The National Transportation Safety Board (NTSB) will be investigating the crash. Among the issue to be covered:

— The lack of cockpit voice and data recorders, and the absence of a cockpit video recorder, which would have at least captured the status of instruments, controls, and the pilot’s actions.

— The use of a Part 91 General Aviation airplane to transport the patient. Under Part 91, there are no standards regarding pilot flight and duty time, and maintenance records are also considerably less rigorous and detailed than for a Part 135 (air taxi) flight. Companies specializing in patient transport are required to transport patients under Part 135 regulations, which are considerably more demanding. Under Part 135, a risk assessment of the flight was necessary and flight following by a company dispatcher should have been routine. As a General Aviation operation, neither criteria was required.

— The use of a single engine piston transport for basically an overwater flight over a lake known for its cold water (and reduced survival time). In this case, the airplane could have flown to Benton Harbor, along the shore to Gary, and west up through Janesville, enroute to Rochester.

— The presence in the airplane of life preservers and rafts, and whether or not the preservers were donned (uninflated) before the airplane crossed into the overwater portion of its flight.

News reports of the crash involving a “medical transport plane” may give their readers the illusion that this was a formal EMS flight by a company specializing in that kind of operation. It wasn’t; it was a Part 91 operation in which the owner and pilot were performing a voluntary service for a non-paying patient.

The Part 91 accident rate is far higher than for Part 135 (air taxi) or Part 121 (scheduled airline) operations. Patients and their relatives and care givers may not be aware of the poor safety record of Part 91 operations.

Turbulence During United Flight 967 Injures Scores; After Years of Such Events, Why Do They Continue?

In the wake of the turbulence that struck United Airlines Flight 767, injuring passengers and flight attendants, the question arises: is the airline industry and is the Federal Aviation Administration (FAA) doing everything possible to prevent mayhem from convective winds? The answer: probably not.

The reason: injuries and even deaths continue to occur on a regular basis. The Tuesday, 20 July, turbulence encounter of the United B777 wide body twinjet was reportedly the third such event for the airline this year. But who knows? At least six such airline encounters have occurred worldwide this month; the annual incidence is obviously higher.

And clearly something is amiss in turbulence avoidance and injury mitigation policies, because frightening and even deadly encounters with potentially bone breaking turbulence continue to occur.

Commercial airplanes run into turbulence 5,000 times a year, according to one account. Most of the encounters are above 10,000 feet. Injury claims alone track into the tens of millions of dollars annually.

The National Transportation Safety Board (NTSB) will be investigating the event. The NTSB will reconstruct the weather at the time, the actions of air traffic controllers and the pilots. Although the NTSB is known more for investigating crashes, this turbulence encounter put people in the hospital; thus, the NTSB is empowered to investigate and make recommendations to ameliorate the hazard.

At this point, general outlines of the accident can be reconstructed. United flight 967 was en route from Dulles International Airport near Washington DC, bound Tuesday night for Los Angeles International Airport. There were 255 passengers and 10 crewmembers aboard. Over Kansas, directly in the path of the westbound jet, a rapidly forming severe thunderstorm was boiling upward. The storm climbed from about 25,000 feet to 45,000 feet in 30 minutes. It produced large hail, indicating the presence of severe turbulence. Updrafts of 50-100 mph are not uncommon.

Radar image of Kansas about the time that United flight 967 encountered severe turbulence.

Radar image of Kansas about the time that United flight 967 encountered severe turbulence.

The plane was flying at 34,000 feet, directly into a wall of convective turbulence. Flying into this wall, the airplane jumped. The rapid change in altitude, as in previous turbulence encounters, caused everything not secured by straps, locks, latches and whatnot to be hurled about the cabin. This includes people.

One passenger described the encounter as “just a huge up and down.” She said her seatbelt was tight; the woman sitting next to her hit her head on the side of the cabin, and a girl across the aisle flew into the air and hit the ceiling.

It is not known how many passengers were wearing their seat belts; the seatbelt sign was illuminated at the time. It is not known if the word had been passed from the cockpit to be seated with seatbelts latched because of impending turbulence..

Four flight attendants were injured. It is not known if they were standing at the time or were strapped into their jump seats. Flight attendant jump seats, unlike 16G passenger seats, are only 9G capable and they have collapsed in previous incidents, injuring flight attendants.

Passengers screamed as the airplane bounced in the turbulence. The uninjured flight attendants calmed everyone down fairly rapidly.

Because of the injuries, the captain elected to divert the flight to Denver for immediate medical attention of those individuals who were hurt. The airplane landed at 7:45 pm and the injured passengers and flight attendants, about 25 in all, were treated by paramedics at the scene and then transported to hospital. About 19 were released from hospital the following morning.

The airplane was inspected and found to be structurally sound. Unknown, however, is the condition of the cabin. In previous incidents, sidewall and ceiling panels have been displaced, and overhead bin doors have popped open, spilling their contents and contributing to injuries and the general sense of mayhem.

At Denver, a few of the braver passengers boarded another United flight for Los Angeles.

Given that records exist of the upwelling thunderstorms along the airplane’s route, a number of pertinent issues are sure to be explored by investigators:

— Did air traffic controllers see the convective activity on their scopes? If so, what did they tell the pilots? Additionally, controllers would be in receipt of Pilot Reports (PIREP) which should generate a SIGMET (significant meteorological activity) that’s broadcast to all aircraft in the area.

— What did the dispatcher at United operations center know about the evolving weather, and did he do anything?

— Did the pilots see the convective activity ahead on their weather radar? If so, did they attempt evasive action or continue on their flight path? Did they make a public address (PA) announcement about the turbulence ahead? Were flight attendants ordered to be seated, or were they caught by turbulence while checking passenger seat belts?

— What is the United Airlines policy to flight crews regarding convective weather activity? Is at a 10 mile avoidance policy? A greater distance? Or is there no policy at all at United? It is clear that policies run the gamut from one airline to another; a more uniform avoidance policy – established by the FAA – may make for predictability and safer travel throughout the industry.

— The vulnerability of the cabin to damage and disruption caused by in flight turbulence is unconscionable, given that these events have been occurring for years. Every seat should be stressed for 16G. Every person should be strapped in, including so-called “lap children.”

— Perhaps overhead bin doors with their flimsy latches should be redesigned, to include an electric lock activated from the cockpit on pushback to secure the bin doors until landing.

— The in-flight safety video could include two crash dummies subjected to severe turbulence while seated. One dummy could be strapped in; the other not. Passengers would see the risk of not having the seat belt affixed immediately.

— Northwest Airlines employs a Turbulence Plot System that is regarded as the gold standard for turbulence avoidance. Based on FAA data from 1980-1996, Northwest had the lowest turbulence encounter rate among six major U.S. commercial carriers. Other airlines have purchased the system, but not – according to a 2010 report – United.

The issue is not who voluntarily adapts a proven system, but whether or not the FAA has evaluated the Turbulence Plot System, found it effective, and mandated its adoption across the industry.

This latest event may have been caused by rising turbulent clouds over Kansas, but the long miasma of complacency at the FAA about cabin structure and turbulence avoidance are the root causes of continuing injury.

‘Letter War’ Rages While Helicopter Ambulances Continue to Crash

The “letter war” between the two agencies is not improving safety, but it is proof of the old adage that three inches of flame will shield one’s derriere from accountability.

Case in point: the recommendations issued in 2006 to improve the safety of medical evacuation flights, especially those flown by helicopters. The National Transportation Safety Board (NTSB) issued four recommendations. Taken as a group, they are classified RED by the NTSB – for unacceptable response – because the Federal Aviation Administration (FAA) is progressing slowly in implementing them. Progress may be lagging but, boy, the FAA has issued pages and pages of bland assurances to the NTSB that the situation is in hand.

That is debatable. Helicopter emergency medical services (HEMS) flights are falling out of the sky with appalling regularity, killing patients, pilots, nurses, and other people aboard or on the ground. With these continued incidents there is a higher need than ever for helicopter accident lawyers.

While helicopter ambulances continue to crash, the FAA dithers.

While helicopter ambulances continue to crash, the FAA dithers.

Here is the record for the past three years:

HEMS Accidents2008 to Present
5 Feb. 2008South Padre Island, TXMetro Aviation Inc.3 fatal
10 May 2008La Crosse, WIAir Methods Corp.3 fatal
21 May 2008Hiram, GAOmniflight Helicopters Inc.None
29 May 2008Grand Rapids, MIAero Med Spectrum Health2 serious injuries
30 May 2008Pottsville, PALehigh Valley Medevac3 minor injuries
8 June 2008Hunstville, TXPHI Inc.4 fatal
27 June 2008Ash Fork, AZPHI Inc.3 serious injuries
29 June 2008Flagstaff, AZAir Methods Corp.7 fatal
29 June 2008Flagstaff, AZClassic Helicopter Lifeguard7 fatal
31 Aug. 2008Greensburg, INAir Evac Lifeteam3 fatal
27 Sept. 2008District Heights, MDMaryland State Police4 fatal1 serious injury
15 Oct. 2008Aurora, ILAir Angels Inc4 fatal
22 Feb. 2009Cave Creek, AZPHI Inc.None
2 July 2009Loris, SCOmniflight Helicopter Inc.None
17 Aug. 2009North Captiva Island, FLLee County Division of Public SafetyNone
22 Sept. 2009Page, AZOmniflight Helicopters Inc.None
24 Sept. 2009Tucson, AZAir Methods Corp.None
25 Sept. 2009Georgetown, SCCarolina Life Care3 fatal
22 Oct. 2009Lythe, CATristate Careflight LLCNone
14 Nov. 2009Doyle, CAMountain Lifeflight3 fatal
25 Dec. 2009Decatur, TXAir Evac EMS Inc.None
17 Jan. 2010Reno, NVAir Methods2 serious injuries1 minor injury
5 Feb. 2010El Paso, TXSouthwest Med Evac3 fatal
11 Feb. 2010Cheverly, MDMaryland State PoliceNone
25 March 2010Brownsville, TNHospital Wing3 fatal
2 June 2010Midlothian, TXCareFlight2 fatal
Total for the 29 month period: 26 helicopters banged up or destroyed49 fatalities8 serious injuries4 minor injuries

Basically, about two people per month are killed or injured in HEMS flights. The total, 61 dead and injured, exceeds the 50 or so persons on board a regional airliner; and no matter how the calculation is done, being aboard a Part 135 HEMS flight is considerably riskier to life and limb than being a passenger on a Part 121 airliner. The HEMS accident rate is fuzzier, because unlike for airliners, we don’t know how much air time the HEMS industry logged. Suffice to say, though, if Part 121 airliners were crashing at a rate of about 0.90 per month – as are the evacuation helicopters – the airline fleet would be grounded. In this case, HEMS flights are still conducted despite the grim recent record of broken aluminum and shattered bodies.

Now consider the FAA’s pallid response to the NTSB’s 2006 recommendations.

A-06-12, Require operators to conduct all EMS flights with medical personnel on board in accordance with commercial flight operations. The FAA stated in March 2010 that, because an IFR [instrument flight rules] flight provides guaranteed obstacles clearance, continuous radio communication with air traffic control, and radar contact, this option provides a HEMS operator with an equivalent level of safety to that of a Part 135 [air taxi] visual flight rules flight. The only problem here is that despite three pages of back-and-forth letters between the NTSB and the FAA, the fact remains that the NTSB’s word – “require” – has not been acted upon. The NTSB characterizes the FAA response to this recommendation as “OPEN – Unacceptable Response.”

A-06-13, Require EMS operators to develop and implement flight risk evaluation programs. The industry had a 94% compliance with risk assessment; FAA is working on a Notice of Proposed Rulemaking (NPRM) to make risk assessments a requirement. Despite promises to issue the NPRM in January 2010, it has yet to be issued. For its slow rate of progress, the FAA response is categorized by the NTSB as “OPEN – Unacceptable Response.” Note that its been four years since the recommendation and an NPRM has yet to be issued; after the NPRM is issued, the FAA will have to consider all comments before issuing a final rule. Action on this recommendation is at least two years away.

A-06-14, Require formalized flight following and dispatch procedures including up-to-date weather. The FAA’s May 2008 publication of Advisory Circular (AC) 120-96, “Integration of Operations Control Centers [OCC] into Helicopter Emergency Medical Services Operations,” only partially satisfied the NTSB recommendation, as an AC does not “require” implementation. The FAA promised an NPRM by January 2010; no such document has been found on the Federal Register. Only because an AC has been issued, the NTSB classifies the response to this recommendations as “OPEN – Acceptable Response.”

A-06-15, Require EMS operators to install TAWS [terrain alert and warning systems]. The latest FF response is dated April 2009, promising to complete work on an NPRM by January 2010. It appears that much was promised by January 2010, none of which was delivered. The NTSB said, “FAA initiated rulemaking process, but little progress has been made.” The recommendation was classified, “OPEN – Unacceptable Response.”

All four recommendations are still “OPEN” and only in one was the response deemed “Acceptable” because a non-mandatory AC was issued. A literal reading of all four recommendations, each of which contains the word “require,” indicated nil progress.

Let us consider just one of the accident flights in the table above: the 8 June 2008 nighttime crash at Huntsville, TX, of the PHI Bell 407. TAWS might well have alerted the pilot to his dangerous proximity to ground. The NTSB issued a recommendation for TAWS two years before the accident.

In February 2009 the NTSB held a three-day hearing on the safety of HEMS flights. After this 3-day conclave, 21 additional recommendations were issued. None of them has been fully implemented. These recommendations were issued right in the middle of the three-year record of HEMS flight accidents in the table above.

The NTSB must be into self-flagellation, issuing 21 additional recommendations on top of the four languishing above.

But this commentary isn’t about the NTSB. It’s about the dismal record of the FAA at stemming the continuing mayhem in helicopter ambulance flights. If the FAA’s job is to protect the flying public – in this case patients strapped to a gurney, and the pilots and flight nurses sent to rescue them – the agency has been a dismal failure.

One thing is evident: had the FAA spent a little less time sending letters to the NTSB explaining why progress was difficult and time-consuming, it might have freed up a few bureaucrats to actually solve the problems.

The Golden Tombstone Award for the Feds

There is something deeply paradoxical and disconcerting about the Federal Aviation Administration (FAA). Here is an agency that touts safety as its highest priority, yet its actions are dilatory, incomplete, and reflect a regulatory lassitude that is inexcusable.

Four recent examples certainly suggest this damning indictment.

First, a 29 June 2010 Notice of Proposed Rulemaking (NPRM) on airframe and engine icing, dealing primarily with supercooled liquid droplets (SLD) that slap and stick on metal, turning to ice. Note, first of all, that this is a proposed rule, not a final rule. In other words, the FAA is seeking comments, and it could be a year or more before it publishes a final rule.

Following fatal icing accidents at Roselawn and Monroe, the National Transportation Safety Board issued two recommendations to the FAA regarding SLD. Both recommendations languish, the NTSB having characterized the FAA reaction to them as “OPEN – Unacceptable response.” The matters contained in the NPRM are intended to respond to the NTSB, but the “Unacceptable response” characterization will remain until the FAA publishes a final rule sometime a year or two hence.

Publication of the final rule won’t immediately effect one airplane. Lets look at the overall evolution, here, from womb to tomb (an appropriate metaphor given the accusation that the FAA is a “tombstone” agency requiring dead bodies to galvanize safety action). Since the ATR-72 accident at Roselawn, it has taken about 14 years and 8 months to bring the SLD issue to the proposal stage. If codified and effective, say, at the beginning of 2011, and application made for type certification of a transport airplane at that time, the airplane will have up to five years to be certificated to this rule, or until 2016 before the first airplane of the type would enter service. It will take several more years for the fleet to accrue significant exposure, necessary to determine if the rule has the intended effect on the safety of airline operations in icing conditions.

Total elapsed time, approximately 25 years – a quarter of a century – from accident to improvement.

Example 2: an FAA Safety Alert for Operators (SAFO) of 6 July 2010. The SAFO basically says that for stall training in the simulator, the old guidance of training the pilot to recover with “minimum altitude loss” is out. It is critically important that the pilot lower the nose (decrease back-pressure on the control yoke or side stick), add power, and increase speed to recover from a stall. Holding altitude or endeavoring to minimize altitude loss (without good cause, such as a ground proximity warning) can be a death sentence.

The SAFO follows Canadian guidance to this effect issued three years ago. And the change to approach to stall recovery was first urged back in 1999. That was 11 years ago. The FAA gets the “golden tombstone” for this belated action. There are a number of fatal accidents that could probably have been avoided had the pilots responded to the stall warning/upset along the lines suggested in this SAFO.

Example 3: an Airworthiness Directive (AD) issued 7 July 2010 regarding in-flight entertainment systems that do not have an ON/OFF switch in the cockpit enabling the crew to cut power in the event of smoke or flames from the system. While a circuit breaker (CB) does enable electrical power to be terminated, CBs are not to be routinely used as switches as this habit decreases the life of the breaker, resulting in failed circuits, smoke or fire.

The AD makes mandatory a number of Boeing Service Bulletins (SBs) on the corrective action for B777 jetliners (readers may recall the control boxes under the seats that control individual monitors; the boxes also reduce foot room).

Following the 1998 fatal crash at Halifax of Swissair flight 111 from a rampaging fire believed to have begun in the location of in-flight entertainment system wiring, Transportation Safety Board (TSB) of Canada investigators were dismayed to discover there was no installed ON/OFF switch for the entertainment system on the accident MD-11 and commented extensively about the hazard in their final report.

An FAA official concedes, “There is nothing in the FARs [Federal Aviation Regulations] prohibiting the use of CBs as switches.”

Here we are, 12 years after the Swissair accident, 7 years after the TSB final report, 4 years after the Boeing SBs, still dealing with in-flight entertainment systems without an ON/OFF switch. Another 5 years is allowed for installation, bringing the time from the Swissair crash to final fix to a total of 17 years.

Example 4: An AD published 13 July 2010 to prevent windshield cracking caused by loose electrical connections in the window heater. We’re not talking of one or two cracks, but wholesale cracking that impedes vision and has showered pilots and instrument panels with jagged pieces of shattered glass.

Cracked windscreen on an American Airlines B757 en route from Puerto Rico to Philadelphia, diverted to an emergency landing at West Palm Beach, FL, in 2008.

Cracked windscreen on an American Airlines B757 en route from Puerto Rico to Philadelphia, diverted to an emergency landing at West Palm Beach, FL, in 2008.

The FAA recounts 11 reports of smoke and fire from windscreen heaters. The most recent emergency landing resulting from this hazard occurred 16 May 2010 involved a United 757 at Dulles International Airport in Washington, DC.

Although replacement of the windscreen and heater controls is an alternative to the AD, which calls for inspection and repair on over 1,000 Boeing airliners, Continental Airlines notes that access to components requiring inspection is “atrocious.” Limited access, coupled to poor “view-ability” turns a simple task into a very difficult one requiring special tooling.

Given the redesign and tooling work necessary to yield a safer windscreen, one would think that replacement of the whole windscreen and associated electrical circuits would be more than justified. It appears that the original design was marginal from an inspection, maintenance and safety standpoint.

The FAA’s mandate to inspect, not replace, seems totally inappropriate given the cost of an emergency landing, or worse.

Note that the four examples cited here occurred within the last month. More examples for the same period could easily be produced. Add up the number of late, incomplete or token safety measures taken within a year and 50-100 such citations could be counted. Tote up the total over 5-10 years; the number of safety deficiencies is simply staggering.

What this reflects is a tolerance at the highest levels in the FAA for a regulatory torpor more seemly for Rip Van Winkle than for an aggressive regulatory agency with the mission of protecting the flying public. One wonders: does the FAA even recognize how slack and inept it appears?

Alpine Texas Air Ambulance Crash the Latest in a Legacy of Unsafe Practices

The fatal crash of a medical evacuation airplane is certain to be investigated with an eye to unrequited recommendation to improve aerial ambulance operations.

Shortly after midnight on 4 July, in clear weather, an O’Hara Flying Service-operated twin-engine Cessna 421 aerial ambulance took off from Alpine-Casparis Municipal Airport, Texas, for a flight to Midland International Airport, Texas. The airplane was carrying patient Mary Folger, 73, who had broken her hip. She was accompanied by her husband, Guy Folger 78. Two flight nurses were aboard, Sharon Falkener and Tracy Chambers. Piloting the aircraft was Ted Caffarel, 59.

Crash scene at Alpine, Texas, of an O’Hara Flying Service air ambulance, killing all 5 aboard.

Crash scene at Alpine, Texas, of an O’Hara Flying Service air ambulance, killing all 5 aboard.

After an uneventful takeoff, the airplane experienced some sort of problem, perhaps engine related, and Caffarel was attempting a return to the departure airfield. About a mile short of the runway, a main landing gear wheel hit a rut in an open, muddy field. The airplane overturned at least once and burst into flames. There were no survivors.

In May 2009, another O’Hara Flying Service aircraft, also a Cessna 421, was substantially damaged during a forced landing following the loss of engine power shortly after takeoff near Alpine. The pilot was the sole occupant of this positioning flight and received minor injuries in the incident. It is not known if this earlier event involved the same Cessna 421 or one of its engines.

Between December 2007 and February 2010 a total of 41 patients and flight crew have been killed in EMS fixed-wing and helicopter accidents. Generally, EMS flight safety is about 30 times lower than it is for commercial airline operations.

The National Transportation Safety Board (NTSB) will be investigating this accident. The NTSB has a long record of concern about the safety of Emergency Medical Service (EMS) flights. A special investigation report was produced in 2006 that examined about 40 EMS accidents. In 2008 helicopter EMS accidents hit an all-time high, with 29 fatalities, prompting the NTSB to hold a public hearing on HEMS safety in February 2009. In addition to the four safety recommendations issued as part of the 2006 study, the 2009 forum produced an additional, and whopping, 21 recommendations. None have been fully implemented.

In February of this year, the NTSB increased the pressure to act on the Federal Aviation Administration (FAA) by adding the improved safety of EMS flights to its “Most Wanted” list of still-to-be-enacted improvements. On that “Most Wanted” list was the recommendation to install Terrain Awareness Warning Systems (TAWS) on all EMS flying machines. A technical standard order (TSO) was released by the FAA for TAWS in December 2008, but the FAA has yet to take action requiring such a system to be installed on EMS aircraft and helicopters. The NTSB has characterized its moribund TAWS recommendation as “Open – Unacceptable Response.”

It is not known at this time if O’Hara Flying Service voluntarily installed TAWS on its EMS air ambulances. Since there was no FAA requirement to do so, there is reasonable suspicion that the accident airplane was not equipped with TAWS.

TAWS might have prevented this night time crash. TAWS may have alerted the pilot to his low altitude, preventing the premature contact with the ground as pilot Caffarel was returning to the runway.

The NTSB investigation will doubtless discuss the legacy of FAA-ignored recommendations as part of its investigation of this accident.

Of interest, the NTSB has never recommended two pilots in the cockpit. Single pilots like Caffarel frequently rely on a flight nurse in the co-pilot’s seat to manage part of the radio communications and to maintain a look out the cockpit for other aircraft or terrain.

In Canada, which has not suffered a single fatal EMS accident, two-pilot operation is required. Helicopter crash law firms can come into play in these types of incidents.

No commercial airline flights would be undertaken by a single pilot. Yet here is an EMS flight, with passengers, being flown by one pilot, who had an emergency such that he was attempting to return to the departure airfield.

Any number of NTSB reports on EMS accidents have served to justify its recommendation for TAWS, but TAWS is best employed with two pilots. TAWS alerts require one pilot to be looking out the windscreen while the other pilot tracks the dangerous rising terrain on the cockpit display.

And if he had an engine problem, Caffarel could certainly have used a co-pilot to manage the overall situation. With the resources of two pilots’ trouble shooting, and TAWS to avoid premature ground contact, the fiery crash just may have been avoided.

Safety Research That Gathers Dust on Bookshelves Not Helpful

For a highly pertinent example of the Federal Aviation Administration (FAA) not following-up on its own research, look no further than its requirements for life preservers. I use life preservers as my prime example because, unlike avionics and other esoteric electro-mechanicals of airplanes, most people understand the problem of floating for extended periods in cold water.

Cold water is the key. Water saps the body’s heat at a much faster rate than cold air. With the body numb from cold, muscle coordination atrophies, the mind loses concentration – the will to live is sapped much quicker. In cold water, even if one’s head is kept above the waves, one can die from the cold even if the airway is free to breathe. And remember, many survivors of a ditching may be suffering from shock and trauma even before they grab a flotation aid and evacuate the sinking airliner. These people are doubly vulnerable to the effects of cold water.

Every seat cushion and life preserver on an airplane used for flotation must conform to the FAA’s Technical Standard Order, in this case TSO-C13f, issued in 1992, dealing with life preservers.

The TSO covers a great deal about the required preserver performance. Herewith, selected passages:

“This technical standard order (TSO) prescribes the minimum performance standards [emphasis added] that life preservers must meet …”

“This standard covers inflatable (Type I) and noninflatable (Type II) life preservers. Both Type I and Type II preservers are divided into the following four categories: Adult, Adult-Child, Child, and Infant-Small Child.”

“For coated fabrics used in the manufacture of inflation chambers, the maximum permeability to helium may not exceed 5 liters/square meter in 24 hours at 77 degrees F or its equivalent using hydrogen.”

“The force necessary to operate the mechanical inflation means may not exceed 15 pounds when applied through the pull cord.”

“(A)t least 75% of the total number of test subjects … can don the life preserver within 25 seconds unassisted, starting with the life preserver in its storage package …”

“After donning, inadvertent release by the wearer is not likely.”

The TSO lists the required color of the vest (international orange-yellow), the readability of instructions (a minimum viewing distance of 24 inches with illumination no greater than 0.05 foot-candle), and material properties (separation rate must be 2.0 to 2.5 inches/minute). Buoyancy, survivor locator light performance, and salt-spray standards are laid out in detail. Oh, and the preserver must be comfortable to wear in the water.

The TSO is absolutely silent on a critical matter: its aid in heat retention in cold water. A 1985 report by the FAA’s Civil Aeromedical Institute (Report No. DOT/FAA-AM-85-11) on the development of a better life preserver noted:

“If a life preserver provides a measure of thermal protection, not only are the chances of death caused by hypothermia decreased, but also the chances of death caused by drowning decrease.”

Citing a number of accidents where aircraft crashed into cold water, the FAA required research into a preserver that would not only keep the person afloat but would also “provide increased thermal protection in the event of accidental submersion in cold water.” This requirement was in addition to a donning time of 15 seconds, and all the buoyancy, marking and storage requirements of the existing TSO.

During water immersion, the body loses heat at about 26 times the rate it does in air. A close fitting life preserver was designed to minimize degradation of the body’s core temperature in the upper torso (most heat is lost from the trunk, not the limbs).

Test subjects, outfitted with rectal thermometers, were required to wear a prototype preserver in cold water, and a trial was also conducted with the standard life preserver found on airliners today. Pages and pages of graphs show that the prototype preserver retained about 50%-60% more body heat.

Based on rectal temperatures of subjects in 55 degree water, the report concluded:

“(T)he mean estimated predicted survival time was greater for subjects wearing the prototype life preserver than when the same subjects wore the standard PFD [personal flotation device].”

Note, this prototype preserver met all the other requirements for storage (in the same space), for buoyancy (35 pounds), for ease of donning (about 18 seconds), and so forth.

Note also that the improved life preserver report was produced in 1985, a good seven years before publication of the current TSO. Even the FAA apparently has forgotten about this report and its life-saving findings. It had no effect on the TSO or any other FAA requirements for life preserver effectiveness.

Basically, passengers today rely on either the seat cushion, with absolutely no thermal protection, or an obsolescent preserver that was not designed with heat retention as a basic function.

The improved design could be produced at about the same cost. Why was it not pushed by the FAA? One suspects industry resistance at the total cost – which could be absorbed through a multi-year program of fielding the improved model, estimated to cost about $35 apiece.

This is not the only case where the FAA has developed something that enhances safety that does not find its way into the airline fleet. In 1979 the FAA Technical Center published a report on its successful fuel tank inerting system. This 600-pound system displaced explosive fuel-air gasses in fuel tanks with inert nitrogen enriched air. The technology was tested in an FAA DC-9 airliner and passed all performance criteria with flying colors. The weight of the inerting system, we should note, was comparable to or less than the weight of many in-flight entertainment systems, which the airlines have aggressively deployed.

The FAA never mandated that this inerting system be installed on airliners. In 1996, TWA Flight 800, a B747, blew up when volatile vapors exploded in the plane’s center fuel tank. Now the FAA has ordered a less-capable inerting technology to be installed in all but the oldest airliners, and to get the job done by 2018 – fully 22 years after TWA 800 exploded. (See Aviation Safety Journal, August 2008, ‘Significant Regulatory & Related Activity’)

In light of all this, a couple pertinent questions arise. First, why does the FAA bother to explore new technologies or equipment if the results of its efforts just gather dust in obscure reports? Millions of dollars could be saved by closing down the Civil Aeromedical Institute and the Technical Center. This writer cannot think of a single technology or improvement that has been adopted as a result of the work at these subordinate agencies.

Second, if the Civil Aeromedical Institute and the Technical Center are going to be retained, and they continue to develop useful devices and techniques for the safety of the industry, there is an obviously related and relevant question: why isn’t there a link between the FAA’s development efforts and FAA requirements for implementation or adoption by the airline industry?

There is no evident linkage. In an FAA that touts safety as Job #1, advances to safety developed by the agency’s most committed and best minds seems to languish somewhere around Job #0.

The Chimera of Airline & Oil Drilling Industry Safety

At a Congressional hearing 15 June on the BP oil-drilling and ecological disaster in the Gulf of Mexico, a legislator declared that if the airline industry operated with the same sloppy standards as the oil industry – no functional blow out preventer, inadequate training of staff, failure of warning systems, history of less severe incidents where greater disaster was narrowly averted – no one would fly.

The lawmakers assailed the oil spill plans across the industry. Oil company executives representing Exxon Mobil, Chevron, ConocoPhillips, Shell Oil and BP looked on meekly as Congressmen charged their disaster response plans looked suspiciously alike, including references to nonexistent walruses in the Gulf of Mexico and a marine science expert who’d been dead for four years.

BP rig

The airline industry was held up as a model for the oil industry to emulate when it comes to safety.


One doubts many passengers (or Congressmen) are aware of the airline practice of operating an airplane for days with key safety equipment inoperative. Under the minimum equipment list (MEL), a weather radar, for example, can be inoperative for up to ten days and the airplane may still fly. For just about any safety system on the airplane, there is a grace period between when a system fails and when it must be repaired.

Worse, there is no upper limit on how many airplane systems can be inoperative under MEL and the airplane can still be dispatched for a passenger carrying flight. To put it rather technically, the set of all MEL outages is not enough to cancel a flight and get the airplane in for repairs.

A hearing with top airline executives to explore why the MEL was different for the same model airplane in service with two different airlines would be an interesting exercise in squirming and evasiveness.

The public’s enthusiasm to fly might be jolted by the obfuscations and self-serving rationales offered up by airline executives as to why maintenance procedures vary by airline..

The absence of key safety systems in the Deepwater Horizon blowout is similar to the MEL situation. The drillers were in a hurry (time pressure akin to schedule pressure in the airlines) so the decision was made to rush ahead without key safety systems (the equivalent of MEL).

One of these days, 80%-90% of MEL-excused items will combine into an airliner catastrophe.

It would be interesting to see the number of passengers refusing to fly if a green light/red light display were mounted on the cockpit bulkhead facing the boarding area in the cabin. The display would indicate the status of each MEL items, green for fully functional and red for inoperative. Imagine such a board with ten items, six of which have green lights on, four of which have red lights. How many passengers would continue to their seats? How many would raise questions? How many would turn around and get off the airplane?

Nor are passengers aware of the months or even years allowed under Federal Aviation Agency (FAA) practices to correct what are called “unsafe conditions,” which go far beyond MEL items. Under the airworthiness directive (AD) system, mandatory corrective action must be taken. AD’s cover everything from faulty checklist procedures to potential fuel vapor ignition sources, to windshield heater problems, to cracked engine parts, or anything else on the airplane where the FAA has determined that the problem poses an intolerable risk to the flying public. But the ADs are generous in the extreme in allowing airliners to operate with extant problems awaiting repair.

If the Minerals Management Service (MMS) has an equivalent to the AD process (doubtful, given its reputation for collusive coziness with the oil industry it “regulates”), compliance time may be as scandalously generous as that allowed by the FAA.

From the MEL the congressmen could look at maintenance, and ask why inspection and lubrication intervals were different for the same airplane at two carriers. Each airline has its maintenance program separately approved and inspected by the FAA. Recall the lubrication intervals approved for the elevator jackscrew on Alaska Airlines MD-80s, which meant the airplanes went years between lubrications. The crash of Alaska Flight 261 in January 2001 was the direct result of the failure to lubricate the jackscrew, which stripped its threads and failed. Subsequent inspection of other airlines’ MD-80 lubrication indicated that the largest fleet operator of MD-80’s, American Airlines, had rigorous lubrication schedules and procedures. American’s jackscrews were found to be in “like new” condition. But in the industry overall, the belated jackscrew maintenance inspections revealed that practices varied widely.

The “best practices” of one operator were not emulated by all. The FAA doctrine of “one level of safety” was compromised – a fiction, really – from the outset.

Similarly, the executives appearing before the House Energy and Commerce Committee hearing all outlined differing safety standards for oil drilling.

In neither the airline industry not the oil drilling industry are “best practices” adopted for application by all operators. Anarchy prevails, abetted by the government’s lax regulators.

The situation is worse for the oil drilling industry given the consequences. The FAA’s slack practices might result in an airliner or two crashing, but when the MMS fails to enforce regulations, the consequence is not only the 11 lives lost when the rig blew up, but hundreds of miles of coastland pollution, thousands of wildlife killed, and the deleterious effects of oil contamination persisting for decades.

A comment at “The Oil Drum” website (www.theoildrum.com/node/6543) specifically compares the oil drilling and airline industries:

“A cursory study of reports generated after the 1977 Ixtoc disaster, along with incident reports like the ones above. Lead me to believe that offshore drilling will always have a risk of catastrophic environmental failure. Saying otherwise is like saying commercial aviation aircraft will cease crashing to the ground tomorrow because we understand every possible failure and have the technology to counter every failure.

“The sad truth is the types of failures we face in offshore drilling are not completely understood. The list is certainly lengthy, but it is not complete. Surprises will happen. Usually, they are controllable and adjustments can be made in the future to compensate for them. That still leaves us with the analogy of the airliner falling from the sky. A single unanticipated failure, or a combination of failures, may have no solution. All aboard the airliner will die. Likewise, the well will leak for months.”

In the airline industry, unpleasant surprises are minimized (not eliminated) by analysis of potentially fatal combinations. The process is called “failure modes effects analysis” (FMEA). In the airline industry, these analyses are supposed to demonstrate that the probability of catastrophe is one in a billion. Virtually no airplanes in service live up to this standard, but one in 100 million has been demonstrated. Mechanical failure, human error, unforeseen environmental effects, and other real-world factors combine to yield a lower safety standard, but we start from a theoretical of one in a billion flight hours.

The oil drilling industry starts from a lower threshold: one in a million. When real world shortcomings reduce the standard further, the result is the history of lesser breaks, mechanical failures, and human confusion that preceded the Deepwater Horizon mega-blowout. That sad and scary history is fully documented at the website above.

The higher one in a billion standard might prompt the following to be examined:

The shear in the blowout preventer (BOP) is the last line of defense, physically cutting the drill pipe. It was not truly fail-safe. Just like critical flight controls feature two or three actuators, why weren’t there at least two functional shears? If one failed, the other would cut the riser. The comforting statistics caught up with the Deepwater Horizon, just like they did in the case of B737 rudder reversals, where a history of a hundred or more events finally culminated in a fatal crash. And that was with a one in a billion probability.

There are reports of low batteries (might not operate valves), questionable accumulator pressure (not sufficient to operate rams), and other alterations that were not fully documented. My bet is that when all mechanical failures are accounted for, the “on paper” risk of an uncontained blowout was not one in a million, but closer to one in a hundred or even one on ten.

Then there are contributing factors that should be familiar to airline industry accident investigators:

Inadequate training of staff for them to properly undertake the risks of their actions. This observation applies not only to the oil drilling industry, but to the regional airline industry, where accidents have resulted from poorly trained pilots.

The corruption of data in one incident caused the drilling rig to get invalid information about where it should be, causing it to move. Recall the corrupted airspeed data on Air France Flight 447, resulting in the airplane flying too fast in the “coffin corner” of the maneuvering envelope, going out of control and crashing into the Atlantic. Added automation can increase safety, but not when the automation is fed bum data. The automation can then become a killer.

The failure of warning systems (lights, etc.) that aren’t noticed when things are working normally, but which can bite when something actually does go wrong.

It is readily apparent that the BP blow-out resulted in short cuts – from design to operations – with little pretense of any risk avoidance whatsoever. Similar short cuts and their disastrous consequences have been seen in the airline industry.

The risks need to be assessed against the one in a billion probability of cascading failure, based on incidents and operational experience – not rosy, comforting assumptions about mechanical and human reliability. This observation applies to both the airline industry and the offshore oil drilling enterprise.

And the “best practices” identified at one operator need to be adopted by all operators. That’s where the federal regulators come in; they should force recalcitrant operators to adopt them or face termination of the federally issued operating license.

Former chairman Jim Hall of the National Transportation Safety Board was asked to comment on the lack of common “best practices” in both the airline and the offshore oil drilling industries. He offered a mouthful, but on close reading his comment is eminently sensible:

“With the increased dependency on technology and the many inter-related systems, the Federal Government needs to move from a regulatory structure of minimum standards to a structure of ‘best practices’ policed by independent investigative bodies with a more robust role in defining the best practices.”

The FAA and the MMS are capable of realistically defining the one in a billion safety calculation, and they are in a position to define and require the best practices that can support the realization of good operational safety. Neither agency currently demands these things to minimize the risk of catastrophe.

Definition of Professionalism Not Coming Anytime Soon

Greater “professionalism” is badly needed in the airline industry, but no one person or organization seems to have defined it succinctly yet broadly to capture the qualities needed. That much is evident from a 2½ day forum on the subject of pilot and air traffic controller professionalism held 18-20 May by the National Transportation Safety Board (NTSB). It may be quite feasible to define the term, but the Federal Aviation Administration (FAA) is not likely to embrace it in regulations, as such action would put the FAA’s own culture and practices on the spot.

The NTSB held the forum because of findings over the past few years of lapses in both pilots and controllers of standards one could expect of professed professionals. Pilots have been found violating the sterile cockpit rule with excessive and distracting chit-chat, in some cases contributing to fatal accidents. Controllers have been found talking on the telephone about personal business while disaster unfolded on their radar screens. Air traffic control is often about timely intervention –which necessitates are solid awareness not based on assumptions. If a pilot is told to do something, the healthy controller attitude is first to assume that he might not, perhaps because the pilot has misunderstood or is pressured, fatigued or distracted. Reliably detecting airborne errors is the signature theme of a professional controller. It demonstrates a level of maturity that comes with experience, and it’s an ingrained attitude that is a good example for junior controllers. After all, effective on-the-job training of junior controller is fundamentally reliant upon establishing norms and teaching precedents.


At the forum, about 40 different presenters offered about as many different perspectives on the term “professional.” Here is a representative smattering:

“Professionalism means recognizing the public trust and SOP [standard operating procedures] adherence.”

“Professionalism is a series of traits that focus on outcomes and are consistent with the values of the organization.”

“Professionalism is how you do the work, whether you’re following SOPs all the time.”

“Professionalism is an outgrowth of commitment, knowledge, discipline, passion and judgment.”

“An aviation professional consistently exceeds minimum standards, continuously improves, and helps others to do so.”

“A professional pilot possesses the physical, mental and emotional attributes to do the right thing – because it is the right thing to do.”


Discourse along these lines clearly frustrated the NTSB. Member Robert Sumwalt expressed his reaction thusly: “Right now, professionalism is this glob that we can’t put our hands around.”

Chairman Deborah Hersman put the matter more diplomatically, but pointedly:

“One thing that strikes me is that defining professionalism is somewhat elusive. We heard a number of panel members say that they can see it in actions; the difficult part that remains is defining professionalism and creating a culture of professionalism at all levels.”

It is possible to come up with a definition that is broad yet specific, and that captures both the detailed job performance and the general standards expected of employees. Herewith, a working definition:

“A professional individual is technically competent, an ethical exemplar, with presence of mind and strength of character in difficult circumstances, working within a structured top-down culture where safe operations and mutual trust are paramount, whom we would want all others to emulate.”

This definition covers a lot more than just activities in the cockpit or airport tower and associated air traffic control facilities (e.g., en route control centers). This definition covers the flight line, the corporate offices, and the individual’s personality and personal appearance. Why appearance? Because appearance not only influences third party perceptions – the travelling public – it adds to the aura of command and solicits respect. There is a reason for the pilot’s uniform being modeled after that of a naval officer.

“Technically competent” means more than just adherence to SOPs in the cockpit or control center. It means not only knowledge of them and adherence to them, but the degree to which these SOPs are executed. Are the radio readbacks prompt, clear and precise, for example.

“Presence of mind” is a term used to convey the ability to focus and keep a cool head in extreme circumstances. For instance, Capt. Chesley Sullenberger and First Officer Jeffrey Skiles, the two pilots who successfully ditched their US Airways A320 in the Hudson River, had presence of mind; both were outwardly cool, focusing on options and procedures and keeping their emotions in check. They had “presence of mind.” Then there’s Captain Marvin Renslow and First Officer Rebecca Shaw, who allowed their Colgan Air Dash 8-Q400 twin-turboprop to stall on approach, and then applied grossly incorrect procedures after being panicked by the sudden departure from controlled flight. They didn’t have “presence of mind” and unfortunately let the stun-power of surprise kill themselves and 47 others aboard.

“Strength of character” refers to the ability to maintain one’s position in the face of contrary pressures. For example, insisting on the highest standards of safety in the face of corporate pressure to fly with only minimal safety margins.

“Mutual trust” means more than just a junior/senior relationship in the airline or in the air traffic organization. It means management has the self confidence to listen to an employee, and the employee feels free to state his position without fear of retribution.

“We want all others to emulate” covers the employees communication skills, pleasant personality, personal appearance and other aspects of performance that are worthy of copying. For instance, casual swearing or comments loaded with sexual innuendo are immature and destructive of morale. A pilot with bad breath or a fat, sloppy personal appearance is not the image one wants to project to the public. It isn’t necessary to be a rail-thin moralist, but the airline has a right to expect and enforce an image of pride and competence. Beyond image, there are the unseen background factors in which professionalism is rooted: a code of conduct, integrity, and high ethics.

The hard part is getting the FAA to give this suggested definition, or any other, the force of regulation. That would require floating the proposal to industry as a proposed regulation. The airlines are likely to respond that the FAA should stick to matters of aviation, per its congressionally mandated charter. If there were to be any costs to the industry associated with this definition, expect strong airline resistance in these tough economic times.

But if this definition were propounded in a nonbinding advisory circular (AC), such objections could not hold sway. An advisory circular is a form of articulating optional “best practices” – albeit normally of a quite technical nature.

There are identifiable problems with the FAA publishing an AC: such a document might be perceived by the FAA rank and file as an abject exercise in hypocrisy. There is virtually nil protection against retribution for those in the FAA who speak out about shoddy practices in airline operations, about hastened and pressured efforts to certify new aircraft designs, about the FAA’s reluctance to engage air traffic controllers in assessing new equipment technologies, low morale at the agency, etc. The top-down fealty to safety in an atmosphere of mutual trust is lacking in the FAA. For the agency to propound such “professionalism” for all others while its own house is in unhappy disorder will be seen as an example of “do what I say, not what I do.”

There is also the conundrum of whether the AC could be utilized by employers – government or industry – as a basis for remediation or dismissal. Pervert the exalted intent of a helpful definition and it could become the basis of demonstrable abuse. Professionalism has leverage only so long as it’s not “in disrepute” as a flogging tool (As in “the floggings will continue until morale improves”). In some contexts, professionalism, as with virtue, has to remain the great unspoken.

The NTSB, though, has been evaluated by employees as one of the best places to work in government. Why, the NTSB scores so well this matter is covered on its website under the heading “The Best Place to Work in the Federal Government 2009.” There is not a comparable box on the FAA’s website, for an obvious reason – the FAA rates near the bottom in terms of employee satisfaction. The NTSB scores above 75 and is improving. The FAA scores a dismal 49 and is getting worse.

When the FAA rises in the eyes of its employees to a similar level as the NTSB, it may be time to publish an AC on professionalism. Or perhaps it could issue a coda. A coda is a theme or motif, often a summation of preceding dictums and/or an underlying sentiment. Professionalism may be best seen as a postscript that essentially states the overlaid (yet underlying) goal of achieving “the best that you can be.”

In whatever form, the aviation industry demonstrably needs some guidance on professionalism, but the FAA will first have to address and redress the cultural dysfunction in its own house. It may ultimately prove to be one vital area in which the NTSB can go beyond its limited charter and pleading recommendations – setting standards by the unsubtle reproof of sterling example.

Tripoli Crash Resulting From a Fatal Combination of Factors

There is a telling indicator of what may have happened as the Afriqiyah Airways A330 attempted to land at Tripoli airport on 12 May. Amid the shattered wreckage on the approach to runway 09, the largest piece is the tail – and it’s pointed backward to the line of flight.

Intended runway is to the left (east) in this photo.

Intended runway is to the left (east) in this photo.

That positioning indicated that the airplane cartwheeled on impact. If there was a need to bank late in the approach to line up with the runway, at that low altitude there is the potential to dig in a wing-tip and cartwheel. If the handling pilot hit take-off go-around (TOGA) thrust at the last moment to avoid ground contact, that would guarantee the cataclysmic extent of the cart-wheeling break-up. An Alitalia crew saw the Afriqiyah A330 looming out of the mist on finals and reported it was banked in a nose-down attitude, about to hit in the underrun.

Crash site relative to Tripoli's airport, looking east.

Crash site relative to Tripoli's airport, looking east.

What would lead the pilot to be low enough to hit the ground with a wingtip? There is a pronounced upslope in the first third of the runway. The effect of this first third and limited runway field of view in poor visibility (dawn at the time of the crash, about 6 a.m.) is an illusion that will cause the pilot to undershoot. The undershoot results as the pilot descends in his attempt to maintain a normal visual approach angle – and he has no VASI (visual approach slope indicator) or PAPI (precision approach path indicator) to help guide him. Nor is runway equipped with ILS (instrument landing system). Runway 27 at Tripoli, the reciprocal of runway 09, was ILS equipped.

The obvious question: why wasn’t runway 27 used instead? At that time of day, planes landing on runway 27 approach from the east. In other words, they come out of the rising sun, as viewed from the control tower. As one account has it: “They [air traffic controllers] find this unpleasant.” So airplanes are directed to use runway 09. That means pilots fly into the sun and haze at dawn. In this case, that approach from the east meant a tailwind, which would tend to flatten the approach. Add the appearance of the first third of the runway, nil navigation aids, and maybe a bit of fatigue from flying all night from Johannesburg, South Africa, and one has the makings of an accident.

The airplane’s TAWS (terrain awareness and warning system) was of marginal utility. As one pilot remarked:

“Looking at the terrain clearance floor … the floor rises from 0 feet a short way from the runway to 400 feet at 5 NM. If you flew a 3 degree slope to the ground at 1 NM it looks unlikely that you would get any warning and, if you did, it would be a very late one!”

At times of sunset and sunrise, the pilot’s prevailing visibility can be very directional. For instance, a pilot landing into the west around sunset can easily “lose it” in the flare. Cloud isn’t a factor and most likely wasn’t in this case in Tripoli. Here’s guessing the pilot dragged in low on approach, lost it in the glare, and dug in a wing-top. Of the 104 passengers and crew aboard, 103 died.

As the saying goes, Occam’s razor cuts deep when illusions are in play.

Pilot Error Led to Fiery Crash, But System Logic Didn’t Help

As the building into which they were about to crash filled the windscreen, the two pilots of the TAM A320 probably did not realize that one of their throttles was in CLIMB while the other was in REVERSE.

The TAM Linhas Aéreas A320 was landing 17 July 2007 at Brazil’s Congonhas airport after a flight from Port Alegre at about 7 p.m., and the runway was slick from rain. The aircraft veered to the left near the departure end, crossed a boulevard and hit a gas station and then plowed into a TAM air cargo service building.

Burning wreckage of TAM A320 and cargo building.

Burning wreckage of TAM A320 and cargo building.

All 187 persons aboard were killed, plus 12 people in the building. The airplane’s No. 2 engine reverser was de-activated, in accordance with the Minimum Equipment List (MEL), due to a leak in the inner actuator. However, even without the thrust reverser, the airplane should have been able to stop. But with the No. 2 engine throttle set to CLIMB power, the overrun was inevitable.

Brazil’s Aeronautical Accident Investigation and Prevention Center (CENIPA) just recently released its final report. It goes well beyond the cockpit to cut a wide swath of causes for the tragedy:

— The airline was in a period of rapid growth from 2003-2007: a 30% increase in the number of aircraft, 110% more flight hours, 115% growth in the number of pilots.

— The first officer had less than 200 hours in the A320. Crew Resource Management between the captain and the first officer was poor to nonexistent. During previous flights, five different procedures for landing with a deactivated reverser were used.

— There was internal pressure on the pilots not to divert to alternate airports because of “the consequences to the company’s image before the passengers.”

— The airline had only 21 people dealing with safety issues, as compared to 900 in maintenance. Safety was regarded by the flight crews as “a not very active sector.”

— There was no systemic evaluation of training, most of which was outsourced.

— Simulator training was done by the Operations department, disconnected from the remainder of instruction conducted by the Training department.

— The airport did not have an adequate (per international regulation) runway safety area beyond the tarmac.

— The regulator’s “inappropriate or absence” of oversight of TAM’s operation led to uncorrected problems.

— Manufacturer Airbus was deficient in its design of the A320 fly-by-wire aircraft. Specifically, according to the CENIPA report:

“It was verified that, for the A320 airplane proceeding to land, it is possible to place one of the thrust levers at the ‘REV’ [reverse] position and the other at ‘CL’ [climb], and no alerting device will advise the pilots in an efficient way. This situation may put the aircraft in a critical condition and, depending on the time it takes the crew to identify this configuration, and on the runway parameters, a catastrophic situation may occur.”

In the case of this accident, Airbus’ design of the throttle system bears examination. According to the regulations for certification, “Under all anticipated operating conditions, the airplane shall not possess any feature or characteristic that renders it unsafe.”

And the A320 is described by pilots as a steady, predictable flying machine.

But there are quirks. One is the possibility of inadvertently setting the thrust levers at cross purposes. This situation was evidently not “anticipated” (per the regulation) during the design and certification phase. Yet this has happened repeatedly, with Airbus, Boeing and McDonnell Douglas designed airliners. There have been at least 11 events since 1983. As the CENIPA report noted:

“Two are worth being highlighted, on account of the similarities to the [TAM A320] accident … the ones of Bacolod (Philippines – 1998) and Taipei (Taiwan – 2004). In both cases, the pilots were operating an A320 with the reverser of one of the engines deactivated and, during the landing, they kept the thrust lever of that engine in the ‘CL’ position, reducing only the thrust lever of the other engine to the ‘IDLE’ position and later to the ‘REV’ position. At that time, neither aircraft possessed in its FWC (Flight Warning Computer) a routine to alert the crew about any inadvertent positioning of the thrust levers.”

Following the 2004 event, Airbus developed what is referred to as the H2F3 standard, alerting the pilots to a thrust lever above IDLE during the landing. According to the French accident investigation bureau (BEA) comment in the CENIPA report:

“This situation, which had not been foreseen during certification [by the French, we should add] thus became foreseeable. In this case, two corrective actions were taken by Airbus:

— The development of the FWC (H2F3) standard to ensure triggering of a specific warning with an ECAM [Electronic Caution Alert Module] ‘ENG X THR LEVER ABV IDLE’ message.

— An operational change requiring that crews position the two thrust levers in the REV detent. This procedure prevents any inappropriate action on the thrust levers.”

TAM had not implemented these changes. Why not? Because Airbus issued them via service bulletin, which does not require adoption. If the French (and then Brazilian) regulator had issued an airworthiness directive (AD) requiring implementation of the H2F3 and crew standard, the accident might have been avoided.

As the CENIPA report indicated, the TAM A320 was not upgraded:

“Thus, the H2F3 standard represented only an improvement offered by the manufacturer through a service bulletin to all A320 operators. It was up to each one of them to decide either for its implementation (handling the respective costs) or not.”

Given the turbulent conditions at TAM, an optional service bulletin went ignored. Here’s the price of too-rapid growth and two few safety people and poor oversight.

CENIPA issued the following recommendation:

“(173/A/07) … require that the aircraft designs already certified and the aircraft designs in process of certification have their power control systems and their warning systems optimized, so as to allow the identification of the conditions in which the thrust levers are incorrectly positioned during critical phases of flight.”

Whether this recommendation will be implemented beyond the optional H2F3 standard is questionable. The BEA clearly does not see more action as necessary: “The incorrect positioning of the thrust levers cannot be considered a [system] failure since it results from an action by the crew.”

If the outcome is nil regulatory and certification reform, the question arises: at what point does inaction become negligence and an accident become culpable homicide? The TAM A320 accident may not result in any mandatory hardware or software changes (beyond the reactive H2F3 Band-Aid) despite 199 deaths. Given the extensively-documented history of this identical scenario, is this outcome acceptable?