Safety Corner

Warren Le Grice

The long  road from “The Captain is always right” to Safety Management Systems

The concept in the transportation industry, that the captain is always right, very likely dates back to the 17th century when sailing ships provided the fastest mode of world travel. Sailors would question the wisdom of the Commanders decision making, at their own peril. Changes to safety standards were introduced very slowly, and over an extended period time. More often than not, major tragic events were the catalyst for change, and in that respect, not a whole lot has changed over the centuries.

Scilly Disaster

The Scilly Naval disaster in 1707 involving the loss of four ships, onto the rocks west of Scilly, on the night of Oct 22, and the loss of over 1300 mariners in stormy weather, would eventually lead to a major change in navigation. At that point in history, mariners were able to calculate their latitude but not longitude. In 1714 the British government passed the Longitude Act, which offered up a prize of 20,000 British pounds ( about 1.5 million pounds today) for a practical and useful method to determine longitude to an accuracy of one half a degree.

Longitude at that time was calculated by “dead reckoning”. John Harrison’s marine chronometer in 1735 would finally solve the problem of calculating longitude while at sea. His solution would revolutionize navigation and increase the safety of sea travel.

Titanic

The sinking of RMS Titanic in the early hours of April 15, 1912 resulted in major changes to maritime regulations, and leading to the establishment of the International Convention for the Safety of Life at Sea in 1914.  In spite of six warnings of icebergs in the area, the Captain was travelling at a  speed that was only 3 knots below the maximum design speed, attempting it is believed, to set a speed record on the trip to New York. The glancing blow to an iceberg sliced  open six of the sixteen compartments. The ship had been designed to withstand being able to stay afloat after four compartments being breached. As the ship only carried 20 lifeboats, over one thousand passengers perished. Captain Edward Smith went down with his ship.

BEA548 Stains-on-Thames

On June 18, 1972 BEA Flight 548 a VC10 Trident, crashed 3 mins after taking off from runway 28R at Heathrow on a flight to Brussels. There were 118 persons on board and there were no survivors. Investigation revealed that the flaps and leading edge devices were retracted prematurely and the aircraft entered a deep stall from which there was no recovery. The pilot in command was a senior captain with the airline, the first and second officers were junior pilots.

There had been a strong argument between Captain Key and another pilot in the crew briefing room, immediately prior to the flight involving another pilot regarding impending strike action at the airline. There was some evidence in the autopsy that the captain had previous heart damage. Investigators determined what had happened to the VC10, but not why it had happened.

This accident would result in the installation of CVRs, (cockpit voice recorders), which are now standard equipment on airliners around the world.

Tenerife / Portland  Oregon

On March 27, 1977  two Boeing 747s were both heading for Las Palmas. On Gran Canary Island in the Canary Islands to take their passengers to meet cruise ships. A terrorist bomb being set off in the Las Palmas terminal building, resulted in both aircraft being re-routed to Tenerife airport. Tenerife airport is located on another island about 30 miles west of Las Palmas.

Tenerife is a secondary airport and it would soon become over whelmed by the number of aircraft that were diverted there from Las Palmas. The airport had no surface detection radar and had but a single runway, 12/30. Both 747s, KLM4805 and PAA1736 were both delayed several hours on the ground at Tenerife, and when Las Palmas airport did finally open, there was a rush to depart, as the crew duty times were almost up, which meant the aircraft and several hundred passengers would have to wait until the next day to depart.

As the parallel taxiway was blocked by parked aircraft, the two 747s would have to back track on runway 12 for their departures on runway 30. As the two aircraft began their taxi with KLM4805 in the lead followed by PAA1736 low cloud moved down and covered the airport to the point that the airport went IMC. KLM was piloted by Capt. Jacob van Zanten a very senior captain and training captain with the airline. Two first and second officers were former students of van Zanten who was very anxious to get on his way.

The KLM aircraft went to the far end and turned around and was waiting for Clipper 1736 to back track and take the last taxi way, in order to clear the runway and be number two for departure. The thick cloud prevented either aircraft from seeing the other, and the visibility was likely below take-off limits.

van Zanten who was the pilot flying, was very anxious to be on his way and started to advance the power levers. The co-pilot stopped him by reminding him that they did not yet have their IFR clearance. After obtaining their IFR clearance they still needed a take-off clearance from the tower, which they would not receive until Pan American had reported clear of the runway.

Radio communications were disrupted, but PAA did state they were still on the runway but that message was distorted by another radio transmission. The Captain again advanced the power levers and then the second officer questioned “is he not clear then” van Zanten replied yes he was clear, and commenced the take off run, with out a take-off clearance. The first officer had the nerve to intervene once, but probably didn’t think he could get away with it a second time.

PAA saw the lights of KLM shaking and the Bob Bragg the first officer said to Captain Grubb, I think he is taking off, get off, get off. KLM saw the Clipper as they came out of the low cloud and struck the PAA1736 well behind the cockpit. Of the KLM crew of 14 and 234 passengers, there were no survivors.

Of the PAA crew of 16, 9 were fatally injured and of the 380 passengers, 326 were fatally injured. Because a pilot was in a hurry, and would not listen to his crew, there were 583 fatalities, and Tenerife remains the world’s worst aviation accident. KLM airlines after initially blaming the accident on ATC, did finally admit that their crew was responsible for the accident, and provided financial compensation to the families of all the victims.

UAL173 Portland Oregon- Dec 28- 1978

The DC8 was inbound from Denver and when the landing gear was lowered for landing, there was an unusual noise when the gear was extended. The aircraft was put into a hold at low altitude while the crew went through check lists, and prepared for a possible gear failure on landing. The first and second officers were aware that they were rapidly burning through their fuel at low altitude, with gear and flaps extended.

The captain did not grasp their situation until engines started to fail and the crew members failed to effectively communicate their concerns about the fuel situation. Captain McBroom was able to perform an engine out landing  in a wooded area east of the airport. There were 10 fatalities. Family members and passenger who spoke to McBroom at reunion of crash survivors in  1998, reported that he was a broken man who was plagued by guilt over his role in the accident.

The above two accidents lead to CRM -Cockpit Resource Management being introduced by United Airlines and that training has now world wide acceptance, now called Crew Resource Management.

A reactive approach to safety has been the norm for the last 400 years.

It has been the practice to wait for an accident to happen, investigate it and then implement changes to prevent it from reoccurring.

Lytton B.C – June 2021

The latest example of waiting until an accident occurs is demonstrated in the Lytton fire on June 30, after days of record braking heat. Transport Canada has ordered new safety measures for rail operators across Canada aimed at reducing the risk of wildfires after speculation that a passing train sparked the blaze that destroyed the village of Lytton and killed two people.

A pro-active approach  works to identify possible safety failures before they lead to an accident and that approach is applied in a Safety Management System. SMS is achieving world wide acceptance in the aviation community.

The block diagram below represents a concept that would work for the Abbotsford Flying Club. SMS entails a “cultural change” where safety is the focus and a culture of continuous learning is encouraged and supported.

A Safety Management System includes several components, which work  towards the simple  goal of having everyone go home safely, at the end of the day.

An interesting article on why standard operating procedures matter.

No Safety, Know Pain – Know Safety, No Pain

By: Warren Le Grice

HB-HOT, the aircraft involved in the accident.

The “Safety Culture” of any aviation organization, can either make or break that organization. That proved to be the case with JU-Air of Switzerland. The Final Report, No. 2370 compiled by the Swiss Transportation, Safety Investigation Board, STSB, describes the accident of  JU-Air, August 2, 2018 which occurred 1.2 nm SW of Piz Segnas, Flims, Switzerland. This 78-page accident report, with added appendixes, makes for a very interesting reading. The report is one of the most comprehensive reports I have seen in recent years. It provides a very detailed look at all the negative aspects of human behaviour that lead to the loss of 17 tourists, and the three-person crew, which was on a scenic flight through the Swiss Alps. The LOC or loss of control accident was, as are most accidents, completely preventable.

I have found the SHELL model of accident causal factors, very useful over the many years that I have been promoting aviation safety. I will utilize that jigsaw puzzle model, which was introduced by Edwards and Hawkins back in the 1970s, as we examine a number of the factors that when combined together, lead to the fatal accident. Do all the pieces of the puzzle fit together with the L or liveware (pilot) in the center or not?

Software

Examples: written instructions, flight operation manual, SOPs -standard operating procedures, SMS – Safety Management System.

Swiss investigators identified numerous issues with regard to maintenance:

• In the operating instructions for the BMW 132 A3 engines, the manufacturer had stipulated that they would require a major overhaul every 200 to 300 hours. Following the transition to civilian operators, the air operator requested and received approval from the Federal Office of Civil Aviation to increase the operating time up to 1500 hours.
• “The available documents concerning the engines fitted in the Junkers 52 aircraft registered as HB-HOT, reveal that the approved operating time of 1,500 hours since the last overhaul has not been reached. Instead, it has been necessary to continuously repair and in particular, replace important components outside the scope of a major overhaul.
• Quality and documentation of  maintenance issues

 JU-Air’s maintenance program “lacked essential information on topics such as partial and major overhauls of the airframe, surface protection, and supplementary inspection documentation. In general, it was difficult to trace the maintenance work performed as well as the modifications and repairs made, because the maintenance documentation was flawed, incomplete or kept in an unsystematic manner.”

  The empty weight of the aircraft, and the center of gravity values, were incorrect in the operations manual, therefore pilots had been systematically miscalculating these figures, including on the day of the accident flight. The aircraft was loaded, slightly aft of its rearward limit, making it more difficult to control in the event of a stall.

Mountain Flying Techniques

The risks of VFR flight or mountain flying were never assessed, despite the existence of an approved SMS ( Safety Management System). The fact that mountain flying was completely ignored was a major indicator of a  dysfunctional system of risk assessment, as almost all the flying was over mountainous terrain. Investigation of the JU-Air revealed that the routes and altitudes selected by JU-Air left no margin for error. Aircraft were routinely flown down the center of valleys, it was common to cross mountain ridges at more than 45 degrees and at altitudes that did not provide any escape route, should the aircraft encounter wind shear or down flowing air.

The routes and altitudes flown by JU-Air were not only unsafe but also illegal. The JU-52 was required to remain at least 2,000 feet above any terrain within 9.3 km of its route of flight, because the aircraft could not maintain level flight above 8,200 feet, in the event of an engine failure. Pilots flying the route would not be able to follow the 2,000 feet above terrain, as that would involve flight at 12,500 feet. There was another air regulation stating the aircraft could not fly over 12,500 feet, as the airplane was non-pressurized. Basically the JU-52 was not the right aircraft for the mission. The terrain clearance distances were not mentioned in the JU-Air operations manual. One wonders how the Swiss authority would ever approve a document with those major shortcomings.

Risk Assessment

Investigators discovered that there were 150 safety-related incidents that had occurred prior to the accident, and there was no in-depth analysis performed of any of them. Risky behaviour was commonplace at JU-Air and the operation was being managed without any regard to operational risk. Safety regulatory over-sight had been systematically deficient. 

The risks of VFR flight or mountain flying had never been assessed, despite the existence of an approved SMS.

View from the cockpit of accident aircraft (Note: Regulations required a/c to be 2,000 ft above the terrain)

Hardware – the aircraft, engines, and instruments 

The Junkers Ju52 a low wing trimotor was designed in 1931 and entered service with Lufthansa, the German civil airline, in 1932. The BMW-powered aircraft could carry up to 18 passengers. Approximately 6,000 units were ordered by the Luftwaffe and saw service in WW2 as bombers and military air transports.

At the time of the accident in 2018, the aircraft was then an antique, having been built in 1939. It was powered by three nine-cylinder radial engines, turning fixed pitch propellers.

The Swiss Transportation Safety Investigation Board identified the following issues with the aircraft:

• “The JU52 is considered as comparable to a Cessna 152 or Piper Super Cub” regarding the mass-to-power ratio.  The JU52 was operated at high-density altitudes in a manner that provided no margin of error due to minimal lateral and vertical separation, from the terrain, all the while powered by engines in poor condition.
• Investigation revealed that the airplane suffered from extensive corrosion of wing and fuselage components, and the left wing spar was found to have advanced fatigue. It would seem anyone doing a reasonable pre-flight inspection, would have noted those items and grounded the airplane. One wonders who was doing the routine maintenance on the aircraft, not to notice corrosion.  

Malfunctions 

“Numerous engine faults on JU-Air aircraft were recorded between 2008 and the accident. The investigation revealed that 17 safety-related engine malfunctions or system faults in relation to an engine took place during flight. On each of these occasions, it was necessary to shut down an engine or run it on reduced power. In 14 out of 17 instances the flight was aborted. On one occasion, an engine failed completely. Several cases of pronounced vibrations caused by loose propeller blades occurred on flights between 2012 and 2018.

The Junkers Company had long since disappeared years before the accident, and as result, no one held a type certificate. JU-Air had been making the required spare parts through subcontractors, and not all were qualified to produce parts. None of the spare parts received approval from the Swiss FAA. 

Environment – geography, weather, runways, airport, winds, turbulence 

• Ever-present weather-related risks, such as wind shear, high-density altitude, and down-flowing air could be expected during flight in the Swiss Alps.
• The established route through the alps required flights to cross over a pass at 100 feet above the terrain.

Map showing flight planned route

Liveware – the pilot in command, the person who has to put everything together

• The pilot in command had 20,714 hours of flying, with 121 hours on type.
• The PIC had been involved in a mid-air collision between two Swiss Air Force F5s, (several million dollars collectively), both pilots safely bailed out. The pilot was  held responsible for the accident on the basis of a “lack of caution”
• The pilot and co-pilot had established a “conditioned deviance” from established safe flying practices.
• The investigators concluded the loss of control accident occurred after the pilots encountered wind shear as a direct consequence of their own risky behaviour, which had become their standard method of operation.
• The pilots’ intention was to fly over the Segne Pass at 100 AGL, which the same two accident pilots had made on a previous similar flight. The power was reduced on the aircraft in order to provide the passengers with a good view of an unusual hole through the mountain at Martinsloch, which then put the aircraft in a position 410 feet below the altitude of the pass. This error in judgment was the last one the pilots would ever make.

Photo taken by a passenger just as the airplane stalls, and yaws to the left. The red arrow indicates the landmark being pointed out to the passengers.

Liveware  (others) – other individuals who are interacting with the pilot

• The pilot acting as PM or pilot monitoring, on the fatal flight, had made three JU-Air sightseeing flights, as PIC  in from their home base in Dubendorf in another of the company’s JU52 aircraft. On all three flights, it was found that the aircraft had been flown significantly below 1,000 feet agl in mountainous areas on several occasions, and that “the flight crew had disregarded essential principles for safe mountain flying”.
• Investigators looking into past history of both pilots revealed additional violations. The PIC routinely violated minimum altitudes during training flights, however, his instructors graded his performance as “standard” to “high standard”. The co-pilot flew similar dangerous maneuvers during training, and was graded “high standard”. The supervisory pilot only served to re-enforce the pilot’s hazardous flying performance. 
• Investigators found that 5 years prior to the accident flight, the co-pilot flew the exact same route over the Sengas Pass just 100 feet above the terrain and with a flight path for which there had been no escape route. Both pilots were “ potential smoking holes, looking for a grid reference”.
• Swiss investigators discovered that the rate of violations was much higher among ex-Air Force pilots and those who had flown in civil aviation. The Swiss Air Force operated under a different set of rules, and their tolerance for high risk was elevated. This culture had then seeped over into ex-Air Force pilots who were now flying, trusting, fare-paying passengers. Both accident pilots were ex -force and obviously had the same attitude towards their flying.

The wreckage of HB-HOT lies in a valley in the Swiss Alps after the crash.

The most hazardous item in the cockpit continues to be… the pilot.

Closing thoughts

This accident demonstrates how pilots with any one of the five hazardous attitudes …

• Anti-Authority
• Macho 
• Invulnerability
• Complacency
• Resignation    

… can be accidents waiting to happen, and far too often take trusting and unwitting passengers on their final flight. The accident pilots would appear to have demonstrated  4 out of the 5 hazardous attitudes.

Any aviation organization must have effective oversight into how their personnel are performing, or they will discover their weak areas by “accident”.

Government agencies tasked with monitoring aviation safety have to do their job, they need to “trust and verify”

There are no new accidents, just new victims.

The number of flying hours a pilot has logged may well be a good indicator of future performance, but it is the next hour of flying that is really important.

We used to have a saying at Systems Safety, Transport Canada, and it is still valid today,

“ If  you think flight safety is expensive, try having an accident”

As Captain A.G. Lamplugh, a British pilot from the early days of aviation said “Aviation itself is not inherently dangerous. But to an even greater degree than the sea, it is terribly unforgiving of any carelessness, incapacity, or neglect.” 

Safe Flying

Cairn erected at crash site