Loss of Control In-flight incident involving a Royal Air Force A330

A camera jammed between the left armrest and the side –stick unit producing an inadvertent physical input to the Captain’s side-stick assessed as the cause of the event. Several organizational and some design factors were identified as contributory factors

ZZ333 (2)

Photo (C) Stewart Marshall. Jetphotos.net

UK Ministry of Defense and Military Aviation Authority Service Inquiry: incident involving Voyager ZZ333 on 9 February 2014.

HISTORY OF THE FLIGHT

On February 9^th, 2014, the crew of ZZ333 briefed at 0925 UTC for a non-stop air transport flight from RAF Brize Norton (BZZ) to Camp Bastion Airfield (QOZ), Afghanistan. ZZ333 taxied approx 20 minutes late with a total flight crew of 9, plus 189 passengers. The departure was delayed slightly by a transponder Electronic Centralized Aircraft Monitoring (ECAM) warning just prior to line-up which was quickly resolved. With a call sign of ISF 63JW, ZZ333 departed BZZ at 1200 UTC for an anticipated 8hr 20min leg to QOZ.

Initially, the flight progressed without incident, with the exception of at least one instance of turbulence, significant enough to warrant the illumination of the seat belt signs. At 1549 UTC (night time), with the aircraft in the cruise at Flight Level (FL) 330 and autopilot 1 engaged, the Co-pilot had left his seat and was in the forward gallery in the vicinity of the forward left passenger door. The Captain (occupying the left-hand flight deck seat) suddenly felt a sensation of weightlessness and being restrained by his harness, accompanied by a rapid pitching down of the aircraft. He attempted to take control by pulling back on his side-stick controller and pressing the autopilot disconnect button but these actions were ineffective.

Immediately prior to pitch-down, the Co-pilot felt a sensation similar to turbulence. Other crew in the cabin reported a similar sensation, describing it as a “jolt”. The Co-pilot then experienced weightlessness and struck the cabin roof but was able to re-enter the flight deck through the open door. He reported a disorderly scene with audio alarms sounding and a violent shaking of the aircraft. He reached down to pull back on the side-stick control. Both pilots reported hearing a “dual input” audio warning, indicating simultaneous inputs by both pilots, on their respective side-sticks. As the aircraft began to recover from the dive, excessive speed was building. The thrust levers were selected to idle and as the aircraft re-established a climb, the speed rapidly reduced. The Captain set Take-off and Go-around (TOGA) power and subsequently re-established a power altitude combination for a straight and level flight at FL310.

The aircraft had lost 4,400 feet n 27 seconds, registering a maximum rate-of-descent of approximately 15,800 feet per minute, before recovering to straight and level flight. The speed had reached 358 knots Indicated Air Speed (KIAS), or Mach 0.9, and g-forces had ranged from minus 0.58 “g” (at the onset of the dive), to plus 2.06 “g” during the recovery. The aircraft was diverted to Incrilik Airbase in southern Turkey without further incident.

The resulting negative “g” forces were sufficient for a significant number of passengers and crew to be thrown towards the cabin roof. Twenty-five passengers and 7 crew reported injuries, and were attended in flight by medical personnel travelling as passengers, and subsequently at the on-base medical facilities. No major injuries were reported at the time of the incident.

Background

Voyager is a modified Airbus A330-243, procured under a comprehensive service delivery contract between the Ministry of Defense and a contractor which owns the aircraft and provides for aircraft, infrastructure, inventory, certain manpower and training services. The aircraft must be able to switch between the Civil Aircraft Register (CAR) and the Military Aircraft Register Hub. Thus, each aircraft must be maintained to civilian standards by an appropriately licensed organization and using licensed staff, therefore the service s administered in the military role and controlled in the civil environment. The Voyager’s key capabilities include probe and drogue air-to-air refuelling (AAR) for all RAF receiver aircraft, plus a carrying capacity of up to 291 passengers and 8 NATO freight pallets.

Flight planning and authorization

The flight on 9 Feb was in support of an operational air-bridge, which provides the military air link between the UK and Afghanistan. The scheduled departure time was 1125 UTC on 9 Feb and the flight was expected to last approximately 8 hours.

The crew of two pilots and eight cabin crew members were scheduled to check in at 0925 UTC on 9 Feb. Accompanying the flight were two Aircraft Ground Engineers (AGE), who would be responsible for ground maintenance on arrival at QOZ.

Pre-event

Start-up and taxi. The aircraft star was normal. On taxi out, the ECAM System displayed a failure of the identification Friend or Foe1 (IFF1) transponder. The crew informed Air Traffic Control (ATC) that they would hold short of the main runway while they addressed the fault. While following the procedure for an IFF reset, the ECAM indicated that IFF2 had also failed. Several resets of both transponders did not remedy the faults and the AGEs were called upon to the flight deck to provide advice. The pIlots were informed that nothing could be done to resolve the faults without taxiing back to the stand and shutting down. While preparing to return to the stand the IFF1 fault cleared, thus satisfying the crew that they could proceed with the flight. Take-off clearance was obtained from ATC.

Take-off. The aircraft was only 0.7 Tones below its Maximum Takeoff Weight (MTOW) and thus required the full length of Runway 26 for take-off. Adopting a standard technique for improving the aircraft’s take-off performance, the crew switched off the air conditioning packs and selected the thrust levers to TOGA power. The take-off roll was normal and, as the aircraft climbed through 300 ft above ground level, the autopilot was engaged. The rest of the departure was uneventful, following the Standard Instrument Departure (SID) from RAF Brize Norton, before conducting a relatively unrestricted climb to cruising altitude Flight Level (FL) 330 with London ATC.

The cruise. Initially, the flight progressed without incident, with the exception of at least instance of turbulence, significant enough to warrant the switching on the seatbelts signs. At 1532 UTC, around 18 minutes before the incident, the Co-pilot left his seat for a break. Approximately two and a half minutes later, he returned briefly to the flight deck to deliver refreshment to the Captain before adjourning to the forward galley in the vicinity of the L1 station (forward left passenger door). He remained at this location until the incident took place, talking to the Purser and a former colleague who was on board as a passenger.

While on his own and in his seat, the Captain was taking photographs of the flight deck with his Nikon digital SLR camera. The last photograph was taken at 1546:38 UTC, three minutes and twenty seconds before the incident, and co-incident with the purser entering the flight deck. The purser and the captain had a brief conversation about the progress of the flight before the purser left the flight deck at 1548:04 UTC, one minute and 54 seconds before the incident.

The event

At 1549:58 UTC, the Captain felt a sensation of weightlessness and being restrained by his harness, accompanied by a rapid pitching down of the aircraft. He attempted to take control by pulling back on his side-stick and pressing the autopilot disconnect button, but these actions were ineffective. The captain was unaware of any alarms but reported an increase in cabin ambient noise and a sensation similar to being underwater. In less than ten seconds the aircraft had pitched to 17 degrees nose-down, was descending at 15,800 feet per minute, and was accelerating rapidly through 300 KIAS.

Immediately prior to the nose-down attitude, the co-pilot felt a sensation similar to turbulence. The purser also reported a similar sensation, describing it as a “jolt”. As the aircraft pitched down, the co-pilot was lifted to the cabin roof and, while experiencing weightlessness, re-entered the flight deck through the open door. He described a confused scene with audio alarms and flashing lights, as well as a violent shaking of the aircraft. The captain shouted repeatedly that he could not disengage the autopilot. With his feet on the flight deck roof, the co-pilot reached down and attempted to disengage the autopilot by pulling back on his side-stick; an action which appeared to have no effect. As he resumed his seat and pulled back again on his side-stick, the aircraft began to pitch up. As the aircraft pitched up, “dual input” audio warnings were heard, indicating simultaneous side-stick inputs by both-pilots. By now (around 14 seconds into the incident), excessive speed had built, leading the pilots to reduce the thrust levers to idle. The aircraft began pitching upwards, and as it did so the speed decreased. The co-pilot warned the captain of the decaying airspeed, who consequently set TOGA power as a straight and level flight was re-established at FL310. The crew then re-engaged autopilot 1.

Meanwhile, in the cabin, a large number of passengers and crew had been thrown towards the ceiling. A significant volume of loose articles, including bags, personal effects, teapots, paper cups and bins were flying around the cabin, while some passengers were shouting. As the negative “g” force from the initial pitch-down subsided, and as the aircraft accelerated in the dive, some of the unrestrained passengers and crew were able to find their way towards vacant seats and strap in. As the aircraft recovered to straight and level flight, the purser made a brief check of the flight deck, before beginning a survey of the situation throughout the cabin.

The aircraft had lost 4,400 feet in 27 seconds, registering a maximum rate-of-descent of approximately 15,800 feet per minute, before recovering to straight and level flight. The speed had reaches 358 knots IAS, and “g” forces had ranged from minus 0.58 “g” (at the onset of the dive), to plus 2.06 “g” during the recovery.

Post-event

Once in level flight, the captain decided to land the aircraft as soon as possible. An initial Mayday call, transmitted by the co-pilot during the event, was followed by another call in which he requested a diversion “to a suitable airfield of our choice”. On the advice of Turkish ATC, the aircraft was turned towards Trabzon, a civilian airfield approximately 60nm away. The captain judged that the close proximity of Trabzon would not allow enough time to descend in good order, and as unsure as to its suitability. Instead, he elected to divert to Istanbul International Airport, some 500nm away. After a few more minutes, however, ATC suggested that they should divert to Incirlik Airbase in southern Turkey, some 340nm from the aircraft’s position at the time. The captain agreed and the aircraft was turned south.

During the diversion the captain and purser addressed the passengers a number of times using the public announcement (PA) system, repeating seat belt instructions, advising on timings and informing them before large attitude or configurations changes. In the immediate aftermath of the incident, the captain used the PA system to inform passengers that the reason for the incident was unknown and that the aircraft was being diverted. He asked all passengers to remain seated with seatbelts fastened. During the purser’s assessment of the rear cabin, it became apparent that one of the passengers was suffering from an acute stress reaction and was attended by a doctor onboard.

The purser checked the cabin crew members to verify their fitness to fly and conducted a second survey of the cabin with one of the AGEs. No external damage was found, the flight crew was updated and the passengers were prepared for landing.

Both pilots remained in their seats and guarded the controls at all times. The aircraft landed at Incirlik Airbase from a straight-in approach without further incident. The aircraft was taxied to an aircraft parking bay and a normal disembarkation was conducted with the emergency services present.

Damage to aircraft

There was no severe damage to the aircraft cabin structure that compromised the function for the landing.

There was no reported damage to the flight deck. The post-occurrence review by Airbus found the side stick received forces beyond its design specification, therefore was deemed unserviceable.

There was no reported damage to the external structure of the aircraft

Post Occurrence Management

As a military aircraft incident, the station lead for post-occurrence management rested with the military chain-of-command.

Injuries

On landing in Incirlik, the following injuries were identified:

Table 1

The co-pilot and seven cabin crew received minor injuries but were able to conduct their duties; one crew member had suffered a stress reaction but recovered within a few minutes and was able to carry out their duties. 24 passengers received minor injuries and one passenger had suffered an acute stress reaction which resulted in his admission to hospital.

FINDINGS

The incident involving Voyager KC Mk 3 (ZZ333) on 9 Feb 14 occurred when the aircraft suddenly pitched down while in the cruise at FL330. The pitch-down command persisted for a total of 33 seconds, during which time the aircraft lost 4,400 ft in height. The aircraft’s self-protection measures initiated a recovery from the dive.

Evidence gathered from the aircraft’s Digital Flight Data Recorder showed that a full pitch-down command had been initiated from the captain’s side-stick, which caused the autopilot to disconnect ante the aircraft to enter a dive. The evidence also showed that the pitch-down command was not the result of a technical malfunction of the side-stick, the control surfaces, the autopilot, the flight control computers, or the aircraft weight and balance. Neither was the pitch-down command the result of turbulence. A detailed examination of the aircraft indicated that there were no pertinent technical faults throughout the flight.

The inquiry established conclusive evidence that the pitch-down command was actually the result of an inadvertent physical input to the captain’s side-stick. Specifically:

Two or three minutes before the event, a Digital Single Lens Reflex (D-SLR) camera was placed directly behind the side-stick, in the space between the side-stick and the captain’s left armrest.
At one minute and 44 seconds before the event, the captain’s seat was moved forward, creating a slight jam of the camera between the front of the armrest ant the rear base of the side-stick.
At the onset of the event, the captain’s seat was moved forward again, forcing the side-stick fully forward and initiating the pitch-down command.
With the captain’s side-stick jammed fully forward, the pitch-down command could not be counteracted initially, as the captain was the only person present on the flight deck.
The resulting forces were sufficient for a considerable number of passengers and crew to be thrown to the ceiling, resulting in a number of injuries.

The panel found that the factors which led to the pitch-down command were influenced principally by the prevailing safety culture with respect to loose articles on the flight deck of RAF air transport aircraft. The small amount of guidance regarding the treatment of loose articles on flight decks was overwhelmed by an organizational requirement to tale large amounts of equipment and documentation onto the flight deck to support missions and to stores it in ad hoc locations. As a result, the carriage, use, and ad hoc storage of a small number of personal items had become normal practice. The recovery from the pitch-down command was initiated by the aircraft’s own protection laws which prevented the incident from being worse. In the opinion of the panel, the evidence suggests strongly that the clearing of the obstruction from behind the side-stick was achieved by means of a physical manipulation of the camera itself.

The situation in the passenger cabin was managed effectively and had no adverse bearing on the injuries sustained by passengers and cabin crew.

The practical response in the immediate aftermath of the incident was fast, thorough and highly effective.

Determining the cause of the pitch-down command

Context

Comprehensive interviews with the pilots conducted in Incirlik had already established a strong theme that pointed towards a technical malfunction on the aircraft, especially associated with the side-stick and the autopilot. However, the initial analysis of the DFDR and CVR had revealed no evidence of any pertinent technical malfunctions, particularly with respect to the side-sticks and the autopilot.

A number of concurrent lines of inquiry became necessary in order to rule out a variety of possible causes, including extensive work carried out by independent parties to help isolate the cause of the pitch-down command.

Analysis

The DFDR showed no indication of indication of system failure, there were no annunciations to the crew of pertinent faults, nor were any relevant fault codes generated that could help explain the incident. The panel assessed this incident to be unique.

At 1548:13 UTC, one minute and 44 seconds prior to the event, the FDR detected a low frequency fluctuating pitch-down command of 0.5 to 0.9 degrees from the captain’s side-stick. This input endured until the onset of the full pitch-down command. This initial forward input was pure in pitch with no discernible lateral input. The force and displacement of the side stick during this command did not disengage the autopilot, because a five deca-Newton force and five-degree displacement in pitch of the side-stick is required to autopilot to disengage. Therefore, the aircraft remained initially in level flight with the autopilot engaged. At 149:57 UTC, a fully-forward input was made by the captain’s side-stick, pure in pitch and at a constant rate, with no discernible lateral input, held for approximately four seconds. This input initiated the pitch-down event.

Early analysis of the CVR identified a distinctive noise on the flight deck at one minute and 44 seconds prior to the event, and at the onset of the event itself. Spectral analysis of the noise identified it, by its frequency of 1900-2000 Hz, as the electric motor used to adjust the flight deck crew seats. In the two minutes prior to the event, the captain was the only person on the flight deck, therefore it was concluded that the motor noise came from the captain’s seat. There was no evidence that the seat had malfunctioned in flight and the functional tests carried out after the event showed that the seat was fully serviceable.

There was an obvious and strong temporal and directional correlation between the seat motor movement and the side-stick movement. The stick and the seat would have to be physically connected, either by the seat’s occupant or by an object.

The pitch input from one minute and forty-four seconds until de onset remain between 0.5 and 0.9 degrees, in a manner inconsistent with human input. The captain was certain that he was not touching the controls prior to the event, and the persistence of the subsequent pitch-down command for around 33 seconds indicated that it was not the product if an inadvertent human input. On the other hand, the lack of roll input on the DFDR trace during the initial pitch-down of the aircraft meant that a hand-flown pitch-down command was unlikely. Therefore, the panel concluded that the captain was not in physical contact with the side-stick immediately prior to or during the onset of the event.

As a result, the panel focusing on the possibility of an object connecting the seat and the side-stick collected the personal effect which had been on the flight deck during the event. It became evident that a Nikon Digital Single Lens Reflex (D-SLR) D5300 Camera belonging to the captain had been present on the flight deck in the minutes leading up to the pitch down event, had been seen on the surface area near the base of the captain’s side-stick and the captain has been seen using it during the flight. In one photograph, the GPS digital clock on the flight deck could be seen, allowing a comparison with the internal time measurement of the camera. 77 photographs were taken during the flight, the last one, taken one minute and thirty-five seconds before the initial pitch event, and three minutes and twenty seconds before the full pitch-down event.

The camera was found to have a large linear dent on its right-hand side (Figure 6). The dent extended from the softer hand grip region toward the front of the camera, across a thin part of the main body frame, and across the memory card flap.

The profile of the large dent was mapped forensically using surface profilometry and was found to be consistent with the flange of the side-stick. The chemical analysis indicated trace amounts of materials present in a swab from the camera indentation consistent with the material typo of the side-stick. Using binocular microscopy to examine the rubber gaiter at the base of the side-stick some marks were found that considered alongside other smaller witness marks on the camera, it was assessed that the damage was consistent with the side-stick being pulled back forcefully against the body of the camera.

The event was reconstructed using the Voyager simulator, placing a camera in the gap between the armrest and the side-stick and moving the seat motor forward until the camera was gently flush against the base of the side-stick. The effect was to push and hold the side-stick fully forward in a manner consistent with the pitch-down command seen on the DFDR. The motion resulted in the grip flange become aligned with a location exactly consistent with the dent in the camera.

Using the calculated movement of the seat, the position of the armrest and the location of the camera, the analysis found that it was feasible for the seat movement recorded on the CVR t have caused the movement recorded on the CVR to have caused the movement of the side-stick to the fully forward position.

In the meantime, the panel ruled out a thorough range of other causes (See the original report)

The captain agreed that a physical interference with the side-stick, in the manner suggested above, represented the most probable trigger for the pitch-down command. Therefore, the panel concluded that the cause of the pitch-down event was an inadvertent physical input to the Captain’s side-stick, by means of a physical obstruction (a camera) that jammed between the left armrest and the side –stick unit when the Captain’s seat has motored forward.

Factors leading to the pitch-down command

A series of individual acts took place at the moment before the pitch-down command which was assessed as having contributed to the incident itself. Those individual acts were influenced by the combination of error promoting conditions, organizational influences and breached defenses.

fig 10

Carriage of the camera

The carriage of the camera was considered by the panel as a contributory factor, however, was consistent with normalized behaviour regarding loose articles on flight decks on RAF air transport aircraft. This issue had been the source of considerable debate amongst junior Air Safety staff but it had not been resolved. Aircrews were required to take a large number of items of equipment on board the aircraft for operational flights, result of the nature of the tasking and the associated volume of paperwork necessary to support the mission. However, only some of these items had designated storage, with the rest usually found space around the flight deck, for example on the floor behind the pilot’s seats. It is likely that this situation promoted an attitude that it was generally acceptable to have a large number of items on the flight deck, such that the carriage of a small number of personal effects would not have seemed unreasonable. There was no evidence, however, of official guidance or training related to the carriage and use of these personal items and how they should be stored and positioned on the flight deck, increasing the likelihood that personnel would develop their own norms and practices as a result of experience and advice of others.

fig 11 y 12

Photographs taken on the flight deck of ZZ333 shortly before the incident indicated that there was a number of loss articles placed in areas around the flight deck, some not officially designed for storage. The selection of typical locations used to store items illustrates the challenge imposed by the imbalance between the available storage, the required volume of official equipment and documentation and the carriage of personal items, resulting in items being stored on the floor and in ad hoc areas, including the area around the side-stick.

fig 13

The carriage of personal items may also have been perceived as advantageous as it would provide access to items in flight which could be used to help maintain mental alertness and prevent boredom during times of low work.

The panel assessed that normalized behaviour regarding the carriage and treatment of loose articles was a contributory factor to the incident. Furthermore an incomplete RAF Brize Norton Occurrence Investigation (OSI) opened on April 2013, executed to examine an Air Safety Occurrence Report (ASOR) about a concern of the number of loose articles being found on board one of the fleets and to determine whether the issue was limited to that fleet, and what measures should be taken to address it and which report has not been issued by the time of the incident, was assessed as a contributory factor.

The carriage of the camera on the flight deck was not prohibited by any rules or regulations. Restrictions on the use of such items were only in regard to their transmitting properties during different phases of flight.

Use of the camera in flight

The use of the camera on the flight deck during the flight was considered a contributory factor. However, this was influenced by a number of associated factors.

The use of the camera was not explicitly prohibited by any rules and the restrictions on the use of personal electronic devices were associated with their transmitting properties. However, the Voyager Operations Manual stated that: “Flight crew must refrain from non-relevant duties (e.g. paperwork, casual conversation), in circumstances such as (but not limited to): while the other pilot is away from the active Air Traffic Control (ATC) frequency.”

While on his own, the captain took 28 photographs, approximately eight minutes and three minutes prior to the incident, which were not related to the duties he was carrying out at the time. The panel considered this was not a deliberate and conscious contravention of the rules. However, the use of the camera represented a lack of compliance with the policy regarding non-relevant duties, thus rendering the policy a breached defense.

This lack of compliance with policies was assessed by the panel as highly probably a consequence of boredom and low work load. During a phase of flight when the workload on pilots is low, as in cruise, a high level of automation, as the Voyager’s, can make it even lower, resulting in boredom and complacency. Some individual factors can make an individual more susceptible to boredom. A high level of knowledge, education and ability, be keen for a demanding job, be fatigue or the lack of adaptation to night work make boredom easier to appear. Given the operation conditions, it was highly likely that the crew would take actions to raise their level of alertness and alleviate boredom. Having regular visitors to the flight deck, taking comfort breaks, reviewing in-flight paperwork and using personal items are actions considered as typical to maintain alertness during flight.

Based on all the above the panel assessed that low workload and boredom were contributory factors.

On the other hand, the presence on ZZ333 of only a single person in the flight deck for an extended period of time increased the risk of boredom and under-arousal, thus increasing the likelihood that the Captain would take actions to maintain his general alertness. The panel assessed that the presence of only a single person on the flight deck for an extended period of time was a contributory factor. Moreover, this represented a potential lack of compliance with the policy regarding crew members at their station, although it was possible to apply a wide interpretation to the rule. Nevertheless, as it did not prevent the extended absence of a pilot from the flight deck, the policy regarding crew members at their station was assessed by the panel to be a failed defense.

Placing the camera

The placing of the camera between the armrest and the side-stick created a hazard. This went unrecognized initially, leading directly to the interference with the side-stick and the subsequent pitch-down. As such the panel assessed that the placing of the camera was a contributory factor.

Immediately after the camera was last used, the CVR indicated that the purser entered the flight deck and began a conversation with the captain. This conversation could have drawn the captain’s attention and so reduced his focus on the task of stowing the camera. It cannot be positively determined that the camera was put down at this time, but if it was the case, the panel assessed that distraction of the captain while using the camera was a possible contributory factor.

Likewise, the design of the side-stick area was considered a contributory factor. Interviews with the ZZ333 crew indicated that there was a known issue that inadvertent contact with the side-stick (most commonly by a knee) could result in the autopilot disconnected. Such incidents have been resolved immediately by re-engaging the autopilot. Data from Air Tanker Services indicated that there have been up to 26 incidents since the start of Voyager flying when the autopilot disconnected in the cruise by moving the side stick against the increased force.

Additionally, although when the seat moves the armrest is never less than 50mm from the side-stick, therefore it is no possible for the armrest itself to interfere directly with the side-stick, the operation of the seat when an item of appropriate size is located between the armrest and the side-stick could create a situation in which movement of the seat causes the side-stick to be moved out of the central position while the autopilot is engaged.

The armrest setting was also considered a contributory factor. As both captain and co-pilot had tall upper bodies, their required seat setting for operating the flying controls was lower than that of majority of pilots, that configuration would cause the armrest to have no vertical separation from the side-stick which increased the risk of an item becoming jammed. Moving the seat forward against a camera similar in size to the captain’s with the armrest at different settings din NOT result in the side-stick being held forward.

Other factors

A widespread lack of awareness regarding the risk of the side-stick interference was considered as contributory factor. The clean cockpit concept and the rendered regulatory article regarding the carriage of loose articles were the breached defenses that influenced this factor.
The lack of reporting regarding inadvertent operations of the side-stick and the lack of a register regarding flight deck control interference as an identified risk were assessed as a contributory factor
The movement of the captain’s seat without the interference with the side-stick being noticed, influenced by captain’s low arousal, distraction and cognitive lack of expectation was considered as a contributory factor

Summary of factors

The key factors which made the pitch-down command more likely were summarized as follows:

Individual acts

The carriage of the camera on the flight deck
The use of the camera in flight
The armrest setting
The placing of the camera behind the side-stick
The movement of the captain seat

Error promoting conditions

Low workload
Boredom and low arousal
The presence of only a single person on the flight deck for an extended period of time
Distraction
Cognitive lack of expectation

Organizational Influences

Normalized behavior regarding the carriage and treatment of loose articles
The RAF Brize Norton OSI into loose articles
The design of the side-stick area
A widespread lack of awareness regarding the risk of side-stick interference
The lack of reporting regarding inadvertent operations of the side-stick
The lack of an identified Duty Holder risk regarding flight deck control interference

Breached or failed defenses

The Voyager policy regarding non-relevant duties
The Voyager Operations Manual policy regarding crew members at their station
The Airbus FCTM advice on the “clean cockpit” concept
MAA Regulatory Article 2309 (carriage of loose articles)

Recommendations

The panel made several recommendations to the Royal Air Force, to the Brize Norton Air Base, to AirTanker Services Ltd, to AIRBUS

EXCERPTED FROM

Service Inquiry: incident involving Voyager ZZ333 on 9 February 2014 Final report. Published 19 March 2014. Last updated 23 March 2015 From UK Ministry of Defense and Military Aviation Authority.

Risk Assesment: TAP Runway excursion at Aeroporto Internacional de Belém (SBBE), Brasil

Final report published on May, 30th, 2016. TAP Runway excursion during 180º turn on runway without turn pad, Aeroporto Internacional de Belém (sbbe), Belém – Brasil, 08th June 2014 at 23:17 UTC. TAP PORTUGAL / AIRBUS A330-200 CS-TOJ.

The A330 was instructed by ATC to taxi for line up on runway 06, using a taxi route via the runway (backtrack) compelling necessarily to perform an 180° turning maneuver, even though it is recognized that, because the airport did not integrate a turning area (turn pad) in the designated runway, the aircraft did not meet the recommended ICAO safety settings. It is considered that the contamination of the runway was also a factor in that the maneuver was compounded by the nose gear skidding, making it impossible to the crew to control the aircraft. The risk was high with the conditions on the day of operation. It would not be at all possible to prevent the event, for the presented conditions since crew flight preparation, instructions from the controller and crew decision making when confronted with the inability to control the maneuver.

a) Why the risk assessment carried out by the operation’s direct parties did not include the operating difficulties encountered in the day of the event?

b) Why were these variables not identified earlier?

Photo (C) Rui Miguel https://img.planespotters.net/media/photos/original/067000/PlanespottersNet_067155.jpg

Runway excursion during 180º turn, on runway without turn pad. Final report approved by the Director of GPIAA (Álvaro Neves), on the 30th May 2016.

The Gabinete de Prevenção e Investigação de Acidentes com Aeronaves- GPIAA, Portugal Civil Aviation Safety Investigation Authority became aware, through the notification held by TAP PORTUGAL, in the period established of 72 hours, of an incident occurred at the international airport of Belem (SBBE) on 8th June 2014, involving the runway excursion of the CS-TOJ aircraft during the taxi to later take-off at the threshold of the runway 06.

Having begun talks with the counterpart at the State of occurrence, the Centro de Investigação e Prevenção de Acidentes Aeronáuticos- CENIPA, the Brazilian Aeronautical Accidents Investigation and Prevention Center, was subsequently informed that the initial classification of occurrence had been simple incident, not being provided for the opening of an investigation by the CENIPA counterpart.

After an evaluation carried out on the basis of potential damage identified at an early analysis via photographic information as a result of the maneuver performed on the runway from Belem airport, GPIAA took the responsibility to take the opening of an investigation, classifying the event as an incident in accordance with the recommendations of ICAO Annex 13.

CENIPA was informed of this decision and in accordance with international agreements, representing the State of occurrence appointed an accredited representative to mediate the necessary actions with the airport operator responsible for the infrastructure under the technical research process established by GPIAA. The aircraft operator actively cooperated in technical research and provided expert support in the survey of the evidence throughout the process.

History of the Flight

Initial preparation of flight

The rotation for this flight began with the presentation of the crew in LIS at 06:20 UTC, two days before the incident, to the LIS-MAO flight, taking MAO-BEL flight was performed with the presentation at 17:45 UTC, and BEL-LIS flight departure time scheduled at 22:15 UTC.

On June 08th 2014, the Airbus A-330-200 of TAP, registration CS-TOJ, was preparing to take off from the airport of Belem – Brazil (SBBE) for a scheduled air transport having as a destination Lisbon Airport with 116 passengers and 11 crew members on board. On site the weather was not favorable, the night presented with the sky overcast with very strong showers, visibility for taxing was not the best and the wind was blowing from 060° with about 6 knots of intensity.

Being the first time that the crew was operating in this airport, and due to the specificity of the maneuver of the 180° turn on a runway with 45 m wide, without turning pad, the Commander (CM1) of the flight was contacted by phone by a representative of the operator TAP that provided some information regarding the maneuver. It was also suggested to re-read all the information contained in FCOM and FCTM about the procedure.

The whole flight process documentation was analyzed by both pilots during the flight briefing preparation.

During the flight preparation, the Official Pilot (First Officer – CM2) was assigned to Pilot Flying.

The taxi out maneuver was performed by CM1.

The 180° turn on the runway was studied and analyzed before the flight by the crew having become referred to during Take-off briefing, cockpit preparation and taxi-out.

During the transit time of the aircraft in BEL were checked some periods of rain, having this situation and the impact in the area of maneuver, been approached by pilots during the preparation phase of the flight in the cockpit.

The aircraft started to taxi out maneuver at 23:02 UTC in the wet runway conditions, having been instructed to proceed from the stand 06, to line up on the runway 06 via taxiway B, runway 02 and perform taxing on the runway to align runway 06.

While they made the taxing to the runway 02 was given instruction by the ATC to hold the position about 100 m before the runway 06/24 an aircraft was on approach to runway 06.

During taxi “backtrack” on the runway 24 was reviewed once more the procedure of “180° turn on runway”.

Taxi phase on the runway and 180° turn

The CM1 lift the seat before starting the taxi and asks to the CM2 to switch on the landing lights.

During the taxi the pilots remained always in communication, verbalizing actions and coordinating/confirming the values of the parameters recommended in the technical manuals.

When starting the 180° turn to the right, there was a strong noise in the cockpit.

The aircraft runway excursion occurs between the taxiway E and the runway 06.

It was confirmed that the aircraft was out of the runway, having made about 2/3 of the turn, immobilizing on the side of the runway. While turning around to line up for take-off the aircraft went off the paved surface of the runway and came to a stop with all gear on the soft ground.

TAP 1

Immobilization and evacuation

With aircraft grounded, the CM1 informed the ATC of the runway excursion and to close the airport, and also assistance from the ground services and maintenance.

After stopping the aircraft, the CM1 called the Cabin Supervisor (SCC) to the cockpit and informed of what happened.

The CM2 started the APU, after the request of the CM1 and performed the engines shut down, while the CM1 spoke to the passengers.

The SCC informed passengers would disembark with all hand luggage.

The passengers and crew disembarked in an unconventional manner in groups of 4 elements, assisted by the airport authorities of Belem Airport, there has been no injury to any passenger resulting from the event.

Operational documentation

The A330 Flight Crew Operating Manual and Flight Crew Training Manual includes the following procedures for the 180° turn on the runway:

TAP 2

TAP 3

TAP 4

FCOM (PRO-NOR-SOP-10) recommends the following: “Asymmetric thrust should be used during the turn, to maintain a continuous speed (between 5 to 10 kt). Some anticipation is required to ensure that asymmetric thrust is available at the beginning of the turn”.

FCTM (NO-040) recommends similarly: “Asymmetric thrust will be used during the turn. Anticipation is required to ensure that asymmetric thrust is established before the turn is commenced [50% N1 or 1.05 EPR] to maintain a continuous speed of approximately 8 knots throughout the maneuver”.

FCTM (NO-040) recommends the following: “Differential braking is not recommended, to prevent stress on the landing gear assembly. In addition, a braked pivot turn in NOT permitted”.

Airport specific information

The published and in force NOTAM for crews consulting, with information regarding aerodrome conditions, namely, prompted the prohibition of an 180° turn outside the turning pads. It should be mentioned that this information does not provide a correct wording to airport users, given the physical characteristics of the airport presenting only 2 turning pads, one on runway 24 and one on runway 20 it is concluded that the turn on runway 06 is inaccessible to crews.

The information regarding the runway 06/24 closure in case of water accumulation due to the occurrence of moderate to strong rain should be taken into account by crews assessment before start taxiing, where confirmation by the airport operator is clearly required that the runway meets the required safety conditions for authorization of turning maneuver and take-off on the referenced runway.

TAP 5

NOTAM 10475/14: According to information obtained by the internal investigation conducted by Belém ATC it was confirmed that the purpose of published NOTAM was only meant to meet the need to impose on the air traffic obligation to turn in the turning pads to avoid runway asphalt breakdown and not for operational reasons, but its wording was imperfect and incomplete, which raised a number of questions to stakeholders.

The Crew and Company Information (CCI) published in the route manual had no information about the backtrack maneuver.

The CCI published in self-briefing at the date of occurrence and available in NOTAM contained the following additional information:

TAP 6

A330 manufacturer specific information

The minimum effective runway width required for a U-turn assumes that the procedure provided in the FCOM is applied:

Amongst others that no differential braking is used, and that asymmetrical thrust is set at the entry of the 180° turn so as to easily ensure a GS between 5 to 10 kt.
The minimum effective width required is 42/46 m with 72° steering angle with asymmetrical thrust and proper FCOM procedure applied.

In the case of an 180° turn on the runway, a specific procedure is provided in SOP. Keep in mind that:

You should not let the G/S drop below 8kt during the maneuver in order to avoid stopping.
Use differential thrust setting, by adding thrust on outer engines (≅ 50 % N1 or 1.05 EPR).
The use of differential braking is not recommended due to gear stress.
It is essential to keep minimum GS during the turn in order not to need to increase the thrust too significantly so as not to get stuck. Thus, it is recommended to set the differential thrust before starting the turn.

Finally on wet or contaminated surfaces, more specifically when turning on the runway white or yellow painted markings, tight turns lead to jerky rides of the nose wheel which are noisy and uncomfortable.

Visibility from cockpit from static position

TAP 8 y 9

180˚ Turn on Runway Width

This section gives the minimum line-up distance correction for an 180˚ turn on the runway width.

TAP 10

For this maneuver, the pavement width is considered to be the runway width, which is a frozen

As per the standard operating procedures for the ”180˚ turn on runway” (described in the Flight Crew Operating Manual), the aircraft is initially angled with respect to the runway centerline when starting the 180˚ turn.

The value of this angle depends on the aircraft type and is mentioned in the FCOM.

During the turn, all the clearances must meet the minimum value of 4.5 m (15 ft) for this category of aircraft as recommended in ICAO Annex 14. Where severe weather conditions and resultant lowering of surface friction characteristics prevail, a larger wheel-to-edge clearance of 6 m should be provided where the code letter is E or F.

ANALYSIS

This occurrence involved an Airbus A330 aircraft on June 8th, 2014 at the International Airport of Belém in Pará, Brazil meets the ICAO definition of an incident.

The A330 was instructed by ATC to taxi for line up on runway 06, using a taxi route via the runway (backtrack) compelling necessarily to perform an 180° turning maneuver, even though it is recognized that, because the airport did not integrate a turning area (turn pad) in the designated runway, the aircraft did not meet the recommended ICAO security settings. It is considered that the contamination of the runway was also a factor in that the maneuver was compounded by the nose gear skidding, making it impossible to the crew to control the aircraft. The risk was high with the conditions on the day of operation. It would not be at all possible to prevent the event, for the presented conditions since crew flight preparation, instructions from the controller and crew decision making when confronted with the inability to control the maneuver.

This incident investigation determined to have been no evidence of any technical defects on board the aircraft, airport or air traffic service provider that may be the cause or influence in the incident.

The key areas, during this occurrence, were the following questions:

a) Why the risk assessment carried out by the operation’s direct parties did not include the operating difficulties encountered in the day of the event?

b) Why were these variables not identified earlier?

The possibility of having guaranteed the extraction of voice data from the CVR equipment installed on board it was performed an analysis of human performance where it was found that the crew coordination before, during and after the event complied with the indicated in CRM parameters allowing the effective use of all human resources in the cockpit, hardware and information available to pilots to ensure the safety and efficiency of flight operations.

However, given the encountered conditions, it is considered that the reduction of human error in this assessment might be defined as an act or omission that led to the deviation of the intentions of the crew or situational requirements, such as organizational policies, regulations and standard operating procedures (SOP) in place for the operation under analysis.

Operational analysis

Flight preparation phase

Because of the risk inherent to the taxi on the runway for line up maneuver and the fact of being at an early stage of the operation, it was given by the operator a few days before the flight a briefing to CM1 about the 180° turn on the runway with the suggestion to re-read all the FCOM and FCTM information about the procedure. The 180° turn on the runway and their specific feature, were analyzed before the flight by the crew and was again raised during the take-off briefing, cockpit preparation and taxi-out.

All flight process documentation was analyzed by both pilots during the flight preparation phase, having the NOTAM 10475/14, which refers to the prohibition of executing an 180° turn outside from turning pads on runway 06/24, being interpreted as referring to the landing phase instead of take-off.

Within 4 hours prior to the incident, according to METAR’s analysis, there was a period of heavy rain and three periods of light rain as described in this report, a fact that was repeatedly mentioned by the crew in rotation BEL and moments before the start taxi-out phase.

Taxi phase

It is noticeable in the recorded communications the CM1’s concern to perform the 180° turn on the runway due to weather conditions and the runway grip conditions, which would have made it difficult to taxi when arriving at BEL.

The taxi-out maneuver was performed by the CM1 according to the operator’s FCAP (Flight Crew Airline Policy).

After the pushback maneuver, from stand 06, the taxi clearance was obtained to leave Apron 4 via taxiway B, enter runway 02 and perform backtrack on runway 06, despite the information shown in the NOTAM 10475/14 as indicated in point 1.18 of this report.

In order to improve cockpit visibility to the outside, the CM1 raises his seat height before starting the maneuver and asks the CM2 to turn on the landing light. (The pilots eyes are 5,8 m above the ground, which causes a front view dead angle of 16 m).

180 degree turn maneuver phase

The 180° turn on the runway maneuver was started at 23:26:46, being the aircraft on the right of the runway centerline on heading 250°, following a left turn to heading 221° (approximate angle of divergence of 024° to runway QFU of 245°). The maximum registered taxi speed during this phase of maneuvering was 5 Kt. The brakes were symmetrically applied, 10° on the left, 10° on the right. During the maneuver there was effective and assertive communication among pilots with verbalization of actions and coordination/confirmation of values (heading, thrust, ground speed) recommended in the technical manuals.

TAP 11

23:17:03 – Starting right turn (heading 221°; 31,5% N1; 25,9% N2; 4 kt GS).

23:17:04 With the aircraft approaching the right edge of runway 06, it was initiated the 180° turn with 4 knots of ground speed. The N1 power in engines ENG1/ENG2 was 31.5%/25.9%, beginning to be increased at that moment. Asymmetric brakes application, 18° left side and 7° right side.

23:17:08 The turning angle of 75.0°was achieved. During all the turn, the nose wheel maximum angle in relation to the neutral position was 73.1°. Asymmetric brakes application, 21° left side and 4° right side.

23:17:10 Maximum Engine Pressure Ratio during the turn of 1,06 on the left engine. The N1 power on both engines was 49.5/37.0%. Asymmetric brakes application, 21° left side and 4° right side.

23:17:16 Indicated ground speed of 6 kt and N1 power on both engines of 55.0% and 36.9%, having not been a direct correlation between the power increase and the speed variation compared to the ground speed of point 1, which indicates the start of the skidding. Asymmetric brakes application, 10° left side and 2° right side.

When the nose landing gear wheels reached the threshold marks of runway 06, the noise created by the skidding difficult the communication between both pilots.

23:17:24 It was reached the maximum N1 engine power on both engines, with a value of 59.0%/39.8%. Asymmetric brakes application, 10° left side and 3° right side.

With a high level of noise in the cockpit, the CM1 questions the CM2, which was in a better position to make an assessment of the aircraft position, if in his opinion there would still be further space for the maneuver.

23:17:25 The maximum registered rolling speed during the turn was 13 kt, being reached 1 second before the runway excursion and setting engines power to IDLE (no trust). Asymmetric brakes application, 0° left side and 23° right side.

The CM2 has the perception that it will not be possible to maneuver and warns the CM1, which due to the high noise level will not have heard the warning.

23:17:26 The nose landing gear wheels overrun the runway and engine thrust levers are set to IDLE. Asymmetric brakes application, 0° left side and 43° right side.

Due to the high level of noise in the cockpit, the CM1 realizes, through non-verbal communication used by the CM2, that there would be no space to perform the maneuver.

23:17:29 The rolling speed of 13 kt started to reduce, with brakes application. Asymmetric brakes application, 1° left side and 41° right side.

23:17:32 The aircraft came to a full stop, with the nose wheel at 67.7° from its neutral position.

Then the crew instructed the ATC to close the airport since it would not be possible to remove the aircraft from the position it was in.

Evaluation of airport characteristics

Runway 06 characteristics

Runway 06 of Belém airport is an asphalt runway with an area of 400 m of grooves before crossing runway 02/20.

It’s a runway that is easily contaminated with water accumulated in the event of heavy or continuous rain.

The aircraft needs at least 42 m radius, without safety margins, to make an 180° turn on the runway.

The runway has a width of 45 m and has no turning pad, which according to Annex 14 of ICAO and the manufacturer’s operating manual (Airbus), does not comply with the safety margin of 4,5 or 6 m, distance in relation between the outside of the tires and the runway edge, as the runway is dry or wet, so it is possible to perform a safe 180° turn, for this type of aircraft (Airbus 330-200).

The aircraft was parked on apron 4 which is served by taxiways C and D for accessing runway 06.

The taxiway C has 18 m width. According to a recommendation of Annex 14 of ICAO, for this aircraft type, the minimum taxiway width should be 23 meters.

TAP 13 FIG

Comments to aircraft operator

180° turn on runway without turning pad simulator training

It was found during the investigation that the practice of 180° turn on runways without turning pad is not part of the simulator sessions as well as training actions covering tight turning with the need to adapt the techniques recommended by the manufacturer in these situations.

According to the Flight Crew Airline Policy (FCAP) this maneuver is only executed under the Chief Fleet or Chief Pilot authorization.

As a not regularly performed maneuver, the GPIAA recommends to TAP operator (RS Nº 16/2015) to include on the simulator programs (Recurrent training and checking) the training of the 180° turn on runways without turning pad.

Human factors

Usually, these kinds of incidents, runway excursions, are the result of a chain of events supported by certain conditions and basic causes. The interaction of the people involved plays a special role. During the analysis of this runway excursion during the 180°, one of the key aspects was the interaction between the Air Traffic Controller in the tower position (ground) and the crew members. The other aircraft in the circuit to approach or rolling on the ground are not to have any direct or indirect influence on the occurrence.

An error analysis of the actions of all those involved showed that the crew of the A330 has accepted the instructions of the controller for taxi route to runway 06, not taken into account the NOTAM 10475/14, in which it stated, the prohibition to execute 180 degrees turn on runway 06/24 outside of turning pads. This might be considered a pilot deviation, ie a crew did not adhere to an instruction or have deviated from the prescribed procedure, given the flight commander is sovereign in the actions it takes, may decline and/or change the instructions in accordance with its risk assessment. In addition, the deviation may also be attributed to the controller on duty for the instructions do not take into account the accumulation of water by the occurrence of moderate rain strong on the track 06, despite the information shown in the NOTAM 10475/14.

In order to deduce the appropriate actions to prevent similar future occurrences, the question has to be answered why this error occurred and why was not recognized and/or foreseen by those involved during the time of preparation of this operation.

The GPIAA opinion is that the following aspects of this question arose:

The A330 crew had never experienced an 180° on that runway, under those atmospheric conditions found on the day of the incident. For the crew, the deviation of the compliance mentioned in the NOTAM, may have been induced by the lack of understanding of that the text also applied to the take-off operation, whereas it would be routine in some way this operation to be confronted with this type of instruction, therefore, recognize that there would be a deviation from the standard procedure established. During the pre-flight preparation, this takeoff procedure had been discussed by the crew.
The tower controller formally gave the correct instructions, but should have corrected himself, warning the crew that this maneuver contravened the published in NOTAM, while recognizing that it would be the only one for which the aircraft could take off the runway in use. Even if the taxi route path has been agreed upon beforehand, still in the flight pre-preparation phase.

However, the GPIAA is of the opinion that the inaccuracies in communication have not contributed to the parties involved to understand according to the ICAO recommendations. It was not a single mistake, just minor inaccuracies which added the role of contributing factors. The GPIAA is of the opinion that the confidence with which the crew took over the maneuver, as well as the care accounted for it to be successful, not due to negligence and/or lack of proficiency , but rather the risk assessment performed before the start of operation that does not cautioned the difficulties presented at the aerodrome for the operation with this type of aircraft were developed, with an acceptable calculated risk, enhancing the crews diversion when called upon to take decision to operate under these conditions.

Considering all the established facts during the material collection for the technical investigation process, the GPIAA assumes that the instructions given by the ATC and accepted by the crew as well as the previously outlined plan for the taxiing of this type of aircraft at the Belém airport, have failed to comply with the operating rules approved by the actors involved in this event by the country of occurrence authorities and in strict compliance with the technical assessments made for the implementation of the operation.

The GPIAA is of the opinion that both the crew and the duty controller, the imputed workload was not unusual, and generally unsafe.

But, the analysis clearly showed that in this situation a deviation or an exception to the standard operating situation and/or stipulated is not appropriate and may cause unsafe events. Thus, the GPIAA is of the opinion that the conscious deviation from the sense of procedures for taxi route for the A330 aircraft at the Belém airport, causing exceedances of standards and best operating practices can result in a hazardous situation.

The GPIAA assumes that, the A330 crew has not mentally registered after receiving the clearance instructions, that the tight 180° turn maneuver in a 45 meter contaminated runway was not possible, planning the maneuver according to the data inserted in FCOM, in strict compliance with the aircraft performance.

Superficial human factors analysis of the sequence of events on board the A330, revealed that the crew would have expressed discomfort for executing the maneuver even in the preparation flight phase, where after receiving the taxi instructions (clearance) from the controller is noticeable that the workload in the cockpit intensified, to the detailed preparation of the turning operation which kept the crew in a state of high “stress” due to the current conditions. Presumably, no member of the A330 crew did acknowledge their discomfort to the duty controller, because of a feeling that would be the only ones to taxi on the runway, not having any pressure to expedite, thinking so, they would have more than time so that it would unveil safe according to the prior planning.

Defenses

Defenses are measures to protect a system against the consequences of technical or human failure. The GPIAA is of the opinion that a mechanism that would have prevented this runway excursion by the A330, is the adherence is the adherence of interveners from Belém airport and the operator to Standard Operating Procedures for an operation with this nature (SOP).

The following SOP’s would have been of importance:

1. Adherence to taxi procedures for the runway according to layout

The airport operator and the air traffic service provider should have agreed on an operating protocol for taxi maneuver to the runway in use in accordance with the rules and the available layout – So should have been constituted an SOP. The instruction to the A330 to enter the runway and perform a “backtrack” was a conscious deviation from the procedures of an SOP.

This instruction was given by the fact that the taxiway C did not have the width in accordance with the category of the aircraft, which allow access to the threshold of runway 06, preventing a tight 180° turn. In terms of guidance for the duty controller and the own flight crew, it was accepted that the deviation was validated for the sake of facilitating the operation. The deviation of the good practices of an existing SOP did not occur as an ad hoc situation, but a pre-agreed situation.

2. Signal, marks and technical equipment

At the time, the Belém airport was not equipped with centerline lights or aiding marks to turn at the threshold by the lack of a turning pad on runway 06, or other markings or signs to help prevent runway excursions in 180° turns. The GPIAA is however of the opinion that in this case this marks or signs would have prevented the failure of the maneuver, allowing the crew to better manage the little available slack they had in turning radius, the conditions to which they were subjected on the day of the event.

Monitoring the runway pavement for the accumulation of water and rubber in the threshold area would have allowed a greater tire grip, preventing slippage and consequent excursion.

CONCLUSIONS

From the available evidence, the following findings are made in relation to the runway excursion at Belém Airport, Brazil (SBBE), on June 8th, 2014; and should not be read as apportioning blame or liability of any organization or private individual

Findings

The aircraft was involved in a passenger transport flight;
The aircraft’s Airworthiness Review Certificate of aircraft was valid and all scheduled maintenance actions were performed in accordance with the maintenance program and Aircraft Maintenance Manual;
The Aircraft Technical Log Book had no record of limitation or restriction for a normal operation of the aircraft;
The aircraft was loaded within the limits;
The crew was duly certified, trained and qualified for the flight in accordance with current regulations. Both crew members had no restrictions or limitations on the operation;
There was no evidence of physiological factors affecting the performance of the flight crew;
The runway 06/24 has a width of 45 meters;
The A330-200 airplane requires a minimum of 42 meters, without safety margin, to perform an 180° on the runway in accordance with the FCOM operating manual of TAP operator;
According to the recommendation of Annex 14 of ICAO and the Aircraft Characteristics – Airport and Maintenance Planning of AIRBUS manufacturer, 180° turns in a given runway must maintain a safety margin of 4,5 m between the wheels and the runway edges;
Runway 06 has no turning pad;
Runway 06/24 has no centreline lights;
The runway was wet according to the investigation via CVR;
NOTAM 10475/14 refers to the prohibition of carrying out the 180° turn on runway maneuver out of turning pads on runway 06/24.
ATC taxi instructions did not take into account the water accumulation by the occurrence of moderate to strong rain on the runway 06, despite the information shown in the NOTAM 10475/14 as indicated in paragraph 1.18.2 of this report.
The prohibition of 180° turn outside from turning pads maneuver was established in NOTAM and CCI published in self-briefing, at the date of occurrence.
The Commander has a long experience in the operation of flights to Brazil, this was his first flight to the Belém airport.
The Commander said that he interpreted the NOTAM (DO NOT PERFORM THE RETURN OUTSIDE TURN-AROUND AREA) as referring to the landing phase and not take-off.
The 180° turn maneuver was executed on the threshold of runway 06, in the area of lower grip, on top of threshold markings and at night.

Causes

Based on DFDR analysis, the runway excursion that occurred during the 180° turn was the result of two main factors combination:

Mismanagement of maneuvering speed during the turn.

The 180° turn began without established asymmetrical power and at a low speed (4 kt).

During the turn, there was an excessive increase in the power of both engines, with left engine reaching 59% N1 and the right engine 39.8% N1, with a consequent increase in aircraft speed up to 13 kt.

Inappropriate brakes application during the turn.

Contributing factors

Being the NOTAM 10475/14 published to the Belém airport, which prohibits 180° turns out of turning pads maneuvers, despite the constraint is not operational, the ATC should not have instructed the flight commander to backtrack via runway 06.
The commander knowing the existence of this NOTAM and the company’s CCS, should not have complied with the instructions given by the ATC. Being the first time that he was operating at this airport, with contaminated runway (wet), at night, in a runway without centerline lights, without external references, being the maximum margin of error within about 3 meters.
In the TAP Operator Flight Crew Operation Manual (FCOM) was published 42 meters turning radius without safety margin to make an 180° turn on the runway, but according to the recommendations of Annex 14 of ICAO and the AIRBUS manufacturer there must be a safety distance of 4.5 meters to each side between the outer main gear wheel and the edge of the pavement.
The maneuver was performed at night and the runway has no centerline lights and, being the pilots eyes 5.8 m above the ground, causes a front dead angle of about 16 m.

SAFETY RECOMMENDATIONS

Implemented measures after the accident

1. TAP

After the incident the TAP operator made a new Operational Risk Assessment, now with 23 mitigation measures (the first ORA had 10 mitigation measures) where it implements the following measures to increase safety in Belém airport:

Define a minimum experience/criteria for the assignment of Commanders;
The operating area defined a maximum taxi speed of 5 kt to reduce the potential for skidding to be used as reference in ground operations;
Consider Airport Cat B for “unusual characteristics or performance limitations”;
Do not consider take-off/landing with items that reduce the aircraft’s directional control or braking capacity;
Reinforcement of the 180° turn outside from turning pads prohibition faced the hypothesis to date, of dubious interpretation observed the occurrence in question;
Taxi in APRON 3, TWY C and D should be assisted by Follow Me;
Do not use reduced engine taxi.

2.INFRAERO/Belém

The airport operator INFRAERO/Belém has implemented the following measures after the incident:

The Emergency Response Plan and the Disabled Aircraft Removal Plan were properly reviewed and forwarded to the Brazilian Civil Aviation Authority (ANAC);
A follow me procedure for TAP air operator departure operations has been established as well as an operating agreement has been signed between the INFRAERO/Belém and TAP;
Revitalization of the markings of the runway 06/24 was performed;
Grooving3 of the runway 06/24 was implemented;
The vertical signaling services were maintained in the movement area of the SBBE airport;
The construction project in runway 06/24 and taxiways was amplified, including the construction of a turning pad on threshold 06, with the implementation of the planned work for 2017.

Safety recommendations

In the context of the investigation, seven safety recommendations were issued.

According to the provisions of Annex 13 of the ICAO, all safety recommendations listed in this report are intended for the supervisory authority of the competent state, which has to decide on the extent to which these recommendations are to be implemented. Nonetheless, any agency, establishment or individual is invited to strive to improve aviation safety in the spirit of the safety recommendations pronounced.

In the Decree on the Investigation of Aircraft Accidents and Serious Incidents (GPIAA), the Portuguese legislation D.L. 318/99 provides for the following regulation regarding implementation: Article 27º Safety recommendations.

SR Nº 06/2016 To TAP

Include in the simulator programs (recurrent training and checking) training in 180° turns without turning pads.

SR Nº 07/2016 To TAP

Include in the FCOM the turning radius distances with the safety levels recommended by Annex 14 of ICAO and the AIRBUS manufacturer.

SR Nº 08/2016 To INFRAERO

Integrate on its expansion plan as soon as possible the construction of a turning pad, in runway 06’s threshold at Belém International Airport, according to the recommendations of Annex 14 of ICAO, to increase the operation safety levels with Airbus A330-200 aircraft.

SR Nº 09/2016 To INFRAERO

Integrate on its SMS program a verification plan for friction macro texture measurements and as well as rubber removal of runways 06/24 and 20/02 from Belém International Airport (SBBE) and to publish the measurement reports as required by resolution Nº 236, of 5th June 2012, issued by ANAC Brazil.

SR Nº 10/2016 To Departamento do Controle do Espaço Aéreo-DECEA

Update, including more information on AIP Brazil, on the physical characteristics of the aerodrome, namely, width, type and pavement strength of taxiways B/C/D/E/G/H/J/K, of the Belém International Airport (SBBE).

SR Nº 11/2016 To ANAC Portugal and ANAC Brasil

The supervision of the correct interpretation and implementation of the recommendations contained in this report to ensure the effectiveness and improving the operator’s safety should be activated by ANAC Portugal and Brazil under an agreement.

SR Nº 12/2016 To ANAC Brazil

In cooperation with DECEA, responsible for air navigation and air traffic control service providers, the airport operator INFRAERO/Brazil, and users of Belém International Airport, should conduct a comprehensive analysis of operating procedures and take all necessary steps to find appropriate measures to reduce complexity and systemic risks.

Excerpted from Final Report of Incident with Airbus A330, registration CS-TOJ, 08th jun 2014, at International Belem Airport – Brazil published 2016-06-08. http://www.gpiaa.gov.pt/ Final Report of Incident with Airbus A330, registration CS-TOJ, 08th jun 2014, at International Belem Airport – Brazil

**********************

_______________________

The Organizational Influences behind the aviation accidents & incidents

On February 12, 2009, about 2217 eastern standard time, a Colgan Air, Inc., Bombardier DHC-8-400, N200WQ, operating as Continental Connection flight 3407, was on an instrument approach to Buffalo-Niagara International Airport, Buffalo, New York, when it crashed into a residence in Clarence Center, New York, about 5 nautical miles northeast of the airport. The 2 pilots, 2 flight attendants, and 45 passengers aboard the airplane were killed, one person on the ground was killed, and the airplane was destroyed by impact forces and a postcrash fire. The flight was operating under the provisions of 14 Code of Federal Regulations Part 121. Night visual meteorological conditions prevailed at the time of the accident.

The safety issues discussed in the NTSB final report focus on strategies to prevent fatigue, remedial training, pilot training records, operational procedures, training procedures, Federal Aviation Administration (FAA) oversight, flight operational quality assurance programs, the FAA’s use of safety alerts for operators to transmit safety-critical information, use of personal portable electronic devices on the flight deck, and weather information provided to pilots. Safety recommendations concerning these issues were addressed to the FAA.

buffalo-crash

Photo: The wreckage of Continental flight 3407 (Photo credit AP)

The Organizational Influences

“Accidents come in many sizes, shapes and forms and are the result of a sequence of events or a serial development. It is now broadly recognized that accidents in complex systems occur through the concatenation of multiple factors, where each may be necessary but none alone sufficient, they are only jointly sufficient to produce the accident.

All complex systems contain such potentially multi-causal conditions, but only rarely do they arise thereby creating a possible trajectory for an accident. Often these vulnerabilities are “latent”, i.e. present in the organization long before a specific incident is triggered. Furthermore, most of them are a product of the organization itself, as a result of its design (e.g. staffing, training policy, communication patterns, hierarchical relationship,) or as a result of managerial decisions.”

THE ORGANIZATIONAL ACCIDENTS (1)

“Major accidents occur in complex productive systems, had been extensively investigated and the reports had made it clear that the performance of those at the sharp end (who may or may not have made errors, but mostly did) was shaped by local workplace conditions and upstream organizational factors. It became obvious that one could not give an adequate account of human error without considering these contextual system issues.”

“Short-term breaches may be created by the errors and violations of front-line operators, however, latent conditions – longer-lasting and more dangerous gaps- are created by the decisions of designers, builders, procedure writers, top-level managers and maintainers. A condition is not a cause, but it is necessary for a causal factor to have an impact. All top-level decisions seed pathogens into the system, and they need not be mistaken. The existence of latent conditions is a universal in all organizations, regardless of their accident record.”

“No one failure, human or technical, is sufficient to cause an accident. Rather, it involves the unlikely and often unforeseeable conjunction of several contributing factors arising from different levels of the system. The concurrent failure of several defenses, facilitated, and in some way prepared, by suboptimal features of the organization design, is what defines an organizational accident.”

“Organizations, whether they are a result of natural evolution or design, generally function in a hierarchical fashion. This means that actions, decisions and directives made at a higher level are passed on to a lower level, where they either are implemented directly, or interpreted in some way before they are passed on to the next level below, etc. The basic principle of organizational control is simply that higher levels control what happens at lower levels, although control more often is in terms of goals (objectives) and criteria than instructions that must be carried out to the letter.”

“The very basis for the principle used to explain accidents as failures at anyone of these stages is that management decisions propagate downwards and progressively turn into productive activity; Bad management decisions propagate downwards and progressively turn into unsafe activity, and possibly accidents.

However, we have known, at least since the days of David Hume (1711-1776), that causes must be prior to effects, e.g., that A must happen before B. But we also know that the temporal orderliness of two events does not mean that A necessarily is the cause of B. Such a conclusion is logically invalid and furthermore disregards the role of coincidences.”

“Accidents are due to a combination of specific events and the failure of one or more barriers – or of all barriers if they are serial rather than parallel- that should have prevented a hazard from resulting in a loss. The failed barriers can be found at any level of the organization or – what is essentially the same thing – at any stage of the developments that led to the accident. This is consistent with the view that “everybody’s blunt end is somebody else’s sharp end”.”

“The understanding of how accidents occur has during the last eighty years or so undergone a rather dramatic development. The initial view of accidents as the natural culmination of a series of events or circumstances, which invariably occur in a fixed and logical order (Heinrich, 1931), has in stages been replaced by a systemic view according to which accidents result from an alignment of conditions and occurrences each of which is necessary, but none alone sufficient (e.g., Bogner, 2002).

Indeed, it may even be argued that the adaptability and flexibility of human performance is the reason both for its efficiency and for the failures that occur, although it is rarely the cause of the failures. In that sense even serious accidents may sometimes happen even though nothing failed as such.

Adopting this view clearly defeats conventional accident models, according to which accidents are due to certain (plausible) combinations of failures. This is the logic of functions as represented, e.g., by the fault tree. But the fault tree only shows representative accidents. The more unusual accidents cannot be captured by a fault tree, one reason being that there are too many conjunctive conditions. What we see in accidents is that confluences occur, and predictive accident models must therefore not only recognize that confluences occur but also provide a plausible explanation of why they happen. If we relax the requirement that every accident must involve the failure of one or more barriers, the inescapable conclusion is that we need accident analysis methods that look equally to individual as to organizational influences. In other words, models of “human error” and organizational failures must be complemented by something that could be called socio-technical or systemic accident models

This line of thinking corresponds to the Swedish MTO model- Människa (Man) – Teknik (Technology) – Organisation. MTO considers accidents are due to a combination of human, technological and organizational factors giving the three groups equal importance. It promotes a view of accidents as due to a combination of the three groups related to performance variability. Performance variability management accepts the fact that accidents cannot be explained in simplistic cause-effect terms, but that instead, they represent the outcome of complex interactions and coincidences which are due to the normal performance variability of the system, rather than actual failures of components or functions. (One may, of course, consider actual failures as an extreme form of performance variability, i.e., the tail end of a distribution.) To prevent accidents there is therefore, a need to be able to describe the characteristic performance variability of a system, how such coincidences may build up, and how they can be detected. This reflects the practical lesson that simply finding one or more “root” causes in order to eliminate or encapsulate it is inadequate to prevent future accidents. Even in relatively simple systems, new cases continue to appear, despite the best efforts to the contrary.”

WHY DO AIRCRAFT CRASH? (2)

“The annals of aviation history are littered with accidents and tragic losses. Since the late 1950s, however, the drive to reduce the accident rate has yielded unprecedented levels of safety to a point where it is now safer to fly in a commercial airliner than to drive a car or even walk across a busy New York city street. Still, while the aviation accident rate has declined tremendously since the first flights nearly a century ago, the cost of aviation accidents in both lives and dollars has steadily risen. As a result, the effort to reduce the accident rate still further has taken on new meaning within both military and civilian aviation.

Even with all the innovations and improvements realized in the last several decades, one fundamental question remains generally unanswered: “Why do aircraft crash?” The answer may not be as straightforward as one might think. In the early years of aviation, it could reasonably be said that, more often than not, the aircraft killed the pilot. That is, the aircraft were intrinsically unforgiving and, relative to their modern counterparts, mechanically unsafe. However, the modern era of aviation has witnessed an ironic reversal of sorts. It now appears to some that the aircrew themselves are more deadly than the aircraft they fly (Mason, 1993; cited in Murray, 1997). In fact, estimates in the literature indicate that between 70 and 80 percent of aviation accidents can be attributed, at least in part, to human error (Shappell & Wiegmann, 1996). Still, to off-handedly attribute accidents solely to aircrew error is like telling patients they are simply “sick” without examining the underlying causes or further defining the illness.

So what really constitutes that 70-80 % of human error repeatedly referred to in the literature? Some would have us believe that human error and “pilot” error are synonymous. Yet, simply writing off aviation accidents merely to pilot error is an overly simplistic, if not naive, approach to accident causation. After all, it is well established that accidents cannot be attributed to a single cause, or in most instances, even a single individual (Heinrich, Petersen, and Roos, 1980). In fact, even the identification of a “primary” cause is fraught with problems. Rather, aviation accidents are the end result of a number of causes, only the last of which are the unsafe acts of the aircrew (Reason, 1990; Shappell & Wiegmann, 1997a; Heinrich, Peterson, & Roos, 1980; Bird, 1974).”

The Human Factors Analysis and Classification System- HFACS describes four levels of failure: 1) Unsafe Acts, 2) Preconditions for Unsafe Acts, 3) Unsafe Supervision, and 4) Organizational Influences.

What some call Root Cause NEVER is in the airman is in the organization.

The Organizational Influences leading to the Unsafe Supervision behind the Preconditions for Unsafe Acts of Air Crew.

asiana-b777-sfo

Photo: The Asiana Airlines Boeing 777 plane after it crashed while landing in San Francisco. Photograph: Jed Jacobsohn/Reuters

“Fallible decisions of upper-level management directly affect supervisory practices, as well as the conditions and actions of operators. Unfortunately, these organizational errors often go unnoticed. Generally speaking, the most elusive of latent failures revolve around issues related to resource management, organizational climate, and operational processes.

Organizational Influences

1. Resource Management. This category encompasses the realm of corporate-level decision making regarding the allocation and maintenance of organizational assets such as human resources (personnel), monetary assets, and equipment/facilities. Generally, corporate decisions about how such resources should be managed center around two distinct objectives – the goal of safety and the goal of on-time, cost effective operations. In times of prosperity, both objectives can be easily balanced and satisfied in full. However, there may also be times of fiscal austerity that demand some give and take between the two. Unfortunately, history tells us that safety is often the loser in such battles and, as some can attest to very well, safety and training are often the first to be cut in organizations having financial difficulties. If cutbacks in such areas are too severe, flight proficiency may suffer, and the best pilots may leave the organization for greener pastures.

Excessive cost-cutting could also result in reduced funding for new equipment or may lead to the purchase of equipment that is sub optimal and inadequately designed for the type of operations flown by the company. Other trickle-down effects include poorly maintained equipment and workspaces, and the failure to correct known design flaws in existing equipment. The result is a scenario involving unseasoned, less-skilled pilots flying old and poorly maintained aircraft under the least desirable conditions and schedules. The ramifications for aviation safety are not hard to imagine.

2. Organizational Climate refers to a broad class of organizational variables that influence worker performance. Formally, it was defined as the “situationally based consistencies in the organization’s treatment of individuals” (Jones, 1988). In general, however, organizational climate can be viewed as the working atmosphere within the organization.

One telltale sign of an organization’s climate is its structure, as reflected in the chain-of-command, delegation of authority and responsibility, communication channels, and formal accountability for actions. Just like in the cockpit, communication and coordination are vital within an organization. If management and staff within an organization are not communicating, or if no one knows who is in charge, organizational safety clearly suffers and accidents do happen (Muchinsky, 1997).

An organization’s policies and culture are also good indicators of its climate. Policies are official guidelines that direct management’s decisions about such things as hiring and firing, promotion, retention, raises, sick leave, drugs and alcohol, overtime, accident investigations, and the use of safety equipment. Culture, on the other hand, refers to the unofficial or unspoken rules, values, attitudes, beliefs, and customs of an organization. Culture is “the way things really get done around here.”

When policies are ill-defined, adversarial, or conflicting, or when they are supplanted by unofficial rules and values, confusion abounds within the organization. Indeed, – However, the Third Law of Thermodynamics tells us that, “order and harmony cannot be produced by such chaos and disharmony”. Safety is bound to suffer under such conditions.

3. Operational Process. This category refers to corporate decisions and rules that govern the everyday activities within an organization, including the establishment and use of standardized operating procedures and formal methods for maintaining checks and balances (oversight) between the workforce and management. For example, such factors as operational tempo, time pressures, incentive systems, and work schedules are all factors that can adversely affect safety. As stated earlier, there may be instances when those within the upper echelon of an organization determine that it is necessary to increase the operational tempo to a point that overextends a supervisor’s staffing capabilities.

Therefore, a supervisor may resort to the use of inadequate scheduling procedures that jeopardize crew rest and produce sub-optimal crew pairings, putting aircrew at an increased risk of a mishap. However, organizations should have official procedures in place to address such contingencies as well as oversight programs to monitor such risks.

Regrettably, not all organizations have these procedures nor do they engage in an active process of monitoring aircrew errors and human factor problems via anonymous reporting systems and safety audits. As such, supervisors and managers are often unaware of the problems before an accident occurs. Indeed, it has been said that “an accident is one incident to many” (Reinhart, 1996). It is incumbent upon any organization to fervently seek out the operattional dangers and risks and plug them up before they create a window of opportunity for catastrophe to strike.

The Unsafe Supervision behind the Preconditions for Unsafe Acts of Air Crew

Recall that in addition to those causal factors associated with the pilot/operator, Reason (1990) traced the causal chain of events back up the supervisory chain of command. As such, we have identified four categories of unsafe supervision: inadequate supervision, planned inappropriate operations, failure to correct a known problem, and supervisory violations.

1. Inadequate Supervision. The role of any supervisor is to provide the opportunity to succeed. To do this, the supervisor, no matter at what level of operation, must provide guidance, training opportunities, leadership, and motivation, as well as the proper role model to be emulated. Unfortunately, this is not always the case. sound professional guidance and oversight is an essential ingredient of any successful organization. While empowering individuals to make decisions and function independently is certainly essential, this does not divorce the supervisor from accountability. The lack of guidance and oversight has proven to be the breeding ground for many of the violations that have crept into the cockpit.

Some examples of inadequate supervision are (not limited to):

Failed to provide guidance
Failed to provide operational doctrine
Failed to provide Oversight
Failed to provide Training
Failed to provide Qualifications
Failed to provide Track performance

2. Planned Inappropriate Operations. Occasionally, the operational tempo and/or the scheduling of aircrew is such that individuals are put at unacceptable risk, crew rest is jeopardized, and ultimately performance is adversely affected. Such operations, though arguably unavoidable during emergencies, are unacceptable during normal operations. Therefore, the second category of unsafe supervision, planned inappropriate operations, was created to account for these failures.

Some examples of inappropriate planned operations are (not limited to):

Failed to provide correct data
Failed to provide adequate brief time
Improper manning
Mission not in accordance with rules/regulations
Provided inadequate opportunity for crew rest

3. Failure to Correct a Known Problem. The third category of known unsafe supervision, Failed to Correct a Known Problem, refers to those instances when deficiencies among individuals, equipment, training or other related safety areas are “known” to the supervisor, yet are allowed to continue unabated. The failure to correct the behavior, either through remedial training or, if necessary, removal from flight status, the failure to consistently correct or discipline inappropriate behavior certainly fosters an unsafe atmosphere and promotes the violation of rules.

Some examples of failure to correct a known problem are (not limited to):

Failed to correct document in error
Failed to identify an at-risk aviator
Failed to initiate corrective action
Failed to report unsafe tendencies

4. Supervisory Violations. Supervisory violations, on the other hand, are reserved for those instances when existing rules and regulations are willfully disregarded by supervisors. Supervisors have been known occasionally to violate the rules and doctrine when managing their assets. For instance, there have been occasions when individuals were permitted to operate an aircraft without current qualifications or license. Likewise, it can be argued that failing to enforce existing rules and regulations or flaunting authority are also violations at the supervisory level. While rare and possibly difficult to cull out, such practices are a flagrant violation of the rules and invariably set the stage for the tragic sequence of events that predictably follow.

Some examples of supervisory violations are (not limited to):

Authorized unnecessary hazard
Failed to enforce rules and regulations
Authorized unqualified crew for flight

No one thing “causes” accidents. Accidents are produced by the confluence of multiple events, task demands, actions taken or not taken, and environmental factors. Each accident has unique surface features and combinations of factors.What some call Root Cause NEVER is in the airman is in the organization.

To be continued on Normalization of Deviance: when non-compliance becomes the “new normal”

REFERENCES

Excerpted from

Revisiting The « Swiss Cheese » Model Of Accidents. J. Reason, E. Hollnagel, J Paries. European Organisation for the Safety Of Air Navigation- EUROCONTROL. Eurocontrol Experimental Centre. EEC Note No. 13/06. Project Safbuild. Issued: October 2006.
DOT/FAA/AM-00/7 U.S. Department of Transportation, Federal Aviation Administration, The Human Factors Analysis and Classification System–HFACS. Scott A. Shappell, Douglas A. Wiegmann. February 2000
Loss of Control on Approach Colgan Air, Inc.Operating as Continental Connection Flight 3407 Bombardier DHC-8-400, N200WQ Clarence Center, New York. February 12, 2009. Accident Report NTSB/AAR-10/01 National PB2010-910401

Living Safely with Human Error

Dedicated to studying about Human Factors in Aviation from its academic and scientific aspects. If you leave this site convinced that Human Factors goes far beyond CRM, I will consider myself succeeded

Tag: SMS