Spanair accident at Madrid
No, I don't know if Spanair has or ever had a FOQA program. However, information regarding the existence of such a program usually finds it's way into these threads long before now, (loooooooooooonnnngggg before now) so it appears to me that they don't have such a program. I believe Iberia does but am not sure.
Given the nature of such programs and their importance to SMS, [Safety Management Systems] approach to flight safety, perhaps some airline managements would find it easier and "safer", (for the corporation) NOT to know what their fleet is doing.
In comparison with the return on investment, (safety, maintenance, airframe loads, fuel efficiencies), such programs, employed intelligently and thoroughly, are relatively cheap. One may conclude these days that the airline which has no such program in place is either ignorant of it's business and responsibilities, doesn't have a safety culture worth the name or the executive has made the [quiet] decisions that it does not want to know what it's fleet is doing. Those that have the program but don't use (or believe) the data and seem to have it "on the books as a box tick" fall into the same category. An airline which employs flight data in a manner discussed here recently regarding a firing does not have a safety culture, it has a culture of blame and punishment which discourages safety reporting and learning.
Such an approach works for a while but building systems based upon knowledge as opposed to being based upon punishment yields better, and more targeted results. Human factors are by far the largest single cause of an aircraft accident and learning about them through data analysis then finding ways to reduce/prevent them seems a more effective way to handle this most difficult of causes to fix. At least fifty-five takeoffs without slats/flaps were attempted/reported. How many more are hidden in the data? Airlines that don't have a FOQA Program and the appropriate events for such incidents will never know until the day an accident occurs.
Kicking tin only prevents the second accident. Not all incidents are reported, especially in a blame-and-punish culture. FOQA, used as intended, can tell an airline, more specifically it's pilots, about the first "accident" that, but for one layer of cheese almost happened. That way everyone quietly learns and headlines, lawsuits that put airlines out of business don't happen and most important of all, crews and passengers live.
Same goes for FOQA - it is almost like a free ride - a get-out-of-jail program. It can tell an airline where, when, and how the near-accident happened so it can do something before the next time. FOQA can tell an airline's management where it's soft underbelly is and equally important, it can tell an airline and it's pilots where it's strengths in training and SOPs are. But it must be used with complete integrity, honesty, knowledgeable support from the CEO on down and cannot be used to punish pilots for mistakes. That's what training and standards are for.
Given the nature of such programs and their importance to SMS, [Safety Management Systems] approach to flight safety, perhaps some airline managements would find it easier and "safer", (for the corporation) NOT to know what their fleet is doing.
In comparison with the return on investment, (safety, maintenance, airframe loads, fuel efficiencies), such programs, employed intelligently and thoroughly, are relatively cheap. One may conclude these days that the airline which has no such program in place is either ignorant of it's business and responsibilities, doesn't have a safety culture worth the name or the executive has made the [quiet] decisions that it does not want to know what it's fleet is doing. Those that have the program but don't use (or believe) the data and seem to have it "on the books as a box tick" fall into the same category. An airline which employs flight data in a manner discussed here recently regarding a firing does not have a safety culture, it has a culture of blame and punishment which discourages safety reporting and learning.
Such an approach works for a while but building systems based upon knowledge as opposed to being based upon punishment yields better, and more targeted results. Human factors are by far the largest single cause of an aircraft accident and learning about them through data analysis then finding ways to reduce/prevent them seems a more effective way to handle this most difficult of causes to fix. At least fifty-five takeoffs without slats/flaps were attempted/reported. How many more are hidden in the data? Airlines that don't have a FOQA Program and the appropriate events for such incidents will never know until the day an accident occurs.
Kicking tin only prevents the second accident. Not all incidents are reported, especially in a blame-and-punish culture. FOQA, used as intended, can tell an airline, more specifically it's pilots, about the first "accident" that, but for one layer of cheese almost happened. That way everyone quietly learns and headlines, lawsuits that put airlines out of business don't happen and most important of all, crews and passengers live.
Same goes for FOQA - it is almost like a free ride - a get-out-of-jail program. It can tell an airline where, when, and how the near-accident happened so it can do something before the next time. FOQA can tell an airline's management where it's soft underbelly is and equally important, it can tell an airline and it's pilots where it's strengths in training and SOPs are. But it must be used with complete integrity, honesty, knowledgeable support from the CEO on down and cannot be used to punish pilots for mistakes. That's what training and standards are for.
Last edited by PJ2; 29th Oct 2008 at 05:09.
Join Date: Aug 2008
Location: Palma De Mallorca
Age: 60
Posts: 1
Likes: 0
Received 0 Likes
on
0 Posts
Poor guys
read in the news of the manslaughter charges on the ground crew,poor guys!
They will be feeling bad enough without having the finger pointed directly at them,sure they had a part in this tradgedy,but they are not the ones who did not set the lever !
They will be feeling bad enough without having the finger pointed directly at them,sure they had a part in this tradgedy,but they are not the ones who did not set the lever !
SPA83;
The Reason "Swiss Cheese Model" is well known and understood and is even being challenged these days as "limited". For it's time, it's greatest value was moving an extremely recalcitrant (hesitant, with an attitude) community off the "pilot error" excuse for an aircraft accident and into a way of considering systemic causes far removed (physically) from the actual accident. The concept was revolutionary at the time and still serves a purpose in terms of continuing to educate those who stubbornly stick to old notions about causes and how to fix them. A blame-and-punish culture and the increasing willingness to criminally prosecute rather than learn is a formula for repetition. If we examine the fatal accident rate since the late '60's, a dramatic drop is easily seen and the "curve" is almost flat at the moment, there being great difficulties in cracking the final barrier to solving the "human factors" issues. This is where Reason's model came in some twenty years ago.
Today Reason's theory has "morphed" into more sophisticated notions about causal chains. The concept and increasing reality of a "Just Culture", not limited to aviation by the way, has taken these understandings to greater and I think more helpful levels. One writer among many excellent authors is Sidney Dekker who has written, "The Field Guide to Understanding Human Factors", and "Just Culture", both well worth reading in concert with Jim Reason's work. I recommend them highly as one way into next steps after Reason. I know there are others.
As mentioned above, the accident rate has somewhat stabilized and is proving difficult to reduce. That means that any increase in traffic, (I realize present economic circumstances mitigate against such increase but we all know economics is cyclical) will bring a corresponding increase in the number of fatal accidents which causes will likely be human error.
FOQA, LOSA, AQP and a supporting cast in an enlightened management are ways forward. The trend to blame-and-punish will keep the accident rate where it is because no learning ever resulted from punishment. We could argue that lawsuits alone have forced improvements in aviation and to a certain extent that's true but the cost has been, and continues to be, extremely high in human as well as economic terms. It seems slightly more efficient and intelligent to use the best means possible to forestall and otherwise prevent accidents through knowledge rather than a rolled newspaper or worse, "jail time for the perps".
The Reason "Swiss Cheese Model" is well known and understood and is even being challenged these days as "limited". For it's time, it's greatest value was moving an extremely recalcitrant (hesitant, with an attitude) community off the "pilot error" excuse for an aircraft accident and into a way of considering systemic causes far removed (physically) from the actual accident. The concept was revolutionary at the time and still serves a purpose in terms of continuing to educate those who stubbornly stick to old notions about causes and how to fix them. A blame-and-punish culture and the increasing willingness to criminally prosecute rather than learn is a formula for repetition. If we examine the fatal accident rate since the late '60's, a dramatic drop is easily seen and the "curve" is almost flat at the moment, there being great difficulties in cracking the final barrier to solving the "human factors" issues. This is where Reason's model came in some twenty years ago.
Today Reason's theory has "morphed" into more sophisticated notions about causal chains. The concept and increasing reality of a "Just Culture", not limited to aviation by the way, has taken these understandings to greater and I think more helpful levels. One writer among many excellent authors is Sidney Dekker who has written, "The Field Guide to Understanding Human Factors", and "Just Culture", both well worth reading in concert with Jim Reason's work. I recommend them highly as one way into next steps after Reason. I know there are others.
As mentioned above, the accident rate has somewhat stabilized and is proving difficult to reduce. That means that any increase in traffic, (I realize present economic circumstances mitigate against such increase but we all know economics is cyclical) will bring a corresponding increase in the number of fatal accidents which causes will likely be human error.
FOQA, LOSA, AQP and a supporting cast in an enlightened management are ways forward. The trend to blame-and-punish will keep the accident rate where it is because no learning ever resulted from punishment. We could argue that lawsuits alone have forced improvements in aviation and to a certain extent that's true but the cost has been, and continues to be, extremely high in human as well as economic terms. It seems slightly more efficient and intelligent to use the best means possible to forestall and otherwise prevent accidents through knowledge rather than a rolled newspaper or worse, "jail time for the perps".
Join Date: Apr 2008
Location: The sunny side
Posts: 39
Likes: 0
Received 0 Likes
on
0 Posts
EASA have issued an Airworthiness Directive
The reason for the AD is
"In August 2008, a McDonnell Douglas DC-9-82 (MD-82) airplane crashed while attempting to take off from runway 36L at Madrid's Barajas International Airport.
"In August 2008, a McDonnell Douglas DC-9-82 (MD-82) airplane crashed while attempting to take off from runway 36L at Madrid's Barajas International Airport.
Although the preliminary report issued by Spain’s Comisión de Investigación de Accidentes e Incidentes de Aviación Civil (CIAIAC) did not identify the probable causes of the accident, it states that the data recordings suggest the flaps/slats were not set for takeoff and the Take-Off Warning (TOW) did not occur.
After a similar accident in 1987 where it was concluded that the flaps/slats were not set for takeoff and the TOW did not occur, McDonnell Douglas recommended all MD-80 series operators conduct a check of the TOW system before engine start prior to every flight. It has been found that some operators’ procedures no longer reflect the initial intent of the recommendation made by McDonnell Douglas as the check is performed less frequently.
After a similar accident in 1987 where it was concluded that the flaps/slats were not set for takeoff and the TOW did not occur, McDonnell Douglas recommended all MD-80 series operators conduct a check of the TOW system before engine start prior to every flight. It has been found that some operators’ procedures no longer reflect the initial intent of the recommendation made by McDonnell Douglas as the check is performed less frequently.
A defective TOW system could let an improper take-off configuration undetected to the flight crew and result in loss of control during the initial climb. As a consequence, to ensure that all operators of MD-80 series airplanes perform the TOW system check before every flight, this Airworthiness Directive requires an update of the Airplane Flight Manual (AFM) to make the frequency mandatory.
The AD also extends to the DC-9 and 717-200 aircraft as the design of the TOW system is common to all three types."
The AD also extends to the DC-9 and 717-200 aircraft as the design of the TOW system is common to all three types."
Link to the AD EASA Airworthiness Directives Publishing Tool
Join Date: Aug 2008
Location: Canary Islands, Spain
Posts: 240
Likes: 0
Received 0 Likes
on
0 Posts
EDIT: ooops, sorry, I didn't notice the post above as I was typing this one.
Well, as a first "lesson learned" and in an attempt to reduce the likehood of this type of accidents, EASA (European Aviation Safety Agency) has published this directive today:
http://ad.easa.europa.eu/blob/easa_a...AD_2008-0197_1
together with this press note:
"Following the preliminary report of the Spanish Comisión de Investigación de Accidentes e Incidentes de Aviación Civil (CIAIAC) on the 20 August 2008 accident of a Spanair McDonnell Douglas DC-9-82 (MD-82) at Madrid's Barajas International Airport, as well as the Agency's own evaluation of DC-9/MD-80 family service history, EASA is today publishing an Airworthiness Directive (AD) concerning the DC-9/MD-80 family of aircraft.
The Airworthiness Directive requires an update of the Airplane Flight Manual (AFM) to include a mandatory check of the functionality of the Take-Off Warning system (TOW) before engine start prior to every flight. This system provides warning in the case of the flaps and slats not being correctly set, thus alerting the crew of an improper take-off configuration. This action is being taken as a precautionary measure to improve the consistency of pre-flight safety drills.
To ensure that the TOW check is a part of all operators’ pre-start checks for every flight, a recommendation for an Operational Directive (OD) affecting the same aircraft types is simultaneously being issued by the Joint Aviation Authorities (JAA) to their members, after consultation with EASA. The JAA are currently responsible for remedial action related to air operations, until the EASA Implementing Rules on air operations are in force.
At the present time the cause or causes of the non-functionality of the TOWS system of the Spanair MD-82 have not yet been established. EASA is continuing to work closely with all parties involved in support of the CIAIAC investigation team and will consider any further action in light of the on-going investigation."
Theoretically, and according to Spanair's chief of operation declaration, the SOP demanded a TOWS test for this flight as well, as the crew had left the cockpit in Madrid for a significant amount of time. Although there is serious doubt the crew performed the test, the chain of events should've been this in this case:
-Crew tested TOWS and RAT heater
-Relay failure occurred during taxi (it had been happening intermitently for up to 24h)
-Aircraft lined up for take-off
-RAT probe heater was noted on through excessive RAT readings / autothrottle warning
-Returned to gate and engines off
-Heater was "repaired" (disconnected by MEL)
-Aircraft lined up again, this time w/o testing the TOWS as it had already been tested for THIS FLIGHT and the pilots (incidently not even the PAX) had left the aircraft for any significant amount of time (as per Spanair's SOP which met standards but didn't follow Boeings updated recommended procedure after Detroit)
-The aircraft attempted to take-off with an unnoticed inoperative TOWS and the crew (likely) neglected to set flaps/slats for the maneuver.
The directive is now clear in that tests should be made required before each engine start, which theoretically happens quite close to takeoff time, for all the operators that still didn't include such recommended procedure.
Well, as a first "lesson learned" and in an attempt to reduce the likehood of this type of accidents, EASA (European Aviation Safety Agency) has published this directive today:
http://ad.easa.europa.eu/blob/easa_a...AD_2008-0197_1
together with this press note:
"Following the preliminary report of the Spanish Comisión de Investigación de Accidentes e Incidentes de Aviación Civil (CIAIAC) on the 20 August 2008 accident of a Spanair McDonnell Douglas DC-9-82 (MD-82) at Madrid's Barajas International Airport, as well as the Agency's own evaluation of DC-9/MD-80 family service history, EASA is today publishing an Airworthiness Directive (AD) concerning the DC-9/MD-80 family of aircraft.
The Airworthiness Directive requires an update of the Airplane Flight Manual (AFM) to include a mandatory check of the functionality of the Take-Off Warning system (TOW) before engine start prior to every flight. This system provides warning in the case of the flaps and slats not being correctly set, thus alerting the crew of an improper take-off configuration. This action is being taken as a precautionary measure to improve the consistency of pre-flight safety drills.
To ensure that the TOW check is a part of all operators’ pre-start checks for every flight, a recommendation for an Operational Directive (OD) affecting the same aircraft types is simultaneously being issued by the Joint Aviation Authorities (JAA) to their members, after consultation with EASA. The JAA are currently responsible for remedial action related to air operations, until the EASA Implementing Rules on air operations are in force.
At the present time the cause or causes of the non-functionality of the TOWS system of the Spanair MD-82 have not yet been established. EASA is continuing to work closely with all parties involved in support of the CIAIAC investigation team and will consider any further action in light of the on-going investigation."
Theoretically, and according to Spanair's chief of operation declaration, the SOP demanded a TOWS test for this flight as well, as the crew had left the cockpit in Madrid for a significant amount of time. Although there is serious doubt the crew performed the test, the chain of events should've been this in this case:
-Crew tested TOWS and RAT heater
-Relay failure occurred during taxi (it had been happening intermitently for up to 24h)
-Aircraft lined up for take-off
-RAT probe heater was noted on through excessive RAT readings / autothrottle warning
-Returned to gate and engines off
-Heater was "repaired" (disconnected by MEL)
-Aircraft lined up again, this time w/o testing the TOWS as it had already been tested for THIS FLIGHT and the pilots (incidently not even the PAX) had left the aircraft for any significant amount of time (as per Spanair's SOP which met standards but didn't follow Boeings updated recommended procedure after Detroit)
-The aircraft attempted to take-off with an unnoticed inoperative TOWS and the crew (likely) neglected to set flaps/slats for the maneuver.
The directive is now clear in that tests should be made required before each engine start, which theoretically happens quite close to takeoff time, for all the operators that still didn't include such recommended procedure.
Last edited by justme69; 30th Oct 2008 at 03:43.
EASA AD No.: 2008 - 0197
Have I missed something here?
Is this AD perhaps a bit like ‘closing the stable door … ’ given evidence of previous events.
If the check is carried out correctly and the TOCW proven to be serviceable, but the nose ground–air switch changes state during taxi, and in combination with a failure to select flap, then an accident could still occur. This scenario is very similar to this accident:-
Previous work on the nose leg, possible mal-aligned switch during maintenance, or a design weakness where the switch is opened when the aircraft is loaded at aft cg.
Is there a time delay before the TOCW is reactivated if the switch is remade? Does the nose leg rise at aft cg as power is applied during the takeoff run? Have operators deliberately chosen to load aft cg to aid fuel burn in the current economic situation?
Given the above, how does the AD “reduce the likely hood of this type of accident”, or “improve the consistency of pre-flight safety drills”?
Hopefully the “further action in light of the on-going investigation” will resolve the issues above.
Is this AD perhaps a bit like ‘closing the stable door … ’ given evidence of previous events.
If the check is carried out correctly and the TOCW proven to be serviceable, but the nose ground–air switch changes state during taxi, and in combination with a failure to select flap, then an accident could still occur. This scenario is very similar to this accident:-
Previous work on the nose leg, possible mal-aligned switch during maintenance, or a design weakness where the switch is opened when the aircraft is loaded at aft cg.
Is there a time delay before the TOCW is reactivated if the switch is remade? Does the nose leg rise at aft cg as power is applied during the takeoff run? Have operators deliberately chosen to load aft cg to aid fuel burn in the current economic situation?
Given the above, how does the AD “reduce the likely hood of this type of accident”, or “improve the consistency of pre-flight safety drills”?
Hopefully the “further action in light of the on-going investigation” will resolve the issues above.
Join Date: Aug 2005
Location: fl
Posts: 2,525
Likes: 0
Received 0 Likes
on
0 Posts
Loading fuel aft is how you increase fuel efficiency. Just don't overinflate the nose strut. Testing the TOWS before engine start each time should eliminate 99% of departures with TOWS inop.
Join Date: Aug 2008
Location: Canary Islands, Spain
Posts: 240
Likes: 0
Received 0 Likes
on
0 Posts
Just a quick note to clarify that, for whatever reason, the CIAIAC is strongly suspecting the failure of the R2-5 relay as oppossed to the strut gear sensor (as in a case described in this board) or the Left ground control circuit breaker (as in MAP case).
The main reason is probably the lack of evidence that the 30+ devices connected to the front wheel logic, including the 20 or so exclusive to the left wheel, failed the ground/air mode and, more importanly, that the Flight Data Recorder recorded a change of state from ground to air coming from the front wheel left sensor circuit on R2-12 shortly after VR was called, signalling a correct detection of the front wheels leaving the ground by the left wheel sensor circuit, to which R2-5 is also connected.
The R2-5 relay could have had an intermitent malfunction (i.e. a loose electrical connection, etc) and this would've only ultimately affected the ground/air logic for only two devices, the TOWS and the RAT probe anti-ice heater (because the other two "devices" also connected to R2-5, the AC x-tie & the radio rack venting were redundantly serviced from the right wheel sensor circuit through R2-8 and R2-4).
Most of this, especulation on my side.
The main reason is probably the lack of evidence that the 30+ devices connected to the front wheel logic, including the 20 or so exclusive to the left wheel, failed the ground/air mode and, more importanly, that the Flight Data Recorder recorded a change of state from ground to air coming from the front wheel left sensor circuit on R2-12 shortly after VR was called, signalling a correct detection of the front wheels leaving the ground by the left wheel sensor circuit, to which R2-5 is also connected.
The R2-5 relay could have had an intermitent malfunction (i.e. a loose electrical connection, etc) and this would've only ultimately affected the ground/air logic for only two devices, the TOWS and the RAT probe anti-ice heater (because the other two "devices" also connected to R2-5, the AC x-tie & the radio rack venting were redundantly serviced from the right wheel sensor circuit through R2-8 and R2-4).
Most of this, especulation on my side.
Last edited by justme69; 2nd Nov 2008 at 04:50.
EASA AD No.: 2008 - 0197
The wording in the required action – the check, is a type of SOP, and might not be the best example of creating a SOP or additional safety defense.
The check assumes that the flaps are up before the TOCW is tested – this is not stated. If the flaps were inadvertently down for the check, and another part of the TOCW in error e.g. mis-set trim, then this might open a hazardous sequence of events, but no less likely than in this accident, i.e. after taxing-in due to a RAT fault and flaps are selected up after the test – before the next start. The test has been successful (mis-set trim), but might not prevent an accident, e.g. failed ‘intermittent relay.
This emphasizes the need for careful wording in checks, an understanding and memory of the reason for the check, and correct execution of the check. All of these should be associated with training or documentation, as without them there may be more possibilities for error, similar to those which supposedly occurred in the accident.
The check might be seen as a ‘band-aid’, or just another line of defense which adds complexity to the operation (the check takes time in an environment where crews could be hurrying), or it becomes another opportunity for error - forgetting.
An alternative is to provide a more robust defense, probably improving something which already exists, but where an investigation identifies a weakness e.g. a more reliable TOCW system, or a TOCW system failure warning (cf AMC CS 25.703 ). Solutions in this area could also suffer added complexity or more opportunity for error, but robustness and resilience in defense are often quoted as being more effective than a check.
I recognize that it is easy to pick holes in proposals and, in hindsight, seek a safety solution that focuses on the most recent accident. The skill in safety management might be that of identifying and managing the risks of the ‘holes in the solutions’, or choosing the better generic solution(s) addressing the causes underlying this particular or a similar accident. Apparently, the causes (why) in this accident have not yet been identified.
Note the CS 25 text re hazards of crew familiarity with a warning in normal operations (the check) vs their reaction to a warning in the failure case, where the familiarity of the warning during the check might decrease its effectiveness in a failure condition – human performance and limitations, etc.
The wording in the required action – the check, is a type of SOP, and might not be the best example of creating a SOP or additional safety defense.
The check assumes that the flaps are up before the TOCW is tested – this is not stated. If the flaps were inadvertently down for the check, and another part of the TOCW in error e.g. mis-set trim, then this might open a hazardous sequence of events, but no less likely than in this accident, i.e. after taxing-in due to a RAT fault and flaps are selected up after the test – before the next start. The test has been successful (mis-set trim), but might not prevent an accident, e.g. failed ‘intermittent relay.
This emphasizes the need for careful wording in checks, an understanding and memory of the reason for the check, and correct execution of the check. All of these should be associated with training or documentation, as without them there may be more possibilities for error, similar to those which supposedly occurred in the accident.
The check might be seen as a ‘band-aid’, or just another line of defense which adds complexity to the operation (the check takes time in an environment where crews could be hurrying), or it becomes another opportunity for error - forgetting.
An alternative is to provide a more robust defense, probably improving something which already exists, but where an investigation identifies a weakness e.g. a more reliable TOCW system, or a TOCW system failure warning (cf AMC CS 25.703 ). Solutions in this area could also suffer added complexity or more opportunity for error, but robustness and resilience in defense are often quoted as being more effective than a check.
I recognize that it is easy to pick holes in proposals and, in hindsight, seek a safety solution that focuses on the most recent accident. The skill in safety management might be that of identifying and managing the risks of the ‘holes in the solutions’, or choosing the better generic solution(s) addressing the causes underlying this particular or a similar accident. Apparently, the causes (why) in this accident have not yet been identified.
Note the CS 25 text re hazards of crew familiarity with a warning in normal operations (the check) vs their reaction to a warning in the failure case, where the familiarity of the warning during the check might decrease its effectiveness in a failure condition – human performance and limitations, etc.
Join Date: Aug 2005
Location: fl
Posts: 2,525
Likes: 0
Received 0 Likes
on
0 Posts
This before start check of TOWS only says the system is working and the annunciator works. It can not be tested for all the faults like trim, speedbrakes and flaps, only that something is wrong. Flaps are always up during this check so that is the fault giving the warning most of the time. Hopefully this warning will never be needed again since we are aware of the possibility of failure of the system and the importance of checking flap setting lining up with the runway.
Join Date: Aug 2007
Location: Vancouver, Canada
Posts: 60
Likes: 0
Received 0 Likes
on
0 Posts
PJ2,
You state "As mentioned above, the accident rate has somewhat stabilized and is proving difficult to reduce."
Very true!
Tony Kern's premise in his book 'Flight Discipline' is that although we know the right thing to do (CRM, Human Factors, SOPs, Training, etc) we often lack the discipline to carry it out. On the jacket cover he states that "A skilled pilot without flight discipline is a walking time bomb."
Personal experience tells me that one of the most difficult tasks an aviator faces is to be consistently disciplined. Failure in this tremendously important area has in too many circumstances caused loss of life and property.
best regards,
Bruce Waddington
You state "As mentioned above, the accident rate has somewhat stabilized and is proving difficult to reduce."
Very true!
Tony Kern's premise in his book 'Flight Discipline' is that although we know the right thing to do (CRM, Human Factors, SOPs, Training, etc) we often lack the discipline to carry it out. On the jacket cover he states that "A skilled pilot without flight discipline is a walking time bomb."
Personal experience tells me that one of the most difficult tasks an aviator faces is to be consistently disciplined. Failure in this tremendously important area has in too many circumstances caused loss of life and property.
best regards,
Bruce Waddington
Join Date: Apr 2005
Location: UK
Posts: 459
Likes: 0
Received 0 Likes
on
0 Posts
A little drift, but.
Which aircraft hav the lowest rate of T/O (actual or attempt) or T/O warn config due pilot test on Airbus due to Slat/Flap incorrect settings ?
Do Airbus pilots report if test picks up a config prob ?
Does the Airbus config test record findings to any data recording device ?
I guess the answer to my last question could be a big factor to answer to my middle question !
The latest AD mentions a previous event that resulted in a crash, what about all the other non crash events of this type getting into the air with incorrect Slat/Flap settings !
My thoughts still with all involved.
Which aircraft hav the lowest rate of T/O (actual or attempt) or T/O warn config due pilot test on Airbus due to Slat/Flap incorrect settings ?
Do Airbus pilots report if test picks up a config prob ?
Does the Airbus config test record findings to any data recording device ?
I guess the answer to my last question could be a big factor to answer to my middle question !
The latest AD mentions a previous event that resulted in a crash, what about all the other non crash events of this type getting into the air with incorrect Slat/Flap settings !
My thoughts still with all involved.
Join Date: Aug 2008
Location: Canary Islands, Spain
Posts: 240
Likes: 0
Received 0 Likes
on
0 Posts
Joetom,
I'll let the questions about the airbus takeoff configuration warnings to someone who knows the answers.
About how often this type of incidents/accidents happens: quite a bit.
Read the thread a couple of pages back. There has been at least 6 accidents with victims (LAPA, India, Northwest, Delta, Lufthansa, Spanair).
There've been at least 3 take-offs w/o flaps/slats that managed to stay in the air long enough to escape a crash. In none of them the warning worked (bad switch @DCA/pulled circuit breaker @ACE/not reported). In some cases, i.e. the flaps were noted retracted after the stall alarm and quickly commanded, in others just engines firewalled and nose down while flying on ground effect until the speed was increased.
It seems there have been voluntarily reported some 55 cases in the USA alone in the past 7.5 years of attempted clean takeoffs, almost all of them "catched" by the Takeoff Config Warning System, of course.
It seems like it happens "quite often". A couple more cases, probably not reported, have unofficially been told in this thread by a couple of pilots.
There've been also at least 6 instances of known cases "after the facts" of flights that took off with unnoticed inoperative TOWS alarms (but the configuration was just fine, so nothing happened).
All this, probably, just the tip of the iceberg.
If in the past say 25 years or so there has been at least 7 known take-offs in which the crew didn't set the configuration and the alarm didn't sound (I'm not counting LAPA where it did sound nor India Air, which it wasn't reported), I guess we could factor that it's common enough so that once every 3-4 years someone forgets to set the flaps &/or slats at exactly the same time the TOWS is not working, although it not always ends up in a crash, but could've easily if the conditions weren't favourable for a recovery.
I'll let the questions about the airbus takeoff configuration warnings to someone who knows the answers.
About how often this type of incidents/accidents happens: quite a bit.
Read the thread a couple of pages back. There has been at least 6 accidents with victims (LAPA, India, Northwest, Delta, Lufthansa, Spanair).
There've been at least 3 take-offs w/o flaps/slats that managed to stay in the air long enough to escape a crash. In none of them the warning worked (bad switch @DCA/pulled circuit breaker @ACE/not reported). In some cases, i.e. the flaps were noted retracted after the stall alarm and quickly commanded, in others just engines firewalled and nose down while flying on ground effect until the speed was increased.
It seems there have been voluntarily reported some 55 cases in the USA alone in the past 7.5 years of attempted clean takeoffs, almost all of them "catched" by the Takeoff Config Warning System, of course.
It seems like it happens "quite often". A couple more cases, probably not reported, have unofficially been told in this thread by a couple of pilots.
There've been also at least 6 instances of known cases "after the facts" of flights that took off with unnoticed inoperative TOWS alarms (but the configuration was just fine, so nothing happened).
All this, probably, just the tip of the iceberg.
If in the past say 25 years or so there has been at least 7 known take-offs in which the crew didn't set the configuration and the alarm didn't sound (I'm not counting LAPA where it did sound nor India Air, which it wasn't reported), I guess we could factor that it's common enough so that once every 3-4 years someone forgets to set the flaps &/or slats at exactly the same time the TOWS is not working, although it not always ends up in a crash, but could've easily if the conditions weren't favourable for a recovery.
Last edited by justme69; 1st Nov 2008 at 11:52.
Join Date: Feb 2008
Location: Belgium
Posts: 58
Likes: 0
Received 0 Likes
on
0 Posts
Familiarity issue
Originally Posted by safetypee
Note the CS 25 text re hazards of crew familiarity with a warning in normal operations (the check) vs their reaction to a warning in the failure case, where the familiarity of the warning during the check might decrease its effectiveness in a failure condition – human performance and limitations, etc.
It is a training issue, and also a "generic philosophy" issue.
The "generic philosophy" issue is a matter of projecting one self in the near future when performing a test, or checking a set up.
If you just do the test to make sure the TOWS is operational, you have only checked the nuts and bolts, you missed to check the human part.
I you chek the TOWS while projecting your self at the beginning of the take-off roll, and imagine that you hear that warning ... you just have to end the test (by retarding the thrust levers) while imagining yelling "ABORT" ...
It would be a good idea to add that word "abort" to the test procedure , and a good opportunity to remember that "any warning before xx knots, we abort"
Training issue ...
Well, see to it that this "projection philosophy" becomes an habit ...
Take full advantage of sim training to enforce the principle "any warning ... etc"
Take advantage of such sim training to enforce first officer assertivity ... (have the captain ignore voluntary such a warning ...)
Take full advantage of the failure pannel ... and rent the simulation device with the most comprehensive one.
“More training – better training”
More, or better training might be identified with the need to link knowledge with know-how (tacit knowledge), which is difficult to teach and best gained from experience.
The industry promotes a ‘no error’ operational philosophy, yet humans learn from error. Similarly the lingering blame culture restricts the number of error reports and restricts opportunity to learn from others.
Pilots can be taught the fundamentals of the TOCWS and the ground-air switching logic, but in order to associate them in situations when a probe overheats requires skills of critical thinking:- how is the situation understood and/or related to the next operation, what if, comparison, association, accurate memory recall, etc.
These skills are essential in aviation, and generally acquired from being in the relevant situations – experience.
Thus for a probe failure, full understanding of the situational aspects might require a pilot to have experienced ‘the specific failure’. However, probes can fail for many reasons – with or without TOCWS implications, that’s one reason we call maintenance to determine the nature of the failure;- CRM, use all available resources, provided that they too have the required knowledge and know-how.
The MMEL DDG (Dispatch deviation guide) should be the documented reference for allowing and managing these failures, but MELs may not consider human error, and probably not combined with other errors.
Following this line of argument, then it might be unreasonable to expect pilots to know the specific association between TOCW / ground-air switch / probe.
Flight crew are seen, and see themselves as the last line of defence, which breeds personal responsibility, but there are limits to the practicality of this.
The regulations (#2104) might suggest that system design should limit the dependency on pilot’s knowledge (and vulnerability to error), which argues for improved system integrity. If this was not the intent of the regulation then this accident identifies a mismatch between what the regulation (CS 25) assumes about a pilot’s knowledge and that required by JAR-FCL (training); a gap in the regulations which the operational industry fell into.
“What can be learned?”
Investigations of accidents in complex systems can usually determine ‘what’ happened quite quickly; finding out ‘why’ things happened is much more difficult. Blame, should not – must not, enter these phases of investigation, and is normally an issue for the lawyers, but this segregation is not always made.
Perhaps the most disappointing aspect of the the investigation so far, is that the ‘why’ aspects appear to be missing. Perhaps the jump to the legal national requirement (blame) has eclipsed the need to determine ‘why’; a pity as it is this understanding from which the industry might learn.
It is interesting to relate what is known about this accident with the causes of the recent financial ‘crash’. (cf New Scientist 25 Sept “The blunders that led to the banking crisis.”) Although the banking collapse is seen as an industry wide issue, the reasons for failing apply equally to an individual organization, bank or operator.
“The crisis did not come without warning.” Were the outcomes of previous MD 80 accidents and incidents sufficiently heeded? What action was taken by the continued airworthiness process, the manufacturer, and operators?
“By definition they are rare, extreme events, so all the [math] models you rely on in normal times don't work any more, " What assumptions have been made about aircraft system failure in the MD 80 and opportunities for error? Did these change with in-service experience?
“… each liquidity crisis is inevitably different from its predecessors, not least because major crises provoke changes in the shape of markets, regulations and the behaviour of players.” Was the Spanair operation towards the ‘end of the chain’ where previous experience, knowledge, or requirements may not have been passed on? Or if available the information not used due to a lack of awareness of the severity / frequency of the problem?
“…wrongly assumed that two areas of vulnerability could be treated in isolation, each with its own risk model. When the two areas began to affect each other … there was no unifying framework to predict what would happen, " Something for aviation to learn? MMELs rarely consider combined interactions in systems and / or human vulnerability.
“These models typically assume that market prices will continue to behave much as they have in the past, and that they are reasonably predictable. Statistical models based on short time series of data are a terrible way to understand [these kinds of] risks.
The banks had set great store by their use of statistical models designed to monitor the risks inherent in their investments. The models were not working as well as hoped - in particular that they were ignoring the risks of extreme events and the connections. The real risk, … turns out to be a cycle of drops." Complacency? Drops – small incremental changes in normal procedure, moving away from the assumed safe standard and so become the norm. Are these changes identifiable with FOQA, LOSA, etc, and are these safety tools based on the correct norm – risk, certification / training assumptions?
“… each bank had been content to use a measure called "value at risk" that predicted how much money it might lose from a given market position ("What do we stand to lose?") . In aviation, is this synonymous with an insular approach to flight safety – not sharing safety information, not considering the experiences of other operators?
“Statistical models have proved almost useless at predicting the killer risks for individual banks, and worse than useless when it comes to risks to the financial system as a whole. The models encouraged bankers to think they were playing a high-stakes card game, when what they were actually doing was more akin to lining up a row of dominoes.
Banks should be careful not to assume that they have it right and the rest of the world has it wrong. And regulators - who have lately allowed themselves to be blinded by science - should have no qualms about shutting down activities they do not understand. We shouldn't need another warning.” Cf Revisiting the Swiss Cheese Model of Accidents.
[USA Today] – Alan Greenspan … was "shocked" to discover, as a once-in a-century financial crisis spread, that his bedrock belief that financial firms could police themselves turned out to be "flawed."
"I made a mistake in presuming that the self-interests of organizations, specifically banks and others, were such as that they were best capable of protecting their own shareholders and their equity," "… a flaw in the model that defines how the world works."
Hopefully not an epitaph for aviation SMS and devolved regulatory oversight.
More, or better training might be identified with the need to link knowledge with know-how (tacit knowledge), which is difficult to teach and best gained from experience.
The industry promotes a ‘no error’ operational philosophy, yet humans learn from error. Similarly the lingering blame culture restricts the number of error reports and restricts opportunity to learn from others.
Pilots can be taught the fundamentals of the TOCWS and the ground-air switching logic, but in order to associate them in situations when a probe overheats requires skills of critical thinking:- how is the situation understood and/or related to the next operation, what if, comparison, association, accurate memory recall, etc.
These skills are essential in aviation, and generally acquired from being in the relevant situations – experience.
Thus for a probe failure, full understanding of the situational aspects might require a pilot to have experienced ‘the specific failure’. However, probes can fail for many reasons – with or without TOCWS implications, that’s one reason we call maintenance to determine the nature of the failure;- CRM, use all available resources, provided that they too have the required knowledge and know-how.
The MMEL DDG (Dispatch deviation guide) should be the documented reference for allowing and managing these failures, but MELs may not consider human error, and probably not combined with other errors.
Following this line of argument, then it might be unreasonable to expect pilots to know the specific association between TOCW / ground-air switch / probe.
Flight crew are seen, and see themselves as the last line of defence, which breeds personal responsibility, but there are limits to the practicality of this.
The regulations (#2104) might suggest that system design should limit the dependency on pilot’s knowledge (and vulnerability to error), which argues for improved system integrity. If this was not the intent of the regulation then this accident identifies a mismatch between what the regulation (CS 25) assumes about a pilot’s knowledge and that required by JAR-FCL (training); a gap in the regulations which the operational industry fell into.
“What can be learned?”
Investigations of accidents in complex systems can usually determine ‘what’ happened quite quickly; finding out ‘why’ things happened is much more difficult. Blame, should not – must not, enter these phases of investigation, and is normally an issue for the lawyers, but this segregation is not always made.
Perhaps the most disappointing aspect of the the investigation so far, is that the ‘why’ aspects appear to be missing. Perhaps the jump to the legal national requirement (blame) has eclipsed the need to determine ‘why’; a pity as it is this understanding from which the industry might learn.
It is interesting to relate what is known about this accident with the causes of the recent financial ‘crash’. (cf New Scientist 25 Sept “The blunders that led to the banking crisis.”) Although the banking collapse is seen as an industry wide issue, the reasons for failing apply equally to an individual organization, bank or operator.
“The crisis did not come without warning.” Were the outcomes of previous MD 80 accidents and incidents sufficiently heeded? What action was taken by the continued airworthiness process, the manufacturer, and operators?
“By definition they are rare, extreme events, so all the [math] models you rely on in normal times don't work any more, " What assumptions have been made about aircraft system failure in the MD 80 and opportunities for error? Did these change with in-service experience?
“… each liquidity crisis is inevitably different from its predecessors, not least because major crises provoke changes in the shape of markets, regulations and the behaviour of players.” Was the Spanair operation towards the ‘end of the chain’ where previous experience, knowledge, or requirements may not have been passed on? Or if available the information not used due to a lack of awareness of the severity / frequency of the problem?
“…wrongly assumed that two areas of vulnerability could be treated in isolation, each with its own risk model. When the two areas began to affect each other … there was no unifying framework to predict what would happen, " Something for aviation to learn? MMELs rarely consider combined interactions in systems and / or human vulnerability.
“These models typically assume that market prices will continue to behave much as they have in the past, and that they are reasonably predictable. Statistical models based on short time series of data are a terrible way to understand [these kinds of] risks.
The banks had set great store by their use of statistical models designed to monitor the risks inherent in their investments. The models were not working as well as hoped - in particular that they were ignoring the risks of extreme events and the connections. The real risk, … turns out to be a cycle of drops." Complacency? Drops – small incremental changes in normal procedure, moving away from the assumed safe standard and so become the norm. Are these changes identifiable with FOQA, LOSA, etc, and are these safety tools based on the correct norm – risk, certification / training assumptions?
“… each bank had been content to use a measure called "value at risk" that predicted how much money it might lose from a given market position ("What do we stand to lose?") . In aviation, is this synonymous with an insular approach to flight safety – not sharing safety information, not considering the experiences of other operators?
“Statistical models have proved almost useless at predicting the killer risks for individual banks, and worse than useless when it comes to risks to the financial system as a whole. The models encouraged bankers to think they were playing a high-stakes card game, when what they were actually doing was more akin to lining up a row of dominoes.
Banks should be careful not to assume that they have it right and the rest of the world has it wrong. And regulators - who have lately allowed themselves to be blinded by science - should have no qualms about shutting down activities they do not understand. We shouldn't need another warning.” Cf Revisiting the Swiss Cheese Model of Accidents.
[USA Today] – Alan Greenspan … was "shocked" to discover, as a once-in a-century financial crisis spread, that his bedrock belief that financial firms could police themselves turned out to be "flawed."
"I made a mistake in presuming that the self-interests of organizations, specifically banks and others, were such as that they were best capable of protecting their own shareholders and their equity," "… a flaw in the model that defines how the world works."
Hopefully not an epitaph for aviation SMS and devolved regulatory oversight.
alf5071h
While there is a lot of good words in what you wrote, I do feel that it is too wordy and reaches too far in comparison with a well regulated system such as aviation with a far less regulated trust me approach of the financial sector.
The issuer of the MEL does have a responsibility to assume a degree of other errors. Typically a probabilistic approach should treat this based on experience with all known faults in asimilar machine. However such assumptions can not imagine statistically improbable combinations of human error where no such subtantiated reports have been presented from history.
Of course I am not privy to all the facts surrounding this latest accident still under investigation. But I am drawn to the so called newly released NASA data suggesting that numerous incorrectly configured aircraft takeoffs have been attempted and some even in the presence of failed TOWs systems.
Is this the failure of a system by itself? or is this a failure of communication between the user and the MEL writer.
I'm not ready to discect this further at this time because I don't even know if the MEL writer or Span Air had any idea of the results of the NASA study beforehand. Sometimes safety related studies are kept even private from the manufacturer and the users.
While there is a lot of good words in what you wrote, I do feel that it is too wordy and reaches too far in comparison with a well regulated system such as aviation with a far less regulated trust me approach of the financial sector.
The issuer of the MEL does have a responsibility to assume a degree of other errors. Typically a probabilistic approach should treat this based on experience with all known faults in asimilar machine. However such assumptions can not imagine statistically improbable combinations of human error where no such subtantiated reports have been presented from history.
Of course I am not privy to all the facts surrounding this latest accident still under investigation. But I am drawn to the so called newly released NASA data suggesting that numerous incorrectly configured aircraft takeoffs have been attempted and some even in the presence of failed TOWs systems.
Is this the failure of a system by itself? or is this a failure of communication between the user and the MEL writer.
I'm not ready to discect this further at this time because I don't even know if the MEL writer or Span Air had any idea of the results of the NASA study beforehand. Sometimes safety related studies are kept even private from the manufacturer and the users.
lomapaseo;
I have to say I'm 100% in agreement with alf5071h in an examination of common factors in both "accidents", (if you will).
I say this because done improperly, (under-resourced, data ignored, lack of coordination and/or honesty with POI), SMS is the de-regulation of safety - it is handing over monitoring and self-governing processes to those who's interests are contrary to conservative, (regulated, overseeing) approaches to flight safety.
The processes are exactly the same. Certainly the details, complexities, risks and outcomes are different but the principles are the same: When no one is watching management will compromise, cut corners, attempt to make the organization look good with candy-coated safety-board reports, ignore the warnings from FOQA/FDA, ASR and other safety programs in favour of commercial, profit-oriented/cost-controlling priorities.
It is not a matter of what Diane Vaughan called "ammoral calculation" - an intentionally-negligent act by management. The processes under the de-regulation of safety "feel" and "seem" natural and sufficient such that the notion of "compromise" does not even arise in the safety dialogue or if it does, the "deviance is normalized" to the point where it is acceptable.
Three main factors, (I know you know/understand this...I'm writing for all readers), are at work as the "new" standard is entrenched as "normal": Time, new managers with little/no experience (plus bean-counter pressure) and "success" - the "new, lowered standard has not resulted in a reduction in safety". Ignoring safety data or at least dismissing it as "suspect" provides comfort to such processes.
In terms of finance, all these factors were at work prior to the current world economic crisis and, in principle, they are at work at airlines right now - I have seen them, (and the consequent commercial decision-making), first-hand and have asked why FOQA data was ignored. The question itself was ignored and nothing has changed.
The factors and the pathways are as clear as a brightly-lit road and it was a matter of time until the sub-prime crisis back-flushed into the banks and out onto the streets. As we know, the seeds of aircraft accidents are similarly sown months and more likely years before the accident.
"Kiting" financial instruments is illegal for individuals but America's corporations and banks do it all the time with impunity. In flight safety work, "kiting" equates to finding compromise within the legal documentation such as the MMEL and the SMS audit process such that the operation may continue without apparent risk, all the while such risk laying buried in a stream of seemingly rational operational decisions.
The difference between the causes of this financial collapse and the increased potential for an accident under SMS is a matter of degree, not principle. Historically speaking, the roots of the present crisis may be found in "neoliberal" economics from about 1970 onwards where de-regulation, privatization of profit and socialization of risk which has morphed into the mad drive for pure profit at the expense of all sound financial principles. Nixon withdrew the US from the Bretton-Woods agreement, under tremendous pressure from corporations, in 1999 Clinton repealed the Glass-Steagall Act of 1933 which permitted banks to engage in currency speculation among many other non-traditional banking activities and to create "value" through loans and home purchases by those who couldn't afford it.
Though not in the same league or playing field, these processes equate directly with SMS's first principle with is self-regulation, self-auditing and an absent regulator. We already have seen the results in the US in the FAA's "difficulties" when it's oversight of Southwest, United and other airlines was found wanting.
In my view, these similar principles will lead to similar outcomes - that's all that's being stated, not that Transport Canada is going to listen or change course and not that any airline is going to listen. To me and obviously to others, there are significant lessons for the airline industry both in Canada and the US from the greatest financial crash since 1929 and I think alf5071h hit the nail on the head.
I have to say I'm 100% in agreement with alf5071h in an examination of common factors in both "accidents", (if you will).
I say this because done improperly, (under-resourced, data ignored, lack of coordination and/or honesty with POI), SMS is the de-regulation of safety - it is handing over monitoring and self-governing processes to those who's interests are contrary to conservative, (regulated, overseeing) approaches to flight safety.
The processes are exactly the same. Certainly the details, complexities, risks and outcomes are different but the principles are the same: When no one is watching management will compromise, cut corners, attempt to make the organization look good with candy-coated safety-board reports, ignore the warnings from FOQA/FDA, ASR and other safety programs in favour of commercial, profit-oriented/cost-controlling priorities.
It is not a matter of what Diane Vaughan called "ammoral calculation" - an intentionally-negligent act by management. The processes under the de-regulation of safety "feel" and "seem" natural and sufficient such that the notion of "compromise" does not even arise in the safety dialogue or if it does, the "deviance is normalized" to the point where it is acceptable.
Three main factors, (I know you know/understand this...I'm writing for all readers), are at work as the "new" standard is entrenched as "normal": Time, new managers with little/no experience (plus bean-counter pressure) and "success" - the "new, lowered standard has not resulted in a reduction in safety". Ignoring safety data or at least dismissing it as "suspect" provides comfort to such processes.
In terms of finance, all these factors were at work prior to the current world economic crisis and, in principle, they are at work at airlines right now - I have seen them, (and the consequent commercial decision-making), first-hand and have asked why FOQA data was ignored. The question itself was ignored and nothing has changed.
The factors and the pathways are as clear as a brightly-lit road and it was a matter of time until the sub-prime crisis back-flushed into the banks and out onto the streets. As we know, the seeds of aircraft accidents are similarly sown months and more likely years before the accident.
"Kiting" financial instruments is illegal for individuals but America's corporations and banks do it all the time with impunity. In flight safety work, "kiting" equates to finding compromise within the legal documentation such as the MMEL and the SMS audit process such that the operation may continue without apparent risk, all the while such risk laying buried in a stream of seemingly rational operational decisions.
The difference between the causes of this financial collapse and the increased potential for an accident under SMS is a matter of degree, not principle. Historically speaking, the roots of the present crisis may be found in "neoliberal" economics from about 1970 onwards where de-regulation, privatization of profit and socialization of risk which has morphed into the mad drive for pure profit at the expense of all sound financial principles. Nixon withdrew the US from the Bretton-Woods agreement, under tremendous pressure from corporations, in 1999 Clinton repealed the Glass-Steagall Act of 1933 which permitted banks to engage in currency speculation among many other non-traditional banking activities and to create "value" through loans and home purchases by those who couldn't afford it.
Though not in the same league or playing field, these processes equate directly with SMS's first principle with is self-regulation, self-auditing and an absent regulator. We already have seen the results in the US in the FAA's "difficulties" when it's oversight of Southwest, United and other airlines was found wanting.
In my view, these similar principles will lead to similar outcomes - that's all that's being stated, not that Transport Canada is going to listen or change course and not that any airline is going to listen. To me and obviously to others, there are significant lessons for the airline industry both in Canada and the US from the greatest financial crash since 1929 and I think alf5071h hit the nail on the head.