Issuu

SPRING/SUMMER 2015

HAZARD IDENTIFICATION & RISK ANALYSIS

JUST CULTURE THE HUMAN HEART OF SAFETY

COPORATE SAFETY & RISK OFFICE P04 Aer Lingus Risk_Cover.indd 1

AIRBUS IMMERSION TRAINING P17

HUMAN TRAFFICKING P38 30/04/2015 16:17

AER SAFETY / CORPORATE HEALTH & SAFETY / 0037

IFC Aer Lingus Risk_IFC 1pp.indd 37

30/04/2015 14:19

AER SAFETY/ CONTENTS / 001

Contents 03 04

INTRODUCTION Captain Conor Nolan welcomes you to this issue of Aer Safety magazine.

CSRO Meet the team behind the work of our Corporate Safety & Risk Office.

AIRBUS IMMERSION WEEK Airbus delegates participate first-hand in the daily operations of the CSRO.

EMBEDDED SAFETY MANAGERS The implementation of a direct link between individual departments and the Corporate Safety Risk Office promises improved resilience.

JUST CULTURE Managing safety issues in an atmosphere of trust.

HAZARD IDENTIFICATION & RISK ANALYSIS HIRA is a proactive tool that can identify potential risks and avoid unwanted concequences.

A DAY WE WILL ALWAYS REMEMBER An extraordinary lesson in fuel gauging left an indelible impression on a young pilot.

001 Aer Lingus Risk_Contents.indd 1

MINIMUM FUEL AND FUEL SHORTAGE Information for controllers.

HOW SAFE IS OUR INDUSTRY? Captain Conor Nolan assesses the evidence.

PREPARE TO BE SURPRISED An overview of the current thinking on upset prevention and recovery training.

ETIHAD PARTNERSHIP GROUP Giving Aer Lingus useful operational and safety performance insights.

CORPORATE SECURITY Complex security issues are posed by remotely controlled aircraft.

SAFETY SURVEY Results show the overwhelming relevence of safety training to all of our staff.

HUMAN TRAFFICKING Our anti-trafficking strategy depends on frontline staff being aware of and vigilant for signs of human trafficking

2014 A YEAR IN REVIEW A look back at some of the extraordinary highs and lows in aviation last year.

THE AUTOMATION PROBLEM There is clearly an automation problem. But what is its real cause? And why has it taken so long to become obvious? Captain Ed Pooley asks.

CORPORATE HEALTH AND SAFETY Working at heights requires a carefully managed assessment of risks and responsibilities.

COMPETITION Solve our aviation-themed puzzle to be in with a chance of winning 50.

SPECIAL THANK YOU to Stephen Jordan who works in the Ground Ops department for supplying the cover photo and additional photographs for use in this publication.

01/05/2015 10:13

AER SAFETY / CORPORATE HEALTH & SAFETY / 0037

002 Aer Lingus Risk_Image 1pp.indd 37

29/04/2015 16:36

AER SAFETY/ INTRODUCTION / 003

Introduction

W CAPTAIN CONOR NOLAN

DISCLAIMER This magazine contains confidential information and is prepared for Aer Lingus. Information contained within is believed to be accurate at the time of publication but no warranty of accuracy or reliability is given and no liability is accepted for errors, loss or damage (including but not limited to special, incidental, consequential or other damages) suffered as a result of a person acting in reliance thereon. Information does not supersede official operations manuals, policies or procedures. Copyright of this document is property of Aer Lingus without whose written permission reproduction in whole, or in part is strictly prohibited.

elcome to this latest edition of our SMS magazine, Aer Safety. In this edition we introduce some of the many industry groups with which we regularly interact, sharing experiences, lessons learnt and working together to improve the resilience of our individual airlines and the wider system. No single organisation can possibly pretend to know all the answers, and in the same way as we encourage each of you to share with us your experiences through safety reporting, hazard reporting, incident feedback and routine operational engagement, the Corporate Safety & Risk Office in turn is actively involved with a multitude of industry safety forums, with operators such as the Etihad Strategic Partner Safety group, with IATA and EASA, as well as with global safety initiatives such as the Flight Safety Foundation. Through the relationships we have built and continue to nurture, we have access to the experience of a wide range of industry experts and airline safety and operations staff. Together we strive to improve the way we share data, information and intelligence so that we can all become aware of hazards and threats before they ever manifest as safety occurrences in our operations at home. In this edition, we also introduce the new CSRO team and our newly formed embedded safety managers team. Safety management has evolved enormously over the last decade, developing from a specialised activity housed in what was then called the Air Safety Office, into a company-wide effort where every department has some involvement, and now under EASA Air Operations regulations every staff member is required to have safety training commensurate with their responsibilities. Against this backdrop the mission of the CSRO is changing, with more emphasis now on supporting the company in managing safety as business as usual. To facilitate this move, a team of dedicated safety champions have been recruited to

fulfil the role of local safety manager within each operational department. The CSRO will support this team, providing all the necessary training and tools to allow them in turn to support their local management in driving improvements in safety performance, as well becoming the focal point for local staff safety engagement. The CSRO retains its independent role, providing safety assurance and investigation capability, as well as being the primary liaison with state authorities both at home and abroad. All of us have worked hard together to maintain a consistently high standard of safety, and Aer Lingus has a well-earned reputation for safe operations and pro-active safety management. However, the absence of serious events is not enough to allow us rest and become complacent. We know we can still do better to prevent things from going wrong by recognising those times, places and activities that could go wrong, nearly went wrong, or indeed did go wrong but were saved by the good actions of the people involved. When we talk about these things, we all benefit by learning from others’ mistakes or experiences, and are better prepared to cope if we find ourselves in similar situations. We must respect and trust each other to do the right thing, have courage to take responsibility for our own actions, and be prepared to engage in open, constructive dialogue to help drive continuous improvement in safety performance. In 2014, Aer Lingus introduced “Our Values and Behaviours”. Our challenge is to work together as a team to make Aer Lingus unique, successful and safe. Enjoy the magazine, and please do take the time to tell us what you like, what you’d like to see more of, and most importantly what we can do to support you in playing your part in keeping Aer Lingus safe. Lastly, please share this magazine with your colleagues. Thank you, Conor

PLEASE SHARE THIS MAGAZINE WITH YOUR AER LINGUS COLLEAGUES

003 Aer Lingus Risk_Introduction 1pp.indd 3

29/04/2015 16:34

004 / AER SAFETY/ CSRO

Corporate Safety & Risk Office

A look at the active framework and faces behind today’s airline safety procedures.

The Corporate Safety Risk Office is an independent functional unit within the company, and is central to the concept of managing safety as a core business process. The office is the focal point and is responsible for the development, administration and maintenance of an effective safety management system. The CSRO ensures best practice and strives for continued improvement in terms of our safety needs. It requires proactive identification of potential hazards and looks for deficiencies within the operations so that corrective and preventative actions can be implemented. The CSRO’s primary role involves analysing safety reports, risk assessing and then ensuring adequate investigation and corrective action is achieved by the departments. In addition the office provides support to the departments during HIRA processes, and tracking and monitoring flight safety data with a view to identifying potential precursors of potential issues with air safety. All this information is collated and generates regular reports for the organisation; it too aids the discovery of potential hotspots and in the monitoring of safety trends in order to ensure that risk is kept as low as reasonably practicable. As part of our role we ensure that feedback is provided and conduct regular safety training. An article will discuss some feedback that has been generated from this training and we welcome your thoughts and opinions in relation to any safety training or queries you may have. In addition the CSRO provide the oversight for the organisation and ensure that there is an active framework in place to sup-

004 Aer Lingus Risk_CSRO team 2pp.indd 4

OPERATIONAL CHANGES We would also like to announce some operational changes within the office. Our Flight Safety Officer Captain Joe Elliott, who has been an invaluable team member and an asset to the Corporate Safety & Risk Office, has been recently promoted as the Compliance Monitoring Manager. We would like to take this opportunity to thank Joe for all his hard work, and wish him every success within his new role.

Captain Joe Elliott.

port the business and safety needs. Regular meetings are attended both on and off site. Members of the office have heavy involvement with external bodies, for example the IAA, IATA, NATS and UKFSC, and attend regular meetings, seminars and conferences in order to promote and share critical safety knowledge and of course to enhance our understanding, which can be transcended into the departments. This edition hopes to give some understanding of the type of work we do and provides a taste of some of the topics discussed at these external organisations.

The office is the focal point and is responsible for the development, administration and maintenance of an effective safety management system.

30/04/2015 14:16

AER SAFETY/ CSRO / 005 PAUL KEARNEY Flight Data Monitoring

MUTSUMI SAGA-WALSH Corporate Safety & Risk Officer

JESSICA BROWNE Safety Management Systems Manager

Paul joined Aer Lingus in 1982 as an apprentice mechanic. Paul has worked in many departments, for example M&E and TEAM, and also the simulator section. In 1999 Paul then moved to ACARS, Satcom and Flight Data Monitoring. In 2010 Paul’s role was then evolved and he became part of the Air Safety Office as there was a safety need for further technical information to ensure proactive identification of safety trends.

In April 2000 Mutsumi joined Aer Lingus as cabin crew, where previously she had worked as a registered nurse in Japan and senior cabin crew for Virgin Atlantic Airways. Mutsumi is responsible for managing and dealing with all air safety occurrences and actively engages and provides support to the departments. She is supporting the CSRM in creating the enterprise risk management system and provides valuable statistical data for the organisation.

Jessica Browne joined Aer Lingus in 1999 and has recently taken on the role of SMS manager, with responsibility for leading and developing our new Embedded Safety Manager team. Jessie previously worked in the Air Safety Office, Ground Operations Compliance, Operations Logistics Compliance, Emergency Response and most recently as Corporate Portfolio Manager. She brings a wealth of corporate knowledge and experience to our team.

CAPTAIN CONOR NOLAN

CSRO TEAM 2015

004 Aer Lingus Risk_CSRO team 2pp.indd 5

Conor joined Aer Lingus in 1989 as a cadet pilot, and is currently an A320 captain. Conor joined what was then the Safety Office in 2008 as the Fight Safety Officer. In spring 2010 he was appointed as the Safety Manager, and became responsible for providing an efficient safety management system, and ensuring safety knowledge and understanding within the business. In August 2013 Conor’s title changed to Corporate Safety & Risk Manager and he is tasked to create a framework for the enterprise risk management for the company. Conor also sits on the Board of Governors of the Flight Safety Foundation.

FIONA COX Corporate Safety Management Systems Administrator Fiona recently joined the Corporate Safety Risk Office in July 2014 having previously worked as a housing officer. She has a B.Sc. in Environmental Health from Dublin Institute of Technology and has gained experience across a number of areas. Fiona’s primary role is liaising with departments, processing reports with risk assessment and ensuring the efficient and smooth operation of the office.

29/04/2015 16:38

006 / AER SAFETY / EMBEDDED SAFETY MANAGERS

Embedded Safety Managers The implementation of a direct link between individual departments and the Corporate Safety & Risk Office brings the promise of improved resilience.

hy embedded safety managers? Regulation (EC) No 216/2008 of the European Parliament and of the Council of 20 February 2008 laid down common rules in terms of aviation safety. Article 8 Air Operations which came into force in October 2014 requires the implementation of an effective (safety) management system. With the changing legislation it became apparent there was a need for additional supports to aid the effective delivery of safety management across the organisation while also keeping in line with statutory requirements. From this need embedded safety managers have been appointed. The embedded safety managers are aimed at ensuring departmental responsibility when it comes to reporting, reviewing and working towards closing occurrences. There will be a number of benefits of these embedded safety managers there primary aim will be to achieve and promote strategic safety objectives; they will act as support to the CSRO whilst in addition supporting their own departments. The projects long term aim is to continuously improve our safety culture and processes across the whole organisation while ensuring the organisation can continually meet new and evolving statutory requirements in terms of aviation safety.

JUST CULTURE The ESMs will ensure the implementation of Just Culture and will strive to achieve the highest level of safety by encouraging regular reporting within their departments. This introduction of embedded safety managers will explore new ways of improving the effective-

006 Aer Lingus Risk_Embedded Safety Officers_2pp.indd 6

ness of safety action planning and safety implementation throughout the departments. Each of these managers will report directly to their own departments; however, they will also have a direct line to the Corporate Safety and Risk Office and will provide valuable support and resources in the line of safety for the business. It is envisaged that the ESMs will champion safety and drive for improvement within their roles. They will ensure active leadership, whereby our Just Culture will be reinforced at every level of supervision. They will lead by example to ensure that best practice is followed at all times in terms of safety.

29/04/2015 16:39

AER SAFETY / EMBEDDED SAFETY MANAGERS / 007

PERSONAL RESPONSIBILITY It is important to note that safety requires the involvement of each and every individual; where the ESM will drive for continual improvement, it is just as important that everyone is aware of risk issues and encouraged to notify concerns promptly. Responsibility for safety lies with each and every one of us. To ensure that a learning outcome is achieved the ESMs will ensure that issues are translated into knowledge by providing regular feedback. This means that positive safety risk attitudes and behaviours can be encouraged and compliance improved through training and identifying new and emerging trends.

006 Aer Lingus Risk_Embedded Safety Officers_2pp.indd 7

EMBEDDED SAFETY MANAGERS THE CURRENT EMBEDDED SAFETY MANAGERS FOR EACH DEPARTMENT ARE LISTED AS FOLLOWS:

Catering Safety Officer Mary Murphy

Ground Ops Safety Officer Witold Proszynski

Cargo Safety Officer Gerry Wheeler

IFS Safety Officer Miriam Herrero, Yvonne Farrell, Anita Brown, David Sheahan, Janet Smith, Sharon Clifford, Jennifer Haye

IOC Safety Officer Declan Doherty, Paddy Mulvihill

Flight Safety Officer Captain Michael Mulligan Maintenance Safety Officer Gus Kieran, David Hickey CSRO Jessica Browne

29/04/2015 16:40

008 / SAFETY FIRST / JUST CULTURE

Just Culture The evolution of Just Culture within our organisation encourges issues around safety and compliance to be managed in an atmosphere of trust. Safety culture has evolved over the decades; culturally organisations have undergone many changes in terms of how management deal with human factors. The safety within any organisation has a direct correlation to the culture that is promoted within the company. This has been identified through numerous aviation disasters that have acted as catalysts and lead us to where we are today. As part of this shift it is recognised that if the system fails, it creates a hole in our defences that impacts human performance which can lead to human error; however, how we deal with this human error relies on ensuring a positive reporting culture. Culture also gives rise to an organisation’s identity and can determine the organisation’s beliefs, values, and working norms. A notion of ‘this is how we do it round here’ can be instilled within a culture, which is not always the vision of the organisation. Over time the organisation can develop ‘norms’ or ‘normalised behaviour’ as people become overfamiliar with patterns of work and can sometimes take shortcuts leading to an understanding whereby a complacency culture over time becomes established.

ATMOSPHERE OF TRUST With this in mind it has led to an organisational shift in how we view our culture within the organisation and it brings up the subject: when something goes wrong, where does the responsibility lie? Taking this question into consideration has led the organisation to introduce the concept of Just Culture. The implementation of this Just Culture was first identified by James Reason. Reason refers to Just Culture as “an atmosphere of trust in which people are encouraged, even rewarded, for providing essential safety-related information, but in which they are also clear about where the line must be drawn between acceptable and unacceptable behaviour.” This sentiment is further enhanced by the European Commission in which they define Just Culture as “a culture in which front line operators or others are not punished for actions, omissions or decisions taken by them that are commensurate with their experience and training, but where gross negligence, wilful violations and destructive acts are not tolerated” [EC No 691/2010]. This draws a clear culpability line and distinguishes organisational failures it identifies from unacceptable reckless behaviour by an individual. Just Culture is about creating a balance between safety and corrective action. It ensures that where honest mistakes are made, whereby there were unin-

008 Aer Lingus Risk_Just Culture_3pp.indd 8

JUST CULTURE Can you find it? Can you explain it? Do you promote it? Do you ensure it happens?

JUST

CULTURE THIS WAY

29/04/2015 16:41

SAFETY FIRST / JUST CULTURE / 009

A notion of ‘this is how we do it round here’ can be instilled within a culture which is not always the vision of the organisation.

WE MANAGE THIS AS AN ORGANISATION BY PROVIDING:

JUST CULTURE POLICY Our Just Culture policy is not simply a policy, it is the way we do things around here. This is through management commitment by ensuring consistency across the organisation. Our accountability sharing chart ensures consistency when dealing with individual incidents. This can be found in the Safety Manual on the Intranet.

008 Aer Lingus Risk_Just Culture_3pp.indd 9

PROCEDURES Aer Lingus ensures that policies, standard operating procedures and checklists are in place. This puts the onus of responsibility back onto the organisation, which protects a staff member from any ramifications where a genuine mistake is made.

COMMUNICATION & TRAINING Effective communication is essential for the Just Culture policy to be effective. Adequate

training is provided to all employees to ensure that safety requirements are maintained to a high standard. Training is provided to ensure that employees’ duties are commensurate to the roles. Culture can be enhanced through training to ensure safer decisionmaking choices.

ENVIRONMENT Transparency across the organisation is essential. It ensures

an atmosphere of trust where learning outcomes are an integral part of the Just Culture process. Ongoing safety feedback of reported incidents and the reinforcement of the importance of safety are essential to ensure that incidents such as ‘near misses’ are reported. Just Culture provides a positive environment for incidents to be reported, which results in safer operations throughout the organisation.

tended consequences, so far as reasonably possible that individual is protected by the system. However, an individual who acts recklessly and irresponsibly creating undesirable events or consequences will be subject to corrective action.

POSITIVE SAFETY CULTURE Culture can be identified as being either weak or strong. A strong culture leads to increased awareness, therefore providing more understanding and awareness with learning outcomes, which has an increased benefit for producing better safer systems. This type of enforced culture identifies that organisations understand that mistakes can happen.

30/04/2015 16:16

010 / SAFETY FIRST / JUST CULTURE

RISK MANAGEMENT People’s behaviours, their ability to make decisions and choices can all impede safety; however, the benefit of a fair and transparent Just Culture policy aims to provide a mechanism where individuals and departments can learn from mistakes. The introduction of this culture has many added benefits compared to previous negative cultures. Staff become empowered, it ensures ownership and creates an atmosphere of trust, both for the organisation and the staff. In addition accountability is understood; both the organisation and individuals know at what point they become responsible. To every action there is a consequence whether negative or positive; it is important that in the course of our duties we apply good risk management principles at all times and minimise our level of personal and organisational risk. An accountability flow chart is incorporated into our Safety Manual and can be found on page 25, located on the Intranet. This accountability chart defines and gives a structure in how we deal with people when an incident occurs. In the majority of cases responsibility will normally fall with the organisation as it often becomes apparent that the system in some way let the person make a mistake that had negative consequences. In addition, as part of the accountability spectrum, at times an investigation may require a substitution test, which looks at how groups of individuals perform a similar task. This substitution test is formulated to identify situations where behaviours or work practices have become normalised, which has led to a breakdown within the defence layer, and which identifies a systemic issue that needs to be rectified.

The diagramme below outlines our behaviours and values, which have been incorporated into some of the key points of the Just Culture Policy.

Team

Humanity

Courage

Performance

Honesty

TEAM We are all part of a team to deliver the company’s vision of “Connecting Ireland to the World”. We work together to ensure safety is pro-actively managed by sharing knowledge and safety ideas. PERFORMANCE It is essential to the culture process that feedback is given and learning outcomes are recognised to ensure the safe activities of the operation and that we achieve our personal and organisational safety goals. HONESTY We need your honesty to report incidents or ‘near misses’ that are potential hazards and risks to our operations, in a timely manner. It is important that we all adhere to the Standard Operating Procedures and conform with all regulatory requirements to ensure that safety is not compromised. COURAGE Reporting incidents and ‘near misses’ takes courage. We must have the confidence to speak up when things go wrong, to ensure we learn from our mistakes, move on and work more confidently in conducting our duties. HUMANITY This underpins our Just Culture policy. As an organisation we are aware that employees will make mistakes from time to time. Our Just Culture policy ensures protection for honest mistakes. It ensures that as an organisation we act both fairly and objectively to ensure consistency across the airline.

In addressing culture communication is key, both in terms of assessing and reporting safety. As such it is vital that the lines of communication are kept open at all times and there is the freedom to communicate both up through departments and vice versa. Equally the introduction of the embedded safety managers ensures that there can be horizontal communication also, whereby safety can be discussed with colleagues within your departments. Safety reporting is paramount to an organisation’s culture and both are interlinked. Without a strong, Just Culture where staff can openly report without negative cognitions or backlash, safety will fail. Every occurrence reported has the potential to develop into something more serious; however, with the freedom of reporting the incident rate of something occurring can be greatly reduced as systemic issues, standard operating procedures and checklists can be continually monitored, reviewed and re-evaluated to ensure that the system and the processes in which we work in are fit for safe and continued operational use.

CONCLUSION The introduction of EASA OPs signals changes in how our safety management systems are integrated into our operational needs by addressing our cultures and human performance in terms of our individual roles that can impact on safety. The last 15 years have seen major improvements, aviation as a sector has become 95% safer; however, with this improvement we also must be mindful that we can never become complacent. How we move forward with these changes is extremely important and involves each and every one of us becoming involved with the process. The culture we create as an organisation underpins every aspect of safety, and as we move with the changes the regulator will increasingly be challenging the industry with regards to human performance and error management. This cultural shift is identifying that people create safety, and through continued re-evaluation and reflection that is conducive with learning outcomes creates the benchmark going forward.

FOR MORE information please refer to the Safety Manual that can be found on the CSRO Intranet Portal, or alternatively you can contact csro@aerlingus.com

008 Aer Lingus Risk_Just Culture_3pp.indd 10

30/04/2015 11:39

AER SAFETY / HAZARD IDENTIFICATION & RISK ANALYSIS / 011

risks for safe operation or activities within the organisation. In addition the CSRO ensure that managers are charged with the knowledge and training to successfully carry out the hazard identification procedure.

CONSIDERED ANALYSIS In this instance transporting Leona the turtle did not pose a significant risk or affect the overall operation of the airborne flight; however, considerations were made to ensure a low passenger-load flight. The carriage of Leona was securely fastened over two seats to ensure that should turbulence occur Leona would be safe, while also preventing any passenger panic on board the fight. Accountable personnel are charged with ensuring that the HIRA’s mitigating controls and defences are in place in order to ensure an effective and safe operation in the delivery of activities within the business. This was just one example of our HIRA process; however, HIRAs continually take place every day regarding every aspect of the operations within the organisation.

Hazard Identification & Risk Analysis

Risk Assessment

Recently Aer Lingus became involved with transporting Leona the turtle back to its natural habitat. As part of this process Flight Operations conducted the hazard identification and risk analysis process in ensuring this happened safely. Prior to the introduction of new operational activities, as an operator we are required by EASA to identify aviation safety hazards, and evaluate and manage associated risks, including taking actions to mitigate the risks and verify their effectiveness. All operations actively use the HIRA process before any activity is carried out. It is a proactive tool that is utilised to identify any potential risks that may result in any consequences both on the ground and in the air. The HIRA process involves identifying the hazard, stakeholder analysis, defining risks/hazard, gap analysis on existing SOPs, and treating risks and hazard with preventative and corrective actions when necessary to reduce the risk to as low as reasonably practicable (ALARP). Where a HIRA deems a hazard to be unacceptable alternative arrangements or additional controls and mitigating factors are needed to reduce that risk.

Hazard Identification

Risk Control

HIRAs are the principal tool responsible for ensuring effective hazard identification. The hazard is then risk assessed by identifying severity and likelihood, and where necessary risk controls are put in place to minimise risk to ALARP.

HIRA RESPONSIBILITY The HIRA process is the responsibility of the particular department/s that may be introducing a potential hazard; however, the CSRO oversee the process of the HIRA and ensure that where the hazard is reduced with mitigating factors it does not create further SPECIAL THANKS TO COLM MAHER WHO SUPPLIED THE ABOVE PHOTOS.

011 Aer Lingus Risk_Hazard Identification_2pp.indd 11

30/04/2015 12:43

012 / AER SAFETY / A DAY WE WILL ALWAYS REMEMBER

A DAY WE WILL ALWAYS REMEMBER An extraordinary lesson in fuel gauging error and the concept of unusable fuel left an indelible impression: by Captain Harry Nelson, Airbus Industries.

012 Aer Lingus Risk_A day to remember_3pp.indd 12

FOLLAND GNAT T1 XP502 IN RED ARROWS COLOUR SCHEME. © MILLBORN ONE

y story starts with a young 19 year old RAF trainee pilot entering the visual circuit at RAF Valley in the UK, which is situated on the island of Anglesey in northern Wales. The aircraft being flown is a fighter trainer, the Folland Gnat, a beautiful, small and responsive “sports car” of an aircraft made famous by first the Yellow Jacks and later the Red Arrows aerobatic teams. The sky is blue and the circuit is quiet. This student loved flying and it therefore seemed perfectly “reasonable” for him to “put on one side” the fact that his fuel level was nudging slightly below the 550 lbs level, at which he was supposed to call for a priority landing. He decided to do “just one more circuit”. After a pretty well-flown circuit, he was turning downwind to land when an instructor asked to join the circuit and immediately declared “fuel priority”, which meant that he had about 350 lbs or enough for about three circuits total. No problem; our student still had more fuel than him – just! Of course, he was sent around to the dead side only to find that the instructor was quite a long way out and he had to extend the circuit, so that by the time he was ready to turn onto a long downwind position, his thoughts

29/04/2015 16:45

AER SAFETY / A DAY WE WILL ALWAYS REMEMBER / 013

Captain Harry Nelson presented an extended version of this facinating story at the Airbus Flight Safety Conference in Paris in March 2015 This article is an extract from a longer presentation on fuel management and diversion airfield capability that Harry presented at the Airbus Flight Safety Conference in Paris in March 2015. Aer Lingus has attended every Airbus Safety

Conference since its inception. This conference brings together well over 100 airbus operators from across the globe to discuss topical safety and operational issues, sharing experience and facilitating the building of networks. Airbus Flight Safety

publishes a magazine, Safety First. It is made available to pilots in the Operations area and published online on the CSRO Intranet page and posted on Yammer. Download the Airbus Safety First App from the iTunes Store to read it on your own device.

THE FOLLAND GNAT A small, swept-wing British subsonic jet trainer and light figher aircraft developed for the RAF. Designed by W.E.W. Petter, it first flew in 1955. Although never used as a fighter by the RAF the Gnat T.1 trainer variant was widely used. The Gnat became well known as the aircraft of the RAF’s Red Arrows aerobatic team.

012 Aer Lingus Risk_A day to remember_3pp.indd 13

30/04/2015 14:29

014 / AER SAFETY / A DAY WE WILL ALWAYS REMEMBER

were interrupted by an ATC transmission from the leader of three Lightning fighters returning from missile practice who also asked to join the circuit and declared very forcefully their need for priority due to lack of juice, which in their case meant an immediate landing. One of them at least was probably sucking fumes. ATC, knowing that there was no comparison between the comparative value to Her Majesty of three front-line Lightning fighters and three fully trained fighter pilots and a student flown trainer, naturally gave priority to the Lightnings. A decision made easy by the student’s failure to speak up and admit his fuel state. Yes –- I can see several pilots reading this starting to smile, as he became No 5 for landing: he was by now too scared to say anything about his fuel situation. Having duly gone around again twice more and finally positioned behind the last Lightning, he was praying that no more aircraft would enter the circuit. The Gnat cockpit looked like the above right – but not to him. There was only one gauge in there of any importance at that time. Managing to take his eyes off the fuel gauge sufficiently long enough to land the aircraft, he landed at last and taxied in with about 130 lbs left. Well maybe just a smidgeon less! He shut down and after a short de-brief with his instructor, that did not include the word “fuel” once, he headed to the mess bar for a well needed pint or two of beer. He had “got away with it!” Or so he thought. The next morning, arriving at the squadron and sliding past the Flight Commander’s office, en route to the crew room, he heard his name being called quite forcefully. As he entered the office he was met with the words: “Come in, you may like to read that”, the Flight Commander said, pointing to a piece of paper on his desk. Yes – you have all guessed right. The words at the top of the official-looking form said “Fuel Bowser Dispensing Figures” from the previous day. And the name of “Nelson” was right at the top. I knew immediately that the game was up. When caught red handed, I had already learned that there is only one survival strategy in the military – tell the truth and pray. So I told him the story exactly as it happened. As it unfolded, and to my surprise, instead of venting his fury on me, he started to laugh and then finally told me what my “punishment” was going to be.

012 Aer Lingus Risk_A day to remember_3pp.indd 14

Captain Harry Nelson is Executive Advisor to the Vice-President of Product Safety at Airbus. A former test pilot, he has flown every variant of Airbus aircraft, and in his wide and varied career has flown over 75 different aircraft types. In 2012 Harry addressed the Aer Lingus Pilot Instructor Seminar in Dublin.

FOLLAND GNAT COCKPIT

The Gnat cockpit looked like this... only one gauge in there was of any importance at that time; the fuel gauge. Subsequently, fuel gauging error and unusable fuel were always two of the first things I went and discovered about all the new aircraft I went on to fly and I did have a few occasions in later flight test operations when that information was used for real and in earnest.

As he dismissed me from the “interview” he said: “Nelson, you have just learnt one of the most important lessons of your career and you have learnt it early – this is a day you will always remember.” With some relief, I started to leave his office but he had one final “kicker” for me. He called me back and asked me a question. “Do you know what fuel gauging error is?” he asked quite quietly. I didn’t, I hadn’t got a clue. In fact, I had never ever heard the term and therefore I had never thought about it. But later, after I had visited the fuel bay in the hangar and read up about it, as he demanded, I lost several nights’ sleep as I went over and over the events of that day and how close I had been, especially when I calculated the worst-case fuel state. All that, and imagine this: the concept of unusable fuel was still unknown to me. My punishment, by the way (which I know you all want to hear) was to go into the crew room, call the whole course to order and explain how I got into the situation of being so short of fuel. I also had to describe the way I felt during those infinitely long circuits that built up to the landing. As well as my fellow students, many instructors also just “happened” to come into the crew room to listen and to add to my embarrassment and discomfort. I deserved it all. Yes – I will always remember that one. Subsequently, fuel gauging error and unusable fuel were always two of the first things I went and discovered about all the new aircraft I went on to fly and I did have a few occasions in later flight test operations when that information was used for real and in earnest.

Nelson, you have just learnt one of the most important lessons of your career and you have learnt it early – this is a day you will always remember.

30/04/2015 12:44

AER SAFETY / MINIMUM FUEL / 015

Minimum Fuel and Fuel Shortage INFORMATION FOR CONTROLLERS By Dr Anne Isaac and Captain Tim Price

BACKGROUND In May 2012, the Manual of Air Traffic Services Part 1 was amended in the section ‘Low Fuel, Holding Procedures and Associated Radiotelephony Phraseology’ to include the response by controllers to a pilot’s declaration of ‘minimum fuel’, which ICAO had planned to introduce into PANS-ATM in October 2012.

DEFINITIONS Minimum fuel is the term used to describe a situation in which an aircraft’s fuel supply has reached a state where little or no delay can be accepted by the flight crew. It is not an emergency situation but indicates that an emergency situation is possible, should any undue delay occur [ICAO]. However, ‘minimum fuel’ RTF phraseology is not universally used by every aircraft operator and pilot. A pilot’s declaration of minimum fuel indicates that no further fuel diversion options are available where the aircraft is committed to land at the pilot’s nominated aerodrome of landing with not less than ‘final reserve’ fuel.

CONTROLLER AND PILOT ACTIONS

COMMITTING TO LAND This is a picture of the Fuel page on the Electronic Centralized Aircraft Monitoring system of an Airbus 320: fuel is displayed to an accuracy of +/- 10kg. Fuel on board was 3,060kg when this picture was taken.

principles are applicable to any flight in any aircraft type. The first point to note is that in modern aircraft the fuel-gauging is very accurate, and all the fuel on the gauges is usable – so the pilots are very well aware of how much fuel they actually have.

COMMITTING TO LAND The ICAO text talks about ‘committing to land’ at a specific aerodrome – what does that mean? EASA rules are quite clear in that regard: the aeroplane is required to land with (for a jet) fuel for 30 minutes of flying time. How the crew manages their flight to achieve that is outside the scope of this short discussion; nevertheless, it is perfectly acceptable, if the crew so decides, to dispense with an alternate and ‘commit’ to land at destination.

Controllers are not required to provide priority to pilots of aircraft that have declared minimum fuel or those that have indicated that they are becoming short of fuel. However, controllers shall respond to a pilot who has declared minimum fuel by confirming the estimated delay they can expect to receive expressed in minutes if the pilot is en-route to, is joining, or is estimated in an airborne hold; or by expressing the remaining track mileage from touchdown if the aircraft is being vectored to an approach. Once the pilots have this information, they will determine whether or not they can continue to the aerodrome with or without declaring a fuel emergency.

A PILOT’S WORLD-VIEW So what does this mean, practically, from a pilot’s point of view? Let’s consider a flight inbound to Heathrow via Lambourne. In this case it is being operated by an Airbus 320, but the general

015 Aer Lingus Risk_Minimum Fuel_2pp.indd 15

29/04/2015 16:51

016 / AER SAFETY / MINIMUM FUEL

THE ESTIMATED APPROACH TIME ‘CONTRACT’ Final reserve fuel is fuel for 30 minutes of flight for turbinepowered aircraft or 45 minutes for piston-powered aircraft [EASA Ops.]

THE ESTIMATED APPROACH TIME ‘CONTRACT’ Our flight is now in the LAM hold, and expecting – when cleared for approach – a flight path which will look something like the picture above, for a landing on Runway 27L (albeit via radar vectors of course). It would typically require 300-400kg of fuel to fly that approach from the hold to landing. Holding fuel-flow is typically of the order of 30 Kg per minute for our flight. When the pilots receive an estimated approach time (EAT) they have at their fingertips all the information they need to assess whether they can accept it (and land with final reserve fuel) or whether they need to divert. In effect, the EAT has become an informal contract between the controller and the pilots. If the pilots assess that they can continue to hold, but their landing fuel will be close to final reserve, they may declare minimum fuel at that point, even if they still have to hold for 20 minutes. In that sense a declaration of minimum fuel is an accurate indicator of a flight’s fuel state without the pilots actually having to describe their endurance in minutes. Minimum fuel should act as a warning to a controller that there is little scope to change the ‘contract’. Unless the pilots have committed to a particular airport, and know they will land with less than final reserve fuel, they will not declare an emergency. Note too that the option of declaring a PAN for low fuel state has, in theory, disappeared (although, of course, it is always an option for the pilots). ICAO has dispensed with it. Thus minimum fuel is not a request for priority. Now, we all know EATs are not set in stone; however, the most important thing to take away from this short discussion is the absolute imperative to tell the pilots if the plan, especially the EAT, changes. If the pilots have declared minimum fuel and the aircraft is broken off from the approach, or has to go around, it is very likely they may have to declare a mayday.

NATS SAFETY PARTNERSHIP AGREEMENT The Safety Partnership Agreement is a concept that is delivered through NATS. NATS is the main air navigation service provider in the UK. Over the years NATS has grown from a UK-focused business to a global business, with contracts in more than 30 countries. It offers aerodrome, data and consultancy solutions to worldwide customers which include airports, air traffic service providers (ANSP) and governments. NATS’s primary goal is to face the challenges that are facing the aviation industry and finding solutions. As such, the SPA was initiated to provide a link with airlines and industry stakeholders to improve safety. The SPA is about ‘’Working together to identify and resolve safety issues whilst maximising the use of the airspace and airport capacity’’. As part of this collaboration the CSRO attend meetings and submit safety-related information. The SPA focus is currently centred on pilot-controller interfaces, runway safety and airspace safety. The Safety Partnership Agreement works alongside the Organisational Partnership Agreement and togther the partnerships drive to ensure operational improvements while collaboratively agreeing priorities and identifying ‘hotspots’ for joint action.

If the pilots have declared minimum fuel and the aircraft is broken off from the approach, or has to go around, it is very likely they may have to declare a mayday.

SPECIAL THANK YOU TO NATS & CAPTAIN TIM PRICE, BRITISH AIRWAYS, WHO PROVIDED PERMISSION FOR THIS ARTICLE AND GRAPHICS TO BE PUBLISHED.

015 Aer Lingus Risk_Minimum Fuel_2pp.indd 16

29/04/2015 16:47

AER SAFETY / AIRBUS IMMERSION WEEK / 017

Airbus Immersion Week Organised as a means of improving safety and sharing knowledge, Airbus delegates participate first-hand in the daily operations of the CSRO.

In October the Corporate Safety and Risk Office recently took part in an induction into our operations for delegates from Airbus. Denis Cardoux, Airbus Accident Investigator and Eric Jeanpierre, Airbus Product Safety, were welcomed into the organisation and spent a full week being immersed into the operation’s daily activities. Their week, which was organised by Airbus and facilitated by the CSRO, involved attending a number of safety meetings regarding our operations. They got an insightful introduction into our reporting structure and risk assessment, and they gained valuable insights into SEP training and experienced simulator sessions with members from the CSRO team. In order to experience and gain a good understanding of our procedures and checklists they both got to experience a flight seated in the cockpit, where they flew with Captain Conor Nolan and Captain Joe Elliott. During their stay all members of the Aer Lingus Accident Investigation and Recovery Teams had the opportunity to participate in blood-borne pathogen/biohazard training, which was delivered by Denis Cardoux.

BIOHAZARD TRAINING The purpose of this training is to ensure that all personnel are aware of and trained in understanding the hazards associated with blood-borne pathogens while performing aircraft accident investigation. The training outlined the risks of Hep A, B, and

typhoid to name but a few, and the need for vaccination. It also signified the importance of adequate record-keeping of these vaccinations in order to gain entry to a crash site. Biohazard training is an essential component that is inbuilt into our Emergency Response Plan and Procedures; all staff attending an accident site must receive this training. The training delivered and outlined the process of conducting an accident investigation in order to minimise the exposure of hazardous pathogens. The group’s interaction during the session gave participants a real understanding of the need to use, and correctly dispose of, biohazard gear. Airbus is a leading manufacturer of aircraft for the industry. Approximately 500 million passengers fly within an Airbus aircraft each year. Airbus aircraft undergo strenuous testing to ensure air worthiness. Each aircraft must do 1,200 hours of test flying before the aircraft obtains its final certificate of worthiness. In ensuring air safety the CSRO organise this immersion each year for delegates of Airbus in order to improve safety and share knowledge to pro-actively identify potential hazards. To enhance this sharing of knowledge, Airbus produce a monthly magazine, Safety First, which is published by the Flight Safety Department of Airbus. This magazine provides valuable information on specialist safety topics specific to flight and ground crew members. The Airbus Safety First App can be downloaded free on your iPad from the iTunes store.

The Airbus Safety First App can be downloaded free on your iPad from the iTunes store.

017 Aer Lingus Risk_Airbus Immersion_ 1pp.indd 17

30/04/2015 12:15

018 / AER SAFETY / SAFETY SURVEY

Safety Survey Conducted during SEP Results show the overwhelming relevance of the ongoing safety awareness training to 98% of participants.

fundamental function of our safety management system is to ensure there is continued safety promotion and safety assurance within the organisation. To ensure this the CSRO recently conducted a safety survey where participants from the SEP recurrent training programme completed questionnaires. In 2014 the CSRO provided ongoing safety awareness training to approximately 1,136 employees at the time of the survey. Of this figure 297 responses were received, which accounts for 26% feedback rate.

AER LINGUS INTRANET PORTAL LOGIN

CREW PARTICIPATED IN SEP 2014

BREAKDOWN OF THOSE SURVEYED The survey was carried out by both flight and cabin crew members. The majority of returned questionnaires came from CCMs & SCCMs, with a completion rate of 63.7%. Flight deck crew accounted for 36.4% responses. The topic of most benefit for the groups was hazard reporting, which is the process of preventing accidents and occurrences from unaddressed, unreported hazards. As part of the CSRO training the groups were explained the process and procedure when addressing hazards. The tool in which we use to capture hazards is SafetyNet. This database system ensures that all employees have access to communicate their concerns in a timely and responsible manner.

018 Aer Lingus Risk_Survey 2pp.indd 18

To report a hazard or a safety occurrence SafetyNet can be found on the Aer Lingus Intranet Portal under the Corporate Safety and Risk Office section. Please ensure that you have a username to log in with it, as this is an important step in ensuring feedback from the report you submit. Please contact the CSRO to request an account to be set up; login and password details will be then issued. The CSRO can be contacted at CSRO@aerlingus.com or alternatively you will find the CSRO office on 1st Floor, Shamrock House, Dublin Airport. Contact can also be made by calling 01 886 2008.

RESPONSES RECEIVED

FOUND THE PRESENTATION VERY RELEVANT TO THEIR ROLE

30/04/2015 11:38

AER SAFETY / SAFETY SURVEY / 019

LEVEL OF CHANGE IN SAFETY OVER 12 MONTHS

SAFETY OF AER LINGUS OVER 12 MONTHS Over the last 12 months 47.7% stated they felt safe within the airline while a further 39.4% felt the organisation was very safe.

FELT SAFE WITHIN THE AIRLINE

39.4%

FELT THE ORGANISATION WAS VERY SAFE

SAFETY OF AER LINGUS OVER 12 MONTHS

52.4% of respondents feel that safety within Aer Lingus over the last 12 months has been unchanged; however, 37.5% feel that safety has improved. Benchmarking this change is important as going forward with our Just Culture promotion we hope to see this number increasing due to the additional reports we hope to receive as a result of the policy.

47.7%

OF RESPONDENTS FEEL THAT SAFETY HAS IMPROVED WITHIN AER LINGUS OVER THE LAST 12 MONTHS

100%

OF RESPONDENTS FEEL THAT SAFETY WITHIN AER LINGUS OVER THE LAST 12 MONTHS HAS BEEN UNCHANGED

CONTENT RELEVANCY SERIES 1

SERIES 1

Content Relevancy

Suitability of presentation to role

• Very relevant 27% • Relevant 71% • Not relevant 2%

FEEDBACK & ASSURANCE The CSRO is committed to providing safety assurance and feedback. According to the employees, 71% felt the content within the presentation was very relevant while an additional 27% found the information provided to be very relevant. Overall 87% of respondents felt that the presentation would help them in their roles in relation to safety and hazard reporting. Of all the reports recieved 9% felt they were already familiar with the content while a minority felt the presentation did not benefit their role at all. The CSRO rely on your feedback. As such, should anyone have any queries or concerns regarding safety please contact the CSRO and these concerns will be addressed.

018 Aer Lingus Risk_Survey 2pp.indd 19

SUITABILITY TO ROLE

71% RELEVANT

• Very relevant 87% • Already aware of content 9% • Not relevant 4%

87% VERY RELEVANT

27%

VERY RELEVANT

9% ALREADY AWARE

2% NOT RELEVANT

4% NOT RELEVANT

29/04/2015 17:06

020 / AER SAFETY / A YEAR IN REVIEW

A Year in Review The aviation safety stories from around the world that made it onto our radar last year.

MARCH

DHC-6 Twin Otter of Nepal Airlines impacted a mountainside in Nepal, killing all 18 passengers on board. The accident occurred due to poor weather conditions: in attempting to avoid the weather the pilots had to fly up and down, changing the heading. A diversion was called to the nearest airport; however, due to loss of situational awareness and CFIT, the aircraft crashed into a mountain.

FEB

Malaysia Airlines Boeing 777 goes missing over the Indian Ocean with 239 on board. The flight was flying from Kuala Lumpur to Beijing. The aircraft was carrying 12 crew members and 227 passengers. The aircraft has not yet been found and investigations are still ongoing. Experts have been drafted in to investigate shore drift in the hope of finding the aircraft. This was the first time in commercial aviation history an aircraft disappeared without a trace.

AN AER LINGUS A330 PERFORMED AN AIR TURN BACK TO DUBLIN AFTER SEVEN CABIN CREW MEMBERS REPORT FEELING UNWELL. AAIU ATTENDED AND THE INVESTIGATION IS STILL ONGOING. AER LINGUS OFFICIALLY OPEN TERMINAL 2 LONDON HEATHROW.

JULY JUNE

FIFTH WORST MONTH IN AVIATION HISTORY.

020 Aer Lingus Risk_A year in review 2pp.indd 20

Aer Lingus aircraft returned to stand due to high engine vibration which was the result of a birdstrike incident causing engine damage. The aircraft landed successfully and repairs were carried out.

JULY

Malaysian Airlines Boeing 777 crashes in eastern Ukraine after having likely been hit by a missile. A second catastrophic event for the airline, this flight contained 15 crew and a total of 283 passengers. At present the Dutch Safety Board are investigating the event and a report is expected to be published in August 2015.

29/04/2015 17:07

AER SAFETY / A YEAR IN REVIEW / 021

An ATR-72 of TransAsia Airways crashed while on approach to Magong, in Taiwan. There were four crew and 54 passengers on board. There was low visibility and poor weather conditions. The crew initially requested an ILS approach; however, changed their minds to a VOR. On descent the aircraft descended below the glidepath and deviated approx. 340m left of the centreline. A go-around was requested, however, the aircraft made contact with trees, which caused the aircraft to crash in a residential area. There was a total of 48 fatalities on board.

SEP AUG SEPAHAN AIRLINES FLIGHT 5915 CRASHED AFTER IT WAS REPORTED THE NUMBER TWO ENGINE HAD STOPPED DURING THE TAKEOFF. THE PILOTS REPORTEDLY TURNED BACK FOUR MINUTES AFTER TAKEOFF UPON EXPERIENCING TECHNICAL DIFFICULTIES, BUT WERE UNABLE TO MAINTAIN ALTITUDE. ON BOARD WERE 40 PASSENGERS AND EIGHT CREW; 39 PEOPLE DIED IN THE INCIDENT.

Aer Lingus flight returns to Dublin due to a report of strong smell of burning in the cabin but no indication of smoke. Although the smell of smoke started to dissipate the aircraft continued to land. The incident is still under review. A Jet 2 aircraft required an emergecy landing in East Midlands Airport after strong smell of burning in the cabin. The incident led to a passenger-led evacuation over the wing of the aircraft. The AAIB is currently investigating the incident.

SEP A JetBlue A320 which had departed from Long Beach returned to the airport due to a report of a fire in the right engine which created significant smoke in the cabin. The aircraft made a single engine landing. There were no fatalities.

JULY

OCT JULY An MD-83 operating for Air Algerie impacted terrain in the Mali desert. Approximately 50 minutes after take-off the aircraft disappeared from radar. There were six crew and 110 passengers on board; there were no survivors. Investigations are still ongoing by the Malian authorities with assistance from BEA, the French Civil Aviation Authority, as to the cause of the event.

020 Aer Lingus Risk_A year in review 2pp.indd 21

Aer Lingus cabin pressure system dual fault. Mayday declared and returned back to Edinburgh.

AUG

A threat of a volcanic Eruption of Bardarbunga volcano in Iceland sparked a red alert aviation warning. To date the volcano has not erupted and has caused no effect on the aviation industry outside the immediate vicinity of the volcano.

Ryanair was involved in a wing-tip collision after two of their aircraft made contact during taxing phase of the flight. The AAIU is currently investigating this occurrence. Emergency services attended the scene as a precaution. There was no injury to staff or passengers.

OCT

A multi-agency major emergency excercise was conducted in which Aer Lingus was heavily involved. This excercise put all our policies and procedures to the test. A crash site was set up in Fairyhouse Racecourse and Aer Lingus’ Accident Investigation Team attended the site, while management took part organising the incident from the Emergency Response Centre in H6.

NOV

AER LINGUS EXTENDS NETWORK REACH SIGNING FLYBE CODESHARE, WITH WHICH THE CSRO WILL BE INVOLVED IN TERMS OF SAFETY PERFORMANCE.

AIRBUS DELIVERS FIRST A350 AIRCRAFT TO QATAR AIRWAYS.

29/04/2015 17:08

022 / AER SAFETY / MINIMUM FUEL

THE AUTOMATION PROBLEM

There is clearly an automation problem. But what is its real cause? And why has it taken so long to become obvious? Captain Ed Pooley asks.

022 Aer Lingus Risk_Automation_3pp.indd 22

30/04/2015 14:16

AER SAFETY / AUTOMATION PROBLEM / 023

he rapid rise in the extent to which the pilot of a modern transport aeroplane manages and controls their aircraft with the aid of automated systems is well known. During this change, the accident rate has stayed low despite a continuing rise in aircraft movements. It seems to me that the extent to which a lack of competence1 of pilots as the direct cause of accidents has not diminished and relative to other such causes, has probably increased. The effects of high levels of aircraft automation appear to have been twofold: ● Pilots’ knowledge of both their automated systems and the way they interact with how aircraft fly, however they are controlled, is often insufficient to cope with abnormal events unless these are resolved by straightforward checklist compliance. ● The extent and nature of the decision making which is required to operate a highly automated aeroplane today is quite different from that required to fly most similar sized aeroplanes 30 years ago. The relationship between these two components of pilot competence is important. Decision making in the event of abnormal occurrences which are not covered by a ‘scripted’ procedural response often requires ‘background’ knowledge. Before automation became so dominant, such knowledge was usually available on account of more frequent use. But now it is rarely required and has either never been acquired at all or since forgotten due to lack of use either on the line or in training.

INCREASING ROLE OF AUTOMATION We should also remember that flying transport aeroplanes no longer involves much actual flying – and when it does it is rarely undertaken without the benefit of at least some ‘automation support’. The majority of the generation of pilots now in the vicinity of retirement had the benefit of much more opportunity to fly manually because automation was less extensive. This provided them the context for the overall task of flight management rather than it nowadays, on almost every flight, being the central task. Only in the case of the take-off have the means to automatically control the aircraft through automatic system management not yet been found. Interestingly, that is the one flight phase where the key to aircraft flight safety – appropriate pilot decision making based on readily recalled knowledge – is still crucial if an unexpected situation occurs, although of course it rarely does. Much has been made of the importance of cross monitoring in a two-pilot flight deck as a defence against inevitable human error. Much emphasis has also been placed on compliance with the comprehensive set of rules and procedures which aim to cover all the situations which it is anticipated that pilots will ‘normally’ encounter. But in the context of automation, both these contributions to safety are, whilst unquestionably important, simply attempts to treat the symptom not the cause. The focus needs to be placed firmly on effective knowledge-based decision making. Perhaps you are not convinced? Let me illustrate my point by looking at a couple of superficially well-known accidents where all did not go well.

AIR FRANCE 2009 LOSS CAPTAIN ED POOLEY is an experienced airline pilot who for many years also held the post of Head of Safety for a large short-haul airline operation. He now works with a wide range of clients as a consultant and also acts as Chief Validation Adviser for SKYbrary.

First, the Air France Airbus A330 (AF447) which crashed in mid-Atlantic in 20092. The two co-pilots were (jointly3) in charge of the aircraft whilst the captain took his planned rest in the cruise. It was a night flight and the aircraft had been in level flight in IMC for some time with the autopilot engaged. Then, unexpectedly, they were faced with a sudden successive but ultimately very brief4 loss of all air speed indications and an un-commanded disconnection of the autopilot. Although there was no strictly applicable checklist for such an occurrence given that it was not considered sufficiently likely at the time, the immediate pilot action in such cases was – and remains – ‘do nothing’. But one of the pilots almost immediately initiated and sustained a climb, something that was inevitably going to lead rapidly to a stall5, which it did. Despite the stall warning – for which there is an effective mandatory response – the pitch up was continued. And the other pilot failed to intervene verbally or by taking control. By the time the captain hurriedly returned to the flight deck, the aircraft was fully stalled and descending at 10,000 fpm leaving him insufficient time to assimilate what was happening and regain control. The aircraft had been crossing the zone of convective weather known as the ITCZ6. This region was already well known as a potential environment for ice crystal icing at temperatures below -40°7 and the potential for this to cause temporary loss of the dynamic air pressure necessary for airspeed to be computed and displayed. No other flight instruments failed8 and all that was required was to continue in level flight with the same engine thrust and at the same aircraft pitch attitude. The latter is the basic way aircraft are controlled and an indication of pitch attitude would have been enough to continue the cruise temporarily even if altitude and engine thrust

We should also remember that flying transport aeroplanes no longer involves much actual flying – and when it does it is rarely undertaken without the benefit of at least some ‘automation support’.

SPECIAL THANK YOU TO EUROCONTROL, WHO PROVIDED PERMISSION FOR THIS ARTICLE TO BE PUBLISHED.

022 Aer Lingus Risk_Automation_3pp.indd 23

29/04/2015 17:19

024 / AER SAFETY / AUTOMATION PROBLEM

ASIANA 2013 IN SAN FRANCISCO

indications had also failed, which they had not. The investigation was not able to account for the actions of one co-pilot or the inactions of the other. But, on the evidence presented, you may recognise that perhaps a ‘startle’ phase degenerated very quickly into confusion and uncertainty. This replaced the rational response that is usually founded in any professional by an underlying grasp of how their ‘machine’ works. What happened to two pilots ‘working together’ seems to me to have been impossible if there had been not just knowledge about the state of the automated systems, but at a very fundamental level about how all aircraft fly. Of course prompt compliance with the mandatory stall warning drill could have saved the day but the investigation was also unable to explain the absence of that. I should mention that the flight envelope protection function on this aircraft type which prevents pilots ‘accidentally’ losing control of their aeroplanes by taking them into a stall despite stall warning activation became inoperative because the applicable control law changed from ‘Normal’ to ‘Alternate’ when all three air data computers registered a lack of valid input for airspeed calculation.

The passive willingness of some aircraft operators to permit pilots who have not been adequately prepared to fly the line in all the situations they might find themselves in is not new. Indeed, the history of accidents and incidents appears to indicate that there was proportionately far more of this ‘passive willingness’ in the past than there is today.

022 Aer Lingus Risk_Automation_3pp.indd 24

Second, the Asiana Boeing 777 (OZ214) which crashed at San Francisco in 20139. On a VMC day, ATC gave the crew a visual approach at San Francisco because the ILS Glideslope was out of service and the weather conditions did not warrant the issue of clearances to fly the available localiser-only procedure. The pilot flying (PF), a trainee captain being supervised by a training captain and with the relief first officer occupying the observer seat, decided that rather than fly a visual approach, he would use the automatics to capture the localiser and set the vertical speed mode so as to follow the standard vertical profile as detailed on the localiser-only plate. Localiser capture went as intended but right from the start, the PF had difficulty in properly controlling the vertical speed. About 1,500 feet and about 3.5 miles out, somewhat higher than the correct vertical profile required, he made inappropriate mode selections and, when they caused the autopilot to begin to climb the aircraft, he decided to resolve the situation by disconnecting the autopilot and manually selecting flight idle thrust. But he was unaware that having left the autothrottle engaged, it would no longer track the selected speed, the mode providing this function having been overridden by manually setting idle. As the Asiana-designated stabilised approach ‘gate’ at a height of 500 feet was passed, the aircraft was not stabilised in accordance with the specified criteria10 but nothing was said. With the thrust remaining at idle, the aircraft began to progressively descend below the correct vertical profile. It seems that none of the pilots were able to comprehend the reason why the view out of the window of the runway perspective then steadily became more and more abnormal as also confirmed by the visual descent path guidance provided by the PAPI11 as the latter progressively changed from white/white/ white/red (just above profile) at 500 feet AGL through the two intermediate stages to reach red/red/red/red (significantly below profile – stop descent until profile regained) at 219 feet AGL. It appears that once below 500 feet, none of the pilots had noticed that the airspeed was dropping, the thrust was at idle, the rate of descent was increasing far in excess of that which would be expected for a descent on the correct profile and the progressive increase in pitch in an attempt to ‘reach’ the runway was rapidly creating a pitch attitude which was completely at odds with that which would normally be seen. All these are fundamental requirements for the collective situational awareness of the crew. Recognition of any one of these would have constituted a requirement for an immediate go around. But in the end, a very late recognition that the aircraft was – to put it mildly – not going to make the runway only led to the initiation of a go around at 90 feet agl. Whilst this would not have been too late on a normal approach, it was at the prevailing low energy state of the aircraft. The tail hit the low sea wall just before the runway threshold and broke off, after which the fuselage was no longer controllable and a crash was inevitable. The complete lack of situational awareness of the newly appointed training captain who watched this scenario unfold is particularly difficult to understand. This is the very strand of competence that underpins the essential performance of a senior captain appointed to this role and, as such, it must be assured rather than assumed before the appointment is confirmed. The management decision that the trainee captain was ready to begin the final phase of his com-

30/04/2015 16:13

AER SAFETY / AUTOMATION PROBLEM / 025

mand upgrade also seems, to be at the very least questionable. The capabilities of modern flight simulators, provided they are combined with competent management decision making about whether trainee commanders have reached the ‘almost-ready’ stage, mean that line training has become a confirmation of competence not an exploration of it. In Captain Pooley’s opinion evidence of this investigation shows that the competence of the trainee was still being explored. He had insufficient confidence in his ability to fly the aircraft without using the automatics to the maximum extent possible and having decided to rely on the automatics, he was unable to use them properly. Then, when it all began to go wrong, he did not understand how they worked. As with AF447, the day could have been saved in the early stages, and indeed in this case much later, by the simple expedient of compliance. The Asiana stabilised approach SOP was clearly stated and clearly breached both at the specified 500 feet ‘gate’ and then continuously once below it. I take the view that the passive willingness of some aircraft operators to permit pilots who have not been adequately prepared to fly the line in all situations they might find themselves in is not new. Indeed, the history of accidents and incidents appears to indicate that there was proportionately far more of this ‘passive willingness’ in the past than there is today. But what has actually kept the accident rate12 low? Automation of course! It’s grown rapidly in both its capability and in its reliability. Its effect has been to change the role of the pilot into one which requires – most of the time – a different set of skills underpinned by additional knowledge. But these new skills do not replace pilots’ need to have the ability to manually manage and fly the aircraft during infrequent and unexpected departures from the automated normality. There will always be some situations that do not lend themselves to a prescribed SOP response even with the number of these that now exist. Compliance culture can certainly help avoid accidents but alone it is not enough. A deeper background appreciation of the big picture – both how aeroplanes actually fly and how the automated interface between the pilot and his particular machine functions – is a fundamental part of competence13.

KNOWLEDGE BASED INTERVENTION Think back to the Qantas A380 which suffered an uncontained engine failure in 201014. The consequences of the collateral damage which followed this caused the (fortunately) augmented crew to abandon the ECAM-directed response in favour of action informed by their knowledge-based ad-hoc decisions. Yet just like all the others, this crew usually had a routine automated flight focused primarily on diligent system management. Think, too, of the Cathay Pacific A330 crew who, also in 2010, got their aircraft safely on the ground in Hong Kong when both engines began to malfunction after they had unknowingly loaded contaminated fuel for their flight15. Again the crew demonstrated their ability to deal with a situation for which existing prescribed responses alone were not enough to secure a safe outcome. I see these responses as a clear indication that the crews involved must have been both selected and trained by their employers in a way that enabled these impressive performances. So I conclude that, whilst the way automation is delivered in aircraft design can always be improved, the root of the automation

022 Aer Lingus Risk_Automation_3pp.indd 25

problem we are seeing today does not lie primarily – as many human factors experts will tell you – in system design. Rather, it lies in ensuring that people with the right aptitude and ability are trained as pilots in the first place. And that they are thereafter provided with a type of recurrent training that is compatible with a job which now typically has very long periods of automated routine punctured only very rarely by the challenge of something (completely) unexpected. Even with the very best selection processes, a successful outcome to any path through training is not a guaranteed one. There is a very heavy responsibility on all aircraft operators to ensure that they do not release pilots to line flying duties until there is solid evidence that all aspects of their professional competence have been clearly demonstrated to be compatible with their role.

RESPONDING TO THE CHALLENGE A similar training challenge can be found in other jobs where the role of automation has rapidly increased and has also delivered greater overall safety by this very fact. So whilst in aviation we certainly need an operating culture underpinned by procedures and compliance, the real foundation is, as in other comparable risk-bearing occupations, the right people in the right jobs who are trained in the right way. Then we will be able to reduce the prevalence of occasions when the performance of pilots leads to the crash of an essentially or even a fully serviceable aircraft. And we will see more instances of recovery from potential disasters such as the Qantas and Cathay Pacific examples quoted. It is perhaps worth reflecting that, on the evidence available, the industry as a whole and the regulatory system in particular can reasonably be characterised as having been sleepwalking towards the situation we are now in. There has been a failure to realise that the undoubted safety benefits of automation needed a lot more attention to pilot qualification and pilot training than we have seen in all but a relatively few enlightened operators.

30/04/2015 16:13

026 / AER SAFETY / AUTOMATION PROBLEM

Finally, can we expect the ‘automation problem’ to get worse if there continues to be no ‘structural’ response to the underlying cause I have identified? Unfortunately, the answer is a resounding ‘yes’. We are rapidly moving towards the time when both pilots on the flight deck will have gained all their experience in the ‘automation age’. The consequences of the transition to automation have so far been masked by the broader experience which older pilots, especially those in command, have had. In some cases, their personal conversion to automation may have been incomplete but their reversion skills were ingrained through early-career use and have been readily accessible when suddenly needed. But we are now rapidly leaving that comfort zone with only best practice at leading operators showing the way for the rest. Now what if anything does all this mean in terms of the automation and safety in ATC? In principle, automation for both controllers and pilots has a similar cost/benefit balance. In both cases, as well as being more efficient than humans, it is also more reliable – until that is, it fails. Which is when the licence holder in either case has to pick up the pieces rather like they used to do as a full time job before automation. When this happens, the response expected of controllers, as with pilots, is likely to be time-sensitive and require recovery from a situation in which: ● automation may have been managing a situation which is more complex than the human would have been. ● the human may well be ‘startled’ and their initial response less than optimal. ● there may be no pre-trained response which fits the scenario. ● the realism of prior training for “the unexpected” may have been poor and/or the frequency of exposure to it may have been insufficient. ● the automation abnormality may have been unintentionally precipitated by one’s own action (or inaction). And there is another rather important similarity linking pilots’ and controllers’ response to the challenges of automation – their licence holding status. In my view this brings with it a personal professional responsibility which is just as much a part of the solution to automation issues as the obvious responsibilities of employers to ensure they recruit people with the right aptitude and then ensure that they provide them with the training they need to manage both the normal and the abnormal. The latter may require ad hoc decisions based on rarely-recalled knowledge and the responsibility to possess and be able to apply it is very much in the interests of both the individual and their employer. Now there’s some more complexity... and a need for ANSPs and their regulators to take a lead from best practice and not be content with the the achievement of safety management at the threshold of audited compliance.

Further articles in relation to automation can be found in HindSight issue 20. HindSight is produced and content is controlled by EUROCONTROL. HindSight can be found on the SKYbrary website and users can register for a copy of each of the magazines. It provides valuable information on industry related articles and aims at helping the industry by identifying issues and sharing experiences of safety related occurrences. SKYbrary was first established by ICAO, the European Organisation for the Safety of Air Navigation and the Flight Safety Foundation to provide industry information and act as a reference tool for compiled aviation knowledge, expertise and critical safety issues in relation to aviation safety information.

1. ICAO, in Doc 9995, a recently issued manual describing a new approach to pilot training based on the demonstration of a number of defined competencies, defines competency as “a combination of knowledge, skills and attitudes required to perform a task to the prescribed standard”. The eight competencies which are defined include “aircraft flight path management, automation” and “aircraft flight path management, manual control”. 2. For more detail on this see: http://www.skybrary.aero/ index.php/A332,_en-route,_Atlantic_Ocean,_2009_ (LOC_HF_AW) And to see what the public are being ‘told’ in a surprisingly coherent and fairly accurate account published recently in the general media, see http://www. vanityfair.com/business/2014/10/air-france-flight-447crash 3. The captain did not explicitly designate one of them as the senior pilot and Air France procedure on the matter was arguably ambiguous. 4. All three airspeed indications were lost for around 30 seconds and two for around a minute. 5. The angle of attack which corresponds to normal high altitude cruise is usually relatively close to that at which a stall warning would be triggered. 6. Inter Tropical Convergence Zone 7. Such icing results from ice crystals which encounter heated parts of an aircraft such as engines and pitot tubes being heated to melting point and then temporarily re-freezing. 8. Although there was intermittent loss of Fight Director guidance on both pilots’ Primary Flight Displays. 9. For more detail on this see: http://www.skybrary.aero/index.php/B772,_San_ Francisco_CA_USA,_2013_(LOC_HF_FIRE_AW) 10. Because the rate of descent was 1200 fpm when around 700 fpm would have been expected, because the thrust setting was not appropriate to the aircraft configuration and because more than ‘small changes in heading and pitch’ would have been required to maintain the correct flight path. 11. Precision Approach Path Indicator – see: http://www.skybrary.aero/index.php/Visual_Approach_ Slope_Indicator_Systems for a description 12. Recorded incidents attributed to ‘pilot error’ (as opposed to accidents) have by contrast increased because of a combination of better reporting and better investigation processes, especially the widespread use of recorded flight data to put alongside the narratives submitted by pilots. 13. Knowledge is at the core of the recent competencybased ICAO pilot training guidance referenced earlier and in the Airbus adaptation of it for A350 type rating training is explicitly, rather then implicitly defined as a ‘competency’ - see ‘Learning from the evidence’ pps 24-32 in Safety First (the Airbus Safety Magazine) Issue 18, July 2014 14. For more detail on this see: http://www.skybrary.aero/index.php/A388,_enroute_ Batam_Island_Indonesia,_2010_(LOC_AW) 15. For more detail on this see: http://www.skybrary.aero/ index.php/A333,_Hong_Kong_China,_2010_(LOC_RE_ GND_FIRE) 16. Think of the A320 successfully ditched in the Hudson River off Manhattan in 2009 after a multiple bird strike – details at: http://www.skybrary.aero/index.php/ A320,_vicinity_LaGuardia_New_York_USA,_2009_(BS_ LOC_AW)

SPECIAL THANKS TO EUROCONTROL WHO KINDLY GRANTED PERMISSIONS FOR THE ABOVE ARTICLE AND GRAPHICS.

022 Aer Lingus Risk_Automation_3pp.indd 26

30/04/2015 14:17

AER SAFETY / STOP PRESS / 027

How safe is our industry?

By Captain Conor Nolan

n recent months we have observed a significant spike in tragic, fatal accidents involving commercial air transport category aircraft. Most notably, four of these accidents have involved the Airbus A320, our own main fleet type, and two others involved ATR aircraft, used by our regional partner, Stobart Air. In December 2014 an Air Asia A320 crashed in the Java Sea in Indonesia. No official report has yet been published. In March, a Germanwings A320 collided with mountainous terrain in France, after departing stable cruise without any notification to air traffic control of any malfunctions or emergency condition. Notwithstanding the way in which information was divulged by local French officials, nor the absence of any official accident report, it is generally accepted at this point in time that the available factual evidence points to a deliberate controlled flight into terrain (CFIT). Also in March 2015, an Air Canada A320 collided with terrain short of the landing runway at Halifax Airport in Nova Scotia. Weather at the time was poor, with poor visibility caused by snow, and wind. It suffered extensive damage and although thankfully there were no fatalities, a number of people were injured in the impact. In April, an Asiana 320 suffered almost identical circumstances at Hiroshima. Looking at any accident, but especially those described above, it is clear that we will in time be able to answer the fundamental questions that all investigations must ask: When, where, what, who and how? However, when Rudyard Kipling introduced his six honest serving men, he included the most important: why? And therein lies our greatest challenge. We already know most of the facts related to each of the accidents; however, for all of them we remain unclear as the reason why it happened. Why was it able to happen, why were the crew not able to stop it, why did the system not protect those people from the ultimate outcome? Until we better understand why things happen, we will struggle to put in place the necessary barriers to prevent recurrence. Looking at all these events together, or even in isolation, can understandably lead people (in particular our customers) to question whether aviation safety standards are robust. Every aircraft accident is a major media event, and as tragic and regrettable as every fatal accident is, we must always strive to maintain some perspective on the overall state of the industry, and of course learn

027 Aer Lingus Risk_Stop Press.indd 27

AER LINGUS offers all of its employees the support of the Employee Assistance Program (EAP).

99.999% of flights result in a safe outcome because of the actions of the crew, support staff, maintenance standards and infrastructure.

from these events in order to prevent recurrence. It is a fact that an Airbus aircraft takes off or lands every second of every day around the globe. With annual flight cycles for the fleet now over ten million, a statistic of two fatal accidents per ten million flights starts to become a cold, chilling reality, even if it is the lowest accident rate in history and simply incomparable with other forms of transport. But let us not ignore the fact that more than 99.999% of flights result in a safe outcome because of the actions of the crew, support staff, maintenance standards and infrastructure. Our system is incredibly safe and despite the recent events, continues to be both safe and focused on getting safer. Instead of looking for quick fixes to heal the pain caused by these tragedies, we need to look deeper to try and identify whether we could have predicted these events by looking at warning signs, weak signals, pre-cursor events or tolerance of lax attitudes to danger. Does our culture support people in challenging the norms, asking hard questions, pointing out flaws in our systems? Do we care for our people in a way that ensures that those in need of support can reach out and get the help they need in a timely, non-judgemental way? Aer Lingus offers all of its employees the support of the Employee Assistance Program (EAP). Details can be found on the Intranet. Other groups within the airline maintain their own peer supports, such as the Pilots’ Advisory Group (PAG). It is essential that each of us take the time to find out what support is available, not just in case we need it for ourselves, but also so that we can reach out to a colleague who might need that support. The best way we can protect ourselves, and by extension our customers and the company, is by looking out for each other (humanity), recognising when our team mates need support (team), and having the courage to take the necessary action to get the help required (courage). The CSRO maintains a Confidential Reporting System (details can be found on the Intranet) and can also be contacted for advice on how to engage with any of the other support services available.

29/04/2015 17:25

028 / AER SAFETY / PREPARE TO BE SURPRISED

Prepare to be Surprised Sunjoo Advani, Jeffery Schroeder and Bryan Burks provide a summary of the current thinking and provide practical perspectives on upset prevention and recovery training.

he airplanes we operate are reliable by design, and training is so solid that we can respond to nearly all situations without allowing them to escalate beyond control. However, perfectly good airplanes can rapidly transgress from an upset state to a loss-of-control inflight (LOC-I) condition when a pilot is not trained to react properly. LOC-I is still the number one threat, and while rare, LOC-I events are likely catastrophic. The Boeing/CAST (August 2012) indicates that LOC-I killed 1648 passengers during the past ten years, and EASA’s Annual Safety Review 2012 indicates that it is also the category with the highest fatalities. When faced with the unexpected, pilots will need to refer to their learned skills and apply best judgement within a very small window of time. It is no wonder that this subject has received focused attention during the past five years following a number of compelling accidents: Colgan Air 3407 (Q-400, Buffalo, 12 February 2009), Turkish Airlines 1951 (B737, Amsterdam, 14 March 2009) and Air France 447 (A330, Atlantic Ocean, 31 May 2009). While other causes of accidents have been systematically addressed through technology (CFIT, powerplant-related, mid-air collisions), LOC-I prevention requires better awareness, recognition and avoidance, and recovery training. In today’s cockpit, the pilot’s training is the final safety net to prevent LOC-I. While the seeds for the Royal Aeronautical Society’s ICATEE (International Committee for Aviation Training in Extended Envelopes) had already been planted prior to these events, a conference in London by that society launched an earnest effort to understand the causes of these upsets and to define the best training solutions.

028 Aer Lingus Risk_Suprised_4pp.indd 28

ICATEE

A working group that includes airframe manufacturers, airlines, aviation authorities and safety boards, simulator manufacturers, and training providers such as upset recovery specialists, research institutions and pilot representatives.

STALL

According to Lambregts [2008], aerodynamic stall is the leading cause of fatal LOC-I accidents, contributing to 36%.

What triggers upsets? They can be triggered by pilot, environment or system-induced conditions as shown in the following table, based on Jacobson [2010].

STARTLE – THE LOC-I CATALYST According to Lambregts [2008], aerodynamic stall is the leading cause of fatal

30/04/2015 09:17

AER SAFETY / PREPARE TO BE SURPRISED / 029

TABLE 1 Pilot Induced

Environmentally Induced

System Induced

Improper/inadequate training

Weather (turbulence, icing, adverse winds, wind shear)

Reduced envelope/mode protection

Poor energy management

Wake vortices

Poor energy management (systems-induced)

Changing pilot skill base

Visibility (for VFR flights)

Propulsion-related

Automation/mode confusion

Foreign object damage

Erroneous sensor data

Destabilised approaches

A/C systems failure

Improper procedures (e.g. poor monitoring)

028 Aer Lingus Risk_Suprised_4pp.indd 29

30/04/2015 09:17

030 / AER SAFETY / PREPARE TO BE SURPRISED

LOC-I accidents, contributing to 36%. Surprisingly, some crews (e.g. Colgan 3407 and AF 447) responded inappropriately to the stall warning and protection systems. Other flight crews appeared unaware of the flight condition, or reverted to maintaining altitude whatever the cost – a major systemic training deficiency. True, stall is an end product of poor energy management, inattention, inaccurate flight path monitoring, or weather-induced events. Yet despite the escalation of the events leading to the stall, the recovery at any stage (prior to the g-break, or after loss of lift and the resulting unsteady aerodynamic conditions) remains the same: an immediate reduction of angle-of-attack is requisite. Why then do upsets invariably become loss of control events? When combined with a situation that causes a pilot to become alarmed, leading to an inability to properly resolve the problem – a condition commonly known as “startle” – the upset can rapidly become a LOC-I event. Most of the LOC-I events are believed to occur when an upset provokes a startle reaction. If this is true, then unfortunately knowledge and the traditional manoeuvre-based training alone will not prevent LOC-I. Startling scenarios are needed. The crew’s startle reaction is the leading catalyst that can take an upset airplane into an LOC-I condition. Can we create startle in training? Probably. Can enough startle scenarios be developed and used appropriately so that they remain effective? Possibly. Do we need to train startle management? Absolutely.

STALL TACTICS Until 2012, the aeronautical community had a misplaced emphasis on minimising altitude loss during a stall recovery. While the safety intentions of such an emphasis may have seemed sound, it led to the inappropriate establishment of specific standards for altitude loss in proficiency checks, and that was accompanied by an unintentional hiding of stalling physics. Training events that instilled minimising altitude loss consisted of preplanned, announced, stall recovery manoeuvres. Invariably, a pilot only needed to apply power, quickly break the stall with a short nose drop, and adjust the airplane attitude to continue recovery – without compromising altitude. It was a hand-eye co-ordina-

028 Aer Lingus Risk_Suprised_4pp.indd 30

REFERENCES: Jacobson, S., “Aircraft Loss of Control Causal Factors and Mitigation Challenges”. In Proc. of AIAA Guidance, Navigation and Control Conference, Toronto, Aug 2010, AIAA-2010-8007 CP. Proceedings of AIAA GNC Conf., Toronto, 2010 Lambregts, et al, “Airplane Upsets – Old Problem, New Issues”. In Proc. of AIAA Modeling & Simulation Technologies Conf., Honolulu, Aug 2008, AIAA-20086867 CP.

tion task, and because the manoeuvre was planned, it caused no startle reaction or startle management from the pilot. However, if those are the ONLY skills that one has acquired, are they enough to prevent reoccurrences of the recent stall accidents? Perhaps not. Light aerobatic-capable aircraft can be a beneficial learning environment, and are recommended for at least initial training at the licensing level. A good instructor can demonstrate and hone the flying skills of the pilot in UPRT and provide the bridge of knowledge that pertains to transport category aircraft. Part of the complete initial UPRT program, and the subsequent type-specific training, must rely on flight simulators with a representative flight-deck environment, even for stall training. In a stall, the aircraft behaviour may be unpredictable as the aerodynamics are unsteady. No two airplanes or situations are the same, and no two stalls are the same. Unpredictability is not the kind of behaviour we commonly want from our simulation software, especially when qualification is required. However, with a major focus on stall training, simulator models that do represent stalls “accurately enough for the training objectives” are now becoming available. Boeing and NASA Langley Research Centre developed an accurate stall model for one aircraft type nearly a decade ago. Boeing has developed a full stall model for the 737NG using data from hundreds of flight-test stalls. “Type representative” models, depicting the needed random behaviour are also becoming available (for example, from Bihrle Applied Research), while other consortia continue to develop convincingly realistic real-time models based on wind tunnel and computational fluid dynamics data. Hence, there is no technical reason that prevents full stall training.

SIMULATOR STALL TRAINING REQUIREMENTS Is training the recovery from an approach-to-stall in a simulator sufficient? The viewpoints differ. While US Public Law 111-216 and recent Part 121 revisions require training to full stalls and upsets, some argue that this could lead to negative training transfer. While they argue that improvements in prevention alone are sufficient, others believe training should go beyond that. As the aircraft comes close to the aerodynamic stall, the aircraft flight characteristics degrade and the controls become sluggish. Buffet cues may help the pilot to respond, and in some cases, the vibrations can be so severe that instruments become unreadable. Pilots could be drawn into a tendency to maintain the nose-up attitude or try to control bank angle at the expense of recognising and recovering by reducing the angle-of-attack. Therefore, there is a strong argument in favour of exposing pilots to the complete threat environment in a properly controlled manner. The FAA conducted a study in Oklahoma City in late 2013 in-

In a stall, the aircraft behaviour may be unpredictable as the aerodynamics are unsteady. No two airplanes or situations are the same, and no two stalls are the same.

30/04/2015 09:18

AER SAFETY / PREPARE TO BE SURPRISED / 031

volving 45 Boeing 737 airline pilots who had been previously “approach-to-stall” trained in their company simulators. They were all briefed on, and indicated they were familiar with, the recently published OEM Stall Recovery Template explaining how to recover at first indication of stall by applying a nose-down pitch input until the stall warning is eliminated. During the study, the airline pilots were presented with an unexpected surprise stall situation. The result was as startling for the researchers as it was for the pilots: only one-quarter of the pilots applied the proper stall recovery procedure correctly when surprised. Most of the pilots – for a significant length of time – applied back pressure, worsening the stall. The advanced stall models also tempted pilots to deviate more from the proper recovery technique through actions such as applying significant pedal inputs. The bottom line of this eye-opener was that reverting to the old recovery technique was a dominant response when pilots were surprised. Clearly, the approach-to-stall manoeuvre-based training leaves something to be desired. Exposure to the startle effect acting as a psychophysical catalyst in combination with the stall reveals errors that simulator training can correct. Both aeronautical knowledge and exposure to the threat environment can be used to develop the confidence that is needed to avoid startle and learn to recover properly. In other words, remaining calm during an emergency can only be fully realised after one has been shown that they are indeed capable of resolving that emergency. Using today’s technology to get the most out of UPRT is strongly recommended. While modifications to stall models and the presentation of UPRT-critical information on the instructor operating station may involve time and investment, airlines should applaud the fact that over half of the required training can be accomplished by making better use of current-day simulators, when combined with proper knowledge-based training. The Airplane Upset Recovery Training Aid (AURTA) is the distinguished source of the aeronautical knowledge, covering causes and cures for most upsets.

INVESTING IN RISK REDUCTION UPRT can provide the biggest bang for the buck when properly implemented and quality assured. The forthcoming Manual of Aeroplane Upset Prevention and Recovery, a manifestation of several international committees including ICATEE, promises to define the training elements necessary to ensure pilots develop the requisite knowledge and skills for a successful programme. However, the development or revision of those programmes is left to the operators and local authorities themselves. An innovative development is taking place at South African Airways (SAA), whose underwriter has pledged assistance with the implementation of their UPRT program. According to their Chief Training Captain Johann Du Plessis, “Being faced with an upset

Clearly, the approach-tostall manoeuvre-based training leaves something to be desired.

ABOUT THE AUTHORS: DR SUNJOO ADVANI, the owner and president of International Development of Technology b.v., is an aerospace engineer and pilot. He has chaired the ICATEE team in the development of the content that became the core of the ICAO Manual of Aeroplane Upset Prevention and Recovery. DR JEFFERY SCHROEDER is the FAA’s Chief Scientific and Technical Advisor for Flight Simulation Systems. He has served as Research & Technology CoChair of ICATEE. CAPT BRYAN BURKS is a Seattle based pilot and UPRT content developer with Alaska Airlines. He has served as Training & Regulatory Requirements CoChair of ICATEE.

condition which takes a pilot out of their comfort zone cannot be successfully recovered from, unless ingrained recovery techniques have been developed. Therefore, our insurers and underwriters appreciate the risk associated with loss of control in flight and have been extremely supportive with the introduction of a recognised and comprehensive upset prevention and recovery training programme”. This includes acquiring a tablet-based version of the AURTA, development of the entire training programme, and a complete “train-thetainer” programme for their instructors utilising on-aircraft and simulator training. “The airline industry recognises that LOC-I is the leading cause of fatal accidents”, states SAA’s Chief Standards Pilot, Captain Sandy Bayne. “A lot of the actions you take in recovering from an upset are really counter-intuitive.” Following completion of the course at Aviation Performance Solutions in Mesa, Arizona, Captain Bayne felt “I now have the ability to impart this knowledge, to understand the concepts behind an upset and recovering from it.” While not every nation, airline or pilot may have the luxury to impart on-aircraft training (it is recommended though as part of CPL or MPL training), the message is clear: properly designed and carefully instructed programmes that integrate knowledge and practical exposure to the upsets – that develop the confidence pilots need to bring an airplane back into its flight envelope – can be powerful in preventing upsets and avoiding loss of control in flight. And don’t forget that important catalyst: Surprise!

The above article recently featured in the Focus magazine, which is a quarterly magazine that is published by the UKFSC. It provides a source of reference for safety articles and highlights occurrences that are happening within the sector. In addition it promotes best practice across the industry, and provides current up-to-date information. The UKFSC is an independent self funded organisation; it was formed in 1959 to examine the issues surrounding flight safety. The committee began with nine organisations, however, it has grown from strength to strength with more than 90 organisations at present. Captain Conor Nolan is a member of the committee. This committee meets six times a year to discuss accidents, incidents and occurrences and is a group committed to sharing and evaluating safety occurrences to ensure future aviation safety. Further information can be found at http://www.ukfsc.co.uk/home. The above article first appeared in the Civil Aviation Training (CAT) Magazine issue 1 2014. The CAT is an international simulation and training publication which is produced bi-monthly in the United Kingdom by Halldale Media. The magazine was first published in 1990 and since then has been an invaluable resource in terms of latest information in relation to aviation safety. Further articles and editions can be read from this link: http://issuu.com/halldale/docs/cat_1_2014

AER LINGUS WOULD LIKE TO KINDLY THANK BOTH THE UKFSC AND CAT FOR GIVING PERMISSION FOR THE PUBLICATION OF THE ABOVE ARTICLE.

028 Aer Lingus Risk_Suprised_4pp.indd 31

30/04/2015 11:01

032 / AER SAFETY / ETIHAD PARTNERSHIP

Etihad Partnership Group Membership of this group gives Aer Lingus access to aggregate data providing useful operational and safety performance insights.

032 Aer Lingus Risk_Ethiad_1pp.indd 32

30/04/2015 09:23

AER SAFETY / ETIHAD PARTNERSHIP / 033

er Lingus was a founder member of the Etihad Strategic Partner Safety Group. Originally comprising just Etihad Airways, Aer Lingus and Air Berlin safety and quality teams, the group now extends to the entire Etihad partner group. Meeting twice a year, normally concurrent with other industry safety conferences, the group has determined a joint mission statement, a confidentiality charter, and has set objectives to measure the effectiveness of safety risk controls by sharing data and identifying hazards. By identifying hazards we can make continuous improvements in the safety processes across our collective SMS. The objective is not to change our SOPs but to compare our safety indicators and identify potential hazards. The group now has over 600 aircraft in service, of which more than half are Airbus aircraft. This gives us invaluable insight into how our types of aircraft are being operated on a global scale. Operational and airport risk assessments are being shared, SOPs are being compared and numerous benchmarking exercises have been trialled. Future plans include development of shared evidence-based training (EBT) scenarios, exploration of cross group operational observation flights, and pooling of investigative and emergency response capability. In 2015 a group-wide safety performance indicator pilot programme is being established to facilitate benchmarking of key risk indicators. Data will be de-identified and then aggregated, allowing each airline to compare its performance to the group average, and where differences exist, seek the help of the group to understand what they do differently.

The Etihad Partnership Group is made up of: 49% 49% 40% 29% 29% 24% 21.24% 4.99%

032 Aer Lingus Risk_Ethiad_1pp.indd 33

30/04/2015 12:57

034 / AER SAFETY / CORPORATE SECURITY

034 Aer Lingus Risk_Corporate Security_3pp.indd 34

30/04/2015 09:25

AER SAFETY / CORPORATE SECURITY/ 035

Corporate Security Office

he aim of aviation security is to protect passengers, crew, staff, and members of the public and civil aviation in general from acts of unlawful interference. Every day there are potential risks and it is important that we are all aware of potential situations. The below articles provide some information on current issues.

REMOTELY PILOTED AIRCRAFT SYSTEMS: THE THREAT OF UNMANNED FLYING OBJECTS In today’s aviation security environment, we expend many resources in order to secure both the airport and the aircraft. But we have also seen that there are scenarios whereby one does not have to be in the airport or on board the aircraft in order to target civil aviation. The cyber threat is becoming increasingly well documented, but Captain Jo Schoenmaker looks at one of the other ‘unconventional’ threats that is, perhaps, not being looked at in a substantive way given today’s security environment, namely that of remotely piloted aircraft systems. (RPAS). On Monday 31st May 2010, Mr. E. Ratelband, a Dutch selfclaimed ‘guru of positivism’, crashed a small, unmanned aircraft into one of the prime political buildings (De Ridderzaal) in the Hague, The Netherlands. According to the media, his action was well planned weeks in advance. He had rented a seminar room on the top floor of the Novotel, opposite the governmental buildings and, from there, he had launched his Robbe Charter aircraft (weight approximately 2,000 grammes, propelled with a 5cc Magnum two-

034 Aer Lingus Risk_Corporate Security_3pp.indd 35

30/04/2015 09:25

036 / AER SAFETY / CORPORATE SECURITY

stroke engine, carrying 0.4 litre methanol as fuel), towing a banner with the title of his newest book. After a few circling manoeuvres over the area, he crashed his aircraft into De Ridderzaal. He claimed it to be a promotional stunt for his book. There was, apparently, no link to terrorism, and nobody was hurt or injured. As such, it never became an international news headline, and the story and attention soon waned. However, one could argue that this revealed just how simple it can be to use an RPAS as an attack system. The term RPAS is nowadays used as the reference for ‘remotely piloted aircraft systems’ but it belongs to the wider family of unmanned aircraft systems (UAS), which also comprises ‘autonomous’ RPAS where no human action is necessary after take-off. ICAO uses the term UAS. An RPAS is simply an aircraft that is designed to operate with no human pilot on board, of which there are a wide variety on the market; their size can vary from micro-UASs, of only 100 grammes, to high altitude/long range RPAS of over 10,000 kg – in other words, anything from a privately owned and operated matchbox-sized flying camera to an aircraft the size of a Boeing-737 used for commercial or military purposes. The military versions are commonly referred to as ‘drones’. RPAS is clearly a new domain all over the globe and the biggest challenge is to come up with a single set of truly global rules and regulations, taking into account matters of safety, privacy, security, environment, commerce, legal liability and insurance. The number of RPAS, and their possible modes of application, are increasing enormously and that rise is expected to increase. Their uses vary widely from (commercial and non-commercial) photography and surveillance to transport for civil and military objectives. All sorts of entities are researching new possibilities for the use of RPAS; not only defence agencies, but also companies like DHL, UPS, Amazon (Prime Air) and Google (Project Wing) are researching the possibilities of packages being delivered right to the doorstep of the customer by an unmanned aircraft. RPAS are becoming more and more sophisticated (or even fully automated), yet easier to use and operate. This also goes for unregulated (lightweight) RPAS in the hands of inexperienced users, keeping in mind that these systems are affordable and easy to obtain. This all means that RPAS will increasingly utilise the same airspace as commercial civil (or general) aviation. This will not only have safety implications for the industry, like the challenge of integration of RPAS in non-segregated airspace; it will require a very thorough examination of the security ramifications of RPAS operations, related to possible security scenarios involving either regulated RPAS or unregulated RPAS in the hands of private owners or, worse still, terrorists. Currently, initiatives are underway around the world to address the issue of RPAS. To mention just a few examples: ● The adoption of the European RPAS Roadmap from the European RPAS Steering Group jointly started by the European Commission (EC), Directorate General (DG) Mobility and Transport (DG MOVE) and DG Enterprise and Industry. It is anticipated that from 2016 onwards the civil RPAS market will open in European airspace.

034 Aer Lingus Risk_Corporate Security_3pp.indd 36

SECURITY CONSIDERATIONS SAFETY CONSIDERATIONS

The safe integration of RPAS operations into civil, nonsegregated airspace can only be achieved if these RPAS are regarded in all respects as being aircraft, and that they and their operations be subject to, at the very least, all existing rules and regulations applicable to the same class of manned aircraft. Therefore all factors should be considered including, but not limited to, employees, location, accessibility, technology, design properties, link protocols, command structure, etc. It is essential that RPAS fit into the existing and future air traffic management (ATM) environment in all respects.

Security of RPAS operations is a vital issue, with characteristics and considerations that are both similar and unique when compared with manned aircraft. RPAS are controlled by a remote pilot-incommand for the entire flight under normal conditions, including movements on the ground. The fact that the pilot is not actually on board makes it even more complicated and can present, besides safety, some additional security considerations. Also, on-board automation can trigger manoeuvres in the absence of pilot command, e.g. in abnormal failure conditions or loss of command and control (C2) link. RPAS could be hijacked or used as weapons against other airspace users (e.g.by exploiting ADS-B signals) or targets on the ground. Terrorists could also use their own RPAS to crash into specific targets. They could also jam or spoof the Global Positioning System (GPS) signals of other RPAS, thereby seriously compromising safety. This could be achieved by any number of means like physical attacks or destruction of parts of the RPAS components (e.g. the ground station, the data-link or the remote pilot), electronic attacks (e.g. jamming or spoofing of data links or GPS) or cyber-attacks (e.g. hacking through the internet or cyber-attack on specific information networks).

30/04/2015 16:20

AER SAFETY / CORPORATE SECURITY/ 037

● The Joint Authorities for Rulemaking on Un-

manned Systems (JARUS): JARUS is a group of experts from the National Aviation Authorities (NAAs) and regional aviation safety organisations. Its purpose is to recommend a single set of technical, safety and operational requirements (guidance material) for the certification and safe integration of Unmanned Aircraft Systems (UAS) into airspace and at aerodromes. ● The establishment of the RPAS Panel (formerly the UAS Study Group, UASSG) at ICAO’s Air Navigation Commission (ANC), ● The publication of the Civil Integration Roadmap by the Federal Aviation Administration (FAA) to further integrate UAS into the US National Airspace System (NAS), including the selection of six UAS test sites.

SECURITY

THE AIRCRAFT The aircraft itself should be stored and prepared for flight in a manner that will prevent and detect tampering and ensure the integrity of vital components. RPAS should be able to prevent ‘denial of service’, assure ‘integrity of data’ and provide ‘confidentiality of operations’. The protection of the data (command and control – C2) link, the authenticity of the user and the correctness of data transfer and processing should be protected against threats, attacks and

PERSONNEL

acts of unlawful interference. Additionally, steps

Personnel responsible for pre-flight preparation, servicing, programming, as well as operating and remote controlling the RPAS should be security background checked in accordance with national laws, similar to those for airline pilots and to persons granted unescorted access to security restricted areas of airports.

should be taken to ensure that no additional software and/or hardware can be, or have been, added to any systems components for malicious use at a later date, and that hardware and software within all system components will perform the intended function only. In

GROUND FACILITIES As a remote pilot station is similar in purpose and design to a typical aircraft cockpit, it must likewise be secure from sabotage or unlawful malicious interference. The location, and the surrounding property, of a remote pilot station should be regarded as being a security restricted area (as for an airport), and should be guarded as such. Persons entering the premises of the remote steering facility should be screened in accordance with ICAO Annex 17 for persons other than passengers entering security-restricted areas. Particular attention should be paid to the veracity and reliability of individuals entering these facilities, including extensive and robust background checks, and use of biometric identification systems.

CONCLUSION UAS/RPAS are already widely used, both regulated and unregulated. Besides the obvious safety considerations, there is an undeniable security issue. It is therefore imperative that a continuous and thorough risk analysis of the implication and use of RPAS takes place, not least to protect passengers and people on the ground. All aspects of RPAS must be regarded and be proportionate to the standards of comparable manned aircraft operation.

other words, it is essential to ensure that no other function other than the one intended can be performed, that all uploaded functions are verified to ensure correctness and authenticity of transfer, that all users of the system are authenticated by the system as authorised ASI-mag is an international magazine that is dedicated to security issues within the aviation sector. It is published every two months and gives information on topical current security related issues that both airlines and airports have to deal with within the dynamically changing and evolving world of aviation. The magazine gives information on new security related technologies and procedures that can assist with ensuring security related issues are made safer for all.

users of that system, that commands between the system components are not corrupted or interfered with, and that all commands and/or transmissions between the system components are acknowledged.

DISCLAIMER: THIS ARTICLE REFLECTS THE PERSONAL VIEWS OF THE AUTHOR AND SHOULD NOT BE REGARDED AS BEING THE POSITION OF IFALPA OR ECA. Jo Schoenmaker is an active-flying 10,000+ hours captain on the Boeing 737 Next Gen, flying for transavia.com, one of KLM’s subsidiaries. He started his career as a police officer. He was selected and trained as a pilot for the Aviation Branch of the Dutch National Police and flew fixed-wing aircraft for police and coastguard. He joined transavia.com in 1991 and held several positions within his company, including safety trainer, safety officer, project manager, security adviser and security trainer. He developed training in the areas of security and crew resource management (CRM). He is also an active flight instructor and examiner (TRE/TRI) on the Boeing 737. Captain Schoenmaker joined the security committee of VNV-DALPA (Dutch Airline Pilots’ Association) in 2005 and became chairman of that committee in 2009. He is also vice chairman of the security committee of IFALPA (International Federation of Airline Pilots Association) and member of the security committee of the ECA (European Cockpit Association).

AER LINGUS WOULD LIKE TO KINDLY THANK AVIATION SECURITY INTERNATIONAL (WWW.ASI-MAG.COM) FOR GIVING US PERMISSION TO PUBLISH THIS ARTICLE

034 Aer Lingus Risk_Corporate Security_3pp.indd 37

30/04/2015 12:09

038 / AER SAFETY / HUMAN TRAFFICKING

Human Trafficing COMMON INDICATORS A key element of any anti-trafficking strategy is having frontline personnel that are informed and aware of indicators of trafficking and vigilant for signs of a crime taking place. We all have an obligation to raise awareness and play our part by reporting any suspicious activity that may indicate potential human trafficking.

DEFINITION The trafficking of human beings is the recruitment, transportation, transfer, harbouring or receipt of people for the purpose of exploitation. This includes persons forced into prostitution or other forms of sexual exploitation, forced labour or services, slavery or practices similar to slavery, servitude or the removal of organs. For children exploitation may also include illicit international adoption, trafficking for early marriage or for begging. Trafficking involves a process of using illicit means such as threat or use of force or other forms of coercion, of abduction, of fraud, of deception, of the abuse of power or of a position of vulnerability. Human trafficking is a form of slavery that is still happening all around the world. Sadly it is also happening in Ireland today; people are being trafficked into our country to provide slave labour or forced into prostitution. Others are being trafficked through Ireland to other destinations.

038 Aer Lingus Risk_Human Trafficking_3pp.indd 38

30/04/2015 09:32

AER SAFETY / HUMAN TRAFFICKING / 039

COMMON INDICATORS On the following pages are examples of indicators that may suggest something is wrong. The list is by no means exhaustive. It is not the case that a set number of indicators will equate to a person being a victim of trafficking. One or a combination of factors could suggest a person is a victim, so each case should be considered on its own merits. Many of these indicators may apply to both adults and children. TIP: Your instinct is the most important tool. If you feel something is not quite right then it’s worth alerting An Garda Síochána (whether the indicator is listed here or not!).

POTENTIAL VICTIMS

THE PASSENGER’S DEMEANOUR: Looks intimidated Acts as if instructed by another, but may not be travelling with anyone Wears inappropriate clothing for their age or the weather conditions or looks particularly uncomfortable in their clothing Appears expressionless or unhappy Lack of interest in engaging in activities, lack of interest in engaging with others Hostility (annoyed and easily irritated, temper outbursts) Appears sedated or incoherent Signs of injuries or scars that could be the result of an assault Does not behave in a way that is seen to be typical of someone their age Appears fearful or anxious Appears nervous, withdrawn, afraid – especially of the person they are accompanied by/ checked in with/ by someone who is sitting in another part of the aircraft for no apparent reason Avoids eye contact with accompanying passenger or appears unduly submissive (unless from a country where this is the social norm) Is not allowed or able to speak for themselves – observed by an ‘escort’ Does not speak the same language as the person(s) they are travelling with (especially if there is a noticeable age gap or difference in ethnicity)

038 Aer Lingus Risk_Human Trafficking_3pp.indd 39

CASE STUDY

ANA’S STORY

UNDERSTANDING THE ELEMENTS Human trafficking has three distinct elements:

1 2 3

THE ACT – recruitment, transport, transfer, harbouring and receipt of persons; THE MEANS – threat or use of force, coercion, abduction, fraud, deception, abuse of power or vulnerability and giving payments or benefits; THE PURPOSE – exploitation including prostitution of others, sexual exploitation, forced labour, slavery or similar practices, removal of organs and other types of exploitation. THE CONSENT of the victim is irrelevant when any of the means outlined above have been used. Furthermore, in the case of children, defined as anyone under 18 years of age, actions taken for the purpose of exploitation constitute trafficking even where the means have not been used. There is no requirement that a person must have crossed a border for trafficking to take place – it can and does take place within national borders

On a recent flight, a cabin-crew member noticed a couple on board who were travelling with a young child. The child, Ana, Looked to be about nine years old. The couple seemed very well dressed, wearing expensive looking jewellery and clothes. Ana, by comparison, was wearing poor quality clothes. The cabin-crew member noticed that the couple was Irish but the child was not – she supposed the child could be adopted. However, after some time, the cabin-crew member also noticed that, as the couple spoke among themselves, the girl looked unresponsive and she seemed to be gazing into space. The cabin-crew member initiated a conversation with the child asking if the child had been to Ireland before. The man accompanying Ana immediately intervened and asked the cabin crew member to leave the child alone, he said she was tired after her long journey. The cabin-crew member felt that something about the situation was not quite right. She informed the captain of her concerns. The captain decided to alert ground immigration officials by radio so that they could watch out for the couple and the child when passing through immigration. It turned out that the couple, who were Irish, had “bought” Ana from her “uncle” back in her home country. They had drugged Ana before the flight. They were taking her to Dublin to become a domestic servant for a wealthy couple who had paid for her in advance. The couple were arrested. It was the actions of the cabin-crew member that saved Ana from a life of slavery.

ANSWERING QUESTIONS PASSENGER’S ABILITY TO ANSWER QUESTIONS: They are unsure of their own travel route. May not know what country they are in/where they are transiting/their intended destination. Can only answer specific security or immigration related questions, answers appear to be rehearsed. Unable to answer general questions – what’s your name, where are you from, how old are you, etc. Provide no credible answers about the purpose of the travel, their employer or tourist activities. Difficulties completing basic details on landing card (e.g. name, DoB, nationality) without referring to documentation or asking another passenger.

30/04/2015 09:32

040 / AER SAFETY / HUMAN TRAFFICKING

CASE STUDY

CHRISTINE’S STORY Christine is a 19 year-old Albanian girl. She has primary school education and speaks very little English. She spent most of her teenage years working for her family at home. One day a friend of her uncle offered to take Christine to Europe for work. She willingly accepted his offer and her father gave his blessing. The friend organised all her travel arrangements and they flew to Dublin via London. When they arrived at Dublin Airport the friend handed her over to a man called Jim and it wasn’t until she arrived at Jim’s house that she realized her fate. Jim raped her and told her that she had to do everything he said. He informed her that she owed him 50,000 for travel and that she would have to pay it back by selling sex to men. Christine was horrified as she never wanted to be a prostitute but she was frightened of what would happen if she refused. Jim told Christine that if she went to the Gardaí she would be thrown in prison because her travel documents were illegal. It didn’t take Jim much to deter Christine because her only experience of policing was one of corruption in Albania. Jim took Christine to a house where there were three other young women and she was introduced to the life of prostitution. Christine had to have sex with five to 10 men a day. Jim or his driver would collect the women’s earnings everyday and the women would receive 20 a day to buy food and condoms. Christine lived in the brothel with the other women, and while they were free to go to the shops, they could never go too far away from the house because they had to be available 24/7 when men rang to use them. A few weeks later Christine was taken to another location and this time she was in a brothel on her own. Christine initially felt totally isolated in a new town with no one to talk to, except the men who used her – or her pimp. In time, Christine frequently spoke with a friendly woman in the local supermarket, but she was afraid to tell her the truth. Occasionally Christine would ring her family but she felt too ashamed to tell them what had happened. The only option Christine felt she AFTERMATH had was to do as she was told and hope that maybe when the debt In accordance with existing was repaid she would get free. arrangements in this area Christine often blamed herself Christine was granted a 60for deciding to go abroad and day recovery and reflection trusting the family friend. One period for the purpose of: day the brothel was raided by the ● recovering from her ordeal, local Gardaí and Christine was ● giving her time to reflect arrested for not having ID and for on her position, and engaging in prostitution. Christine ● deciding whether to assist had a lifelong fear of police and with a police investigation. she decided not to tell them her She was also provided true story. Christine was granted with safe and secure State free legal aid and in time built up a accommodation. Christine trusting relationship with her legal opted to assist the Gardaí representative who having heard with their investigation and her story, formed the view that she she has now been granted six was a victim of sex trafficking. months’ temporary residency.

038 Aer Lingus Risk_Human Trafficking_3pp.indd 40

POTENTIAL TRAFFICKER 1

HAS BEEN SEEN TRAVELLING WITH DIFFERENT CHILDREN OR FEMALES OR GROUPS OF MEN PREVIOUSLY

APPEARS TO BE LEADING A GROUP WHO DO NOT KNOW EACH OTHER BUT ARE NOT ON A TOUR

SEEN WITH ANOTHER PASSENGER, BUT THEN DISASSOCIATES FROM THEM AT CHECK IN, ON BOARD AND THROUGH SECURITY/IMMIGRATION CONTROLS

AN UNEXPLAINED INCREASE IN THE LEVELS OF SUPERVISION CLOSE TO LANDING

A SIGNIFICANTLY OLDER MALE ACTING AS IF HE WERE THE BOYFRIEND OF AN UNDERAGE/YOUNG FEMALE.

30/04/2015 11:03

AER SAFETY / HUMAN TRAFFICKING / 041

TAKING ACTION

NEVER DIRECTLY CONFRONT A SUSPECTED TRAFFICKER OR VICTIM YOURSELF AS THIS MAY HARM YOU OR THE VICTIM. GROUND STAFF ACTION HOW YOU CAN MAKE A DIFFERENCE Be observant as you pass through airports, if you see anything suspicious contact the authorities. Be observant of passengers at check-in and at boarding – and on board your flights. Trust your instincts: if something doesn’t feel right, take time to explore the situation further and report to the authorities if appropriate. In particular pay attention to children who seem uncomfortable with their travelling companion. SIGNS TO BE WARY OF INCLUDE: if the child does not seem alert or seems drugged if the child is not free to speak if the child is dressed in shabby clothes but the adult(s) accompanying them are well dressed signs of physical abuse.

IF YOU SUSPECT THAT A PASSENGER MIGHT BE A VICTIM OF TRAFFICKING YOU COULD: Initiate pleasant, non-threatening conversation Ask questions such as: whether or not the person is on holiday, where are they staying, etc. In the case of an unaccompanied minor, ask who will be meeting them Gauge their reaction as they respond – do their answers seem rehearsed? Are they being watched by someone as they answer? Do they seem anxious? Try to assess their body language and demeanour Inform other cabin crew of your concerns, asking them to interact with the passenger Advise the captain of your concerns saying you feel An Garda Síochána/local police need to be notified in advance of landing at the destination If you are at the airport and see any suspicious activity call the Airport Police or Gardaí. Your information may be invaluable and could save someone from a life of exploitation Remember, both your own safety and that of the victim is paramount. A potential victim may be travelling alone or they may be accompanied. As a responsible citizen you are asked to be alert, gather information and inform the relevant authorities.

Ground staff identifies potential trafficking indicators and advises duty manager or supervisor Duty manager or supervisor contacts the Gardaí or Airport Police to attend at the gate Provide as much detail as possible, including passenger’s details and why you suspect something is wrong Keep written reports of the event (shift report) Ground action is now complete. Do not treat the passenger any differently or alert them to Police interest.

CABIN CREW ACTION CCM identifies potential trafficking indicators and advises captain Captain contacts ground, requesting Gardaí or Airport Police on arrival Provide as much detail as possible, including passenger’s details and why you suspect something is wrong Keep written reports of the event (crew report) Cabin crew action is now complete. Do not treat the passenger any differently or alert them to Police interest. SOURCE: DEPARTMENT OF JUSTICE AND EQUALITY

038 Aer Lingus Risk_Human Trafficking_3pp.indd 41

30/04/2015 11:04

042 / AER SAFETY / CORPORATE HEALTH & SAFETY

Corporate Health & Safety Office Working at heights requires a carefully managed assessment of risks and responsibilities. By Deirdre O’Kennedy, Health & Safety Adviser.

he Health & Safety Office is responsible for ensuring that all hazards and risks identified are managed in accordance with the Safety, Health and Welfare at Work Act 2005 and other relevant health and safety legislation. The below article provides insight into the type of incidents that can occur when working at heights and reinforces the reasons why we must always be aware of potentially dangerous situations while performing our duties.

AER LINGUS

Actively develop and improve safety processes to conform to worldclass standards.

WORKING AT HEIGHT IN THE AIRCRAFT ENVIRONS A Hampshire-based aircraft maintenance company has been sentenced in December 2014 for safety failures after three workers were injured in separate falls at its airfield in Lasham – two in the same month. The first incident at ATC (Lasham) Ltd, which has an international client base, saw an employee fall five metres from an aircraft door to the runway tarmac while repairing a faulty door. His injuries were at first thought to be life-threatening. Less than three weeks later, a contractor, broke a knee after falling three metres when a weld gave way on a scissor lift. Finally another employee fell from an aircraft stand that had no guardrail between the aircraft and the stand steps. He fractured a thumb in three places. The incidents, on 9 and 27 July, and 30 November 2011 respectively, were investigated by the Health and Safety Executive (HSE UK), which prosecuted ATC (Lasham) Ltd for three safety breaches at Salisbury Crown Court. The court was told the first worker, then 60 years old, from

042 Aer Lingus Risk_Corporate Health & Safety_2pp.indd 42

HSE UK

Each year in the air transport and aviation industry, HSE receives reports of employees injuring themselves after failing from a height. Most could be avoided with simple risk reduction measures.

Alton in Hampshire, had been helping to fix an aircraft door fault that had been detected during crew safety checks. During the repair, the worker opened the door and it flew out under pressure. As he was holding onto the door, he was pulled out of the plane and plunged five metres to the ground, as there were no safeguards in place to prevent him falling. He suffered a broken right thigh and ankle and needed rods and pins inserted to help him recover. He has since been able to return to work. Later the same month, a contractor, 48, from Wootton Bassett, Swindon, fell as he attempted to climb down from inside a Boeing 757 wing fuel tank. He was standing on a scissor lift when a weld in the lift gave way, sending him falling to the ground below. The final of the injured three, an employee then aged 67, from Ascot, Berkshire, sustained a multiple fracture to his thumb as he fell from an unprotected part of an aircraft platform. The court heard HSE identified that in all three incidents ATC had failed to provide safe plant and a safe system of work for the three men. There was a lack of safe procedures for working at height, provision of unsuitable and un-maintained equipment, and general poor management.

BREACHES OF HEALTH AND SAFETY AT WORK After the incidents, HSE had served a number of prohibition notices halting certain areas of work and improvement notices requiring better working practices. ATC (Lasham) Ltd, of Lasham Airfield, Lasham, Hampshire, was fined a total of £35,000 and ordered to pay £32,430 in costs after admitting three breaches of the Health and Safety at Work Act 1974. After the hearing, HSE Inspector Kelly Nichols said: “Three workers have suffered painful injuries owing to inadequate safe systems of work employed by ATC (Lash-

30/04/2015 11:06

AER SAFETY / CORPORATE HEALTH & SAFETY / 043

am) – which is particularly disappointing given it is a major company working in a particularly safety-critical sector. “The company’s management of health and safety was extremely poor in many areas but particularly in their approach to working at height. Three falls occurred in a relatively short period and these could have resulted in even more serious injuries.”

042 Aer Lingus Risk_Corporate Health & Safety_2pp.indd 43

Working at height needs careful planning and organisation.

In Aer Lingus we are aware that “Working at height needs careful planning and organisation, and part of that is selecting and using the right type of equipment, which is properly maintained and safe.” We are currently reviewing all our working at height activities. This review includes all the activities around an aircraft; however we must not forget working around plinths, steps, stairs and working below ground also constitute hazards associated with “working at height”.

30/04/2015 11:06

044 / AER SAFETY / COMPETITION

Competition Test your safety knowledge with our crossword and enter for a chance to win a 50 DAA voucher.

6 7

15 The main air navigation provider in the UK 18 An atmosphere of trust in which staff are encouraged to provide essential safety-related information 19 Requirements of both AAA and EASA that certain occurrences are reported as Mandatory Occurrence Reports 20 The action of reducing the severity, seriousness, or painfulness of something

10 11

12 13 15

Across 3 An accident in which an airworthy aircraft, under pilot control is unintentionally flow into the ground, a mountain or water on an obstacle 4 “As low as is reasonably practicable” 8 In accordance with EASA Air Ops ORO.AOC. 135. Senior managers charged with statutory responsibilities for the conduct of safe operations and maintenance activities 10 A third country aircraft may be inspected by EU member state

044 Aer Lingus Risk_Competition 1pp.indd 44

11 Aer Lingus Occurrence Reporting Tool/Database 12 A plan in which it is designated to prepare to deploy an effective humanitarian and technical response in the event of aircraft accident, serious incident or other disaster 13 A condition or an object with the potential to cause death, injuries to personnel, damage to or loss of an aircraft, equipment, structures, or foreseeable situation 14 Safety Action Group

Down 1 A person who has the ultimate responsibility and accountability for implementation and maintenance of the Aer Lingus Safety Management System 2 Hazard Identification and Risk Management 5 ICAO Manual for Aircraft Accident and Incident Investigation 6 An independent federal agency charged with investigating every civil aviation accident in the United States and significant accidents in other modes of transportation 7 Proactive and non-punitive use of digital flight data from routine operations to improve aviation safety 9 The assessment of safety risk management performance through periodic monitoring, feedback and continuous corrective action to maintain the effectiveness of safety risk controls under changing operational demands 11 Standard Operating Procedure 16 Air Accident Investigation Unit 17 Fatigue Risk Management

PLEASE SEND COMPLETED COPY OF THIS TO: CSRO, 1ST FLOOR, SHAMROCK HOUSE, DUBLIN AIRPORT. PRIZE: E50 DAA VOUCHER

30/04/2015 13:01

AER SAFETY / CORPORATE HEALTH & SAFETY / 0037

Contact Details THE CSRO TEAM ALWAYS WELCOME SUGGESTIONS AND FEEDBACK, SO PLEASE FEEL FREE TO EMAIL/CALL OR DROP IN TO SEE US IN RELATION TO ANY ISSUE.

CORPORATE SAFETY & RISK MANAGER CAPT CONOR NOLAN 353 1 886 2709 CONOR.NOLAN@AERLINGUS.COM

SMS MANAGER JESSICA BROWNE 353 1 886 2708 JESSICA.BROWN@AERLINGUS.COM

FDM SPECIALIST PAUL KEARNEY 353 1 886 8192 PAUL.KEARNEY@AERLINGUS.COM

CORPORATE SAFETY & RISK OFFICER MUTSUMI SAGA-WALSH 353 1 886 2008 MUTSUMI.SAGA-WALSH@AERLINGUS. COM

CORPORATE SAFETY MANAGEMENT SYSTEMS ADMINISTRATOR FIONA COX 353 1 886 2054 FIONA.COX@AERLINGUS.COM

CORPORATE SAFETY & RISK OFFICE 1ST FLOOR SHAMROCK HOUSE, DUBLIN AIRPORT, IRELAND 353 1 886 8193 CSRO@AERLINGUS.COM

IBC Aer Lingus Risk_Contact details 1pp.indd 37

30/04/2015 14:18

AER SAFETY / CORPORATE HEALTH & SAFETY / 0037

OBC Aer Lingus Risk_BACK COVER 1pp.indd 37

30/04/2015 14:18