February 2012
Incidents
  • The cost of safety!
  • 1 February 2012

  • By Dr Guy Gratton

  • Certified aeroplanes don’t break up in flight – the safety standards we have had for well over 50 years have done a fantastic job of preventing this from happening. Another part of the equation that has prevented such break-ups has been the high standards of modern flight training ensuring that aeroplanes are kept by competent pilots within their limitations.

    So how, on September 2009, did OO-TML, a PA-34-220T Seneca V break up during a training flight from Seville in Spain, killing an instructor and two students? All evidence is that the aeroplane was perfectly serviceable, and the 2000hr instructor competent and current to teach his 150 hour student – a commercial student on his third multi-engine flight, and handling the aeroplane.

    Examination of the wreckage showed that the aeroplane, which was loaded to just behind the aft CG limit, and probably a few pounds over the maximum take-off weight (a bad habit, but one shared by very many flying schools who often fail to practice what they preach about weight and balance). Neither examination of the wreckage, nor of the technical records showed any abnormality likely to lead to any kind of in-flight breakup. The wing structure however showed clear signs of an overload in flight, adding to the wreckage being spread over quite a wide area of countryside – and this aeroplane had clearly broken up in flight.

    The one thing – apart from the in-flight breakup itself – that was really unusual, was that the electrical pitch trimmer was in the fully nose-down position; this isn’t something you’d expect to see in any well designed aeroplane at any stage of flight.

    The investigators went to the aircraft technical records and found relatively little that seemed untowards. However, they also talked to various of the other pilots who’d flown this aeroplane. This threw up something quite disconcerting eight separate incidences, with six different pilots, of pitch trim jams or runaways – only one of which ever got reported to maintenance. One of these runaways had been the day before the accident.

    Most aircraft maintenance engineers, when no pilot is in earshot, will admit that they are not superhuman, psychic or possessed of supernatural powers. So, to reach meaningful conclusions about the state of any aeroplane, they rely upon the aircraft technical records to tell them that something is wrong – and then, if they’re any good at their jobs, they’ll fix it. Anybody who has been working in an aircraft operating environment knows that there’s a certain amount of artistic licence about reporting of defects: when operations are busy, and when an aeroplane is sorely needed to make money or to meet commitments to customers (or just the crew want to sleep in their own beds that night) then snags don’t get written up. It is understandable, but seldom defensible.

    In this case five pilots between them failed to properly record what was clearly a consistent pattern of faults occurring on this pitch trim system. Any maintenance engineering team worth their salt would have seen such a pattern of faults and found an opportunity to break into the pitch trim mechanisms and ensure that it was all working properly.

    But that in itself doesn’t surely explain this accident? Does it? Some of those previous incidents were also pitch trim runaways – yet nobody got killed all those other times. The truth is, nobody can be quite certain – the aeroplane had no flight data recorder, the voice recorder wasn’t working, and nobody lived to tell. However, we can conject a bit.

    Firstly, if you look at the various commercial training syllabi – what failures and emergencies routinely get practiced? Not, to be honest very many – engine failures and fires, unusual attitudes, vacuum failure, maybe an undercarriage failure, and very occasionally a communications failure. This is perhaps the fault of the CPL flying syllabus which puts very heavy emphasis on precision navigation, and after that looks at the standard emergencies which tend to repeat in skill tests. So, “non-exam” emergencies – for example intercom failure, a complete electrical failure – or a pitch trim runaway - just don’t feature. There’s a classic educational issue here – any educational system will inevitably train or teach to the test: this is true in any primary school or a commercial flying school. So, this 25 year old, 2,000hr commercial instructor was probably sharp as hell at dealing with the emergencies he’d trained for his own commercial licence and had trained many other pilots in for theirs – but had spent little time thinking about, or training for, “non-exam” failures.

    And so, on this date – the aeroplane, which possibly had weakened structure from loss of control after many previous and unlogged trim runaways, did it again, but this time, we can only assume through some mishandling from a pilot not trained in this emergency, the airframe was overstressed and failed. This forms a likely accident chain which looks something like this:

    Chain Link 1 Failure prone pitch trimmer design
    Chain Link 2 Lack of training in “non-test” emergencies
    Chain Link 3 Consistent failure by pilots to report in-flight faults
    Chain Link 4 Weakened structure due to repeated pitch trim runaways
    Chain Link 5 The final trim runaway
    Chain Link 6 Incorrect responses to the pitch trimmer

    James Reason, who invented the famous Swiss Cheese model (if you’ve not met this before, I strongly recommend his book The Human Contribution which is readily available worldwide) would have categorised these something like this:-

    Poor pitch trimmer design & lack of training:

    Organisational influences.

    Failure to report faults:

    Unsafe Supervision

    Weakened Structure:

    Precondition for Unsafe Act

    Incorrect Response to trim runaway:

    Unsafe Act.

    And so, this unfortunate crew really had everything stacked against them; by a trimmer design capable of running away regularly, and by management who didn’t enforce proper reporting of every failure; by colleagues who accepted regular non-reporting of in-flight failures; and, by regular in-flight runaways (co-incident with an overweight aeroplane) perhaps weakening the structure. It is perhaps inevitable that this accident was going to happen eventually, in this or a similar aeroplane, in this or a similar training environment.

    Can we learn things from this?

    We absolutely can – and every aircraft operating environment should. Weight and balance limits should not be treated as optional. Reporting of in-flight failures should also not be regarded as optional, and if there are potential failures on any aeroplane, then that operator should include in regular crew training some awareness of how to manage those failures. All very elementary – but expensive, which is the problem of-course. Every extra training flight or simulator session, every afternoon with an aircraft off the line, every hour an instructor spends refreshing his or her own skills cost money either directly, or through lost revenue.

    So, the level of professionalism that any organisation can afford to display in its safety management becomes dependent upon how much money they have spare. That is a horrible equation, and I don’t have a solution for it. Sorry!