1

O N C O M M E R C I A L A V I A T I O N S A F E T Y

ISSUE 48 THE OFFICIAL PUBLICATION OF THEUNITED KINGDOM FLIGHT SAFETY COMMITTEE ISSN 1355-1523

AUTUMN 2002

Making Every Mission Possible

Jeppesen continues to set the standard for

accurate and up-to-date flight information. We

are leading the way with innovative digital

charting solutions that can give your operation

distinct advantages in performance, safety, and

overall effectiveness.

Whether you use JeppView, JeppView FliteDeck,

or our digital charts in an integrated avionics

system, our goal is to provide you the highest

level of convenience and capability now and in

the future.

When it comes to mission critical flight

information, it’s nice to know you have

Jeppesen OnBoard.

chartingcharting

new courses.new courses.

For more information aboutJeppesen digital charts

visit us on the internet atwww.jeppesen.com

or call us:

1-800-621-5377or 303-799-9090

(Western Hemisphere)

+49 6102 5070(Eastern Hemisphere)

+61 3 9706 0022 (Australasia)

DigitalChartingSolutions

The Official Publication ofTHE UNITED KINGDOM FLIGHT SAFETY COMMITTEE

ISSN: 1355-1523 AUTUMN 2002 ON COMMERCIAL AVIATION SAFETY

contentsEditorial 2

Chairman’s Column 3

Preventing Hard Nosegear Touchdowns 4

Level Busts – ACEing the hazard 8

Safety Culture: The Ultimate Goal 12

Professor Patrick Hudson

Book Review 15

CRM: Celluar Resource Management 15

What to do about Maintenance Error Incidents? 16

Wg Cdr Dave McCormick

Safe and Sound 20

Merran Williams

On Track – Pushing your ideas forward 22

and looking for more!!

UKFSC Members List 24

FOCUS on Commercial Aviation Safety

is published quarterly by The UK Flight Safety

Committee.

Editorial Office:

Ed Paintin

The Graham Suite

Fairoaks Airport, Chobham, Woking,

Surrey. GU24 8HX

Tel: 01276-855193 Fax: 855195

e-mail: ukfsc@freezone.co.uk

Web Site: www.ukfsc.co.uk

Office Hours: 0900-1630 Monday-Friday

Advertisement Sales Office:

Andrew Phillips

Andrew Phillips Partnership

39 Hale Reeds,

Farnham, Surrey. GU9 9BN

Tel: 01252-642695 Mobile: 07836-677377

Printed by Woking Print & Publicity Ltd

The Print Works, St.Johns Lye, St.Johns

Woking, Surrey GU21 1RS

Tel: 01483-884884 Fax: 01483-884880

ISDN: 01483-598501

Email: wokingprint@compuserve.com

Web: www.wokingprint.com

FOCUS on Commercial Aviation Safety is

circulated to commercial pilots, flight engineers

and air traffic control officers holding current

licences. It is also available on subscription to

organisations or individuals at a cost of £12

(+p&p) per annum.

FOCUS is produced solely for the purpose of

improving flight safety and, unless copyright is

indicated, articles may be reproduced providing

that the source of material is acknowledged.

Opinions expressed by individual authors or in

advertisements appearing in FOCUS are those

of the author or advertiser and do not necessarily

reflect the views and endorsements of this journal,

the editor or the UK Flight Safety Committee.

The mention of specific companies or products

in articles or advertisements does not imply that

they are endorsed or recommended by FOCUSor its publisher in preference to any others.

1

UK FLIGHT SAFETY COMMITTEE OBJECTIVES

■ To pursue the highest standards of flight safety for public transport operations.

■ To constitute a body of experienced aviaition flight safety personnel available for advice and consultation.

■ To facilitate the exchange of urgent or significant flight safety data.

■ To maintain a liaison with all aviation authorities on matters affecting the safety of the flight-crew, ground-crew, the aircraft

and passengers.

■ To provide advice and assistance to operators setting up a flight safety organisation.

Editorial

2

Taking Advantage of Aviation Expansion in the UK

The recent announcement by theMinister for Transport that additionalrunway capacity will be provided in theUK and in particular in the South East ofthe country has been greeted with greatenthusiasm by the aviation industry. Bycoincidence the Freedom to Fly NationalConference 2002 was held on the 24thJuly, the day following the announcementby the government.

Commercial organisations are alwaysenthusiastic about an opportunity to makemore profit, after all, that is what businessis all about. The chance of expanding thebusiness does not present itself all thatoften and if the United Kingdom is tomaintain its position as the gateway toEurope then there is a real need to graspthis opportunity with both hands.

Wherever the new runways are to be builtthere is going to be a need for animprovement to the infrastructure. We cannot expect the existing infrastructure tocope, most of it is already working atcapacity. Road and rail links, terminalbuildings, hangar, and otheraccommodation will need to beconstructed. This is all good for theeconomy and job creation will bewelcomed by many but think for amoment about the following issues.

The environmental lobby has over theyears become very active and the delayin the construction of Terminal 5 atHeathrow is proof of how they slow downnew developments. Every environmentalactivist in the country will be jumping onthis bandwagon.

The national railway infrastructure iscurrently in a less than good state and willbe expected to provide resources to buildnew railway lines and facilities at any newor currently un-serviced sites chosen. Ifthis work is contracted to privateorganisations they will have to recruittrained staff. Where will they come from?Will this requirement draw staff from theexisting railway organisation? Who willtrain new staff if recruited?

More runway capacity inevitably meansmore aircraft operating in our airspace.This will require additional air trafficcontrollers. We are told that there isalready a shortage of trained andexperienced air traffic controllers and thatthe recruitment of new staff is not keepingpace with the current demand. Where willthe additional staff be found and wherewill they be trained?

The downturn in passenger trafficfollowing the 11th September 2001disaster meant the airlines and supportingservices shed staff in order to try tobalance their books. These folk have bynow found work in other industries andare unlikely to return to aviation becausethere is an upturn in the industry. Who isgoing to train additional aircraft engineersand supporting ground staff?

Adopting a positive attitude to thispotential expansion is very necessary andcould well have a long term affect on thefuture of aviation in the UK. It doeshowever require both the government andthe aviation industry to play their part inthis complicated process.

Firstly, we need to see the governmentprovide the necessary infrastructure forthe development of the selected areas. Tothis end there will be a very real need forit to exercise its so called “joined upthinking” so that all the involveddepartments plan adequately and delivertheir promises on time and to budget.Recent history has shown that we willneed to try much harder if we are toachieve this.

Secondly, there is a need for theoperators and service providers includingair traffic control to ensure that they trainsufficient people, to the correct standard,in a timely manner in order that we cantake advantage of this opportunity. Thismay mean that operators take a moreactive role in staff training of their serviceproviders. Failing to do so would meanthat the United Kingdom would lose its“Gateway to Europe” status and thebenefits that accrue from it.

UK FLIGHT SAFETY COMMITTEE OBJECTIVES

■ To pursue the highest standards of flight safety for public transport operations.

■ To constitute a body of experienced aviation flight safety personnel available for advice and consultation.

■ To facilitate the exchange of urgent or significant flight safety data.

■ To maintain a liaison with all aviation authorities on matters affecting the safety of the flight-crew, ground-crew, the aircraft

and passengers.

■ To provide assistance to operators setting up a flight safety organisation.

Chairman’s Column

3

Conflict

“The Russians were at fault” was theinitial speculative response of the mediaand the aviation “experts” to the tragicevents over Southern Germany on 1st July2002. The loss of 71 lives in the mid aircollision between the DHL Boeing 757 andthe Bashkirian Airlines Tupolov Tu 154 wasa stark reminder of the complexity andvulnerability of the aviation safety chain.As the professional Air Accident Inspectorsmoved in and began their task of siftingthrough the data and wreckage a differenttale of the causal issues involved in themid-air collision have begun to emerge.

The similarities between this tragedy andthe extremely close call between two JALaircraft over Tokyo on 31st January 2001should serve as a catalyst to a soul-searching debate within our industry. Bothevents have uncovered seriousshortcomings in the system; theopportunity to address those issuesshould not be missed.

The why’s and wherefores of why thesystem safety net defences (in the form ofidentifying the aircraft when they initiallyenter the controller’s sector, a switched offshort-term conflict alert system, oneperson in the control room, a busytelephone line, operating the 4-5 aircraft inhis sector on two different screens on twodifferent frequencies) were stripped awayon the night in classic “Reason Model”style will no doubt be explored andreported on in detail by the AccidentInvestigation team. This area will no doubtbe the focus of effort as these safety netsshould prevent us ever getting to a TrafficAlert and Collision Avoidance Systemwarning scenario.

But once those system safety nets werebreached the controller and the two crewswere placed in a situation where no oneperson actually had the total picture of theunfolding scenario. In those last secondsdid the controller and the two crewsactually make the “right” decision based ontheir own limited perspective of thescenario as they saw it? The controllerdoes not know if “his” aircraft are TCAS

equipped, if the TCAS is functioning and ifthe crew are responding correctly to anyTCAS warning. The crews of both aircraftappear to have responded to the situationin a manner aligned to their differenttraining and SOP philosophies. Thecontroller also only has a schematic planview of events with a digitised “label”providing the transponder data. In closeconflict situations this “label” informationfrom the two aircraft can merge causing ablurred image depriving the controller of asignificant part of the overall conflictpicture. Coupled to that is the refresh rateof the controllers screen which can be 2 – 5seconds behind the actual aircraft position.

If we started today with a clean sheet ofpaper and were tasked with designing arobust safety system from scratch perhapswe would consider addressing some ofthe following points:

■ ATC and TCAS separation are twoindependent and non-complementarysystems. What guidance should ICAOprovide about which separation systemhas the final authority, at what pointwould this authority become absoluteand how will that guidance bedisseminated and implemented?

■ Can TCAS tell us what the aircraft isabout to do or is it limited to telling uswhat the aircraft is actually doing atthat moment, i.e. is it a predictive or aresponsive system?

■ TCAS is the final safety net and itcomes into play when all the othersystem defences have been breached.Should the official guidelines reflectand reinforce this aspect?

■ If we do elect to rely solely on TCASwhat have we done to ensure thesystems integrity prior to each andevery departure. After all we still seeaccidents involving crossed flyingcontrols so how do we ensure that theTCAS system “sense” is as per thedesign intent and keep Murphy at bay?

■ Can TCAS adequately differentiatebetween high rates of decent andrapid closure to cleared altitudes andavoid false or erroneous TCAS alerts.

■ How can we ensure that the players allhave the same mental picture of theactivities in their immediate vicinity?

■ RVSM allows aircraft to fly moreaccurately to barometric references.Does this barometric accuracy (bydefault) potentially increase the risk ofcollision by placing aircraft at the samevertical reference point in the sky?

■ Is the TCAS Resolution Advisoryavoidance manoeuvre the optimum?Currently it’s a mirror-image pitchmanoeuvre. How does a mirror imageroll manoeuvre compare in bothevasive and passenger safety terms?

■ How much traffic is predicted over thenext 40 years, how can we develop asystem that can tolerate that muchtraffic and at the same time tolerateour own human idiosyncrasies? Isautomatic en-route guidanceappropriate?

■ How should the air lanes be laid out tooptimise traffic flow rates?

Recent CHIRP reports have discussed theperceived pressures on the system. Let’snot forget that our safety systems are onlyas good as the weakest link in that safetychain. Can the system cope with theweakest link?

by John Dunne, Airclaims

4

In recent years, there has been anincrease in the incidence of significantstructural damage to commercialairplanes from hard nosegear touchdown.In most cases, the main gear touchdownswere relatively normal. The damageresulted from high nose-down pitch ratesgenerated by full or nearly full forwardcontrol column application beforenosegear touchdown. Flight crews needto be aware of the potential for significantstructural damage from hard nosegearcontact and know which actions to taketo prevent such incidents.

Hard nosegear landings can produceheavy loads on the nosegear and itssupport structure. The resulting highstresses in the forward fuselage uppercrown and between the flight deck andwing front spar can cause the fuselagestructure to buckle. Appropriate actionsby the flight crew can help prevent suchincidents. Understanding which actionsare appropriate requires a discussion ofthe following:

1. Incidents of hard nosegear landings.2. Structural design requirements.3. Airplane control during landing and

derotation.

1. Incidents of hard nosegearlandings

Recent incidents of hard nosegeartouchdown share two characteristics.First, a relatively normal main geartouchdown is followed by full or nearly fullforward control column application, whichresults in overderotation and hard

nosegear contact. Second, the resultingairplane damage is significant andrequires lengthy and expensive repairs.(The location and type of damagedepend on the particular model ofairplane.)

Three representative incidents ofstructural damage incurred from hardnosegear contact with the runway aredescribed below.

An airplane was on approach to arelatively short runway in gustyconditions. The airplane experienced anormal main gear touchdown, but the fullforward column movement applied by theflight crew caused very hard nosegearcontact with the runway. Resultingdamage included displaced nosegear,bent axles, and a buckled and crackedfuselage structure (fig. 1). In addition, thecockpit door, forward lavatory doors, andforward passenger doors were jammedclosed.

Preventing Hard Nosegear Touchdowns

5

An airplane returned to the departureairport following an in-flight engineshutdown. The airplane landed firmly onthe main gear. Recordings by the digitalflight data recorder ended abruptlybecause of damage from the nosegearcontact; however, the last data pointshowed that considerable forward controlcolumn movement had been applied. Thenosegear was rotated aft and to the left ofits normal position, resulting in damage tothe lower fuselage and nosegear wheelwell area (fig. 2).

An airplane landing in strong crosswindsand turbulent conditions touched downon the main gear firmly, but notabnormally for the conditions. Theairplane bounced, full forward columnmovement was applied, and thenosegear contacted the runway veryhard, causing the nosegear to fail androtate upward in the aft direction. Thenosegear wheel assembly penetrated theelectronics bay and caused considerabledamage (fig. 3).

2. Structural design requirements

Boeing first recognized that heavy loadson the nosegear could damage thefuselage structure during the 727-200flight-test program in the 1960s. Flight-test data from various landings with highnose-down pitch rates led Boeing toenhance design requirements. These newrequirements enabled the nosegear andfuselage structure to withstand hardernosegear contacts. All Boeing-designedairplane models meet theserequirements.

The most recent design enhancementsinvolve the 767. The 767-300 nosegearmetering pin has been further optimizedto absorb the energy produced duringoverderotation events, thereby loweringthe load on the nosegear (fig. 4). Themetering pin device controls the flow ofhydraulic fluid within the nosegear oleostrut. The design enhancement wasincorporated into production airplanes inAugust 1994 and is available for retrofiton earlier 767-300s.

In addition, the upper crown stringers onthe forward fuselage of the 767-300 havebeen strengthened in the area wherebuckling often occurs followingoverderotation. This design enhancementwas incorporated into productionairplanes in January 1995. No retrofit isavailable for this design enhancement.

3. Airplane control during landing andderotation

In the last several years, there has beenan increase in the incidence of airframedamage from hard nosegear contacts.Examination of airplane flight recorderdata from these incidents revealed that, in

6

each case, full or nearly full forwardcolumn movement was applied betweenthe time of main gear contact and

nosegear touchdown. Figure 5 shows thatenough nose-down elevator authorityexists to damage the airframe structure if

the airplane is rapidlyderotated following maingear touchdown. This ispossible because themaximum nose-downelevator authority is designedto control go-arounds, whichrequire considerably morelongitudinal control than thelanding maneuver.

In response to recentincidents, Boeing hasproduced a training video toincrease flight crewawareness of the potentialfor both nosegear andairframe damage as aconsequence ofoverderotation. Based on asuccessful training effort in1994 and 1995 thatsignificantly reduced hardnosegear landings worldwidefor several years, the videoserves as a refresher forflight crews. The nine-minutevideo has been sent to all

Boeing airline customers. (For informationon how to obtain additional copies, referto the editor’s note at the end of thisarticle.)

Many factors influence a successfullanding and derotation. First, theapproach must be stabilized, as definedby the Flight Safety Foundation (table 1).If these criteria are not met at any timebefore touchdown, the flight crew shouldinitiate a go-around.

On approach, the speed-brake levershould be armed for landing and theautobrakes should be set for the runwaysurface conditions. The landing derotationshould be performed so that the flightcrew immediately starts flying thenosewheels smoothly onto the runwaywhen the main wheels touch down.

Flight crews can accomplish this bycontrolling the airplane pitch rate whilerelaxing aft column pressure. When heavybrake applications are needed, with andwithout autobrakes, increased aft columnpressure may be required to slow the

Airstaff Associatesin association with

Nigel Bauer & Associates

QUALITY MANAGEMENT FOR OPERATORS *JAR-OPS Quality Systems, documentation & auditing

5 days - LGW - 23 Sep, 25 Nov, 27 Jan

SAFETY MANAGEMENT SYSTEMSSMS course for air & ground operators

2 days - LGW - 29 Oct

AUDITING IN AN OPERATIONAL ENVIRONMENT *Air & ground operations auditing

3 days - on request or ‘in-company’

AUDIT IMPROVEMENT WORKSHOPExperience sharing & improvement of audit process

2 days - LGW - 31 Oct

QUALITY FOR SENIOR MANAGEMENTNew Course - JAR Quality Management Accountability

2 days - ‘in-company’ only

For further details including In-Company courses and consultancyor auditing services please contact:

Airstaff Associates:Tel +44 (0) 1780 721223 e-mail: info@airstaff.co.ukFax +44 (0) 1780 720032 www.airstaff.co.uk

Nigel Bauer & Associates:Tel +44 (0) 1243 778121 e-mail: nigel.bauer@nb-a.demon.co.ukFax +44 (0) 1243 789121 www.nb-a.demon.co.uk

* Incorporating Nigel Bauer & Associates IRCA certificated Internal Auditor Training course

7

derotation rate. Flight crews should nothold the nose up in the touchdownattitude or allow the nose to rise becauseeither could result in a tail strike. Controlcolumn movement forward of the neutralposition should not be needed. Figure 6illustrates this smooth relaxation ofcolumn force as the nose is lowered. Thefigure compares the radio altitude, pitchangle, and control column forces for bothnormal landings and landings duringwhich airframe damage occurred. With the nose down, spoilers up, andthrust reversers deployed, the airplane isin the correct stopping configuration.This should be established as soon as ispractical during landing. Forward columnmovement should not be applied tolower the nose rapidly in an effort toimprove landing performance ordirectional control. The rudder providesthe required directional control until theairplane is at a relatively low speed, thenrudder pedal nosewheel steering is usedto complete the landing rollout. Largeforward column displacement does notimprove the effectiveness of nosewheelsteering and may reduce theeffectiveness of main-wheel brakingbecause it reduces the amount of weighton the main gear.If the airplane bounces, the flight crewshould hold or reestablish a normallanding attitude and add thrust asnecessary to control the rate of descent.Thrust need not be added for a shallowbounce or skip. When a high, hardbounce occurs, the flight crew shouldinitiate a go-around.

Summary

Flight crews can reduce the chances ofairplane damage from hard nosegearcontact by avoiding high derotation ratesand excessive forward column inputs. Inthe event of a hard landing, the flightcrew should report the event to the

engineering and maintenancedepartments so that the airplane can beinspected for potential structural damage.

Editor’s note: A Boeing training video,“Airplane Derotation: A Matter ofSeconds,” covers the material presentedin this article. Copies of the nine-minutevideo have been sent to all commercialairplane customers. Additional copies areavailable from the director of FlightTechnical Services, Boeing CommercialAirplanes, P.O. Box 3707, Mail Code 20-

97, Seattle, WA 98124-2207, USA;telephone 206-662-7800. Additionalinformation on hard nosegear contact isavailable in Boeing Commercial AirplanesFlight Operations Technical Bulletins nos.757-48 and 767-47, Feb. 1, 1993.AeroCopyright © 2002 The Boeing Company.All rights reserved.

Reprinted from AERO magazine bypermission of The Boeing Company

The Flight Safety Foundation suggeststhat operators consider adopting thefollowing definition of a stabilizedapproach: All flights shall be stabilizedby the 1,000ft height above touchdown(HAT) in instrument meteorologicalconditions and by the 500 -ft HAT invisual meteorological conditions.

An approach is considered stabilizedby the Flight Safety Foundation whenthe following criteria have been met:

■ The airplane is on the correct flightpath.

■ Only small changes in heading andpitch are required to maintain thatpath.

■ The airplane speed is not higherthan Vref + 20kt indicated airspeedand not lower than Vref.

■ The airplane is in the proper landingconfiguration.

■ The sink rate is not more than 1,000ft/min. If an approach requires ahigher sink rate, a special briefingshould be performed.

Table 1

■ The power setting is appropriate forthe configuration and not below theminimum power for approach asdefined by the airplane operationsmanual.

■ All briefings and checklists havebeen performed.

■ Specific types of approaches areconsidered stabilized if they alsofulfill the following:

i Instrument landing system – Theairplane must be flown withinone dot of the glideslope orlocalizer.

ii Category I or II – The airplanemust be flown within theexpanded localizer band.

iii Visual – The wings must be levelon final approach when theairplane reaches the 500 -ft HAT.

iv Circuling – The wings must belevel on final approach when theairplane reaches the 300 -ft HAT.

v Unique – A special briefing isrequired.

Elements of a Stabilized Approach

Source:Flight Safety Foundation Approach and Landing Accident Reduction(ALAR) Task Force

8

Since September 2001, a UK National AirTraffic Services ACE project team hasbeen examining level busts, searching fortheir causes, and planning strategies formitigation. At the 346th meeting of theUKFSC in May 2002, team members gavea presentation, describing the work doneto date, and explaining future plans…

Level busts have a real potential to claimlives. The mid-air collision near New Delhiin 1996 killed 349 people, and was theresult of a simple level bust. In the UK,there are approximately 300 level busts ayear, many of which do not result inlosses of separation, though all have thepotential for very serious outcomes.

What is a level bust? A level bust occurswhen an aircraft deviates from the correctlevel by more than 300ft. Normally verticalseparation between aircraft is 1000ft. Thisproject did not address level busts causedby TCAS events, nor instances of ‘late re-clearance’ where an aircraft passesthrough a new cleared level under ATCinstruction before stabilising at that level.

Modern ATC equipment, including ShortTerm Conflict Alert (STCA), high qualityradar, well-trained and experiencedcontrollers, and up-to-date aircraft fittedwith Traffic Alert & Collision AvoidanceSystem (TCAS) flown by competentcrews, should afford better protection.Despite this, a mid-air collision (not, itseems, the result of a level bust) occurredover Ueberlingen, Germany earlier thisyear. This proves that reliance uponpresent collision avoidance techniques isnot sufficient; accepting level busts andtrusting that a collision will be avoided isnot enough; new ways of eliminating levelbusts must be found.

Recognising the nature and potentialseverity of the hazard, UK National AirTraffic Services set up an ACE (Action for

Continuous Excellence) project inSeptember 2001. The Level Bust ACEteam, chaired by a Terminal Control WatchManager, included ATC managers andsafety investigators, representatives ofSafety Regulation Group, a human factorsscientist, and pilots from British Airwaysand easyJet. The project is sponsored atNATS board level, and has an unrestrictedbrief. An ‘ACE agent’ oversees andfacilitates the group’s work, providingguidance and administrative support, andensuring the group retains its focus andthat effective progress is made.

ACE projects address difficult problemsthat need to be solved. The process,developed from an analysis of industrybest practice in problem solving, usesmulti-disciplined teams and a structuredapproach, focusing on taking action andimplementing solutions.

Over a series of one-day workshops, theteam carried out a practical analysis of theroot causes of level busts, and prioritisedthese causes, before discussing andidentifying forty possible solutions. Thesesolutions were themselves prioritised andmatched against causes, in a matrix,before further work to specify solutions foraction took place.

Solutions identified for action rangedwidely in their simplicity of developmentand implementation, cost, and potentialbenefits in addressing issues other thanlevel busts.

Education and Awareness

The most important solution identified isthe need for an education and awarenessprogramme for ATCOs and pilots. Itbecame clear that many, if not all, levelbusts would be avoided if crews andcontrollers complied with currentregulations and ‘best practice’. A new

working group, incorporating members ofthe ACE project team, together with ATCtraining experts, is developing thiscampaign. The campaign will be rolledout through summer and autumn thisyear. It is hoped that a concerted effort toimprove SOP adherence, RTF discipline,and the use of ‘best practice’, may bringabout a significant improvement in thelevel bust statistics.

Alphanumeric Callsigns

Data from ATC safety investigationsidentified that callsign confusion, asignificant cause of level busts, is muchreduced by the use of alphanumericcallsigns. This solution is being furtherexamined, in order to establish that thereare no unknown risks associated withalphanumeric callsigns. Once this iscomplete, consideration may be given toseeking regulatory action to mandate theuse of alphanumeric callsigns.

RTF Phraseology

Much discussion took place regardingsome of the RTF phraseology in currentuse. Whilst it was felt that mostcommunication difficulties arose from poortechnique or assumption, rather than fromquestionable phraseology, someopportunities for improvement wereidentified. The words ‘Flight Level WunHundred’ have been used in place of ‘wunzero zero’ on a trial basis for some time,and with success. This phraseology hasbeen extended to other levels (200, 300,and 400). Other phraseology changes,such as the use of the word ‘degrees’ afterheadings, in order to differentiate fromflight levels, are still under consideration.

Level Busts – ACEing the hazard

9

The UK air traffic controller’s ‘bible’, theManual of Air Traffic Services Part One,gives a full account of standard RTFphraseology as used in the UK. Otherstates use slightly different phraseology.The Manual is available online at www.caa.co.uk/docs/33/CAP493_Part1.pdf,and Appendix E is the appropriatesection. The UK AIP also gives relevantinformation atwww.ais.org.uk/uk_aip/pdf/enr/2010103.pdf.CAP413 gives an overview of RTFtechniques at www.caa.co.uk/docs/33/CAP413.pdf.

Chart Deficiencies

Many pilots reported level busts as aconsequence of mis-reading SID charts.In particular, one chart manufacturer’s

depiction of step climb SIDs was felt tobe unclear. Representations have beenmade to the manufacturer concerned,and work is ongoing to achieve changes.

FMC Software Modification

Modern aircraft such as the Boeing 737-NG and Airbus family have an alertingfeature, which warns crews of climbing ordescending through transition altitudewithout re-setting the altimeters.Investigations have been carried out toascertain whether the FMC on olderaircraft (such as the Boeing 737 EFIS,757, and 767) could be modified toprovide a similar alert. Initial indicationsare that this is feasible, and presentationswill be made to FMC manufacturers indue course. One major operator has

found that their Boeing 737 EFIS fleetexperiences ten times more level bustswith altimeter setting errors as theircause, than their A320 family fleet.(Industry support for this proposal issought – interested parties should contactthe author tim.atkinson@easyJet.com).

Distraction-Free Flight Deck

The project group identified thatdistraction, causing breakdown of SOPs,was a common factor in level busts, andconcluded that a distraction-free flightdeck is an environment in which levelbusts are less likely. Of course this is amatter of discipline, and some companiesalready operate a ‘sterile’ flight deck. Mostoperators are believed to be aware of theissue, and when the security implications

10

of ‘locked door’ policies were considered,it was decided not to pursue this solutionfurther for the moment.

Risk Analysis

It was decided that further formal riskassessment should be carried out. NATSSafety Analysis experts have studiedsubstantial amounts of radar data,evaluating the possible consequences oflevel busts involving aircraft passingthrough or levelling at incorrect levels, thisevaluation being carried out for variousbands of flight levels. Whilst this work isongoing, early indications are that theconclusions will enable betterprioritisation of mitigating techniques. Thework undertaken so far has alreadyidentified that some classes of level bust

are far riskier than others – some of theriskiest being those involving altimetermis-setting or mis-read SID charts. Thisknowledge allows greater priority to begiven to eliminating these errors.

Mode S Implementation, and sub-scale setting

Consideration of the manner in whichMode S might help to reduce the levelbust risk led to the project group’sidentifying that Mode S should beimplemented without delay. Moreover, itwas decided that Mode S selectedaltitude data could be of considerablymore value, if altimeter sub-scale settingwere also a down-linked parameter.Although the present Mode S plans donot incorporate sub-scale setting, NATS

has expressed adesire that it should.

London TMADesign

The design of theLondon TMA wasoften cited as beingcritical to the numberand nature of levelbusts. In particular,the fact that mostSIDs climb under theholding stacks,makes certain typesof level bustparticularlyhazardous. Whilst it isclearly a long-termobjective, the projectgroup felt that aschanges to the TMAare made any suchre-design shouldhave, as its aim theneed to avoid thetypes of interaction

between arrival and departure routes thatpresently exist. Such a re-design mightnot reduce the number of level busts, butwould certainly reduce the likelihood of alevel bust causing a collision.

Datalink Communications

Datalink communications (CPDLC)provide an opportunity to eliminate manyhuman errors in the communicationchain. However, other forms of humaninter-action with data received byelectronic means will take place, andcareful assessment of other areas of riskwill need to be carried out. CPDLC trialsare ongoing in various locationsworldwide, and it is hoped that a robustand reliable form of technology will bearrived at. The project team agreed thatCPDLC had significant potential.

Transition Altitude

The transition altitude in the UK variesbetween 3000ft and 6000ft, dependingupon location. These different values, andthe fact that our transition altitude isrelatively low, not only add to the risk of

School ofEngineering

Air Safety Management - an exciting new careerdevelopment opportunity Introducing a brand new course designed for those rising intheir careers in airlines, air traffic control, airports, aircraft andsystems manufacturing and related industries.

MSc Air Safety Management is for those who have an interestin or a significant level of responsibility for defining andimplementing the management of air safety in all areas of theindustry - not just operations, but also aircraft and equipmentdesign and manufacture. This course has been initiated inresponse to the needs of both the industry and the regulatoryauthorities. The course is:

• Businesslike - modules are taught by leaders in the industry• Flexible - modules last three mid-week days• Practical - study at your own pace to fit your own schedule• Outward looking - with interest coming from many

companies, there are excellent opportunities for networking• Modules run in London and Dubai

For further information, please contact: The Courses Officer,School of Engineering, City University, Northampton Square,London EC1V 0HB. Tel: +44 (0)20 7040 8112; fax: +44 (0)20 7040 8101; e-mail: atm.ete@city.ac.ukwww.city.ac.uk/atm

The University for business and the professions

11

level busts occurring, but make thosewhich do occur, more likely to result in anencounter with another aircraft. For thesereasons, the project group recommendedthe implementation of a 24000ft TransitionAltitude throughout the UK FIRs, incompliance with the European SingleSkies concept. A further working groupwill study this issue in due course, and itswork will be monitored.

Conclusions

Level Busts represent a significanthazard. Much of the mitigation relies uponhuman endeavour – there is notechnological remedy. The education andawareness programme mentioned abovewill aim to ensure that everyone exposedto the level bust hazard has a clearunderstanding of the problem, and knowshow to reduce their risk. This programme,

together with the other solutions raised bythe ACE team, may go some way toimproving the statistics, though greaterawareness will also lead to morewidespread reporting of non-safety-significant events. The only true measureof success available relates to level bustsinvolving losses of separation, which are

almost invariably detected. This statisticwill be closely monitored, and will prove ameasure of success of the ACE project’swork, and other work presently beingundertaken elsewhere.

50%45%40%35%30%25%20%15%10%

5%0%

% L

evel

Bus

ts

Causal Factors - all Level Busts(a level bust may have more than one cause)

Stepp

ed o

ut o

f SOPs

Mis

read

SID

char

t

Autop

ilot n

ot ca

ptur

ing le

vel

Lack

of e

quipm

ent f

or m

itigat

ion

1st le

vel g

iven

to d

epar

ture

cont

rolle

r

Call si

gn co

nfus

ion

Late

chan

ge to

SPS

Inpu

t erro

r to

FMS

Wor

kload

dur

ing o

pera

tiona

l diffi

cultie

s

Climbin

g/de

scen

ding

to a

hea

ding

Cleare

d FL1

10, D

esce

nt F

L100

Confu

sion

not c

heck

ed w

ith A

TCAir Transport Avionics Ltd

AVIONIC REPAIR OVERHAUL SUPPLY AND EXCHANGETCAS EQUIPMENT SUPPLIED AND INSTALLED, F.D.R. AND C.V.R. REPLAYS

8.33 KHz AND FM IMMUNITY MODIFICATIONS FOR ARINC AND GA AIRCRAFTFROM COMPS TO CALIBRATION, OUR LARGE CAPABILITY LIST IS AVAILABLE ON LINE

WWW.AIRTRANSPORT.CO.UK

JAR 145, FAR 145 ISO9002 Approved Workshops next to HeathrowFAA Repair Station CF5Y 777M JAR 145 No. CAA0016

Local Sales Representatives Worldwide

7-9 Willow Rd, Poyle trading Estate, Colnbrook, Berkshire SL3 OBX, England.Tel:- +44 1753 682 654 Fax:- +44 1753 684 166 A.O.G:- +44 603 457 / 67

E-Mail :- sales@airtransport.co.uk

12

Safety management systems can makea big difference to any business. Thebenefits of taking a systematic approachto safety are obvious: the hazards of thebusiness are known, understood anddemonstrably controlled.

However, the possession of a safetymanagement system, no matter howthorough and systematic it may be, is notsufficient to guarantee sustained safetyperformance.

To proceed further it is necessary todevelop organisational cultures thatsupport higher processes such as“thinking the unthinkable” and beingintrinsically motivated to be safe, evenwhen there seems no obvious reason todo this. What is needed is a safetyculture that supports the managementsystem and allows it to flourish.

The bad news is that creating a healthysafety culture and keeping it alive requireseffort. The good news is that less effort isrequired in smaller organisations, andsafety cultures are worthwhile, both interms of lives and profits.

Safety for profit

There is considerable evidence that themost safety-minded companies are alsoamongst the most profitable.

Safety cultures are characterised by goodcommunication between managementand the rest of the company. This notonly enhances safety, but can elevatemorale and in some cases, productivity.As communication failures are alwaysidentified as a source of problems fororganisations, having a definitive focus forimproving communication can only resultin improved performance at all levels.

The other main reason why safetycultures make money lies in the fact that,if one has the safety enhancement that aneffective safety culture can provide, thenone can devote resources moreeffectively and take (profitable) risks thatothers dare not run.

What costs money is not safety, but badsafety management. Once themanagement of an organisation realisesthat safety is financially rewarding andthat the costs incurred have to be seenas investments with a positive return, theroad to a full safety culture is open.

What is a safety culture?

Every organisation has some commoncharacteristics we call its “culture”. Thesecharacteristics have often becomeinvisible to those inside, but may bestartling to outsiders coming from adifferent culture. The notion of anorganisational culture is difficult to define.I take a very general approach and seethe organisational culture as, roughly:“Who and what we are, what we findimportant, and how we go about doingthings round here”.

In one sense, safety always has a placein an organisation’s culture, which canthen be referred to as the safety culture,but it is only past a certain stage ofdevelopment that an organisation can besaid to take safety sufficiently seriously tobe labelled as a safety culture.

“What costs money is not safetybut bad safety management.”

From worst to best

Organisations can be distinguished alonga line from pathological to generative:

■ Pathological: the organisation caresless about safety than about not beingcaught.

by Professor Patrick Hudson

Safety Culture: The Ultimate Goal

PATHOLOGICALWho cares as long as

were not caught

REACTIVESafety as important, we do a loteverytime we have an accident

CALCULATIVEWe have systems in place to

manage all hazards

PROACTIVEWe work on the problems

that we still find

GENERATIVESafety is how we do

business around here

INCREASINGLYINFORMED

INCREASINGTRUST

13

■ Reactive: The organisation looks forfixes to accidents and incidents afterthey happen.

■ Calculative: The organisation hassystems in place to manage hazards;however the system is appliedmechanically. Staff and managementfollow the procedures but do notnecessarily believe those proceduresare critically important to their jobs orthe operation.

■ Proactive: The organisation hassystems in place to manage hazardsand staff and management havebegun to acquire beliefs that safety isgenuinely worthwhile.

■ Generative: Safety behaviour is fullyintegrated into everything theorganisation does. The value systemassociated with safety and safeworking is fully internalised as beliefs,almost to the point of invisibility.

A safety culture can only be consideredseriously in the later stages of thisevolutionary line. Prior to that, up to andincluding the calculative stage, the termsafety culture is best reserved to“describe formal and superficialstructures” rather than an integral part ofthe overall culture, pervading how theorganisation goes about its work. In theearly stages, top management believesaccidents to be caused by stupidity,inattention and, even wilfulness on thepart of their employees. Many messagesmay flow from on high, but the majoritystill reflect the organisation’s primaryproduction goals, often with “and besafe” tacked on at the end.

A true safety culture is one thattranscends the calculative level. Even so,it is at this stage that the foundations arelaid for acquiring beliefs that safety isworthwhile in its own right.

By constructing deliberate procedures, anorganisation can force itself into takingsafety seriously. At this stage the values

are not yet fully internalised, the methodsare still new and individual beliefsgenerally lag behind corporate intentions.However, a safety culture can only arisewhen the necessary technical steps andprocedures are already in place and inoperation.

An organisation needs to implement amanaged change process so it candevelop along the line towards thegenerative or true safety cultures. Thenext culture defines where we want to goto, the change model determines how weget there. (See “Change, for safety’ssake”, in box).

A cultural change is drastic and nevertakes place overnight. If a safetychampion leaves, there is often no-one totake up the fight and the crucial top-downimpetus is lost. But even without apersonnel change there aretwo threats to the successfultransition to a higher level ofsafety culture. One issuccess, the other failure.

In the case of success,effective processes, toolsand systems may bedropped, because theproblem is perceived to havegone away. In the case offailure, old-fashionedapproaches may be retrievedon the grounds that theyworked before. But in bothof these cases, the new, andoften fragile, beliefs andpractices may not havebecome sufficientlyinternalised to survivechanges at the top.

Management has to be trulycommitted to themaintenance of an advancedculture in the face of successand/or failure, and suchcommitment is rare.

Change is hard

One final underlying reason why culturalchange often fails to succeed is that thenew situation is unknown to theparticipants. If this is added to existingbeliefs, such as the belief that the currentsituation is as good as it gets, then thereis little real need to change and failure isalmost certain. If these failures are at thelevel of the workforce, then strongmanagement commitment may save theday. If the problems lie withmanagement, then there is little hopebecause they will enforce the oldsituation, which feels most comfortable,on the most proactive of workforces.

A colleague has likened this to learning anew golf swing by changing the grip andthe stance. At first the new position isuncomfortable. However, to improve your

For information contactMiSu International LimitedTel: +44 (0) 01638 780154Fax: +44 (0) 01638 781218E-mail: Bgmisuaviation@aol.comwww.misuinternational.com

■ measures of excellence

■ independence

■ standards of quality

■ unsurpassed in experience

Development of Audit Systems & Procedures

Operation and Management of Audit Systems

Professional guidance on regulatory requirements

Operational cost reduction

Global benchmarking and audit specialistsMeeting the needs of Dynamic Industries

14

swing you have to trust the pro, do thework and be patient. (One advantage ofthis metaphor is that managers often playgolf and can transfer their experience oflearning a new swing to learning tomanage an advancing culture. Changeagents are like golf professionals: theycan help develop a person’s game, butthey can’t play it for them.)

Not too difficult

Given the financial inducements, why don’torganisations try and develop the mostadvanced forms of safety culture? Theanswer seems to be contained in the typeof culture the organisation has at the time.

Pathological organisations just don’t care.Reactive organisations think that there is

nothing better and anyone who claimsbetter performance is probably lying.They do what they feel is as good as canbe done. Calculative organisations arehard to move because they arecomfortable, even if they know thatimprovement is possible. Largeorganisations will inevitably be heavilycalculative unless active steps are takento counter that tendency.

Small organisations are more likely to beable to develop past the calculative stageand become generative. The greatestsingle barrier to success for smallerorganisations however, is the belief that itis too difficult. On the contrary, in thelong term, it is more difficult, anddangerous, not to.

Professor Patrick Hudson is recognisedinternationally for his work on safetymanagement systems. He is based atLeiden University in Amsterdam and is anactive member of the ICAO HumanFactors Awareness Group.

Reprinted with kind permission of AirSafety Letter Issue 2/2002

The following model was developed formanaging successful change withinorganisations. Its strength comes fromthe fact that it is intended to changeboth the individuals and theorganisations they constitute, andrealises that changing one without theother is impossible. The model putstogether the requirements for changeof individual beliefs that are so crucialin cultural development. It can apply tosafety, but it can also apply to anyother desirable development in anorganisation. It gives substance to theoft-heard cries for workforceinvolvement and shows where and whysuch involvement is crucial, especiallyin the later stages of evolution towardsa full safety culture:

Awareness

■ Awareness: Knowledge of a betteralternative than the current state.

■ Creation of need: Active desire toachieve the new state.

■ Making the outcome believable:Believing that the state is sensiblefor those involved.

■ Making the outcome achievable:Making the process of achievingthe new state credible for thoseinvolved.

■ Information about successes:Provision of information aboutothers who have succeeded.

■ Personal vision: Definition by thoseinvolved of what they expect thechange to be.

Planning

■ Plan construction: All peopleinvolved in the change create theirown action plan.

■ Measurement points: Indicators ofsuccess in the process are defined.

■ Commitment: Staff andmanagement sign up to the plan.

Action

■ Do: Start implementing actionplans.

■ Review: Progress is reviewed withconcentration upon successfuloutcomes.

■ Correct: Plan is modified wherenecessary.

Maintenance

■ Review: Management reviewschange process at regular (anddefined in advance) intervals.

■ Outcome: Checks to see whethernew values and beliefs havebecome second nature.

Change, for safety’s sake

15

Barry Strauch applies contemporaryerror theory to the needs of investigatorsand of anyone attempting to understandwhy someone made a critical error, howthat error led to an incident or accident,and how to prevent such errors in thefuture. Students and investigators ofhuman error will gain an appreciation ofthe literature, with numerous references toboth scientific research and investigatereports in a wide variety of applications,from airplane accidents, to bus accidents,to bonfire disasters. The book:

■ includes an easy to follow step bystep approach to conducting errorinvestigations that even those new tothe field can readily apply.

■ summarizes recent transportationaccidents and human factors literatureand relates them to the cause ofhuman error in accidents.

■ provides an approach to investigatinghuman error that will be of interest toboth human factors psychology andindustrial engineering students andinstructors, as well as investigators ofaccidents in aviation, masstransportation, nuclear power, or anyindustry that is to the adverse effectsof error.

Using his 18 years of experience as anaccident investigator and instructor ofboth aircraft accident investigationtechniques and human factorspsychology, the author reviews recenthuman factors literature, summarizesmajor transportation accidents, andshows how to investigate the types oferrors that typically occur in high riskindustries. He presents a model ofhuman error causation influenced largelyby James Reason and Neville Moray, and

relates it to error investigations with stepby step guidelines for data collection andanalysis that investigators can readilyapply as needed.

Hardback 1 84014 9310 £45.00

Book Review

Investigating Human Error: Incidents, Accidents and Complex Systemsby Barry Strauch

Commercial airline passengers arereminded during every preflight briefing toturn off electronic devices that mayinterfere with aircraft systems – includingcell phones. Now here’s a report thatsuggests what’s good for the cabin, isgood for the cockpit, too.

The Captain filed the flight plan late so Icould not pick up the clearance until just

before the passengers showed up. Wewere issued the SID with transition. I didnot have time to look up the SID becausethe Captain was in a hurry to taxi. Hewas making calls on a cell phone whilehe taxied out so I still could not talk tohim. Tower put us in position and holdon Runway 30L while I yelled for theCaptain to turn off his cell phone. Hefinally did when they cleared us fortakeoff. We never did brief the takeoff orthe SID.

Once airborne, the Captain asked mewhat we were supposed to do. I triedreading the text and gave him some ofthe instructions as I read them. I gotconfused at one point about how to jointhe transition and told the Captain. Heturned the wrong way. ATC asked whatradial we were trying to join. They told usto turn right 140° to continue the SID and

to call Approach once on the ground.

This would never have happened if theCaptain had not been in such a hurry toget going, and if he had been payingattention to flying duties while taxiing out,instead of talking on his cell phone.

We’re sure this type of event is rare, but itnonetheless illustrates the importance ofeffective cockpit management skills (andtraining). In effective CRM, flight crewsmake flying duties their first priority, andFirst Officers participate constructively inresolving problems.

With acknowledgement to NASA’s AviationSafety Reporting System. Callback #249,Mar 00

CRM: Cellular Resource Management

16

What to do about Maintenance Error Incidents?

“Maintenance error” is not a popularphrase amongst aircraft engineers. Weare the kind of people who live by hardfacts, drawings and numbers. Conceptslike people making mistakes are easilydealt with by others, but in maintenancewe train our personnel and writeprocedures to ensure that mistakes donot happen. The fact that a competentmaintainer following a good procedurecould make a mistake is a figment of

nightmares to most engineers. However,people make mistakes. It is an inevitableconsequence of being a human being!Nothing we do can prevent all mistakesabsolutely. Therefore, error tolerance is abasic characteristic of safe systems ofwork. Despite trying to design errortolerant maintenance systems,maintenance error incidents will occur.This article is about how you might dealwith maintenance error incidents. I’d like

to start by assumingthat this routinemaintenance errorhas not caused adisaster. In that case,other procedures maywell be forced on youby the AAIB and, inthe worst case, thecoroner!The first problem isfinding out that anundesirable incidenthas occurred. If theincident hassignificantconsequences, I haveno doubt that youhave a system inplace to make youaware. However,most maintenanceerror incidents couldgo unreportedbecause theconsequences wouldbe mitigated bydetection. For

example, a failure to seat an electronicbox correctly may well be discoveredduring pre-flight checks and rectifiedbefore the departure time. Would youknow? Is the reporting system detailedenough for you to find out? Even if it is,would you investigate such an incident?You should because finding out why thisincident occurred and preventingrecurrence could avoid a more seriousincident later. Systems for developingopen reporting cultures could be thesubject of another article. This article isabout a system to deal with reportedmaintenance error incidents.

Having discovered that an incident hasoccurred, you must always initiate aninvestigation. At this stage, the key is notto focus on the individual or theconsequences of his action. In almostevery case of maintenance error, there willbe a sequence of events and decisionsleading to the error. It is useful toconstruct a flow diagram to record whathappened and why. The diagram opositeshows the sequence of events leading toa hypothetical maintenance error incident.(I admit that the hypothetical event isbased on a picture and a one linedescription of a US military aircraftincident, but I have used my imaginationto help make a few points.) The aircrafthad come out of deep maintenance somedays before and had flown a few tripsbefore the structural failure of an aircraftwing during refuel. I am convinced that, ifthis was to happen to one of your aircraft,your immediate reaction would be similar

by Wing Commander Dave McCormickSO1 Engineering Policy, Defence Aviation Safety Centre

I know many of you will find this hard to believe, but I started writing this article before the Potters Bar rail accident.Currently, the investigation is underway and, as usual, the media are after a culprit. Initially, they were happy to blamethe Secretary of State for Transport; now, they are looking for the rail maintainer who made the mistake. In my opinion,

the question that society must ask is summarised below.

Which is the higher priority: preventing recurrence or taking punitive sanctions against the individual whomade a human error?

FOCUS Subscription Application

UK Flight Safety CommitteeThe Graham Suite, Fairoaks Airport,

Chobham, Woking, Surrey. GU 24 8HXTel: 01276-855193 Fax: 855195

email: ukfsc@freezone.co.uk

Name

Job Title

Company Name

Address

Tel/Fax No

email

Nature of Business

Please enter my subscription to FOCUS from the next issue. I enclose a sterlingcheque made payable to Flight Safety Committee or invoice me for the annual

Subscription Rate of £12.00 for 4 issues.Plus P & P £2.60 for UK - overseas P & P on application.

Signature

17

to mine: “What was the pratt doing therefuel up to?” Instinctively, we tend toblame the unfortunate individual at thescene of the incident. Reality can be verydifferent, as in this hypothetical case, andwe must restrain our instinct and producean accurate sequence of events. In thediagram, boxes portray the events thatoccurred within the sequence. Alwaysstart with the undesirable incident as thefirst event box. The lines portray thereverse sequence and show the linkbetween events and their causes. Inproducing your sequence of events, try toapply these 5 rules:

Do not allocate or imply blame withinthe sequence. This can lead tounreasonable conclusions. So canemotive language, so don’t use it.Statements like “the tradesman failedto…” or “the supervisor did not deem

to…” add no value to your investigationand colour the readers’ views. It wouldbe much better to say “the tradesman didnot…” in one box and explain why in thenext!

Ensure each link in the sequence isclear and logical. There should be noreason for the most inexpert reader to askwhy one event leads to another.

Ensure that the sequence iscomprehensive but concise. It is easyto overlook contributions that onlyaggravate the outcome or are not theprime cause of the incident. Within theconstraints of the rules, include onlyrelevant facts. Never use 2 words whereone would do!

Ensure that no human error event isat the end of a sequence. In thiscontext, human error includes any failureto follow a procedure. You must alwaysexplain fully why the human erroroccurred. Record the reason of theindividual who made the error; not yourown reason!

Stop the sequence when there isnothing left to investigate. You mayfind that the sequence is just recordingnormal events or comes to a natural end.Do not keep recording the sequence forthe sake of it.

Once you have completed thisinvestigation, you should have defined thecircumstances of the incident and thereasons for it. Highlight the classificationin some way. In the example, I have usedthe following code:

18

Serial(a)

1

2

3

4

5

6

7

8

9

10

11

12

13

Recommendation(b)

Company executives must emphasise importance ofairworthy product as well as timely output to all staff.

Technical staff must have importance of followingestablished work procedures and drawings

explained in terms of airworthiness of product.

Continuation training should emphasise the level ofrecording required on aircraft technical

documentation including need for any deviationsfrom established procedures or drawings to be

recorded.

Company procedures to include requirement tofollow established technical procedures and

drawings unless alternative approved by ChiefEngineer.

Company policy to define level of recording requiredon aircraft technical documentation including needfor any deviations from established procedures or

drawings to be recorded.

Company procedures to require repair drawings tobe vetted by engineering plans section prior to issue

to production department.

Company policy and continuation training to includeimportance of workforce taking responsibility for

arriving at work fit for duty in terms of alcohol, drugs,health and fatigue.

This incident and the lessons identified should bepublished widely to all departments in the company.

All staff in engineering planning section to be trainedto request repair drawings from OEM so that

holidays have no impact on output.

Driver continuation training to emphasise all reasonsfor not parking under aircraft wings.

Company procedures to require documentationdelivered after normal office hours to be held incustody by company security until start of next

working day unless alternative approved bynominated managers.

When repair drawings requested from OEM,engineering plans section should specify materials

available at the work location and ask for use ofthose materials if possible.

Lighting level in production hangars to be improvedto achieve HSE published inspection standards.

Importance(c)

Vital

Very Important

Very Important

Very Important

Very Important

Important

Important

Important

Important

Not Important

Not Important

Not Important

Not Important

Priority(e)

1

2

2

3

3

4

4

4

5

6

6

7

8

Ease(d)

Easy

Easy

Easy

Easy

Easy

Easy

Easy

Easy

Difficulty

Easy

Easy

Difficult

Very Difficult

19

The original undesirable event = blackwith white print.

Normal and acceptableevents = green with white print.

The primary causal chain that made theundesirable event occur = red with whiteprint.

The contributory causes that set up therest of the circumstances for theundesirable event = yellow with blackprint.

The aggravating causes that made theoutcome of the undesirable event worsebut did not contribute to it = amber withwhite print.

Now all you have to do is look at theevent box at the end of each sequenceand decide what you could do to theorganisation to prevent that event fromcontributing to the incident. For someevents, there will be no action that willsuffice; in these cases, try the previousevent. Again try not to focus your actionson any individual. For example, if a maninvolved in an incident has an inadequateunderstanding of how the system works,the same is probably true of otherpersonnel in your organisation. The issuenow becomes one of organisationalcompetence requirements and needs to

be addressed accordingly.

Once you have recorded all thepreventative options, rate them forimpact; that is, the ability of the actionconcerned to prevent recurrence of thefinal incident. Now rate them for howquickly they could be implemented ifaccepted. Record them in a tableshowing priority for implementation basedon importance and ease; a table mightlook like the one oposite for the incidentin the example sequence.

You have now done your investigationfocusing on preventing recurrence ratherthan blame. Subject to the appropriateline managers implementing yourrecommendations, the risk of recurrenceof this incident should be significantlyreduced.

I should include a “health warning” aboutmalicious acts and wilful negligence.Hopefully everyone will know what I meanby malicious acts. In my parlance, wilfulnegligence involves and individual being

aware that he has a duty to perform atask, being competent to carry out thetask and deciding not to carry out thetask or carrying out the task without due

care and attention. In the case ofmalicious acts and wilful

negligence, I am in no doubt that the

company disciplinarypolicy should beimplemented, possibly

with employment sanctions. Inmost incidents, individuals making

errors are involved in other behaviour,such as errors of judgement orunintentional negligence. In these cases,organisational cures are more effective inpreventing recurrence than sanctionsagainst the individual. Remember, youcan not deter an unintentional act! Also,using discipline against an employee tomotivate others to take more care onlyworks temporarily and may antagoniseyour staff.

All this is based on my learning in the last21/2 years. I apologise to ProfessorReason, David Marx and many otherleading experts in the field of humanfactors for plagiarising their ideas and forany misinterpretation they perceive;however, it works for me!

The views expressed in this article are notthose of the Ministry of Defence, the RoyalAir Force or the Defence Aviation SafetyCentre, but are the opinions of the authoronly.

20

It only took a moment. Alan turned hisback on the trolley he was using to loadfreight into the wing locker, and the prop-wash from a nearby plane sent the trolleyrattling across the tarmac towardsanother plane that was about to taxi.

Fortunately, he turned in time to grab thewayward trolley and prevented what couldhave been an expensive incident forQueensland regional airline, Skytrans. Ifthe trolley had crashed into a propeller,the company estimated damage couldhave cost more than $50,000.

Worried about the possibility of anotherincident, Alan took immediate action toensure the trolley was chocked andunlikely to move when loading. He alsotook his concerns to Skytrans’ safetymanager, who gave a commitment toresolve the problem and asked Alan toraise the issue at the airline’s next safetycommittee meeting.

Alan did so, and told other members ofthe committee it would cost only $200 pertrolley to fit handbrakes. All were inagreement. For the cost of just $600, thecompany has potentially savedthousands of dollars in repair bills andlost aircraft time.

According to CASA Aviation Safety

Promotion general manager, Mike Smith,Skytrans is an excellent example of anaviation business that has tailored asuccessful safety management programto fit is needs.

“Skytrans has truly benefited fromformalising its safety managementsystem,” Smith said. “There are directcost benefits in both flight operations andmaintenance. There is a real sense ofownership which reflects a prosperingsafety culture.”

Skytrans managing director, DavidBarnard has seen this firsthand. “Havinga safety management system for Skytranshas been absolutely great,” he said. “It’sallowed input from staff into safety andoperational matters. It provides us with apositive marketing tool. It helps createbusiness opportunities by providingcustomers with a known high level ofservice and safety.”

Managing director of Network Aviation,Lindsay Evans agrees. We believe thesafety management system we have inplace is actually saving us money thoughbetter practices,” he said. “The peoplewho work for us have a betterappreciation of safety in general.”

A small business servicing remote areas

of Western Australia, Network has beenrunning a safety management system forthree years. The company won anAviation Safety Foundation Australiaaward this year for safety excellence.New employees spend half a day of theirtwo-day induction program learning howthe program works and the contributionthey can make to workplace safety.

Positive morale: “We emphasise thatstaff will not be penalised and no punitiveaction will be taken if they put somethingforward that might be a little delicate,”Evans said. “That means we’vesucceeded in having free flowinginformation up and down the chain.”

Chief pilot, Richard Hurd concurs. “Theemployees now have a lot of trust andbelieve when they report something that itwill be looked at carefully,” he said.

Hurd has seen many benefits flow fromNetwork’s safety management system,including the development of acomprehensive business plan.

“Having it in place has helped us gainadditional contracts, created a positivemorale within the company and made it asafer and more enjoyable place to work,”he said.

Mike Smith is not surprised at theadvantages Network has received fromsafety management.

“Their system has developed from areactive one, to one which actively seeksto identify hazards and put in placeappropriate solutions.”

Smith sees company-wide commitmentas the key to successful safetymanagement. “Everyone from the CEOdown needs to be involved,” he said.

“One of the failings that I see with

Safe & Soundby Merran Williams

21

systems in some companies is that theyhave the process to identify the hazard,they have a process to decide whatthey’re going to do about it, if anything.But they don’t have good feedbackmechanisms that go back to the reporterand the rest of the organisation. Thisfeedback needs to say: We’ve identifiedthis hazard and have put in place thismitigation for it. Or, we identified thishazard and we are not going to mitigatebecause re recognise that this is a riskthat we’re going to accept in the conductof our business. It is this feedback loopthat is vital if staff are going to have anongoing commitment to the system.”

Business information: Smith saysbusinesses might be surprised at whatthey find when they develop a safetysystem. “Putting in place a good safetymanagement system gives you a formalprocess to review the safety of yourbusiness,” he said. “In doing this youfind out an awful lot of other informationabout how your business is running, suchas what things are costing you moneyand the opportunities for savings.”

Smith points out that some companieswill only allow their employees to fly withairlines that have a formal safetymanagement system in place.

“The mining industry is one that is keen tosee the systems in place, largely becausethey have them themselves,” he said.“The concept of safety management fromthe oil and gas industry was furtherdeveloped by the industry following anaccident on a North Sea oil rig (PiperAlpha).

“The subsequent inquiry further the viewthat companies have safety systems inplace for the benefit of the organisation,its staff, customers and shareholders, notjust the regulator.”Safety management expert, James

Reason, sees effective safetymanagement as more about thecompany’s mindset and they way it treatsworkplace hazards, than about cost.

“If you’re a small operator then thereis going to be a call upon resources,but it doesn’t have to be a call upon

money... .You have tremendousadvantages if you are small.”

“If you’re a small operators then there isgoing to be a call upon resources,” heacknowledged. “But it doesn’t have to bea call upon money, because you’re aflexible organisation – you havetremendous advantages if you are small.

“What you’ve got to do is build a systemthat’s not something which seems like anextra job to do. It should be integratedinto the actual management process.

“Ideally the safety system should behomegrown and full integrated into thecurrent task so that in a year’s time itdoesn’t feel like doing it is an extra job;it’s part of how you do your business.”

Sunstate Airlines Qantas Link, a regionalpassenger airline providing servicesacross Queensland, has found this to bethe case. It formalised its safetymanagement system in 1996 with theappointment of a flight safety manager.Former flight operations manager andchief pilot, Arch Van Dongen says safetymanagement has become an integral partof managing the airline.

“I don’t think you can afford to run abusiness without managing safety,” hesaid. “I don’t think it costs that much. Itcosts some time and resources butcertainly the alternatives aren’t verypalatable. And once you have the systemin place, it becomes easier to manage

and gives you a lot of useful informationabout running your business.”

It’s about people: Chief engineer, PaulLee-Horn likes the unity that hasdeveloped within Sunstate since theimplementation of safety management.

“What I’ve found is the success of thesafety management system has been theability to bring all the departments of theairline together with a single goal,” hesaid. “That is, to achieve the best safetyrecord possible for this airline.”

For Mike Smith, safety management isabout people. “It’s about makingorganisations, big and small, value theinputs of their people and actually dealwith them in a way that addresses thehazards and safety problems,” he said.“Many companies have experience withquality systems and there is a lot ofcommon ground here. I simplify thedistinction between a quality system anda safety system by observing that aquality systems is about product andprocess, a safety system is aboutpeople.”

He sees integrated safety managementas the next big step in aviation safety.“We’ve concentrated in aviation on notharming our passengers and our crew,”he said. “Safety management takes thata step or two further, and the spin-off ofimproving the integration of a safetysystem within your business is makingsavings that flow to the bottom line.”

Reprinted with acklowedgement to FlightSafety Australia.

22

Since the project got under way late lastyear the On Track team have been veryencouraged by the response from the GApilot and the ATC community. Some 800inputs from you by fax, telephone, e-mailand, of course, the ‘Your Say’ section ofour website at www.flyontrack.co.uk whichgets a lot of good opinion and some hotair going!! You’ve come up with somegreat ideas about the reasons behindinfringements, but most important, soundadvice from you on how to improve thesystem and avoid the problem.

While you have been busy suggestingideas, the team have been running yourinputs through the various CAA and NATSagencies, such as the Safety RegulationGroup, the Directorate of Airspace Policyand LATCC. We have also been incontact with other companies andagencies such as Garmin and theAustralian CASA to discuss products thatcould be relevant to the solutions youthink we need to adopt. Finally we havebeen spreading the word at symposiumsand seminars throughout the country. Ifwe have not come your way yet and youwant to see us, please let us know.Because we are independent from theCAA we can delve as deeply as we likeinto any agency, and it’s good to reportthat we have so far received a mostpositive response from all our contacts.

Here are some of the main ideas that youhave given us so far. Although it’s tooearly for many results we can give yousome idea of the response we’ve had toyour suggestions:

LARS

■ Dedicated GA LARS controller at eachof the major airfields

■ US style Flight Following Service(frequency + radar + squawk)

■ Specific radar service to cover thenotorious Stapleford/Stansted/Lutonrouting

Progress - Funding for LARS beingreviewed – report:www.aviation.dtlr.gov.uk/lars/index.htm.

ATC

■ Review Class A airspace for possibledowngrade to Class D

■ Review base heights of airspace togain more GA airspace especiallyStansted stub

■ Review Regional Pressure Settingprocedures to avoid verticalinfringement

■ Improve communication between ATCand the GA community

Response - ATC are aware of thecommunication problem with GA trafficand are supporting all suggestions yougave to improve this – the initial messagesuggestion was theirs. They will bereviewing the length of the long messageat the next R/T meeting. DAP willcontinue to review airspace. Stansted willbe looked at again!

Maps and Charts

■ Strong support for an on-line chartfacility – freely downloadable to coverthe “hot areas” around London,Manchester and Southampton. TheAustralian VFR guide and CD ROMsuggested as an excellent role model

■ ICAO codes and frequencies shouldbe shown on charts next to airfields

■ Single sheet (A4) map size to coverLondon area – freely downloadable

■ Specific Mil maps with informationonly required below FL100 or FL55

■ VFR routes (e.g. Note 8 route) shouldbe better marked with downloadableguide & pictures

■ Zones and Control Areas should beredrawn so that boundaries followgeographical features

■ Circular boundaries for Zones andAreas (easy to read and avoid whenusing DME)

Result - A very positive response here. Aseries of prototype charts and otherproducts have already been started.

GPS

■ CAA should recognise GPS and issueguidelines for its use and a trainingsyllabus

■ Instruction manuals are too complex.Need to be simple and practical

■ Ensure all data bases are updated –possible CAA involvement to monitor

■ GPS training to be introduced afterbasic PPL navigation instructioncomplete

■ Pilots should use other navaids(including a map!) in addition to GPS

Result - Flight examiners are in theprocess of drafting guidelines forapproved GPS courses. The next step willbe for schools to produce a syllabus.Some schools already do informal GPStraining

On Track - Pushing your ideas forward and looking for more !!

23

R/T

■ Standard of R/T is poor – a practicaltraining syllabus and a basic PPL R/TPamphlet are essential

■ Sub-standard training in someschools

■ PPL confidence level when talking toATC is low - performance is poor

■ Schools should encourage studentsto use the radio as soon as possible

■ Calling ATC - always use the initial R/Tmessage – it gives you a betterchance of getting a service

■ Long R/T message needs to beshortened

Result - R/T Ground training will bereviewed. PPL R/T pamphlet beingpursued.

Navigation

■ Review JAR PPL syllabus for basicNavigation training

■ Ensure minimum number ofMATZ/CTA/CTR crossings are taught

■ Formalise navigation ground training-don’t rely on self study

Result - Publicity to be given to schoolson importance of comprehensivenavigation training to teach good basicnavigation - particularly to include Zoneand MATZ crossings

Communication

■ A GA VFR start up pack should beissued free to all new PPLs

■ AIC format for Air shows & Ralliesneed an overhaul. They’re toocomplex and not user friendly. Foreign

guides concentrate more on assistingthe pilot with colour illustrations /frequencies etc.

Result - CAA has recently introduced aSafety Information Book.

The Australian system showing easierrouting information has been adopted byDAP and they will be producing their ownversion.

So far so good, but there is a long way togo - the On Track team will continue topush forward your suggestions. However,we are still looking for more ideas fromyou in time for our report at the end ofthis year.

Please contact us:Website – www.flyontrack.co.uke-mail – flyontrack@onetel.net.ukFreephone/fax -0800 328 0792Mail – “Freepost Fly On Track”Dave, Mike & ChrisThe On Track Team Pilots

ExperienceWith nearly thirty years experience, we can easilyclaim to be one of Europe’s leading providers of aircraft services.

Air ContractorsThe Plaza, New StreetSwords, Co. DublinIreland

Tel +353 1 812 1900 Fax +353 1 812 1919info@aircontractors.com

www.aircontractors.com

24

Full members

ChairmanAirclaimsJohn Dunne

Vice-Chairmanflybe british europeanStuart McKie-Smith

TreasurerAir 2000Capt. Martin Pitt

External Affairs OfficerRAeSPeter Richards

Aer LingusCapt. Tom Croke

Aerostructures HambleDr. Marvin Curtiss

AIG AviationJonathan Woodrow

Air ContractorsCapt. Tony Barrett-Jolley

Air MauritiusCapt. Francois Marion

Air ScandicPaul Ridgard

Air SeychellesCapt. Curtis Allcorn

Air Transport AvionicsColin Buck

ALAEDave Morrison

Astraeus LtdCapt. Nick Carter

BAA plcFrancis Richards

BAC ExpressCapt. Steve Thursfield

BAE SYSTEMS Reg. A/CDan Gurney

BALPACarolyn Evans

bmi regionalCapt. Steve Saint

British AirwaysSteve Hull

British Airways CitiExpress LtdCapt. Ed Pooley

British InternationalCapt. Terry Green

British Mediterranean AirwaysRobin Berry

CAADave Lewis - MRPSChrys Hadjiantonis - Safety Data Dept.Brian Synnott - Flight OperationsAlison Thomas - Intl. Services

Cardiff International AirportGraeme Gamble

CargoLuxCapt. David Martin

Cathay PacificCapt. Richard Howell

Channel ExpressRob Trayhurn

CityJetCapt. Mick O’Connor

Cougar LeasingShaun Harborne

DHL AirPeter Naz

DragonairAlex Dawson

Eastern Airways UK LtdCapt. Jacqueline Mills

EasyJetCapt. Tim Atkinson

Emerald AirwaysCapt. Roley Bevan

European Aviation Air CharterDavid Wilkinson

EVA AirwaysAlex Reid

Excel AirwaysPeter Williams

FlightLineCapt. Derek Murphy

GAPANCapt. Chris Hodgkinson

GATCORichard Dawson

GO FLY LtdCapt. Simon Searle

HeavyLift CargoCapt. Mike Jenvey

Independent Pilots AssociationCapt. Mike Nash

Irish Aviation AuthorityCapt. Bob Tweedy

JMC AirlinesCapt. Graham Clarke

LAD (Aviation) LtdSteve Flowers

LoganairDoug Akhurst

London-Manston AirportWally Walker

Maersk AirCapt. Robin Evans

Manchester Airport plcPeter Hampson

Middle East AirlinesCapt. Mohammed Aziz

Monarch AirlinesCapt. Gavin Rowden

MyTravelCapt. Tom Mackle

NATSPaul Jones

PrivatAirCapt. Boris Beuc

RyanairCapt. Gerry Conway

Members of

25

SBACJohn McCulloch - SecretariatBryan Cowin - BAE SYSTEMSVic Lockwood -FR Aviation

Schriener AirwaysArnoud Schriener

ServisairEric Nobbs

Shell AircraftCliff Edwards

The Boeing Co.Edward Berthiaume

TRW Aeronautical SystemsKeith Joyner

Virgin Atlantic AirwaysCapt. Jason Holt

Willis AerospaceIan Crowe

Group members

bmi british midlandCapt. Ian Mattimoe

bmi british midland Eng.Peter Horner

Bristow HelicoptersCapt. Derek Whatling

Bristow Helicopters Eng.Richard Tudge

Britannia AirwaysJez Last

Britannia Airways Eng.Adrian Vaughan

CHC ScotiaCapt. David Bailey

CHC Scotia Eng.Colin Brown

EurocypriaCapt. Constantinos Pitsillides

Cyprus AirwaysCapt. Spyros Papouis

FLS Aerospace (IRL)Frank Buggie

FLS Aerospace (UK)Andrew Hoad

flybe british eropeanStuart McKie-Smith

flybe british european eng.Chris Clark

Ford AirF/O Paul Stevens

Ford Motor Co. EngSteve Laven

GB AirwaysCapt. Aaron Cambridge

GB Airways Eng.Terry Scott

KLM ukDean Godfrey

KLM uk Eng.Andy Beale

Lufthansa Cargo AGCapt. Nigel Ironside

Condor/Lufthansa & CityLine

MODDASC Col. Arthur GibsonDASC Eng.HQ STC MOD - Sqn Ldr Jeff Collier

RAeSPeter Richards

RAeS Eng.Jack Carter

Co-opted Advisers

AAIBPhil Gilmartin

CHIRPPeter Tait

GASCoJohn Campbell

Royal Met. SocietyDr John Stewart