ROYAL JORDANIAN AIRLINES FLIGHT OPERATIONS DEPARTMENT / FLIGHT SAFETY FLIGHT SAFETY NEWSLETTER ( NOV. 2011 )

Prepared by: F/O. Marwan Al-Dayaflah Manager Flight Safety

1

Table of content

Subject

Page

Safety Assessment of Foreign Aircraft (SAFA)

3

Air India Express pilot flirts with danger 4 times and grounded as a 6

result Air France 447 Latest Report; Mandating Safety, or Cost?

8

Loss of communication prompts intercept for an A321 near Munich

10

Turkish Airlines A343 at Mumbai involved in runway excursion

11

Fatigue Risk Management System (FRMS)

12

2

Safety Assessment of Foreign Aircraft (SAFA)

Introduction The European Civil Aviation Authorities perform since 1996 ramp inspections on aircraft visiting their countries. During such an inspection, the compliance with the applicable International safety standards (issued by the International Civil Aviation Organization [ICAO]) is checked. These inspections became mandatory for all Member States of the European Union as of April 2006. This leaflet is to explain the setup of the program. Which aircraft are checked? The Participating States (countries) choose which aircraft to inspect. Besides the obligation that aircraft being suspected of noncompliance with the international safety standards shall be inspected, most participating States carry out random inspections. Both aircraft used by EU operators and non-EU operators may be inspected. What is checked? A checklist of 54 inspection items is used during a SAFA Ramp Check. It is SAFA policy not to delay an aircraft except for safety reasons. As the time between arrival and departure (the turn-around time) may not be sufficient to go through the full checklist, not all 54 items might be inspected. Checks may include: • • • • • •

Licenses of the pilots; Procedures and manuals that should be carried in the cockpit; Compliance with these procedures by flight and cabin crew; Safety equipment in cockpit and cabin; Cargo carried in the aircraft; and The technical condition of the aircraft.

Note: SAFA audit has a repetitive items to check such as NAV DATA BASE in use, RVSM check during flight each one hour, Flight Documents (LTS, Logbook, WX..etc ), Enroute Charts validity, A/C

3

certificates and Manuals, Cabin Condition & Security and A/C General Condition. The inspections carried out by the Participating States follow a common procedure and are then reported by entering them into the centralized SAFA database of the European Aviation Safety Agency (EASA). It has to be stressed that SAFA inspections are limited to onthe-spot assessments and cannot substitute for proper regulatory oversight and therefore they cannot guarantee the airworthiness of a particular aircraft. Findings and follow-up actions A non-compliance found during an inspection is called a finding. Such findings are categorized according to the magnitude of the deviation of the requirements and to the influence on safety of the non compliance. Minor deviations (category 1) are reported to the Pilot in Command. If an inspection identifies one or more significant deviations from the safety standards (category 2 findings), these will also be reported to the operator and its competent authority. Where non-compliances have a major impact on safety (category 3), the flight crew is in addition expected to correct such non-compliances before the aircraft departs by either correcting the deficiency or by imposing restrictions on the aircraft operations (by e.g. blocking a defective seat for its use by passengers). The 42 Participating States engaged in the EC SAFA Program are: Albania, Armenia, Austria, Azerbaijan, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Moldova, Monaco, Netherlands, Norway, Poland, Portugal, Republic of Georgia, Romania, Serbia and Montenegro, Slovakia, Slovenia, Spain, Sweden, Switzerland, The former Yugoslav Republic of Macedonia, Turkey, Ukraine, United Kingdom.

4

Follow-up process The Stakeholders involved in the SAFA process are the State of Inspection, the Operator, the State of Operator and the State of Registry the (if different from the State of Operator). These organizations play a key role in the follow-up process after an inspection is conducted: 1. The SAFA inspector debriefs the Pilot in command and hands over the Proof of Inspection. 2. The inspector requests the pilot in command to sign a copy of the Proof of Inspection form. 3. In case of category 2 and/or 3 findings, a written communication will be send to the operator and to the competent authority overseeing the operator. 4. The operator is requested to reply to the written communication with an action plan which addresses the deficiencies. 5. The competent authority ensuring the oversight of the operator (and/or the airworthiness of the aircraft) may be asked to confirm their agreement on the corrective actions taken. 6. Findings are considered closed when the deficiencies have been satisfactorily addressed. 7. Subsequent inspections by any participating State may occur to verify rectification of the deficiencies. Database analysis All reported data is stored centrally in a computerized database set up and managed by EASA. The database also holds supplementary information, such as lists of actions carried out following inspections which revealed non-compliances. The information held within this database is reviewed and analyzed by EASA on a regular basis. The European Commission and Member States are informed about the results of the analysis and are advised on any identified potentially safety hazards. In case of any questions resulting from an inspection, one should contact the participating State directly.

5

Air India Express pilot flirts with danger 4 times and grounded as a result (It was a quartet of mistakes that could have had disastrous consequences). In the course of landing an aircraft in a strong crosswind, an Air India Express commander took four erroneous decisions, one after another, endangering a Boeing 737 aircraft and its 87 passengers. Luckily, it all ended with damage done only to the aircraft and the commander's flying record. The potentially fatal incident occurred on November 3rd 2011 on the Cochin-Salalah Air India Express flight IX 441 when it landed after three attempts at 9.45am, local time. After a very rough touchdown, the Boeing 737 aircraft hurtled down the runway only to jerk sharply as two tyres burst. One wing almost scraped the runway surface and the landing gear was damaged before the aircraft came to a halt near the runway end. The commander was so flustered that even after the plane stopped, he kept the engines running and did not release his foothold on the brakes for about 15-20 minutes till an engineering team arrived to tow away the aircraft. Confirming the incident, the Air India Express spokesperson said: "The landing was not in keeping with our standard operating procedures. It indicated a disregard for the SOP by the commander." The series of faulty decisions began when the flight reached Salalah (Oman) airspace and the pilots were informed by the Omani air traffic controller that the wind speed on the ground was 25 knots (46 km/h) gusting (sudden bursts of high-speed wind) to 35 knots (65 km/h). "The aircraft should not have attempted a landing in Salalah as the crosswind (wind blowing across the runway) speed was about 35 knot," said a source. The SOP manual disallows a landing when the surface wind speed is beyond 25 knots, and in this case, it was not only about the wind speed but also about wind direction. Landing in a crosswind is more difficult, as an aircraft is prone to drifting laterally as it approaches the runway. At this point, the commander should have diverted the aircraft to Abu Dhabi, the alternate airport listed in the flight plan. An aircraft is flown 6

to an alternate airport if the commander perceives that a safe landing is not possible at the destination airport (it is mandatory to carry enough fuel to fly to the alternate). There are instances where experienced commanders have managed to land safely in a strong wind and taken care to ensure that the flight safety department of the airline concerned was not informed about it. "But the best of pilots follow the norms. If a landing is in violation of an air safety norm, it is not done," said a senior commander. The AI Express commander too tried to land in Salalah, but had to abort the landing. After the first failed attempt, he took the aircraft up 6,000 feet and after 10 minutes attempted a second landing, only to fail again. Finally, he decided to divert to Abu Dhabi, which is one hour, 15 minutes away. But that wasn't the end of the matter. "The commander entered the wrong data into the Flight Management System and it threw up a scare," said the source. "It showed that only six minutes of flying time would be left on reaching Abu Dhabi, which was insufficient to make a landing." In reality, the aircraft had 4.7 tons of fuel on board, and the fuel needed to reach and land safely in Abu Dhabi was 4.5 tons. But since the commander was under the impression that the aircraft was short on fuel, he panicked and decided to return to Salalah. It was now the commander's third attempt at landing in Salalah in poor weather, which is something air safety experts warn against. Several airlines worldwide have banned a third attempt at landing at an airport in poor weather and made a diversion mandatory. Air India, however, does not have such a policy yet-the airline spokesperson said this was "under review". During the third attempt, the commander decided to do an autoland although the cockpit crew was not trained to do so. In an autoland, the aircraft directly takes inputs from ground-based navigation instruments that give guidance to an aircraft on descent profile and horizontal maneuvering. But there are wind speed restrictions for autoland, and a 35-knot crosswind is way above the permissible limit for a B737. "The commander also disregarded the limitations by Boeing Company for autoland operation," said the airline spokesperson. "The matter is under investigation by our air safety department."

7

Air France 447 Latest Report; Mandating Safety, or Cost? (As expected, the BEA has called for mandatory black box data streaming technology aboard airliners). The French accident investigation branch, the Bureau d'Enquêtes et d'Analyses, has formally recommended that mandatory "triggered data streaming technology" be installed aboard airliners. The recommendation is contained in the latest BEA accident report investigating the loss of the Air France Flight 447, a document that outlines 10 new safety recommendations, including improved pilot stall-awareness training, the inclusion of cockpit cameras, and adding angle-of-attack readouts in the cockpit. But it's the inclusion of a call for mandatory data streaming technology that is sure to raise the biggest objections with airlines, who will have to pay for it. Specifically the BEA recommends: "that EASA and ICAO make mandatory as quickly as possible, for airplanes making public transport flights with passengers over maritime or remote areas, triggering of data transmission to facilitate localization as soon as an emergency situation is detected on board." That the BAE's report includes a recommendation for the International Civil Aviation Organization and the European Aviation Safety Agency to require triggered transmission of black box data from aircraft isn't surprising. Now that the BAE has formally proposed the idea, it will be up to ICAO and EASA to decide whether and how to implement to mandate. It won't be easy. There are some obvious and fairly complex technological questions that must be addressed but still, equipment makers and the companies that control satellite transmission of data are enthusiastic supporters of the concept. Again, that's not surprising, since they'll reap the financial rewards of any such a mandate. On the technological side of the argument; during the two-year investigation of the Air France tragedy, AeroMechanical Services, a Calgary, Alberta, maker of automatic flight information reporting 8

system equipment, participated in the BEA's data recovery and triggered data transmission working groups. The company has demonstrated an "on-demand triggered data streaming technology" called FLYHTStream that can automatically transmit the exact position of an aircraft and key black box data in real time, with a minimum of fuss. AeroMechanical Services has been testing FLYHTStream aboard a Hawker 750 for several months with promising results as data was broadcast over the Iridium satellite network to ground networks. The company's so-called AFIRS 228 standard will soon become "a fully certified avionics platform capable of meeting all air navigation requirements for CPDLC in Europe and Future Air Navigation System in the United States, providing all input and outputs necessary to continue to enhance the value of real-time data in flight." The cost of equipping airliners with such a technology, of course, will be steep. But if such capabilities are built in to CPDLC an FANS equipment that airliners will soon need anyway, the cost impact would be somewhat mitigated. At least that's the theory. So apparently the technological hurdles of beaming black box data from airplanes by satellite aren't as great as was first supposed, even though the cost implications remain. Never mind that instances where an airliner crashes and the black boxes are never recovered is exceedingly rare (it's happened only once). The big question, of course, is just because we can send real-time flight data from commercial aircraft, should airlines forced to do so?

9

Loss of communication prompts intercept for an A321 near Munich An Onur Air Airbus A321-200, registration TC-OAL performing flight 8Q-6380 from Manchester, EN (UK) via Bodrum (Turkey) to Ercan (Cyprus) on 20th Aug 2011, was enroute at FL330 over Germany when radio communication with the aircraft was lost for more than 15 minutes without the crew setting their transponder to the loss of communication code. A pair of German Eurofighters intercepted the aircraft over Bavaria's Chiemsee southeast of Munich, communication was restored and the aircraft continued to Bodrum for a safe landing about 2 hours later. The sonic booms were widely heard in Bavaria causing a lot of emergency calls by worried citizens. On Saturday (Aug 20th) Munich-Erding's police reported the Eurofighters went supersonic on a training mission. On Sunday Bavaria's Police Headquarter however confirmed that the Eurofighters were on a protective mission ("Schutzflug"). On Monday Germany's Air Force confirmed that an Onur Aircraft entered Bavarian Airspace however no radio contact could be established by Munich Radar. Two Eurofighters were launched at 16:13L to intercept the aircraft. About 5 minutes later the fighters had intercepted the A321 over Lake Chiemsee, the Onur pilots however did not understand the problem despite international signaling by the Eurofighter crews and continued enroute towards Austria. Two Austrian Eurofighters were launched as well and took over. The Onur crew slowly seemed to realize that they had lost radio contact and finally restored radio communication while over Graz (Austria) just before the Hungarian Air Force would have launched their interceptors. The German Air Forces assume that the Onur crew simply forgot to change frequency or selected a wrong one while being handed off to Munich Radar.

10

Turkish Airlines A343 at Mumbai involved in runway excursion A Turkish Airlines Airbus A340-300, registration TC-JDM performing flight TK-720 from Istanbul (Turkey) to Mumbai (India) with 93 passengers and 11 crew, had landed on Mumbai's runway 27 at 04:13L (22:43Z Sep 1st 2011). While attempting to turn off onto high speed exit N8 the aircraft veered off paved surface and came to a stop with all gear on soft ground within the runway protected zone. No injuries occurred. The runway was closed, and despite being expected to re-open by 20:00L about 14 hours after the incident remained closed until the evening of the following day for a total of about 43 hours. The airport remained open using the second shorter runway 14/32. Mumbai Airport reported the runway had been inspected at 03:58L with all airside infrastructure found operational/functional, following the inspection one landing and one takeoff took place prior to the landing of TK-720. Turkish Airlines said, the aircraft skidded off the runway due to excessive rainfall. No injuries occurred. A replacement aircraft has been dispatched to Mumbai to conduct the return flight TK-721. India's Directorate General of Civil Aviation rated the occurrence a serious incident and opened an investigation. Mumbai METARs at that time: •

VABB 012310Z 19005KT 1200 R27/1400 RA FEW012 SCT015 FEW030CB BKN090 25/25 Q0999 TEMPO 0800 +SHRA • VABB 012210Z 19005KT 2100 HZ FEW012 SCT015 FEW030CB BKN090 26/26 Q0998 TEMPO 1500

11

Fatigue Risk Management System (FRMS)

Fatigue is a known contributor to aviation accidents. This has been acknowledged by the NTSB through its most-wanted transport safety improvements list, where action to reduce fatigue-related accidents in aviation remains a critical item requiring attention. The acknowledgement that current fatigue management strategies are ineffective is a sentiment shared worldwide. Both ICAO and EASA have recently issued guidance recommending management strategies to address the fatigue risk threatening safe airline operations. So why may there be resistance to full implementation of a fatigue risk management system (FRMS)? 24-hour operations expose employees in the aviation industry to varying and often lengthy periods of time on duty, disruption to circadian patterns compounded by reduced and often interrupted rest periods. On top of this are workload influences, including external and internal factors that can vary from one duty or shift to the next. These hazards can interact and result in a fatigued employee – one whose ability to perform safety-related duties is impaired. What is a FRMS? A static means of fatigue management, such as prescriptive rules, cannot fl ex or adjust to the operating environment that exists at any one time and in any one place. For example, a legal twelve hours’ time on task limitation is the same for an aircrew member operating a two-sector duty at the start of a shift sequence following multiple days off and experiencing minimal workload or hassle factors as it is for another aircrew member operating their last shift of a six-day sequence of duty, flying into a category C airfield and with an inexperienced co-pilot. This is clearly simplistic. Such examples can be found in all areas of aviation, be it airline operations, maintenance, air traffic control, etc. On the other hand FRMS provides a way of extracting data from the specific operational environment and comparing it with scientific knowledge on sleep and shift sequences. It therefore effectively manages the risks posed by fatigue as a result of the operational 12

circumstances that actually exist. It is proactive and continuous so as to identify the risks, implement mitigating strategies and review the outcome, ensuring the risks are controlled effectively and continuously. How do I implement? By its dynamic, adaptive and analytical nature, FRMS is not easy to implement. It is multi-faceted rather than binary. FRMS requires that an operation be flexible, with a willingness to change if and when required. This may be for all or only specific parts of the business as determined. For large organizations, which are highly automated and systems dependent, this can be extremely difficult given their inherent inertia and legacy processes. Small changes may require lengthy lead-in times and complex systems integration. This will therefore necessitate careful planning by subject matter experts, including impact forecasting which must account for varying circumstances. Simply relying on the legal limitations as a means of controlling the fatigue risk is easy; however, it is also becoming recognized as incomplete and therefore unacceptable. FRMS requires education, increased expertise and understanding, but any investment made is recoverable through the accrued benefits it brings. Is it worth it? In essence FRMS exists to ensure an organization can proactively manage the operational fatigue risk, thereby reducing the chance of a serious accident linked to fatigue. Yet, simultaneously, as alertness increases, we can expect to see a reduction in the incidents, cognitive slips and lapses caused by fatigue. Human factors degradations such as impaired decisionmaking, reduced communication and increased risk taking will diminish. These safety improvements can have a quantifiable benefit to the organization through a significant reduction in insurance premiums. As employee alertness improves, recovery is optimized, leading to a better work / life balance for the individual and reduced attrition for the organization. Furthermore, absence due to fatigue 13

related sickness is reduced, bringing greater stability to the operation and heightened performance. At what cost? The safety benefits of FRMS are apparent but the improved efficiencies which are intrinsic to a well-developed FRMS can equally be quantified. Predictive fatigue models can be utilized to highlight the productivity restrictions in prescriptive flight time limitations and to suggest the FRMS managed variations that can provide additional flexibility (within an appropriately risk-mitigated environment). However, predictive fatigue models are only one tool within an FRMS toolkit. By implementing an array of fatigue risk identification strategies such as field studies, surveys and employee reporting, the operating environment can be fatigue-risk assessed. Working with the local safety authority and all other stakeholders the risk areas, as identified, can be targeted using specific management strategies with similar beneficial outcomes for both safety oversight and productivity.

14