For a better use of incident analysis and safety data

1. For a better use of incident analysis and safety data International Air SafetySummit Flight SafetyFoundation Capt. Bertrand de Courville Washington 31st October 2013

2. Worlwide Air Transport Safety Records (up to date) Fatal accidents Multi-engine commercial aircraft Certified for more than 13 passengers Source: ASN - FSF http://aviation-safety.net/index.php/ Production Protection Risk exposure Safety barriers Production/Protection “balance management” • Environmental changes are continuously affecting both sides • Corrections, adjustments and adaptations are permanently needed • Major improvements need imagination and joint innovations

3. Less catastrophic accidentsChallenges and opportunities • Less fatal accidents potentially leads to • Unclear trends and correlation between accident scenarios • Focus on the most recent catastrophic accident and consequently less resources to address other accident risks • A significant risk awareness and safety commitment erosion at all level • More than ever, learning from accidents is not sufficient. Further safety improvement suppose to introduce innovations in the way • we monitor, check and maintain critical safety barriers • we analyze worldwide serious incidents • we disseminate the most significant outcomes

4. Managing Safety DefensesMonitoring, checking and maintaining • Three significant safety case studies related to three different risks and corrective actions • A risk of loss of control (1994) • A risk of runway collision (1998) • A risk of mid air collision (2002)

5. Managing Safety DefensesMonitoring, checking and maintaining

6. Managing Safety DefensesMonitoring, checking and maintaining • Three significant safety case studies related to three different risks and corrective actions • A risk of loss of control (1995) • A risk of runway collision (1999) • A risk of mid air collision (2002)

7. Managing Safety DefensesMonitoring, checking and maintaining • Three significant safety case studies related to three different risks and corrective actions • A risk of loss of control (1995) • A risk of runway collision (1999) • A risk of mid air collision (2002)

8. San Diego - 1978 - B727 – 2600 ft- Approach Los Angeles – 1986 DC9– 6000ft - Approach Managing Safety DefensesMonitoring, checking and maintaining

9. In 2002 … F/O safety report related to a non consequence eventHe reported having initially reacted the opposite way to a RA TCAS. Managing Safety DefensesMonitoring, checking and maintaining • A simple risk assessment rates this scenario as a high risk one • This event was published in our monthly safety bulletin • The publication triggered two other reports relating similar events • A FDA algorithm was implemented to monitor opposite response • This issue was shared and published in Eurocontrol ACAS bulletin

10. FDA (FOQA) algorithmDetecting and sharing opposite response to TCAS Sharing at a European level (Eurocontrol) Managing Safety DefensesMonitoring, checking and maintaining RA 3 sec pitch order opposite to RA t sec 7 Consecutive sec

11. Managing Safety DefensesMonitoring, checking and maintaining • Airbus SafetyConference in Barcelona (2003) • TCAS opposite response case presented • FDA algoritmoffered to beshared • One airlineusedit and found the sameresults • This became an industry issue and led to the TCAS 7.1 TCAS 7.0 TCAS 7.1 ‘’Level Off’’

12. Managing Safety DefensesMonitoring, checking and maintaining Operations Accidents ? • Loss of control • CFIT • Mid air collision • Runway collision • Runway excursion • Other damages/injuries (Flight) • Other damages/injuries (Ground)

13. Managing Safety DefensesDissemination of lessons learnt • Whenever a critical aircraft system failure affecting airworthiness aspects is identified through an incident, manufacturers and/or authorities may decide a check of an aircraft type fleet worldwide because there is a significant probability that the same failure already have or could occur somewhere else. AD could be published. • Similarly, serious incident related to pure operational issues may reveal critical operational failures that could reflect a much wider industry problem. But there is no process to check further the existence of the same weaknesses, in other airlines/organisations.

14. Dissemination of lessons learntComparing Technical and Operational Events • Arcraft systems related incident • Very efficient and structured dissemination process of lessons learnt whenever an incident reveals key airworthiness aspects of aircraft systems or technical issues. • A fleet could be inspected and measures taken within a few week with immediate measures • Flight operations related incident • No formal and structured processe to encourage further « inspection » worldwide of specific operational issue discovered in operational incident • Predictive aspects of key operational (non airworthiness) related failures Not used to prevent accident worldwide. • Accidents still needed to consider repetitive incidents and trends The most significant safety failures found in every single high risk operational incidents, should inspire further check across the industry and, when needed, safety actions.

15. Dissemination of lessons learntTaking advantage of standardization • Worlwide harmonization bring opportunities • More standardized policies, procedures, practices and training makes more « predictable » operational failures • Most of safety issues detected and addressed in a single airline are also a concern in other airlines. • Do we take enough advantage of this ?

16. FDM(FOQA) LOSA Air Safety Reports Surveys Dissemination of lessons learntImplementing safety watch as SMS component * Space of precursors * * * * * * * * * * * * * * * * * * * * * SIB/SAFO * * * * * ? * * * * * * * * * * * * * * * * * * * * * * * *

17. Dissemination of lessonsImplementing safety watch as SMS component Internal monthly publication « safety watch » Summary (per accident families) • Safety Promotion (awareness) • MonthlySafety Publication • Hazard identification • Most significantevents are reviewedduringSafety Action Groups Meeting

18. Defenses Whatwe must manage Whatwe must manage LOC Reporting channels Control Recovery UC CFIT What we collect UC Undesired events Runway Collision UC Mid-Air collision UC Runway Excursion UC Other Damages (Flight) UC Other Damages (Ground) Managing Safety DefensesAbout methodology Altitude bust Runway Incursion, W&B error Aircraft system malfunction, Loss of separation, etc.

19. LOC UC CFIT UC High Risk Operational Events Runway Collision UC Mid-Air collision UC Runway Excursion UC Other Damages (Flight) UC Other Damages (Ground) Managing Safety DefensesAbout methodology • Identified high riskoperationalevent. Couldithappen to us ? • No. Can weproveit ? • Yes. Do we monitor the risk? Can wepreventbetter ? Safety Watch Control barriers Recoverybarriers

20. Managing Safety DefensesThe ARMS methodology as an example • RiskAssessment of IndividualSafety Events • ERC «Event RiskClassification» • IdendifySafetyIssue • Reactive, preparingtheproactiveapproach • Risk Assessment of Safety Issues • SIRA „SafetyIssuesRiskAssessement“ • ProactiveorPredictive • RiskAssessment of operational changes • (Management of Change) • SIRA «SafetyIssuesRiskAssessement» • ProactiveorPredictive

21. Managing Safety DefensesGA decision: a critical safety barrier GA decision making is a barrier against landing accidents risk. Is this barrier robust? Are our crews performing well? What training? How do we know for these threats or unsafe conditions ? • Degraded visibility at low height • Not stabilized at 1000/500 floor • Destabilized at low height • EGPWS “Sink rate” or “Pull Up” • Tail wind and wet/contam. rwy • Deep landing • Bounced landing • Wind above limits • Severe turbulence • Wake turbulence • Windshear • Instrument failures (in IMC) • Runway occupied • Runway/airport confusion

22. Managing Safety DefensesGA decision: a critical safety barrier • Degraded visibility at low height (rain showers, fog patches) • When ground, approach lights and some runway lights are in sight, we may think they still sufficient visual cues to continue • But we may not be aware that the horizontal visibility has reduced to a few hundreds of meters, below the minimum needed to detect and correct accurately deviations. Why ? • More resources are needed to keep visual contact and control the flight path. Pilot corrections are delayed and become inaccurate. Vertical or lateral deviations may develop without being detected. • PF alone have not any more resources to decide a go around. Again PM role is key ! • Many runway overrun or landing short accidents are related to this type of situations which are not met during training

23. Managing Safety DefensesGA decision: a critical safety barrier • Degraded visibility at low height (rain showers) • When a single good video equals hundreds of words • A training opportunity through Youtube www.youtube.com/watch?v=8WNBxNoCO1Q Video 4 GA in Heavy Rain

24. Weak transport system • Risk control based on individuals • Intensive training • Accident analysis • Safe transportsystem • Technology (acft & simulators) • Procedures,regulation, HF • Incident analysis • High reliability transport system • SMS: Beyond regulatory compliance • Evolution of training • Better use of safety data Managing Safety Defenses High risk to high reliability era through innovation

25. Managing Safety DefensesA European (ECAST) Initative • High Risk Incident Review initative • Objective • To identify the most significant safety barrier failures from individual high risk incidents, susceptible to inspire further check by safety professional throughout civil aviation. • Tasks (Extract) • To agree on an review method and to document this method. • To analyse High Risk Incidents using the agreed method • To disseminate its findings to the wider aviation community

26. Conclusion • Further safety improvements need innovation and … • Better Safety board efforts around the world to comply with ICAO Annex 13 regarding investigation and communication about high risk incidents • Formal and structured worldwide dissemination processes of key safety failure identified in high risk operational incidents still to be developed • Adoption of a common barrier based model to be used both in high risk incident analysis and safety data mining

27. Thank You