“Most Wanted” list of safety improvements to be part of overall examination
Safety advocacy programs will be intensely reviewed for their effectiveness, the National Transportation Safety Board (NTSB) announced last week.
The decision to undertake a special review came at the end of the NTSB’s May 6 public hearing on its “Most Wanted” list of needed safety improvements. That list, created in 1990, originally was intended to focus attention – and action – on the board’s highest-priority safety improvements. However, the acceptance rate of some 250 specific recommendations on the list has hovered around 48 percent, significantly less than the 80 percent acceptance rate for all recommendations issued by the board.
One of the reasons for the lower acceptance rate of “Most Wanted” recommendations may be that they tend to involve issues of greater technical, cost and design difficulty to implement. Safety deficiencies elevated to “Most Wanted” status tend to strike closer to the core of long-standing and deeply embedded problems.
Nonetheless, concern about the effectiveness of the “Most Wanted” program has been growing. Some of the items, such as runway safety, have been on the list since its inception. Last year, then-NTSB chair Marion Blakey, wondered if the “Most Wanted” list was losing its punch. “I am concerned about its overall static quality,” she said (see ASW, May 20, 2002). At that hearing a year ago, Elaine Weinstein, director of the NTSB’s office of safety recommendations and accomplishments, asked if the list was “a lean, mean fighting machine or a lumbering bandwagon?”
That concern crystallized this year with a decision to suspend publishing the list until the rationale is reviewed.
In her first public appearance as NTSB chair, Ellen Engleman said, “Our focus must be on the aggressive pursuit of safety. It’s directly related to public confidence.”
The aim of the 30-day review, she said, is to produce “an effective, coordinated safety plan that integrates NTSB investigations, recommendations and advocacy efforts.”
The “Most Wanted” list has been a high-profile part of the board’s safety advocacy for a number of years. Nevertheless, Engleman said, “Issuing safety recommendations alone is not sufficient to fulfill our obligation to ensure the safety of the national transportation system.”
“Implementation of these recommendations is what will make a real difference,” she declared.
In other words, an annual exercise to focus attention on top safety issues may have devolved into a pro forma ritual of debatable effectiveness. The “Most Wanted” list had become a vehicle with about as much traction as a Teflon-coated tire.
Member Carol Carmody said, “While the list has been extremely useful, perhaps there is a way of being more effective.”
The order for a sweeping review came at the end of detailed deliberations over some of the most difficult safety challenges the board had faced over the years. The frustration with the lack of progress was palpable. As in 2002, the proposed “Most Wanted” improvements for 2003 include three aviation-specific items and three items concerning all modes of transportation but with clear relevance to aviation. The current state of play on these issues shows that the “Most Wanted” list has influenced progress incrementally, but overall it has been bereft of breakthroughs.
Aviation specific: In this category, the response to date is dominated by research efforts, some of which do not meet what the NTSB believes is necessary. In general, there is a dearth of deployment.
Explosive vapors in fuel tanks of transport category aircraft. This item has been among the “Most Wanted” improvements since 1997 and is on the list as a consequence of the fatal 1996 center wing tank explosion on TWA Flight 800. Two actions are called for: over the long term, eliminate the presence of flammable vapors in fuel tanks and, over the short-term, mitigate the hazard by eliminating ignition sources and by carrying a minimum amount of fuel (3,000 lbs.) so that pump inlets are always submerged and conditions are not present where the pumps can suck in vapors (see ASW, Sept. 9, 2002).
John Clark, NTSB head of aviation accident investigations, said the short-term actions have been significant but are even more important in light of the recent discovery of “bluing” on pump inlets, suggesting high heat from malfunctioning pumps and the potential to trigger an explosion of vapors. “We don’t know what’s going to show up tomorrow in an accident or incident,” Clark said, arguing that continued activity to preclude ignition sources is needed to “minimize exposure” until “the explosive mixtures in tanks can be eliminated.”
Inerting the vapors is seen as the long-term solution, in which the oxygen content of the vapors would be kept too low to sustain an explosion. A lightweight membrane-type system is being touted as promising, although it may not provide sufficient nitrogen-enriched air to inert tanks during descent, which is the most demanding part of the flight for an inerting system (see ASW, Dec. 23, 2002). Additionally, the sensitivity of the membranes to contamination and their long-term durability remain open issues.
Nonetheless, at least three aircraft will be conducting test flights this summer to evaluate prototype designs. A B747SP and an A320 will be flown at the William J. Hughes Technical Center at Atlantic City, N.J. The center is the research arm of the Federal Aviation Administration (FAA). Independently, Boeing [BA] will be test flying a concept system on one of its B747-400 aircraft, also this summer.
Sources say money for the FAA flight test program is sufficient for this year, but funding to continue the work next year is problematic.
Design assumptions and performance standards are another issue. The FAA issued Advisory Circular No. 25.981-2 on April 18, 2001, outlining four performance parameters for an inerting system (see ASW, Dec. 23, 2002). An oxygen content of not more than 10 percent in the tank was one of the criteria, yet the hollow-fiber membrane system being touted by the FAA cannot meet this standard and a move is afoot to relax the oxygen concentration to 12 percent. Clark said a “Special Condition” document prepared jointly by the FAA and Europe’s Joint Aviation Authorities (JAA) will be published in the Federal Register in June. This document, he said, will address “what assumptions are to be used.”
While the NTSB has been seeking to eliminate hazardous vapors in fuel tanks since 1997, the issue goes back much further in time. Fuel tank explosions that destroyed another TWA jet nearly 40 years ago prompted the first call for inerting the tank vapors.
Airframe structural icing. Freezing rain continues to pose a particular threat, the certification criteria don’t fully account for it, and improved ice detection, protection and operational procedures are needed, according to Clark. This item has been on the “Most Wanted” list since 1997 and is an outgrowth of the fatal 1994 crash of an Avions de Transport R�gional ATR-72 twin-turboprop at Roselawn, Ind.
The January 1997 fatal crash of an Embraer EMB-120 twin-turboprop at Monroe, Mich., added impetus to this item’s presence on the “Most Wanted” list (see ASW, Aug. 31, 1998 and Sept. 7, 1998).
Another example where a twin turboprop nearly spun in icing conditions involved a Saab 340A flying in icing conditions over Eildon Weir, Australia, Nov. 11, 1998. The airplane, with three crew and 28 passenger, rolled 126� to the left, pitched 35� nose-down, and dropped 2,300 feet before the pilots were able to regain control. The Australian Transport Safety Bureau (ATSB) report of this incident references the Roselawn and Monroe crashes, and cites shortcomngs in pilot awareness, procedures, certification and stall warning – a carbon copy of the NTSB’s menu of concerns (for the ATSB report, see http://www.atsb.gov.au/aviation/pdf/vh-lpi.pdf).
More recently, the fatal Dec. 21, 2002, crash of a TransAsia ATR-72 looks like scores of icing events that have afflicted twin-turboprop aircraft (see ASW, Feb 3). The Aviation Safety Council of Taiwan is investigating this crash and has requested technical assistance from the NTSB.
Turboprop aircraft are not the only point of concern. Regional jets with their hard wings (i.e., no leading edge slats) may also be vulnerable to icing, portending a repeat of icing accidents two decades ago involving early-model DC-9s, which also featured a hard wing. A nonfatal Dec. 16, 1997, runway overrun involving a Bombardier CL-600 regional jet at Fredericton, Canada, and a fatal Jan. 4, 2002, crash on takeoff of the same model at Birmingham, England, add to the NTSB’s concern. The latter case is still under investigation by the UK’s Air Accidents Investigation Branch (AAIB). This much can be said: the airplane was not de-iced before its morning takeoff, although other aircraft, “which had been parked overnight, were de-iced during the morning, with associated reports of moderate to severe ice or frost accumulations,” according to the AAIB’s preliminary report (AAIB Bulletin No. S1/2002). In the Fredericton case, conditions were conducive to the formation of “a small though significant amount of ice,” according to the Transportation Safety Board of Canada (see ASW, Aug. 31, 1998). In the Birmingham case, the jet was not de-iced before takeoff.
Clark’s briefing to the board members covered concerns that he believes warrant keeping icing on the “Most Wanted” list.
Runway incursions. The need for better control of aircraft on the ground has been on the “Most Wanted” list since its inception 13 years ago. As Clark recounted, the board urged that the FAA quickly acquire and install automated equipment to alert controllers of impending runway incursions. The airport movement area safety system (AMASS) was the FAA’s response, and the system is operational today at 28 of 34 airports.
Because AMASS performance has been downgraded to prevent incursions, not necessarily collisions, the NTSB deemed this response “unacceptable/superceded.”
The term “superceded” refers to what the NTSB now wants – a ground movement safety system at all 433 U.S. airports with scheduled passenger service, and it wants the system to provide a direct warning to flight crews – which AMASS and a lower cost system called ASDE-X do not do.
“Since 1990, there have been five fatal accidents caused by runway incursions with 63 fatalities,” Clark said. “Staff believes that the risk for an incursion, collision and loss of life remains great.” Similar concerns were expressed in a Department of Transportation/Inspector General (DOT/IG) report of April 7, which lamented the lack of progress on runway safety.
He cited a Jan. 22, 2001, near miss at Seattle in which an American Airlines [AMR] MD-80 was mistakenly crossing an active runway on which a TWA MD-80 was taking off in the foggy conditions. The two aircraft, carrying 176 people, missed colliding by a scant 60 feet. An AMASS simulation of the event showed that the tower controller might have had just 11 seconds before the near collision. Clark said that is precious little time for the controller to (1) determine the nature and location of the problem, (2) identify the aircraft involved, (3) decide on an immediate course of action, (4) issue instructions to the flight crew and (5) have the pilots respond.
“Clearly, 11 seconds is not enough time,” Clark said.
NTSB staff urged accelerated development and deployment of cockpit moving map displays. Engleman said, “I’m a little concerned about the emphasis on high-tech solutions to the runway incursion issue. Are there any low-tech opportunities?”
Actually, there are at least three such opportunities. The DREADLE instantaneous alarm system articulated in this publication would provide an instant warning of any taxiway/runway transgressions to both cockpits and control towers. The system also would alert to incursions by ground vehicles (see ASW, July 16, 2001 and ASW, May 20, 2002).
The Ground Marker concept developed by UK-based Airspec would alert taxiing pilots to a closed runway (see ASW, March 24). Had this system been installed at Taipei on the night of Oct. 31, 2000, it could have prevented the pilots of Singapore Airlines Flight SQ006 from attempting takeoff on Runway 05R, which was closed. The airplane struck construction equipment parked on the tarmac, and in the resulting crash and fireball, 83 of the 176 passengers and crew aboard were killed. The pilots thought they had lined up on the parallel runway, 05L, for takeoff (see ASW, May 6, 2002). According to Airspec’s Nigel Corrigan, with Ground Marker installed, as the pilots lined up on Runway 05R, they would have received this alert: “Warning, runway zero five right closed. Construction equipment. Call tower now.”
Ground marker is now undergoing testing at the FAA’s technical center.
Another concept being developed by Honeywell is dubbed the Runway Awareness and Advisory System (RAAS). This approach to runway safety basically capitalizes on the company’s enhanced ground proximity warning system (EGPWS), a tool now installed in thousands of airplanes to help prevent controlled flight into terrain (CFIT) crashes by comparing aircraft position in flight – based on the Global Positioning System (GPS) – to a digitized terrain database. RAAS is a software upgrade to the existing EGPWS system that provides pilots with various aural advisories. For example, while on approach, the system would advise pilots, “Runway three-four left ahead.”
On the ground, RAAS would help to assure pilots that they are taxiing toward the correct runway. As Honeywell’s Greg Francois explained, “We have all the runways already in the digital database.” Pilots would hear advisory messages like “approaching three-four left” and, when lined up for takeoff, “on runway three-four left.”
If the pilot mistakenly attempts to take off on a taxiway, as aircraft ground speed passes through 40 knots, RAAS will sound off with an advisory, “on taxiway! on taxiway!”
RAAS seems to be an answer to one of Clark’s scenarios of concern. “A number of incursions involved aircraft moving off the runway, then moving back onto the runway,” he said. It is for such situations that the NTSB desires moving map displays, but a steady stream of advisories from RAAS would seem to provide a near-term palliative.
One of the strengths of this system is that it capitalizes on existing EGPWS technology, which already is installed in some 17,000 aircraft worldwide. The company hopes to achieve supplemental type certification of this EGPWS adjunct this fall. Estimated cost per plane of the RAAS software upgrade is about $15,000. That is list price, and package discounts likely will be available.
Upgrades to make RAAS more capable already are envisioned. “Further down the road, step two if you will, we would be looking at incorporating ADS-B [automatic dependent surveillance – broadcast] to give further advisories, like ‘Runway zero-six occupied’ or ‘Aircraft on final to Runway zero-six,’ ” Francois said.
Since EGPWS features a visual display of terrain, Francois said a “second or third generation” of RAAS might incorporate the kind of map display of aircraft on the airport that NTSB officials are seeking.
Corrigan thinks Ground Marker is more cost-effective, but freely admits to a bias in favor of his company’s product. Not all aircraft are GPS/EGPWS equipped, so RAAS may leave gaps in the fleet. With Ground Marker, he said, “You’ve got every visitor [aircraft] to the airport in one go.”
“Also, Ground Marker messages can be quickly modified to accommodate changes on the airport,” he added.
One observer pointed out that additional aural messages in a sterile cockpit environment, while reassuring in theory, probably “progress toward distraction” and aural overload leading to missed radio calls – in comparison to the “silent sentry” approach embodied in DREADLE.
The larger point is that cheaper, simpler technologies than esoteric radar-based systems are emerging to combat the rising tide of runway incursions, near collisions, takeoffs on closed runways and taxiways, and the like.
Aviation-related “Most Wanted” for all modes of transportation: In this general category, regulatory gridlock prevails.
Child occupant protection. This item was added to the “Most Wanted” list in May 1999. The NTSB’s Weinstein recalled that in December 1999 former FAA Administrator Jane Garvey committed the agency to ending the practice of lap children. At that time, Garvey declared, “We are committed to mandating child restraint systems in aircraft to provide equal protection for adults and children.” (See ASW, May 20, 2002) Weinstein said, “Today, there is still no requirement that children be buckled up for takeoff and landing.”
Automatic information recording devices. The safety board is seeking a number of improvements in cockpit voice and flight data recorder (CVR/FDR) technology:
- A two-hour CVR capability with battery backup.
- Dual installation of combination CVR/FDR boxes for redundant data capture capability.
- FDR upgrades to differentiate between system and pilot control inputs.
- Annual maintenance checks of the equipment to ensure that the various recording parameters are functioning properly.
- A two-hour cockpit image recording capability.
These recommendations have emerged from various crashes, to include Swissair Flight 111 in 1998 (two-hr. CVR and dual combination CVR/FDR installation with battery backup), and the October 1999 crash of EgyptAir Flight 990 (cockpit video recorder), among others.
Member John Goglia asked if recent developments have not changed the imperative for these improvements. For example, he said, the call for cockpit video recording came out of the EgyptAir crash, where the board thought from its investigation into this case that it would be useful to be able to see who was coming into and going out of the cockpit. Now, with hardened, locked doors in the post 9/11 era, the whole issue of cockpit access “has changed drastically,” Goglia said.
He also pointed out that the coming Airbus A380 will feature some 1,600 parameters worth of FDR capability, raising the question of just how much FDR capability is enough.
Dr. Vern Ellingstad, NTSB director of research and engineering, pointed out that the minimum required number of parameters is 88; what he did not say is that the sampling rates of two-to-eight times per second are substantially less than the sampling rates on the order of dozens per second needed to more accurately recreate the sequence of events in an incident or accident.
With respect to the video imaging capability, Ellingstad pointed out that there is considerable non-verbal activity in a two-person cockpit, and it would be desirable to capture who is doing what in terms of running checklists and other activity.
Moreover, operators of Part 135 on-demand charter flights are not required to equip their aircraft with CVR/FDR technology. For these aircraft, a low-cost video recorder would be very useful for capturing instrument displays, control inputs and switch positions. The fatal Oct. 25, 2002, crash of a Beech King Air 100 that killed Sen. Paul Wellstone (D, Minn.), members of his family and the pilot was mentioned as a case in point. The airplane was not equipped with a CVR or FDR, and was not required to be so outfitted.
The NTSB’s James Cash said a one-hour video recorder would cost about the same as a CVR. The video recorder also would capture sound, he pointed out.
In addition to the lack of discussion about FDR sampling rates, last week’s meeting also did not mention the potential for ejectable recorders, which would separate from the aircraft milliseconds before impact (see ASW, Jan. 25, 1999). These recorders avoid the crushing and destructive forces of impact and fire that often obliterate data, or leave investigators with gaps of unreadable data. In a May 1 speech to the Mid-Atlantic Regional Chapter of the International Society of Air Safety Investigators (ISASI), former NTSB chairman James Hall argued in favor of this ejectable technology.
Human fatigue and hours-of-work. This item, too, has been on the “Most Wanted” list since its 1990 inception. It stemmed from a study of aircrew fatigue in commuter/regional airlines, and achieved added impetus with the 1996 crash of a ValuJet DC-9, when the safety board determined that fatigue and hours-of-work rules also need to be extended to maintenance personnel.
On this issue, too, there has been a pronounced paucity of progress. “FAA issued an NPRM [notice of proposed rule making] in 1995 to update flight and duty time regulations, but no final rule was issued,” Ellingstad recounted. A supplementary NPRM is now under DOT review, but the regulation’s coverage will be restricted to Part 121 (scheduled) operators, Ellingstad said.
No rulemaking has been proposed for aviation maintenance personnel, but an FAA study of the matter is to be completed by the end of this year, he said.
In the face of this regulatory inertia, “fatigue is an important recurring safety issue,” he said.
Whether these “Most Wanted” improvements result in a 2003 update now depends on the outcome of the 30-day review. Engleman more than once referred to the “aggressive pursuit of safety,” and the legacy of the “Most Wanted” list is anything but aggressive in terms of response.
One industry source said the list should be maintained. “If it goes away, visibility disappears and one point of pressure on agencies disappears,” he said. Killing the list, he added, would be tantamount to conceding that the NTSB has no clout. One stratagem suggested during last year’s deliberations over the “Most Wanted” list was that if the NTSB hopes to see its top-priority improvements implemented with greater alacrity, it may have to take its case more directly to Congress. After all, it took an act of Congress to mandate traffic alert collision avoidance system [TCAS] technology for cargo aircraft. >> Corrigan, e-mail [email protected], see also http://www.airspecinc.com; Francois, e-mail [email protected], see also http://www.egpws.com <<
The Rome Accident and the First Call for Inerting
From “A Review of the Aviation Fuel Controversy,” by the UK’s Air Safety Group, December 1966 (extracts):
On Nov. 23, 1964, a TWA 707, while attempting take-off from Rome’s Fiumicino airport, experienced apparent malfunctions in No. 2 and No. 4 engines. Following the decision to abort, reverse thrust was selected, but owing to the malfunction in the No. 2 thrust reverser, this engine gave a powerful forward thrust while the remainder were in reverse. Directional control was lost, the No. 4 engine struck a ground vehicle, and after the airplane came to rest, and as the emergency evacuation was under way, four fuel tanks exploded, including the center wing tank. Of 73 aboard, 49 were killed.
The airplane had been loaded with JP4, a more volatile fuel than the Jet A commonly used today.
This accident involved only a fairly minor collision and the aircraft was almost intact on coming to rest. Nevertheless, lethal explosions occurred the moment fire reached the tank vent system.
The press evidently did not uncover the fact that the prospect of such explosions was treated with grave concern in the late [1950s], and to such an extent that the Civil Aeronautics Administration [predecessor to the Federal Aviation Agency, later Administration] required as a Special Condition for turbine powered aircraft some form of tank inerting when JP4 was to be used. This condition was evidently waived when the first U.S. turbine aircraft were certificated.
Maximized Survivability and Recoverability
The case for ejectable recorders
Remarks made by former NTSB chairman James Hall, May 1 to Mid-Atlantic Regional Chapter of the International Society of Air Safety Investigators (extracts):
“The NTSB added “Expanded Parameters for Flight Data Recorders” to its Most Wanted Transportation Safety Improvements list in May 1995 (the name of this item was changed to “Automatic Recording Devices” in May 1998). This item remains on the NTSB Most Wanted list today and I am not sure that we have made much progress.
“I continue to learn about aircraft accidents around the world for which air safety investigators do not have comprehensive FDR data available to solve the investigations and develop accident prevention measures in a timely manner. In some cases, the FDRs do not have sufficient parameters, the FDRs are not functioning correctly or are damaged, power is lost to the FDR during critical phases of flight, or there is no FDR installed.
“The terrorist attacks of 9-11 opened the nation’s eyes to the fact that our skies are vulnerable to more than mechanical or human error and remain a constant reminder to us all about how important it is to have complete access to flight data and cockpit voice recorder information as quickly as possible.
“As you know, the black boxes from the two World Trade Center attacks were never recovered and the cockpit voice recorder from the Pentagon was damaged beyond repair. From a national security perspective, I don’t think anyone in this room would disagree about how critical it would have been to have had access to the flight information from every flight involved that day.
“Unfortunately, even the recorders the NTSB [recovered] from that day’s events presented limitations that impeded our investigations. The Shanksville, PA, crash demonstrated one clear example of how “inadequate recorders” hindered the only opportunity to uncover major clues from the cockpit voice recorder. While this was the only CVR that the NTSB successfully recovered data from, because the CVR was only capable of recording the last 30 minutes of the flight, critical information from the flight was taped over, which may have included how the terrorists actually gained access to the cockpit and potential clues about the terrorists’ backgrounds, co-conspirators, and ultimate plans.
“Over the last year, I have become familiar with a deployable black box technology, which our military has successfully tested, developed and used for years on aircraft including the Navy’s F/A-18E/F Super Hornet fleet. Recently, this technology has been adapted to meet the needs of the commercial industry and presents an obvious way to maximize our ability to ensure the survivability and recoverability of flight recorders. This advanced technology combines a digital flight data recorder (DFDR), cockpit voice recorder (CVR) and emergency locator transmitter (ELT) within a single deployable unit. Unfortunately, I was not aware of this technology when we devised the 1999 recommendations. But if something good must be found in the FAA’s delay in implementing these recommendations, it must be that now, it is not too late to make them better.
“The deployable recorder unit combines both the FDR and CVR into this compact unit, weighing approximately 4 pounds and its aerodynamic design allows it to fly away from the aircraft and land outside the impact zone. The recorder’s design also allows it to float indefinitely on water, greatly improving our ability to quickly recover the data following an over water crash.
“The emergency locator beacon equipped within the unit replaces the need for the highly unreliable underwater locator beacons (ULBs), which have a history of malfunctioning or disconnecting from the recorders and only work in incidences of water crashes. The deployable ELT sends immediate satellite notification to identify the accident site and recorder location both on land and in water to aid search, rescue and recovery operations. This component is highly attractive as we experience an increase in polar and over water routes.
“While fixed recorders certainly have their place in aviation investigations, it is hard to overlook the reality that they do go down with the plane, which often results in timely and costly recovery efforts both on land and in water.” >> Hall, e-mail [email protected]; for more on ejectable recorders, see DRS Technology’s deployable flight incident recorder set at http://www.drs.com/products/index.cfm?gID=5&productID=352 <<
No Decision To Expedite Solutions
DOT/IG findings on the runway incursion problem (extracts):
On average, in FY 2002, at least one commercial aircraft was involved in a serious runway incursion or operational error once every 10 days.
FAA’s runway safety program director still has no authority to ensure initiatives undertaken by various FAA lines of business are completed on schedule. As we have been reporting since 1998, many initiatives to reduce runway incursions have not been completed on schedule.
AMASS [airport movement area safety system] will not prevent runway incursions in all situations and does not directly alert pilots of potential collisions; therefore, other technological solutions are still needed.
FAA and the aviation industry have not made a decision to expedite technologies, such as in-cockpit surface moving map displays, that may have significant potential for reducing runway incursions caused by pilots. According to FAA officials, efforts to expedite these technologies have been slowed due to the economic slowdown of the airline industry, which became more pronounced after September 11th. FAA officials stated that because major investments in security are being made while revenue is down, most airlines have no budget for new avionics. In an effort to expedite moving map technology, FAA is working with the aviation industry in developing a portable surface moving map display that can be used with an electronic flight bag.
Recommendations:
- Advance low-cost technologies to high-risk airports.
- Expedite technologies … to aid pilots in reducing runway incursions.
- Improve program accountability.”
Source: DOT/IG, Operational Errors and Runway Incursions: Progress Made, But the Number of Incidents is Still High and Presents Serious Safety Risks,” Report No. AV-2003- 040, dtd April 3, 2003