PILOT ERROR AND ACCIDENT CASE STUDIES-Vikash K Thakur Pilot error (sometimes called cockpit error) is a term used to describe the cause of an accident involving an airworthy aircraft where the pilot is considered to be principally or partially responsible. Pilot error can be defined as a mistake, oversight, lapse in judgment, or failure to exercise due diligence by an aircraft operator during the performance of his/her duties. Usually in an accident deemed due to "pilot error", the pilot in command (Captain) made the error unintentionally. However, an intentional disregard for a standard operating procedure (or warning) is still considered pilot error, even if the pilot's actions justified criminal charges. An aircraft operator (airline or aircraft owner) is generally not held accountable for an incident that is principally due to a mechanical failure of the aircraft unless the mechanical failure occurred as a result of pilot error. The pilot may be declared to be in error even during adverse weather conditions if the investigating body deems that the pilot did not exercise due diligence. The responsibility for the accident in such a case would depend upon whether the pilot could reasonably know of the danger and whether he or she took reasonable steps to avoid the weather problem. Flying into a hurricane (for other than legitimate research purposes) would be considered pilot error; flying into a microburst would not be considered pilot error if it was not detectable by the pilot, or in the time before this hazard was understood. Some weather phenomena (such as clear-air turbulence or mountain waves) are difficult to avoid, especially if the aircraft involved is the first aircraft to encounter the phenomenon in a certain area at a certain time. One of the most famous incidents of an aircraft disaster attributed to pilot error was the crash of Eastern Air Lines Flight 401 near Miami, Florida on December 29, 1972. The pilot, co-pilot, and Flight Engineer had become fixated on a faulty landing gear light and had failed to realize that the autopilot buttons had been bumped by one of the crew altering the settings from level flight to a slow descent. The distracted flight crew did not notice the plane losing height and the aircraft eventually struck the ground in the Everglades, killing 101 out of 176 passengers and crew. The subsequent National Transportation Safety Board (NTSB) report on

the incident blamed the flight crew for failing to monitor the aircraft's instruments properly. Details of the incident are now frequently used as a case study in training exercises by aircrews and air traffic controllers. Placing pilot error as a cause of an aviation accident is often controversial. For example, the NTSB ruled that the crash of American Airlines Flight 587 was due to the failure of the rudder which was caused by "unnecessary and excessive rudder pedal inputs" on the part of the co-pilot who was operating the aircraft at the time. Attorneys for the co-pilot, who was killed in the crash, argue that American Airlines' pilots had never been properly trained concerning extreme rudder inputs. The attorneys also claimed that the rudder failure was actually caused by a flaw in the design of the Airbus A300 aircraft and that the co-pilot's rudder inputs should not have caused the catastrophic rudder failure that led to the accident that killed 265 people. During 2004 in the United States, pilot error was listed as the primary cause of 78.6% of fatal general aviation accidents, and as the primary cause of 75.5% of general aviation accidents overall. For scheduled air transport, pilot error typically accounts for just over half of worldwide accidents with a known cause.

Human Error To understand the problem of aviation judgment it is helpful to look at human error and the human information processing system. Our awareness of the 'human error problem' in aviation began when cockpit voice recordings of pilot communications prior to fatal accidents revealed the enormous factor played by human error in accidents. The result was a very large proportion of accidents that were listed as 'pilot error'. Pilots have long been dismayed by the use of this term to describe their failures because it sounds as if the pilot was negligent in someway. In most circumstances that have resulted in pilot error accidents, the pilots involved were putting forth their best efforts to fly safely. to say that an accident was caused by pilot error and go no further is no better than saying that a mechanical failure accident was caused by the airplane. In both cases we are obligated to look further into the reasons for the pilot or mechanical failure that led to the accident. Obviously, mechanical failures are easier to trace because there is usually an abundance of physical evidence to show the way. The reasons for pilot failures are more difficult to discover but they usually can be found as

well, if one is willing to use psychological and sociological expertise and probe into the behaviour and thought patterns of crew involved.

Pilot Error Definition Human error may be defined as, 'any human activity that fails to accomplish the intended outcome'. In continuous controlled flying we are always comparing intended or desired outcome with actual outcome. As these the actual outcome departs from intended outcome, we notice it, make a decision, and act by moving the controls to bring the two closer together. I fact, straight and level flight can be defined as a series of error correction maneuvers. To err is human, to correct errors is what flying is about. Why is it so much easier for pilots to accept that they make these types of control errors and so hard to accept judgmental errors? Pilots, who don't want to admit to any weaknesses, sometime define pilot error in curious ways.

What types of errors do pilots make? Paul M. Fitts, a pioneer in aviation factors, together with Jones, saw that many aircraft accidents in the US military were being caused by pilot and sought answers to determine why. Believing that at least a part of the reason for the pilot error accidents was in the design and location of the cockpit instruments and controls, he surveyed pilots asking them what types of errors they had made or observed other pilots make during their experience as aviators, In all, pilots reported 270 different types of instrument reading errors and 460 different types of control errors. Control errors were classified as follows: Substitution errors: Confusing one control with another (for example, Confusing flap and gear controls). Adjustment errors: Operating a control too rapidly or too slowly, moving a switch to the wrong position, or following a wrong sequence in operating several controls (for example, turning fuel selector to wrong tank). Forgetting errors: Failing to check, unlock, or use a control at the proper time (for example, taking off without flaps to take off position). Reversal errors: Moving a control in a direction opposite to that

necessary to produce the desired results (for example, moving trim control in the wrong direction). Unintentional activation: Inadvertently operating a control without being aware of it.

Instrument reading errors were classified as follows: Misreading errors: Multi-indicator instruments (for example Misreading 3 pointer altimeter by more than 1000 ft) Reversal errors: Reversing the interpretation of an instrument indication (for example Misinterpretation of gyro compass) Signal interpretation errors: Misinterpretation of message conveyed by sound or light warning (for example Interpretation of stall warning as landing configuration warning) Legibility errors: Errors resulting from difficulty in seeing the numbers or scales distinctly Substitution errors: Mistaking one instrument for another (for example Confusing Manifold pressure and Tachometer) Using an inst. That is inoperative unknowingly accepting as valid the indication of inst. that is not reliable. Scale interpretation error: Errors that result from difficulty in interpolating between number gradations of scale. Errors due to illusions: Misconception due to conflict between body sensations and inst. indication and errors due to visual illusions in poor weather. Forgetting errors: Failing to check inst. prior to TAKE OFF or during flight.

These two classes of pilot errors, identified by Fitts and Jones were enormously important to the refinement of the cockpit inst. panel. One of the result of the study was the basic "T" arrangement of flight inst. as shown below that has been the cornerstone of standardization in the cockpit since

the late 1940's.The focal point of the arrangement is the attitude indicator which is the inst. on which pilots spend most of their visual attention time. The other three inst. serve as conformation sources of information and take on more or less importance depending on the maneuver being performed.

Airspeed Indicator Altimeter

Attitude indicator

Direction indicator

A second development to come out of the two classes of pilot errors published by Fitts and Jones was a host of human factors research studies to determine how to design inst. and controls for pilots, in particular, but also for people in general who are controlling machines. It is important in human machine interface design to take advantage of learn stereotypic behavior to minimize the amount of training necessary. For example we learn through our development years that when we see something deviate from where it should be, we move it back in the opposite direction. Naturally, then when people get to cockpit of an airplane and see a symbol deviating from center, the natural response is to move the controls in the opposite direction to bring it back. This is known as 'Control Display Compatibility' and is one of the basic tenets of display and control design in field of human factors.

Human Performance and Limitations All flight crew who have studied for PPL or ATPL should already be reasonably familiar with the theory of Human Performance and Limitations (HPL) and, in particular the basic aviation psychology, applicable to flying. CRM requires a reasonable understanding of such concepts as human information processing, attention and vigilance, decision making, communication, arousal and stress, and personality

differences. It is important to appreciate that all humans have both physical and cognitive limitations, and to understand something about the nature of those limitations with respect to themselves and also to other crew members when flying in a multi-crew situation. Basic Theory ICAO has, in many of its publications, based its descriptions of human factor around a model known as the SHELL model. S = Software (procedures, Ops manual, etc.), H = Hardware (Cockpit layout, aircraft design, etc.); E = Environment (weather, day/night, unfamiliar aerodrome, busy TMA, etc.); L = Liveware (the person or people). Human Performance and Limitations is sometimes used as a term to describe all human factors issues (i.e. all the elements of the SHELL model), and at other times, to describe only those human factors aspects directly relating to the performance of individuals (i.e. only the "liveware" element of the SHELL model). There are various taxonomies which exist, listing the elements which are considered to be human performance and limitations, although it should be said that these are generally derived from those taxonomies used for military pilots and tend to favour the physiological aspects of performance. What is important is not to worry too much about which 'categories' the various aspects of human factors come under but, rather, to ensure that CRM training covers all those areas which are relevant, and to the appropriate level of detail. ICAO Human Performance Training Curriculum for Pilots The following text has been taken from the ICAO Human Factors Training Manual, Doc 9683 (1998). Module 1: Introduction to Human Factors in Aviation In this module, the rationale for Human Factors training should be explained. A good point of departure is the fact that since 1940, three out of four accidents

have had at least one contributory factor relating to human performance. The introduction has to be carefully prepared in order to capture the pilots interest. It is desirable that training directed at meeting any examination or test requirement associated with the revised Annex 1 be kept relevant to operational aspects of flight. A practical orientation is therefore essential to effective training. The relevance of the programme must be made quite clear to pilots this is not intended as an academic exercise. Therefore, only that information which relates to pilot performance should be included. Training personnel should present the information according to their particular operational needs and may wish to take specific aspects of their local accident/incident experience into account. The SHELL model might be usefully introduced in this module as one of the possible aids to understanding the interactions between the different components of the system, as well as the potential for conflict and error arising from the various mismatches which can occur in practice. The SHELL concept (the name being derived from the initial letters of its components, Software, Hardware, Environment, Liveware) was first developed by Edwards in 1972, with a modified diagram to illustrate the model developed by Hawkins in 1975. For those familiar with the long-established concept ofman-machineenvironment (now referred to ashuman-machine-environment), the following interpretations are suggested: liveware (human), hardware (machine) and software (procedures, symbology, etc.), environment (the situation in which the L-H-S system must function). This building block diagram does not cover the interfaces which are outside Human Factors (hardware-hardware; hardware-environment; softwarehardware) and is only intended as a basic aid to understanding Human Factors. Module 2: The Human Element (Aviation Physiology) Breathing; recognizing and coping with: hypoxia

hyperventilation Pressure effects; effects on ears, sinuses and closed cavities of: trapped or evolved gases decompression underwater diving Limitations of the senses visual aural vestibular proprioceptive tactile Acceleration effects; positive and negativeGs aggravating conditions Disorientation visual illusions vestibular illusions coping mechanisms Fatigue/alertness acute chronic the effects on skill and performance Sleep disturbances and deficits Circadian dysrhythmia/ jet lag Personal health Effects of: diet/nutrition alcohol drugs (including nicotine/caffeine) medications (prescribed; over-the-counter) blood donations aging Psychological fitness/stress management Pregnancy Module 3: The Human Element (Aviation Psychology) Human errors and reliability Workload (attention and information processing) perceptual cognitive Information processing mind set and habit patterns attention and vigilance perceptual limitations memory Attitudinal factors personality

motivation boredom and complacency culture Perceptual and situational awareness Judgement and decision-making Stress symptoms and effects coping mechanisms Skills/experience/currency vs. proficiency Module 4: Liveware-Hardware: Pilot-equipment Relationship Controls and displays design (movement, size, scales, colour, illumination, etc.) common errors in interpretation and control glass cockpits; information selection habit patterns interference/design standardisation Alerting and warning systems appropriate selection and set-up false indications distractions and response Personal comfort temperature, illumination, etc. adjustment of seat position and controls Cockpit visibility and eye-reference position Motor workload Module 5: Liveware-Software: Pilot-software Relationship Standard operating procedures rationale benefits derivation from human limitations and the accident/incident record Written materials/software errors in the interpretation and use of maps/charts design principles and correct use of checklists and manuals The four 'P's (philosophies, policies, procedures, practices) Operational aspects of automation overload/underload and phase of flight; complacency and boredom staying in the loop/situational awareness automated in-flight equipment; appropriate use, effective task allocation, maintenance of basic flying skills Module 6: Liveware-Liveware: Interpersonal Relations NOTE: Liveware-Liveware deals with interpersonal contacts happening at the present time (here and now), as opposed to the interpersonal contacts involving people outside

of the current operating situation (the latter are considered in Module 7). Factors influencing verbal and non-verbal communication between and with: flight deck crew cabin crew maintenance personnel company management/flight operations control air traffic services passengers How verbal and non-verbal communication affects information transfer and thus safety and efficiency of flight Crew problem solving and decision-making Introduction to small group dynamics/crew management (see also ICAO Circular 217 for further information on this topic). Module 7: Liveware-Environment: The Operating Environment A systemic view of safety The aviation system: components General models of organisational safety Organisations structures and safety Culture and safety Procedures and safety Safe and unsafe organisations

Human Error, Reliability and Error ManagementThe science of Human Factors accepts the fact that human error is inevitable - what is important is to ensure that human error does not result in adverse events such as air accidents. This can be addressed in two ways: reducing errors in the first place, and controlling errors such that they, or their immediate effects, are detected early enough to allow remedial action. CRM addresses both types of mitigating strategies, but concentrates particularly on error detection, especially in the multi-crew situation. Human reliability is the science which looks at the vulnerability of human beings to make errors (or less than perfect performance) under different

circumstances. One could argue that it is more of an art than a science, since it is very difficult to predict, in quantifiable terms, human reliability in different situations, and from individual to individual. However, there are certain conditions under which humans are more likely to make errors (e.g. during circadian lows, when stressed, when overloaded, etc.), but these will be covered in other Appendices rather than under "human reliability" as such. If readers wish to find further information on the science of human reliability, a few references are included at the end of this Appendix.

The following text, which draws heavily from Professor James Reason's book "Human Error", explains some of the basic theory of human error.

Basic TheoryIntroduction to Human Error It has long been acknowledged that human performance is at times imperfect. Nearly two thousand years ago, the Roman philosopher Cicero cautioned It is the nature of man to err. It is an unequivocal fact that whenever men and women are involved in an activity, human error will occur at some point. In his book Human Error, Professor James Reason defines error as follows: Error will be taken as a generic term to encompass all those occasions in which a planned sequence of mental or physical activities fails to achieve its intended outcome, and when these failures cannot be attributed to the intervention of some chance agency. Error Models and Theories To appreciate the types of error that it is possible to make, researchers have looked at human error in a number of ways and proposed various models and theories. These attempt to capture the nature of the error and its characteristics. To illustrate this, the

following models and theories will be briefly highlighted: design- versus operator-induced errors; variable versus constant errors; reversible versus irreversible errors; slips, lapses and mistakes; skill-, rule- and knowledge-based behaviours and associated errors; the Swiss Cheese Model. Design- Versus Operator-Induced Errors In aviation, emphasis is often placed upon the error(s) of the front line operators, who may include flight crew, air traffic controllers and aircraft maintenance engineers. However, errors may have been made before an aircraft ever leaves the ground, by aircraft designers. This may mean that, even if an aircraft is maintained and flown as it is designed to be, a flaw in its original design may lead to operational safety being compromised. Alternatively, flawed procedures put in place by airline, maintenance organisation or air traffic control management may also lead to operational problems. It is common to find when investigating an incident or accident that more than one error has been made and often by more than one person. The error chain captures this concept. It may be that, only when a certain combination of errors arise and error defences breached (see the Swiss Cheese Model) will safety be compromised. Variable Versus Constant Errors In his book Human Error, Professor Reason discusses two types of human error: variable and constant errors. The implication is that constant errors may be predicted and therefore controlled, whereas variable errors cannot be predicted and are much harder to deal with. If we know enough about the nature of the task, the environment it is performed in, the mechanisms governing performance, and the nature of the individual, we have a greater chance of predicting an error. However, it is rare to have enough information to permit accurate

predictions; we can generally only predict along the lines of fatigued pilots are more likely to make errors than alert pilots, or The SOPs for task X on aircraft type Y is known as being ambiguous and likely to result in pilot error. It is possible to refine these predictions with more information (e.g. The SOPs in Operator Z's QRH are known as being ambiguous), but there will always be random errors or elements which cannot be predicted. Reversible Versus Irreversible Errors Another way of categorising errors is to determine whether they are reversible or irreversible. The former can be recovered from, whereas the latter typically cannot be. For example, if a pilot miscalculates the fuel he should carry, he may have to divert to a closer airfield, but if he accidentally dumps his fuel, he may not have many options open to him. A well designed system or procedure should mean that errors made by flight crew are reversible. Thus, if a flight crew member incorrectly selects fuel feed which results in an imbalance, the aircraft systems should generate an appropriate alert. Slips, Lapses, Mistakes and Violations Professor Reason highlights the notion of intention when considering the nature of error, asking the questions: Were the actions directed by some prior intention? Did the actions proceed as planned? Did they achieve their desired end? Slips can be thought of as actions not carried out as intended or planned, e.g. finger trouble when dialling in a frequency or Freudian slips when saying something. Lapses are missed actions and omissions, i.e. when somebody has failed to do something due to lapses of memory and/or attention or because they have forgotten something, e.g. forgetting to lower the undercarriage on landing.

Mistakes are a specific type of error brought about by a faulty plan/intention, i.e. somebody did something believing it to be correct when it was, in fact, wrong, e.g. switching off the wrong engine. Slips typically occur at the task execution stage, lapses at the storage (memory) stage and mistakes at the planning stage. Violations sometimes appear to be human errors, but they differ from slips, lapses and mistakes because they are deliberate illegal actions, i.e. somebody did something knowing it to be against the rules (e.g. deliberately failing to follow proper procedures). A pilot may consider that a violation is well-intentioned, e.g. electing not to climb in response to a TCAS RA, if he is certain that the other aircraft has already initiated avoiding action. There is great debate about whether flight crew should follow SOPs slavishly, or should elect to diverge from SOPs from time to time. Whatever the case, and however well-intentioned, this would still technically constitute a 'violation' rather than an error. Skill-, Rule- and Knowledge-Based Behaviours and Associated Errors Human behaviour can generally be broken down into three distinct categories: skill based, rule-based and knowledge-based behaviour. Each of these behaviour types have specific errors associated with them. Examples of skill-based errors are action slips, environmental capture and reversion. Action slips as the name implies are the same as slips, i.e. an action not carried out as intended. The example may consist of a pilot intending to key in FL110 into the FMS but keying in FL100 by mistake, after having been distracted by a query from his co-pilot. Environmental capture may occur when a pilot carries out a certain task very frequently in a certain location. Thus, a pilot used to reaching for a certain switch to select function A on an Airbus A320, may inadvertently select the same switch on an Airbus 321 when, in fact, it has a different function. Reversion can occur once a certain pattern of behaviour has been established, primarily because it can be very difficult to abandon or unlearn it when it is no longer appropriate. Thus, a pilot may accidentally carry out a procedure that he has

used for years, even though it has been recently revised. This is more likely to happen when people are not concentrating or when they are in a stressful situation. Reversion to originally learned behaviour is not uncommon under stress. Rule-based behaviour is generally fairly robust and this is why the use of procedures and rules is emphasised in aircraft maintenance. However, errors here are related to the use of the wrong rule or procedure. For example, a pilot may misdiagnose a fault and thus apply the wrong SOP, thus not clearing the fault. Errors here are also sometimes due to faulty recall of procedures. For instance, not remembering the correct sequence when performing a procedure. Errors at the knowledge-based performance level are related to incomplete or incorrect knowledge or interpreting the situation incorrectly. An example of this might be when a pilot makes an incorrect diagnosis of a situation without having a full understanding of how the aircraft systems work. Once he has made such a diagnosis, he may well look for information to confirm his (mis) understanding, while ignoring evidence to the contrary (known as confirmation bias).

Violations It is a fact of life that violations occur in aviation operations. Most stem from a genuine desire to do a good job. Seldom are they acts of laziness or incompetence. There are three types of violations: Routine violations; Situational violations; Optimising violations. Routine violations are things which have become the normal way of doing something within the persons work group (e.g. flight crew from one

company base). They can become routine for a number of reasons: flight crew may believe that procedures may be over prescriptive and violate them to simplify a task (cutting corners), to save time and effort. This rarely happens in flight operations, since flying tasks are so proceduralised, but it is not unusual to see these types of violations in maintenance engineering. Situational violations occur due to the particular factors that exist at the time, such as time pressure, high workload, unworkable procedures, poorly designed man machine interface in the cockpit. These occur often when, in order to get the job done, pilots consider that a procedure cannot be followed. Optimising violations involve breaking the rules for kicks. These are often quite unrelated to the actual task. The person just uses the opportunity to satisfy a personal need. Flying an illegal circuit over a friend's house might be an example. Time pressure and high workload increase the likelihood of all types of violations occurring. People weigh up the perceived risks against the perceived benefits, unfortunately the actual risks can be much higher.

Error ManagementOne of the key concepts associated with error management is that of "defences in depth", based on the premise that there are many stages in any system where errors can occur, and similarly many stages where defences can be built to prevent and trap errors. Professor James Reason covers error management in his book "Human Error". Reason's Swiss Cheese Model In his research, Reason has highlighted the concept of defences against human error within an organisation, and has coined the notion of defences in depth. Examples of defences are pre-flight checks, automatic warnings, challenge-response

procedures, etc., which help prevent to trap human errors, reducing the likelihood of negative consequences. It is when these defences are weakened and breached that human errors can result in incidents or accidents. These defences have been portrayed diagrammatically, as several slices of Swiss cheese (and hence the model has become known as Professor Reasons Swiss cheese model) Some failures are 'latent', meaning that they have been made at some point in the past and lay dormant. This may be introduced at the time an aircraft was designed or may be associated with a management decision. Errors made by front line personnel, such as flight crew, are active failures. The more holes in a systems defences, the more likely it is that errors result in incidents or accidents, but it is only in certain circumstances, when all holes line up, that these occur. Usually, if an error has breached the design or engineering defences, it reaches the flight operations defences (e.g. in flight warning) and is detected and handled at this stage. However, occasionally in aviation, an error can breach all the defences (e.g. a pilot ignores an in flight warning, believing it to be a false alarm) and a catastrophic situation ensues.

Error Detection and Prevention The concept of redundancy should be applied at all stages of the aviation system, never assuming that one single mechanism, especially if human, will detect and prevent an error. CRM provides a form of redundancy in that it emphasises the role of the second pilot to check what the first pilot has done. There is a potential danger with independent checks that the second person will trust the first person not to have done anything wrong, and therefore not to carry out the second check properly. CRM

dual checking is one of the last lines of defence, especially if no automatic system checks and alerts are present, and pilots should always be alert for the possibility that their colleague may have made an error, when carrying running through SOPs which require challenge-response checks, no matter how much they might trust and respect the other pilot. Similarly, the pilot carrying out the first action should never become complacent and rely upon the other pilot detecting an error. (The same applies with pilot-ATC communications, and read backs). It is essential to remember that we are all human therefore we all make mistakes from time to time, so assume the worst.

Sensory illusions in aviation

Because human senses are adapted for use on the ground, navigating by sensory input alone during flight can be dangerous: sensory input does not always accurately reflect the movement of the aircraft, causing sensory illusions. These illusions can be extremely dangerous for pilots.

Vestibular system

Fluid in the inner ear reacts only to rate of change, not a sustained change. For example, if a pilot initiates a banking left turn, the inner ear will detect the roll into the turn, but if the turn is held constant, the inner ear will compensate and rather quickly, although inaccurately, report to the brain that it has returned to level flight. As a result, when the pilot finally levels the wings, that new change will cause the inner ear to produce signals that produce the perception of banking to the right. This is the crux of the problem experienced by pilots flying without instruments in low-visibility weather. Even the best pilots will quickly become disoriented if they attempt to fly without instruments when there are no external visual references, because vision provides the predominant and coordinating sense that humans rely upon for stability. Perhaps the most treacherous thing under such conditions is that the signals the inner ear produces are incorrect though they may feel right. These sensory illusions occur because flight is an unnatural environment; our senses are not capable of providing reliable signals that we can interpret and relate to our position in three dimensions without visual reference.

Vestibular/somatogyral illusions llusions involving the semicircular and somatogyral canals of the vestibular system of the ear occur primarily under conditions of unreliable or unavailable external visual references and result in false sensations of rotation. These include the leans, the graveyard spin and spiral, and the coriolis illusion.

The leans This is the most common illusion during flight, and is caused by a sudden return to level flight following a gradual and prolonged turn that went unnoticed by the pilot. The reason a pilot can be unaware of such a gradual turn is that human exposure to a rotational acceleration of 2 degrees per second squared or lower is below the detection threshold of the semicircular canals. Leveling the wings after such a turn may cause an illusion that the aircraft is banking in the opposite direction. In response to such an illusion, a

pilot may lean in the direction of the original turn in a corrective attempt to regain the perception of a correct vertical posture. Graveyard spin The graveyard spin is an illusion that can occur to a pilot who enters a spin. For example, a pilot who enters a spin to the left will initially have a sensation of spinning in the same direction. However, if the left spin continues the pilot will have the sensation that the spin is progressively decreasing. At this point, if the pilot applies right rudder to stop the left spin, the pilot will suddenly sense a spin in the opposite direction (to the right). If the pilot believes that the airplane is spinning to the right, the response will be to apply left rudder to counteract the sensation of a right spin. However, by applying left rudder the pilot will unknowingly re-enter the original left spin. If the pilot cross-checks the turn indicator, he would see the turn needle indicating a left turn while he senses a right turn. This creates a sensory conflict between what the pilot sees on the instruments and what the pilot feels. If the pilot believes the body sensations instead of trusting the instruments, the left spin will continue. If enough altitude is lost before this illusion is recognized and corrective action is not taken, impact with terrain is inevitable. Graveyard spiral The graveyard spiral is more common than the graveyard spin, and it is associated with a return to level flight following a prolonged bank turn. For example, a pilot who enters a banking turn to the left will initially have a sensation of a turn in the same direction. If the left turn continues (for more than about 20 seconds), the pilot will experience the sensation that the airplane is no longer turning to the left. At this point, if the pilot attempts to level the wings this action will produce a sensation that the airplane is turning and banking in the opposite direction (to the right). If the pilot believes the illusion of a right turn (which can be very compelling), he will reenter the original left turn in an attempt to counteract the sensation of a right turn. Unfortunately, while this is happening, the airplane is still turning to the left and losing altitude. Pulling the control yoke/stick and applying power while turning would not be a good idea because it would only make the left turn tighter. If the pilot fails to recognize the illusion and does not level the wings, the airplane will continue turning left and losing altitude until it hits the

ground. Coriolis illusion This involves the simultaneous stimulation of two semicircular canals and is associated with a sudden tilting (forward or backwards) of the pilot's head while the aircraft is turning. This can occur when tilting the head down (to look at an approach chart or to write on the knee pad), or up (to look at an overhead instrument or switch) or sideways. This can produce an overpowering sensation that the aircraft is rolling, pitching, and yawing all at the same time, which can be compared with the sensation of rolling down a hillside. This illusion can make the pilot quickly become disoriented and lose control of the aircraft. Vestibular/somatogravic illusions Somatogravic illusions are caused by linear accelerations. These illusions involving the utricle and the saccule of the vestibular system are most likely under conditions with unreliable or unavailable external visual references. Inversion illusion An abrupt change from climb to straight-and-level flight can stimulate the otolith organs enough to create the illusion of tumbling backwards, or inversion illusion. The disoriented pilot may push the aircraft abruptly into a nose-low attitude, possibly intensifying this illusion. Head-up illusion The head-up illusion involves a sudden forward linear acceleration during level flight where the pilot perceives the illusion that the nose of the aircraft is pitching up. The pilot's response to this illusion would be to push the yoke or the stick forward to pitch the nose of the aircraft down. A night take-off from a well-lit airport into a totally dark sky (black hole) or a catapult take-off from an aircraft carrier can also lead to this illusion, and could result in a crash. Head-down illusion The head-down illusion involves a sudden linear deceleration (air braking, lowering flaps, decreasing engine power) during level flight where the pilot perceives the illusion that the nose of the aircraft is pitching down. The pilot's response to this illusion would be to pitch the nose of the aircraft up. If this illusion occurs during a low-speed final approach, the pilot could stall the

aircraft.

Visual illusions Visual illusions are familiar to most of us. As children, we learned that railroad tracks contrary to what our eyes might tell us don't come to a point at the horizon. Even under conditions of good visibility, one can experience visual illusions. Linear perspective illusions This illusion may make a pilot change (increase or decrease) the slope of his final approach. They are caused by runways with different widths, upsloping or downsloping runways, and upsloping or downsloping final approach terrain. Pilots learn to recognize a normal final approach by developing and recalling a mental image of the expected relationship between the length and the width of an average runway. Upsloping terrain or narrow or long runway A final approach over an upsloping terrain with a flat runway, or to an unusually narrow or long runway may produce the visual illusion of being too high on final approach. The pilot may then pitch the aircraft's nose down to decrease the altitude, potentially resulting in dropping short of the runway at high speed. Downsloping terrain or wide runway A final approach over a downsloping terrain with a flat runway, or to an unusually wide runway may produce the visual illusion of being too low on final approach. The pilot may then pitch the aircraft's nose up to increase the altitude, which can result in a low-altitude stall or a missed approach. Other visual illusions Black-hole approach illusion A black-hole approach illusion can happen during a final approach at night (no stars or moonlight) over water or unlit terrain to a lighted runway beyond

which the horizon is not visible. If the pilot has no peripheral visual cues to be oriented relative to the earth, there may be the illusion of being upright and the runway itself to be tilted and sloping. A particularly hazardous black-hole illusion involves approaching a runway under conditions with no lights before the runway and with city lights or rising terrain beyond the runway. These conditions may produce the visual illusion of being too high on final approach, resulting in pitching the aircraft nose down to decrease the perceived approach angle. Autokinetic illusion The autokinetic illusion gives the pilot the impression that a stationary object is moving in front of the airplane's path; it is caused by staring at a fixed single point of light (ground light or a star) in a totally dark and featureless background. This illusion can cause a misperception that such a light is on a collision course with the aircraft. False visual reference illusions False visual reference illusions may cause the pilot to orient the aircraft in relation to a false horizon; these illusions can be caused by flying over a banked cloud, night flying over featureless terrain with ground lights that are indistinguishable from a dark sky with stars, or night flying over a featureless terrain with a clearly defined pattern of ground lights and a dark, starless sky. Vection illusion This is when the brain perceives peripheral motion, without sufficient other cues, as applying to itself. Consider the example of being in a car in lanes of traffic, when cars in the adjacent lane start creeping slowly forward. This can produce the perception of actually moving backwards, particularly if the wheels of the other cars are not visible. A similar illusion can happen while taxiing an aircraft.

Spatial disorientationSpatial disorientation is a condition in which an aircraft pilot's perception of direction (proprioception) does not agree with reality. While it can be brought on by disturbances or disease within the vestibular system, it is more typically a temporary condition resulting from flight into poor weather conditions with low or no visibility. Under these conditions the pilot may be deprived of an external visual horizon, which is critical to maintaining a correct sense of up and down while flying. A pilot who enters such conditions will quickly lose spatial orientation if there has been no training in flying with reference to instruments. Approximately 80% of the private pilots in the United States do not have an instrument rating, and therefore are prohibited from flying in conditions where instrument skills are required. Not all pilots abide by this rule, and approximately 40% of the NTSB fatal general aviation accident reports list continuation of flight into conditions for which the pilot was not qualified as a cause. Senses during flight During the abnormal acceleratory environment of flight, the vestibular and proprioceptive systems do not respond veridically. Because of inertial forces created by acceleration of the aircraft along with centrifugal force caused by turning, the net gravitoinertial force sensed primarily by the otolith organs is not aligned with gravity, leading to perceptual misjudgment of the vertical. In addition, the inner ear contains rotational "accelerometers," known as the semicircular canals, which provide information to the lower brain on rotational accelerations in the pitch, roll and yaw axes. However, prolonged rotation (beyond 15-20 s) results in a cessation of semicircular output, and cessation of rotation thereafter can even result in the perception of motion in the opposite direction. Under ideal visual conditions, the above illusions are unlikely to be perceived but at night or in weather, the visual inputs are no longer capable of overriding these illusory nonvisual sensations. In many

cases, illusory visual inputs such as a sloping cloud deck can also lead to misjudgments of the vertical and of speed and distance or even combine with the nonvisual ones to produce an even more powerful illusion. The result of these various visual and nonvisual illusions is spatial disorientation

Effects of disorientation Once an aircraft enters conditions under which the pilot cannot see a distinct visual horizon, the drift in the inner ear continues uncorrected. Errors in the perceived rate of turn about any axis can build up at a rate of 0.2 to 0.3 degrees per second. If the pilot is not proficient in the use of gyroscopic flight instruments, these errors will build up to a point that control of the aircraft is lost, usually in a steep, diving turn known as a graveyard spiral. During the entire time, leading up to and well into the maneuver the pilot remains unaware that he is turning, believing that he is maintaining straight flight. The graveyard spiral usually terminates when the g-forces on the aircraft build up to and exceed the structural strength of the airframe, resulting in catastrophic failure, or when the aircraft contacts the ground. In a 1954 study, the Air Safety Foundation found that out of 20 non-instrument-rated subject pilots, 19 of the 20 entered a graveyard spiral soon after entering simulated instrument conditions. The 20th pilot also lost control of his aircraft, but in another maneuver. The average time between onset of instrument conditions and loss of control was 178 seconds. Spatial disorientation can also affect instrument-rated pilots in certain conditions. A powerful tumbling sensation (vertigo) can be set up if the pilot moves his head too much during instrument flight. This is called the Coriolis illusion. Pilots are also susceptible to spatial disorientation during night flight over featureless terrain.

Spatial Orientation Spatial orientation is our ability to maintain our body orientation and/or posture in relation to the surrounding environment (physical space) at rest and during motion. Humans are designed to maintain spatial orientation on the ground. The three-dimensional environment of flight is unfamiliar to the human body, creating sensory conflicts and illusions that make spatial orientation difficult and sometimes impossible to achieve. Statistics show

that between 5% and 10% of all general aviation accidents can be attributed to spatial disorientation, 90% of which are fatal. Good spatial orientation on the ground relies on the use of visual, vestibular (organs of equilibrium located in the inner ear), and proprioceptive (receptors located in the skin, muscles, tendons, and joints) sensory information. Changes in linear acceleration, angular acceleration, and gravity are detected by the vestibular system and the proprioceptive receptors, and then compared in the brain with visual information. Spatial orientation in flight is difficult to achieve because numerous sensory stimuli (visual, vestibular, and proprioceptive) vary in magnitude, direction, and frequency. Any differences or discrepancies between visual, vestibular, and proprioceptive sensory inputs result in a sensory mismatch that can produce illusions and lead to spatial disorientation.

The Otolith Organs and Orientation Two otolith organs, the saccule and utricle, are located in each ear and are set at right angles to each other. The utricle detects changes in linear acceleration in the horizontal plane, while the saccule detects gravity changes in the vertical plane. However, the inertial forces resulting from linear accelerations cannot be distinguished from the force of gravity (according to the theory of general relativity they are the same thing) therefore, gravity can also produce stimulation of the utricle and saccule. A response of this type will occur during a vertical take-off in a helicopter or following the sudden opening of a parachute after a free fall. "Seat of the pants" flying Anyone in an aircraft that is making a coordinated turn, no matter how steep, will have little or no sensation of being tilted in the air unless the horizon is visible. Similarly, it is possible to gradually climb or descend without a noticeable change in pressure against the seat. In some aircraft, it is possible to execute a loop without pulling negative G so that without visual reference, the pilot could be upside down without being aware of it. That's because a gradual change in any direction of movement may not be strong enough to activate the fluid in the semicircular canals, so the pilot may not realize that the aircraft is accelerating, decelerating, or banking.

CASE STUDIES Eastern Air Lines Flight 401Eastern Air Lines Flight 401 was a Lockheed L-1011 Tristar 1 jet that crashed into the Florida Everglades on the night of December 29, 1972, causing 101 fatalities (77 initial crash survivors, two died shortly afterward). The crash was a result of the flight crew's failure to recognize a deactivation of the autopilot during their attempt to troubleshoot a malfunction of the landing gear position indicator system. As a result, the flight gradually lost altitude while the flight crew was preoccupied and eventually crashed. It was the first crash of a wide-body aircraft and, at the time, the deadliest in the United States Crash Eastern Air Lines Flight 401, operating with a four-month-old Lockheed L1011-1 Tristar (the 12th example delivered to the carrier) carrying 163 passengers and 13 crew members, left New York's JFK airport on Friday, December 29, 1972 at 9:20 p.m., en route to Miami International Airport. The flight was under the command of Captain Robert Loft, 55, a veteran Eastern Air Lines pilot ranked 50th in seniority at Eastern. His flight crew included First Officer Albert Stockstill, 39 and Second Officer (flight engineer) Donald

Repo, 51. A fourth memberEastern technical officer, Angelo Donadeo, returning to Miami from an assignment in New Yorkaccompanied the flightcrew for the journey. The ten women flight attendant crew on Flight 401 included: Mercedes Ruiz, Sue Tebbs, Adrienne Hamilton (lead flight attendant), Trudy Smith, Dorothy Warnock, Pat Ghyssels, Beverly Raposa, Patty Georgia, Stephanie Stanich and Sharon Transue. Pat Ghyssels (seated on jumpseat 3L) and Stephanie Stanich (seated on jumpseat 4L) died in the crash. The flight was routine until 11:32 p.m., when the flight began its approach into Miami International Airport. After lowering the gear, First Officer Stockstill noticed that the landing gear indicator, a green light identifying that the nose gear is properly locked in the "down" position, did not illuminate. The cause, discovered after much investigation, was due to a burned-out light bulb. The landing gear could have been manually lowered either way. The pilots cycled the landing gear but still failed to get the confirmation light. Loft, who was working the radio during this leg of the flight, told the tower that they would abort their landing and asked for instructions to circle the airport. The tower cleared the flight to pull out of its descent, climb to two thousand feet (610 m), and then fly west over the darkness of the Everglades. The cockpit crew removed the light assembly and Second Officer Repo was dispatched into the avionics bay beneath the flight deck to check visually if the gear was down through a small viewing window. Fifty seconds after reaching their assigned altitude, Captain Loft instructed First Officer Stockstill to put the L-1011 on autopilot. For the next eighty seconds the plane maintained level flight. Then it dropped one hundred feet (30 m), and then again flew level for two more minutes, after which it began a descent so gradual it could not be perceived by the crew. In the next seventy seconds, the plane lost only 250 feet (76 m), but this was enough to trigger the altitude warning C-chord chime located under the engineer's workstation. The engineer had gone below, and there was no indication by the pilot's voices recorded on the CVR that they heard the chime. In another fifty seconds, the plane was at half its assigned altitude. As Stockstill started another turn, onto 180 degrees, he noticed the discrepancy. The following conversation was recovered from the flight voice recorder later:

Stockstill: We did something to the altitude. Loft: What? Stockstill: We're still at 2,000 feet, right? Loft: Hey what's happening here? The jetliner crashed at 255153N 803543WCoordinates: 255153N 803543W. The location was west-northwest of Miami, 18.7 miles (30.1 km) from the end of runway Eight Left (8L). The plane was traveling at 227 miles per hour when it flew into the ground. The left wingtip hit first, then the left engine and the left landing gear, making three trails through the sawgrass, each five feet wide and more than 100 feet (30 m) long. When the main part of the fuselage hit the ground it continued to move through the grass and water, breaking up as it went.

Cause of the crash The NTSB investigation discovered that the autopilot had been inadvertently switched from altitude hold to CWS (Control Wheel Steering) mode in pitch. In this mode once the pilot releases pressure on the yoke the autopilot will maintain the pitch attitude selected by the pilot until he moves the yoke again. Investigators believe the autopilot switched modes when the captain accidentally leaned against the yoke while turning to speak to the flight engineer, who was sitting behind and to the right of him. The slight forward pressure on the stick would have caused the aircraft to enter a slow descent, maintained by the CWS system. Investigation into the aircraft's autopilot showed that the force required to switch to CWS mode was different between the A and B channels (15 vs 20 pounds respectively). Thus it was possible that the switching to CWS in channel A did not occur in channel B thus depriving the First Officer of any indication the mode had changed (Channel A provides the Captain's instruments with data, while channel B provides the First Officer's). After descending 250 feet from the selected altitude of 2000 feet a C-chord sounded from the rear speaker. This altitude alert, designed to warn the pilots of an inadvertent deviation from the selected altitude, went unnoticed by the fatigued and frustrated crew. Investigators believe this was due to the crew being distracted by the nose gear light, and because the flight engineer

was not in his seat when it sounded and so would not have been able to hear it. Visually, since it was nighttime and the aircraft was flying over the darkened terrain of the Everglades, there were no ground lights or other visual indications that the TriStar was slowly descending into the swamp. It was also discovered that Captain Loft had an undetected tumor in his brain, although this was later found to be in an area controlling vision. The final NTSB report cited the cause of the crash as pilot error, specifically: "the failure of the flight crew to monitor the flight instruments during the final four minutes of flight, and to detect an unexpected descent soon enough to prevent impact with the ground. Preoccupation with a malfunction of the nose landing gear position indicating system distracted the crew's attention from the instruments and allowed the descent to go unnoticed."

Flash Airlines Flight 604Flash Airlines Flight 604 was a charter flight operated by Egyptian charter company Flash Airlines. On 3 January 2004, the Boeing 737-300 crashed into the Red Sea shortly after takeoff from Sharm el-Sheikh International Airport, killing all 142 passengers, many of them French tourists, and all 6 crew members. The findings of the crash investigation are controversial, with

accident investigators from the different countries involved not agreeing on the cause. Flight 604 has the highest death toll of any aviation accident in Egypt, and the highest death toll of any accident involving a Boeing 737-300. History of the flight The aircraft, a Boeing 737-3Q8 had originally been delivered to TACA Airlines in 1992. Other operators included Color Air, Egypt-based Mediterranean Airlines, and the prior corporate identity of Flash Airlines, Heliopolis Airlines. The flight took off at 04:44 Eastern European Time (0244 GMT) from runway 22R at the Egyptian resort en route to Paris via Cairo. The captain was one of Egypt's most experienced pilots, with over 7,000 hours flying experience that included a highly decorated career in the Egyptian Air Force. After taking off, the aircraft should have climbed and initiated a left turn to follow the air corridor to Cairo designated by the Sharm el-Sheikh VOR station. The captain appeared surprised when the autopilot was engaged, which he immediately switched off again. The copilot warned the captain that the bank angle was increasing. At a bank angle of 40 degrees to the right, the captain said "OK, come out". The ailerons were briefly returned to a neutral before being commanded to increase the bank to the right. The aircraft reached an altitude of 5,460 feet (1,660 m) with a 50 degrees bank when the copilot exclaimed "Overbank!" repeatedly when the bank angle kept increasing. The bank angle was 111 degrees right, while the pitch attitude was 43 degrees nose down at an altitude of 3,470 feet (1,060 m). The observer on the flight deck, also a pilot, but a trainee on this type of aircraft, shouted "Retard power, retard power, retard power! Both throttles were moved to idle; the captain appeared to regain control of the airplane from the nose-down, right bank attitude. However the speed increased, causing an overspeed warning. At 04:45, the aircraft impacted the water about 9.4 statute miles (15.2 km; 8.2 NMI) south of the airport. The impact occurred while the aircraft was in a 24 degree right bank, 24 degree nosedown attitude, travelling at 416 knots (770 km/h)(478 mi/h) and pulling 3.9g (38 m/s). All passengers and crew were killed on impact. Charles de Gaulle Airport initially indicated the Flash Airlines flight was delayed; authorities began notifying relatives and friends of the deaths of the passengers two hours after the scheduled arrival time. Authorities took relatives and friends to a hotel, where they received a list of passengers

confirmed to be on the flight. Marc Chernet, president of the victims' families association of Flight 604, described the disaster as the "biggest air disaster involving French nationals" in civil aviation. Investigation Initially, it was thought that terrorists might have been involved, as fear of aviation terrorism was high (with several major airlines in previous days canceling flights on short notice). The British Prime Minister at the time, Tony Blair, was also holidaying in the Sharm el-Sheikh area. A group in Yemen said that it destroyed the aircraft as a protest against a new law in France banning headscarves in schools. Accident investigators dismissed terrorism when they discovered that the wreckage was in a tight debris field, indicating that the aircraft crashed in one piece; a bombed aircraft would disintegrate and leave a large debris field. The wreckage sank to a depth of 1,000 m (3,300 ft), making recovery of the flight data recorder and cockpit voice recorder difficult. However two weeks after the accident, both devices were located by a French salvage vessel and recovered by a ROV. The accident investigators examined the recorders while in Cairo. The maintenance records of the aircraft had not been duplicated; they were destroyed in the crash and no backup copies existed. The Ministry of Civil Aviation (MCA) investigated the accident, with assistance from the American National Transportation Safety Board (NTSB) and the French Bureau d'Enqutes et d'Analyses pour la Scurit de l'Aviation Civile (BEA). The MCA released its final report into the accident on March 25, 2006. The report did not conclude with a probable cause, listing instead four "possible causes". The NTSB and the BEA concluded that the pilot suffered spatial disorientation, and the copilot was unwilling to challenge his more experienced superior. Furthermore, according to the NTSB and BEA, both officers were insufficiently trained. The NTSB stated that the cockpit voice recorder showed that 24 seconds passed after the airliner banked before the pilot began correcting maneuvers. Egyptian authorities disagreed with this assessment, attributing the cause to mechanical issues. Shaker Kelada, the lead Egyptian investigator, said that if Hamid, who had more experience than the copilot, detected any problems with the flight, he would have raised objections. Some media reports suggest that the plane crashed due to

technical problems, possibly a result of the apparently questionable safety record of the airline. This attitude was shown in a press briefing given by the BEA chief, who was berated by the first officer's mother during a press conference, and demanded that the crew be absolved of fault prior to the completion of the investigation. Two months after the crash Flash Airlines went bankrupt. U.S. Summary Comments on Draft Final Report of Aircraft Accident Flash Airlines flight 604, Boeing 737-300, SU-ZCF January 3, 2004, Red Sea near Sharm El-Sheikh, Egypt. Quote from page 5 of 7: "Distraction. A few seconds before the captain called for the autopilot to be engaged, the airplanes pitch began increasing and airspeed began decreasing. These deviations continued during and after the autopilot engagement/disengagement sequence. The captain ultimately allowed the airspeed to decrease to 35 knots below his commanded target airspeed of 220 knots and the climb pitch to reach 22, which is 10 more than the standard climb pitch of about 12. During this time, the captain also allowed the airplane to enter a gradually steepening right bank, which was inconsistent with the flight crews departure clearance to perform a climbing left turn. These pitch, airspeed and bank angle deviations indicated that the captain directed his attention away from monitoring the attitude indications during and after the autopilot disengagement process. Changes in the autoflight systems mode status offer the best explanation for the captains distraction. The following changes occurred in the autoflight systems mode status shortly before the initiation of the right roll: (1) manual engagement of the autopilot, (2) automatic transition of roll guidance from heading select to control wheel steering-roll (CWS-R), (3) manual disengagement of the autopilot, and (4) manual reengagement of heading select for roll guidance. The transition to the CWS-R mode occurred in accordance with nominal system operation because the captain was not closely following the flight director guidance at the time of the autopilot engagement. The captain might not have expected the transition, and he might not have understood why it occurred. The captain was probably referring to the mode change from command mode to CWS-R when he stated, see what the aircraft did?, shortly after it occurred. The available evidence indicates that the unexpected mode change and the flight crews subsequent focus of attention on reestablishing roll guidance for the autoflight system were the most likely reasons for the captains distraction from monitoring the attitude". Problems associated with the complexity of autopilot systems were

documented in the June 2008 issue of Aero Safety World. Before the completion of the investigation, Avionics writer David Evans suggested that differences in instrumentation between the MiG-21 (with which the captain had experience) and the Boeing 737 may have contributed to the crash.

Garuda Indonesia Flight 200

Garuda Indonesia Flight 200 (GA200) was the scheduled domestic passenger flight of a Boeing 737-497 operated by Garuda Indonesia between Jakarta and Yogyakarta, Indonesia. The aircraft crashed and burst into flames while landing at Adisucipto International Airport on March 7, 2007. According to the airline, 21 passengers and 1 crew member were killed; both the captain and the first officer survived and were admitted to an Indonesian military hospital. Flight chronology Flight GA200 originated in Jakarta and was carrying 133 passengers, 19 of whom were foreigners. Several Australian journalists were on the flight, covering the visit of Australia's Foreign Affairs Minister Alexander Downer and Attorney-General Philip Ruddock to Java. . They were on the flight as the aircraft carrying Australian dignitaries were at capacity. At approximately 7 am local time (UTC+7), while attempting to land at Adisucipto International Airport, Yogyakarta, Indonesia, the plane overran the end of the runway, went through the perimeter fence and stopped in a nearby rice field after it bounced three times. Passengers in the plane and witnesses on the ground reported the plane approached the runway at a speed greater than normal. According to passengers, the plane shook violently before it crashed. At some point the plane caught fire, and while most passengers were able to escape, a number of passengers perished inside the burning fuselage. This may have been caused by the broken main exit door, which is located at the front left. The fire may have been ignited from the nose landing gear after its wheels were snapped off, which were

found later on the runway. The pilot, Captain Muhammad Marwoto Komar, claimed that there was a sudden downdraft immediately before the flight landed, and that the flaps on the aircraft may have malfunctioned. Investigation Australia was heavily involved in the investigation in which the Australian Federal Police disaster victim identification experts were deployed to the scene to assist with the identification of bodies. Australian Transport Safety Bureau staff assisted at the scene by inspecting the wreckage to attempt to piece together a picture of the incident. The "black box" recorders consisting of a flight data recorder and cockpit voice recorder were removed from the wreckage and flown to Canberra, Australia, for further analysis by the Bureau of Air Safety Investigations using equipment not yet available in Indonesia. The United States' National Transportation Safety Board dispatched a team to assist in the investigation, including representatives from Boeing and the Federal Aviation Administration. Staff in Australia could not read the cockpit voice recorder of the black box, which was then sent to the Boeing factory in Seattle, United States, to be deciphered. Police started the investigation of the pilots, who had been suspended and were suffering from psychological trauma after the inferno.[who?] According to the pilots, a huge gust of wind was responsible for the disaster, while witnesses said that the plane was at a higher than normal speed during landing. Police were said to be investigating the possibility of a detonator inside the aircraft, with Police spokesman Budi Santoso saying "About a suspicion of a detonator might have been found inside the ill-fated plane, we are still investigating it. To prove it, it will take a long time, and the police are still collecting evidence both from witnesses' information and from objects found from the plane wreckage,". After the flight data and black box recordings were analyzed, and a complete safety review of the airport was conducted, it was revealed that the Yogyakarta Airport did not conform to international safety standards, having a runway runoff a quarter the recommended length; pilots reported the reverse thrust of one engine was not working prior to takeoff; the weather was calm, contradicting claims of an updraft; data recordings revealed no mechanical fault before landing; black box recordings revealed there was no cockpit argument, as reported; safety vehicles were unable to reach the crash site in sufficient time, failing to conform to global safety standards.

On 17 March 2007, new evidence from the flight data recorder indicated that wing flaps on the plane were not extended for landing. New evidence came up on April 1, 2007 and it is reported that the pilot and co-pilot were arguing about the plane's speed, but other reports said there was no evidence for this. On 11 April 2007, Indonesia's National Safety Transport Committee released a preliminary finding into the crash, confirming that Garuda Flight 200 was travelling at around 410 km/h - almost twice the normal speed - when it came in to land. A Garuda Pilots' Association official has speculated that the captain could have been trying to save fuel due to a new fuel conservation bonus scheme recently introduced by Garuda Airlines. On October 22, 2007, the official enquiry blamed the crash on pilot error. The captain ignored the planes automated warning system as it sounded alarms fifteen times. He also ignored calls from the co-pilot to go around and make another approach. On 4 February 2008 the captain, Marwoto Komar, was arrested and charged with six counts of manslaughter. The charge carries a penalty up to life imprisonment if the court finds the crash was deliberate. Short of that finding, the lesser charge of negligent flying causing death, carries a maximum sentence of seven-years. The copilot testified that he had told the captain to go around because of excessive speed, and that he then had blacked out due to the severe buffeting. On 6 April 2009, the captain was found guilty of negligence and sentenced to 2 years in jail. Despite all evidence pointing towards severe pilot error, the captain's conviction was quashed by the Indonesian High Court on September 29, 2009.

Helios Airways Flight 522Helios Airways Flight 522 (HCY 522 or ZU522) was a Helios Airways Boeing 737-300 flight that crashed into a mountain on 14 August 2005 at 12:04 EEST, north of Marathon and Varnavas, Greece. Rescue teams located wreckage near the community of Grammatiko 40 km (25 miles) from Athens. All 121 on board were killed.

Flight and crash

Date: 14 August 2005 All times EEST (UTC + 3h), PM in bold Time Event 0900 Scheduled departure

0907 Departs Larnaca International Airport 0911 Pilots report air conditioning problem 0912 Cabin Altitude Warning sounds at 12,040 feet (3,670 m) 0920 Last contact with Nicosia ATC; Altitude is 28,900 feet (8,809 m) 0923 Now at 34,000 feet (10,400 m); Probably on autopilot 0937 Enters Athens Flight Information Region 1007 No response to radio calls from Athens ATC 1020 Athens ATC calls Larnaca ATC; Gets report of air conditioning problem 1024 Hellenic Air Force (HAF) alerted To possible renegade aircraft 1045 Scheduled arrival in Athens 1047 HAF reassured that the problem Seemed to have been solved 1055 HAF ordered to intercept by Chief of General Staff, Admiral Panagiotis Chinofotis 1105 Two F-16 fighters depart Nea Anchialos 1124 Located by F-16s over Aegean island of Kea 1132 Fighters see co-pilot slumped over, cabin oxygen deployed, no signs of terrorism 1149 Fighters see an individual in the cockpit, apparently trying to regain control of aircraft 1150 Left (#1) engine stops operating,

presumably due to fuel starvation 1154 CVR records two MAYDAY messages 1200 Right (#2) engine stops operating 1204 Aircraft crashes in mountains near Grammatikos, Greece Hans-Jrgen Merten, a 59-year-old German contract pilot hired by Helios for the holiday flights, served as the captain. Pampos Charalambous, 51, a Cypriot who flew for Helios, served as the first officer. 32-year old Louisa Vouteri, a Greek national living in Cyprus who served as a chief purser, replaced a sick colleague. The flight, which left Larnaca, Cyprus at 09:07 local time, was en route to Athens, and was scheduled to continue to Prague. Before take-off the crew failed to set the pressurization system to "Auto," which is contrary to standard Boeing procedures. Minutes after take-off the cabin altitude horn activated as a result of pressurization. It was, however, misidentified by the crew as a take-off configuration warning, which signals that the aircraft is not ready for take-off, and can only sound on the ground. The horn can be silenced by the crew with a switch on the overhead panel. Above 14,000 ft (4,267 m) cabin altitude, the oxygen masks in the cabin automatically deployed. An Oxy ON warning light on the overhead panel in the cabin illuminates when this happens. At this point, the crew contacted the ground engineers. Minutes later a master caution warning light activated, indicating an abnormal situation in a system. This was misinterpreted by the crew as indicating that systems were overheating. At some point later the captain radioed the engineer on the ground to say that the ventilation fan lights were off. This suggests that the captain was suffering from hypoxia, as the 737-300 has no such lights. The engineer asked the captain to repeat. The captain then said that the equipment cooling lights were off, which again suggested confusion. The engineer said, "this is normal, please confirm the problem." The engineer then asked, "Can you confirm that the pressurization system is set to AUTO?" The captain, however, disregarded the question and instead asked in reply, "Where are my equipment cooling circuit breakers?" The engineer then asked whether the crew could see the circuit breakers, but received no response.

After the flight failed to contact air traffic control upon entering Greek air space, two F-16 fighter aircraft from the Hellenic Air Force 111th Combat Wing were scrambled from Nea Anchialos Air Base to establish visual contact. They noted that the aircraft appeared to be on autopilot. In accordance with the rules for handling "renegade" aircraft incidents (where the aircraft is not under pilot control), one fighter approached to within 300 ft (91 m), and saw the first officer was slumped motionless at the controls. The pilot could also see that the captain was not upright in the cockpit and that oxygen masks were seen dangling in the passenger cabin. Later, the F-16 pilots saw the flight attendant Andreas Prodromou enter the cockpit and sit at the controls, seemingly trying to regain control of the aircraft. He eventually noticed the F-16, and signaled him. The pilot pointed forward as if to ask, "Can you carry on flying?" Prodromou responded by shaking his head and pointing downward. The cockpit voice recorder recorded him calling "mayday" multiple times. Within minutes, due to lack of fuel, the engines failed in quick succession and the aircraft began to descend. Prodromou grabbed the yoke and attempted to steer, but the plane continued, hit the ground and exploded. At the time of impact, the passengers and crew were likely unconscious but breathing. None survived. The aircraft was carrying 115 passengers and a crew of 6. The passengers included 67 due to disembark at Athens, with the remainder continuing to Prague. The bodies of 118 individuals were recovered. The passenger list included 93 adults and 22 people under the age of 18. Cypriot nationals comprised 103 of the passengers and Greek nationals comprised the remaining 12. The cause of the crash (according to air crash investigations) was that the cabin pressurization control valve was set to manual and was not switched back to auto after post-maintenance pressurization testing was completed. As a result, the cabin never pressurized during the ascent to 35,000 feet (11,000 m). The flight attendant seen in the cockpit managed to stay conscious by using the spare oxygen bottles provided in the passenger cabin for crew use.

Investigation Suspicions that the aircraft had been hijacked were ruled out by Greece's foreign ministry. Initial claims that the aircraft was shot down by the fighter

jets have been refuted by eyewitnesses and the government. Loss of cabin pressurewhich, without prompt alleviation, would cause pilot unconsciousnessis the leading theory explaining the accident. This would account for the release of oxygen masks in the passenger cabin. Weighing against this is the fact that the pilots should have been able to don their own fast-acting masks and make an emergency descent to a safe altitude provided that they recognized the pressurization system as the source of the alarm and acted before their minds were too impaired by hypoxia. The flight data recorder and cockpit voice recorder were sent to Paris for analysis. Authorities served a search warrant on Helios Airways' headquarters in Larnaca, Cyprus, and seized "documents or any other evidence which might be useful in the investigation of the possibility of criminal offences." Most of the bodies recovered were burned beyond visual identification by the fierce fires that raged for hours in the dry brush and grass covering the crash site. However, it was determined that a body found in the cockpit area was that of a male flight attendant and DNA testing revealed that the blood on the aircraft controls was that of flight attendant Andreas Prodromou, a pilotin-training with approximately 260270 hours of training completed. Autopsies on the crash victims showed that all were alive at the time of impact, but it could not be determined whether they were conscious as well. Prodromou was not originally scheduled to be on the flight; he joined the crew so he could spend time with his girlfriend, a fellow Helios flight attendant. Decompression hypothesis The preliminary investigation reports state that the maintenance performed on the aircraft had left the pressurization control on a 'manual' setting, in which the aircraft would not pressurize automatically on ascending; the pretakeoff check had not disclosed nor corrected this. As the aircraft passed 10,000 feet (3,000 m), the cabin altitude alert horn sounded. The horn also sounds if the aircraft is not properly set for takeoff, for example flaps not set, and thus it was assumed to be a false warning. The aircrew found a lack of a common language and inadequate English a hindrance in solving the problem. The aircrew called maintenance to ask how to disable the horn, and were told where to find the circuit-breaker. The pilot left his seat to see to the circuit breaker and both aircrew lost consciousness shortly afterwards.

The leading explanation for the accident is that the cabin pressurization did not operate and this condition was not recognized by the crew before they became incapacitated. Decompression would have been fairly gradual as the aircraft climbed under the control of the flight management system. The pressurization failure warning on this model should operate when the effective altitude of the cabin air reaches 10,000 ft (3,000 m) at which altitude a fit person will have full mental capacity. The emergency oxygen supply in the passenger cabin of this model of Boeing 737 is provided by chemical generators that provide enough oxygen, through breathing masks, to sustain consciousness for about 12 minutes, normally sufficient for an emergency descent to 10,000 feet (3,000 m), where atmospheric pressure is sufficient to sustain life without supplemental oxygen. Cabin crew has access to portable oxygen sets with considerably longer duration. Emergency oxygen for the flight crew comes from a dedicated tank. Previous pressurization problems On 16 December 2004, during an earlier flight from Warsaw, the accident aircraft experienced a rapid loss of cabin pressure, and the crew made a successful emergency descent. The cabin crew reported to the captain that there had been a bang from the aft service door, and that there was a handsized hole in the door's seal. The Air Accident and Incident Investigation Board (AAIIB) of Cyprus could not conclusively determine the causes of the incident, but indicated two possibilities: an electrical malfunction causing the opening of the outflow valve, or the inadvertent opening of the aft service door. The mother of the first officer killed in the crash of Flight 522 claimed that her son had repeatedly complained to Helios about the aircraft getting cold. Passengers also reported problems with air conditioning on Helios flights. During the two months before the crash, the aircraft's Environmental Control System required repair five times. On the morning of the crash, after the aircraft arrived at Larnaca on a flight from the United Kingdom, the cabin crew reported an abnormal noise coming from the right aft service door during the flight. Helios engineers performed a visual inspection of the door and a pressurization leak check, and reported no defects, leaks, or abnormal noises.

Tenerife airport disasterThe Tenerife airport disaster in 1977 was a collision involving two Boeing 747 passenger aircraft on the runway of Los Rodeos Airport (now known as Tenerife North Airport) on the Spanish island of Tenerife, one of the Canary Islands. With 583 fatalities, the crash remains the deadliest accident in aviation history. All 248 aboard the fully fuelled KLM flight were killed. There were also 335 fatalities and 61 survivors from the Pan Am flight, which was struck along its spine by the KLM's landing gear, under-belly and four engines. Rescue crews were unaware for over 20 minutes that the Pan Am aircraft was also involved in the accident, because of the heavy fog and the separation of the crippled aircraft following the collision. The collision took place on March 27, 1977, at 17:06:56 local time. The aircraft were operating as Pan Am Flight 1736 (the Clipper Victor) under the command of Captain Victor Grubbs, and KLM Flight 4805 (the Rijn) under the command of Captain Jacob Veldhuyzen van Zanten. Taking off in heavy fog on the airport's only runway, the KLM flight crashed into the top of the Pan Am aircraft back taxiing in the opposite direction. The Pan Am had followed the back taxiing of the KLM aircraft, under the direction of Air Traffic Control, and the KLM's flight crew had been aware of Pan Am back taxiing behind them on the same runway. Despite lack of visual confirmation (because of the fog) the KLM captain thought that Pan Am had cleared the runway and so attempted to take off without further clearance to do so. Several other key factors contributed to the accident.

Flight details For both planes, Tenerife was an unscheduled stop. Their destination was Gran Canaria International Airport (also known as Las Palmas airport), serving Las Palmas on the nearby island of Gran Canaria. Both are in the Canary Islands, an autonomous community of Spain located in the Atlantic Ocean off the west coast of Morocco. Pan Am Flight 1736 had taken off from Los Angeles International Airport with an intermediate stop at New York's John F. Kennedy International Airport. The aircraft was a Boeing 747-121, registration N736PA. Of the 380 passengers, 14 had boarded in New York, where the crew was also changed. The new crew consisted of Captain Victor Grubbs, First Officer Robert Bragg, and Flight Engineer George Lawrence; there were 14 other crew members.

The airplane was Pan Am's first Boeing 747 (ex Clipper Young America). KLM Flight 4805, a charter flight for Holland International Travel Group from the Netherlands, had taken off four hours before from Amsterdam Airport Schiphol. Its captain was Jacob Veldhuyzen van Zanten and the first officer was Klaas Meurs. The aircraft was a Boeing 747-206B, registration PH-BUF. The KLM jet had 235 passengers and 14 crew members, including 48 children and three infants. Most of the KLM passengers were Dutch; four Germans, two Austrians, and two Americans were also on the plane. After the aircraft landed at Tenerife, a Dutch tour guide named Robina van Lanschot, who lived on the island in Puerto de la Cruz and wanted to see her boyfriend that night, elected not to re-board the 747, leaving 234 passengers on board. Chain of events leading to disaster

Bombing at Las Palmas Events on both planes had been routine until they approached the islands. Then, at 1:15 pm, a terrorist bomb (planted by separatist Fuerzas Armadas Guanches) exploded in the terminal of Gran Canaria International Airport. It had been preceded by a phone call warning of the bomb. The civil aviation authorities closed that airport after the bomb detonated and diverted all of its incoming flights to Los Rodeos, including the two Boeing 747 aircraft involved in the disaster. Upon contacting Gran Canaria airport, the Pan Am flight was informed of the temporary closure. Although the Pan Am crew indicated that they would prefer to circle in a holding pattern until landing clearance was given, the plane was ordered to divert to Los Rodeos, along with the KLM flight. This led to the critical cramped aircraft conditions within the smaller airport. Congestion at Los Rodeos In all, at least five large aircraft were diverted to Los Rodeos, a regional airport that could not easily accommodate them. The airport consisted of one runway and one major taxiway parallel to it, as well as several small taxiways connecting the main taxiway and the runway. While waiting for Gran Canaria airport to reopen, the diverted aircraft took up so much space that they were parked on the long taxiway, meaning that it could not be used for taxiing. Instead, departing aircraft would have to taxi along the runway to position themselves for takeoff, a procedure known as a runway

backtrack. Refuelling After the threat at Gran Canaria International Airport had been contained, authorities reopened the airport. The Pan Am aircraft was ready to depart, but the KLM plane and a refuelling vehicle obstructed the way to the active runway. Captain van Zanten had decided to fully refuel at Los Rodeos instead of Las Palmas, apparently to save time, but added extra weight, greatly retarding liftoff (and accident escape) ability, which proved fatal. The refuelling took an estimated 35 minutes. By a factor of just 12 feet of lack of manoeuvre clearance, due to KLM's refuelling, Pan Am was stuck behind it until KLM was finished, delaying its ability to fly out before the KLM flight. Taxiing and weather conditions Following the tower's instructions, the KLM aircraft was cleared to back taxi the full length of runway 30 and make a 180 turn to put the aircraft in takeoff position a difficult manoeuvre to perform with a 747 on a runway only 45 m (150 ft) wide. While KLM 4805 was back taxiing on runway 30, the controller asked the flight crew to report when it was ready to copy the ATC clearance. Because the flight crew was performing the checklist, copying this clearance was postponed until the aircraft was in takeoff position on Runway 30. During taxiing, the weather deteriorated and low-lying clouds now limited the visual range to about 300 m (1,000 ft). Legal or stipulated threshold for take-off was 700 metres visibility, as noted in the Nova documentary and relayed by a surviving Pan Am pilot in an on camera interview. Pan Am pilots were thinking visibility conditions were not present for take-off. But weather changed by seconds and/or minutes. Shortly afterward, Pan Am 1736 was instructed to also back taxi, to follow the KLM aircraft down the same runway, to exit the runway by taking the "third exit" on their left and then using the parallel taxiway. Initially the crew was unclear as to whether the controller had told them to take the first or third exit. The crew asked for clarification and the controller responded emphatically by replying: "The third one, sir; one, two, three; third, third one". The crew began the taxi and proceeded to identify the unmarked taxiways using an airport diagram as they reached them. Based on the chronology of the cockpit voice recorder (CVR) and the distances between the taxiways (and the location of the aircraft at the time of the collision), the crew successfully identified the first two taxiways (C-1

and C-2), but their discussion in the cockpit never indicated that they had sighted the third taxiway (C-3), which they had been instructed to use. There were no markings or signs to identify the runway exits. The Pan Am crew appeared to remain unsure of their position on the runway until the collision, which occurred near the intersection with the fourth taxiway (C-4). Pan Am's lack of visibility and runway exiting confusion probably contributed to its slow taxiing speed, another key factor in the accident. The angle of the third taxiway would have required the plane to perform a turn of approximately 145, which would lead counter-productively back toward the still-crowded main apron. At the end of C-3 another 145 turn would have to be made to continue taxiing towards the start of the runway. Taxiway C-4 would have required just two 35 turns. A study carried out by the Air Line Pilots Association after the accident concluded that making the second 145 turn at the end of taxiway C-3 would have been "a practical impossibility", although the Dutch report stated that such a manoeuvre "could reasonably be performed". The official report from the Spanish authorities did not explain why the controller had instructed the Pan Am aircraft to use the third taxiway, rather than the sensible and easier fourth taxiway. Communication misunderstandings Immediately after lining up, the KLM captain advanced the throttles (a standard procedure known as "spin-up", to verify that the engines are operating properly for takeoff) and the co-pilot, surprised by the mano