Managing a large scale accident/incident

investigation

ICAO Accident/Incident Investigation Workshop

Oficina Regional NACC de la OACI – Mexico City

4 June 2013

Recurrent Questions

What happened?

Have you found the recorders?

Who collaborates and how?

Will the investigation be long?

Whose fault is it?

Why did it happen?

What could have

been done to prevent

this accident?

� More than ever, abide by it:� Investigations must be conducted in a timely manner with the sole

objective of drawing safety lessons;

� The State conducting the investigation must associate with the investigation other States, in particular the States of Manufacture, Design, Registry and Operation of the aircraft;

�Investigators must be independent and cannot receive instructions from any authority;

�If a judicial investigation takes place in parallel with the safety investigation, it must not impede the due course of the safety investigation;

�Only the authority conducting the investigation can provide information on the investigation. Its report must be made public.

�While respecting the sovereignty of each ICAO contracting state, an accident and its lessons learned belong to the international aviation community.

Annex 13

State of

Occurrence

State of

Design

State of

Registry

State of the

Operator

State of

Manufacture

International Organization of a Safety Investigation

International Organization of a Safety Investigation

State of

Occurrence

State of

Design

Designer

State of

Registry

Owner

State of the

OperatorOperator

State of

Manufacture

Manufacturer

Technical

adviser

Technical

adviser

Technical

adviser

Example

EASA BEA(France)

US NTSB(Acc. Rep.)

DGAC

UK AAIB

(Acc. Rep.)

Accident on 23 July 2011 at Paris-CDG airport

to the Boeing 737-300 registered G-CELD operated by Jet2.com

State of Occurrence

State of Manufacture(and Design)

State of the Operator (and Registry)

Part IOrganization and

Planning

Part IIProcedures and

Checklists

Part III

Investigation

Part IV

Reporting

ICAO Doc 9756

� Working groups:

Organization

-Wreckage-Structure-Basic systems-Engines-Maintenance

-Flight recorders-Flight qualities/ Performance-Complex systems

-Flight ops-Weather-Air navigation-Survival aspects

AIRCRAFT SYSTEMS OPERATIONS HUMAN PERFORMANCE

IIC

Deputy IIC

�Site access� Airport closed due to the accident

� Uncertainty on the location of the accident

� Remoteness of the area

� Security issues

Challenges

� Independence and competence

�Relations between Justice and Safety investigations

� Investigating human and organizational factors

�Consultation and publication of final reports

�Communication and media coverage

�Cost of sea searches and recovery

�Training

Challenges

Case Study

Safety Investigation

into the accident to the Airbus A330,

Air France flight 447, June 1, 2009

� 228 victims

� 32 nationalities

� 23-month search for

wreckage*

� 3-year investigation

� 32 millions €

Circumstances

���� BEA (France) in charge of the safety investigation

with participation of

���� CENIPA (Brazil)

���� NTSB (USA)

���� BFU (Germany)

���� AAIB (UK)

���� ANAC (Senegal)

and

� 10 countries as Observers (China,Hungary, Ireland, Italy, Korea,

Lebanon, Morocco,Norway, Russia, Switzerland).

Organization of the Safety Investigation

Floating Debris

Undersea Search Operations

Divers

Totally

encapsulated suit

standard ROV

Specialized ROV -

Submarine

????

around 2 km

Plateau continental

Plaine abyssale

Limited pingerrange

Undersea Search Operations

• Phase 1: 10 June – 10 July 2009

• Search for the flight recorders based on the signals emitted by their underwater locator beacons

• Phase 2: 27 July – 17 August 2009

• Undersea searches for the airplane wreckage using a towed sonar and Remotely Operated Vehicles (ROV)

• Phase 3: 2 April – 24 May 2010

• Undersea searches for the airplane wreckage using 3 REMUS 6000

• Phase 4: 25 March - 20 April 2011

• Discovery of the accident site

• Phase 5: 26 April – 13 May 2011

• Discovery and recovery of the flight recorders and of airplane parts

*More information:http://www.bea.aero/fr/enquetes/vol.af.447/sea.search.ops.af447.05.11.2012.en.pdf

1 and 3 May 2011: Discovery of the FDR & CVR

Recorders readout

History of flight

Flight Path

22 h 29

01 h 49

BEA animation

� Based on data from flight recorders

� For educational or training purpose only

� Not all parameters that were displayed to the crew are shown here

AOA and Stall Warning threshold

Warnings

Significant CVR events or comments

Flight path

1 2 34 5 6

7

Part 1

Part 2 Part 3

���� Part 1: from the beginning of the CVR

recording until the disconnection of the

autopilot

���� Part 2: from the disconnection of the

autopilot to the triggering of the stall warning

���� Part 3: from the triggering of the stall

warning to the end of the flight

1 Cruise at FL 350 and Mach 0.82

Part 1

A few minutes after ORARO: heading change of 12 degrees to the left2

Part 1

Main findings - Part 1

�The composition of the crew was in accordance with the operator’s procedures.

�There was an implicit designation of a pilot as relief Captain.

�There is no regulatory CRM training for a crew made up of two copilots in a situation with a relief Captain.

1 2 34 5 6

7

Phase 1

Part 3

Part 2

Soon after AP disconnection: roll and nose-up inputs by the PF, the

airplane began to climb3

Part 2

Altitude 36,000 ft - vertical speed reached max value of +6,900 ft/min4

Part 2

Frozen Pitot

Speed displayed on the PFDs

Main findings - Part 2

�Unreliable airspeed situation �difficulty to have a correct situation awareness following a situation

with unreliable airspeed

�lack of appropriate response to unreliable airspeed situation

�observed response of the crew not specific nor isolated

�poor training to unreliable airspeed situations

�Insufficient basic airmanship

�CRM �loss of coordination due to stress and when faced to a

misunderstood situation.

�inaccurate communications

�Ergonomic �numerous messages displayed by ECAM

�no specific ECAM message that could help the crew to identify the situation

�FD still engaged

1 2 34 5 6

7

Part 1

Part 2

Part 3

Altitude 37,500 ft, Mach 0.68 and angle of attack 5°°°° => triggering of the stall warning5

Part 3

Stall warning in alternate law

AOA

Flight Enveloppe

Altitude 35,800 ft, vertical speed -9,000 ft/min, N1 around 102%

Part 3

6

Altitude 10,000 ft, nose-up pitch: 12 °°°°, angle of attack > 40°°°°, vertical speed: -12,000

ft/min

Part 3

7

End of flight, nose-up pitch: 16°°°°, roll 5°°°° left, vertical speed: -10,900 ft/min

Part 3

Main findings - Part 3

�The speed displayed

�on the left PFD was incorrect for 29 seconds,

�that of the speed on the ISIS for 54 seconds

�and the speed displayed on the right PFD for 61 seconds

at most

�The angle of attack is the parameter that allows the stall

warning to be triggered; if the angle of attack values become

invalid, the warning stops

�By design, when the measured speed values are lower than

60 kt, the measured angle of attack values are invalidated.

�The aeroplane’s angle of attack is not directly displayed to

the pilots

�Neither of the pilots formally identified the stall situation

Sequence of events leading to the accident

1. The temporary inconsistency between the measured

speeds, likely following the obstruction of the Pitot probes

by ice crystals

Pitot probes

Speed measurement system architecture

1. The temporary inconsistency between the measured

speeds, likely following the obstruction of the Pitot probes

by ice crystals

Ice Crystals

Pressionmesurée

Measured

Pressure

⇒⇒⇒⇒ autopilot disconnection and reconfiguration to alternate law

2. Inappropriate control inputs destabilizing the flight path

3. The lack of any link, by the crew, between the loss of displayed airspeed information and the appropriate procedure

4. The late identification of the deviation from the flight path by

the PNF and insufficient correction applied by the PF

5. The crew not identifying the approach to stall, their lack of

immediate response and the exit from the flight envelope

6. The crew’s failure to diagnose the stall situation and

consequently a lack of inputs that would have made

recovery possible

AOA

These events can be explained by the

combination of these associated factors:

� The feedback mechanisms of all of those involved

� To identify the repeated non-application of the loss of

airspeed information procedure and to remedy this,

� To ensure that the risk model for crews in cruise included

icing of the Pitot probes and its consequences;

These events can be explained by the

combination of these associated factors:

� An absence of training, at high altitude, in manual

aeroplane handling and the procedure relating to

speed indication anomalies

These events can be explained by the combination of these associated factors:

� Task-sharing weakened by

� Incomprehension of the situation when the autopilot disconnection occurred,

� Poor management of the startle effect that generated a highly charged emotional factor for the two copilots;

� Lack of a clear display in the cockpit of the airspeed inconsistencies identified by the computers

These events can be explained by the combination of these associated factors:

� The crew not taking into account the stall warning, which could have been due to:� A failure to identify the aural warning, due to low exposure time in training to stall

phenomena, stall warnings and buffet,

� The appearance at the beginning of the event of transient warnings that could be considered as spurious,

� The absence of any visual information to confirm the approach-to-stall after the loss of the limit speeds,

� The possible confusion with an overspeed situation in which buffet is also considered as a symptom,

� Flight Director indications that may led the crew to believe that their actions were appropriate, even though they were not,

� The difficulty in recognizing and understanding the implications of a reconfiguration in alternate law with no angle of attack protection.

Safety Recommendations

41 Safety Recommendations

� Interim Report n°2: 6

� Interim Report n°3: 10

� Final Report: 25

6

26

13

13

1

0

5

10

15

20

25

30

DGAC AESA OACI Aut. Brésil FAA Aut. SénégalSenegalEASA Brazil FAAICAODGAC

Safety Recommendations

� Certification (2)� Meteorological

� AOA indicator

� Operations and Initial and Recurrent Training of Pilots (11)� Manual aircraft handling

� Reconfiguration law and associated protections

� Relief captain

� Managing crew resources and surprise

� Instructor training

� Improvement of flight simulators and scenarios

Safety Recommendations

� Ergonomics (6)

� FD appearance / disappearance

� Warning vs Triggering of specific monitoring

� Stall warning

� Operational and Technical Feedback (2)

� Feedback process from in-service events

� Oversight of the Operator (2)

Safety Recommendations

� Search and Rescue Operations (6)� Coordination

� Organization of SAR in France

� Air Traffic Control (2)� Use of ADS-C and ADS-B

� Link ground / aeroplane

� Flight Recorders and Transmission of Flight Data (10)� Flight parameters transmission

� ULB

� Recorded parameters

� Image Recorder

� Public reports:� 3 interim reports (July 2, 2009;

December 17, 2009; July 29, 2011)

� final report (July 5, 2012)

� More at: http://www.bea.aero/en/enquetes/flight.af.447.php

More Information