EASA Task Force Report on #GermanWings 9525 - A tale of missed opportunities and Accidents "Waiting...To Happen!"

The European Aviation Safety Agency (EASA) was tasked by the European Commissioner to establish a Task Force to look into the accident of #GermanWings flight 9525 including the findings of the French Civil Aviation Safety Investigation Authority (BEA) preliminary investigation report.

Chaired by EASA Executive Director, the Task Force consisted of 14 senior representatives from airlines, flight crew associations, medical advisors and authorities. Additional contributions were provided by invited experts and representative bodies. Three formal Task Force meetings took place from May to July 2015.

As a result of its work, the Task Force delivered a set of 6 recommendations to the European Commission on 16 July 2015, as follows:

• Recommendation 1: The Task Force recommends that the 2-persons-in-the-cockpit recommendation is maintained. Its benefits should be evaluated after one year. Operators should introduce appropriate supplemental measures including training for crew to ensure any associated risks are mitigated.
• Recommendation 2: The Task Force recommends that all airline pilots should undergo psychological evaluation as part of training or before entering service. The airline shall verify that a satisfactory evaluation has been carried out. The psychological part of the initial and recurrent aeromedical assessment and the related training for aero-medical examiners should be strengthened. EASA will prepare guidance material for this purpose.
• Recommendation 3: The Task Force recommends to mandate drugs and alcohol testing as part of a random programme of testing by the operator and at least in the following cases: initial Class 1 medical assessment or when employed by an airline, post-incident/accident, with due cause, and as part of follow-up after a positive test result.
• Recommendation 4: The Task Force recommends the establishment of robust oversight programme over the performance of aero-medical examiners including the practical application of their knowledge. In addition, national authorities should strengthen the psychological and communication aspects of aero-medical examiners training and practice. Networks of aero-medical examiners should be created to foster peer support.
• Recommendation 5: The Task Force recommends that national regulations ensure that an appropriate balance is found between patient confidentiality and the protection of public safety. The Task Force recommends the creation of a European aeromedical data repository as a first step to facilitate the sharing of aeromedical information and tackle the issue of pilot non-declaration. EASA will lead the project to deliver the necessary software tool.
• Recommendation 6: The Task Force recommends the implementation of pilot support and reporting systems, linked to the employer Safety Management System within the framework of a non-punitive work environment and without compromising Just Culture principles. Requirements should be adapted to different organisation sizes and maturity levels, and provide provisions that take into account the range of work arrangements and contract types.

Following the 11 September 2001 attacks, several measures were introduced to mitigate the risk of unwanted persons entering the cockpit. Secure cockpit door locking was rapidly mandated, and rules were subsequently fine-tuned to address the risks in the areas of rapid aircraft depressurisation, double pilot incapacitation, post-crash cockpit access, and door system failure including manual lock use.

The focus for all the measures that were introduced was put on the threat from outside of the cockpit. A potential threat from inside the cockpit was not fully considered in either the initial phase or the period that followed, when the regulations were fine-tuned.

As I have also pointed out in my earlier blog posts in this blog, the risk mitigation measure introduced to mitigate the risk of unlawful interference (Secured Cockpit Door) has actually facilitated the very event it was meant to prevent! There have been many cases, even before #GermanWings 9525, where the secure cockpit door was locked from inside by a rouge pilot, preventing the other pilot from entering, while he proceeded to unlawfully interfere with the flight by hijacking or crashing it. The risk mitigation measure had been introduced and implemented in a hurry, without a full assessment of Residual Risks or Additional Risks created by its implementation.

This was a mandate that the EASA task force was charged with. Here was an opportunity to carry out a professional risk assessment and properly evaluate all the additional/residual risks and develop a system to mitigate them as well. Here was an opportunity to reform the cockpit door technology and to improve the procedures surrounding its use. Here was an opportunity to, maybe, introduce new technology; develop new policies and/or new procedures.

Unfortunately, the task force has missed the bus! They have chosen to limit themselves to the “2-persons-in-the-cockpit recommendation”, instead of being more creative and developing further on this base to introduce more security measures in addition to merely two-persons-in-the-cockpit. The technology today has advanced considerably since the days of 2001 and many additional and secure measures are today possible beyond the mere four digit numeric code to lock or open a door. These additional measures, like biometrics etc., are not only readily available but are competitively priced and readily implementable.

I was reminded by my colleague, Carlo Cacciabue, of Professor James Reason’s ground breaking research and work on Safety Management Systems. He used to say, mistakes by humans, be they errors or violations, are like mosquitoes. You can try to swap them individually, but they will keep coming back. The only way to save ourselves from being bitten is to drain the swamps where these mosquitoes breed. All human performance happens inside an organizations policies and procedures. Erroneous or insufficient policies/procedures are the swamps where these mosquitoes called errors and violations breed. Unless we develop organizations measures to prevent breeding of these mosquitoes, we will never be able to prevent another event like #GermanWings 9525!

It is very unfortunate that the EASA Task Force has failed to deliver any meaningful recommendation. One did not need a task force to arrive at the very basic and on-the-surface kind of recommendations that have emerged here. We all knew this within days of the accident. What one expected from a task force of this level was a more professional risk assessment and recommendations in tune with the complexity of the problem. The task force needed to go into the depth of this problem and emerge with recommendations with far reaching impact on safety of civil aviation. It needed to develop organizational policies and procedures for dealing with distressed employees and those that need help, in addition to a complete relook and revamp of how we secure our cockpits.

Once again, it has been forgotten that at the end of the day, pilots are as human as rest of us and susceptible to as many human problems and issues as the rest of us. Any human can be regulated only to a certain extent. There is a limit to the amount of stress and regulation that can be piled onto a specific job role. The Pilots are the goal keepers of the Aviation industry…and a goal keeper can only save so much if rest of the team does not support the aim of winning the match!

An opportunity has been missed, and yet another accident, similar to #GermanWings remains waiting…“Waiting…To Happen!”.

Stay Safe,

The Erring Human.

#Germanwings 9525: Preliminary report and way ahead

The investigation team, under the lead of French BEA, has published a preliminary report on the accident to #Germanwings flight 9525 and the full report can be access here: http://www.bea.aero/docspa/2015/d-px150324.en/pdf/d-px150324.en.pdf

While the report does not tell us too much more than what has already been made public in the press, it does clarify some important technical doubts that have been voiced in various social media as well as my earlier posts.

On the issue of “Human Breathing”, the report states as follows, Quote “A sound of breathing is recorded both on the co-pilot track and on that of the Captain throughout the accident flight. This breathing, though present on both tracks, corresponds to one person’s breathing. It can be heard several times while the Captain was talking (he was not making any breathing sound then) and is no longer heard when the co-pilot was eating (which requires moving the microphone away or removing the headset). The sound of this breathing was therefore attributed to the co-pilot.” Unquote.

It is very interesting to note that even the Captains microphone recorded only the Co-pilots breathing, while not recording Captains breathing or even that of the flight attendant who was present in the cockpit for a short period of time. As I had mentioned in an earlier post on this blog, if any sound of breathing is recorded in a CVR tape, it cannot be normal breathing. This statement is now corroborated by the fact that even the Captains mic, that was very close to his face, recorded only the Co-pilots breathing and not of the Captain. We have evidence here that the Co-pilot was certainly not breathing normally, and not just when the Captain was absent from the cockpit! The co-pilot was clearly in distress on that fateful day and it is surprising that this very audible sign was missed by all around him. There is certainly a need here to probe deeper into this aspect of evidence and if the crew underwent any nature of pre-flight medical evaluation on that day or, if this heavy and abnormal breathing was also noticed by any of the ground crew (eg. Flight Despatchers) who interacted with the Pilots prior to departure and while on ground in Barcelona. It will also be significant here to understand if there was any change in the rate, volume or frequency of this breathing sound, especially at the time when Captain left the cockpit.

Another very significant detail in this report is the revelation of what transpired during the onward flight to Barcelona. The Captain apparently left the cockpit at 07:20 hrs. The aircraft then received instructions to descend from its cruise altitude of 37,000 ft to initially 35,000 ft and later to 25,000 ft. and the co-pilot descended the aircraft according to these instructions, stabilizing correctly at 25,000 ft. So far nothing is unusual. What is surprising here is the manner in which this descent was carried out by the Co-pilot. Instead of making a selection to 35,000 ft and later changing that to 25,000 ft, he appears to have been “playing around” with the auto-pilot controls. As the graph below depicts, he made multiple, seemingly random changes, varying from the minimum possible selection of 100 ft to the maximum possible selection of 49,000 ft! This behaviour is highly unusual and needs some evaluation. The press is going viral calling it a practice of what was to follow or even an aborted attempt to intentionally crash the aircraft. However, to my mind, this might represent something very significantly different. To me, this represents the behaviour of someone experiencing psychomotor problems…essentially, a lack of coordination between mind, eyes and hands! He seems to be hunting for the correct selection and unable to reach one. It could also represent a casual attitude or lack of seriousness, even indecisiveness. All of these could, in turn, be related to the reported psychological distress caused either because of mental depression or maybe, a more serious and undiagnosed state of Schizophrenia.

While the aircraft was correctly descended according to ATC instructions and stabilized at the requested level, the manner of achieving this was irregular and reflective of state of mind of the pilot. A deeper psychiatric evaluation is certainly necessary here and I hope BEA is investing sufficiently into such nature of professional evaluation.

A similar behaviour is also noted in the minutes leading to the crash. The report states,

“At 9 h 33 min 12 (point 5), the speed management changed from “managed” mode to “selected” mode. A second later, the selected target speed became 308 kt while the aeroplane’s speed was 273 kt. The aeroplane’s speed started to increase along with the aeroplane’s descent rate, which subsequently varied between 1,700 ft/min and 5,000 ft/min, then was on average about 3,500 ft/min.

At 9 h 33 min 35, the selected speed decreased to 288 kt. Then, over the following 13 seconds, the value of this target speed changed six times until it reached 302 kt.”

Once again, we see evidence of “playing around” with speed selections…either unable to make a selection or undecided on what selection to make, or maybe just playing with the selector knob like a fidgety child.

Another significant aspect highlighted in the report occurred just after the Captain left the cockpit. The event is documented as follows:

• At 9 h 30 min 24 (point 3), noises of the opening then, three seconds later, the closing of the cockpit door were recorded. The Captain was then out of the cockpit.
• At 9 h 30 min 53 (point 4), the selected altitude on the FCU changed in one second from 38,000 ft to 100 ft. One second later, the autopilot changed to “OPEN DES”  mode and autothrust changed to “THR IDLE” mode. The aeroplane started to descend and both engines’ rpm decreased.
• At 9 h 31 min 37, noises of a pilot’s seat movements were recorded.
• At 9 h 33 min 12 (point 5), the speed management changed from “managed” mode to “selected” mode. A second later, the selected target speed became 308 kt while the aeroplane’s speed was 273 kt. The aeroplane’s speed started to increase along with the aeroplane’s descent rate, which subsequently varied between 1,700 ft/min and 5,000 ft/min, then was on average about 3,500 ft/min.”

The Co-pilot was seated and settled in his seat. He had been flying for some time. So, why at this point should there be any need to move/adjust his seat? Did he at this point move from his seat to the Captains seat? Did he have a reason to leave his seat? It will be significant to note if there were any changes in his breathing pattern at this stage because then there is another item in the report that causes concern. The report documents, “low amplitude inputs on the co-pilot’s sidestick were recorded between 9 h 39 min 33 and 9 h 40 min 07” and then again, “An input on the right sidestick was recorded for about 30 seconds on the FDR 1 min 33 s before the impact, not enough to disengage the autopilot.” Both these texts refer to the same event, although they appear in different sections of the report.

Was this a last minute attempt by a man struggling to regain control of his own body to recover and save the situation?

Yet another significant aspect of this report relates to the cockpit door access alarm. “At 9 h 34 min 31 (point 7), the buzzer to request access to the cockpit was recorded for one second.” Further,

• the cockpit call signal from the cabin, known as the cabin call, from the cabin interphone, was recorded on four occasions between 9 h 35 min 04 and 9 h 39 min 27 for about three seconds;
• noises similar to a person knocking on the cockpit door were recorded on six occasions between 9 h 35 min 32 (point 9) and 9 h 39 min 02;
• muffled voices were heard several times between 9 h 37 min 11 and 9 h 40 min 48, and at 9 h 37 min 13 a muffled voice asks for the door to be opened;
• noises similar to violent blows on the cockpit door were recorded on five occasions between 9 h 39 min 30 and 9 h 40 min 28;
• low amplitude inputs on the co-pilot’s sidestick were recorded between 9 h 39 min 33 and 9 h 40 min 07;

In the description of the door locking system fitted in the accident aircraft, it states that, “…To request access to the cockpit from the passenger compartment, the normal one-digit access code followed by ‘‘#’’ must be entered on the keypad. A one-second acoustic signal from the buzzer sounds in the cockpit to warn the crew that someone wishes to enter…The flight crew then moves the three-position switch:

• If they pull and maintain the switch in the UNLOCK position, the door unlocks. The acoustic signal stops. The green LED lights up continuously on the keypad to indicate the door has been unlocked. The door must then be pushed in order to open it. A magnet in the cockpit is used to keep the door in the open position.
• If the flight crew moves the switch to the LOCK position, the door is kept locked. The acoustic signal stops. The red LED lights up continuously on the keypad to indicate locking is voluntary. Any interaction with the keypad is then disabled for 5 minutes (until the extinction of the red LED). At any time, the crew in the cockpit may cancel this locking by placing the switch in the UNLOCK position. The door then immediately unlocks.
• In the absence of any input on the switch, the door remains locked. No LEDs light up on the keypad. The acoustic signal stops after one second.”

It is significant that after just one access request at 09:34, no further request is recorded on the door lock. It is reasonable to assume at this point that the selector switch inside the cockpit was put in “Locked” position, thereby disabling the keypad for 5 minutes. However, did the Captain not know about this 5 minute interval? Why did he not make yet another attempt 5 minutes later, at about 09:39 to use his emergency access code?

As highlighted in my earlier blogposts also, human error is not a disease. It is a symptom of the disease called “Poor Organizational Management”. Several flaws in Germanwings and Lufthansa management have been highlighted by this accident and it is those shortfalls in management that created the setting in which the accident scenario could be played out. Lufthansa has much to learn from this accident about management of human resources and about preventing humans from erring. As for Germanwings, if they thought safety was expensive, they have now had a taste of an accident. The writing is already on the wall…investors have already decided to liquidate the Germanwings brand and merge the assets with Europewings. This is not the first time an airline has had to be liquidated because of an accident, and unless the managements learn very quickly about managing humans like humans and not objects, I fear that this will not be the last time also!

Stay Safe,

The Erring Human.

Life After #Germanwings 4U9525: Lessons in Risk Management

A memorial service was held on Friday, at Cologne Cathedral, for the 150 people who died an untimely death when #Germanwings 9525 crashed. The comment by one of the mourners set my mind racing on a tangent.

A relative of one of the victims remarked, “To know that this was a murder and not an accident, makes our grief even more. The question that now comes to my mind is WHY?” It was further reported that parents of 27 year old Late Mr. Andreas Lubitz, who appears to have to deliberately locked the captain out of the cockpit and taken control of the plane so that he could crash it, had been invited to the service but did not come. The couple have not spoken publicly since the crash and are trying to mourn the loss of their son in dignified isolation and silence, no doubt tormented by the events.

These two news items highlight everything that the French investigators are to blame for in their extremely unprofessional conduct of making public statements before all the facts were collected, all the evidence analysed and even before any nature of professional investigation had gotten underway! While loss of a loved one in an accident has an element of grief, but one can accept such event as fate. However, when it is told that it was not an accident, but a murder, the grief takes-on a very different connotation, and not just for the victims’ families! This is the reason why it is all the more important to deal with these matters very sensitively, confidentially and methodically. All available evidence needs to be collected, analysed scientifically with latest techniques of forensic science. The possibilities that emerge then need to be tested through simulations to close the gaps and evaluate the alternate scenarios. Only then can the investigators arrive at the most likely event scenario. In all this, it is very important to remember the basic principles of any investigation, as well as natural justice: Evidence must be weighed, not counted; and every individual is innocent unless proved guilty.

The French investigators have violated both these basics of accident investigation. Weight of evidence of “human breathing” heard in the CVR tapes is far heavier than weight of evidence of manual input to controls. In a normal CVR recording, it is not possible to hear a pilot breathing and if this sound can be heard, it is a clear indication that the individual was not in normal state of health…clearly breathing hard and heavy…like in a “Panic Attack”, for instance! There have been further statements in the press, attributed to the French Prosecutor, that report him stating, “Pilot tried to break the door using an Axe”! I hope that he has been misquoted on this one, because anyone who has ever flown in a commercial airliner in recent years would know that there are no Axe’s available inside a commercial airliner today! Even if we assume that one was available, how can this conclusion be reached merely from hearing sounds recorded in a CVR tape?

Clearly, public statements have been made here without properly analysing and processing the available evidence. This projects the BEA and the French Prosecutor in very poor light, because they have through this action caused immeasurable and unnecessary avoidable pain to over 150 families!

That being said, one cannot escape the fact that at the centre of this controversy is the armed cockpit door. I had stated, in one of my earlier posts in this blog that in today’s world there are rarely any new accidents. Almost every Accident has happened before, and for the same reasons.

The case in point is Ethiopian Airlines Boeing 767-300 that was en route from Addis Ababa to Rome operating as Flight ET702 on Feb. 14, 2014. At one point during cruise, the captain left the cockpit to use the lavatory. The first officer did not allow him back inside and hijacked the aircraft. At this point he could have done anything with the airliner. He could have crashed the 767 into a crowded square in London, Paris or Berlin. Instead, he decided to fly wide circles over Geneva and finally land there to request political asylum. No injuries. The world forgot. The debate on cockpit security procedures should have happened then. However, there was no blood, so no one thought it important to take any further action. The safety process loop was not fed…

Cockpit doors were provided with armed security after 9/11 incidents. This was a mitigation measure to reduce the risk of a hijack to ALARP…the yellow or the green region in the inverted triangle above. However, this mitigation measure did create an additional risk…that of keeping the good guys out as well! While the American regulator developed a further mitigation by regulating that two crewmembers must always be present in the cockpit, the European regulators did not do so…and this was not updated even after the February 2014 incident that highlighted the need for a further mitigation strategy here. Therefore, while one can go to eternity blaming a suicidal pilot, the fact remains that a regulatory lapse allowed this to happen. A regulatory lapse that was not corrected even when highlighted by another similar event over one year ago. The essential continued to remain invisible!

The job of safety risk management needs to happen at the base of this iceberg…in the region of 1000-4000 latent conditions that exist for every 1-5 fatal accidents. The latent condition was highlighted through the event of February 2014 and missed, causing the conditions to remain favourable for the Germanwings accident to occur! In the game of safety risk management, there are no runners-ups. Either we win or we lose. Yes, Flight 9525 ended in tragedy and ET702 did not. They are vastly different in public perception and attention, but in both cases one of the pilots managed to take control of the aircraft because a decade earlier, secure cockpit doors were introduced that cannot be opened against the will of the person left in the cockpit. This is why it is so important to design a system properly and professionally as per the flow chart below.

This is the one discussion the industry and regulators should have had more than a year ago, or after the Nov. 13, 2013, crash of a Lineas Aereas de Mocambique Embraer 190 that was in all likelihood caused by the captain committing suicide: 33 people died. That the debate did not happen back then is cynical, but now that it is taking place the danger is that wrong conclusions will be drawn.

Some press reports are debating if the secure cockpit doors should be relinquished. This, in my opinion, is nonsense. There are still valid reasons for the cockpit to be a protected space; the threat from terrorists trying to use aircraft as weapons does not seem to have decreased over the past decade.

It took European regulators mere three days to decide that a minimum of two people have to be in the cockpit at all times, effective immediately, with no serious discussion. While there are no obvious drawbacks to the new occupancy rule, its advantages are even less obvious than at first sight. Would a flight attendant really stop a pilot committed to intentionally crashing an aircraft? Probably not. Could a committed flight attendant with access to knives in the galley be a potential safety threat to the pilot left in the cockpit? I believe that yes, this is possible.

The moves are clearly based on rushed judgments made under enormous public pressure. It would have been much better to slowdown, evaluate, debate and then decide professionally in a cool headed manner when emotions are no longer the guiding factor!

The most important thing this industry needs to look at is whether cockpits should continue to be so secure that they cannot be entered even under reasonable circumstances. Right now, the pilot remaining in the cockpit can prevent door from opening even when the emergency code is entered on the keypad outside, the idea being that a hijacker might force a flight attendant to reveal the code to gain access. When secure doors were introduced after the 9/11 terrorist attacks, the possibility of a rouge, or disabled, pilot in the cockpit was not considered. It was taken for granted that pilots would never do something like that, or suffer from any affliction preventing him from opening the door. Today we know that the assumption was wrong.

There is also a reason to doubt if the Captain indeed knew the emergency access code. For this, it is important to look at the pre-flight briefing procedures, and the culture, at Germanwings to understand how seriously this matter was being dealt on a day-to-day basis. At this time, there seems to be no evidence that the Captain indeed tried to seek entry using his emergency access code, and more importantly, there is also no evidence that the Co-pilot prevented him from entering!

However, one still needs to put things into perspective. There have been a handful of events that can be linked to pilots intentionally crashing aircraft. However, in the broader debate about how we perceive and accommodate mental health issues, in particular depression, in the workplace,  The DSM-IV criteria say that a Major Depressive Disorder or Depressive Episode may be present where a patient exhibits a majority of these symptoms every day:

• Depressed mood or irritable most of the day, nearly every day, as indicated by either subjective report (e.g., feels sad or empty) or observation made by others (e.g., appears tearful).
• Decreased interest or pleasure in most activities, most of each day
• Significant weight change (5%) or change in appetite
• Change in sleep: Insomnia or hypersomnia
• Change in activity: Psychomotor agitation or retardation
• Fatigue or loss of energy
• Guilt/worthlessness: Feelings of worthlessness or excessive or inappropriate guilt
• Concentration: diminished ability to think or concentrate, or more indecisiveness
• Suicidality: Thoughts of death or suicide, or has suicide plan

We see here that “suicidality” is only one symptom of a severe depressive condition and indeed, may be the least common. It is notable that the condition is not typically marked by signs of outwardly turned hostility or violence. Indeed, depression is more an emotional implosion than explosion.

In the noise erupting around Germanwings, we must remember two simple facts: depression does not normally lead to suicide and suicide almost never leads to murder.

Therefore, in this emotionally charged debate on how to keep suicidal pilots out of our cockpits, it is important to note that we do not yet have all the facts. A known devil, it is said, is better than an unknown God! Any decision taken in the heat of this emotionally charged environment without proper and complete scientific process will have consequences in the future. It is not enough to do something…it is important to do the RIGHT thing. The right thing here is to wait for the complete evidence to be available. For it to be scientifically processed and weighed. For the residual or new risks generated out of every proposed mitigation measure to be analysed too, and properly mitigated. Only then will we be in a position to take a correct decision that will prove its worth over a long period of time.

Stay Safe,

The Erring Human.