An interesting article on why standard operating procedures matter.

No Safety, Know Pain – Know Safety, No Pain

By: Warren Le Grice

The “Safety Culture” of any aviation organization, can either make or break that organization. That proved to be the case with JU-Air of Switzerland. The Final Report, No. 2370 compiled by the Swiss Transportation, Safety Investigation Board, STSB, describes the accident of  JU-Air, August 2, 2018 which occurred 1.2 nm SW of Piz Segnas, Flims, Switzerland. This 78-page accident report, with added appendixes, makes for a very interesting reading. The report is one of the most comprehensive reports I have seen in recent years. It provides a very detailed look at all the negative aspects of human behaviour that lead to the loss of 17 tourists, and the three-person crew, which was on a scenic flight through the Swiss Alps. The LOC or loss of control accident was, as are most accidents, completely preventable.

I have found the SHELL model of accident causal factors, very useful over the many years that I have been promoting aviation safety. I will utilize that jigsaw puzzle model, which was introduced by Edwards and Hawkins back in the 1970s, as we examine a number of the factors that when combined together, lead to the fatal accident. Do all the pieces of the puzzle fit together with the L or liveware (pilot) in the center or not?

Software

Examples: written instructions, flight operation manual, SOPs -standard operating procedures, SMS – Safety Management System.

Swiss investigators identified numerous issues with regard to maintenance:

• In the operating instructions for the BMW 132 A3 engines, the manufacturer had stipulated that they would require a major overhaul every 200 to 300 hours. Following the transition to civilian operators, the air operator requested and received approval from the Federal Office of Civil Aviation to increase the operating time up to 1500 hours.
• “The available documents concerning the engines fitted in the Junkers 52 aircraft registered as HB-HOT, reveal that the approved operating time of 1,500 hours since the last overhaul has not been reached. Instead, it has been necessary to continuously repair and in particular, replace important components outside the scope of a major overhaul.
• Quality and documentation of  maintenance issues

 JU-Air’s maintenance program “lacked essential information on topics such as partial and major overhauls of the airframe, surface protection, and supplementary inspection documentation. In general, it was difficult to trace the maintenance work performed as well as the modifications and repairs made, because the maintenance documentation was flawed, incomplete or kept in an unsystematic manner.”

  The empty weight of the aircraft, and the center of gravity values, were incorrect in the operations manual, therefore pilots had been systematically miscalculating these figures, including on the day of the accident flight. The aircraft was loaded, slightly aft of its rearward limit, making it more difficult to control in the event of a stall.

Mountain Flying Techniques

The risks of VFR flight or mountain flying were never assessed, despite the existence of an approved SMS ( Safety Management System). The fact that mountain flying was completely ignored was a major indicator of a  dysfunctional system of risk assessment, as almost all the flying was over mountainous terrain. Investigation of the JU-Air revealed that the routes and altitudes selected by JU-Air left no margin for error. Aircraft were routinely flown down the center of valleys, it was common to cross mountain ridges at more than 45 degrees and at altitudes that did not provide any escape route, should the aircraft encounter wind shear or down flowing air.

The routes and altitudes flown by JU-Air were not only unsafe but also illegal. The JU-52 was required to remain at least 2,000 feet above any terrain within 9.3 km of its route of flight, because the aircraft could not maintain level flight above 8,200 feet, in the event of an engine failure. Pilots flying the route would not be able to follow the 2,000 feet above terrain, as that would involve flight at 12,500 feet. There was another air regulation stating the aircraft could not fly over 12,500 feet, as the airplane was non-pressurized. Basically the JU-52 was not the right aircraft for the mission. The terrain clearance distances were not mentioned in the JU-Air operations manual. One wonders how the Swiss authority would ever approve a document with those major shortcomings.

Risk Assessment

Investigators discovered that there were 150 safety-related incidents that had occurred prior to the accident, and there was no in-depth analysis performed of any of them. Risky behaviour was commonplace at JU-Air and the operation was being managed without any regard to operational risk. Safety regulatory over-sight had been systematically deficient. 

The risks of VFR flight or mountain flying had never been assessed, despite the existence of an approved SMS.

Hardware – the aircraft, engines, and instruments 

The Junkers Ju52 a low wing trimotor was designed in 1931 and entered service with Lufthansa, the German civil airline, in 1932. The BMW-powered aircraft could carry up to 18 passengers. Approximately 6,000 units were ordered by the Luftwaffe and saw service in WW2 as bombers and military air transports.

At the time of the accident in 2018, the aircraft was then an antique, having been built in 1939. It was powered by three nine-cylinder radial engines, turning fixed pitch propellers.

The Swiss Transportation Safety Investigation Board identified the following issues with the aircraft:

• “The JU52 is considered as comparable to a Cessna 152 or Piper Super Cub” regarding the mass-to-power ratio.  The JU52 was operated at high-density altitudes in a manner that provided no margin of error due to minimal lateral and vertical separation, from the terrain, all the while powered by engines in poor condition.
• Investigation revealed that the airplane suffered from extensive corrosion of wing and fuselage components, and the left wing spar was found to have advanced fatigue. It would seem anyone doing a reasonable pre-flight inspection, would have noted those items and grounded the airplane. One wonders who was doing the routine maintenance on the aircraft, not to notice corrosion.  

Malfunctions 

“Numerous engine faults on JU-Air aircraft were recorded between 2008 and the accident. The investigation revealed that 17 safety-related engine malfunctions or system faults in relation to an engine took place during flight. On each of these occasions, it was necessary to shut down an engine or run it on reduced power. In 14 out of 17 instances the flight was aborted. On one occasion, an engine failed completely. Several cases of pronounced vibrations caused by loose propeller blades occurred on flights between 2012 and 2018.

The Junkers Company had long since disappeared years before the accident, and as result, no one held a type certificate. JU-Air had been making the required spare parts through subcontractors, and not all were qualified to produce parts. None of the spare parts received approval from the Swiss FAA. 

Environment – geography, weather, runways, airport, winds, turbulence 

• Ever-present weather-related risks, such as wind shear, high-density altitude, and down-flowing air could be expected during flight in the Swiss Alps.
• The established route through the alps required flights to cross over a pass at 100 feet above the terrain.

Liveware – the pilot in command, the person who has to put everything together

• The pilot in command had 20,714 hours of flying, with 121 hours on type.
• The PIC had been involved in a mid-air collision between two Swiss Air Force F5s, (several million dollars collectively), both pilots safely bailed out. The pilot was  held responsible for the accident on the basis of a “lack of caution”
• The pilot and co-pilot had established a “conditioned deviance” from established safe flying practices.
• The investigators concluded the loss of control accident occurred after the pilots encountered wind shear as a direct consequence of their own risky behaviour, which had become their standard method of operation.
• The pilots’ intention was to fly over the Segne Pass at 100 AGL, which the same two accident pilots had made on a previous similar flight. The power was reduced on the aircraft in order to provide the passengers with a good view of an unusual hole through the mountain at Martinsloch, which then put the aircraft in a position 410 feet below the altitude of the pass. This error in judgment was the last one the pilots would ever make.

Liveware  (others) – other individuals who are interacting with the pilot

• The pilot acting as PM or pilot monitoring, on the fatal flight, had made three JU-Air sightseeing flights, as PIC  in from their home base in Dubendorf in another of the company’s JU52 aircraft. On all three flights, it was found that the aircraft had been flown significantly below 1,000 feet agl in mountainous areas on several occasions, and that “the flight crew had disregarded essential principles for safe mountain flying”.
• Investigators looking into past history of both pilots revealed additional violations. The PIC routinely violated minimum altitudes during training flights, however, his instructors graded his performance as “standard” to “high standard”. The co-pilot flew similar dangerous maneuvers during training, and was graded “high standard”. The supervisory pilot only served to re-enforce the pilot’s hazardous flying performance. 
• Investigators found that 5 years prior to the accident flight, the co-pilot flew the exact same route over the Sengas Pass just 100 feet above the terrain and with a flight path for which there had been no escape route. Both pilots were “ potential smoking holes, looking for a grid reference”.
• Swiss investigators discovered that the rate of violations was much higher among ex-Air Force pilots and those who had flown in civil aviation. The Swiss Air Force operated under a different set of rules, and their tolerance for high risk was elevated. This culture had then seeped over into ex-Air Force pilots who were now flying, trusting, fare-paying passengers. Both accident pilots were ex -force and obviously had the same attitude towards their flying.

The most hazardous item in the cockpit continues to be… the pilot.

Closing thoughts

This accident demonstrates how pilots with any one of the five hazardous attitudes …

• Anti-Authority
• Macho 
• Invulnerability
• Complacency
• Resignation    

… can be accidents waiting to happen, and far too often take trusting and unwitting passengers on their final flight. The accident pilots would appear to have demonstrated  4 out of the 5 hazardous attitudes.

Any aviation organization must have effective oversight into how their personnel are performing, or they will discover their weak areas by “accident”.

Government agencies tasked with monitoring aviation safety have to do their job, they need to “trust and verify”

There are no new accidents, just new victims.

The number of flying hours a pilot has logged may well be a good indicator of future performance, but it is the next hour of flying that is really important.

We used to have a saying at Systems Safety, Transport Canada, and it is still valid today,

“ If  you think flight safety is expensive, try having an accident”

As Captain A.G. Lamplugh, a British pilot from the early days of aviation said “Aviation itself is not inherently dangerous. But to an even greater degree than the sea, it is terribly unforgiving of any carelessness, incapacity, or neglect.” 

Safe Flying