Australian accidents and incidents - some worrying trends
The last time, I took for granted that a Safeskies audience would know what the ATSB was and the roles it played in Australia's system of aviation safety. Conversations with a number of you - and with others - have since convinced me that I might have been over-optimistic on that score.
We're still positioned in the public's mind as 'the accident investigator'. Certain television series only reinforce that view. Thorough and effective investigation is of course an essential part of what we do - a necessary pre-condition - but it's only one of several means and definitely not an end in itself.
The end goal is improved safety.
So, with apologies to those of you who think I'm stating the obvious, here's the simple person's picture of the system of safety and where we fit in.
Having established the particular - and in our view essential - role of the ATSB, let's move to an equally simple picture of how we carry out that role.
In terms of our priorities (if not necessarily allocation of resources), safety occurrence information is of equal weight with investigation in identifying issues and trends in the system of safety.
The Australian system is almost unique in how the no-blame investigator is the focal point of mandatory occurrence reporting, rather than the regulator. This sends a clear signal: understanding what might have gone wrong and fixing it has priority over holding people and organisations to account for their responsibilities - important though that is.
Don't get me wrong: we pass information from all the occurrence reports we receive to CASA on a daily basis and this informs their regulatory scrutiny of the system of safety. That's as it should be. My point is more that the concepts of just culture are embedded in the overall system of safety and how roles are allocated within it.
In any event, our database of occurrence information is a formidable source of safety information.
So, what is all this data telling us?
Looks like a beautiful trend in commercial air transport. But embedded in that is an average over the last ten years of two fatal accidents and six deaths, mainly in charter work - and none in high-capacity regular public transport.
And of course there is no room for complacency: there have been several high-capacity accidents and occurrences in recent Australian aviation that were closer than any of us would wish to disaster. I'll return to that point later.
Of course, we don't just do high-level analysis. We try and understand what is causing the occurrences we are told about. We classify each occurrence by type. During 2010, the top four occurrence types for air transport relating to accidents and serious incidents were aircraft separation; aircraft control; power-plant, propulsion and airframe; and a combination of terrain collisions, runway events and ground operations events.
Then there's general aviation. Again, the trends look pretty good.
But what underlies this is an average of 15 fatal accidents causing 24 deaths each year. And about half those accidents and half those deaths relate to private and business flying.
Put crudely, private pilots are dying at the same rate as motor cyclists. And they are doing it in sadly predictable ways. This is why we have put some of our resources into a series of 'avoidable accident' publications. We want to help pilots understand what can get them into potentially fatal trouble and how to reduce their risks.
I'll leave that there. So let me simply reiterate my main point. We hold the national safety occurrence dataset on behalf of the aviation sector as a whole. We are committed to meeting the responsibilities of using that information, sharing it and making it publicly available. But it's critically dependent on getting the information in the first place.
These are just some boring workload indicators of our core investigation business.
They do illustrate some important points, though. We're getting better at putting our investigative attention where it should be, at scoping our investigations and completing them more quickly without reducing quality. And we're heading towards a sustainable level of investigation activity - and some reasonable prospect of giving each significant occurrence the attention it deserves.
All this investigative work is aimed at identifying safety issues.
And for each safety issue we identify, we do a formal risk assessment, to establish whether the risk is critical, significant or minor.
The only critical safety issue we identified in the last year related to a certain A380 aircraft. The aircraft's No 2 engine had sustained an uncontained failure of its intermediate pressure turbine disc. Sections of the disc had penetrated the left wing and the left wing-to-fuselage fairing, resulting in structural and systems damage to the aircraft.
Within a month of the accident, the ATSB, leading an investigation that involved a range of other countries and major corporations, had established the presence of fatigue cracking within a small stub pipe that feeds oil into one of the engine's bearing structures.
The fatigue was attributed to misaligned counter-boring of the stub pipe as part of the engine manufacturing process. Such fatigue cracking, if it occurred in other engines, had the potential to create oil leakage which could lead to catastrophic engine failure from a resulting oil fire.
As a result of this work, a number of safety actions were immediately undertaken by Qantas, the Australian Civil Aviation Safety Authority, Airbus, Rolls-Royce plc, and the European Aviation Safety Agency that enabled the resumption of safe flight by all aircraft equipped with the failed engine type.
The investigation continues so that all the safety implications and lessons from the accident, including positive lessons about how the emergency was handled, can be reviewed and published.
But we also identified a number of significant safety issues in other investigations.
One significant investigation (AO-2008-003) was an occurrence involving a Boeing 747-438 aircraft which was subject to a number of electrical power-related malfunctions affecting many of the aircraft's communication, navigation, monitoring and flight guidance systems.
While the consequences were potentially very serious, the aircraft's engines and hydraulic and pneumatic systems were largely unaffected and the aircraft landed safely at Bangkok.
The malfunctions were found to have been caused by leaks resulting from an overflowing galley drain.
The investigation identified a number of serious and systemic safety issues regarding the protection of aircraft systems from liquids. In response, the aircraft manufacturer and operator implemented a number of safety actions intended to prevent a recurrence. In addition, the United States Federal Aviation Administration issued a notice of proposed rulemaking to adopt a new airworthiness directive for certain 747-400 and 747-400D series aircraft to install improved water protection. The ATSB issued two safety recommendations and one safety advisory notice as a result of the investigation.
While we issued recommendations, the key point here is that there is no single party that is able or can be held to account for fixing a set of issues that start with design and certification, move through operator-specific configuration decisions to maintenance procedures and their oversight and extend to flight training and procedures.
The no-blame investigator can specify the problem, but we need to find better ways of getting all the relevant parties alerted to the issue and active in resolving it. We've got to get beyond recommendations to communicating safety issues in a compelling way.
Another investigation, AO-2009-065, highlighted potential problems with unreliable airspeed indications in Airbus A330 and A340 aircraft. When airspeed data is unreliable, some aircraft systems respond in ways that pilots do not encounter often. Airspeed data is derived from mechanisms called pitot probes, which respond to variations in the airflow outside an aircraft.
In the occurrence the ATSB investigated, involving an Airbus A330-202 aircraft, there was a brief period of disagreement between the aircraft's three sources of airspeed information. The autopilot, autothrust and flight directors disconnected and the flight control system reverted to alternate law, which meant that some flight envelope protections were no longer available. There was no effect on the aircraft's flight path, and the flight crew followed the operator's documented procedures. The airspeed disagreement was due to a temporary obstruction of the captain's and standby pitot probes, probably due to ice crystals. A similar event occurred on the same aircraft on 15 March 2009.
Both of the events occurred in environmental conditions outside those specified in the certification requirements for the pitot probes. That is, the certification requirements were not sufficient to prevent the probes from being obstructed with ice during some types of environmental conditions. As a result of its own investigations of similar occurrences, the French Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile (BEA) has recommended the European Aviation Safety Agency (EASA) to review the certification criteria for pitot probes in icing environments. The ATSB is satisfied that this work, when complete, will address this significant safety issue.
Other investigations also identified significant safety issues relating to the safety of air transport.
These related to the supervision of agricultural pilots, training and supervision of charter pilots, potentially hazardous helicopter winching procedures, turbulence caused by buildings at airports, airspace design and management and problems with the management by air traffic control of compromised separation of aircraft. In each case, the ATSB was satisfied that action had been taken or was in train to address the identified safety issues.
I referred earlier to the increased number of short investigations that complement larger investigations by providing more detailed data on a significant number of safety occurrences for future research and analysis. We produced three bulletins containing a total of 52 short summary reports in the course of last year. Examining these in conjunction with our research reports and our larger investigations draws out some potentially significant safety trends in Australian aviation.
The first is the continuing prevalence of incidents and some accidents involving inadequate execution by pilots of 'see-and-avoid' procedures in the vicinity of smaller airports. The ATSB has consistently drawn attention to the limitations of see-and-avoid, but work remains to be done in making sure pilots understand and respond to this.
The second is a range of occurrences which involve issues with the training, checking and supervision of pilots. This trend is independent of the total hours of flight experience pilots have and often involves the execution of normal but rarely used procedures. The ATSB will continue to monitor this area to see if the underlying issue can be drawn out more clearly.
Third is the number of occurrences involving the breakdown of air traffic control separation of aircraft or problems in recovery of a compromised separation. Airservices Australia has taken safety action to deal with recovery from compromised separation (see investigation report AO-2009-080), but several investigations currently under way are likely to clarify whether a series of separation breakdowns point to any systemic safety issue.
Finally, there are a number of safety occurrences in general aviation which point to a continuing exposure to known risks: a sequence of collisions with previously identified powerlines; poor management of fuel leading to fuel exhaustion; and pilots flying visually into instrument conditions. As I indicated earlier, the ATSB has dealt with the continuing prevalence of these types of occurrence by the production of focussed educational material for pilots and by conducting safety education programs based on this material.
Some parting thoughts. A number of our investigations have shown that Australian pilots have responded effectively and with safe outcomes to circumstances where automated aircraft systems acted anomalously. Without wishing to sound complacent or to draw comparisons, these safe outcomes from potentially catastrophic events provide a number of positive lessons for the future.
There has been much discussion about over-reliance on aircraft automation and the de-skilling of pilots. There is a great need for us to change the terms of that debate.
Large, complex and highly automated aircraft are here to stay. We need to turn our focus to ensuring that flight crews are prepared for that environment - and for the circumstances where automation fails or reacts unpredictably. We are not just talking about flying skills. We need to understand how best to prepare for the rare, unpredictable, stressful and complex event.
A key focus of the ATSB's work is and remains the learning and promulgation of positive lessons. Things often go very well - and it is crucial to understand why. We look forward to working with you not only to discover why things go wrong, but also to recognise why they didn't and make sure that others share in the benefits of that learning.
