Report?
 

Copy of a message I just posted in another forum:
1. Accidents are devastating to those directly involved and costly to many others.
2. Accidents should be prevented ahead of time by proper operations risk management (ORM).
3. Accident investigations should be performed professionally, and their reports written such that the knowhow obtained is useful and properly communicated to prevent them from recurring.


I am writing the following with a background including chairman of air accident investigation boards, authorized investigator of a certain state CAA, and have completed US postgraduate technical report writing studies.
4. Without prejudice, the report is written such that it deviates from what I view as acceptable standards in this important line of business. In doing so it is my impression that it fails to pass a clear message to decision makers. A proper format of accident report is for example used by the US Dept. of Transportation NTSB.
5. Excuse me for not reading throughall of it, a decision maker needs to read the main conclusions and recommendations in a one page introductory summary. I closed the report on page 7 and might have missed some info.
BUT- the inverstigation in my humble opinion failed to pinpoint the primary cause of the accident. The primary cause of the accident was the failure of the crew to make a safe approach to landing, while flying with a failed RA. A main secondary contributor to the accident is the RA system failure, but the RA or the AFCS isn't the captain, whose primary responsibility I mentioned.
6. This adds to a number of essay messages I wrote about cockpit automation problematics.

"5. Excuse me for not reading throughall of it, a decision maker needs to read the main conclusions and recommendations in a one page introductory summary. I closed the report on page 7 and might have missed some info."

[ ] Makes sense
[x] Fail

Opherben : Something is not quiet right here.. because I read many accident reports since many years , and this one is very good I'd say.
Again, if you are who you claim you are and you do not read it through, who else will ? and how can you state that its contents are not acceptable standards if you did not read it all ?

To Opherben
 

As an experienced investigator, then, you should know that not all investigation agencies, including some of the world's most respected, and no researchers into causality of accidents whom I know, think an assignment of "primary cause" is appropriate.

Indeed, all those professional researchers researching failures and accidents causally whom I know consider that most accidents result from a conjunction of many causes.

There are many ways of selecting one cause to "put on a pedestal". My view is that, if one wants to do this, one should explain and justify one's selection criteria in the report.

I know the senior researcher, who has a world-wide reputation, who prepared the human factors report on this accident. I regard the insights in his report as very high quality, and some of those insights made it into the final report.

It will be obvious to you, having admittedly read only what we might call the "Executive Summary", that the investigators were reporting on all the safety issues which they found, not just those which were causally related to the accident.

PBL

Primary cause, probable cause, etc. etc. confuses many readers. However it does not confuse safety professionals (who read right by those words). The meat in a report is the linkage of the contributing facts with recommendations for prevention.

In my initial read of the posts above I sensed that the words "primary cause" was simply assigned to the last link in the chain of swiss cheese.

In other examples of the use of the words, it might refer to the most effective link in the chain to assign preventive action that addresses other combinations as well.

Hi,

Emphasis put on experts (what some are telling or how they tell) .. not about another accident ..
This expert have the idea that witnesses accounts are peanut for a investigation.
So when this expert begin a investigation work he have already some prejudice who will give a orientation to the investigation (get rid of the witnesses accounts)
Was about this message:

Of course if one of you can produce a better translation than Google .. this is welcome.

If that is so in the environment in which you work then I envy you.

Most safety professionals, not necessarily those in aviation, analyse mishaps with techniques such as «Root Cause Analysis», which is,
as Wikipedia suggests here, a collection of techniques (I would put «techniques» in quotes; I don't think much of most of them). Take a look at what Wikipedia says are the «General Principles of Root Cause Analysis»:
Notice in particular Item 3: there is "one true root cause".

(I will spare the forum another few hundred references, since most can use Google.)

And, most obviously, opherben, who self-identified as an aviation safety professional, didn't «read right by those words» either; indeed, he suggests they are very important! I think you will also find investigators at the NTSB who think there is such a thing as a «primary cause» sitting in the facts of the matter, rather than in their own selection procedures.

And if you look back at the discussion in this very forum, you will find Contributor A talking about the pilots not minding the store and saying «that is the real issue here», and Contributor B talking about the anomalous behavior of the autothrust as a consequence of a single point of failure, and proposing that as the «real issue». And A and B are thinking they are disagreeing with each other. The most obvious way of interpreting that disagreement is that each thinks heshe is proposing his selection as «primary».

So I don't buy your contention that people «read right by those words».

Just to be clear, I don't think there is anything inherently wrong with focusing on one, or a few, causes. Indeed, I sometimes think it is necessary. When talking to the airline, for example, I would likely have more to say about crew behavior than I would about automation behavior, for obvious reasons (connected with your second selection criterion below). But, as I said, when one does so it is important to make one's selection criterion explicit.

That is just one way of selecting the «meat». For many of the people who deal with accident reports, including insurance companies and their lawyers, the «meat» in a report is anything which allows responsibility to be proportioned amongst those involved in the accident. Although some investigators claim this is anathema to them, a greater proportion of investigators work on this very function. Indeed, this is a very important social function, for international agreement specifies that the airline is strictly liable for any accident. When, say, features of the airport, or the air traffic control environment, or the aviation system, or the airplane, are causally involved then many people would argue that the cost should be apportioned amongst them, and indeed this is what is done. Who thinks that Bashkirian should pay the entire cost of the Überlingen accident, when the investigators have identified failures in the sociotechnical system of air traffic control, as well as inconsistencies in the various applicable guidelines of how TCAS is to be used? No one I know.

Yes, those are two different ways in which one might assign a meaning to «primary cause». Best to be explicit about which one one might be using, no?

Your first criterion, though, runs into a problem. If one uses the «Swiss Cheese» model, then it might be tempting to think, as apparently you do, that the layers are ordered, so that there is a «last» one. But I don't think Jim intended them to be ordered. It is just an artifact of the picture. Indeed, the ATSB used the «Reason Model» for well over a decade, and they neither pick a «primary cause» nor linearly-order the causal factors.

If one uses the Rasmussen Accimap model, as the ATSB now does, the causes are divided into classes, but they are not ordered. They are also not ordered in the Rasmussen-Svedung approach which Leveson uses in STAMP (used by NASA). Every level in STAMP is modelled as a feedback control system, and causal factors are identified (I put it crudely) as missing feedback loops. Neither are factors ordered in the SHEL model. They are not linearly ordered in Why-Because Graphs (used by Siemens RA and MT) either, although they are partially ordered.

Where they are ordered in is Layers of Protection Analysis, used in the process industries. That is because one works there with inherently dangerous behavior (stuff at high temperatures and pressures, and reactions, which is why in these domains one defines an accident as «an uncontrolled release of energy») which is mitigated using specific added protection functions, so it fits with the system architecture. That is not the way things are in transportation accidents. No one uses LOPA there.

Concerning Would that this could be done. It is a research problem to find a way of doing this systematically. I know a very large engineering company who has been trying to do it for almost a decade. They haven't solved it; I don't know whether they have given up.

I won't respond in this forum to any reply. I am very happy to continue discussion of these issues, with you or anyone else interested in them, but please rather by email than here. I am no PJ2 and don't want to be the target of responses such as those of jcjeant to my comment.

PBL

Unfortunately:
 

Three universal root causes:

The airplane was invented by humans.

The airplane was designed and built by humans.

The airplane was operated and maintained and managed by humans.

Yes I know, the investigator tries to be more specific, and variables such as the state of the art are considered. But aren't the above comprehensive?

An item in today's Wall Street Journal on NTSB criticism of the draft report . . .

Safety Board Slams Dutch for Airline Crash Report - Washington Wire - WSJ

Safety Board Slams Dutch for Airline Crash Report - Washington Wire - WSJ

A draft report is just that: a draft. The NTSB should not be making ridiculous public statement about such a thing. If find it very positive that the Dutch ask for input before publishing the final report. A good example of resource management, I would say! :ok:The Dutch board even included an appendix B into the final report, where you can find the comments and suggestions made by the concerned parties and why (or not) these comments were incorporated in the final report.

I think that the final report is a very nice and well made document resulting from a synergy off all parties involved.

off-topic: looking forward to the accident report from the Lybian safety board about the Afriqiyah crash in Tripoli.... :}

Absolutely Sabena Boy, I also find this "Dutch" apppoach to accident reporting very healthy . A good report .
me too, with the French BEA in charge , Afriqiyah having 23 Airbus orders on the pipeline, and with Lybian leaders being very sensitive to their National pride, the final version will be an interesting read !

Cause or contribution
 

The objective of accident reports is to prevent future accidents or incidents, not for academic interest, lawyers, or insurance.
Primary cause etc, might make easy reading for the ‘decision makers’, but does not provide the ‘sharp end’ with an effective means to maintain / improve safety, i.e. what do we have to fix (why), and how.
This report and that for Congonhas, are above average (even if they are difficult to read); Congonhas has greater practicality due to the discussion of human factors (although this was not factual evidence) and that the recommendations aligned with the contributions.
In comparison, the Buffalo report might be more readable, but I doubt that it will have the same effectiveness as the other two. The object is not just to prevent a repeat of the reported accident; it’s the prevention of future ones which should dominate our thoughts.

James Reason provides this view of the elements in accidents (The Human Contribution).

• Universals: the ever present tensions between production and protection.
• Conditions: latent factors that collectively produce defensive weaknesses.
• Causes permit the chance conjunctions of local triggers and active failures to breach all the barriers and safeguards.

“The Universals and Conditions are ubiquitous (ever-present). Only the local events are truly causal and make the difference between this accident and all the other organizations that remain accident free.
So what are the conditions …. tools and equipment, safety culture, design and construction, workarounds, management and supervision … ”.

Most if not all of Reason’s Universals and Conditions can be found in the ‘contributions’ of accident reports. Concentration on ‘cause’ ultimately leads to a solution of ‘not being there’ just to avoid an accident, which is self-defeating and impracticable. However, focus on contributions, the links, and variability in these, provide everyone with a means of improving safety.

Reason’s solution requires checks on the ‘vital signs’ of an operation (SMS?). IMHO this is not a process of analysis of what can / has to be changed; instead there is a need to look at what has changed – the contributions in accidents and the links between them.
Ask what has been overlooked, what has gradually changed and become the norm, what has been accepted as routine, except that it should not be routine.
Many of those small and insignificant changes are the contributions listed in accident reports. These everyday norms are not the ‘cause’ of accidents, but they are the weaknesses in our safety defenses.

Sooo, the big fix is a new aural alert? If you need to have the airplane scream at you that you are low on speed do you really belong on a flightdeck?

Denti asks a good question. If I may "ponder out loud" on his thought ...

If the aural alert goes off during a time when the crew is close to task saturation, particularly tasks heavy with comms/hearing/talking, will an added aural input likely to be edited out, left in the background noise, or pushed to the front of the line for cues to perform an unplanned action?

Why do I say unplanned?

The fraction of a second before the aural cue goes off, the crew are doing something else, and taking other actions (some of them possibly wrong or in wrong priority) when the cue to "do something else" arrives.

If the core problem is that of getting behind the aircraft, and having to catch up, are you as likely to respond to the alert with unsuitable action as with suitable action?

Does this not point to training and proficiency? :confused:

I hate Aural alerts!
When your brain is over loaded you don't hear them.
Maybe just looking at the instruments is a good start.:rolleyes:

I read the report, a few months back.
And all the time, there has been a uncomfortable feeling lurking in the back of my mind. And it is all about ONE word, one key word, that I found in the report:

HOCAM....

You can find it in the CVR transcript, on numerous places. Apparently it means "instructor" in Turkish, and it is used by the two other pilots on the flight deck whenever they had something to say to their captain. And they never used any other name/title/word to get something across.

To me, that smells like a very, very steep cockpit gradient. one Hocam and two zero's.

But it doesn't end there, unfortunately. The report looks pretty complete, exept that it does not adress this "little" problem. Why not? Is it too sensitive? Some sort of Pandora's Box?
Are the Dutch investigators too afraid to include it in the report?

Remember that the Netherlands is a society that thrives by means of concensus-building. I am a Dutch citizen myself and I know what "damage" it can do. --> Just keep on talking until everyone can be sort of happy with some part of the report.
This is the essence of Dutch politics/problem solving, but it does mean that an investigative report might not include everything that should be in it.

fox niner,

You have a point there, but I'ld like to defend the investigators by asking the rhetorical question: how much speculation should be allowed into accident investigations?
In my opinion, the best lesson for the co-pilot would have been a go-around at 1000ft: "You're not ready with your checklists, try again!" Why that didn't happen, steep cockpit gradient and airline procedures (only the captain can decide to abort approach) played a part. Crew error, yes.
However, I still have doubts about whether the captain was aware of his altitude (that radar failure ment he lost an instrument.)

The radio altimeter indication was not a failure, as in flagged invalid, but erroneous altitude with no indication it was invalid. That is quite different, and most disturbing.

Engineers at the airframes and component manufacturers go to great lengths to avoid erroneous indications. It's calculated to be on the order of ten to the minus ninth for Cat III autoland.

I'm not intending to excuse the crew for stalling the plane, but pointing out in this case the hazard of avionics with undetected failures.

GB

The <root cause> is pretty simple...
 

The plane hit the ground because it was going to slowly. Since there is a guy in the pointy end generically identified as the "PF" who was functioning as a "PP" {pilot passenger} things went south. The rest of it is secondary since a proper scan would have easily identified the decaying speed.

Lonewolf is absolutely correct in pointing out the fallacy of adding yet more bells and whistles to a cockpit where bells and whistles are already sounding.

The radalt problem really has only one involvement in this accident - it is not normally 'in scan' on the sort of approach being flown there and thus not noticing the 'invalid' indication is quite understandable. Its involvement was the 'secondary effect' of commanding throttles closed. An a/c with a defunct radalt is so easily flyable, safely and efficiently.

The focus on preventing this accident from recurring is, in my opinion, to focus on training and the quality of the training personnel and system. The Dutch may not say it but as I see it the TC failed badly in his duties and that is where 'repair' is needed. I suggest forgetting about software and automatic systems and concentrating on the 'pink bits' is the priority.

We need to address also the point of having a 'safety pilot' on the flight deck - was he there merely to satisfy a regulatory requirement or was the 'C(ockpit)RM' being properly addressed?

Although now semi-retired I do have many thousands of hours on most versions of the 737 (in both seats) and have also been a simulator instructor on the type. Additionally I have observed a simulator session with THY and was horrified by what I saw. It reminded me very much of the unfortunate 747 freighter accident at Stansted some years ago- a relatively minor aircraft technical problem exacerbated by a complete lack of modern CRM thinking. Unfortunately THY still have a long way to go to get rid of the problematic ex-military dominance still prevalent in many airlines. Other comments can be found on Pprune from expatriate pilots echoing my experience after working for the airline.
IMHO one of the main reasons for the dramatically improved safety levels of European and US airlines has been the acceptance that ALL crew members are fallible no matter what their previous experience. It took many disastrous fatal accidents to break down the historical subservience of co-pilots and (where applicable) flight engineers.
THY along with other airlines from that part of the world still suffer from a dominance by ex-military pilots and only time will erode this problem. The current drive to employ ex-patriate pilots and instructors may (hopefully) improve matters.
In the simulator session that I observed there were no checklists available and apparently little cockpit discipline- as regards who did what and when! I was reminded by one of the crew that the PF was an ex military test-pilot.(So what?) Mobile phones were even answered during the session!
Much has been said on this and other threads about low hour pilots from approved training establishments in Europe. I consider myself fortunate to have flown with many of these people and their deeply engrained professionalism demonstrated has always impressed me. Unlike pilots of my generation who often came via a self-funded and rather chaotic route these guys have been trained in the correct way of getting the job done right from the outset. Their experience levels are, of course, low but they generally have few bad habits to get rid of and absorb new knowledge like sponges. Given the choice I would much rather share a cockpit with one of these guys (or girls) in preference to a high hour,disgruntled ,by-passed alternative!
Stall recovery is something that is routinely taught in all the Boeing approved courses and disconnection of the auto-throttle is often done (although it was not actually stipulated in the Boeing manual). There are no bans on disconnection at any time and this ensured that one was not going to have to maintain a hand on the thrust levers during the recovery manoeuvre. THY seem to be trying to claim this as an excuse for the resultant full stall of the aircraft. As other contributors have pointed out- recovery from the stick shaker on any 737NG is extremely easy because of the enormous amount of available thrust and the relatively rapid response rate of the engines (c.w the old JT8s on the 100/200 versions).
Another very common fault I have observed on simulator training is excessive trust in the A/T! (“look no hands!”) Boeing have re-iterated this recently- a hand MUST be kept on the thrust levers throughout any coupled approach. Unlike the Airbus –all Boeings have continuous feed-back to the thrust levers (even on the FBW 777 and 787) which means any significant thrust command changes can be sensed from the levers.
Schipol abbreviated approaches can be somewhat stressful at times if the crew are not familiar with them- as a result of requests to maintain speed and then join the G/S from above -but there is ALWAYS the option of a go-around. With three people in the cockpit it seems amazing that no-one reacted to the speed loss until too late. An immediate recovery from the shaker is easy but once approaching the full stall the now reduced elevator response combined with the pitch-up effect from full thrust makes things much more problematic! That is why we ALWAYS teach recovery at the stick shaker!

Here's the TK1951 Human Factors Report, written by Sidney Dekker for the Dutch Safety Board. Very interesting!

The Dekker report is excellent. Looks like Boeing had better own up to being responsible for this one. This was an 'Automation Surprise'.

By the time the stick shaker activated-it was too late to save.

About the only thing that a cautious pilot could reasonably be expected to do is dirty up a bit sooner so that the final minute was not so rushed. That might have helped save the day.

Both Dekker's and the OVV's reports lean towards the crew not being fully aware of the actual mode of the Autothrottle yet there is no recommendation to fix this problem. Having two modes with same name is not the brightest of ideas. Given the data in the report I would have recommended a Rad Alt comparator (for all aircraft), documentation revisions to describe Autothrottle functionality during the flare and lastly renaming the RETARD mode of the Autothrottle. Rename RETARD (descent) to IDLE. Or even be really ridiculous and rename the RETARD (flare) to BANANAS. Yes, something stupid in flight!

Until we replace the Mk I human being we will continue having to train crews to operate imperfect systems in an imperfect world. Systems have to be designed that help (or warn) them when they make human errors, omissions or try to just plain cheat the system.

PM

2767 posts later it has to be said the Dekker report is comprehensive indeed, although at times I did wonder if it was sponsored by THY such is the unstinting praise for their training.

Finally, there is a world of difference between doing everything by the book, and a nation adopting the mentality required to implement this on a daily basis.

The Training Capt does not at least appear to be portrayed as an overbearing person, a pleasant surprise given what I have seen of some of his ilk in turkish companies, but I do wonder just how comfortable the other two crew would have felt calling for a go/around.

That unfortunately is more a fault of lingering cultural issues rather than the individual sat in the left seat in this particular case, and my personal experience unfortunately is that many RHS occupants in Turkish companies would let you crash the mothah rather than challenging you.
Unbelievable, and sad indeed for the 21st century, but unfortunately true.
As many suggested from day1, a slightly too smartly orchestrated AMS rushed approach with a maxed out FO and 3 guys none of whom was really minding the stove.

One could argue harsh maybe, but at the risk of being simplistic I would suggest merely succint and to the point.

Report says ...

Quotes from the Dekker Report
 

Isn't the crew supposed to make up for such shortcomings by monitoring what's going on. Every aircraft has shortcomings for which the crew must compensate. Otherwise, why have a crew? :ugh:

Then, what does it do? Teach them to play PacMan? :ugh:

Cwatters-from the Dekker report:
I am a great fan of Mr Dekker however.....
They were doing the landing checklist when the airspeed mousetrap was sprung. If that checklist had been done already, they would have been watching the mouseholes for problems.
The Captain was keeping the FO in the ballpark for a normal approach, but there was no reserve for the unexpected.

Smilin_Ed
I'm not so good that I can't be caught by the right mousetrap, are you?

An interesting report...

However, I disagree with the basics of attributing solely the accident to the automatics failing. Have we really got to the stage where an ATHR fault, on final app, can cause the airspeed to fatally decay, and absolve the crew?

Our (Airbus) FCOM is clear that the crew must monitor the ATHR performance, and disconnect it if it fails to maintain the selected speed.

It depends on the definition of a "rushed approach". In our company, a "rushed approach" is one where the 500' stabilised approach criteria are not met. In this case they were not - approach power was not set and the speed not correct. Depending on company SOP, had the crew checked the parameters at 1000'/500' against their requirements, the error would have been apparent.

NB in some SOPs the "NHP" is actually "PM". In this case, there was a 3rd pilot specifically to make up for a potential shortfall in "monitoring".

As ever, lessons for all to take on board. But I stand by my assertion that a failure of an AP or ATHR system does not absolve the crew :ooh:

NoD

At the beginning of the report is the following quote:
Does anybody know if the lines in the MEL that require the rad alt breaker to be collared and the A/T not to be used for approach or landing were added after the incident?

I might point out that Sidney's HF Report does not attribute any cause. It lists "Findings".

Only a final accident report atttributes probable cause(s). The final report on this accident did not attribute the accident "solely....to the automatics failing".

PBL

I agree with NigelOnDraft about the importance of the stabilised approach and have pointed out several times e.g. post 2572 almost exactly one year ago that this approach did not meet the usual criteria. There are plenty of other contributory factors. But as a trainer on the 737 this accident is the perfect demonstration of why being spooled up at the latest at 1000 feet in IMC is important.

All it boils down to, after 139 pages, is that you are the driver, you make the difference - nobody else. Don't blame the autopilot or -throttle, the ramp guy waving into a too narrow parking spot or whatever. It's you - you get paid for monitoring what your airplane is doing. No minor component failure should bring you down, in theory.

And it's also important how you deal with human errors, because: they will happen again. Even to 'hocams'.

I once met a chief surgeon who was said to have been responsible for the death of a patient because he removed the wrong (= good) kidney instead of the right (= bad) one... He wasn't proud about it, but he never made a secret about it either and let others learn a lesson from his screw-up. I take my hat off for this way of dealing with a terrible failure.

Was he turkish?

In my company, the MEL was revised with the non-use of associated A/P and A/T about a year after the accident, so chances are THY did not have that restriction at the time.

- there before

PBL

Agree - the line of my post you quote actually refers to other posts e.g. NoD

Thanks BOAC,

That is how I recall it but wasn't sure. In which case the report is fundementally wrong. The documentation and training available to the 737 pilots was sufficient as it clearly identified the A/T as unusable for the phase of flight. The Boeing DDG is a horrid manual that often requires careful reading, but in my opinion not in this case.

Sciolistes

In your post above are you implying that:

1. If LH Rad Alt is Inop then ATHR should be disabled as per MEL (as BOAC posted)
2. Because this is in the MEL, then it should have been clear (?) / known (?) to the crew that the LH Rad Alt going offline would cause ATHR issues?

I might have missed your point, but if it is as above, I would tend to disagree, on the following lines:

1. No "knowledge" of the MEL is required IMHO. Just "how to use it" when appropriate...
2. There is no requirement to conslt the MEL after dispatch in the event of a failure... Might be good practice if there's lots of time, but clearly N/A here.
3. My experience (recently Airbus) is that some MEL requirements are not "logical", even when the remaining FCOMs are consulted... and hinting (as here) to areas someone / somewhere has decided crews do not need to know (a line has to be drawn somewhere)

NoD

NoD,

Sorry, I wasn't aware that BOAC already raised this point earlier in the thread so I don't want to trawl over old ground again and my post was clumsy as the report clearly states:

Carry on :O