EASA Annual-Safety Recommendations Report 2017 PDF
EASA Annual-Safety Recommendations Report 2017 PDF
EASA Annual-Safety Recommendations Report 2017 PDF
RECOMMENDATIONS
REVIEW
2017
Catalogue number ISBN ISSN DOI
PDF TO-AE-18-001-EN-N 978-92-9210-212-8 2599-7793 10.2822/177336
Designed in Luxembourg
Strategy & Safety Management Directorate
Safety Intelligence & Performance Department
Annual Safety
Recommendations Review
2017
Disclaimer:
Neither the European Aviation Safety Agency, nor any person acting on behalf of the European Aviation Safety
Agency is responsible for the use which might be made of the following information.
The Annual Safety Recommendations Review is produced by the European Aviation Safety Agency (EASA). This
edition provides an overview of the safety recommendations that have been addressed to EASA in 2017. It also
presents the replies produced during the year.
This annual review aims at providing a feedback on the follow-up given to safety recommendations in the con-
text of openness, transparency and accountability that characterises the European Public Administration.
Apart from its safety related information character, this review is also expected to provide relevant information
related to raised safety concerns, both for EASA itself, as well as its stakeholders, including the European public.
Image credits
© European Aviation Safety Agency, 2018. All rights reserved. Proprietary document.
Printed copies are not controlled. Confirm revision status through the EASA-Internet site: www.easa.europa.eu.
2017 Annual Safety Recommendations Review
Contents
0 Abbreviation list 5
1 Executive summary 7
2 Introduction10
3 Safety Recommendations received in 2017 13
3.1 Overview of Safety Recommendations received in 2017���������������������������������������������������������������������14
3.2 Origin of the Safety Recommendations received in 2017��������������������������������������������������������������������16
3.3 Involvement in accident and serious incident investigations�������������������������������������������������������������20
4 Safety Recommendations replies in 2017 23
4.1 Overview of Safety Recommendations replies in 2017������������������������������������������������������������������������24
4.2 Status of the Safety Recommendations replies in 2017�����������������������������������������������������������������������25
5 Overview of key safety topics processed and actions carried out in 2017 28
5.1 Large aeroplane cabin and passenger safety - emergency evacuation����������������������������������������������30
5.2 Encountering severe turbulence at high altitude��������������������������������������������������������������������������������32
5.3 Runway surface conditions and aircraft ground anti/de-icing������������������������������������������������������������33
5.4 Helicopters performing CAT operations�����������������������������������������������������������������������������������������������35
5.5 Flight simulation training and other flight training exercises�������������������������������������������������������������37
5.6 General Aviation (GA) – various aspects in the frame of airworthiness���������������������������������������������39
5.7 Unmanned Aircraft (UA)������������������������������������������������������������������������������������������������������������������������40
5.8 Ballistic Parachute Recovery Systems (BPRS)���������������������������������������������������������������������������������������� 41
6 Conclusions43
ANNEX A: List of 2017 Safety Recommendations Replies45
ANNEX B: Definitions226
ANNEX C : Safety Recommendations classification 230
2017 Annual Safety Recommendations Review
PAGE 4
List of Figures
Figure 1: Safety Recommendations addressed to EASA per year........................................................... 14
Figure 2: Annual Safety Recommendations by occurrence class 2012-2017.......................................... 15
Figure 3: Safety Recommendations received in 2017 by Type of Operation and Aircraft Category..........16
Figure 4: Origin of Safety Recommendations received by EASA............................................................ 17
Figure 5: States contribution to Safety Recommendations received in 2017........................................ 18
Figure 6: EASA responses to safety recommendations in 2017 by year received.................................. 24
Figure 7: Safety Recommendation Responses sent in 2017 [status, total number]............................... 25
Figure 8: Response assessment received by originator on EASA Final Replies sent
in 2017 [percentage, reference date: 26.03.2018]................................................................................... 26
Figure 9: Assessment EASA received on the Final Responses sent in 2017
[total, reference date: 26.03.2018]........................................................................................................... 27
Figure 10: Safety Recommendations addressed to EASA per topic by EU SIAs..................................... 29
CHAPTER 0
CHAPTER 1
CHAPTER 2
CHAPTER 3
CHAPTER 4
CHAPTER 5
ANNEX B.
ANNEX C.
2017 Annual Safety Recommendations Review
Abbreviation list PAGE 6
AD Airworthiness Directive
AFM Aircraft Flight Manual
AAIB UK Air Accidents Investigation Branch United Kingdom
AMC Acceptable Means of Compliance
ANSV Italian National Agency for the Safety of Flight
BEA Bureau d’Enquête et d’Analyse pour l’Aviation Civile
CAT Commercial Air Transport
CIAIAC Civil Aviation Accidents and Incidents Investigation Commission
CM Certification Memo
CRI Certification Review Item
CRM Crew Resource Management
CS Certification Specifications
CS-LSA Certification Specifications for Light Sport Aeroplanes
CVR Cockpit Voice Recorder
DSB Dutch Safety Board
ELT Emergency Locator Transmitter
ENCASIA European Network of Civil Aviation Safety Investigation Authorities
EPAS European Plan for Aviation Safety
ETOPS Extended Operation
ETSO European Technical Standard Order
EU European Union
FAA Federal Aviation Administration
FCOM Flight Crew Operating Manual
FDM Flight Data Monitoring
GA General Aviation
GM Guidance Material
HEMS Helicopter Emergency Medical Service
HOFO Helicopter Offshore Operations
ICAO International Civil Aviation Organisation
ICCAIA International Coordination Council for Aerospace Industry Associations
ILS Instrument Landing System
LOC-I Loss of control-inflight
MOPSC Maximum Operational Passenger Seating Configuration
MS Member States
NCO Non-Commercial operations with Other than complex motor-powered aircraft
NTSB National Transportation Safety Board
PED Portable Electronic Devices
RE Runway Excursion
RMT Rulemaking Task
SIA Safety Investigation Authority
SIB Safety Information Bulletin
SRGC Safety Recommendation of Global Concern
SRUR Safety Recommendations of Union-wide Relevance
STC Supplemental Type Certificates
STSB Swiss Transportation Safety Investigation Board
VFR Visual Flight Rules
CHAPTER 0
CHAPTER 1
CHAPTER 2
CHAPTER 3
CHAPTER 4
CHAPTER 5
ANNEX B.
ANNEX C.
2017 Annual Safety Recommendations Review
Executive summary PAGE 8
Executive summary
The Annual Safety Recommendations Review provides information on the activity carried out by the Agency in
the field of safety investigation and follow-up. In addition, the review highlights a range of safety issues and
Agency safety improvement efforts that are of interest to the European Aviation Community and the public.
General statistical data on the safety recommendations addressed by safety investigation authorities
to EASA in 2017;
Main safety topics related to the above mentioned recommendations and/or replies that have been
addressed through actions taken.
At the European Union level, the principles governing the investigation of accidents and serious incidents are
defined in Regulation (EU) No 996/2010 of the European Parliament and of the Council of 20 October 2010 on
the investigation and prevention of accidents and incidents in civil aviation. Regulation (EU) No 996/2010 imple-
ments international standards and recommended practices as described in Annex 13 to the Chicago Convention
on International Civil Aviation.
During the last 10 years the Agency has become the main actor in safety investigation follow-up within Europe
and this has also been reflected in the establishment of a robust and rigorous processing of the safety recom-
mendations received. Owing to EASA central positioning in the system, the Agency is able to take actions with
respect to systemic problems and other issues in the management of risk.
The implementation of safety recommendations provides tangible improvements in safety as a result of infor
mation that has been learned during safety investigations. In Europe, the methodical approach to investigatory
work and the implementation of recommendations brings some meaning to the loss experienced as a result of
accidents.
During 2017, Safety Investigation Authorities from 15 different States addressed 42 safety recommendations to
EASA in the context of the Agency’s remit. This number is about the half of the safety recommendations received
by the Agency in 2016, and by far the lowest in the last 8 years.
They were mostly related to aircraft or aviation related “equipment or facilities” [39%, Aircraft/Equipment/
Facilities] and to “procedures or regulations” [37%, Procedures/Regulations]. 16 were classified as safety
recommendations of Global Concern (SRGC) and 16 were classified as safety recommendations having Union-
wide Relevance (SRUR).
2017 Annual Safety Recommendations Review
Executive summary PAGE 9
Therefore, the handling of the safety recommendations in both an expeditious and responsible manner consti-
tutes one of the pivotal responsibilities for EASA. In response, the Agency in 2017 produced 157 replies to safety
recommendations:
86 of them were final replies (closing safety recommendations) with more than 48% carrying an agree-
ment assessment, and 35% with partial agreement;
The remaining 71 updating replies provided information on the progress of the actions decided upon
by the Agency and for which the relevant activities were not yet completed;
Only 9% of the final response provided by EASA were assessed as “not adequate” by the Safety Inves-
tigation Authorities.
CHAPTER 0
CHAPTER 1
CHAPTER 2
CHAPTER 3
CHAPTER 4
CHAPTER 5
CHAPTER 6 Introduction
ANNEX A.
ANNEX B.
ANNEX C.
2017 Annual Safety Recommendations Review
Introduction PAGE 11
Introduction
At the European Union (EU) level, the principles governing the investigation of accidents and serious incidents
are defined in Regulation (EU) No 996/2010 of the European Parliament and of the Council of 20 October 2010
on the investigation and prevention of accidents and incidents in civil aviation.
Regulation (EU) No 996/2010 implements international standards and recommended practices as described in
Annex 13 to the Chicago Convention on International Civil Aviation. It sets down an obligation for each Member
State of the European Union to establish an independent permanent national civil aviation safety investigation
authority, which shall investigate accidents and serious incidents in order to improve aviation safety and prevent
future occurrences without apportioning blame or liability. Investigation reports and the related safety recom-
mendations shall be communicated to the concerned aviation authorities for consideration and appropriate
action, as needed.
Regulation (EC) No 216/2008, the EASA Basic Regulation, states that “Results of air accident investigations should
be acted upon as a matter of urgency, in particular when they relate to defective aircraft design and/or opera-
tional matters, in order to ensure consumer confidence in air transport”.
EASA assigns a high priority to the follow-up of safety recommendations and has established effective proce-
dures to that effect:
The safety recommendations process is subject to continuous internal monitoring until all corrective
actions are closed;
The Agency receives assessments of its responses from Safety Investigation Authorities (SIA) and can
identify when opinions diverge. In this context, EASA considers the assessment given by the safe-
ty investigation authority on the appropriateness of the mitigation measures when closing the
recommendation.
In November 2017, EASA was audited by the International Civil Aviation Organisation (ICAO). ICAO performed
the Universal Safety Oversight Audit Programme (USOAP) of its Member States to check the correct implementa-
tion of their ICAO obligations. The report will be published on ICAO web page.
All safety recommendations must be taken into full consideration by the organisations to which they are ad-
dressed. In this context, the Agency maintains transparency with respect to its decisions and actions, in line with
its safety mission. The Agency will maintain the current levels of cooperation in working with the European Net-
work of Civil Aviation Safety Investigation Authorities (ENCASIA) - WG6 on Safety Recommendations.
Furthermore, EASA is also monitoring safety recommendations that are issued to other aviation and non-avia-
tion addressees. The types of safety recommendations that are listed below have noticeably increased over the
past 3 years:
Safety Recommendations of Union-wide Relevance (SRUR) and with Global Concern (SRGC), address-
ing mainly systemic safety concerns;
2017 Annual Safety Recommendations Review
Introduction PAGE 12
Safety recommendations addressing new developments at the national level, such as safety rec-
ommendations related to increasing number of unmanned aircraft systems (drones/RPAS/UA), or
‘dual-use’ products which can be used for both military and civil aircraft;
The Annual Safety Recommendations Review provides an overview on the follow-up performed by EASA in
response to recommendations addressed to the Agency by Safety Investigation Authorities in relation to the in-
vestigation of Accidents and Serious Incidents or originating from safety studies.
The first edition of this review was issued in 2007. This 11th edition reviews the 2017 activity and presents:
General statistical data on the safety recommendations addressed by safety investigation authorities
to EASA in 2017;
Main safety issues that have been addressed through actions taken.
Since 2011, a process to assess and mitigate safety risks at the European level has been established by EASA. At
the heart of this system is the concept of safety risk management, comprising hazard identification, risk assess-
ment and decision-making resulting in the best agreed course of action to mitigate those risks. EASA, Member
States (MS) and industry work closely together in this process. At the European level, this process is coordinated
by the Agency and documented in the European Plan for Aviation Safety (EPAS).
The EPAS identifies the key safety issues as well as the agreed safety actions to resolve or mitigate the hazards.
Safety recommendations are one of the key inputs to the safety risk management process. They provide informa-
tion on the hazards as well as proposed solutions to mitigate the associated safety risks to the aviation system.
CHAPTER 0
CHAPTER 1
CHAPTER 2
CHAPTER 3
CHAPTER 4
Safety
CHAPTER 5
CHAPTER 6 Recommendations
ANNEX A.
received in 2017
ANNEX B.
ANNEX C.
2017 Annual Safety Recommendations Review
Safety Recommendations received in 2017 PAGE 14
Safety Recommendations
received in 2017
Figure 1 shows the total annual number of safety recommendations that the Agency has received over the last
10 years. The exchange of safety recommendations and the role of EASA in that regard is enforced by the adop-
tion of Regulation (EU) No 996/2010. The issuance of safety recommendations addressed to EASA started to
develop shortly before this regulation came into force in 2010. In the years from 2012 to 2016, the annual num-
ber of safety recommendations addressed to EASA remained constant. In 2017, this amount reduced to half: This
is by far the lowest number of yearly safety recommendations addressed to the Agency during the last 8 years.
This is in line with the decreased number of safety recommendations issued in 2017 by the SIA in EASA Members
States. This fact was noted by ENCASIA when publishing their annual report. It was noted that in comparison to
2016 only 60 percent of safety recommendations were recorded in the European Safety Recommendation In-
formation System (SRIS). WG6 of ENCASIA intends to review this data in more detail in order to understand the
reason for this change.
100 93 92
88 86 88
80
60 55
50
42
40
20
0
2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017
Year
2017 Annual Safety Recommendations Review
Safety Recommendations received in 2017 PAGE 15
In 2017, the safety recommendations were related to one study, one transmittal letter and 30 different occurrenc-
es, comprising 20 accidents, 8 serious incidents and 2 incidents.
The study was initiated by the Swiss Transportation Safety Investigation Board (STSB) and reviewed the organi-
sation and efficiency of the civil aviation search and rescue service in Switzerland1 (Swiss – SAR) addressing et al
one safety recommendation to the Agency regarding crash survivability of the emergency locator transmitter
(ELT) system (signal and technical construction).
The transmittal letter was received from the Romanian Civil Aviation Safety Investigation and Analysis Center
(CIAS) with one safety recommendation addressed to the Agency regarding the language used for passenger
safety briefings on domestic flights.
In summary, each investigation of the applicable occurrences resulted in one to three safety recommendations
being addressed to the Agency.
Figure 2 shows the total number of safety recommendations by different occurrence classes since 2012.
60
No. of safety recommendations
50
50 47 47
40
30
30
22 24 24
21
20 18
12 13 12 14
10 5 7
0 1 2 0 1 2 2
0
2012 2013 2014 2015 2016 2017
Year
The aircraft categories, per type of operation, that were involved in the occurrences that resulted in safety
recommendations in 2017 are listed in the table below.
1 “Studie Nr. 3 der Schweizerischen Sicherheitsuntersuchungsstelle SUST über die Organisation und die Wirksamkeit des Such- und
Rettungsdienstes der zivilen Luftfahrt (search and rescue – SAR) in der Schweiz“
2017 Annual Safety Recommendations Review
Safety Recommendations received in 2017 PAGE 16
Aircraft Category
Fixed Wing
Type of Operation Fixed Wing Small
Lighter- Rotorcraft UA/ Grand
Aeroplane
Large than-air Total Total
(incl. Glider, RPAS
Aeroplane
Ultralight/
Microlight)
Commercial Air
14 1 2 8 25
Transport
Cargo 1 1 2
Passenger 13 2 8 23
Airline 13 13
HEMS 7 7
Sightseeing 2 1 3
Non-Commercial
2 10 1 1 14
Operations
State Operations 1 1
Firefighting 1 1
not applicable* 2
Grand Total 16 11 2 10 1 42
*including safety recommendations stemming from one study and one letter
Figure 4 shows the percentage distribution of safety recommendations between EASA Member States and non-
EASA Member States that were addressed to EASA in 2017. The chart shows that EASA Member States issued
90 % of the safety recommendations that were received by EASA in 2017.
2017 Annual Safety Recommendations Review
Safety Recommendations received in 2017 PAGE 17
10%
90%
Almost one third [28%] of the safety recommendations received in 2017 were related to 4 major occurrences as
follows [each investigation issued 3 safety recommendations addressed to EASA]:
2. A serious incident involving an AIRBUS A330, with registration N276AY, on 26 June 2016 at London
Heathrow Airport (United Kingdom) with an emergency evacuation at the parking stand after an APU
failure filled cabin with smoke;
3. An accident involving a RANS S6 aircraft (Annex II aircraft), with registration EC-YDQ, on 15 July 2016
in the vicinity of the “Los Garranchos” airfield in Spain;
4. A serious incident involving a BK117D2 helicopter, with registration I-BRXA, in a powerplant related
event, en-route during an Emergency Medical Service (HEMS) operation on 11 October 2017 at Mon-
tichiari Airport in Italy.
The safety recommendations that EASA received from non-EASA Member States are related to the following four
occurrences:
An accident involving an ATR 72 aircraft, with registration VH-FVR, operating on a scheduled passen-
ger flight from Canberra to Sydney, Australia, sustained a pitch disconnect while on descent to Sydney
on 20 February 2014. The Australian Transport Safety Bureau (ATSB) addressed one safety recommen-
dation to EASA.
A fatal accident involving a BOEING B747-412F, with registration TC-MCL, on 16 January 2017 while
performing a cargo flight from Chek Lap Kok Airport (VHHH, Hong Kong) via Manas International
Airport (UCFM, Bishkek) to Ataturk Airport (LTBA, Istanbul) impacted the ground during approach to
RWY 26 of Manas International Airport, Kyrgyz Republic. The accident is being investigated by the
Russian Federation Interstate Aviation Committee Commission (MAK), and in the published preliminary
report one safety recommendation was addressed to EASA.
2017 Annual Safety Recommendations Review
Safety Recommendations received in 2017 PAGE 18
An incident investigated by the Transport Safety Investigation Bureau of Singapore that occurred dur-
ing a flight from Sydney to Singapore on 26 November 2016 involving a BOEING B787, with registration
9V-OJF. The aircraft experienced vibration in one engine during the climb and cruise phase and an
engine failure during descent to Singapore Changi Airport. The SIA addressed one safety recommen-
dation to EASA.
The United States National Transportation Safety Board (NTSB) investigated an accident involving an
AIRBUS Helicopters AS350 that suffered a loss of control at take-off from a ground-based hospital heli-
pad in Frisco, Colorado on 3rd July 2015. The SIA addressed one safety recommendation to EASA.
Safety recommendations coming from non-EASA Member States mainly addressed actions to EASA certified
products (focused on reviewing the design to ensure the ongoing safe operation) or recommended cooperation
with the primary certification authority.
Figure 5 shows the contribution of different SIAs worldwide, also indicating the number of occurences that
contributed to the safety recommendations that were addressed to EASA in 2017. The contribution of the occur-
rences is proportional to the number of safety recommendations. The SIAs of Sweden [8], Switzerland [7] and
Spain [6] issued the highest number of safety recommendations.
SWEDEN 6 8
SWITZERLAND 4 7
SPAIN 4 6
ITALY 3 5
UNITED KINGDOM 2 4
FINLAND 2 2
FRANCE 1 2
AUSTRALIA 1 1
AUSTRIA 1 1
BELGIUM 1 1
NETHERLANDS 2 1
ROMANIA 0 1
RUSSIAN FEDERATION 1 1
SINGAPORE 1 1
UNITED STATES 1 1
10 8 6 4 2 0 2 4 6 8 10
Number of occurrences contributed to the Number of Safety Recommendations EASA received by:
Safety Recommendations EASA received EASA Member States
Non-EASA Member States
The Swedish Accident Investigation Authority (Statens haverikommission - SHK) issued 8 safety recommendations
that were related to 6 different occurrences, all of which occurred in Sweden. The majority of the safety recom-
mendations arise from different occurrences and are not drawn from the previously described 28% of all safety
recommendations received in 2017:
An accident involving a hot air balloon LINDSTRAND (model LBL 120A, with registration SE-ZOU) at
Nynäs Fallet on 10 May 2016. The investigation resulted in two safety recommendations being ad-
dressed to EASA.
2017 Annual Safety Recommendations Review
Safety Recommendations received in 2017 PAGE 19
A serious incident at Vilhelmina Airport in Sweden on 6 April 2016 involving a BAe ATP aeroplane, reg-
istration SE-LLO, in a runway excursion. The investigation determined that this event was caused by an
asymmetrical reverse thrust and the braking action was probably worse than that indicated by the cal-
culated friction coefficients. Two safety recommendations were addressed to EASA.
A serious incident on 6 April 2016 involving a FOKKER F28-100 aeroplane, with registration YR-FZA,
that occurred during an instrument approach to Gällivare airport, which was performed in the dark
with snow and rain. After a hard landing in the touchdown zone, the aircraft overran the end of the
runway and came to a halt on the runway strip. The investigation determined that the serious incident
was caused by the gradual deterioration of conditions allowing for a safe landing, which was not per-
ceived in due time. One safety recommendation was addressed to EASA.
A serious incident involving an AVRO 146-RJ100, with registration SE-DSP, occurred on 29 September
2016 at Malmö Airport and related to a component failure/malfunction [non-powerplant / SCF-NP] due
to inadequate maintenance. One safety recommendation was addressed to EASA.
A serious incident involving an AVRO-RJ 100,with registration SE-DSV, after take-off from Gothenburg/
Landvetter Airport on 7 November 2016. The investigation determined that the incident was partly
caused by the operator lacking safe procedures for performing a complete contamination inspection,
and partly because the operator had not properly checked the subcontractor’s working methods. This
resulted in the aircraft taking off with ice-contamination on critical surfaces. One safety recommen-
dation was addressed to EASA.
A Loss of control – inflight (LOC-I) involving a Diamond DA42, with registration SE-LVR, during a train-
ing flight on 22 January 2016 at Ängsö (Västmanland County). The investigation resulted in one safety
recommendation being addressed to EASA.
The Swiss Transportation Safety Investigation Board (STSB) issued 7 safety recommendations that were related
to one study and 4 accidents as follows:
2. An accident involving an AIRBUS A319 (HB-JZQ) on 20 July 2014. One safety recommendation was ad-
dressed to EASA.
3. An accident involving a ROBIN DR400 (HB-EQN) on 26 August 2016. One safety recommendation was
addressed to EASA.
4. An accident involving an ATR72 (D-ANFE) on 04 December 2014. One safety recommendation was ad-
dressed to EASA.
5. A study2 concerning the review of the organisation and efficiency of the civil aviation search and res-
cue service in Switzerland (Swiss – SAR) addressing et al one safety recommendation to the Agency
regarding crash survivability of the emergency locator transmitter (ELT) system.
2 “Studie Nr. 3 der Schweizerischen Sicherheitsuntersuchungsstelle SUST über die Organisation und die Wirksamkeit des Such- und
Rettungsdienstes der zivilen Luftfahrt (search and rescue – SAR) in der Schweiz“
2017 Annual Safety Recommendations Review
Safety Recommendations received in 2017 PAGE 20
The Civil Aviation Accidents and Incidents Investigation Commission (CIAIAC) in Spain issued 6 safety recommen-
dations that were related to 4 different occurrences (3 accidents and 1 incident). The safety recommendations
were in the scope of operations [1 safety recommendation Flight Planning and Fuel Management (FPFM)], Air
Crew training [1 safety recommendation concerning the training program for helicopter pilots for the LTE phe-
nomenon, and 1 safety recommendation related to flight crew water survival training for flights over water
in specialised air operations] and three safety recommendations concerning aircraft equipped with a ballistic
parachute recovery system. The volume of safety recommendations is consistent with one of the four main con-
tributing events, as described in the previous chapter.
In general, the safety recommendations issued by the European SIAs in 2017 addressed a wide scope of tech-
nical subjects in the remit of the Agency: Certification, air operations, air crew, aerodromes and air traffic
management. Aspects covered were, inter alia, the initial and continued airworthiness of light aircraft and large
helicopters, various aspects of air operations (such as flight planning, weather conditions, fuel consumption and
de-icing), CAT operations, as along with flight crew training and procedures for air crew (emergency procedures).
Below is a list of 2017 accident and incident investigations where EASA was closely involved, mainly through the
appointment of an EASA Technical Advisor:
A serious incident on 11 March 2017 in Colombia involving an AIRBUS A340-300 (registration F-GLZU),
which experienced a slow rotation take-off from SKBO (Bogota) on RWY 13R. The investigation is
delegated to the BEA by the Colombian Aircraft Accident Investigation (GRIAA).
On 10 August 2017, an accident occurred involving an HPH Glasflügel 304 eS (registration G-GSGS),
which is an electric self-sustainer sailplane, having a battery fire in the Front Electric Sustainer (FES)
during landing at Parham Airfield, in the United Kingdom. The occurrence was initially referred to the
British Gliding Association (BGA) for investigation in accordance with an existing Memorandum of
Understanding between the AAIB and the BGA for non-fatal gliding accidents. Having conducted an
initial investigation, the BGA requested further assistance from the UK AAIB, resulting in the UK AAIB
launching a field investigation.
A serious incident occurred on 09 September 2017 involving an ATR 72-212A (registration EC-KKQ)
during a flight from Alicante to Madrid (Spain), which experienced Loss of Control Inflight (LoC-I) after
entering icing conditions. The investigation is led by the CIAIAC.
A collision with terrain involving a LET-410UVP (registration RA-67047) that was performing a sched-
uled passenger and cargo flight along the route Khabarovsk-Chumikan-Nelkan while approaching the
landing site at Nelkan airport (Russia) on 15 November 2017. The accident is being investigated by the
Interstate Aviation Committee (MAK).
2017 Annual Safety Recommendations Review
Safety Recommendations received in 2017 PAGE 21
On 17 November 2017, a serious incident occurred en-route involving an AIRBUS A320, registration
EC-HQJ, operating from Geneva airport (Switzerland) to Barcelona airport in Spain) when the pilots be-
came partially incapacitated. The pilots donned the oxygen masks, declared an emergency situation
and diverted towards Marseille Airport in Provence. The occurrence is being investigated by the BEA.
An accident involving a Bombardier CL-604 and an AIRBUS A380, on 07 January 2017. During the cruise
phase above the Arabian Sea, Indian Ocean, approximately one minute after it had been passed over-
head by the AIRBUS A380 flying in the opposite direction, the CL-604 experienced a temporary loss of
control. After losing approximately 9,000ft of altitude, the pilots regained control of the aircraft and
subsequently landed at an alternate aerodrome; Muscat Airport, Oman. The German Federal Bureau
of Aircraft Accident Investigation (BFU) is leading the investigation and EASA, at the invitation of the
SIA, has been appointed as an adviser to the Investigator-in-charge.
Two events involved the AIRBUS A330 aircraft type operating in severe turbulence with the potential
to induce an upset:
1. The first involved, an AIRBUS A330-300 (registration 9M-XXS) during cruise in Malaysian airspace
on 03 May 2017. The Air Accident Investigation Bureau of Malaysia has opened an investiga-
tion in accordance with ICAO Annex 13 as the event occurred over international waters (State of
Registration/Operator – Malaysia).
2. The second involved an AIRBUS A330-200 (registration B-5926) during cruise while en-route from
Paris (France) to Kunming (China) at FL390 about 260nm northeast of Tyumen (Russia) on 17 June
2017. The investigation is being led by the Chinese Aircraft Accident Investigation Division, Office
of Aviation Safety.
In both events EASA, at the invitation of the SIA, was appointed as an adviser to the BEA accredited
representative.
Two events occurred in Italy involving the helicopter type Agusta Westland AW139:
1. On 24 January 2017, with registration EC-KJT during an Helicopter Emergency Medical Service
(HEMS operation) flight;
2. The second, with registration I-TNCC, occurred on 05 March 2017 while performing winching
during an HEMS operation.
The ANSV has opened two investigations and EASA, upon invitation from the SIA, appointed an
adviser for the investigation.
An accident involving a BK117 C-2 helicopter (registration N146DU) performing a HEMS operation in
North Carolina (USA) occurred on 08 September 2017. The investigation is being led by the National
Transportation Safety Board (NTSB).
An accident involving a Sikorsky S92 (with registration EI-ICR) of the Irish Coast Guard conducting
a Top Cover off-shore mission for Search and Rescue (SAR) occurred on 14 March 2017 in Ireland.
2017 Annual Safety Recommendations Review
Safety Recommendations received in 2017 PAGE 22
An accident involving an Enstrom 480B helicopter (with registration N-480W) during a VFR flight from
Bolzano airport (LIPB) to Linz airport (LOWL) occurred on 10 May 2017 in Italy. EASA, at the invitation
of the SIA, was appointed as an adviser for the investigation opened by ANSV.
A serious incident involving a SAAB 340 (with registration VH-NRX) with an in-flight propeller mal-
function 19 km SW of Sydney Airport (Australia) occurred on 17 March 2017. The SHK (State of Design
and Manufacture) assigned an accredited representative to assist the investigation led by the ATSB,
and EASA, at the invitation of the SIA, was appointed as an adviser to the accredited representative.
An accident involving an AIRBUS A380-800 (with registration F-HPJE) during a flight from Paris Charles
de Gaulle (France) to Los Angeles (USA) occurred on 30 September 2017. An engine failure occurred
during cruise at FL370 over Greenland, causing the crew to divert the aircraft for a safe landing at
Goose Bay airport (Canada). The Danish Accident Investigation Board delegated the investigation lead
to the BEA. Investigators from AIB Denmark (State of Occurrence), from the NTSB (State of Engine Man-
ufacture), and the TSB (State where the flight crew diverted), are taking part in the safety investigation.
Three powerplant failures [SCF-PP: powerplant failure or malfunction] involving the aircraft type AIR-
BUS A330 (with ROLLS-ROYCE TRENT 700 engine), were classified as serious incidents:
1. During a flight on 15 May 2017, the pilots of an AIRBUS A330-200 (with registration SU-GCI) flying
from Cairo (Egypt) to Beijing (China) rejected a take-off due to an engine failure.
2. During a flight on 11 June 2017 from Sydney (Australia) to Shanghai (China), with an AIRBUS A330-
200 (registration B-6099) an inlet cowl damage occurred. The aircraft returned to Sydney for a safe
landing. The occurrence is being investigated by the ATSB. The BEA and the UK AAIB each appoint-
ed an accredited representative (respectively as State of Aircraft Manufacture and State of Engine
Manufacture). EASA, at the request of the SIA, was appointed as an adviser to each of the two Eu-
ropean accredited representatives.
3. On 25 June 2017 during a flight from Perth (Australia) to Kuala Lumpur (Malaysia), an AIRBUS A330-
300 (registration 9M-XXE) suffered a fan blade fracture en-route at FL380, which led to severe
vibrations and the shutdown of the engine involved. The crew returned to Perth for a safe landing.
The ATSB opened an investigation. The UK AAIB was appointed as an accredited representative and
EASA, at the invitation of the SIA, was appointed as an adviser to the accredited representative.
Please note that safety actions that were taken immediately during an investigation do not appear in this pub-
lication if a Safety Investigation Authority did not issue an associated safety recommendation to EASA in 2017.
CHAPTER 0
CHAPTER 1
CHAPTER 2
CHAPTER 3
CHAPTER 4
Safety
CHAPTER 5
CHAPTER 6 Recommendations
ANNEX A.
replies in 2017
ANNEX B.
ANNEX C.
2017 Annual Safety Recommendations Review
Safety Recommendations replies in 2017 PAGE 24
Safety Recommendations
replies in 2017
However, replies to recommendations from earlier years were also issued, as per the table below, for those cas-
es where follow-up actions and conclusions were reached, which required updates and or closure of the safety
recommendation.
Year Safety Recommendation received in Number of replies in 2017 Including Final Replies
2004 1 0
2005 0 0
2006 1 1
2007 2 2
2008 1 1
2009 6 4
2010 8 3
2011 15 11
2012 3 2
2013 19 12
2014 10 8
2015 14 9
2016 46 24
2017 31 9
total 157 86
2017 Annual Safety Recommendations Review
Safety Recommendations replies in 2017 PAGE 25
Among the 157 replies that were sent by EASA in 2017 and summarised above, 86 were final replies that closed
safety recommendations with the following EASA response category distribution:
EASA agreed to take corrective actions in 71 cases either by directly applying the recommended
actions as was the case for 41 of them, or by partially agreeing to take corrective action for 30 of them
In partially agreeing, the Agency acknowledged the safety issue but took corrective actions other than
those recommended;
In another 15 cases, the safety recommendations were evaluated and the safety benefit was not
agreed with. Figure 7 below shows this distribution.
Closed - Agreement, 41
Closed - Partial
agreement, 30
Open, 71
Closed - disagreement,15
In order to monitor safety recommendations, their status remains open until the proposed action related to each
recommendation is fully developed and completed.
In addition to the 86 final replies closing a safety recommendation, 71 updating replies (so-called intermediate
response) were also issued. These updating replies provided information on the progress of the actions decided
upon by the Agency and for which the relevant activities were not yet completed.
3 These definitions of classification categories are developed in collaboration with European Safety Investigation Authorities and are
part of a taxonomy aimed at facilitating the management of safety recommendations.
2017 Annual Safety Recommendations Review
Safety Recommendations replies in 2017 PAGE 26
To follow-up on whether or not the competent Safety Investigation Authority (SIA) considers the response to be
adequate or disagrees with the action that EASA has proposed, the Agency has implemented procedures in com-
pliance with Regulation (EU) No 996/2010.
Figure 8 shows the total number of response assessments that EASA has received from the SIAs, based on the 86
closing replies that were sent in 20174. As assessed, 50 percent of the responses provided by the Agency were
deemed to be “adequate” or “partially adequate”, and 9 percent as being “not adequate”. With respect to 35 clos-
ing responses or 41% of those sent in 2017, EASA is awaiting the assessment of the SIAs.
Figure 9 provides a more detailed view of the recommendation assessment and or classification as determined
by the addressee.
´´ Figure 8: Response assessment received by originator on EASA Final Replies sent in 2017
[percentage, reference date: 26.03.2018]
´´ Figure 9: Assessment EASA received on the Final Responses sent in 2017 [total, reference
date: 26.03.2018]
Closed-Disagreement
Recommendation assessment by EASA
Closed-Partial agreement
Closed-Agreement
0 5 10 15 20 25 30 35 40 45
Response assessment by the originator
CHAPTER 1
CHAPTER 2
Overview of key
CHAPTER 3
CHAPTER 4
ANNEX A.
QMS/SMS/SSP, 7%
Procedures or
Regulations, 37%
Figure 10 provides information on the main topics by safety recommendation, according to the taxonomy used
in the European Safety Recommendation Information System (SRIS). The majority, almost 80 percent of safety rec-
ommendations that EASA received in 2017 make proposals for aircraft or aviation-related equipment/ facilities
[39%, 21 safety recommendations] and procedures or Regulations [37%, 20 safety recommendations].
Only 24 percent of the safety recommendations that EASA received in 2017 addressed safety topics in the fields
of “Personnel” and “Quality Management System/Safety Management System/State Safety Plan [QMS/SMS/SSP]”,
with 17 percent and 7 percent respectively.
5 Note: data in Figure 10 contains also safety topics estimated by EASA for 10 safety recommendations not recorded in EU SRIS by the
SIAs of the MS.
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 30
Among the actions taken in 2017, several key safety topics are outlined below with accompanying information
on the action that the Agency took. The description highlights the safety issues that were underlined by the safe-
ty recommendations, together with the actions taken by the Agency in response. Furthermore, the follow-up of
safety recommendations that were classified as being of Global Concern (SRGC) and Union-wide Relevance (SRUR)
are also specially taken into account.
Investigations containing an analysis of actual emergency evacuations are important to gather ‘lessons learned’,
which in turn should enhance passenger safety in the event of an emergency evacuation. The aftermath of inves-
tigations and their safety recommendations are often classified as being of Global Concern (SRGC).
In 2017, and in previous years, several recommendations have been addressed to EASA on safety equipment and
‘passenger briefing’ [material, emergency exit briefing or Passenger emergency exit seating], for example:
Ensure that all operators performing domestic flights provide the safety briefing for the emergency
cases stipulated by CAT.OP.MPA.170 PASSENGER BRIEFING of Commission Regulation (EU) No 965/2012
also in the official language of the state in which the flight is operated. [ROMN-2017-002]
On aircraft that are parked and have passengers on-board, require cabin crew to be evenly distribut-
ed throughout the cabin and in the vicinity of floor-level exits, in order to provide the most effective
assistance in the event of an emergency. [UNKG-2017-028]
Ensure safety briefings emphasise the importance of leaving hand baggage behind in an evacuation.
[UNKG-2014-005]
Develop recommendations on the content of visual aids such as safety briefing cards or safety videos
that information be included on how passengers, including those with young children, should use the
escape devices. [UNKG-2014-006]
Consider the need for expanded information and checking the understanding of emergency evacua-
tion procedures of passengers who are expected to act in an emergency evacuation. [SWED-2011-011]
Require modifications to life vest stowage compartments or stowage compartment locations to im-
prove the ability of passengers to retrieve life vests for all occupants. [UNST-2010-095]
Regulate the operation of interphone handsets, including during emergency communications, so that
it is standardised irrespective of aircraft type. [UNKG-2017-025]
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 31
EASA Actions:
In general, cabin crew duties, responsibilities and procedures, such as Passenger briefing procedures and surveil-
lance of the passenger cabin et.al., addressed under Commission Regulation (EU) No 965/2012 of 05 October 2012
‘laying down technical requirements and administrative procedures related to air operations’, are expected to
provide an acceptable level of safety in the event of an emergency evacuation.
(A) Based on the context of the above-listed safety recommendations concerning passenger briefing, the Agen-
cy evaluated this safety issue within the framework of rulemaking tasks RMT.0516 and RMT.0517 ‘Updating Air
OPS Regulation (EU) No 965/2012 Implementing Rules and related Acceptable Means of Compliance (AMC) &
Guidance Material (GM)’.
The outcome of the evaluation is contained in EASA Executive Director (ED) Decision 2017/008/R, which was
published on the Agency’s web site on 30 March 2017. The ED Decision introduces:
Amendments to AMC1 CAT.OP.MPA.170 on ‘passenger briefing’ which now states that, before take-
off/landing, passengers should be briefed on/reminded of the correct stowage of hand baggage and
the importance of leaving hand baggage behind in case of evacuation [see points (a)(1)(iii) and (c)(1)
(iii)]. [UNKG-2014-005]
New guidance material GM2 CAT.OP.MPA.170 ‘Passenger briefing — SAFETY BRIEFING MATERIAL’ ad-
dressing both the safety briefing card and the safety video, and providing guidance on the minimum
content, as applicable to the aircraft and the type of operation. Inclusion of information on how pas-
sengers, including those with young children, should use the escape devices is addressed in point (f)
(7)(iv). [UNKG-2014-006]
New guidance material addressing the need for a clear depiction for passengers of emergency escape
routes from the cabin via the wing to the ground for aircraft with overwing exits (see point (f)(6)(iii) of
GM2 CAT.OP.MPA.170 ‘Passenger briefing — SAFETY BRIEFING MATERIAL’). [UNKG-2002-043]
New guidance material GM1 CAT.OP.MPA.170(a) ‘Passenger briefing’ to recommend instructions that
the passenger(s) should receive through an ‘exit briefing’. It also recommends verification by the cabin
crew that the passenger has understood the instructions received. [SWED-2011-011]
(B) The following actions have taken place related to the safety recommendations addressing standards for
safety equipment:
The Agency has collaborated with FAA to revise the minimum performance standards for aircraft
seating systems, (European) Technical Standard Order (E)TSO-C127a, by adding new life vest retrieval
requirements that take into account this safety recommendation. Consequently, the FAA has published
TSO-C127b dated 06.06.2014. The Agency has also revised ETSO-C127 (from issue ‘a’ to issue ‘b’) under
rulemaking task RMT.0206. The associated ED Decision 2016/013/R amending CS-ETSO (amendment
11) entered into force on 5 August 2016. [UNST-2010-095]
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 32
So far, investigations of these occurrences have focused on the review of the certification requirements for the
passenger cabin with respect to operational procedures, and have highlighted the importance of providing the
crew with adequate training on the aircraft type.
A study about turbulence in air transport was carried out by the BEA in 2008. The study analysed accidents and
incidents involving CAT operators between 1995 and 2007 that had encountered atmospheric turbulences dur-
ing the cruise(excluding events generated by wake turbulence).
In this context, the BEA identified various actors and addressed aspects of air traffic control, forecasting mete-
orological issues and communication of meteorological information via data link. One safety recommendation
was addressed to EASA.
Recent investigations and their recommendations underline the importance of providing the crew with ade-
quate information and training on the aircraft type to identify and manage anomalies in the air data information.
Accident involving a Bombardier CL-604 and an AIRBUS A380 on 07 January 2017 during cruise flight
above the Arabian Sea, Indian Ocean.
and
Two serious incidents involving an AIRBUS A330 (one event on 03 May 2017 (registration 9M-XXS)
during cruise flight in Malaysian airspace and one on 17 June 2017 (registration B-5926) during cruise
flight at FL390 about 260nm northeast of Tyumen (Russia).
EASA Actions:
With the increase of the overall volume of air traffic and enhanced navigation precision, wake turbulence en-
counters in the en-route phase of flight above 10 000 feet (ft) mean sea level (MSL) have progressively become
more frequent in the last few years. Therefore, on 22 June 2017 the Agency published EASA SIB No.: 2017-10
‘En-route Wake Turbulence Encounters’ to enhance the awareness of pilots and air traffic controllers of the risks
associated with wake turbulence encounters in the en-route phase of flight and provide recommendations and
advice with the purpose of mitigating the associated risks.
6 An aeroplane upset is a condition where an aeroplane unintentionally exceeds the flight parameters experienced during normal
flight. Upsets that are not corrected in a timely manner are likely to lead to loss of control in-flight (LOC-I).
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 33
Since March 2016, the Agency has has been conducting a project on ‘weather information to pilots’. The objec-
tive is to propose means to maximise in-flight safety through enhanced meteorological situational awareness in
the cockpit and, therefore, to reduce the risk of flying in severe weather conditions. The resultant EASA strategy
paper is published on the EASA website [https://www.easa.europa.eu/easa-and-you/air-operations/weather-
information-pilots], and concludes with nine recommendations to facilitate and promote enhanced situational
awareness in the cockpit with regard to the weather. The strategy paper recognises the potential benefits of
additional situational awareness that may follow from the provision of in-flight weather updates, for strategic
planning purposes, to the cockpit via emerging technologies such as Electronic Flight Bags. The recommenda-
tions and subsequent actions from the strategy paper aim to more accurately quantify and assess the benefits
and challenges in order that appropriate safety promotion and or regulatory material can be developed.
The Agency intends to monitor data distribution through the use of datalink as part of the Single European Sky
ATM (Air Traffic Management) Research (SESAR) work programme. As the concept and technology improves, the
Agency will develop the necessary regulatory material, as appropriate.
(C) Make the crew fit: provide Loss of Control Prevention and Recovery Flight Cew Training/ Cabin Crew Pas-
senger Management
The Agency published Opinion No 06/2017 ‘Loss of control prevention and recovery training’ from rulemak-
ing task RMT.0581 on 29 June 2017. This Opinion introduces mandatory upset prevention and recovery training
(UPRT), testing and checking at various stages for pilots who intend to pursue a pilot career with a commercial
airline.
The recommendations stemming from 2 serious incidents which occurred in Sweden (one occurrence
consists of two separate incidents, with the second having been a consequence of the first)
address ‘Runway Surface Condition Assessment and Reporting’ [SWED-2017-006], and operations/
performance of aircraft ‘on surfaces contaminated with slush or water’ [SWED-2017-005].
One safety recommendation was received regarding methods for aircraft ground de-icing and post-
de-icing checks [SWED-2017-014].
All three safety recommendations are identified as being of Global Concern (SRGC).
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 34
EASA Actions:
In order to maintain a high and uniform level of civil aviation safety in the Union while pursuing the objective of
an overall improvement in aerodrome safety, the Commission Regulation (EU) No 139/2014 of 12 February 2014
‘laying down requirements and administrative procedures related to aerodromes’, has been published. Reflecting
the state of the art and the best practices in the field of aerodromes while taking into account the applicable
International Civil Aviation Organisation Standards and Recommended Practices.
EASA has taken the following actions in relation to runway surface condition assessment and reporting:
The Agency has been actively supported the development of ICAO standards on this topic. With
Amendment 13B to Annex 14 and Amendment 1 to PANS-Aerodromes, ICAO introduced provisions
regarding the use of a global reporting format for assessing and reporting runway surface conditions,
with the objective to link better assessed runway surface conditions with aircraft performance. These
provisions are required to be implemented by November 2020.
In order to transpose this amendment to Annex 14, the Agency introduced rulemaking task RMT.0704
“Runway Surface Condition Assessment and Reporting” in the European Plan for Aviation Safety
(EPAS) 2017-2021, with a view to amending Regulation 139/2014. The task has been launched on 13
September 2017 with the publication of the terms of reference and the rulemaking task is planned
to finish by second quarter of 2020. The safety recommendation SWED-2017-006 will be considered
within the context of this RMT.
EASA has taken the following actions in relation to generic performance corrections for aeroplane
operations on surfaces contaminated with slush or water [SWED-2017-005]:
—— Rulemaking task RMT.0296 ‘Review of aeroplane performance requirements for CAT operations’
was launched by EASA on 9 June 2015 with the publication of the terms of reference. The
associated notice of proposed amendment NPA 2016-11 was published on 30 September 2016. It
includes proposals on standards for runway surface condition reporting, airworthiness standards
for landing performance computation at time of arrival and an in-flight assessment of landing
performance at time of arrival. The NPA takes into account the following recommendations made
in the 2013 European Action Plan for the Prevention of Runway Excursions (EAPPRE):
›› Establish and implement one consistent method of contaminated runway surface condition
assessment and reporting by the aerodrome operator for use by aircraft operators. Ensure the
relation of this report to aircraft performance as published by aircraft manufacturers.
›› It is recommended that aircraft operators always conduct an in-flight assessment of the landing
performance prior to landing. Note: Apply an appropriate margin to these results. The deliverable
for RMT.0296, an EASA Opinion, is planned to be published in the second quarter 2018.
In addition, the Agency published Safety Information Bulletin SIB No.: 2018-02 on 18 January
2018 concerning ‘Runway Surface Condition Reporting’. The aim of this SIB is to enhance
awareness of air operators and pilots of the risks associated with incorrect or unreliable runway
surface condition reporting, inform about on-going rulemaking actions on the matter and
provide recommendations for the purpose of mitigating the associated risks.
Regarding the safety recommendation on aircraft ground de-icing and post de-icing checks [SWED-2017-014],
the Agency will consider, in collaboration with the ground de-icing industry community, whether there is a need
to re-inforce the established procedures through safety promotion channels, to remind the service providers of
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 35
the importance of applying the procedures correctly. This will inevitably include an evaluation of the suitability
of the recommended methodologies.
EASA Actions:
The Agency initiated a rulemaking task related to Helicopter Emergency Medical Service (HEMS) operations. The
specific objectives of this rulemaking task RMT.0325/0326 ‘HEMS performance and public interest sites’ are the
following:
(a) To issue an efficient and proportional regulation by adapting HEMS requirements to mountain opera-
tions and rescue operations other than search and rescue.
(b) To maintain a high aviation safety level by reviewing the provisions related to flights to/from a PIS lo-
cated in a congested area.
(c) To maintain a high aviation safety level by reviewing requirements related to HEMS flights by day or
night, regarding equipment, training, minima, operating/hospital site illumination.
(d) To issue an efficient and proportional regulation by adapting regulations in order to ensure that limit-
ed certifying staff authorisations can be issued to the best suited personnel regarding the release of
the aircraft following line maintenance on helicopter sling, hoisting, or other cabin equipment.
In 2017, a Notice of Proposed Amendment was under development through RMT.0325/.0326 for publication in
the first quarter of 2018.
Since 21 April 2017 Annex VIII (Part-SPO) of the Commission Regulation (EU) No 965/2012 on Air Operations
has been applicable for specialised operations (SPO) with helicopters. As per definition, SPO may be of non-
commercial or commercial nature.
According to SPO.OP.230, before commencing a specialised operation, the operator shall conduct a risk
assessment, assessing the complexity of the activity to determine the hazards and associated risks inherent
in the operation and establish mitigating measures. Based on the risk assessment, the operator shall establish
Standard Operating Procedures (SOPs) appropriate to the specialised activity and helicopter used (for example
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 36
refer to SPO.SPEC.HESLO.100). This should take into consideration the risks related to the helicopter’s design
during operations with a suspended load. The associated SOPs should include suitable operational defences to
ensure that the equipment is installed and operated safely, also taking into account any instructions prescribed in
the manufacturer’s manuals. The SOPs should specify the training for crew members and task specialists required
to perform their tasks, as well as the responsibilities and duties of crew members and task specialists.
Furthermore, in 2017 the Agency took the following actions to enhance the safety of helicopters
performing CAT and specialised operations:
The Agengy issued Airworthiness Directive 2017-0025 on 14 February 2017 to mandate specific
inspections and a modification of the attaching means of the rescue hoist handle of the rescue hoist
support for specific installations on AW109SP. The manufacturer is also considering the introduction
of a protective cover as a design improvement. [SWTZ-2016-528];
The Agency has approved the Supplemental Type Certificate (STC) No. 10060852 and EASA STC
No. 10061056 to certify, under certain limitations, a crash resistant fuel system for the AS350B3e
rotorcraft. This configuration will be progressively introduced by the manufacturer in the newly
produced rotorcraft. [ASTL-2015-030];
The management of the carriage of passengers can often increase the workload of the pilot and can
cause a distraction during a flight. On 15 September 2017, the Agency issued SIB No.: 2017-15 ‘Carriage
of Passengers on Helicopters’. This SIB promotes two EHEST training videos on Passenger Management7
by way of raising the awareness of helicopter pilot licence holders, National Airworthiness Authorities,
Air Training Organisations and staff involved in helicopter operations;
EASA published updated Certification Specifications and Acceptable Means of Compliance for Large
Rotorcraft (CS-29 Amendment 4). The specific objective is to update the certification specifications in
order to maintain a high level of safety and to provide cost-efficient rules harmonised with those of
international partners. This Decision amends AMC 29.351; to reflect certification experience and to
ensure a consistent and safe approach to establishing structural substantiation; to adopt AC 29-2C —
Change 4, published by FAA in May 2014. Most changes adopted in this AC were previously developed
jointly by FAA and EASA however some minor differences remain; to create new Certification
Specifications on High-intensity radiated fields (HIRF) (CS 29.1317) and lightning (CS 29.1316). This will
better reflect existing certification practice and will replace reliance on ageing JAA interim policies;
The publication of the EHEST Pre-departure Risk Assessment Checklist – This tool has been developed
to allow pilots and technicians to evaluate the actual risk of the flight or of the maintenance. The tool is
based on the PAVE (Pilot, Aircraft, environment, External pressure) check list and adapted for the type
of flight (HEMS, leisure, training, passenger, etc.). The final purpose is to make pilots and technicians
aware that simple factors, when combined, can raise the total risk significantly, eventually resulting in
a situation where the helicopter should not flight unless some of the risk factors are mitigated;
The publication of the new Edition of the EHEST Helicopter Flight Instructor Guide based on
a manual developed by the Australian Civil Aviation Safety Authority (CASA) and other international
organisations – This edition features a series of further changes and improvements such as chapter
reorganisation matching the EASA Part FCL syllabus requirements. The Guide covers the Teaching and
Learning syllabus of the Flight Instructor Course including pedagogical theory, human performance,
threat and error management together withricher content addressing training programme
7 All EHEST material was transferred in 2017 to the EASA Safety Promotion website.
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 37
development and administration. In addition, it covers the PPL(H) Air Exercises with lesson objectives
added as a checklist for instructors.
Simulation of uncontrolled flight conditions due to „Loss of tail rotor effectiveness” (LTE) to require for
helicopter pilots a flight simulation training including a sufficient and dedicated training on „Loss of
tail rotor effectiveness” (LTE) and recovery actions for all training, examination and proficiency check
flights (on appropriate and certified simulators). [AUST-2017-001];
To standardise the theoretical and practical training on the LTE phenomenon among the various
helicopter training programs for obtaining the LAPL(H), PPL(H), CPL(H), ATPL(H) and FI(H) licenses.
This training should benefit the level of complexity and responsibility associated with each license.
[SPAN-2017-010];
To amend the regulations so as to authorise, in the context of FCL, the use of types of FSTD simulators
with a lower level than FFS during smoke or emergency descent training on Cessna 525B aeroplane
types and, more generally, on complex HPA aeroplanes. [FRAN-2017-001];
To identify exercises in flight training that might entail an increased risk factor and to issue guidance
material (GM) for the practical execution of these. [SWED-2017-001];
To ensure that the manufacturer improves the awareness of the flight crews of the Airbus A320 fami-
ly and provide them training to overspeed situations. [SWTZ-2017-524].
EASA Actions:
In 2017, in the wake of several safety recommendations addressing loss of control in flight, the Agency published
opinion No 06/2017 on “loss of control prevention and recovery training”. This opinion introduces mandatory
UPRT and testing and checking at regular intervals for pilots who intend to pursue a pilot career with a commer-
cial airline. In support of the new standards, appendix 9 — Training, skill test and proficiency checks for MPL,
ATPL, type and class ratings, and proficiency checks for IRs is amended to include UPRT. It now covers procedures
requiring a high workload in a short time frame, such as going around with all engines operating. In addition,
opinion No 05/2017 amending Commission Regulation (EU) No 1178/2011 related to flight crew licensing (FCL)
coordinates Part–FCL safety and regulatory issues and takes benefit from new learning objectives (LOs) for ATPL,
MPL, CPL and IR for aeroplanes and helicopters developed in ED Decision 2016/008/R related to performance-
based navigation (PBN) operations.
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 38
In response to recommendations to improve flight simulators fidelity, including the need to improve training
on the latest UPRT amendments and to also cover some specific manoeuvres such as rotorcraft loss of tail rotor
effectiveness, the Agency took all inputs into consideration in the Rulemaking Task RMT.0196 ‘Update of flight
simulation training devices requirement’, which was launched with the objective to adapt the requirements for
Flight Simulator Training Devices (CS-FSTD) to the training need.
All EHEST Training and Education material was transferred in 2017 to the EASA Safety Promotion website. Refer
in particular to:
EHEST Helicopter Flight Instructor Guide, a comprehensive and fully illustrated Helicopter Flight
Instructor Guide;
EHEST Leaflet HE 12 Helicopter Performance: This leaflet discusses the factors affecting helicopter
performance. It then provides pilots with guidance, tips and techniques to ensure safe operations;
EHEST Leaflet HE11 Training and Testing of Emergency and Abnormal Procedures in Helicopters:
This leaflet provides guidance and safety tips for pilots, instructors and examiners on the subject of
training and testing of emergency and abnormal procedures;
EHEST Leaflet HE 10 Teaching and Testing in Flight simulation training Devices (FSTD): This leaflet
provides guidance to helicopter instructors and examiners on how to conduct aircrew training and
testing in Flight Simulator Training Devices (FSTDs), and provides basic principles on how to get the
best use of this invaluable training asset;
EHEST Leaflet HE 6 Advantages of Simulators in Helicopter Flight Training: This leaflet emphasises
the advantages of simulators in helicopter flight training. The document presents the various
helicopter flight simulation training devices available and reviews the additional training and safety
benefits related to recent technological and regulatory developments;
EHEST Leaflet HE 5 Risk Management in Training: This leaflet provides tools and methods to improve
risk management in training;
EHEST Leaflet HE 1 Safety Considerations: addresses Degraded Visual Environment (DVE), Vortex Ring
State (VRS), Loss of Tail Rotor Effectiveness (LTE), Static & Dynamic Rollover and Pre-flight Planning
Checklist.
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 39
These safety recommendations address specific airworthiness aspects for small aeroplanes, for example:
To modify the design of the APEX DR400 brake system after two cases of wing fire of the wooden
structure on the ground as a result of overheating of the brake disc [NETH-2017-001 (SRGC)] or;
To demand a mandatory warning system to detect overheat in the battery and warn the pilot for glid-
ers fitted with Electric Sustainer (FES) systems as recommended in UNKG-2017-018 (SRUR).
It is worth mentioning that three safety recommendations are classified with Global Concern (SRGC) and three
safety recommendations are classified with Union-wide Relevance (SRUR). One recommendation with SRUR and
SRGC character is addressing a proposal concerning the certification of unmanned aircraft and is specifically dis-
cussed in the next safety topic [ref. chapter 4.7].
EASA Actions:
In general, the Agency agreed with the intent of all received safety recommendations in this scope. All request-
ed actions have been properly addressed, either together with the Type Certificate Holder (TCH) or by issuing an
Airworthiness Directive.
The safety recommendation NETH-2017-001 (SRGC) is being addressed with the TC holder to improve
the pedal design mechanism and avoid misuse of the brakes and;
The safety recommendation UNKG-2017-018 (SRUR) has been closed with AD 2017-0167-E, which
requires the removal of the FES battery pack or an EASA approved modification of the FES batteries
before the next flight, Aircraft Flight Manual (AFM) improvement and updating the Flight Control
Unit (FCU) software with regard to the warnings presented to the pilot and modifications to the FES
battery design.
General Aviation is a high priority for EASA and the Agency is dedicating effort and resources towards creating
simpler, lighter and better rules for General Aviation. Recognising the importance of General Aviation and its
contribution to a safe European aviation system, EASA in partnership with the European Commission and other
stakeholders has created a Road Map for the Regulation of General Aviation (GA). EASA recognises that existing
regulations impacting General Aviation may not necessarily be proportional to the risk exposure of GA. Some
of this regulation was intended to cover more demanding (in terms of safety) activities, such as commercial air
transport operations.
Following the objective to simplify the airworthiness certification and oversight system for small and low-risk
General Aviation, EASA has re-written CS-23 certification rules for small aircraft. The reorganised CS-23 remove
design limitations for manufacturers and thus open the way to innovation.
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 40
The Air Accident Investigation Unit Belgium (AAIU-BE) issued four safety recommendations related to UA in 2017
that addressed the NAA and design organisation concerning the review and or modification of requirements for
design and operations following an accident investigation of a UA that took-off in Belgium and crash landed in
northern France due to a series of communication interruptions between the ground station and the aircraft that
caused the autopilot to initiate the automatic landing procedure, which ultimately failed.
In 2016, 5 safety recommendations were issued by the Italian – ANSV stemming from a study related to “Inter-
ference of unmanned aircraft in the Italian airspace. The recommendations were concerned associated risks for
the safety of the flight of manned aircraft”. They addressed the Italian National Aviation Authority and covered
the safety topics of aircraft certification, aircraft operations, oversight and auditing, design, production and
manufacturing.
EASA is following-up all actions as the majority of these safety recommendations are classified as having Global
Concern (SRGC) and Union-wide Relevance (SRUR).
EASA Actions:
A new regulatory framework is currently being developed by the European Commission and EASA to accommo-
date the operation of all Unmanned Aircraft (UA) in the EU:
In accordance with Regulation (EC) No 216/2008 (hereinafter referred to at the ‘Basic Regulation’),
the regulation of unmanned aircraft systems (UAS) with a maximum take-off mass (MTOM) of less
than 150 kg falls within the competence of the European Union (EU) Member States (MSs). This leads
to a fragmented regulatory system that hampers the development of a single EU market for UAS and
cross-border UAS operations. A new proposed Basic Regulation (hereinafter referred to as ‘the new
Basic Regulation’), currently under discussion between the Council, the European Commission, and
the European Parliament, aims to solve this issue, by extending the competence of the EU to regulate
all UAS regardless of their MTOM.
In view of the adoption of this planned ‘new Basic Regulation’, the Agency:
Published a Technical Opinion (Opinion of a technical nature) in December 2015 which proposed a reg-
ulatory concept which is operation centric, proportionate, risk- and performance-based. It includes
the establishment of three categories of UA operation (Open, Specific, Certified) which are based on
the risk posed by the operation;
Started in 2016 a Rulemaking task RMT.0230 and published in August 2016 a ‘Prototype’ regulation for
the ‘Open’ and ‘Specific’ categories;
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 41
Published in May 2017 the Notice of Proposed Amendment 2017-05 ‘Introduction of a regulatory
framework for the operation of drones - Unmanned aircraft system operations in the open and spe-
cific category’;
Published on 6 February 2018 Opinion 01/2018 entitled ‘Unmanned Aircraft System (UAS) operations
in the ‘open’ and ‘specific’ categories’. The objective of this Opinion is to create a new regulatory
framework that defines measures to mitigate the risk of operations in the:
1. ‘Open’ category, through a combination of limitations, operational rules, requirements for the
competency of the remote pilot, as well as technical requirements for UAS, such that the UAS
operator may conduct the operation without prior authorisation by the competent authority,
or without submitting a declarationand;
2. ‘Specific’ category, through a system that includes a risk assessment being conducted by the
UAS operator before starting an operation, or an operator complying with a standard scenar-
io, or an operator holding a certificate with privileges.
4. contribute to addressing citizens’ concerns regarding security, privacy, data protection, and environ-
mental protection.
Thus, the safety risk associated with a UA falling onto third parties or properties is taken into account in the de-
velopment of the regulations. The magnitude of the risk depends both on the type of operation performed and
on the characteristics of the UA. Different means can be used to mitigate this risk, at the operational and design
levels. For an unmanned helicopter, an autorotation function is one of those mitigations.
In Addition, the Agency has developed a Safety Risk Portfolio for UAS with the support of the EASA task force
and Collaborative Analysis Group (CAG). Furthermore, in the UAS domain, there is a large strategic EPAS action
that will cover all the various safety issues identified in the safety risk portfolio.
Lay out the measures required so that aircraft equipped with a ballistic parachute reflect this in the
flight plan as part of point SERA.4005, Contents of a flight plan, “Emergency and survival equipment”.
[SPAN-2017-038];
2017 Annual Safety Recommendations Review
Overview of key safety topics processed and actions carried out in 2017 PAGE 42
Lay out the measures required to initiate, at the European level, an awareness, information and
training campaign directed at general aviation users and emergency services personnel on the
existence, identification, location and deactivation of ballistic parachutes in the event of an accident
or incident. [SPAN-2017-040];
Liaise with International Civil Aviation Organization (ICAO) to include standards for the design
(conspicuity, coloration, visibility, and content) in the installation of ballistic parachute systems.
This should include, as compulsory for pyrotechnical systems, specifications of the routing of the
components of the system and a thermal exposure indicator to enable emergency responders to
quickly and safely disable the system, and fully alert persons to the hazards and the danger areas on
the aircraft. [SPAN-2017-042];
EASA had already received three safety recommendations in 2015 and one in 2014 addressing the need for better
means of identification for aircraft equipped with Ballistic Parachute Recovery Systems (BPRS), in order to alert
rescue or other personnel at the scene of an accident and mitigate the risk to first responders during a rescue
operation. All of them have been closed with final replies.
EASA Actions:
Ballistic Parachute Recovery Systems (BPRS) for EASA certified aircraft are regulated in the Certification
Specifications for Light Sport Aeroplanes, CS‑LSA, which requires compliance of the BPRS with the ASTM standard
F2316-12 (‘Airframe Emergency Parachutes for Light Sport Aircraft’). The same reference standard can be applied
to other small aeroplanes category certified by EASA through a Special Condition.
EASA holds that the installation of placards complying with this standard provide an adequate level of safety, and
that the same standard is also available for use on aircraft not certified by EASA.
In addition, EASA intends to issue an Opinion to amend Commission Implementing Regulation (EU) No 923/2012
concerning the common rules of the air (SERA), as well as of the related Acceptable Means of Compliance (AMC)
and Guidance Material (GM) so that aircraft equipped with a BPRS reflect this in the flight plan and emergency
equipment list as recommended in SPAN-2017-038.
EASA will also examine how to improve the awareness emergency services personnel as to the BPRS
identification, location and deactivation in the event of an accident, as recommended by SPAN-2017-040.
CHAPTER 0
CHAPTER 1
CHAPTER 2
CHAPTER 3
CHAPTER 4
CHAPTER 5
CHAPTER 6 Conclusions
ANNEX A.
ANNEX B.
ANNEX C.
2017 Annual Safety Recommendations Review
Conclusions PAGE 44
CONCLUSIONS
In 2017, EASA received a total of 42 safety recommendations that:
Originated from 1 study, 1 transmittal letter and 30 different occurrences (20 accidents, 8 serious in-
cidents and 2 incidents);
90 percent of the received safety recommendations [38 total] were issued by EASA Member States.
Among those, 16 were classified as safety recommendations having Union-wide Relevance (SRUR);
Were mostly related to aircraft or aviation related equipment or facilities [39%, Aircraft/Equipment/
Facilities] and to procedures or regulations [37%, Procedures/Regulations].
This number of safety recommendations EASA received in 2017 is about the half of those received in 2016, and
by far the lowest in the last 8 years. Although this can be the result of a number of factors, one contributing
element is certainly due to the fact that no single investigation report was issued in 2017 containing a large batch
of safety recommendations addressed to the Agency as it was the case in the previous years.
In response, the Agency in 2017 produced 157 replies to 147 safety recommendations:
86 of them were final replies (closing safety recommendations) with more than 48% carrying an
agreed assessment, and 35 percent with partial agreement;
The remaining 71 updating replies provided information on the progress of the actions decided upon
by the Agency and for which the relevant activities were not yet completed;
85 percent of the final responses provided by EASA and assessed by the originator of the recommen-
dation were “adequate” or “partially adequate”.
The number of replies provided in 2017 was consistent with the number of replies provided in 2016. In
particular, the volume of 86 closing replies sent in 2017 allowed a significant reduction in the number of safety
recommendations currently open for the Agency.
Furthermore, the actions taken by the Agency in response to the safety recommendations outlined several of
the key safety topics that are currently part of the EPAS and are included in the safety risk management process.
CHAPTER 0
CHAPTER 1
CHAPTER 2
CHAPTER 3
CHAPTER 4
List of 2017 Safety
CHAPTER 5
CHAPTER 6 Recommendations
ANNEX A.
Replies
ANNEX B.
ANNEX C.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 46
Argentina
Registration Aircraft Type Location Date of event Event Type
SAAB
LV-CEJ Caltaruna, Province of Rio Negro 18/05/2011 Accident
340
On 18 May 2011, the pilot in command (PIC) and the crew - composed of the co-pilot (COP) and cabin crew mem-
bers (CCM) - initiated the flight OSL 5428 from Rosario International Airport (ROS) in the province of Santa Fe at
20:35, the final destination being the Comodoro Rivadavia International Airport (CRD), in the province of Chubut.
The flight had scheduled intermediate stopovers at Cordoba International Airport (COR), Medoza (MDZ), and Neu-
quén (NQN), according to the company’s plans. The company designated aircraft Saab 340A, with registration
number LV-CEJ, for the flight.
After having made the intermediate stopovers in Cordoba (COR) and Mendoza (MDZ), the pilot landed the air-
craft at the airport in Neuquén at 22:20. After refuelling and carrying out the planned dispatch, the crew and 19
passengers (18 adults and one minor) on board, prepared to make the last leg of the flight OSL 5428, from Neu-
quén Airport (NQN) to the final destination: Comodoro Rivadavia International Airport (CRD). The flight took off
at 23:05.
After the take-off, the aircraft started to climb AWY T 105, to reach FL 190, in accordance with the flight plan. Af-
ter flying for 24 minutes, the pilot levelled the aircraft at 17800 ft, and remained at this level for approximately 9
minutes. Due to the fact that the meteorological conditions at this level caused icing, the technical crew descend-
ed to FL (flight level) 140. Shifting to FL 140 took five minutes. During this stage of the flight the icing conditions
steadily worsened.
By the time the aircraft had reached FL 140, the icing conditions were severe. The aircraft flew for approximate-
ly two minutes with a straight and level flight attitude, increasing the accumulation of ice.
Then the aircraft completely lost lift, which resulted in a loss of control, and the subsequent entry into abnormal
flight attitude. The aircraft plunged towards the earth and impacted the ground, which resulted in a fire. Every-
one on board perished and the aircraft was destroyed.
It is recommended to the Aviation Authorities to consider implementing changes to the compliance requirements
with regard to the crew’s instruction and training, related to flight manoeuvre that are carried out during oper-
ations with a large angle of attack or with abnormal flight attitudes.
Consider making the following manoeuvres obligatory during the training and the licensing inspection (in flight
simulators), in accordance with the aircraft:
The newly developed advanced UPRT course, which is to be mandated as an addendum to ATP and MPL
training courses and also to serve as a prerequisite prior to commencing the first type rating course in
multi-pilot operations, is an important step towards enhancing a commercial pilot’s resilience to the psy-
chological and physiological aspects often associated with upset conditions.
In support of the new standards, the proposals place greater emphasis on the training of instructors in-
volved in the flight and synthetic training who are foreseen to deliver the various UPRT elements. EASA
proposes training up to the stall but does not propose post-stall training to be required in a full flight
simulator (FFS), due to the risk of negative transfer of training, and reiterates that existing flight simula-
tor training devices (FSTDs) may be used to facilitate UPRT.
In line with ICAO, the opinion and the decision mentioned above propose UPRT to proficiency during in-
itial and recurrent training.
Australia
Registration Aircraft Type Location Date of event Event Type
ROBINSON
VH-HWQ Bulli Tops, New South Wales 21/03/2013 Accident
R44
At about 1207 on 21 March 2013, a Robinson Helicopter Company R44 helicopter (R44), registered VH-HWQ,
landed at a grassed area adjacent to a function centre at Bulli Tops, New South Wales. Shortly after landing, the
helicopter was observed to simultaneously lift off, yaw right through 180° and drift towards nearby trees. The
helicopter struck branches of the trees before descending, impacting the ground nose low and rolling onto its
right side. A short time after coming to rest a fire started and engulfed the helicopter. The pilot and three pas-
sengers were fatally injured.
The ATSB recommends that the European Aviation Safety Agency take action to increase the number of hel-
icopters manufactured in accordance with the 1994 certification requirements for helicopters to include
a crash-resistant fuel system. [AO-2013-055-SR-030]
ATR
VH-FVR 47 km WSW of Sydney Airport 20/02/2014 Accident
ATR72
On 20 February 2014, a Virgin Australia Regional Airlines (VARA) ATR 72 aircraft, registered VH-FVR, operating on
a scheduled passenger flight from Canberra, Australian Capital Territory to Sydney, New South Wales sustained
a pitch disconnect while on descent into Sydney. The pitch disconnect occurred while the crew were attempting
to prevent the airspeed from exceeding the maximum permitted airspeed (VMO). The aircraft was significantly
damaged during the occurrence.
In accordance with the Transport Safety Investigation Act 2003 (the Act), the ATSB initiated an investigation into
the occurrence. On 15 June 2016 the ATSB released its first interim investigation report that contained the fol-
lowing safety issue:
Inadvertent application of opposing pitch control inputs by flight crew can activate the pitch uncou-
pling mechanism which, in certain high-energy situations, can result in catastrophic damage to the
aircraft structure before crews are able to react.
In the interest of transport safety, this safety issue was brought to the attention of the aircraft manufacturer (ATR)
and the wider aviation industry prior to completion of the investigation.
During the continued investigation of the occurrence, the ATSB has obtained an increased understanding of the
factors behind this previously identified safety issue. This increased understanding has identified that there are
transient elevator deflections during a pitch disconnect event that could lead to aerodynamic loads that could
exceed the strength of the aircraft structure.
The ATSB also found that these transient elevator deflections were not identified, and therefore not considered
in the engineering justification documents completed during the aircraft type’s original certification process. The
ATSB considers that the potential consequences are sufficiently important to release a further interim report pri-
or to completion of the final investigation report.
This second interim report expands on information already provided in, and should be read in conjunction with,
the interim report released on 15 June 2016 report and an update on the ATSB website on 10 June 2014. It is re-
leased in accordance with section 25 of the Act and relates to the ongoing investigation of the occurrence.
Readers are cautioned that the factual information and analysis presented in this interim report pertains only to
the safety issue discussed herein. The final report will contain information on many other facets of the investiga-
tion, including the operational, maintenance, training and regulatory aspects.
Readers are also cautioned that new evidence may become available as the investigation progresses that will
enhance the ATSB’s understanding of the occurrence. However, in order to ensure the veracity of the analysis of
the evidence leading to the identified safety issue, the ATSB engaged the UK Air Accidents Investigation Branch
(AAIB) to conduct a peer review. The AAIB conducted an analysis of the evidence relating to the safety issue and
concluded that their findings were consistent with those provided by the ATSB.
The ATSB recommends that EASA monitor and review ATR’s engineering assessment of transient elevator de-
flections associated with a pitch disconnect to determine whether the aircraft can safely withstand the loads
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 50
resulting from a pitch disconnect within the entire operational envelope. In the event that the analysis identifies
that the aircraft does not have sufficient strength, it is further recommended that EASA take immediate action to
ensure the ongoing safe operation of ATR42/72 aircraft. [AO-2014-032-SR-015]
Austria
Registration Aircraft Type Location Date of event Event Type
Der Zusammenstoß eines Motorflugzeugs der Type DV 20 „Katana“ mit einem Hubschrauber der Type AS 332
„Super-Puma“ ereignete sich um 09:53 Uhr, ca 1 NM NW des Flugplatzes Zell am See (LOWZ), als der Hubschrau-
ber auf dem Weg von Kaprun Richtung Berchtesgaden den Flugplatzbereich in Richtung NNE überquerte. Dabei
kreuzten einander die Flugwege des Hubschraubers und des Motorflugzeugs entlang der Platzrunde über dem
Südosthang der Schmittenhöhe. Das Motorflugzeug war zum Zeitpunkt des Zusammenstoßes im Steigflug, der
Hubschrauber befand sich kurz nach dem Übergang vom Steigflug in den Horizontalflug.
Als Unfallursachen konnten Sichtbehinderungen und komplexe psychologische Faktoren der Piloten der beiden
Luftfahrzeuge ermittelt werden, die das Erkennen des jeweils anderen Luftfahrzeugs und ein rechtzeitiges Aus-
weichen verhindert haben.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 51
[German] - Die Empfehlungen aus früheren Untersuchungen der UUB (bzw der FUS) zu einer Verwendung von
Zusammenstoßwarngeräten muss nach diesem Zusammenstoß und einem ähnlichen im November 2006 in der
Nähe von Wr. Neustadt eindringlich wiederholt werden. So sollten seitens der EASA die Voraussetzungen für die
Entwicklung von Vorschriften hinsichtlich Technik, Einbau und Zertifizierung von kostengünstigen Zusammen-
stoßwarngeräten für die Allgemeine Luftfahrt geschaffen werden. Es sollte auch eine mögliche Subventionierung
von Zusammenstoßwarngeräten überlegt werden (Aero-Club, Steuerbefreiung usw). Welches der verfügbaren (auf
gegenseitiger Funkabfrage bzw auf Transpondererkennung basierend) oder der in Erprobung befindlichen Systeme
(satellitengestützte Verarbeitung von Transpondersignalen, ADS-B, bzw RFID- Technologie in Verbindung mit GPS)
zum Einsatz kommen sollen, wird noch zu diskutieren sein. Testflüge mit allen derzeit erhältlichen Systemen durch
die UUB haben jedenfalls eindrücklich die Wirksamkeit solcher Systeme bestätigt. [SE/UUB/LF/02/2008]
DIAMOND
Sankt Pantaleon, Austria 20/09/2007 Accident
DA42
Der Pilot führte mit einem Passagier vom Flughafen Linz zum Flugplatz Krems/Gneixendorf mit dem gegenständ-
lichen Luftfahrzeug einen Privatflug durch. Beim Rückflug nach Linz fiel nach dem Start das rechte Triebwerk aus,
worauf der rechte Propeller in Segelstellung wechselte. Der Pilot wollte jedoch den Flug zum Zielflugplatz fortset-
zen. Da er Probleme bekam, den ausfallsbedingten Momentenausgleich zu bewerkstelligen und Flughöhe verlor,
versuchte er das rechte Triebwerk wieder zu starten, was jedoch misslang. Der rechte Propeller befand sich nun-
mehr nicht mehr in Segelstellung, wodurch das Luftfahrzeug stärker an Flughöhe verlor. Der Pilot entschloss sich
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 52
nahe St. Pantaleon/NÖ zu einer Notlandung. Im Endanflug bemerkte er eine etwa quer zur Anflugrichtung ver-
laufende Stromleitung, die er versuchte zu unterfliegen. Nach dem Aufsetzen überschlug sich das Luftfahrzeug.
Der Pilot wurde schwer, seine Passagierin leicht verletzt. Das Luftfahrzeug wurde zerstört.
The MD 88 aircraft took off from the Vienna Schwechat airport for Madrid on 31.07.2008 at 17:34 UTC. During
the take-off run immediately before becoming airborne, the left engine experienced loss of power and vibra-
tion, as well as a smell of burning, upon which the pilots shut the engine off. The pilots returned to the airport
and landed at 18:50. The aircraft was able to leave the runway under its own power.
The incident did not cause any personal injury, but the aircraft was seriously damaged.
The investigations by the Aviation Safety Investigation Authority showed that the unsecured valve stem on the
rim of tyre 2 has worked loose and the O-ring underneath was torn apart, which had the effect of deflating the
tyre. As a result, during the take-off run and past the point of decision, the tread of the tyre broke away, break-
ing off part of the water deflector attached to the left engine. The landing gear well was damaged, and then
parts of the tread were thrown into the left engine, which caused loss of power and vibration, after which the
engine was shut down.
A further consequence of the damage in the landing gear well was that no locking indication of the left-hand
landing gear could be observed, and as a precaution the subsequent landing was performed in accordance with
the “Landing with unsafe landing gear and possible evacuation of the aircraft” checklist.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 53
EASA, FAA: SE/SUB/ZLF/8/2013: Supplement to Certification Specifications 25 (CS-25), pressure displays of land-
ing gear tyres: Insufficient pressure in landing gear tyres can, as happened in this serious incident, cause massive
damage to the aircraft and result in flight situations with increased risk. On this topic also see, for example, the
accident report issued by the US National Transportation Safety Board (NTSB): Runway Overrun during Reject-
ed Takeoff, Global Exec Aviation, Bombardier Learjet 60, N999LJ, Columbia, South Carolina, September 19, 2008,
http://www.ntsb.gov/doclib/reports/2010/aar1002.pdf. CS-25 should be revised to specify installation of pressure
indicators for all landing gear tyres in the cockpit of commercial aircraft.
DIAMOND DA42
near Katzelsdorf 14/11/2006 Accident
ROBINSON R44
Pilot A startete am 14.11.2006, um 12:08 Uhr alleine als verantwortlicher Pilot mit dem Flugzeug A nach Sicht-
flugregeln am Flugplatz Wr. Neustadt-Ost (LOAN) mit dem Flugziel Flughafen Graz-Thalerhof (LOWG).
Zur gleichen Zeit flog Pilot B alleine als verantwortlicher Pilot mit dem Hubschrauber B nach Sichtflugregeln vom
Flugplatz Trieben (LOGI) kommend zum Flugplatz Wr. Neustadt-Ost (LOAN).
Flugzeug A kurvte vom Meldepunkt GOLF kommend im Steigflug nach rechts auf südwestlichen Kurs, Hub-
schrauber B kurvte im Horizontalflug nach links auf nordöstlichen Kurs. Gegen 12:12 Uhr kollidierten die beiden
Luftfahrzeuge ca. 2,1 km südwestlich von Meldepunkt GOLF des Flugplatzes Wr. Neustadt-Ost in ca. 1800-1900
ft MSL und stürzten ab.
Der Zusammenstoß ist auf das für ein Ausweichen der Luftfahrzeuge zu spätes Erkennen der Zusammenstoßge-
fahr zurückzuführen.
[German] - Auf die anlässlich der Untersuchung des Zusammenstoßes eines Motorflugzeuges Type DV20 und eines
Hubschraubers Type AS 332 am 05.03.2007, um 09:53 Uhr UTC im Platzbereich des Flugplatzes Zell am See, Salzburg
(GZ. BMVIT-85.121/0002-II/BAV/UUB/LF/2008) von der Unfalluntersuchungsstelle des Bundes herausgegebene Sicher-
heitsempfehlungen Nr. SE/UUB/LF/02/2008 wird nochmals hingewiesen:
SE/UUB/LF/02/2008 - Zusammenstoßwarngeräte
Die Empfehlungen aus früheren Untersuchungen der UUB (bzw der FUS) zu einer Verwendung von Zusammen-
stoßwarngeräten muss nach diesem Zusammenstoß und einem ähnlichen im November 2006 in der Nähe von Wr.
Neustadt eindringlich wiederholt werden.
So sollten seitens der EASA die Voraussetzungen für die Entwicklung von Vorschriften hinsichtlich Technik, Einbau
und Zertifizierung von kostengünstigen Zusammenstoßwarngeräten für die Allgemeine Luftfahrt geschaffen werden.
Es sollte auch eine mögliche Subventionierung von Zusammenstoßwarngeräten überlegt werden (Aero-Club, Steu-
erbefreiung usw).
Welches der verfügbaren (auf gegenseitiger Funkabfrage bzw auf Transpondererkennung basierend) oder der in
Erprobung befindlichen Systeme (satellitengestützte Verarbeitung von Transpondersignalen, ADS-B, bzw RFID-Tech-
nologie in Verbindung mit GPS) zum Einsatz kommen sollen, wird noch zu diskutieren sein.
Testflüge mit allen derzeit erhältlichen Systemen durch die UUB haben jedenfalls eindrücklich die Wirksamkeit sol-
cher Systeme bestätigt.
The European Plan for Aviation Safety (EPAS) 2016-2020 already addressed the issue under the umbrella
of the safety topic “general aviation safety”. The current version of the plan, (EPAS 2017-2021) includes
further actions for MAC/NMAC in general aviation, under the strategic safety area “General Aviation -
Preventing mid-air collisions”.
Am 18.05.2015 um ca. 12:30 Uhr ereignete sich ein Zusammenstoß zweier Luftfahrzeuge im Fluge. Dabei kollidi-
erte das Luftfahrzeug Antares 18T mit dem Luftfahrzeug DG 300 ELAN ACRO in einer Höhe von ca. 950 m über
dem Steinbruch nahe Unterklien. Das Luftfahrzeug DG 300 ELAN ACRO konnte vom Piloten nach der Kollision am
Flugplatz Hohenems notgelandet werden, das Luftfahrzeug Antares 18T stürzte dabei ab.
[German] - SE/UUB/LF/2/2016 ergeht an: Austro Control, Aero Club und EASA
Erweiterung der Mindestausrüstung:
Die Mindestausrüstung insbesondere von Segelflugzeugen, sowie von Motorsegelflugzeugen sollte in Hinblick auf
Kollisionswarnsysteme erweitert werden.
The latest version of the plan, European Plan for Aviation Safety (EPAS) 2016-2020 is further addressing
the issue under the umbrella of the safety topic “general aviation safety”. The next version of the plan,
(EPAS 2017-2021) will address and take further actions for MAC/NMAC in general aviation, under the um-
brella “General Aviation - Preventing mid-air collisions”.
[German] - SE/UUB/LF/3/2016 ergeht an: Austro Control, Aero Club und EASA
Sicherstellung der Funktionsfähigkeit von Kollisionswarngeräten:
Festlegung geeigneter Maßnahmen welche sicherstellen, dass ein eingebautes Kollisionswarnsystem gemäß seinen
Bestimmungen funktioniert. Im Besonderen, dass richtige und für andere Kollisionswarngeräte verwertbare Daten
ausgesendet und im Umkehrschluss auch empfangen werden.
[German] – SE/UUB/LF/4/2016 ergeht an: Austro Control, Aero Club und EASA
Wiederholte Aussprache der Sicherheitsempfehlung aus dem Jahre 2008 SE/UUB/LF/02/2008:
Die Empfehlung aus einem Unfallbericht aus dem Jahr 2005 (GZ. BMVIT-85.053/0008-FUS/2004) anlässlich eines Zu-
sammenstoßes in der Luft im Jahr 2004 zu einer Verpflichtung zum Betrieb von Zusammenstoßwarngeräten muss
nach diesem Zusammenstoß und einem sehr ähnlichen im November 2006 in der Nähe von Wr. Neustadt eindring-
lich wiederholt werden.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 57
Der Störungshergang wurde aufgrund der Aussage des Luftfahrzeughalters in Verbindung mit den Erhebungen
der Sicherheitsuntersuchungsstelle des Bundes Bereich Zivilluftfahrt wie folgt rekonstruiert:
Am 25.04.2009 wurde von einem nach EASA Part MF genehmigten Instandhaltungsbetrieb ein Notfunksender
der Type ACK E-01 rechts neben dem Fahrwerkskasten in das Motorsegelflugzeug Ventus cM eingebaut. Der Not-
funksender ACK E-01 ist das Vorgängermodel des ACK E-04, welcher von der Halterung mit diesem ident ist. Das
Einbaudatum des Notfunksenders ACK E-04 wurde seitens des Luftfahrzeughalters mit dem Datum 29.12.2011
angegeben. Der letzte Jahrestest des Notfunksenders gem. den Herstelleranweisungen konnte nicht rekonstru-
iert werden. Am 20. April 2015 wurde der Notfunksender (ELT) ACK E-04 im Zuge einer Umrüstung auf ein
alternatives Gerät aus dem Motorsegelflugzeug ausgebaut. Dabei konnte festgestellt werden, dass das Gehäuse
der Notfunksender Batterie teilweise geschmolzen war. Die Halteplatte, sowie die Struktur des Motorsegelflug-
zeuges wiesen keine Beschädigungen auf. Der genaue Zeitpunkt, wann die Beschädigung entstand, konnte nicht
rekonstruiert werden.
Der Isolationskörper der Steckverbindung bzw. die Steckverbindung zwischen thermischen Schaltelement und Kon-
taktfeder sollte so gewählt werden, dass ein Durchscheuern durch Teile der elektrischen Steckverbindung nicht
möglich ist.
DE HAVILLAND Serious
Vienna Int’l Airport (LOWW) 06/05/2015
DHC8 incident
Flug XXX meldete wenige Minuten nach dem Abheben von der Piste 29 des Flughafens Wien-Schwechat (LOWW),
Rauch in der Kabine als auch im Cockpit des Luftfahrzeuges. Das Luftfahrzeug befand sich zu diesem Zeitpunkt,
ca. 2 Minuten nach dem Abheben, mit 43 Passagieren und 5 Besatzungsmitgliedern an Bord im Steigflug unter
Sichtflug-Wetterbedingungen (VMC) entlang der Standardabflugroute (SID) SITNI 4C mit dem Flugziel Innsbruck
in ca. 5000 ft (Flugfläche 50).
Die Piloten entschieden sich zur Rücklandung des Luftfahrzeuges zum Flughafen Wien-Schwechat. Das Luft-
fahrzeug landete kurze Zeit später ohne Probleme auf dem Flughafen Wien-Schwechat. Alle Passagiere sowie
die gesamte Flugbesatzung konnten das Luftfahrzeug unverletzt verlassen.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 59
Die Auswirkungen von kontaminierter Kabinenluft in Luftfahrzeugen auf den menschlichen Körper sollten zeitnah,
umfassend und unabhängig untersucht werden, um aus den daraus gewonnenen Ergebnissen Lösungsansätze für
den Schutz von Passagieren und Besatzungsmitgliedern aufzuzeigen und verpflichtend umzusetzen. Dies könnte
gegebenenfalls mittels einer internationalen Kooperation mit bereits laufenden Forschungsarbeiten erfolgen.
Study 1: Cabin air quality (CAQ) measurement campaign - study conducted by a consortium of the
Fraunhofer Institute for Toxicology and Experimental Medicine and the Hannover Medical School.
In-flight measurements have been conducted on a number of commercial flights after defining adequate
and reliable air contaminants measurement methods for cockpit and passenger cabin areas.
The results show that the cabin/cockpit air quality is similar or better than what is observed in normal in-
door environments (offices, schools, kinder gardens or dwellings). No occupational exposure limits and
guidelines were exceeded.
In total, 69 measurement flights were performed between July 2015 and June 2016 on 8 types of aer-
oplane/engine configurations. This included 61 flights on aeroplanes equipped with engine bleed air
systems, and 8 flights on Boeing 787 which is equipped with electrical compressors (‘bleed free’ system).
For all flights, measurement equipment was installed in the cockpit and in the cabin. Special attention
was paid to organophosphates, in particular Tri Cresyl Phosphates (TCP) with the use of high sensitivity
analysis techniques.
Study 2: Characterisation of the toxicity of aviation turbine engine oils after pyrolysis - study conducted
by a consortium of the Netherlands Organisation for Applied Scientific Research and the Dutch Nation-
al Institute for Public Health and the Environment.
This study characterised the chemical composition of some transport aeroplane turbine engine oils (in-
cluding pyrolysis breakdown products), and the toxic effects of the chemical compounds that can be
released in the cabin or cockpit air.
It concluded that ‘neuroactive pyrolysis products are present, but that their concentration in the pres-
ence of an intact lung barrier is that low that it could not be appointed as a major concern for neuronal
function’. TCP was present in the analysed oils, however no ortho-isomers could be detected. Finally the
‘analysis of the human sensitivity variability factor showed that the complete metabolic pathway and the
contribution of inter individual variability in the metabolic enzymes is still largely unknown for the ma-
jority of industrial chemicals, including cabin air contaminants’. Two brands of oil were used in this study,
and both new and used oil samples were analysed.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 60
Der Einbau von technischen Überwachungsmöglichkeiten wie etwa Sensoren welche die Zusammensetzung bzw.
eine mögliche Verunreinigung der Kabinenluft im Luftfahrzeug in Echtzeit routinemäßig aufzeichnet und die Pi-
loten rechtzeitig warnt, gepaart mit geeigneten Filtersystemen, sollte bei Luftfahrzeugen welche Zapfluft von den
Triebwerken für die Kabinenluft verwenden, verpflichtend vorgeschrieben werden.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 61
Der Pilot des Hubschraubers startete am 09. August 2014 um 09:07 Uhr in Begleitung eines Passagiers mit dem
Hubschrauber der Type Schweizer 269C vom Flugplatz Stockerau (LOAU) zu einem kurzen kommerziellen Rund-
flug. Kurz vor der Landung um 09:18 Uhr begann der Hubschrauber in ca. 1,5 m Höhe um die Hochachse nach
rechts zu drehen. Nach mehreren Drehungen setzte der Hubschrauber hart auf den Kufen auf und kippte nach
links.
Der Passagier und der Pilot wurden durch den Aufprall bzw. durch das Kippen des Hubschraubers leicht verletzt.
Der Hubschrauber wurde schwer beschädigt. Es entstand geringer Flurschaden.
CS-FSTD(H) already address antitorque device ineffectiveness in Helicopter Full Flight Simulators with
subjective testing of the loss of anti-torque effectiveness. Nevertheless, the Agency will review the
requirements for helicopters FSTD within the context of rulemaking task RMT.0196 ‘Update of flight sim-
ulation training devices requirements’, which was launched on 15 July 2016 with the objective to enhance
LTE simulation aspects on Helicopter Full Flight Simulators.
Belgium
Registration Aircraft Type Location Date of event Event Type
PILATUS
GELBRESSEE 19/10/2013 Accident
PC6
The aeroplane was used for the dropping of parachutists from the parachute club of Namur1. It was the 15th
flight of the day. The aeroplane took off from the Namur/Suarlée (EBNM) airfield at around 13:25 with 10 para-
chutists on board. After 10 minutes of flight, when the aeroplane reached FL50, a witness noticed the aeroplane
in a level flight, at a lower altitude than normal. He returned to his occupation. Shortly after he heard the sound
he believed to be a propeller angle change and turned to look for the aeroplane. The witness indicated that he
saw the aeroplane diving followed by a steep climb (major pitch up, above 45°), followed by the breaking of the
wing. Subsequently, the aeroplane went into a spin. Another witness standing closer to the aircraft reported see-
ing the aeroplane flying in level flight with the wings going up and down several times and hearing, at the same
time an engine and propeller sound variation before seeing the aeroplane disappearing from his view. The aero-
plane crashed in a field in the territory of Gelbressée, killing all occupants. The aeroplane caught fire. A big part
of the left wing and elements thereof were found at 2 km from the main wreckage.
Cause(s):
The cause of the accident is a structural failure of the left wing due to a significant negative g aerodynamic over-
load, leading to an uncontrollable aeroplane and subsequent crash.
The most probable cause of the wing failure is the result of a manoeuvre intended by the pilot, not properly
conducted and ending with an involuntary negative g manoeuvre, exceeding the operating limitations of the
aeroplane.
The lack of organizational structure between the operator and the parachute club.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 65
It is recommended that the EASA mandates the installation of a lightweight recording system in aircraft used for
parachuting activities.
SOCATA Serious
Aerodrome of Genk 17/12/2015
TBM700 incident
At the end of a short 12-minute flight from EBLG to EBZW the pilot checked the landing gear position indication
lights, confirmed he saw three greens and no red light and entered the landing circuit. In the final leg, after the
flaps were extended to landing position, the pilot checked again the landing gear position lights. The touch-
down and the first phase of the landing were uneventful, however the nose landing gear collapsed as soon as it
made contact with the runway.
Cause:
The cause of the serious incident is the failure of the nose landing gear actuator to lock down combined with
the landing gear control system wrongly indicating that this landing gear was properly extended and locked.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 66
The root cause of the serious incident is a spurious triggering of the NLG actuator extend dual switch into “ex-
tend and locked”.
Investigation determined that the activation system of the dual switches has the potential to cause simul-
taneously a false indication (showing 3 greens and no red light) on the LGCP and stop the operation of the
electro-hydraulic generator, interrupting the landing gear leg extension before reaching the locked position.
Contributing factors:
The mechanical improvement of the actuators involving the installation of differential plungers
(MOD70-0334-32), introduced in December 2012, was not applied to the aircraft.
The possibility to improve the safety of the landing gear system by installing the differential plungers
(MOD70-0334-32) was not communicated and was not recommended to the end-users.
It is recommended that EASA mandates the improvement of the switch kinematics using hydraulic pressure to
help the plunger movement by the application of Part 4.2. of MOD70-0334-32 to all landing gear actuators not
already modified during application of EASA AD 2013-0227. This would include the prohibition of the installation
of unmodified actuators, which is currently allowed by EASA AD 2013-0227.
Bulgaria
Registration Aircraft Type Location Date of event Event Type
On 30.06.2015 at 12:26 h UTC, in the controlled upper airspace of the Republic of Bulgaria, particularly in Sofia
Control FS Varna East Upper airspace an infringement of the standards on the minimum radar separation be-
tween two aircraft occurred. An unidentified unknown aircraft flying without two way radio communication and
without transmitting transponder (Mode A/C) passed by a controlled aircraft Falcon 900, registration marks VP-
CGD, of „VOLKSWAGEN AIR SERVICE” AO, performing flight with flight number WGT62N, at a minimal horizontal
distance at 0.9 nm at same FL 370. Later on the unidentified unknown aircraft established radio communication
with Sofia ACC FS Varna West and it was identified as Embraer 170 aircraft, registration marks SP-LDK, perform-
ing flight with flight number LOT7293 of „LOT” AO.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 67
Based on the grounds of the performed investigation, including the research and analysis of the available fac-
tual information, the Investigation Commission concluded that the serious incident resulted from the following
main and several accompanying causes:
Main cause:
Unintentional interruption of the Air Traffic Service in regard to LOT7293 on the side of ACC Bucharest after
changing of the aircraft transponder mode of operation to STANDBY, particularly in Bucharest Control BANAP
sector, during the its flight in Bucharest FIR and later on in Sofia FIR.
Accompanying causes:
Not implemented procedures by the flight crew of Embraer 170, registration marks SP-LDK, after the
momentary failure of the transponder system.
Not provided information in timely manner on the location, direction of flight and height of the uni-
dentified aircraft by ACC Bucharest to ACC Sofia, previously received from NATO07.
Not implemented procedures by ACC Bucharest from the LETTER OF AGREEMENT between BULATSA
SOFIA ACC and ROMATSA BUCUREŞTI ACC/CONSTANŢA APP.
E.1 Transfer of Control
E.2 Transfer of Communications;
F.2.5 Transfer of Aircraft Identification.
ЕАSА and ICAO to request that the AOs operating Embraer 170/175/190/195 aircraft upgrade the Primus Epic
Load software with a version that can display caution CAS message XPDR (1/2) IN STBY. [BG.SIA-2015/03/07]
There is no evidence to suggest the alerts did not function as expected during the incident.
So, even if the crew misses the “NAVCOM1(2) FAIL” message, whose associated procedure requests them
to check the status of the transponder, the remaining amber “TCAS OFF” message on the PFD should lead
them to check it in the Radio MCDU page.
Canada
Registration Aircraft Type Location Date of event Event Type
On 2 September 1998, Swissair Flight 111 departed New York, United States of America, at 2018 eastern daylight
savings time on a scheduled flight to Geneva, Switzerland, with 215 passengers and 14 crew members on board.
About 53 minutes after departure, while cruising at flight level 330, the flight crew smelled an abnormal odour
in the cockpit. Their attention was then drawn to an unspecified area behind and above them and they began to
investigate the source. Whatever they saw initially was shortly thereafter no longer perceived to be visible. They
agreed that the origin of the anomaly was the air conditioning system. When they assessed that what they had
seen or were now seeing was definitely smoke, they decided to divert. They initially began a turn toward Bos-
ton; however, when air traffic services mentioned Halifax, Nova Scotia, as an alternative airport, they changed
the destination to the Halifax International Airport. While the flight crew was preparing for the landing in Hal-
ifax, they were unaware that a fire was spreading above the ceiling in the front area of the aircraft. About 13
minutes after the abnormal odour was detected, the aircraft’s flight data recorder began to record a rapid suc-
cession of aircraft systems-related failures. The flight crew declared an emergency and indicated a need to land
immediately. About one minute later, radio communications and secondary radar contact with the aircraft were
lost, and the flight recorders stopped functioning. About five and one-half minutes later, the aircraft crashed into
the ocean about five nautical miles southwest of Peggy’s Cove, Nova Scotia, Canada. The aircraft was destroyed
and there were no survivors.
As of 01 January 2005, all aircraft that require both an FDR and a CVR be required to be fitted with a CVR having
a recording capacity of at least two hours. [A99-02]
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 69
Commission Regulation (EU) No 965/2012 contains the following provisions on CVR recording
duration for Non-Commercial operations with Complex motor-powered aircraft (NCC), and for Spe-
cialised Operations (SPO):
For aeroplanes: NCC.IDE.A.160/SPO.IDE.A.140 Cockpit voice recorder
(a) The following aeroplanes shall be equipped with a CVR:
(1) aeroplanes with an MCTOM of more than 27 000 kg and first issued with an individual CofA on or af-
ter 1 January 2016; and
(2) aeroplanes with an MCTOM of more than 2 250 kg:
(i) certified for operation with a minimum crew of at least two pilots;
(ii) equipped with turbojet engine(s) or more than one turboprop engine; and
(iii) for which a type certificate is first issued on or after 1 January 2016.
(b) The CVR shall be capable of retaining data recorded during at least:
(1) the preceding 25 hours for aeroplanes with an MCTOM of more than 27 000 kg and first issued with
an individual CofA on or after 1 January 2021; or
(2) the preceding 2 hours in all other cases.
For helicopters: NCC.IDE.H.160/SPO.IDE.H.140 Cockpit voice recorder
(a) Helicopters with an MCTOM of more than 7 000 kg and first issued with an individual CofA on or after
1 January 2016 shall be equipped with a CVR.
(b) The CVR shall be capable of retaining data recorded during at least the preceding 2 hours.
With the publication of the above-mentioned provisions, the Agency has completed its actions to ensure
that the CVR has a recording duration which is adequate for the aircraft it is installed in, with a minimum
baseline duration of 2 hours for all aeroplanes used for CAT or SPO, and for complex aeroplanes used for
non-commercial operations.
As of 01 January 2005, for all aircraft equipped with CVRs having a recording capacity of at least two hours,
a dedicated independent power supply be required to be installed adjacent or integral to the CVR, to power the
CVR and the cockpit area microphone for a period of 10 minutes whenever normal aircraft power sources to the
CVR are interrupted. [A99-03]
On 12 March 2009, at 0917 Newfoundland and Labrador daylight time, a Cougar Helicopters’ Sikorsky S-92A (reg-
istration C-GZCH, serial number 920048), operated as Cougar 91 (CHI91), departed St. John’s International Airport,
Newfoundland and Labrador, with 16 passengers and 2 flight crew, to the Hibernia oil production platform. At
approximately 0945, 13 minutes after levelling off at a flight-planned altitude of 9000 feet above sea level (asl),
a main gearbox oil pressure warning light illuminated. The helicopter was about 54 nautical miles from the St.
John’s International Airport. The flight crew declared an emergency, began a descent, and diverted back towards
St. John’s. The crew descended to, and levelled off at, 800 feet asl on a heading of 293° Magnetic with an air-
speed of 133 knots. At 0955, approximately 35 nautical miles from St. John’s, the crew reported that they were
ditching. Less than 1 minute later, the helicopter struck the water in a slight right-bank, nose-high attitude, with
low speed and a high rate of descent. The fuselage was severely compromised and sank quickly in 169 metres of
water. One passenger survived with serious injuries and was rescued approximately 1 hour and 20 minutes after
the accident. The other 17 occupants of the helicopter died of drowning. There were no signals detected from ei-
ther the emergency locator transmitter or the personal locator beacons worn by the occupants of the helicopter.
The Board recommends that The Federal Aviation Administration, Transport Canada and the European Aviation
Safety Agency remove the “extremely remote” provision from the rule requiring 30 minutes of safe operation
following the loss of main gearbox lubricant for all newly constructed Category A transport helicopters and, af-
ter a phase-in period, for all existing ones.
CS 29.927(c) on ‘loss of lubrication’ has been completely revised and replaced by a more objective-based
specification that requires substantiation of the gearbox ability to continue safe operation (for at least
30 minutes) after a loss of lubrication to be followed by a safe landing; the ‘unless such failures are ex-
tremely remote’ provision has been removed. This is supported by substantial changes to the associated
acceptable means of compliance (AMC). Finally, CS 29.1521 has also been amended to include an addi-
tional power plant limitation that describes how the RFM emergency procedures should reflect the test
evidence relating to a loss of lubrication.
The next step of RMT.0608 is the publication of a Decision amending CS-27 and CS-29, envisaged 03Q2017.
Regarding existing Category A transport helicopters certified in accordance with the current CS 29.927(c),
a review has shown that most types complied without using the ‘extremely remote’ rationale to exclude
particular lubrication system failure modes. For helicopter types where potential lubrication system fail-
ure modes were excluded from the ‘loss of lubrication’ test on the basis of extremely remote likelihood
of occurrence, additional actions have been taken to ensure that an acceptable level of safety is main-
tained, and the Agency will continue to address any identified type-specific unsafe condition within the
scope of Part-21.
Cyprus
Registration Aircraft Type Location Date of event Event Type
On the 22nd October 2014 the AAIIB was notified by the JRCC of an aircraft accident which occurred 47 NM south
east, off the coast of Larnaca, involving a twin aircraft (DA42), registration 5B-CLI. This aircraft departed Paphos
Airport with destination Beirut Airport. Last communication with Nicosia ATC was at 16:02:25 UTC and then dis-
appeared from the radar screen.
Based on the safety recommendation received, the subject was brought again to the rulemaking group
constituted to conduct rulemaking task RMT.0188 amending Commission Regulation (EU) No 1178/2011
on aircrew. The group of experts did not find new evidence that indicates that the existing night rating
provisions are presenting a disproportionate risk. The review confirmed the previous opinion that the re-
quired minimum hours of night flying training appear coherent with the risk level.
Finland
Registration Aircraft Type Location Date of event Event Type
CESSNA
OH-CKB Alastaro 08/05/2012 Accident
FA152
An aircraft accident occurred at Alastaro Circuit on Tuesday 8 May 2012 at 18.32 Finnish time. A Cessna FA152
Aerobat aircraft registered OH‑CKB, owned and operated by the Finnish Aviation Academy based at Pori Airport,
collided with the ground. The aircraft caught fire on impact and was completely destroyed. The pilot, who was
alone on board, was killed immediately.
The pilot had departed for a VFR cross‑country flight (under visual flight rules) from Pori in accordance with the
flight training syllabus. The meteorological conditions were good at the time of departure. According to radar re-
cordings, the pilot had flown at a height of about 1000 feet to the village of Yläne, from where he intended to fly
to Huittinen via Alastaro. He followed the planned route quite roughly. About 13 km before Alastaro he reached
road no. 9 leading from Turku to Tampere. Alastaro Circuit is located along this road, and the next turnpoint at
Huittinen follows after it. When the pilot reached the road, he started to follow it towards Huittinen without fly-
ing to Alastaro. The circuit is located about five kilometres from the point where the pilot started to follow the
road towards the north. After reaching the circuit the pilot began circling above it at a height of about 600–1000
feet (180–300 m) from the ground, as a result of this he lost control of the aircraft and crashed onto the circuit.
People who saw the crash reported the accident immediately to the local emergency response centre.
The investigation showed that student pilots sometimes regarded the daily cross-country flights as tedious and
not challenging enough, especially as there could be three to five successive flights on the same day. On such
cross-country flights many students had been performing activities that were not included in the flying exercise,
such as aerial photography. It also came out that the requirements for spin avoidance training in PPL instruction
were partly unclear, and the flight schools’ training instructions were inadequate in the same respect.
The probable cause of the accident was a sudden asymmetric turn stall which developed during the climbing,
steepening turn. It caught the pilot by surprise and led to a complete loss of flight attitude control. The stall de-
veloped because the pilot failed to sufficiently monitor the aircraft’s attitude and flight data as he was circling
above the motor circuit and paying too much attention to the events on the circuit.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 74
Because of the pilot’s short flying experience and the low flight altitude, he was unable to make the correct re-
covery manoeuvres quickly enough and the aircraft collided with the ground.
A contributing factor to the accident was that the pilot decided to divert from the planned route to look for
Alastaro racing circuit, which he had previously not found. After he located the circuit and noticed that there was
an event going on, he started circling above it.
JAR-FCL 1 requires the inclusion of exercise 11: “Spin avoidance” in the PPL(A) syllabus, which includes “stalling
and recovery at the incipient spin stage” and “instructor induced distractions during the stall”. The English lan-
guage version of the document does not infer any active “distraction” to the use of flight controls, for example,
as it almost invariably is understood – and done in Finland.
Safety Investigation Authority Finland recommends that the European Aviation Safety Agency (EASA) consid-
er the translation, provide more detailed comments on the purpose of this exercise, and clarify it with practical
examples.
CESSNA
OH-OTL at Oulu Airport 03/10/2016 Accident
F406
Landing gear failure during landing run at Oulu Airport on 3 October 2016
A Reims F406 Caravan II aircraft (OH-OTL), operated by the Finnish company Lapin Tilauslento Oy, departed for
a routine cargo flight from Rovaniemi Airport to Oulu on 3 October 2016. The aircraft had a crew of two pilots
and carried mail as cargo.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 75
When the landing gear was retracted after take-off, the warning lights for the landing gear and hydraulic sys-
tem remained on. The gear was then selected back down, and the three green lights indicating that the gear was
down and locked illuminated normally. The crew continued the flight to Oulu in good weather with the gear ex-
tended. When approaching at Oulu, it was already dark.
When landing at Oulu, the aircraft touched down at the beginning of the runway. The landing run was normal
at first. After the speed had decreased and the pilot-in-command started braking, the right main landing gear
failed and the aircraft tilted to the right. The aircraft stopped quickly after the landing gear had collapsed, with-
in a distance of about 80 m, but remained on the runway. The aircraft sustained significant damage in the area
between the right propeller and the inner wing flap on the right-hand side. There were no injuries to persons.
Before the accident flight, the aircraft main landing gear had been subjected to maintenance, for which the gear
had to be removed and reinstalled. When the right main landing gear was installed, its forward pivot pin had
been secured incorrectly. As a result of this error the pivot pin moved out of its place, eventually causing the gear
to collapse at landing.
The investigation revealed shortcomings in the main landing gear installation instructions, and the order of
actions was found to be impractical in places. Therefore they did not support the correct performance of main-
tenance actions and related inspections. These factors have contributed to the accident besides human factor
elements.
The Safety Investigation Authority, Finland recommends that the type certificate holder of Reims F406 aircraft
review and update the maintenance instructions so that any deficiencies in main landing gear installation in-
structions are rectified. In addition, it is recommended that the type certificate holder of Cessna 404 aircraft,
which has a similar type of landing gear, also review the corresponding instructions, including those for other
similar aircraft types.
The recommendations are issued to improve safety, to prevent similar accidents in the future, and to minimise
any damage resulting from such accidents.
The European Aviation Safety Agency (EASA) require the aircraft type certificate holder to review and update the
maintenance instructions for Reims F406 aircraft, so that any deficiencies in main landing gear installation in-
structions are rectified. The landing gear installation instructions do not cover all necessary phases of work, and
the order of phases is impractical in some places. The instructions provide no warning of the possibility of incor-
rect pivot pin installation. [2017-S26]
CESSNA
OH-COV Vampula Aerodrome 24/09/2016 Accident
172
The accident occurred on Saturday, 24 September 2016 to the pilot of a Cessna 172N aircraft. At 12.21 the pilot
took off from Tuulikki-Vampula aerodrome for a local flight with two passengers. The pilot decided to abort the
flight because he did not feel well. Following the landing the aircraft drifted off the runway into a ditch at 12.36.
The pilot died soon after the landing as a result of a heart attack. One passenger had a sudden attack, requir-
ing hospitalisation.
The pilot suffered from multi-vessel coronary heart disease and sleep apnoea. Within the five years prior to the
accident he had had three heart attacks which were treated with coronary angioplasty.
On the basis of the investigation the pilot’s higher overall risk of a recurring heart attack, as regards flight safety,
was not recognised. The European guidance material only partly provides for decision-making associated with
overall risk assessment.
The pilot was unaware of the privileges of a medical certification and the validities of the licence. Moreover,
while the public health care system was aware of the pilot’s flying hobby, national legislation does not lay down
any duty of notification associated with medical certification to doctors treating licence holders.
On the basis of the investigation Safety Investigation Authority, Finland issues four safety recommendations:
The International Civil Aviation Organization (ICAO) should include such a risk assessment model in the Manual
of Civil Aviation Medicine that can be used in aeromedical decision-making for assessing the risk of pilots who
have had recurring heart attacks.
The European Aviation Safety Agency (EASA) should improve AME risk assessment competency in aeromed-
ical decision-making through training and by increasing their competency in consultation and in the use of
limitations.
The Finnish Ministry of Transport and Communications should standardise the duty of notification between avi-
ation and road transport associated with a person’s state of health as part of advancing the safety of flight.
The Finnish Transport Safety Agency should see to it that the practitioners of general and sport aviation receive
clarifying information pertaining to the privileges associated with the pilot’s licence and the significance of the
requirement to report medical issues.
The European Aviation Safety Agency (EASA) improve AME risk assessment competency through safety pro-
motion, competency based recurrent training and specific training on the national procedures for referral and
consultation as well as for the use of limitations. [2017-S35]
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 77
France
Registration Aircraft Type Location Date of event Event Type
FOKKER
F-GMPG Pau Pyrénées 25/01/2007 Accident
F28
L’avion décolle en piste 13. Peu après l’envol, il s’incline à gauche, à droite, puis à gauche. L’aile gauche de l’avion,
maintenant en descente, frotte sur le revêtement en limite droite du bord de piste. L’avion touche le sol légè-
rement incliné à droite, rebondit, roule dans les servitudes à droite de la piste, traverse le grillage d’enceinte
de l’aérodrome et franchit une route en heurtant la cabine d’un camion. Les trains d’atterrissage principaux
heurtent le talus opposé de la route et se séparent de l’avion. Celui-ci glisse dans un champ sur environ 535
mètres, à droite de la rampe d’approche de la piste 31.
[French] - Le BEA recommande que tout en veillant à maintenir les exigences opérationnelles relatives au contrôle
du dégivrage avant le vol, l’AESA s’attache à faire évoluer les spécifications de certification pour demander l’analyse
du comportement des avions lorsque les surfaces d’ailes sont contaminées au sol et pour garantir le maintien des
marges de sécurité acceptables en cas de contamination légère.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 78
BEECH
F-GVPD Besançon - La Vèze 18/10/2006 Accident
C90
Le 18 octobre 2006 à 22 h 40, l’avion débute son décollage en piste 23 revêtue sur l’aérodrome de Besançon - La
Vèze. Après avoir roulé pendant 950 mètres, il quitte le sol mais prend peu de hauteur. Quelques instants plus
tard, il heurte la cime d’arbres situés dans l’axe de piste, prend feu et tombe dans un bois. Le pilote n’a signalé
aucune difficulté et n’a pas émis de message de détresse.
[French] - Le BEA recommande que l’AESA étudie l’élargissement des conditions imposant la présence d’un équipage
à deux pilotes en transport public.
The occurrence review does not show a predominant risk in single-pilot commercial air transport opera-
tions, considering that many historical single-pilot occurrence would require a second crew if those EASA
operational rules were applicable.
To be complete, a more specific review of helicopters emergency medical services (HEMS) occurrences
was conducted, because it introduces specific risks when selecting the landing site and the MOPSC is of-
ten below 9. This type of operation is covered by a Specific Approval (Part SPA Subpart J) and a minimum
crew of 2 pilots at night or one pilot and one HEMS technical crew member under specific conditions is
defined (SPA.HEMS.130 (e)). Part-ORO subpart TC defines training requirements for HEMS technical crews.
On this basis, the restrictions and mitigation means applied for single-pilots operations appear coherent
with the safety review.
MUDRY
F-GRRA Saint Rambert d’Albon, France 04/06/2010 Accident
CAP10
Le vendredi 4 juin 2010, les 2 pilotes décollent à bord du CAP10 C immatriculé F-GRRA pour réaliser un vol de ré-
entraînement à la voltige. L’instructeur est en place gauche. Ils montent à une hauteur de 5 000 ft à la verticale
de l’aérodrome de Saint Rambert d’Albon (26) pour débuter les exercices qui ont été préparés lors d’un briefing
avant le décollage. Après avoir exécuté une vrille « dos », ils remontent à la même altitude pour débuter une
vrille « plate ». La mise en vrille plate à droite est réalisée selon la procédure décrite au briefing par l’instructeur.
Après plusieurs tours de vrille, le pilote en place droite puis l’instructeur tentent sans succès d’arrêter la rotation
de l’avion. L’instructeur décide de l’évacuation et largue la verrière. Le pilote en place droite s’extrait de l’avion
et actionne la commande d‘ouverture du parachute qui s’ouvre normalement. L’instructeur n’a pas le temps
d’évacuer avant que l’avion entre en collision avec le sol.
Causes de l’accident
L’accident est dû à la perte de contrôle de l’avion par l’équipage lors de l’exécution d’un exercice de vrille aplatie,
en raison de l’application erronée de la procédure de sortie de vrille.
[French] - L’AESA étudie l’obligation d’équiper les avions de voltige de parachutes avec une sangle d’ouverture au-
tomatique qui permette l’ouverture du parachute quel que soit l’état de conscience du pilote qui a évacué.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 80
Vertical flight path excursion during ILS approach with autopilot engaged
LVP procedures were in force at Paris – Charles de Gaulle. Established on runway 08RILS on a CAT III A preci-
sion approach, the crew noticed that from 1,700 ft AMSL radio-altimeter 1 was working intermittently. The crew
performed a missed approach at around 800 ft AMSL after detecting an APCH WARN message displayed on the
head-up guidance system (HGS) and on the PFD. The origin of this message was a greater deviation to the per-
missible limits between the heights measured by both of the aeroplane’s radio altimeters.
A second CAT III A approach was performed on runway 08R. At around 1,700 ft AMSL, radio altimeter 1 was op-
erating intermittently again. At 1,000 ft AMSL, a MASTER CAUTION warning message, accompanied by the EFIS
COMP MON message at EICAS and the APCH WARN message on the HGS were triggered for a few seconds for the
same reasons as during the first approach. The crew performed a missed approach about fifteen seconds later, at
an altitude of about 800 ft AMSL. The EFIS COMP MON and APCH WARN warning messages were triggered again.
The RVR was sufficient to perform a CAT I precision approach on runway 08R. Using the cloud ceiling noted dur-
ing the two previous approaches, the crew told the controller that they wished to make a CAT I approach and
that in the event of another missed approach, they would divert to Lille airport. At around 1,700 ft AMSL, radio
altimeter 1 was working intermittently again. The AP was connected. From 700 ft AMSL, that is 160 ft above DA
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 81
and up to 340 ft AMSL radio altimeter 1 was not supplying height data. During this period, the aircraft’s pitch at-
titude started to fluctuate. At the altitude corresponding to DA, it was slightly positive (0.3 degrees nose up) then
it increased to 1.3 degrees nose up before decreasing rapidly to an attitude of about 7 degrees nose down at 100
ft AGL. The G/S deviation was then one point below the ILS glide path. The PF disconnected the AP as soon as he
noted the decrease in attitude, at 120 ft AGL. He altered the glide path and, in sight of the approach lights, con-
tinued on to land without further difficulty on runway 08R.
The BEA recommends that EASA ensure that Aircraft manufacturers modify maintenance procedures that could
have consequences on the radio altimetry system in order to take into account the risks of damage.
The student was undertaking a dual-control instruction flight between Dunkirk and Le Touquet aerodromes.
On arrival, he flew the downwind leg for a landing on runway 32. The flare and main landing gear touchdown
occurred without any problems. When the nose gear touched down, the aeroplane was subject to strong vibra-
tions. The instructor pushed the control column forwards and braked. The nose gear collapsed and the aeroplane
came to a stop on the runway.
EASA, in collaboration with the DGAC, implement a technical solution in order to prevent the appearance of
new failures of this type and, consequently, modify Airworthiness Directive EU-2010-0231. [Recommendation
FRAN-2012-031]
AIRBUS Serious
F-GLZU Paris Charles de Gaulle 13/03/2012
A340 incident
Approach above glide path, interception of ILS sidelobe signal, increase in pitch angle commanded by autopilot
The crew took off from Bamako (Mali) aerodrome on 12 March 2012 at 23 h 59 heading for Paris Charles de
Gaulle (CDG) airport. On arrival, the ATIS indicated that the low visibility procedure (LVP) was in force. The crew
prepared themselves for a CAT III precision approach.
The aeroplane was stable at FL90 at about 30 NM from the threshold of runway 08R. Autopilot 1 was engaged
in HDG and ALT mode. The ATHR was engaged in SPEED mode. The speed was stable at 250 kt in accordance
with the controller’s request. The crew was in contact with CDG approach. They were cleared to intercept local-
izer 08R.
At 04 h 40 min 20, the controller cleared the crew to descend to FL80 and five seconds later the aeroplane, stable
at FL90, passed above the 3° glide path. The crew was then cleared to descend to FL60. They selected an altitude
of 6,000 ft on the FCU and the autopilot mode changed to OP DES. The autopilot captured the localizer 08R signal
(LOC*) and then the LOC mode engaged. When the aeroplane descended to 7,220 ft, and was 17.5 NM from the
threshold, or about 1,275 ft above the glide path, the controller requested that a speed of more than 200 kt be
maintained. The aeroplane’s speed was about 250 kt. The crew read back and requested to continue the descent.
The controller apologised for his omission then cleared the crew to descend to 3,000 ft to intercept the 08R ILS.
The crew selected 220 kt and 3,000 ft. The OP DES mode remained active. The aeroplane speed and rate of de-
scent decreased which resulted in increasing the deviation from the glide path. The crew extended the airbrakes.
When the aeroplane speed reached the target speed of 220 kt, the rate of descent increased again to a value
of -1,840 ft/min.
At 10 NM from the runway threshold and at an altitude of 5,500 ft, the approach controller requested that the
crew maintain a speed of more than 160 kt and that they contact the tower. He did not inform the tower control-
ler that the aeroplane was above the glide path. The crew selected a speed of 210 kt then 183 kt and wing slats/
flaps configuration 1. Again, the rate of descent decreased and the aeroplane deviated from the 3° glide path.
The crew contacted the tower and indicated that they were 9 NM out. The aeroplane was at an altitude of 4,950
ft (1,750 ft above the glide path). The controller initially cleared the crew to continue the approach. The latter
read back “Cleared to land 08 right… “. The controller indicated that he then checked that the CAT III ground ser-
vices were clear then confirmed clearance to land. The crew selected slats/flaps configuration 2 and retracted the
airbrakes. About one minute later, they re-extended the airbrakes, set the G/S mode using the APPR switch and
engaged autopilot 2. The glide deviation displayed on the PFD indicated to the crew that they were approaching
the glide path from above. The aeroplane was 4 NM from the runway threshold, at about 3,700 ft (that is 2,100
ft above the glide path at 3°) and was located in an ILS signal sidelobe.
About 30 seconds later, the crew extended the landing gear. The glide path capture mode (G/S*) was activated
when the aeroplane was 2 NM from the runway threshold at 2,850 ft (that is about 1,600 ft above the glide path
at 3°). The ATHR changed to SPEED mode. The pitch attitude increased from 1° to 26° in 12 seconds. The PNF stat-
ed that he had called out the difference in the pitch attitude when the chevrons appeared. When the aeroplane
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 84
pitched up, the speed dropped from 163 kt to 130 kt, the vertical speed changed from – 1,600 ft/min to + 3,300
ft/min. When the pitch attitude reached 26°, the crew disconnected both autopilots and the PF made a pitch
down input almost down to the stop. The pitch attitude and vertical speed decreased.
The crew retracted the airbrakes. The throttle levers were in the IDLE position. The speed was 143 kt and the
ATHR disengaged. About 30 seconds later, autopilot 1 was engaged, the levers were repositioned on the CL set-
ting and the ATHR was activated. The PF explained that he engaged autopilot 1 to perform a go-around on
automatic.
The LOC and G/S modes were active and the ATHR was in SPEED mode. The speed was 147 kt. The aeroplane was
directly above the runway threshold at an altitude of about 2,700 ft. The pitch attitude then decreased from 2°
to -5° and the aeroplane descended.
The PF stated that he realised that the modes displayed on the FMA were not appropriate. He then disengaged
the AP 8 seconds after having activated it and then displayed a pitch attitude of about 6° and placed the throttle
levers in the TOGA setting at an altitude of about 2,000 ft.
The crew made a second approach and landed without further difficulties.
The investigation showed that it was possible to intercept a sidelobe ILS glide path in autopilot without alerting
the crew. Furthermore, under these conditions, the autopilot put the aeroplane in an unusual attitude (26° pitch-
up) during a critical phase of the flight. This issue could well involve other aircraft in public transport.
Consequently the BEA recommends that EASA ensure that aircraft ILS modes are not engaged on an ILS signal
other than the one corresponding to the published descent path; that failing this, a system enabling the crew to
be alerted be put in place.
The functioning of such system would assume a “standard” antenna use on the ground. This may
be a practical initial assumption while there is no such standard and no verification demand where
the side slope is located. When using other antennae e.g. with more or less antenna gain, the side
slope is different. Consequently, there is no way to verify the assumptions used to create the ILS
beam. All verifications are concentrating on the main slope.
In summary, the identified technical limitations do not allow to design an independent monitoring func-
tion able to protect the aircraft safely under all foreseeable conditions from capturing the side slope.
EASA has also considered the mandate of such function. A preliminary qualitative impact assessment
shows that it is difficult to justify a mandatory equipment of aircraft due to the low number of events hap-
pening and considering, on the other hand, the typical estimated effort for aircraft equipage.
This does not preclude some protection being developed by industry. The potential are not sufficiently
mature, at this stage, to allow the development of an industry standard for such function, which would
be a precondition for a mandate.
While disagreeing that a technical solution should be implemented on a mandatory basis, EASA considers
that good airmanship principles should be reminded, which would help to avoid those conditions in the
day-to-day environment. To raise awareness on this issue EUROCONTROL published an article ‘Unstabi-
lised Approach: Vectoring Resulting in Intercepting the Glidepath from Above’ on the SKYbrary webpage
on 5th November 2014, and EASA published SIB 2014-07R1 ‘Unexpected Autopilot Behaviour on Instru-
ment Landing System (ILS) Approach’, dated 12 August 2015.
In a broader context, the potential safety relevance of the topic is shared by the Agency being the
False or Disrupted ILS Signal Capture a safety issue now included in the Commercial Air Transport (CAT)
aeroplanes Safety Risk Portfolio (SRP). This safety issue will be regularly monitored through safety per-
formance monitoring activities.
Towards the end of the 2000’s, the BEA observed that a number of public air transport accidents or serious in-
cidents were caused by a problem relating to “aeroplane state awareness during go-around” (ASAGA). Other
events revealed inadequate management by the flight crew of the relationship between pitch attitude and thrust,
with go-around mode not engaged, but with the aeroplane close to the ground and with the crew attempting
to climb.
Moreover, these events seemed to have some common features, such as surprise, the phenomenon of excessive
preoccupation by at least one member of the crew, poor communication between crew members and difficulties
in managing the automatic systems.
The BEA recommends that EASA in coordination with manufacturers, operators and major non-European avia-
tion authorities ensure that go-around training integrates instruction explaining the methodology for monitoring
primary flight parameters, in particular pitch, thrust then speed. [Recommendation FRAN-2013-017]
In line with ICAO, the opinion and the decision mentioned above propose UPRT to proficiency during in-
itial and recurrent training. The amended skill test and proficiency checks supported by operators’ UPRT
recurrent training and conversion course reinforce pilot competence through regular training. UPRT in-
structors are also required to match minimum experience and receive dedicated UPRT training to deliver
effective teaching and avoid negative transfer of training.
The BEA recommends that EASA, in cooperation with the national civil aviation authorities and major non-
European aviation authorities, ensure that during recurrent and periodic training, training organizations and
operators give greater importance to the assessment and maintenance of the monitoring capabilities of public
transport pilots. [Recommendation FRAN-2013-018]
The newly developed advanced UPRT course, which is to be mandated as an addendum to ATP and MPL
training courses and also to serve as a prerequisite prior to commencing the first type rating course in
multi-pilot operations, is an important step towards enhancing a commercial pilot’s resilience to the psy-
chological and physiological aspects often associated with upset conditions. It develops the ability of the
pilot to cope with unforeseen events.
In support of the new standards, appendix 9 — Training, skill test and proficiency checks for MPL, ATPL,
type and class ratings, and proficiency checks for IRs is amended to include UPRT. It emphasizes regular
training on manual flying manoeuvres and procedures with or without flight directors and at different
speeds and altitudes (3.1).
In line with ICAO, the opinion and the decision mentioned above propose UPRT to proficiency during
initial and recurrent training. The amended skill test and proficiency checks supported by operators’
UPRT recurrent training and conversion course reinforce pilot competence through regular training. The
National Competent Authority ensures through its Air Operators and Aviation Training Organisations
oversight that the training objectives are met.
The BEA recommends that EASA review the regulatory requirements for initial and periodic training in order to
ensure that go-arounds with all engines operating are performed sufficiently frequently during training.
In line with ICAO, the opinion and the decision mentioned above propose UPRT to proficiency during in-
itial and recurrent training. The amended skill test and proficiency checks supported by operators’ UPRT
recurrent training and conversion course implement the recommendation that go-arounds with all en-
gines operating are performed sufficiently frequently.
The BEA recommends that EASA, in coordination with major non-European aviation authorities, amend the CS-
25 provisions so that aircraft manufacturers add devices to limit thrust during a go-around and to adapt it to the
flight conditions.
The BEA recommends that EASA examine, according to type certificate, the possibility of retroactively extend-
ing this measure in the context of PART 26 / CS-26, to the most high-performance aircraft that have already been
certified.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 90
The BEA recommends that EASA, in cooperation with the national civil aviation authorities and major non-Euro-
pean aviation authorities, ensure that the risks associated with dispersion and/or channelized attention during
the go-around, to the detriment of the primary flight parameters, be taught to crews.
In addition, dispersion and/or channelized attention is mitigated by teaching the flight crew about such
risks during realistic training scenarios that contain surprise and startle effects conducive to high work-
load in a short time frame. Effective monitoring of the primary flight parameters is a major criteria to
prevent Loss of Control In-flight (LOC-I), and the Agency has published provisions on flight crew Upset
Prevention and Recovery Training (UPRT) with the specific objective to ensure that flight crew acquire the
necessary competencies to prevent and recover from developing or developed upsets.
The Agency published, on 08 April 2014, Safety Information Bulletin SIB 2014-09 ‘Aeroplane Go-Around
Training’ to raise awareness on the risks associated with unexpected or poorly executed go-around ma-
noeuvres and to encourage operators to specifically address these risks in their safety management
systems.
ED Decision 2015/012/R published on the EASA website entered into force on 04 May 2016. It defines Ap-
plicable Means of Compliance (AMC) and Guidance Materials (GM) for recurrent training programme of
Commission Regulation (EU) No 965/2012 (ORO.FC.230) and conversion training (ORO.FC.220) pertaining
to Commercial Air Transport (CAT) operators using ‘complex motor-powered aeroplanes’.
The material takes into account the International Civil Aviation Organization (ICAO) Annex 6 amendment
38, ICAO Doc 9868 ‘Procedures for Air Navigation Services - Training’ (PANS-TRG) amendment 3 relating
to UPRT, and ICAO Doc 10011 ‘Manual on Aeroplane UPRT’. Reference is also made to the Original Equip-
ment Manufacturers’ (OEMs’) Aeroplane Upset Recovery Training Aid (AURTA).
In addition, the Agency published Opinion No 06/2017 on “loss of control prevention and recovery train-
ing” in the wake of rulemaking task RMT.0581 on 29 June 2017.
This Opinion proposes to introduce mandatory UPRT, testing and checking at various stages for pilots
who intend to pursue a pilot career with a commercial airline:
advanced UPRT course (new FCL.745.A) as a prerequisite for training courses for single-pilot aero-
planes operated in multi-pilot operation, single-pilot high-performance complex aeroplanes and
multi-pilot aeroplanes (amendments to FCL.720.A);
Inclusion of UPRT elements considering the specificities of the particular class or type during the
relevant class or type rating training course (amendments to FCL.725.A);
Amendments to Appendix 9, paragraphs 5 and 6 in Annex I (Part-FCL) of Commission Regulation
(EU) No 1178/2011 for including upset prevention and recovery exercises into training courses, skill
test and proficiency checks related to single-pilot aeroplanes operated in multi-pilot operations,
single-pilot high-performance complex aeroplanes and multi-pilot type rating training courses;
The newly developed advanced UPRT course, which is to be mandated as an addendum to ATP and MPL
training courses and also to serve as a prerequisite prior to commencing the first type rating course in
multi-pilot operations, is an important step towards enhancing a commercial pilot’s resilience to the psy-
chological and physiological aspects often associated with upset conditions. It develops the ability of the
pilot to cope with unforeseen events.
In support of the new standards, appendix 9 — Training, skill test and proficiency checks for MPL, ATPL,
type and class ratings, and proficiency checks for IRs is amended to include UPRT. It now includes go-
arounds with all engines operating from various stages during instrument approach (4.2).
In line with ICAO, the opinion and the decision mentioned above propose UPRT to proficiency during in-
itial and recurrent training.
The BEA recommends that EASA, in coordination with manufacturers, operators and major non-European avi-
ation authorities, study whether to extend these measures to other procedures requiring a high workload in
a short time frame.
The newly developed advanced UPRT course, which is to be mandated as an addendum to ATP and MPL
training courses and also to serve as a prerequisite prior to commencing the first type rating course in
multi-pilot operations, is an important step towards enhancing a commercial pilot’s resilience to the psy-
chological and physiological aspects often associated with upset conditions. It develops the ability of the
pilot to cope with unforeseen events.
In support of the new standards, appendix 9 — Training, skill test and proficiency checks for MPL, ATPL,
type and class ratings, and proficiency checks for IRs is amended to include UPRT. It now includes go-
arounds with all engines operating from various stages during instrument approach (4.2) and also cover
other procedures requiring a high workload in a short time frame such as rejected landing with all en-
gines operating from various heights below DH/MDH and after touchdown (4.5).
In line with ICAO, the opinion and the decision mentioned above propose UPRT to proficiency during in-
itial and recurrent training.
The BEA recommends that EASA, in cooperation with the major non-European certification authorities, make
mandatory the implementation of means to make crews aware of a low speed value and, where necessary, pre-
vent an unusual nose-up trim position from occurring or being maintained.
Concerning in-service aeroplanes, further to the delivery of the Avionics System Harmonization Working
Group - ASHWG (combined aviation authorities and industry working group) report to the FAA through
Aviation Rulemaking Advisory Committee (ARAC), the review of accidents conducted by the ASHWG did
not provide enough safety evidence to justify mandating a costly retroactive design change for incor-
poration of a low speed or low energy alerting system. However further ASHWG discussions have taken
place since 03Q2014 with Agency participation, and the Agency continues to monitor relevant in-service
experience.
2) Unusual nose-up trim position
Rulemaking task RMT.0647 (‘Loss of control or loss of flight path during go-around or other flight phases’)
has started with the publication of its Terms of Reference and its Group Composition on 06/07/2015 (htt-
ps://www.easa.europa.eu/document-library/terms-of-reference-and-group-compositions/tor-rmt0647).
A Notice of Proposed Amendment (NPA) 2017-06 was published on 11 May 2017 on the EASA Website:
https://www.easa.europa.eu/document-library/notices-of-proposed-amendment/npa-2017-06
This NPA proposes to amend CS-25 to ensure that:
the design of large aeroplanes is such that the go-around (G/A) procedure with all engines operat-
ing (AEO) can be safely conducted by the flight crew without requiring exceptional piloting skills
or alertness. Risk of excessive crew workload and risk of somatogravic illusion must be carefully
evaluated, and design mitigation measures must be put in place if those risks are too high; imple-
menting a reduced G/A thrust function is one of the possible solutions which can be used, and it is
considered as an acceptable means of compliance with the proposed new specification;
the design of large aeroplanes provides an adequate longitudinal controllability and authority
during G/A and other flight phases (focusing on low speed situations).
The second proposed measure addresses the intent of this safety recommendation related to nose-up
trim condition. More specifically, the NPA proposal to upgrade the existing certification specifications
and acceptable means of compliance to require:
for G/A: to demonstrate adequate longitudinal controllability and adequate stall margin during
transition from any approved approach and landing configuration to G/A and up to the next flight
phase and level-off (All Engine Operating (AEO) and full thrust/power, different combinations of
automatisms to be evaluated). For other flight phases, when the aeroplane has an automatic pitch
trim function, the stabiliser (or trim tab) travel should be limited before or at stall warning acti-
vation to prevent excessive pitch trim such that it is possible to command a prompt pitch down of
the aircraft for control recovery.
The next step of RMT.0647 is the publication of a Decision amending CS-25, envisaged 01Q2018.
Le pilote décolle à 2 h 39 en piste 12 de l’aérodrome de Saint Martin Grand Case à destination de Fort-de-France.
Quelques minutes plus tard à environ 3 NM, l’avion entre en collision avec la surface de la mer, légèrement
à droite de l’axe de la piste. Le pilote n’a signalé aucune difficulté et n’a pas émis de message de détresse.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 95
L’examen de l’épave n’a pas mis en évidence de défaillance technique susceptible d’affecter significativement
les performances de l’avion. L’absence d’enregistreurs de vol n’a pas permis de préciser les circonstances de
l’accident.
Les causes de l’accident n’ont pu être déterminées avec certitude. Cependant, l’état d’astreinte quasi-permanent
pour les personnels navigants et l’exploitation en monopilote ont pu contribuer à l’accident.
l’obligation d’emport d’enregistreurs de vols à tous les avions exploités en transport aérien commercial;
la prise en compte des réserves autres qu’à l’aéroport dans la future réglementation relative à la sécurité en mat-
ière de limitations de temps de vol applicables aux vols d’évacuation sanitaire.
Dans l’attente de la mise en place de cette nouvelle réglementation, le BEA a adressé à la DGAC une recomman
dation de sécurité relative aux actions de surveillance de la DGAC, afin qu’elle s’assure que les exploitants veillent
à ce que leurs pilotes, lorsqu’ils sont en réserve hors aéroport, soient aptes à entreprendre un vol à tout moment.
[French] - Le BEA recommande que L’AESA prévoie la mise en place en priorité de la réglementation imposant la
présence d’un équipage à deux pilotes en vol d’évacuation sanitaire.
The occurrence review does not show a predominant risk in single-pilot commercial air transport opera-
tions, considering that many historical single-pilot occurrence would now require a second crew if those
EASA operational rules were applicable.
To be complete, a more specific review of helicopters emergency medical services (HEMS) occurrences
was conducted, because it introduces specific risks when selecting the landing site compared to air am-
bulance flight and the MOPSC is often below 9. This type of operation is covered by a Specific Approval
(Part SPA Subpart J) and a minimum crew of 2 pilots at night or one pilot and one HEMS technical crew
member under specific conditions is defined (SPA.HEMS.130 (e)). Part-ORO subpart TC defines training re-
quirements for HEMS technical crews.
On this basis, the restrictions and mitigation means applied for single-pilots operations appear coherent
with the safety review.
Since 2003, events relating to powerplant malfunctions on aircraft equipped with Thielert engines have frequent-
ly been notified to the BEA. By the end of August 2011, 44 had been the subject of a BEA investigation.
In 2005, the BEA recommended to the European Aviation Safety Agency (EASA) that the Thielert TAE 125-01
engine certification be reviewed. This recommendation gave rise to several actions by EASA and Thielert regard-
ing maintenance, operational documentation and training maintenance personnel and in relation to the design
of one part. However, although EASA classified its answer as “agreement”, no certification review action was
undertaken.
New events have occurred since 2004. Most of these notifications came from flying schools. Not all the events
notified required investigation. Nevertheless, the considerable number of notifications bears witness to oper-
ators’ specific concerns about these engines. Some training organisations decided in particular to apply usage
restrictions (no night flights or IFR in IMC in single-engine aircraft, no solo flights on DA40).
Given the number of notifications, the recurrence of specific malfunctions and the technological novelty of these
engines, the BEA decided in 2009 to conduct this study, the aim of which was to establish if a new request for re-
view of the engine certification was justified or not and if safety recommendations were required.
To do this, the BEA invited the following flying schools to take part in the study and to notify events according to
predefined criteria. These schools operate numerous aeroplanes equipped with Thielert engines:
ENAC: Ecole Nationale de l’Aviation Civile (French National Civil Aviation School);
ESMA: Ecole Supérieure des Métiers de l’Aéronautique (French Flight Training Organisation).
This study is based on the investigations conducted by the BEA on malfunctions to Thielert engines during the
period under consideration.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 97
The European regulatory definition of in-flight shutdown (AMC 20-6) is not adapted to light aviation. Therefore,
comparisons between a reference rate and the different manufacturers’ engine shutdown rates seem difficult to
establish. Moreover, losses of power that prevent level flight being maintained should systematically be count-
ed, their consequences being similar to those of an engine shutdown.
EASA, in cooperation with FAA, adopt a definition of engine shutdown for aircraft certified in accordance with
CS-23.
(c) The in-service experience with the intended engine-airframe combination should be at least 100 000
h, demonstrating the required level of reliability. If this experience has not been accumulated, then,
based on analysis or test, in-service experience with a similar or related type of airframe and turbine
engine might be considered by the TC/STC holder to develop an equivalent safety argument in order to
demonstrate that the reliability criteria are achievable.”
In France, the majority of events occurred during a flight performed in VMC by day. The pilot was generally able
to land in the country or at a nearby aerodrome. However, one accident occurred during a night flight, and other
malfunctions may have appeared in IMC, at night or in solo flight, conditions in which the success of an emer-
gency landing is uncertain. Thus the operational consequences of the same powerplant malfunction may vary
greatly depending on the flight rules adopted. However, in CS-23, classification of engine failure does not de-
pend on operating conditions.
EASA define the acceptable occurrence rate for drops in engine power, particularly those that make
it impossible to maintain level flight, in order to establish a classification appropriate to operating
conditions.
“(a) The operator should obtain the power plant reliability data from the type certificate (TC) holder and/
or supplemental type certificate (STC) holder.
(b) The data for the engine-airframe combination should have demonstrated, or be likely to demon-
strate, a power loss rate of less than 10 per million flight hours. Power loss in this context is defined as
any loss of power, including in-flight shutdown, the cause of which may be traced to faulty engine or en-
gine component design or installation, including design or installation of the fuel ancillary or engine
control systems.
(c) The in-service experience with the intended engine-airframe combination should be at least 100 000
h, demonstrating the required level of reliability. If this experience has not been accumulated, then,
based on analysis or test, in-service experience with a similar or related type of airframe and turbine
engine might be considered by the TC/STC holder to develop an equivalent safety argument in order to
demonstrate that the reliability criteria are achievable.”
Stall after takeoff in icing conditions, collision with the ground, fire
The pilot and two passengers arrived at Annemasse aerodrome at about 7 h 00 for a private flight of about five
minutes towards Geneva airport. The temperature was -2°C and the humidity was 98% with low clouds. The aer-
oplane had been parked on the parking area of the aerodrome since the previous evening. The taxiing and the
takeoff run were nominal. As soon as the main landing gear wheels left the ground, the aeroplane stalled, as
a result of the presence of ice on the surface of the wings. The low height reached by the aeroplane did not allow
the pilot to exit the stall situation and to avoid the collision with the ground. The pilot and the passenger seated
to his right were killed. The female passenger seated at the rear was seriously injured.
The investigation showed that the pilot’s insufficient appreciation of the risks associated with ground-ice led him
to take off with contamination of the critical airframe surfaces. This may have contributed to the occurrence of
32 accidents recorded since 1989 for which no de-icing of the aeroplane had been undertaken before takeoff.
The investigation also showed that an onboard device for the detection of ice on the ground could have prevent-
ed the accident and that Annemasse aerodrome does not have any ground de-icing facilities.
The BEA addressed three safety recommendations to EASA and the DGAC relating to:
The BEA recommends that EASA, in coordination with national civil aviation authorities, make changes to the
training requirements for pilots so as to include periodic reminders on the effects of contaminants such as ice
on stall and loss of control on takeoff.
CIRRUS
F-HTAV Aix les Milles 11/05/2013 Accident
SR22
The owner of the aeroplane wanted to make a two-day trip to Spain with another person. Not holding a licence
himself, he asked a pilot to undertake the flight. On 10 May 2013, the pilot, accompanied by those two passen-
gers, took off from Aix les Milles aerodrome bound for Madrid Cuatro Vientos (Spain) aerodrome. The flight took
place without incident.
The following day he took off, accompanied by the same two passengers, at about 13 h 00 to return to Aix les
Milles aerodrome. The flight plan planned the first part of the flight in VFR as far as AGENA and continuation of
the flight in IFR until Aix les Milles aerodrome.
On the approach to Aix les Milles, following a request by the owner, the pilot called out to the approach control-
ler his intention to reroute to Castellet aerodrome in order to carry out a touch-and-go, before returning to Aix
les Milles. Given the wind on the ground at Castellet, he performed an approach followed by a go-around. The
pilot was then cleared to perform a visual approach for runway 33 at Aix les Milles aerodrome. The approach was
stabilised. The speed was about 90 kt, the aeroplane was in fully extended flap configuration and the auto-pilot
was disengaged. The atmosphere was turbulent due to a strong wind in the north-west sector.
During the landing flare, the aeroplane banked about 10° to the left, then returned to a wings horizontal at-
titude. The left wheel touched the runway and the aeroplane bounced. The pilot started a go-around. At that
instant, the air speed was about 60 kt, the stall warning sounded. The pitch increased to 12° and at the same
time the aeroplane banked sharply to the left, turned over and then struck the grassy strip located between the
runway and the taxiway.
It crossed the taxiway perpendicular to it and came to a halt on its back in front of the hangar at the foot of the
control tower. The passengers evacuated the aeroplane before the emergency services arrived.
The investigation showed that the pilot inputs on the flight controls during the go-around were inadequate and
that the pilot may have been surprised by the intensity of the p-factor from the Cirrus SR22 engine. A signifi-
cant number of losses of control in g-around on Cirrus SR20 and SR22 were due to inappropriate pilot inputs on
the controls. The manufacturer has identified the need for specific training on the SR22 which specifically takes
into account its relatively high engine power. European regulations do not provide for specific training on these
aeroplanes.
Consequently the BEA recommends that EASA require specific training linked to aeroplane performance for pi-
lots of the Cirrus SR20 and SR22.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 102
Collision between a tug and a glider, on an aerodrome circuit, during an air display
At about 16 h 45, the pilot of the PA25 took off from runway 28 at Buno Bonnevaux aerodrome while towing
a glider. Following the release, he began a continuous descent towards the aerodrome in order to land back
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 103
there. At about 16 h 50, flying over the southern threshold of runway 10, at a height of about 100 metres above
some woods, the aeroplane collided with another glider. The latter had taken off from runway 28, with the as-
sistance of a winch, a few minutes earlier.
EASA encourage the development, use and generalisation of interoperable onboard traffic detection systems.
This can be achieved through standardisation of the broadcast and exchange formats between the various sys-
tems. [Recommendation 2015-057]
AIRBUS Serious
F-HBNI Bordeaux Airport-France 02/08/2013
A320 incident
Entrée dans un orage de grêle lors de l’approche, cisaillement de vent lors de l’approche, déclenchement bref
de l’alarme de décrochage
En approche sur l’aérodrome de Bordeaux Mérignac, l’équipage d’un Airbus A320 d’Air France traverse un orage
de grêle. L’avion est soumis à un important cisaillement de vent. L’assiette de l’avion augmente jusqu’à envi-
ron 25° sous pilote automatique et la vitesse descend jusqu’à 109 kt (VLS - 27 kt). L’avion descend au maximum
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 104
d’environ 200 pieds. L’équipage remet les gaz. L’alarme de décrochage retentit furtivement et la protection « Al-
pha Floor » se déclenche. L’équipage poursuit l’approche après être sorti de l’orage de grêle.
L’équipage effectuait le troisième et dernier vol de la journée. Une passagère, qui est copilote dans la compag-
nie, était présente dans le poste de pilotage lors de la totalité du vol. Elle est intervenue dans les échanges de
l’équipage pour décider de la trajectoire à suivre.
L’enquête du BEA a conclu que la décision inappropriée du commandant de bord de débuter l’approche, alors
qu’une cellule orageuse se trouvait sur la trajectoire d’approche résulte de la rupture progressive du fonctionne-
ment CRM de l’équipage, qui n’a pas su arriver à une décision partagée sur la trajectoire d’arrivée et d’approche.
Les interventions spontanées de la troisième personne présente dans le cockpit, et le souvenir d’une rotation
que le commandant de bord et le copilote avaient réalisée ensemble trois ans auparavant ont probablement con-
tribué à cette déstructuration du CRM et à l’inefficacité de leur stratégie TEM.
L’absence d’information de vol précise sur la situation météorologique fournie par le contrôleur, la répétition de
messages d’une situation météorologique dégagée sur l’aérodrome ont pu contribuer à la sous-estimation des
risques liés à la situation météorologique.
Le BEA a émis onze recommandations de sécurité à l’attention de l’AESA et la DGAC sur les thématiques suivantes:
[French] - L’AESA définisse les modalités permettant à un exploitant de mettre en oeuvre la formation basée sur les
risques telle que précisée dans le doc OACI 9995 de l’OACI. [Recommandation 2015-062]
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 105
[French] - L’AESA, en coordination avec la FAA, évalue la faisabilité et l’opportunité d’élargir le domaine de disponi-
bilité des alarmes de détection du phénomène de cisaillement de vent. [Recommandation 2015-065]
Quote:
- Inhibit all new aural and visual textual alerts above 1200 ft AGL.
- At take-off, inhibit all new aural and visual textual alerts late in the take-off roll and re-enable after
lift-off. This inhibit region is generally determined by aircraft speed, which should be specified by the
manufacturer as appropriate for the intended aircraft installation. The intent of this requirement is to
avoid high-speed rejected take-off.
- During final approach, inhibit all new aural and visual textual alerts from 50 feet AGL until touchdown.
- During final approach, provide automatic range scaling to prevent the annunciation of a windshear
Warning alert beyond the touchdown zone […].
Unquote.
The height of 1200 ft was selected for the following reasons:
The predictive windshear detection system as defined by DO-220A is designed to provide detec-
tion and alerts of a particular class of windshear events, specifically microburst induced events,
The 1200 ft altitude restriction was imposed to maintain validity to the underlying fluid dynamics
assumptions on which windshear calculations are designed,
At altitudes above 1200 ft, the probability of encountering a microburst-induced windshear event
is low since the outflow region characteristics of microbursts are only present close to the ground,
The determination of the range of heights on which a windshear alert has to be triggered is a bal-
ance between alerting when required and avoidance of nuisance alerts caused by turbulence.
Extending the altitude range of availability of the predictive windshear alerts would increase the risk
of triggering alerts when encountering other atmospheric conditions. This can create confusion for the
flight crew, and also potentially generate inappropriate reactions; for instance, at higher altitudes it may
not be appropriate to make a missed approach but rather to make an avoidance manoeuvre.
For those reasons, it is considered not to be appropriate to ‘extend the domain where windshear detec-
tion alarms are available’ beyond the existing thresholds provided by RTCA DO-220A.
DASSAULT Serious
HB-JFN Kuala Lumpur Airport 24/05/2011
FALCON7X incident
On 24 May 2011 at 08 h 10, the crew of the Falcon 7X registered HB-JFN took off from Nuremberg (Germany)
bound for Kuala Lumpur (Subang Airport) for a repositioning flight. The co-pilot was PF.
During the descent, the autopilot (AP) and auto-throttle were engaged and the calibrated airspeed was 300 kt. At
approximately 19 h 55, the PF reduced the rate of descent on approaching the cleared altitude (11,000 ft). He se-
lected a rate of descent of 1,300 ft per minute and activated vertical mode VS [Mode to maintain vertical speed].
A few seconds later, when the aeroplane had passed below 13,000 ft, the horizontal stabilizer THS [Tail Horizon-
tal Stabilizer] went from neutral to maximum nose-up position (12 degrees) in fifteen seconds.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 107
The AP remained engaged for the first eight seconds of THS deployment. The flight control laws counteracted the
nose-up movement of the THS by a nose-down action on the elevators, which reached approximately two-thirds
of their maximum travel before AP was disconnected. The THS continued its nose-up movement. The aeroplane’s
pitch attitude and load factor increased. The PF applied maximum nose-down input on the sidestick and placed
the throttle levers in Take-Off position. The auto-throttle disconnected. The PF’s nose-down input did not stop
the nose-up movement of the THS, which reached its limit seven seconds after AP was switched off. The FCS
displayed “TRIM LIMIT” on the PDU. Between disconnection of the AP and when the THS reached its stop, the
calibrated airspeed dropped from 297 to 220 kt.
The increased pitch attitude during THS runaway was combined with a slight bank to the right and increased al-
titude. The PF made a leftwards input on the sidestick, causing the aircraft to bank 15 degrees to the left. The
pitch attitude reached 25 degrees nose-up. Feeling that his pitch input was ineffective, the PF made a full right-
wards input. He explained that he was trying to bank enough to decrease the pitch attitude, increase speed and
regain pitch control. During the manoeuvre, the bank angle reached 98 degrees to the right.
Meanwhile, the Captain (PNF) made nose-down inputs and roll inputs contrary to those of the PF. These simulta-
neous inputs decreased the bank input of the PF and increased the pitch attitude, load factor and angle of attack
once again. These simultaneous inputs triggered the “DUAL INPUT” alarm. The PF stated that he therefore asked
the PNF to stop making inputs on his sidestick. He also took over priority of the controls by pressing the appro-
priate push-button on his sidestick for six seconds. The PF maintained the bank angle at 40 to 80 degrees to the
right for about twenty seconds. After reaching 42 degrees nose-up, the pitch attitude gradually decreased to 10
degrees. The angle of attack and load factor fell quickly, from 22 to 5 degrees and from 4.5g to between 1.25 and
1.5g respectively. Meanwhile, the calibrated airspeed dropped from 300 kt to 150 kt.
The PF then made leftwards roll inputs until the bank angle was stabilised at about 50 degrees. The THS re-
mained in full nose-up position, and the pitch attitude and calibrated airspeed remained stable for around forty
seconds, at 10 degrees nose-up and 200 kt respectively. The PNF stated that he attempted to use the manu-
al pitch trim and reengage the flight controls by pressing the “FCS ENGAGE” push-button on the upper panel.
Noticing no improvement, the PNF made roll inputs on his sidestick, in the opposite direction to those made
by the PF, as well as full nose-down inputs. The simultaneous roll inputs of the two pilots gradually brought the
bank angle to zero, which caused the pitch angle to increase once again to approximately 30 degrees, and the
calibrated airspeed to drop to 125 kt. The crew stated that they heard the “INCREASE SPEED” alarm.
This second dual input phase lasted approximately twelve seconds. The Captain then took over the controls.
The attitude began to decrease and the altitude reached a maximum of 22,500 ft. When the attitude reached 5
degrees nose-down, the Captain made nose-up inputs. The attitude increased again and the Captain resumed
making full nose-down inputs.
For a reason unknown to the crew, the THS began to move towards a level position, going from twelve degrees
to one degree nose-up in fifteen seconds. The aeroplane pitch was once again able to be controlled via inputs
on the sidestick. The crew made the decision to continue in manual flight mode. The approach and landing took
place with no any further incidents.
2 minutes and 36 seconds passed between the start of THS nose-up movement and its return to balanced posi-
tion. During this time:
Following this serious incident, the Falcon 7X fleet was temporarily grounded. It returned to service on 16 June
2011.
EASA, in coordination with FAA, SAE and EUROCAE, evaluate and propose alternative or additional methods to
the FMEA for electronic equipment and software. [Recommendation 2016-002]
PIPER
OE-FKG Toulouse-Blagnac 28/10/2011 Accident
PA31T
Asymmetric thrust, loss of control on final approach, collision with ground, fire
The pilot, accompanied by three passengers who were family members, took off at 16 h 35 from Kassel (Germa-
ny) aerodrome for a private flight under IFR to Toulouse-Blagnac. After about three hours of flight, he was cleared
for approach and received radar vectoring for the runway 14R ILS. During the last exchange with the controller,
as the aeroplane was on final at 900 feet, the pilot stated that he had a problem without specifying what type,
as the message was interrupted. Shortly afterwards, radar and radio contact was lost. The wreckage was found
close to the threshold of runway 14R.
EASA reinforce the content of training programmes related to complex high performance single-pilot aeroplanes
by integrating exercises on management of asymmetrical flight during approaches with a view to a landing. [Rec-
ommendation FRAN-2016-007]
AIRBUS
D-AIPX Prads-Haute-Bléone 24/03/2015 Accident
A320
The co-pilot had been flying for Germanwings since June 2014 and was the holder a class 1 medical certificate
that was first issued in April 2008 and had been revalidated or renewed every year. Since July 2009, this medi-
cal certificate had contained a waiver because of a severe depressive episode without psychotic symptoms that
had lasted from August 2008 until July 2009. This waiver stated that it would become invalid if there was a re-
lapse into depression.
In December 2014, approximately five months after the last revalidation of his class 1 medical certificate, the
co-pilot started to show symptoms that could be consistent with a psychotic depressive episode. He consulted
several doctors, including a psychiatrist on at least two occasions, who prescribed anti-depressant medication.
The co-pilot did not contact any Aero-Medical Examiners (AME) between the beginning of his decrease in med-
ical fitness in December 2014 and the day of the accident.
In February 2015, a private physician diagnosed a psychosomatic disorder and an anxiety disorder and referred
the co-pilot to a psychotherapist and psychiatrist. On 10 March 2015, the same physician diagnosed a possible
psychosis and recommended psychiatric hospital treatment. A psychiatrist prescribed anti depressant and sleep-
ing aid medication in February and March 2015. Neither of those health care providers informed any aviation
authority, nor any other authority about the co-pilot’s mental state. Several sick leave certificates were issued by
these physicians, but not all of them were forwarded to Germanwings.
No action could have been taken by the authorities and/or his employer to prevent him from flying on the day
of the accident, because they were informed by neither the co-pilot himself, nor by anybody else, such as a phy-
sician, a colleague, or family member.
In the cruise phase of the accident flight, the co-pilot waited until he was alone in the cockpit. He then intention-
ally modified the autopilot settings to order the aeroplane to descend. He kept the cockpit door locked during
the descent, despite requests for access made via the keypad and the cabin interphone. He did not respond to
the calls from the civil or military air traffic controllers, nor to knocks on the door. Security requirements that led
to cockpit doors designed to resist forcible intrusion by unauthorized persons made it impossible to enter the
flight compartment before the aircraft impacted the terrain in the French Alps.
The BEA investigation concluded that the process for medical certification of pilots, in particular self-reporting
in case of decrease in medical fitness between two periodic medical evaluations, did not succeed in preventing
the co-pilot, who was experiencing mental disorder with psychotic symptoms, from exercising the privilege of
his licence.
The following factors may have contributed to the failure of this principle:
the co-pilot’s probable fear of losing his right to fly as a professional pilot if he had reported his de-
crease in medical fitness to an AME;
the potential financial consequences generated by the lack of specific insurance covering the risks of
loss of income in case of unfitness to fly;
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 111
the lack of clear guidelines in German regulations on when a threat to public safety outweighs the re-
quirements of medical confidentiality.
The BEA has addressed eleven safety recommendations to the WHO, IATA, the European Commission, EASA,
BMVI and BÄK relating to:
EASA require that when a class 1 medical certificate is issued to an applicant with a history of psychological/
psychiatric trouble of any sort, conditions for the follow-up of his/her fitness to fly be defined. This may include
restrictions on the duration of the certificate or other operational limitations and the need for a specific psychi-
atric evaluation for subsequent revalidations or renewals. [Recommendation FRAN‑2016‑011]
EASA include in the European Plan for Aviation Safety an action for the EU Member States to perform a routine
analysis of in-flight incapacitation, with particular reference but not limited to psychological or psychiatric issues,
to help with continuous re-evaluation of the medical assessment criteria, to improve the expression of risk of in-
flight incapacitation in numerical terms and to encourage data collection to validate the effectiveness of these
criteria. [Recommendation FRAN-2016-012]
EASA, in coordination with the Network of Analysts, perform routine analysis of in-flight incapacitation, with
particular reference but not limited to psychological or psychiatric issues, to help with continuous re-evaluation
of the medical assessment criteria, to improve the expression of risk of in-flight incapacitation in numeri-
cal terms and to encourage data collection to validate the effectiveness of these criteria. [Recommendation
FRAN-2016-013]
EASA ensure that European operators include in their Management Systems measures to mitigate socio-econom-
ic risks related to a loss of licence by one of their pilots for medical reasons. [Recommendation FRAN-2016-014]
EASA ensure that European operators promote the implementation of peer support groups to provide a process
for pilots, their families and peers to report and discuss personal and mental health issues, with the assurance
that information will be kept in-confidence in a just‑culture work environment, and that pilots will be supported
as well as guided with the aim of providing them with help, ensuring flight safety and allowing them to return
to flying duties, where applicable. [Recommendation FRAN-2016-021]
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 115
TECNAM Andermos-Les-Bains
F-GXEC 26/10/2013 Accident
P2002 Aerodorome
Failure of a rudder control component, runway excursion during landing, coming to a standstill in a ditch
The aeroplane landed shortly beyond the displaced threshold on unpaved runway 13, rolled about 100 metres
and exited the runway to the right. After crossing the taxiway, it came to rest in the adjacent ditch.
The BEA recommends that EASA ensure that the improvements made in production are effective and places an
obligation on the Tecnam P 2002 manufacturer to establish means to detect cracks on aeroplanes in service that
are more reliable than those mentioned in the two Service Bulletins relating to rudder pedal linkage inspection.
[Recommendation 2016-038]
Regarding the inspection of the rudder pedal linkage on the aeroplanes in service, EASA has investigat-
ed with the TCH the effectiveness of the Service Bulletin SB-018 CS (applicable to the certified version of
the P2002 type only) and has concluded that the inspection method is adequate. Such conclusion keeps
into account also the severity of the linkage failure (impairment of the steering capability of the NLG on
ground only, with no impact on the rudder control during flight) and the service history of the type.
Regarding the SB-017 UL (applicable only to P2002 serial numbers classified as Annex II according to Reg-
ulation (EC) No 216/2008), EASA has requested Tecnam to inform the National Aviation Authorities of
the State of Registry about the occurrence and about the actions taken on EASA certified type design.
SOCATA
N129AG near Meaux 06/08/2014 Accident
TBM700
The pilot, accompanied by four passengers took off from Cannes-Mandelieu aerodrome (France) at about 10 h 40
min bound for Courtrai aerodrome in Belgium, under an IFR flight plan. Cruise was performed at FL240 in a thick
cloud layer. After about 1 h 40 min of flight, the aeroplane dived suddenly in a right turn, down to FL149. During
this descent, the speed increased significantly and the overspeed warning (VMO warning) was triggered. About
forty-five seconds after the beginning of the dive, the aeroplane climbed back up, reaching a climb rate of over
10,000 ft/min. The speed dropped until a stall at around FL201, while the aeroplane was still in IMC. The aero-
plane then went into a spin, which flattened out during the descent. When the aeroplane came out of the clouds
at an altitude between 1,000 and 2,000 ft, in a flat spin, the height was insufficient to allow the pilot to take the
necessary actions to pull out of the spin and regain control of the aeroplane.
The difficulty in identifying the spin and applying the appropriate recovery inputs, when there were no visual
references, made it impossible for the pilot to regain control of the aeroplane and to avoid the collision with the
ground.
In the absence of flight recorders, the investigation was unable to establish with any certainty the circumstances
of the accident. Eight safety recommendations have already been issued by European safety investigation au-
thorities aimed at introducing installation of recorders on light aircraft. In response, EASA studied this subject
through a regulatory task. The BEA thus addressed two additional safety recommendations to EASA to include
the case of this accident in the evaluation of the regulatory task under way and to install flight recorders on aer-
oplanes classified as “high performance”.
EASA add this accident to the TBM700 registered N129AG on 6 August 2014 at Saint-Jean-les-Deux-Jumeaux in
the terms of reference for regulatory task RMT.0271.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 117
EASA require or promote the installation of on-board recorders on aeroplanes categorised as high performance
aircraft (HPA), in accordance with the type of aircraft operation.
Le pilote du F 172 immatriculé F-BXIU décolle de l’aérodrome de Toussus-le-Noble à 12 h 15 pour un vol lo-
cal en instruction. Lors de ce vol de début de formation, l’instructeur et l’élève effectuent divers exercices de
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 118
maniabilité, à altitude sensiblement constante. Ils ne sont pas en contact avec un organisme de la circulation aé-
rienne au moment de l’accident. Le code transpondeur affiché est 7000 avec le mode C.
A 12 h 40, les deux avions entrent en collision en vol au dessus de la commune de Saint-Martin-de-Bréthencourt:
le F 172 perd une partie de l’aile droite, heurte le sol à quelques centaines de mètres du lieu de la col-
lision en vol et prend feu;
le pilote du Commander 114 conserve le contrôle de son avion, se déclare en détresse sur la fréquence
et annonce avoir heurté « un ULM ou quelque chose comme ça ». Il atterrit dans un champ situé sur la
commune de Boinville-le-Gaillard, à environ trois kilomètres du lieu de la collision en vol.
Causes de l’accident
la configuration à aile haute du F 172 en sortie de virage à droite et à aile basse du Commander 114
en croisière;
la fausse impression de sécurité du pilote du Commander 114 qui pensait recevoir une information de
vol sur tout trafic potentiellement conflictuel de la part du CIV Paris Info alors que les dispositions ré-
glementaires applicables à un CIV ne le prévoient pas.
La position du soleil dans le champ de vision du pilote du Commander 114 a pu contribuer à l’accident.
[French] - En conséquence le BEA renouvelle sa recommandation auprès de l’AESA afin d’accélérer l’évaluation des
différents systèmes d’aide à la détection de trafics existants et d’assurer la promotion de leur déploiement dans le
domaine de l’aviation générale.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 119
CIRRUS
F-HKCR Salon de Provence 07/04/2015 Accident
SR22
Le 7 avril 2015, une mission de liaison est effectuée avec un Cirrus SR 22. Pendant la phase de décollage depuis
le terrain de Salon de Provence, le siège recule violemment ce qui conduit à une perte de contrôle de l’appareil.
Celui-ci impacte la piste et est détruit. Le pilote et les deux passagers sont indemnes.
[French] - Le bureau enquêtes accidents defense air (BEAD) recommande a Cirrus en relation avec l’agence europée-
nne de la sécurité aérienne (AESA) d’étudier la possibilité de mise en place d’un système de sécurité (mécanique,
lumineux on sonore,...) permettant de s’assurer du bon verrouillage.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 120
L’équipage décolle à 05 h 40 de l’aérodrome de Paris Le Bourget à destination de l’aérodrome de Lannion pour
un vol de mise en place. À 05 h 47, en contact avec le secteur départ du CRNA/Nord (CRNA/N), il est autorisé
à monter vers le FL 240 en direction de KOKOS. Le copilote est PF et le pilotage est effectué en manuel. À partir
de 05 h 47 min 37 s, la pression d’huile du moteur gauche commence à fluctuer. L’examen réalisé par le con-
structeur a mis en évidence la rupture du palier intermédiaire n° 2 du moteur gauche (moteur 1). Les conditions
météorologiques sont CAVOK à Orly.
Alors qu’ils passent le FL 180 à 05 h 47 min 55 s, les deux membres d’équipage sentent une forte odeur de brûlé.
En quelques secondes, une fumée opaque envahit le poste de pilotage par l’arrière. Le Commandant de bord
(CdB) prend les commandes et donne l’ordre de mettre les masques. Ce faisant, il perd ses lunettes de vue et
son casque radio avec lequel il communiquait. Il n’arrive pas à retrouver ses lunettes en raison de la densité de
la fumée et prend alors ses lunettes de secours. Les deux pilotes ne mettent pas leurs lunettes de protection. Le
CdB ramène les deux manettes de poussée au ralenti à 05 h 48 min 19 s. Six secondes plus tard, l’alarme sonore
« Left engine oil pressure » retentit. Le CdB entame immédiatement une descente d’urgence et l’aéronef prend
progressivement une assiette à piquer de 15°. La température d’huile du moteur gauche augmente à partir de
05 h 48 min 43 s. Pendant ce temps, le copilote informe le contrôleur de la descente d’urgence puis annonce une
phase d’urgence PAN PAN. Le copilote pointe ensuite le cadran du moteur 1. Le contrôleur du CRNA/N accuse ré-
ception de la descente mais ne reçoit pas le message PAN PAN, la fréquence étant occupée par un autre équipage
à cet instant. Le contrôleur et son coordinateur assurent alors la séparation du F-HCIC avec un trafic conflictuel
au départ de l’aéroport d’Orly en direction de l’ouest.
À partir de 05 h 49 min 09 s, le CdB procède à l’arrêt du moteur gauche, sans l’annoncer. Il place dans un premier
temps la manette de poussée sur OFF. L’alarme TCAS « Trafic Advisory » retentit à 05 h 49 min 12 s. Le CdB arrête
la génératrice associée au moteur gauche à 05 h 49 min 29 s. Environ quinze secondes plus tard, n’ayant pas reçu
de réponse à son message PAN PAN, le copilote passe un message de détresse MAYDAY et demande un guidage
radar pour effectuer une approche ILS piste 07 au Bourget. Le contrôleur accepte la demande.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 121
À partir de 05 h 49 min 48 s, l’alarme survitesse retentit pendant près d’1 minute 30 s en concomitance avec
l’alarme «left engine oil pressure». L’assiette longitudinale varie entre - 13° et - 6° à la suite d’une action à cabr-
er du copilote. Celui-ci n’annonce pas son action sur les commandes. La vitesse varie entre 295 kt et 215 kt et la
vitesse verticale entre - 8 000 ft/min et - 1 500 ft/min.
Le CdB ne répond pas au copilote lorsque celui-ci lui signale à plusieurs reprises une survitesse en criant
«vitesse». Le CdB indiquera aux enquêteurs qu’il se préoccupait en priorité de descendre le plus vite possi-
ble. L’avion tourne à gauche. Le CdB passe le sélecteur d’air en position FRESH AIR. Selon les deux membres
d’équipages, les fumées dans le poste sont toujours denses et ne se dissipent pas. Le CdB voit moins bien les in-
struments de bord que le copilote.
Cette communication n’est pas entendue car elle est masquée en raison d’un appui sur l’alternat du CdB qui tente
de passer un message MAYDAY. Le contrôleur radariste en conclut que l’équipage n’est plus en mesure de chang-
er de fréquence.
Il le garde alors en fréquence et un contrôleur organique de la position coordonne par téléphone les clairances
avec les contrôleurs d’approche de Roissy en charge de l’approche du Bourget et de l’espace aérien où se situe
maintenant l’avion. Peu après, la position de contrôle est renforcée par une troisième personne qui s’occupe des
coordinations avec Roissy. Ces coordinations génèrent des échanges continus entre contrôleurs au niveau de la
position.
À 05 h 50 min 26 s, l’avion passe l’altitude de 9 384 ft en descente avec un vario moyen de 3 000 ft/min. Le con-
trôle guide l’avion au cap 290. Constatant que cette consigne n’est pas prise en compte, le copilote hurle à six
reprises « cap deux!neuf!zéro!». L’avion se stabilise au cap 030 et se dirige alors vers la ville de Paris.
À 05 h 50 min 58 s, les aérofreins sont sortis pendant 1 min 19 s. La vitesse passe de 286 kt à 225 kt.
L’avion entre dans la zone interdite P23 à 05 h 51 min 24 s à l’altitude de 5 275 ft et continue de descendre. À 05
h 51 min 25 s, la température d’huile du moteur gauche atteint un maximum de 131 °C alors que celle du mo-
teur droit reste stable à 71 °C. L’équipage vire ensuite vers la gauche à 05 h 51 min 48 s. Dix secondes plus tard,
le copilote reçoit une clairance de descente à 3 000 ft qu’il collationne en indiquant que l‘avion se situe à une al-
titude de 2 800 ft. L’avion est alors au cap 270°, et toujours dans la zone interdite. Le CdB indique que la fumée
commence à se dissiper. Les communications au sein de l’équipage, qui étaient quasiment inexistantes depuis
l’apparition de la fumée, reprennent. Le CdB n’a pas remis son casque.
Un contrôleur de Roissy détecte que l’avion est trop bas. Cette information est transmise in fine au contrôleur du
CRNA/N en contact avec l’avion. Celui-ci annonce à l’équipage qu’il est trop bas. L’avion sort de la zone interdite
de Paris. Le CdB réduit le taux de descente et ordonne au copilote d’indiquer qu’ils ont le feu à bord, ce qui est
réalisé par le copilote peu de temps après. Les contrôleurs donnent ensuite un cap radar 040 à l’aéronef. L’avion
stoppe sa descente à 05 h 52 min 46 s à l’altitude de 2 000 ft.
La fumée se dissipe peu à peu bien qu’une odeur irritante reste présente. Après avoir été guidé radar, l’équipage
est autorisé ensuite à atterrir en piste 07 au Bourget.
Le CdB passe sous le plan afin de pouvoir faire un arrondi doux. Des alarmes GPWS « Glideslope » se déclenchent
à partir de 05 h 56 min 53 s.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 122
Le toucher des roues a lieu à 05 h 57 min 09 s. Les pompiers de l’aéroport suivent l’avion qui ne présente aucun
dégât apparent. Après s’être arrêté au parking, l’équipage est surpris par l’absence de dégât extérieur appar-
ent et effectue un débriefing qu’il enregistre sur un smartphone. Il notifie ensuite l’incident aux autorités de
l’aviation civile.
The crew was not sufficiently trained on application of the fire/smoke or emergency descent procedures. The
European Air OPS regulation in force allows for the use of different types of FSTD simulators while the part FCL
regulation makes mandatory the FFS level for emergency descent exercises. Due to the prohibitive cost, FFS simu-
lators are not available. Today, fixed FSTD simulators can answer the requirements for crew training in emergency
situations on HPA aircraft.
EASA amend the regulations so as to authorise, in the context of FCL, the use of types of FSTD sim-
ulators with a lower level than FFS during smoke or emergency descent training on Cessna 525B
aeroplane types and, more generally, on complex HPA aeroplanes. [Recommendation FRAN-2017-001]]
When the smoke filled the cockpit, the Captain lost his goggles and his headset. Due to the absolute necessity to
descend, he did not have time to don his spare goggles. The co-pilot didn’t don his goggles either and his eyes
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 123
stung after the incident. In an emergency situation, it is difficult to quickly don a protective mask and protective
goggles when smoke appears in the cockpit. A full-face mask allows time to be saved and better protects crew
members. A search in the DGAC database for event reports brought to light crew reports relating to the difficul-
ty in the use of separate masks and goggles.
EASA, in cooperation with the FAA, study the in-service experience on the use of masks with separate
goggles compared to the use of full-face masks, and that it draws conclusions on making it mandatory
for full-face masks to be installed on HPA type aeroplanes mainly used for public transport. [Recom-
mendation FRAN‑2017‑002]
Germany
Registration Aircraft Type Location Date of event Event Type
BEECH
Freiburg aerodrome, Germany 12/01/2006 Accident
300
At 18:55 hrs on 12 January 2006, the German Federal Bureau of Aircraft Accidents Investigation (BFU) was ad-
vised by the Münster Search and Rescue centre that an aircraft accident had taken place in the vicinity of Freiburg
Airfield. A BFU investigation team arrived at the accident site at about 01:00 hrs. Aided by local external expert
for field investigation who was tasked the location and recording of any volatile traces, the team began the im-
mediate investigation on-site.
The Beech 300 (B300) took off on the morning of 12 January 2006 from its home base at Freiburg im Breisgau
(EDTF) Airfield for a commercial flight in which passengers were to be transported from Karlsruhe/Baden-Baden
(EDSB) to Braunschweig (EDVE) and return.
The B300 landed back at Karlsruhe at 17:19 hrs. The passengers disembarked at their destination and the flight
crew took off again at 17:59 hrs. This latter sector was flown under Visual Flight Rules Night (VFR-Night).
The flight continued south at 4,500 ft in radio contact to Strasbourg Approach (119,450 MHz). Before leaving this
frequency at 18:12 hrs, the commander asked the Air Inspection Officer (‘Flugleiter’) at Freiburg for the current
airfield weather. The cruising altitude was reduced to 3,500 ft.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 124
In subsequent radio exchanges, the crew gave position reports to the Flight Information Service at Freiburg and
received the current weather information. At 18:16 hrs the aircraft was above the destination aerodrome on
a southerly heading.
When above the town, the aircraft then reversed heading to a northerly course to begin an approach to land.
This was followed by a further 180 degree turn to intercept the approach path to Runway 16.
The undercarriage was lowered during final approach to Runway 16, and a short time later the commander gave
his position to the Flight Information Service at Freiburg as 3 to 4 NM from the airfield. The aircraft made con-
tact with trees at 18:26 hrs about 450 m from the threshold to Runway 16 at Freiburg Airfield. Both pilots were
killed by the impact.
The accident occurred during the final stages of an approach under Visual Flight Rules, when the aircraft made
controlled descent and then had contact with trees. The causes of the accident were:
because the decision was made to undertake VFR Night flight although the weather was marginal, and
the approach to Freiburg Airfield was continued in conditions of insufficient visibility.
The European Aviation Safety Agency (EASA) should regulate to require that “Single-Pilot Aircraft” engaged in
EU-OPS 1.940 flights made in accordance with Instrument Flight Rules and at night, must have a minimum crew
of two pilots, and that their training is in accordance with JAR-FCL including Multi-Crew-concept (MCC) training.
For the last few years the German Federal Bureau of Aircraft Accident Investigation (BFU) has been receiving an
increased number of reports of so-called fume events. These kinds of events include smell, smoke or vapour in-
side the airplane and/or health impairments of aircraft occupants. In addition, this topic is increasingly discussed
among flight crew, occupational unions, the media and in political committees.
In the “study of reported occurrences in conjunction with cabin air quality in transport aircraft” a total of 845
cases were taken into consideration; Accidents, serious incidents and incidents, which have been reported to the
BFU between 2006 and 2013.
A conjunction with cabin air could be determined in 663 reports. In 180 reports health impairments were de-
scribed although a conjunction with cabin air quality could not be determined.
In 460 of the 663 reported fume events, smell development and in 188 cases smoke development was report-
ed. In 15 cases there was neither smell nor smoke but health impairments which may possible have conjunction
with a fume event.
For this study, the BFU has divided the reported occurrences into the following categories:
EASA should implement a demonstration of compliance of cabin air quality during type certification of aircraft
(CS-25), engines (CS-E) and APU (CS-APU) such that the same requirements apply to all these products and per-
manent adverse health effects resulting from contaminated cabin air are precluded.
Aircraft, engine and APU type certification should include direct demonstration of compliance of all substances
liable to cause cabin air contamination. Certification should be based on critical values which preclude perma-
nent adverse health effects on passengers and crew.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 126
The European Aviation Safety Agency (EASA) should launch a research project to have an independent institute,
e.g. institute of aerospace medicine or a medical university, study and assess the potential causal connection be-
tween transport aircraft cabin air contamination and chronic illnesses.
Indonesia
Registration Aircraft Type Location Date of event Event Type
AIRBUS
PK-AXC SUB - SURABAYA, Indonesia 28/12/2014 Accident
A320
On 28 December 2014 an Airbus A320-216 aircraft registered as PK-AXC was cruising at 32,000 feet on a flight
from Juanda Airport, Surabaya, Indonesia to Changi Airport, Singapore with total occupants of 162 persons. The
Pilot in Command (PIC) acted as Pilot Monitoring (PM) and the Second in Command (SIC) acted as Pilot Flying
(PF).
The Flight Data Recorder (FDR) recorded that 4 master cautions activated following the failure of the Rudder Trav-
el Limiter which triggered Electronic Centralized Aircraft Monitoring (ECAM) message of AUTO FLT RUD TRV LIM
SYS. The crew performed the ECAM procedure on the first three master caution activations. After the 4th mas-
ter caution, the FDR recorded different pilot action and the parameters showed similar signature to those on 25
December 2014 when the FAC CBs were pulled on the ground. This pilot action resulted on the 5th and 6th mas-
ter caution activations which correspond respectively to ECAM message of AUTO FLT FAC 1 FAULT and AUTO FLT
FAC 1+2 FAULT.
Following two FAC fault, the autopilot and auto-thrust disengaged and the flight control reverted to Alternate
Law which means the aircraft lost several protections available in Normal Law. The aircraft entered an upset con-
dition and the stall warning activated until the end of recording.
Participating in the investigation of this accident were Australian ATSB, French BEA, Singapore AAIB and MOT
Malaysia as accredited representatives.
The cracking of a solder joint of both channel A and B resulted in loss of electrical continuity and led
to RTLU failure. The existing maintenance data analysis led to unresolved repetitive faults occurring
with shorter intervals. The same fault occurred 4 times during the flight.
The flight crew action to the first 3 faults in accordance with the ECAM messages. Following the fourth
fault, the FDR recorded different signatures that were similar to the FAC CB‟s being reset resulting in
electrical interruption to the FAC’s.
The electrical interruption to the FAC caused the autopilot to disengage and the flight control logic to
change from Normal Law to Alternate Law, the rudder deflecting 2° to the left resulting the aircraft
rolling up to 54° angle of bank.
Subsequent flight crew action leading to inability to control the aircraft in the Alternate Law resulted
in the aircraft departing from the normal flight envelope and entering prolonged stall condition that
was beyond the capability of the flight crew to recover.
Issues such as flight approval considered did not contribute to the accident and was not investigated. The FDR
data did not show any indication of the weather condition affecting the aircraft.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 129
Following this accident, the Indonesia Air Asia has performed several safety actions.
KNKT issued several recommendations to Indonesia Air Asia, Director General of Civil Aviation (DGCA), US Feder-
al Aviation Administration and European Aviation Safety Administration (EASA) and Airbus.
The KNKT recommend expediting the implementation of mandatory for upset recovery training earlier than
2019.
Ireland
Registration Aircraft Type Location Date of event Event Type
SWEARINGEN
EC-ITP Cork Airport 10/02/2011 Accident
SA227
On 10 February 2011, a Fairchild SA 227-BC Metro III registered EC-ITP, was operating a scheduled commercial air
transport flight from Belfast City (EGAC) to Cork (EICK) with 2 Flight Crew members and 10 passengers on board.
At 09.50 hrs during the third attempt to land at EICK in low visibility conditions, control was lost and the aircraft
impacted the runway. The aircraft came to rest inverted in soft ground to the right of the runway surface. Post
impact fires occurred in both engine nacelles which were extinguished by the Airport Fire Service (AFS). Six per-
sons, including both pilots, were fatally injured. Four passengers were seriously injured and two received minor
injuries.
The European Aviation Safety Agency should review Council Regulation (EEC) No 3922/91 as amended by Com-
mission Regulation (EC) 859/2008, to ensure that it contains a comprehensive syllabus for appointment to
commander and that an appropriate level of command training and checking is carried out.
The CRM extension recognises the importance of Human Performance and its non-technical skills. Empha-
sis is given on Threat and Error Management, which has been instrumental in the development of Evidence
Based Training (EBT) as a pilot training concept. EBT pilot competences address both technical and non-tech-
nical skills and are used as countermeasures to threat and errors.
The Agency considers that the Commander competence is essential and has already taken measures to de-
velop their knowledge and non-technical skills.
While in the process of conducting separate flights for the calibration of navigation aids at EIKN, the lateral sep-
aration between two calibrating aircraft reduced to 0.42 nautical miles (NM) with no vertical separation. One
aircraft initiated avoiding action following a Traffic Advisory System (TAS) warning and subsequently declared an
AIRPROX. Both aircraft landed without further incident. There were no injuries. A total of five Safety Recommen-
dations have been made as a result of this Investigation.
The European Aviation Safety Agency (EASA) should consider a requirement for calibration aircraft operating in
Europe to be fitted with TCAS.
The aircraft, a Cessna TU206G, was being used for parachuting/skydiving activities at Abbeyshrule (EIAB) on the
day of the accident. Shortly after take-off, the Pilot felt what was described as a “knock” following which the en-
gine lost power. This resulted in the Pilot making a forced landing in a nearby field. There were five people on
board the aircraft - the Pilot and four skydivers. The skydivers comprised of two tandem pairs, with each pair
being made up of a qualified skydiver and a person skydiving for charity secured to him. Following the forced
landing, all occupants successfully evacuated the aircraft, which sustained substantial damage.
The Pilot and qualified skydivers reported no injuries at the scene. The two charity skydivers attended a local
hospital, but were released a short time later. The Investigation found that the cause of the engine power loss
was a failure of the crankshaft.
The European Aviation Safety Agency should consider issuing a Safety Information Bulletin highlighting the im-
portance of using the correct sealant/process on the crankcase parting surfaces of engines manufactured by
Teledyne Continental Motors.
Italy
Registration Aircraft Type Location Date of event Event Type
TECHNOAVIA
HA-YDJ Casale Monferrato 29/08/2015 Accident
SMG92
L’incidente è occorso in data 29 agosto 2015, alle ore 12.00 UTC (14.00 ora locale), nelle immediate vicinanze
dell’aeroporto di Casale Monferrato, all’aeromobile di tipo SMG-92 Turbo
Finist marche di identificazione HA-YDJ, con 11 persone a bordo (1 pilota e 10 paracadutisti). Il velivolo, subito
dopo il decollo, nella fase di salita iniziale, ancora all’interno del perimetro
dell’aeroporto e su prua pista, perdeva quota e precipitava in un fossato appena fuori della recinzione aeropor-
tuale. Gli occupanti riportavano lesioni gravi.
ANSV recommends EASA to extend the applicability of AD No. 2015-0014 also to other S/N of the M601 engine,
potentially re-evaluating the criteria for identifying the parameters used in the risk assessment process which led
to the identification of the list of the S/Ns affected by the aforementioned AD. [ANSV-1/2354-15/1/A/16]
AIRBUS Serious
G-EZTC MXP - Milan Malpensa Airport 12/08/2013
A320 incident
L’incidente è occorso il 12 agosto 2013, alle ore 16.16’ UTC (18.16 ora locale), in località aeroporto Milano Mal-
pensa (LIMC), ed ha interessato l’aeromobile tipo Airbus A320-214 marche di identificazione G-EZTC.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 134
Durante la corsa di decollo per pista 35R si verificava il distacco di parti della cappottatura del fan del motore
sinistro. L’equipaggio del G-EZTC veniva allertato via radio dal pilota di un aeromobile al suolo che aveva assis-
tito all’evento. Il comandante veniva informato dell’accaduto anche dalle assistenti di volo, le quali, a loro volta,
erano state informate dai passeggeri seduti in prossimità del motore sinistro, che avevano osservato il distac-
co della cappottatura. L’equipaggio di condotta dichiarava l’intenzione di rientrare a Malpensa con priorità
all’atterraggio, in condizioni di overweight. L’atterraggio avveniva sulla pista 35L e, durante la corsa al suolo,
avveniva il distacco di ulteriori parti della medesima cappottatura. Il velivolo rientrava al parcheggio ed i passeg-
geri sbarcati con procedura normale.
ANSV recommends EASA to highlight to civil aviation national authorities that when certifying the maintenance
organization it must be ascertained that the organization MOE procedures, safety policy and safety standards
adequately indicate and encompass requirements and methods to use the applicable technical documentation
during maintenance activities. [ANSV-13/1656-13/1/A/16]
The lack of a specific procedure in the FCOM, in the QRH and in the FCTM addressing the situation of an engine
fan cowling opening or detachment in flight leave ample margins of discretion to the crew regarding precau-
tions and proper actions to apply.
ANSV recommends EASA to propose Airbus to evaluate the development and addition of a specific procedure,
in the applicable flight operating manual, addressing the specific situation of an engine fan cowling opening or
detachment in flight.
Durante un volo sperimentale volto alla verifica delle caratteristiche di controllabilità dell’elicottero, avveniva un
calo di giri del motore a partire dalla condizione di hovering.
L’aeromobile, che si trovava inizialmente ad una quota di circa 35 m AGL, perdeva quindi quota velocemente fino
ad impattare contro il terreno. L’intero volo è durato circa 10’.
In case of engine failure on a manned helicopter, the pilot would start an autorotation maneuver in order to de-
crease the vertical velocity. The unmanned helicopter under investigation was not equipped with an automatic
system able to reduce the vertical velocity, lessening the effect of the ground impact. In this framework, it is im-
portant to highlight that the EASA document “Policy Statement, Airworthiness Certification of Unmanned Aircraft
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 136
Systems (UAS) - E.Y013-01”, paragraph 7.1 “Emergency Recovery Capability”, states: «no mandatory airworthiness
requirement to fit or configure systems to provide an emergency recovery capability».
Therefore, it is recommended to take into consideration the possibility that unmanned helicopters will have, as
mandotory requirement, automatic emergency recovery capabilities able to reduce the vertical velocity acquired
following an engine failure. This would consequently lessen the effect of the ground impact.
TECNAM
I-CTAC Aeroporto Catania Fontanarossa 06/02/2016 Accident
P2002
Durante un volo scuola condotto secondo le regole VFR, dopo l’atterraggio avvenuto per RWY 08, in fase di de-
celerazione per uscire al raccordo “C” come istruito dalla TWR, il velivolo imbardava violentemente verso destra.
La semiala sinistra toccava il suolo ed il carrello anteriore collassava. Il velivolo continuava la sua corsa striscian-
do al suolo, fermandosi con una posizione di circa 90° rispetto all’asse pista.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 137
[Italian] - Durante il sopralluogo operativo si è riscontrato empiricamente che la forza opposta dalla leva di aziona-
mento freno parcheggio risultava molto blanda, al punto da consentire un azionamento involontario della stessa.
Nel contempo si è verificato che nel Tecnam P2002-JF Aircraft Maintenance Manual non viene fornita una indica-
zione quantitativa su come regolare tale leva, lasciando alla sensibilità del singolo manutentore la decisione di una
eventuale regolazione o sostituzione di parti usurate.
Inoltre, nell’ambito dell’inchiesta di sicurezza si è potuta verificare la discrepanza sulla regolazione del valore di pres-
sione degli pneumatici esistente tra il predetto Aircraft Maintenance Manual e l’Aircraft Flight Manual.
fornire ai manutentori del tipo di aeromobile in questione informazioni quantitative per la regolazione
della leva del freno parcheggio, sufficienti ad impedire un suo azionamento involontario, stante l’attuale
mancanza di indicazione di resistenza minima che tale comando debba opporre alla sua attivazione;
rendere uniformi i valori di pressione di gonfiaggio degli pneumatici contenuti nell’Aircraft Flight
Manual e nell’Aircraft Maintenance Manual, eliminando le discrepanze attualmente esistenti.
[ANSV-4/169-16/1/A/17]
Netherlands
Registration Aircraft Type Location Date of event Event Type
In 2014 the Dutch Safety Board published the study “Pitch-up upsets due to ILS false glide slope”. The Dutch Safe-
ty Board launched this investigation based on the investigation to an incident at Eindhoven Airport.
During the approach to Eindhoven Airport (The Netherlands) on 31 May 2013, a Boeing 737-800 was radar vec-
tored towards runway 21 for a landing with the aid of the Instrument Landing System (ILS). The aircraft was flying
under Instrument Meteorological Conditions (IMC). During the latter stage of the approach, the aircraft was
above the intended 3 degree Gilde Path. After the Localizer was captured, a Glide Slope intercept from above was
executed. The Autopilot Flight Director System (AFDS) and the Auto Throttle (AT) were engaged. The Approach
mode was armed and the aircraft was configured for landing.
At short final, approximately 0.85 NM from the threshold at 1060 feet altitude, the Glide Slope was captured.
Upon Glide Slope capture, a pitch increase of 24.5 degrees aircraft nose up (ANU) occurred in about 8 seconds.
The crew pressed the ‘take-off/go-around’ (TOGA) button for a go-around, almost simultaneously followed by
the activation of the stick shaker warning. During the following approach to stall recovery manoeuvre there was
a second stick shaker activation. The crew made a successful go around and landed at Eindhoven Airport.
The activation of the aircraft’s stick shaker during an autopilot coupled ILS approach in close proximity to the
runway was a factor of interest that prompted the Dutch Safety Board to start an investigation. The occurrence
(henceforth: the Eindhoven incident) has been categorized by the Safety Board as a serious incident.
It became clear during the investigation that the Eindhoven incident was not unique. Four other occurrences
with autopilot commanded pitch-up upset during ILS approach from above the 3 degree Glide Slope were iden-
tified. These incidents took place with different types of aircraft, operated by different airlines, on approach to
different airports.
These findings led the Dutch Safety Board to conclude that little known ILS signal characteristics pose a signif-
icant threat to aviation safety, as they may result in unexpected aircraft behaviour and my thus endanger the
safety of passengers and flight crews. Because identified occurrences, combined with the potential severity of
this hazard, the Dutch Safety Board decided to asdress this issue separately.
This report (study) represents the investigation into the ILS signal characteristics and the SMS framework. The
other findings from the Eindhoven incident are presented in a separate report, issued contemporaneously.
To the regulators involved with the manufacturing of transport category aircraft; European Aviation Safety Agen-
cy (Europe), Federal Aviation Administration (USA), Agência Nacional de Aviação Civil (Brasil), Civil Aviation
Administration of China, Federal Air Transport Agency (Russian Federation), Japan Civil Aviation Bureau, and
Transport Canada.
5. Training regulations
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 139
Review the applicable regulations on initial and recurrent flight crew training to assess whether they adequate-
ly address the potential degradation of situational awareness (basic pilot skills) and flight path management due
to increased reliance on aircraft automation by flight crews.
The newly developed advanced UPRT course, which is to be mandated as an addendum to ATP and MPL
training courses and also to serve as a prerequisite prior to commencing the first type rating course in
multi-pilot operations, is an important step towards enhancing a commercial pilot’s resilience to the psy-
chological and physiological aspects often associated with upset conditions. It develops the ability of the
pilot to cope with unforeseen events.
In support of the new standards, appendix 9 — Training, skill test and proficiency checks for MPL, ATPL,
type and class ratings, and proficiency checks for IRs is amended to include UPRT. It emphasizes regular
training on manual flying manoeuvres and procedures with or without flight directors and at different
speeds and altitudes (7.1).
In line with ICAO, the opinion and the decision mentioned above propose UPRT to proficiency during in-
itial and recurrent training. The amended skill test and proficiency checks supported by operators’UPRT
recurrent training and conversion course reinforce pilot competence through regular training.
AVIONS ROBIN
PH-SPZ Rotterdam The Hague Airport 08/07/2013 Accident
DR400
AVIONS ROBIN
PH-HLR Rotterdam The Hague Airport 04/07/2014 Accident
DR400
On 8 July 2013 and 4 July 2014, respectively, two aeroplanes of the make and model Apex DR400/140B were
seriously damaged by fire. In both cases, the fire started during taxi after landing, on the left-hand side of the
aeroplanes, destroying the left-hand wing. Since the two fires seemed of a similar nature and both aeroplanes
were operated by the same flying club, Dutch Safety Board decided to combine the two investigations into the
cause of these fires.
Advise the manufacture of the Apex DR400 to improve the aeroplane’s brake unit, as to prevent overheating of
the brake disk as a result of friction between the brake disk and brake pads.
Norway
Registration Aircraft Type Location Date of event Event Type
Over a 10-year period, the Accident Investigation Board Norway (AIBN) has received 30 reports of accidents
and incidents related to operations on contaminated and slippery runways. Nine of these concerned accidents
and serious incidents. In the same period AIBN has published 12 investigation reports and issued 36 safety
recommendations.
Although the majority of the incidents were less serious in which the pilots regained control of a sliding aircraft,
or the aircraft left the runway or taxiway at a low speed causing limited damage to personnel and aircraft, the
accident at Stord Airport in 2006 shows the potential for a fatal accident following a runway excursion. Interna-
tionally, runway excursions are considered as being one of the high risk areas.
In 2006, the AIBN decided to perform a theme investigation into the theme ‘winter operations and friction
measurements and conditions for friction predictions’ to supplement the individual safety investigations. The
individual safety investigations focused on the operators and their possible safety actions. The theme investiga-
tion focuses on the general framework for operations on contaminated and slippery runways and the potential
for safety improvements in general. The AIBN has accumulated and analysed a large volume of documentation,
reports, test and research data from various national and international sources in addition to consulting exper-
tise in the field of micrometeorology.
The AIBN recommends that FAA, EASA and CAA Norway evaluate the airlines’ crosswind limits in relation to fric-
tion values and consider whether they should be subject to separate approval by the authorities.
Furthermore, guidance is provided in Safety Information Bulletin (SIB) No 2014-20 on ‘aeroplane opera-
tions in crosswind conditions’, which was published by the Agency on 23 June 2014. The overall objective
of the SIB was to raise awareness of the risks associated with operations in strong and/or gusty crosswind
conditions. This includes factors which aircraft manufacturers, operators and approved training organisa-
tions should take into account when developing or revising approved aircraft flight manuals (AFMs), flight
crew operating or training manuals, operational procedures and limitations, and initial and recurrent
flight crew training programmes. Notably, the SIB recommends that operators and training organisations
consider publishing operational crosswind limitations which take into account their operational experi-
ence and the operating environment (e.g. runway width and state, prevailing weather conditions, etc.).
These limits should be based on the AFM maximum demonstrated crosswind value, when more limiting
values are not published in the limitation section of the AFM. The Agency considers that the safety issue
is adequately addressed through this SIB.
Any future action, if deemed necessary, will be taken through systematic implementation of the Agen-
cy’s Safety Risk Management process and the associated rulemaking and safety promotion programmes
and the European plans for aviation safety.
Romania
Registration Aircraft Type Location Date of event Event Type
On 20.01.2014, the Civil Aviation Safety Investigation and Analysis Center (CIAS) was notified indirectly by phone
about the accident. Subsequently CIAS received an „Air Safety Report” (ASR), from the operator representing the
written communication of the accident in which it was involved a BN-2A-27 aircraft, registered YR-BNP.
BN-2A-27 aicraft, radio call indicative ”RFT 111”, performed a flight from Bucharest – Băneasa Airport to Oradea
Airport, having on board a crew of two pilots and 5 passengers. The flight was performed based on an IFR flight
plan, the aircraft took off at 13.38 LT. The last radio communication between the aircraft and the air traffic agen-
cies was made at 15.34.51 LT, at the distance of approximately 52 NM from the point ROŞIA (air radio reporting
point). At 15.47 LT a passenger of the aircraft informed by phone that the aircraft crashed, but without being able
to communicate their exact location. The wreckage of the aircraft was located after almost 5 hours from receiv-
ing the information, in the vicinity of Horea commune, Petreasa village, Alba County.
As a consequence of the accident, the aircraft was destroyed, five of the persons on board were injured and two
died.
The cause of the accident occurrence consisted in the engine shutdown due to the severe icing of carburettors
based on the following favouring causes:
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 143
incorrect assessment of risk factors specific to the development of this flight due to long interruption
from flight and to the crew’s lack of experience on BN-2A-27 aircraft, included in MEP class;
incorrect decision of the aircraft Captain to fly for a long period of time in icing conditions;
incorrect decision of the aircraft Captain to take off with a weight over the maximum admitted lim-
it and with gravity center position outside the limits calculated and imposed by the manufacturer;
incorrect decision of the aircraft Captain to continue the mission in IMC flight conditions on IFR flight
rules below AMA;
long-time flight interruption and lack of experience of the crew on this MEP class aircraft.
EASA should consider to establish some requirements for the air traffic service providers on the management of
unintentional situations, such as possible infringements of the routes provided in the flight plan, of the minimum
flight levels, of the minimum navigation requirements, and so on, determined by problems such as weather con-
ditions, technical ones, determined by the aircraft performances and/or by other factors through which the air
traffic controllers would require these crews confirmation on the flight rules they followed.
Romania 20/11/2016
It is recommended for EASA to take all the necessary actions to ensure that all operators performing domes-
tic flights are providing the safety briefing for the emergency cases stipulated by CAT.OP.MPA.170 PASSENGER
BRIEFING of Regulation (EU) No 965/2012 also in the official language of the state on which’s territory the flight
is being carried on.
Through their oversight, certification and enforcement responsibilities under ARO.GEN.300 of the air
operations regulation, the competent authority is required to verify that the operator to whom the Air
Operator Certificate (AOC) shall be/has been issued complies with the applicable requirements.
Therefore, the operator should demonstrate to the competent authority how the passenger briefing/
demonstration will satisfy the requirement to give it ‘in a form that facilitates the application of the pro-
cedures applicable in the event of an emergency’.
Russian Federation
Registration Aircraft Type Location Date of event Event Type
ATR
VP-BYZ Roschino (Tyumen) airport 02/04/2012 Accident
ATR72
On 02.04.2012, at 01:35 UTC (07:35 local time), at day time, under VMC after the take-off from the Roschino (Ty-
umen) airport RWY 21, the АТR72-201 VP-BYZ aircraft, operated by JSC “UTAir Aviation” (further referred to as
“UTAir”) crashed while performing the scheduled passenger flight UTA120 from Tyumen to Surgut.
According to the load sheet the A/C TOW and centre of gravity were 18730 kg and 30.72 % MAC corresponding-
ly and that was within the aircraft operation limits. Onboard there were 4 crew members (PIC, F/O and two flight
attendants) and 39 passengers, all RF citizens.
After the landing gear and the flaps retraction the aircraft started descending with a significant left bank and
then collided with terrain. The ground collision first led to the structural damage of left wing followed by the
fuel spillage and fire, and further to the complete destruction of aircraft with the right wing, cockpit and rear
section with empennage separation.
Out of the 43 persons on board, 4 crew members and 29 passengers were killed. Others received serious injuries.
Interstate Aviation Committee (MAK) recommends EASA and other simulator certification authorities to consider
the possibility to add into the simulator data-package the capability to simulate an unexpected or sudden air-
craft stall at any stage of flight.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 146
DASSAULT
F-GLSA Moscow - Vnukovo, Russia 20/10/2014 Accident
FALCON50
On 20.10.2014, at 19:58 UTC (23:58 local time), at night, during takeoff at Moscow (Vnukovo) A/D a Falcon 50EX
F-GLSA aircraft operated by Unijet crashed while conducting charter flight LEA074P from Moscow (Vnukovo) to
Paris (Le Bourget).
It is recommended that EASA, IAC Aviation Register, Rosaviatsiya and other certification authorities: Consider the
practicability to make mandatory for newly certified airplane (as per CS-25, AR-25 or equivalent) the installation
of a nose wheel steering accessible by each flight crew member at their duty position.
On January 2017 the crew of a cargo Boeing 747-412F a/c registration TC-MCL operated by ACT Airlines including
Captain, FO, loadmaster and a/c technician were performing Flight TK6491 transporting cargo from Chek Lap Kok
Airport (VHHH, Hong Kong) via Manas Airport (UCFM, Bishkek) to Ataturk Airport (LTBA, Istanbul). Manas Airport
was planned as a transit airport for refuelling and crew change. The approach was conducted to RWY 26. The
a/c overflown the entire length of the runway and impacted the ground near RWY 08 LMM. The a/c was totally
destroyed in the accident. The 4 persons on board were killed. 35 local residents of Dacha-SU settlement were
killed by the crash a/c and ground fire, 37 local residents got injuries of varying severity.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 148
It is recommended that the FAA in cooperation with the Boeing Company consider the practicability of changing
the A/P logic to prevent occurrences of following inertial glideslope descent (in LAND 3 or LAND 2 mode) in cas-
es when approach path does not allow landing in the appropriate area on the runway. It is recommended that
other certification authorities and aircraft manufacturers consider the applicability of this recommendation tak-
ing into account actual A/P algorithms.
Spain
Registration Aircraft Type Location Date of event Event Type
BOEING
G-BYAG Girona Airport, Spain 14/09/1999 Accident
757
The aircraft made an approach and landing at Girona Airport, Spain, at night through heavy thunderstorms with
rain. At a late stage of the approach the airfield lighting failed for a few seconds. The aircraft touched down
hard simultaneously on the nose and main wheels and bounced. A second harder touchdown on the nosewheel
displaced the nose landing gear and its support stucture. Resultant aircraft systems damage caused the loss of
virtually all electrical power, interference with controls and uncommanded forward thrust increase.
The aircraft ran off the side at high speed around 1,000 metres after the second touchdown. After crossing
a number of obstacles it landed heavily in a field outside the airfield boundary and come to rest after having
travelled almost 1,900 metres from the second touchdown. The fuselage had been fractured in two places and
there was considerable disruption to the cabin. There was no fire. Evacuation of all the occupants, initiated by
the cabin crew, was completed rapidly. Emergency services had difficulty in locating the aircraft in the adverse
conditions and arrived on the scene after evacuation had been completed.
It is recommended to EASA that they evaluate the possibility of making mandatory requirements to train flight
crew in go-around manoeuvres even from below the decision height, with the aim of reducing the response time
when faced with unforeseen events.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 149
DOUGLAS
EC-HFP Madrid-Barajas Airport, Spain 20/08/2008 Accident
DC9
On 20 August 2008 at 14:24 local time, a McDonnell Douglas DC-9-82 (MD-82) aircraft, registration EC-HFP, oper-
ated by Spanair, suffered an accident immediately after takeoff from Madrid-Barajas Airport, Madrid (Spain). The
aircraft was destroyed as a result of impact with the ground and the subsequent fire. Of the aircraft’s occupants,
154 were killed, including all six crew members, and 18 were seriously injured.
The crew lost control of the airplane as a consequence of entering a stall immediately after takeoff due to an im-
proper airplane configuration involving the non-deployment of the slats/flaps following a series of mistakes and
omissions, along with the absence of the improper takeoff configuration warning.
The crew did not identified the stall warnings and did not correct said situation after takeoff. They momentarily
retarded the engine throttles, increased the pitch angle and did correct the bank angle, leading to a deteriora-
tion of stall condition.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 150
The crew did not detect the configuration error because they did not properly use the checklists, which contain
items to select and verify the position of the slats/flaps when preparing the flight.
Specifically:
They did not carry out the action to select the flaps/slats with the associated control lever (in the “Af-
ter Start” checklist);
They did not cross check the position of the lever or the status of the flaps and slats indicating lights
when executing the “After Start” checklist;
They omitted the check of the flaps/ slats when doing the “Takeoff Briefing” in the “Taxi” checklist;
During the visual check performed as part of the “Final Items” in the “Takeoff Imminent” checklist, the
actual position of the flaps/slats as shown on the cockpit instruments was not verified.
The CIAIAC has determined that the following factors contributed to the accident occurrence:
The absence of takeoff configuration warning resulting from the failure of the TOWS to operate, which
thus did not warn the crew that the airplane’s takeofff configuration was not appropriate. The reason
for the failure of the TOWS to function could not be reliably established.
Improper crew resource management (CRM), which did not prevent deviation from procedures in the
presence of unscheduled interruptions to flight preparations.
It is recommended that the European Aviation Safety Agency and the Federal Aviation Administration (FAA) of
the United States require the Boeing Company to evaluate the operating conditions, in-service life, reliability
and failure modes of relays in position R2-5 of the ground sensing system in the DC-9, MD-80, MD-90 and B-717
series of airplanes and that it specify a maintenance program for this component based on the results of said
evaluation. [REC 08/09]
It is recommended to the European Aviation Safety Agency and to the Federal Aviation Administration (FAA) of
the United States that the design of Takeoff Warning Systems (TOWS) be reviewed in transport airplanes whose
certification standards did not require the installation of such systems or which, if they did require it, did not
apply to them the guidelines and interpretation provided by AMC 25.703 in the case of the EASA, or circular AC
25.703 in the case of the FAA. The goal of this review should be to require that the TOWS comply with the appli-
cable requirements for critical systems classified as essential in CS 25.1309 and FAR 25.1309. [REC09/09]
It is recommended that the United States Federal Aviation Administration (FAA) and European Aviation Safety
Agency (EASA) require takeoff stall recovery as part of initial and recurring training programs of airline trans-
port pilots. [REC 18/11]
The newly developed advanced UPRT course, which is to be mandated as an addendum to ATP and MPL
training courses and also to serve as a prerequisite prior to commencing the first type rating course in
multi-pilot operations, is an important step towards enhancing a commercial pilot’s resilience to the psy-
chological and physiological aspects often associated with upset conditions.
It should be noted that the exercise to be conducted includes recovery from a stall event in the take-off
configuration at a safe altitude. EASA and the rulemaking group concluded that requiring a stall event
recovery during the take-off phase cannot be realistically accomplished without the risk of negative trans-
fer of training.
In support of the new standards, the proposals place greater emphasis on the training of instructors in-
volved in the flight and synthetic training who are foreseen to deliver the various UPRT elements. EASA
proposes training up to the stall but does not propose post-stall training to be required in a full flight
simulator (FFS), due to the risk of negative transfer of training, and reiterates that existing flight simula-
tor training devices (FSTDs) may be used to facilitate UPRT.
In line with ICAO, the opinion and the decision mentioned above propose UPRT to proficiency during in-
itial and recurrent training.
It is recommended that the United States Federal Aviation Administration (FAA) and European Aviation Safety
Agency (EASA) study and assess the stall recovery procedure in the flight manuals of large transport airplanes to
include a check of the flap/slat lever and its adjustment, if required. [REC 19/11]
It is recommended that the European Aviation Safety Agency (EASA) establish requirements for flight simulators
so as to allow simulator training to cover sustained takeoff stalls that reproduce situations that could exceed the
flight envelope limits. [REC 20/11]
It is recommended that the European Aviation Safety Agency (EASA) undertake regulatory initiatives intended to
require commercial air transport operators to implement a program of line operations safety audits, as part of
their accident prevention and flight safety programs. [REC 30/11]
Safety performance monitoring and assessment should include safety audits by the operator focussing
on the integrity of the operator’s management system, and periodically assessing the status of safety risk
controls [see sub-paragraph (d)(2)(iv) of AMC1 ORO.GEN.200(a)(3)]. This replicates the principles behind
the line operations safety audits referred to in the safety recommendation through conducting a pro-
gramme of in-flight observations during normal operations.
Under an established process of continuous improvement the operator should conduct proactive and re-
active evaluations of procedures through safety audits and surveys; proactive evaluation of individuals’
performance to verify the fulfilment of their safety responsibilities, and reactive evaluations in order to
verify the effectiveness of the system for control and mitigation of risk [see sub-paragraph (f) of AMC1
ORO.GEN.200(a)(3)].
Furthermore, operators should operate an internal occurrence reporting scheme to identify those in-
stances where routine procedures have failed, and to take appropriate safety action (see Regulation (EU)
No 376/2014, applicable since 15 November 2015). This proactive, evidence-based approach is an essen-
tial part of the overall monitoring function and is complementary to the normal day-to-day procedures
and ‘control’ systems [see GM1 ORO.GEN.200(a)(3)].
In summary, through its management system, the operator should conduct safety audits to assess the
effectiveness of mitigation implemented (such as crew resource management training, threat and er-
ror management training, standard operating procedures) against risks identified. Through this process,
the operator should proactively promote best practices and enhance the organisation’s underlying safe-
ty culture.
It is recommended that the United States Federal Aviation Administration (FAA) and the European Aviation Safe-
ty Agency (EASA) clarify the definition of an inoperative element that is contained in the preamble to all Master
Minimum Equipment Lists (MMEL), so as to avoid interpretation errors in its application. [REC 31/11]
It is recommended that the European Aviation Safety Agency (EASA) issue an interpretation regarding the need
to identify the source of a malfunction prior to using the MEL, and that it assures that national authorities ac-
cept and apply the same standards with regard to their procedures for overseeing operators in their respective
States. [REC 33/11]
It is recommended that the European Aviation Safety Agency (EASA) draft guidelines and instructions so that
national authorities are better able to assess the general situation of commercial air transport operators that
undergo notable changes, such as rapid expansions, a significant growth in their resources, or the opposite
situation, a reduction in their activity or resources, such as through personnel layoffs, the purpose being for
authorities to constantly adapt their monitoring plans to consider their evaluation of these changes so as to pro-
actively detect and assess risk factors that point to a possible degradation in safety level. [REC 42/11]
The operator should have sufficient qualified personnel for the planned tasks and activities to be per-
formed in accordance with the applicable requirements (see sub-paragraph (c) of ORO.GEN.210).
The operator should manage safety risks related to a change. Complex operators may establish a safety
action group to assist or act on behalf of the safety review board which is described under AMC1 ORO.
GEN.200(a). The group should assess the impact of operational changes on safety [see sub-paragraph (d)
(3) of GM1 ORO.GEN.200(a)(1)].
Any change affecting the scope of the air operator certificate or the operations specifications or any of
the risk management elements of the operator’s management system requires prior approval by the com-
petent authority (see ORO.GEN.130). Typical examples of such changes are related to a change of legal
entity, the operator’s scope of activities, additional locations of the operator, or changes to the facilities
[see sub-paragraph (a) of GM1 ORO.GEN.130(a)].
Changes not requiring prior approval shall be managed as defined in the procedure approved by the
competent authority (see sub-paragraph (c) of ORO.GEN.130). The competent authority shall assess the
change information provided by the organisation, to verify compliance with the applicable requirements
(see sub-paragraph (c) of ARO.GEN.330).
As part of initial certification and continuing oversight of an operator, the competent authority should
evaluate the operator’s safety risk assessment processes related to hazards identified by the operator [see
AMC2 ARO.GEN.300(a);(b);(c)].
As part of its continuing oversight, the competent authority should continue to assess the organisation’s
compliance with the applicable requirements, including the effectiveness of the management system [see
GM1 ARO.GEN.300(a); (b);(c)].
When determining the oversight programme for an organisation, the competent authority should
consider the scope of changes not requiring prior approval [see sub-paragraph (a)(2) of AMC1 ARO.
GEN.305(b);(d);(d1)]. If the organisation has continuously demonstrated that it has full control over all
changes, the oversight planning cycle may be adjusted accordingly by the competent authority (see sub-
paragraph (c)(2) of ARO.GEN.305).
Effective implementation of the above-mentioned provisions should ensure that the risks associated with
changes in the organisation are suitably mitigated by the operator, and that the effectiveness of the mit-
igation is continuously monitored by the operator and the competent authority.
SUKHOI Serious
EC-HPX Ocana Airport, Toledo 05/03/2001
SU29 incident
On 5 March 2001, a Sukhoi aircraft on a local flight over the Ocana Aerodrome (Toledo) suffered a jammed rud-
der, which forced the pilot to land using the other control surfaces.
The aircraft had taken off a few minutes earlier from runway 11 at the aerodrome to conduct tests as part of the
approval process for certifying the aircraft in Spain.
Over the course of the flight and after some manoeuvres, the pilot noticed that the rudder control was jammed
to the right. He reported this on the radio, and it was suggested to him that he parachute from the aircraft. The
pilot was able to compensate for the lack of rudder by banking to the left. He made an approach to runway 11
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 157
and managed to land. During the landing run, without steering control, the aircraft departed the runway and
came to a stop in a grassy area next to the runway.
Once the aircraft stopped, the rudder was unjammed and, there being no apparent damage, the aircraft was tax-
ied to the stand without external assistance. The pilot was unharmed.
It is recommended that EASA ensure that the flight control systems on Sukhoi 29 be designed such that neither
the occupants nor objects in the cockpit can cause jamming, chafing or interference in said systems, or if they
do, that the pertinent corrective actions be established. [REC 08/12]
On Wednesday, 10 August 2016, at approximately 16:50 local time, a PZL-Swidnik W-3AS Sokol aircraft, registra-
tion SP-SUC, was involved in an accident while taking part in firefighting activities.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 158
The aircraft, which was at the Forest Firefighting Support Squad (BRIF) base in the town of Puntagorda, on the is-
land of La Palma, was mobilized at around 15:00 to take part in firefighting efforts in the town of Villa de Mazo.
After making 12 drops in the area, the forward command post instructed its crew to proceed to a different point
from the last one but where they had already made a drop. While executing the approach maneuverer to make
a drop at that point, the helicopter started to yaw left at an increasing rate, eventually becoming uncontrollable.
The aircraft crashed into the mountainside and was significantly damaged. The two occupants were taken to
a hospital for observation.
The investigation has concluded that this accident was likely caused by a loss of tail rotor effectiveness (LTE),
which the pilot was late in identifying, resulting in a loss of control of the helicopter, which ended up impact-
ing the terrain.
Contributing to the accident is the fact that the water was not dropped and the bucket was not released.
It is recommended that the EASA standardize the theoretical and practical training on the LTE phenomenon
among the various helicopter training programs for obtaining the LAPL(H), PPL(H), CPL(H), ATPL(H) and FI(H) li-
censes. This training should benefit the level of complexity and responsibility associated with each license. [REC
27/17]
There is an optimum balance between personnel competence and heavier organisation approval process
versus the privilege to manage the complexity of training programmes for commercial licences, taking
into account the various type ratings and associated flight Crew Operational Suitability Data. The Agency
does not regulate into the details such training programme, but the approval process is there to guaran-
tee continued quality standards in training delivery. ORA.GEN.200 Management system also ensure that
compliance monitoring function and a safety management system are in place.
As a support, the Agency, published documentation such as the “EHEST Helicopter Flight Instructor Man-
ual” or the “EHEST Leaflet HE 5 Risk Management in Training”. Both cover the LTE in detail.
Following this Safety Recommendation, the Agency did a safety review of LTE occurrences. This review
did not reveal any obvious weakness in the commercial training programme compared to private pilots.
LTE phenomena involving private pilots are often associated with low experience pilots flying on low
performance helicopters. LTE phenomena involving commercial pilots are often associated with the risk
management of complex operations or manoeuvers such as sling release, high altitude operations or
highly specific photography shooting.
As a follow-up, the Agency intends to review this topic with Competent Authorities of EASA Member
States and establish whether some concerns exist in the development of training programme by ATO es-
pecially using the very specific example of LTE.
Following this review, the Agency will provide feedback.
On Tuesday, 19 May 2015 at 14:00, helicopter EC-LXF took off from the temporary heliport in Huércal-Overa (Alm-
ería) on a positioning flight to La Seu d’Urgell (Lleida). Onboard the aircraft were the pilot and another occupant
who was also a helicopter pilot but who had no flight duties in the cockpit.
Upon reaching the Valencia TMA, the pilot requested to proceed from Cullera to Sagunto along the coastline at
1000 ft or below, which Valencia Approach Control authorized.
While flying over the sea, they heard a loud noise in the helicopter, which started rotating violently left while
banking right.
The pilot ditched the aircraft and issued a MAYDAY on the radio at 15:18. The helicopter fell into the sea and
sank. The occupants managed to exit the aircraft under their own power.
An aircraft flying in the area received the MAYDAY call and notified Valencia approach control. Upon verifying
that they had lost the radar signal from the aircraft, they activated the search and rescue services.
The helicopter wreckage could not be found despite a months‐long search under water.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 160
Based on the statements of the helicopter’s occupants, the most probable cause of the accident seems to have
been the interruption of power transmitted from the engine to the main transmission through the shaft joining
them.
It is recommended that the European Aviation Safety Agency (EASA) considers the suitability of ruling the need
to conduct water survival training for flights over water in specialized air operations, as they are defined in Reg-
ulation (EU) 965/2012, part SPO. [REC 17/17]
In addition, the safety issue has recently been evaluated by EASA through rulemaking task RMT.0409
on helicopter offshore operations (HOFO), which concluded with the publication of additional legisla-
tive mitigation (Commission Regulation (EU) 2016/1199 of 22 July 2016 amending Regulation (EU) No
965/2012, and the associated Executive Director Decision 2016/022/R) for operations with the highest ex-
posure to the safety risk ie commercial HOFO and non-commercial HOFO with complex motor-powered
helicopters (applicable from 01 July 2018), as follows:
Provisions on Specific Approvals (SPA) under SPA.HOFO, including, for example:
additional procedures and equipment for operations in a hostile environment, for example, life
jackets, survival suits, emergency breathing systems, life rafts (SPA.HOFO.165);
water entry and sea survival training for flight crew (SPA.HOFO.170 (a)(3));
implementation of operating procedures (SPA.HOFO.110).
The above-mentioned provisions are expected to achieve an acceptable level of safety with regard to wa-
ter survival in the event of a survivable accident over water, taking into account the level of exposure to
the risk.
Lastly, EASA has in place a Safety Risk Management process, which, through routine monitoring based
on data analysis, aims to identify any weaknesses in the regulatory framework in order to take appropri-
ate action to close any safety gaps.
RANS
EC-YDQ San Javier-Murcia 15/07/2016 Accident
S6
The pilot was flying a second traffic circuit of the “Los Garranchos” airfield, in the municipality of San Javier (Mur-
cia). Based on information provided by eyewitnesses, during the final phase of the circuit the engine misfired
and seemed to stop. The aircraft pitched up and veered to its right, vertically impacting the terrain. The pilot was
killed as a result of the impact. The aircraft was outfitted with a ballistic parachute. While this parachute was be-
ing deactivated by specialized personnel, a fire broke out that affected the aircraft.
The investigation concluded that the accident occurred due to a loss of control of the aircraft after the downwind
leg of the airfield circuit. No signs were found that the aircraft and/or its components malfunctioned, although
it could not be rule out that a drop in power at the most critical point in the circuit surprised the pilot, who did
not have experience on the aircraft.
the wind conditions that day at the airfield, with moderate wings and strong gusts that could have af-
fected the aircraft’s behavior at the most critical point in the circuit if the engine failed,
the pilot’s lack of experience on this aircraft type, which was less powerful and had an opposite direc-
tion of propeller rotation than his usual aircraft and
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 162
the fact that the pilot had been tuning up the engine before making the first flight with the aircraft,
which might have contributed to a possible engine failure.
The investigation also conducted an analysis on the use of ballistic parachutes on aircraft and the lack of knowl-
edge that emergency personnel (firefighting, rescue, etc.) have regarding this system.
Several safety recommendations are issued in this regard on the need to warn, inform and train said personnel
in order to avoid an inadvertent ignition of the system, which could compromise the physical integrity of nearby
individuals in the event of an aircraft accident or incident in which the parachute does not deploy.
It is recommended that the European Aviation Safety Agency (EASA) lay out the measures required so that air-
craft equipped with a ballistic parachute reflect this in the flight plan as part of point SERA.4005, Contents of
a flight plan, “Emergency and survival equipment”. [REC 38/17]
It is recommended that the European Aviation Safety Agency (EASA) lay out the measures required to initiate,
at the European level, an awareness, information and training campaign directed at general aviation users and
emergency services personnel on the existence, identification, location and deactivation of ballistic parachutes
in the event of an accident or incident. [REC 40/17]
It is recommended that the European Aviation Safety Agency (EASA) should liaise with International Civil Avia-
tion Organization (ICAO) to include standards for the design (conspicuity, coloration, visibility, and content) in the
installation of ballistic parachute systems. This should include, as compulsory for pyrotechnical systems, specifi-
cations of the routing of the components of the system and a thermal exposure indicator to enable emergency
responders to quickly and safely disable the system, and fully alert persons to the hazards and the danger areas
on the aircraft. [REC 42/17]
Sweden
Registration Aircraft Type Location Date of event Event Type
The flight was a regular flight with passengers from Stockholm/Arlanda airport to Nice in France. The airplane
was equipped with 148 seats and had 145 passengers on board.
During the preparations for engine start on the apron the electrical power from the airplane’s APU-generator
ceased, and resulted in that the main lighting in the cabin extinguished and the cabin internal communication-
and advertisement system stopped to function.
The pilots continued with the preparations for flight and during start of the right engine short fire flames from
engine’s exhaust appeared. A small pool of fuel on the ground behind the engine also caught fire, but soon ex-
tinct spontaneously.
Some of the passengers observed the fire flames and called “it is on fire”. This led to that a number of passengers
left their seats and moved forward toward the exits. The cabin crew in the forward part of the cabin could not
properly assess the situation, since the passengers prevented both view and passage backward, but concluded
that there was a safety risk. An emergency evacuation was therefore initiated by the cabin crew in the forward
part of the cabin.
The cabin crew member in the rear part of the cabin observed that both the flames from the engine and the
fire on the ground soon ceased, considered that there was no further risk for fire. Because of the electrical pow-
er loss, there was however no possibility by normal procedures to communicate with the other crew members.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 164
The airplane was evacuated through the front doors. No person was injured in the emergency evacuation.
The serious incident to personal injury at the unexpected evacuation of the aircraft was caused by that the cab-
in attendants were unable to control or prevent the course of events in the cabin, when spontaneous calls about
“fire” had started a reaction among the passengers.
The European Aviation Safety Agency is recommended to consider the need for expanded information and
checking of understanding emergency evacuation procedures, of passengers who are expected to act in emer-
gency evacuation of aircraft. [RL 2010:10 R2]
BAE Serious
SE-MAP Helsinki Vantaa airport 11/01/2010
ATP incident
A cargo aircraft of type BAe ATP was to fly from Helsinki to Copenhagen. Owing to the prevailing weather con-
ditions, the aircraft had undergone a twostep deicing prior to departure. In the two-step deicing procedure, hot
water is mixed with glycol (Type I fluid) to remove ice, frost and snow from critical surfaces on the aircraft; after
this, a fluid containing thickening agent (Type II/IV) is applied, to prevent ice from reforming. At takeoff, the con-
trol column could not be pulled back when the rotation speed was reached, and the pilot felt that the elevator
movement was restricted. Takeoff was aborted and the aircraft taxied back to the apron.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 165
Once SHK’s investigation had started, it was discovered that several similar incidents involving the same type
of aircraft and similar conditions had occurred. Following an initial technical inspection, it could be noted that
the individual craft which had experienced these incidents shared certain common denominators: deicing with
Type II/IV, combined with too narrow a gap between the stabiliser and elevator, were determining factors in the
incidents.
In collaboration with one of the operators, SHK has carried out a series of tests to recreate and document the
phenomenon. The test results verified the connection between too small an elevator hinge gap and elevator re-
strictions, in situations where deicing had been carried out using fluids containing thickening agents.
The investigations also showed that the process for drawing up specifications and requirements for deicing fluids
is, to a certain extent, controlled by trade organisations. The investigation found, too, that at present no moni-
toring or specific inspection activities relating to these fluids are carried out by any pan-European aviation safety
body. Neither is there any authorisation process, or any set certification rules, with regard to the types of aircraft
which can/may use different types of deicing fluids.
The incidents involving elevator restrictions were caused by a phenomenon which, for unknown reasons, occurs
following the use of anti-icing fluids containing thickening agents, on individual aircraft where the stabiliser and
elevator are too close together. One contributory factor was the fact that there were shortcomings in that part
of the aircraft’s type certification exercises that concerned anti-icing.
It is recommended that EASA should investigate the possibility of tightening requirements on aircraft design or-
ganizations in terms of demonstrating that the aircraft has full manoeuvrability during all phases of the takeoff
procedure after the application of de- and anti-icing fluids. [RL 2011: 16e R2]
AIRBUS
EP-IBB Stockholm/Arlanda Airport 16/01/2010 Incident
A300
Operational
The incident occurred in connection with a commercial air transport with the airline Iran Air. The aircraft in ques-
tion, an Airbus A300-600 with the registration EP-IBB, was to commence a flight from Stockholm/Arlanda Airport
to Tehran in Iran. Following normal preparations, the aircraft was taxied out to runway 19R for take-off.
The runway conditions were reported as good, with some patches of ice along the runway. The investigation
has however revealed that the runway was contaminated and likely had coefficients of friction which fell short
of the reported values.
After taxiing out, the crew began routine take-off procedures by increasing engine thrust during acceleration on
the runway. After just over 10 seconds, one or more of the edges in a repaired section of the engine – the diffus-
er aft air seal – separated, thereby triggering a sequence which led to a sudden engine failure.
No warning messages were announced in the cockpit at the time of the failure; the pilots only noticed the en-
gine failure through a muffled bang at the same time as the aircraft began to veer to the left. The initial veer,
immediately after the engine seizure, was a result of the nose wheel being unable to gain sufficient force against
the contaminated surface to counteract the moment which arose when the right engine – for a duration of ap-
proximately 1.5 seconds – supplied full thrust at the same time as the left engine rapidly lost thrust. The highest
speed registered during the sequence was 59 knots (110 km/h).
Despite the co-pilot’s reactions – retarding the thrust levers after just over a second, at the same time as steering
and opposite rudder were applied – the veer could not be corrected and the aircraft ran off the runway, main-
ly caused by the forces from the moment in combination with the slippery surface. The chances of stopping the
continued veer were probably reduced by the fact that the pilots did not apply any differential braking in the op-
posite direction.
The investigation also showed that the pilots’ braking was unintentionally asymmetrical, with a higher brake
pressure on the “wrong side”, i.e., in the direction in which the aircraft ran off the runway. Even if this fact may
have affected the aircraft’s movement pattern, such an impact has, however, not been possible to determine
with any reasonable degree of certainty. It is, nevertheless, noteworthy that analyzed data from the FDR show
that the recorded brake angles (asymmetric braking) were not accompanied or followed by any corresponding
change in the rate of heading change.
There are no specific certification requirements for aircraft design organization to show that the aircraft is ma-
noeuvrable in the event of a sudden loss of engine thrust during the initial stage of the take-off sequence. There
are also no mandatory requirements for training regarding how to handle sudden losses of engine thrust dur-
ing the initial stage of the take-off sequence for pilots in training or recurrent training for this class of aircraft.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 167
Technical
Following the event, the engine was sent for examination to Lufthansa Technik (LHT) in Hamburg on behalf of
SHK. Following a completed damage analysis, LHT provided a report on the examination. In addition to an anal-
ysis of the sequence and the damage, the report also contained an opinion on the probable cause of the engine
failure.
According to LHT, it is likely that the diffuser aft air seal had come loose due to micro cracks in the nine attach-
ment lugs that hold the seal against the diffuser.
Neither General Electric Aircraft Engines (GE) nor SHK were in agreement with the LHT’s assessment of the recov-
ered hardware for which reason the decision was made for further analysis of the recovered parts of the failed
engine at the Volvo Aero Corporation metallurgical labs.
The analysis carried out by Volvo Aero Corporation indicated that the engine failure that occurred – and which
was the primary reason for the incident – had probably been caused by fatigue damage in a different part of the
diffuser aft air seal.
The engine failure started once the aft air seal separated from the diffuser assembly. Seal fragments began in-
creasing the amount of debris when seal material fractured a six bolt section of the stage 1 HPT1 blade retainer,
liberating pieces of bolt threads, nuts and retainer material. This debris quickly got into the engine gaspath re-
sulting in downstream damage from the HPT Rotor aft causing an engine stall.
The engine stall is clearly visible in the films taken by onlookers from the station building. As the liberated de-
bris travelled aft down the engine’s gaspath, low pressure turbine blades were being broken / separated. With
the amount of LPT blade damage, fan speed (N1) began to decrease since the LPT didn’t have enough blade air-
foils to drive the fan.
The overall assessment of the investigation results suggests that the fatigue had started in the repaired seam at
the diffuser aft air seal teeth. All documented cases of CF6-80C2 diffuser aft air seal failures have been seals that
had been previously repaired.
Operational
Deficiencies in the certification process for large aircraft with wing-mounted engines with regard to
requirements for yaw stability in the event of sudden loss of engine power in the speed range below
VMCG.
Deficiencies in pilot training with regard to training for sudden losses of engine thrust in the speed
range below VMCG.
Technical
Deficiencies in the approval and follow-up of the Dabbler TIG Weld repair on the engine’s diffuser aft
air seal.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 168
EASA is recommended to ensure that initial and recurrent pilot training includes mandatory rejected takeoff ex-
ercises that cover events of a sudden loss of engine thrust below VMCG. [RL 2012: 21 R6]
The accident occurred on 8 January 2016 during a commercial cargo flight from Oslo/Gardermoen Airport
(ENGM) to Tromsø/Langnes Airport (ENTC) and involved an aeroplane of the model CL-600-2B19, manufactured
by Bombardier Inc. The aeroplane was operated by West Atlantic Sweden AB and had the registration SE-DUX.
The flight was uneventful until the start of the event, which occurred during the approach briefing in level flight
at FL 330. The event started at 00:19:20 hrs during darkness without moonlight, clouds or turbulence. The lack
of external visual references meant that the pilots were totally dependent on their instruments which, inter alia
consisted of three independent attitude indicators.
According to recorded data and simulations a very fast increase in pitch was displayed on the left attitude indi-
cator. The pilot in command, who was the pilot flying and seated in the left seat exclaimed a strong expression.
The displayed pitch change meant that the pilot in command was subjected to a surprise effect and a degrada-
tion of spatial orientation The autopilot was, most probably, disconnected automatically, a “cavalry charge” aural
warning and a single chime was heard, the latter most likely as a result of miscompare between the left and right
pilots’ flying displays (PFD).
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 169
Both elevators moved towards nose down and nose down stabilizer trim was gradually activated from the left
control wheel trim switch. The aeroplane started to descend, the angle of attack and G-loads became negative.
Both pilots exclaimed strong expressions and the co-pilot said “come up”.
About 13 seconds after the start of the event the crew were presented with two contradictory attitude indica-
tors with red chevrons pointing in opposite directions. At the same time none of the instruments displayed any
comparator caution due to the PFDs declutter function in unusual attitude. Bank angle warnings were heard and
the maximum operating speed and Mach number were exceeded 17 seconds after the start of the event, which
activated the overspeed warning. The speed continued to increase, a distress call was transmitted and acknowl-
edged by the air traffic control and the engine thrust was reduced to flight idle.
The crew was active during the entire event. The dialogue between the pilots consisted mainly of different per-
ceptions regarding turn directions. They also expressed the need to climb. At this stage, the pilots were probably
subjected to spatial disorientation. The aircraft collided with the ground one minute and twenty seconds after
the initial height loss. The two pilots were fatally injured and the aeroplane was destroyed.
SHK has investigated the alerting and rescue services that were performed. There is a potential for improvement
of procedures, training and exercises that could shorten the alerting time, improve the situational awareness of
relevant rescue authorities and increase the ability to carry out a rescue operation in the mountains.
The accident site and the wreckage did not show any evidence of an inflight break-up.
The flight recorders were recovered and readout. Calculations and simulations were performed to reconstruct
the event and showed that the aeroplane’s flight control system operated normally.
The erroneous attitude indication on PFD 1 was caused by a malfunction of the Inertial Reference Unit (IRU 1).
The pitch and roll comparator indications of the PFDs were removed when the attitude indicators displayed unu-
sual attitudes. In the simulator, in which the crew had trained, the corresponding indications were not removed.
During the event the pilots initially became communicatively isolated from each other.
The current flight operational system lacked essential elements which are necessary. In this occurrence a system
for efficient communication was not in place. SHK considers that a general system of initial standard calls for the
handling of abnormal and emergency procedures and also for unusual and unexpected situations should be in-
corporated in commercial aviation.
The accident was caused by insufficient operational prerequisites for the management of a failure in a redun-
dant system.
The absence of an effective system for communication in abnormal and emergency situations.
The flight instrument system provided insufficient guidance about malfunctions that occurred.
The initial manoeuver that resulted in negative G-loads probably affected the pilots’ ability to manage
the situation in a rational manner.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 170
EASA is recommended to ensure that a general system of initial standard calls for the handling of abnormal and
emergency procedures and also for unusual and unexpected situations is implemented throughout the commer-
cial air transport industry. [RL 2016:11 R2]
Ensure that the design criteria of PFD units are improved in such a way that pertinent cautions are not removed
during unusual attitude or declutter modes. [RL 2016:11 R3]
The incident occurred during a scheduled flight from Bromma to Visby. The commander has stated that small vi-
brations were felt during descent, at around 7,000 feet. The indicated speed was 250 kts and the power levers
were set to idle.
The vibrations increased in intensity and the commander reduced the rate of descent to 2,500 feet per minute.
The vibrations became so severe that the cabin crew had difficulties moving in the cabin and that there were dif-
ficulties reading the instruments in cockpit.
Information from the flight recorders shows that the left propeller was first feathered momentarily. The right
propeller was feathered thereafter, after which the right engine was shut off. The flight continued with the left
engine in operation. The information also reveals that the communication between the pilots did not include
confirmation of which engine’s power levers were manoeuvred. A number of warning signals were activated dur-
ing the sequence of events. The signals were not reset during the acute phase of the event.
When the commander moved the right propeller control to feather position, he was unable to push it all the way
to fuel shut-off position. The control was therefore returned to the “auto” position and then pushed back via the
feather position to fuel shut-off, whereby the vibrations subsided.
The co-pilot explained the situation to the air traffic controller in the Visby tower and declared an emergency sit-
uation. The air traffic controller triggered the alert signal.
The front propeller pitch change actuator plate was severely bent on all six positions.
The engine mounts had received damage from contact with metal.
The engine’s compressor housing was cracked along half of its circumference.
SHK has been unable to establish the cause of the serious incident.
Consider introducing temporary limitations in the manoeuvring envelope, or limitations of the power ranges
within the latter, until the problem is resolved and rectified. [RL 2016:07 R1]
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 172
DIAMOND
SE-LVR Ängsö, Västmanland County 22/01/2016 Accident
DA42
A training flight in an aeroplane of the model Diamond DA42 was to be undertaken at Västerås Airport. On board
were an instructor and a student in the front seats, with one further student in the back seat. During the training
exercise – the plan for which included approaches and flying on one engine – the instructor should demonstrate
a manoeuvre called “deep stall”. It was dark during the flight, which was undertaken partly under instrument
meteorological conditions, with overcast clouds with base of 300–400 feet and tops of approx. 2,000 feet, with
icing conditions forecasted in clouds.
According to the instructor, the exercise was conducted in the following manner: The aeroplane was brought into
a steep climb with an attitude of approx. 25–30º at the same time as an approx. 30º bank to the right was set. Dur-
ing the deceleration, both engines were set to full power and when the aeroplane was approaching stall speed, the
stick was pulled fully back. However, the students gave evidence when interviewed that the pitch attitude during
the climb was at least 50º (nose up). This information also supports the analyses conducted by the Swedish Accident
Investigation Authority (SHK) on data recorded by units in the aeroplane.
At the top of this manoeuvre, the aeroplane rolled over to the left and entered a spin from an altitude of approx.
4,500 feet. The instructor attempted – e.g. by varying the engine power – to exit the spin. However, the aeroplane
continued to spin and, following a sequence of events lasting just over 30 seconds, crashed into woodland close to
Ängsjö Church. According to the data registered on units on board and the radar data that have been obtained, the
rate of descent in the initial phase is determined to have been approx. 52 m/s (approx. 10 200 ft/min), which then
gradually decreased to approx. 19 m/s (approx. 3 700 ft/min) prior to impact.
During the impact phase into the woods, a tree trunk entered the fuselage, causing the student in the back seat to
be thrown out of the aeroplane. With the rate of descent and the rotation decreasing and with parts of the aero-
plane remaining in the surrounding trees, the wrecked aeroplane finally impacted in the woodland and was totally
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 173
destroyed. The two people in the front seats survived, but were seriously injured. The student in the back seat, who
also suffered serious injuries, came to his senses standing in front of the aeroplane wreckage.
Both SHK and the type certificate holder, Diamond, have made the assessment that the manoeuvre performed can
be classified as a type of aerobatic flying that is not permitted in accordance with the aeroplane’s approved flight
manual.
According to the applicable regulations, the flight training organization shall have a well-thought-out and functional
quality and safety system for the identification and minimisation of potential hazards in its operations. This system
is scrutinised during the Swedish Transport Agency’s initial inspection and oversight inspections.
However, these inspections do not encompass any detailed inspection of practical realisation – or levels of risk –
with respect to the aspects of practical flight training that may be associated with increased levels of risk. The
applicable regulations also contain no guidance pertaining to the practical execution of such exercises.
All in all, SHK is of the opinion that it must be possible to guarantee students at flying schools the same level of
flight safety as afforded to passengers on commercial flights. This accident shows that both regulations and super-
vision are deficient with respect to the identification of areas of risk and hazardous circumstances in conjunction
with flight training.
Deficient planning of the training exercise with respect to the options for managing hazardous situations.
Lack of guidance from the authorities concerned regarding practical implementation of certain exercis-
es within flight training.
Identify exercises in flight training that might entail an increased risk factor and to issue guidance material (GM) for
the practical execution of these. [RL 2017:04 R1]
Therefore, whilst it is acknowledged that prescriptive limitations without safety assurance have limited
effect, awareness and safety promotion are key vectors to help ATOs in their Safety Risk Management.
The Swedish Safety Investigation Authority has already issued a similar recommendation and expressed
a doubt on the effectiveness of individual flight schools’ safety management systems (SMS). Because SMS
is an essential component of organisations approval and is under the scrutiny of the oversight function,
EASA will send a new information to all Member States to carefully take into consideration the increased
risk of such exercise in the frame of their oversight function and clarify the status of Upset Prevention
and Recovery Training.
In addition, the Agency will contact the Swedish Transport Agency and work in cooperation with it with
the objective that individual flight schools properly follow SMS principles and demonstrate it to their
Competent Authority.
FOKKER Serious
YR-FZA Gällivare Airport 06/04/2016
F28 incident
The serious incident occurred during a scheduled flight from Arvidsjaur to Gällivare airport and involved an
aeroplane of the type Fokker 100 with registration marks YR-FZA. The aircraft was operated by the Romanian
operator Carpatair on behalf of the Swedish airline Nextjet.
During the instrument approach to runway 30 at Gällivare airport, which was performed in darkness with snow
and rain, the runway threshold was crossed at approximately 50 feet with a recorded speed of 134 knots. After
a hard landing in the touchdown zone with unchanged speed the aeroplane bounced and was displaced in yaw.
Reported friction coefficients were 0.36, 0.34 and 0.35.
After the landing, which was performed with full flaps and air brake, the lift dumpers on the wing’s upper
surface extended. According to interviews, maximum reverse was activated and the brakes were applied imme-
diately after the displacement in yaw. Data from the recordings indicate that reverse rpm increased from low idle
only 20 seconds after touchdown at a speed of about 50 knots. Engine reverse rpm then only reached 75% and
65%, while the maximum speed limitation is 95.5%.
The aeroplane overran the end of the runway and came to a full stop on the runway strip. There were no injuries
and the damage to the aeroplane was limited.
The investigation revealed that the serious incident was caused by the gradual decrease of the conditions for
a safe landing, which was not perceived in due time.
Contributing factors:
The wheel brakes were probably not fully applied due to the initial yaw disturbance.
EASA is recommended to work for the introduction of a generic Safe Landing concept including the flight phase
from the runway threshold until full stop. [RL 2017:03 R2]
The occurrence consists of two separate incidents, with the second having been a consequence of the first. The
occurrence has therefore been described as the first incident and the second incident, respectively.
The aeroplane, a BAe ATP from NextJet AB with the registration SE-LLO, took off from Hemavan Tärnaby Airport
on a scheduled flight to Vilhelmina. There were 19 passengers and four crew members on board.
The plan was for the flight to continue on to Stockholm Arlanda Airport after a short stay on the ground in Vil-
helmina. Due to the prevailing weather, the pilots were informed via radio from the airport in Vilhelmina that
snow clearance of the runway had commenced.
The pilots commenced an ILS6 approach to runway 28 in Vilhelmina. The visibility at the time was approximate-
ly 1,400 metres in snow with reported friction coefficients of 0.43, 0.45 and 0.42 and 0.5 cm (5 mm) of slush on
the runway. Performance calculations were made using the lowest friction value of 0.42, but without corrections
for contamination on the runway. According to the commander, the approach was normal and without devia-
tions or problems. The approach was perceived early on to be stabilised and no major adjustments to attitude
or engine power needed to be made. This is supported by recordings from the aeroplane’s flight data recorder.
According to the commander, no deviations were perceived in the final phase of the approach in terms of flight
controls, engine thrust or changes in the aeroplane’s trim position. According to the commander, touchdown
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 176
was at a normal speed on the centre line in the touchdown zone of the runway. Immediately after touchdown,
the aeroplane drifted over to the right side of the runway and after a certain amount of ground roll outside the
runway edge, was steered back towards the runway centre line again.
Measurements have shown that the aircraft’s right pair of wheels left the asphalted section of the runway around
400 metres after the estimated touchdown point and rolled outside of the runway for a distance of 155 metres
before it could be steered back onto the runway again. The wheels were at most 2.5 metres outside of the edge
of the asphalt. Roughly 500 metres from the touchdown zone, the aeroplane’s wheels hit one of the runway edge
lights, which came loose from its fitting and was thrown to the side.
Data from the aeroplane’s flight data recorder (FDR) revealed that the thrust during reversal of the engines after
touchdown was not symmetrical. The thrust of the right engine was notably higher than that of the left engine.
This caused a yawing moment to the right which could not be corrected by the crew. The incident was caused
by the following factors:
The braking action was probably worse than what was indicated by the friction coefficients.
When the aircraft taxied back after landing, the crew checked the wheel tracks and informed air traffic control
that they had run off the runway and also damaged a runway edge light. Following the incident, the commander
attempted to make contact with the company’s technician, only to find that he had left the airport. The com-
mander thus performed an inspection of the aircraft himself and detected no damage.
During their stay on the ground, the commander had a dialogue with one of the ramp service persons regarding
the occurrence. At this time, the crew’s perception of the incident changed and they did not believe they had run
off the runway. This perception is however not consistent with the radio com-munications with the tower, the in-
formation provided by the ramp service person and the images taken directly after the incident.
The commander contacted the company’s Head of Flight Operations to inform them about the occurrence. At
this time, however, it was not reported that the aircraft had left the runway – only that it had “drifted far out to-
wards the runway edge”. The Head of Flight Operations thus had no objections to the flight continuing on to
Stockholm Arlanda, according to plan.
However, it was established during an inspection the day after the occurrence that the aeroplane had suffered
structural damage to the right wing flap, likely caused by the runway light being thrown up towards the un-
derside of the wing when it was run over. SHK has established that the damaged wing flap – which had to be
replaced – had cracks and other damage which likely affected the structural integrity of the unit. The aeroplane
was thus not airworthy for the flights which were carried out following the landing in Vilhelmina. The incident
was caused by the following factors:
Continued flight was prioritised in the crew’s assessment of the incident during landing.
Shortcomings in the company’s systematic safety management with regard to maintenance checks
and inspections.
Introduce generic performance corrections for aeroplane operations on surfaces contaminated with slush or wa-
ter. [RL 2017:0e R1]
Nevertheless, rulemaking task RMT.0296 ‘Review of aeroplane performance requirements for CAT op-
erations’ was launched by EASA on 9 June 2015 with the publication of the terms of reference. The
associated notice of proposed amendment NPA 2016-11 was published on 30 September 2016. It includes
proposals on standards for runway surface condition reporting, airworthiness standards for landing per-
formance computation at time of arrival and an in-flight assessment of landing performance at time of
arrival. The NPA takes into account the following recommendations made in the 2013 European Action
Plan for the Prevention of Runway Excursions (EAPPRE):
Establish and implement one consistent method of contaminated runway surface condition assess-
ment and reporting by the aerodrome operator for use by aircraft operators. Ensure the relation
of this report to aircraft performance as published by aircraft manufacturers.
It is recommended that aircraft operators always conduct an in-flight assessment of the landing
performance prior to landing. Note: Apply an appropriate margin to these results.
The next deliverable for RMT.0296, an EASA Opinion, is planned to be published in the third quarter of
2017.
Review the feasibility of changing the method of reporting from airports in terms of friction coefficients, so that
measured values are reported as unreliable under certain conditions. [RL 2017:05e R1]
BAE Serious
SE-DSP Malmö Airport 29/09/2016
AVRO146RJ incident
The incident occurred during a regular flight from Malmö Airport to Bromma Airport. At pre-flight inspection
a damage was detected on the left hand airflow sensor. The sensor was replaced before the flight.
The take-off was normal until lift off, when the stick shaker was activated. However, the flight crew quickly iden-
tified the warning as false.
A warning was indicated on the instrument panel, (IDNT 1). The commander pressed the IDNT/INHIB 1 button
and the INHIB part of the button lit up, but felt that nothing happened.
Later during the climb, when they got into clouds at 660 feet above the ground the stick push was activated,
which means that the control column is pushed forward.
By following the emergency checklists, the systems could be shut down which solved the problems. Thereafter
a normal landing was performed.
An examination of the left hand airflow sensor showed that the unit was incorrectly assembled and that it was
45–50 degrees out of the specification for all angle readings.
To get a stick shake it is sufficient for one sensor to indicate a high angle of attack. In order for the stick push to
be activated, one sensor must have a high angle of attack and the other must have a high angle or a high rate
of change.
The most likely explanation for stick push activation is that the turbulence caused the change rate of the service-
able airflow sensor to become large enough.
In the absence of tampering or warranty seals, it is impossible to determine if the device has been delivered in-
correctly or if someone has manipulated it at a later stage.
The airflow sensor consists of two parts, the vane and the electronic unit. The vane can be replaced separately,
but in this case the complete unit was replaced.
After the replacement of the airflow sensor a simple test intended for vane replacement was performed, which
meant that the fault on the sensor was not detected.
The serious incident was caused by the mix up of test instructions for installation of “Vane assembly” and “Air-
flow sensor” which led to a prescribed functional test was not performed and the fault in the airflow sensor was
not detected.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 180
Contributing factors:
The different component names Vane assembly and Airflow sensor enhance the risk of confusion be-
tween tasks.
The interruptions during the change of the airflow sensor were a stress factor which increased the
risk of mistakes.
EASA is recommended to encourage that components that require specially approved maintenance facilities are
sealed to detect unauthorized manipulation. [RL 2017:08 R2]
LINDSTRAND
SE-ZOU Nynäs Fallet, Örebro County 10/05/2016 Accident
model LBL 120A
The intention of the flight was a hot air balloon flight experience with two passengers. The weather forecasts
showed that the wind strength would increase during the evening because a sharp cold front was moving south
over Svealand 5 during the afternoon and evening.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 181
The hot air balloon lifted off just after eight o’clock in the evening in favourable weather conditions. The flight
time was calculated to be one hour. After about 40 minutes flight, a significant weather change in the form of
fog was observed. The pilot decided to immediately abort the flight and commence descent.
Before the landing could be commenced, the wind changed direction and strength, which made a landing at the
first designated site impossible, upon which the pilot selected a new landing site.
The first touchdown was very hard. Both the rate of descent and the speed were high. All those on board lost
their balance and fell over. In connection with this, the pilot happened to inadvertently put the burners on full
power. This contributed to the balloon climbing to an altitude of 30-50 metres. Shortly thereafter, the pilot suc-
ceeded in shutting down the burners.
A second hard touchdown was made after about 1 000 metres. The balloon basket was then pulled along the
ground and was at times in the air a little above the ground. The system for a rapid deflation of the balloon’s hot
air was not activated in connection with this touchdown.
About 400 metres after the second touchdown, the pilot fell out of the balloon basket. The balloon then climbed
with only the two passengers on board. The passengers, however, operated the top vent so that the balloon
again descended towards the ground. They subsequently decided to leave the balloon. In conjunction with this,
the first passenger became caught for a short while between the basket and the ground. The second passenger’s
foot became tangled in an operating line. Held fast by the line, the passenger was dragged behind the balloon
for several hundred metres before the balloon drifted into a power line and stopped.
The pilot and one of the passengers were seriously injured, while the other passenger received minor injuries.
In light of the weather information that was available, it is SHK’s view that the margin appears too small between
the time of planned completion of the flight and the time at which there was reason to assume that the weath-
er could deteriorate drastically. However, there are no rules regarding time margins between planned flight and
forecasted significant aviation weather. In SHK’s view, the introduction of such rules could reduce the risk of ac-
cidents of this type.
When the hard landing occurred, the pilot was not wearing the safety harness that was in the basket. However,
there are no explicit rules regarding the conditions in which the pilot is to put on the safety harness. National
rules will soon be replaced by common European rules. According to the proposals for new rules, the actual type
of balloon will no longer be subject to any safety harness requirements. As the event shows that there is a risk
that the pilot will fall out of the basket even in the actual type of balloon, SHK believes that EASA should con-
sider introducing safety harness requirements for all types of balloons in commercial air transport and to clarify
when it will be used.
The flight was planned with a too small, albeit permitted, time margin to forecasted significant weath-
er conditions that could impair a safe flight.
A high speed and rate of descent during the landing caused the touchdowns to be very hard. In addi-
tion, after a hard ground contact, the pilot fell out of the basket and thereby lost the ability to control
the balloon.
The system for a rapid deflation of the balloon’s hot air was not activated in connection with the sec-
ond touchdown.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 182
Consider introducing time margins between planned landing time and significant weather conditions. [RL
2017:06 R1]
Consider introducing requirements for safety harness or other restraint systems for all types of bal-
loons in commercial passenger operations and clarifying the conditions in which the system is to be
used. [RL 2017:06 R2]
(1) The pilot can reach all the necessary controls when the restraint is correctly worn and adjusted;
(2) There is a method of quick release that is simple and obvious; and
(3) The possibility of inadvertent release is minimised.
Effective implementation of the above-mentioned provisions is expected to provide the foundation for
safe balloon operations. The Agency considers that the provision and use of pilot’s safety harnesses
or restraints is suitably addressed and that more detailed rules would not support the objective of the
‘Balloon’ Opinion, which is to provide a simpler, ‘lighter’ and proportionate regulatory framework for
balloon operations.
Furthermore, EASA believes that extending the requirements further on pilot’s restraint systems could
create additional risks, such as occupant entanglement or tripping, or restricting necessary movements
by the pilot. For single compartment balloon baskets, the restraint systems required for all occupants by
the Airworthiness Requirements (e.g. hand holds) provide means of restraint for all occupants, includ-
ing the pilot.
Lastly, the Agency has in place a Safety Risk Management process, which, through routine monitoring
based on data analysis, aims to identify any weaknesses in the regulatory framework, in order to take ap-
propriate action to close any safety gaps. This will include the balloon air operations regulation once it
becomes applicable.
Switzerland
Registration Aircraft Type Location Date of event Event Type
EMBRAER
CN-MBR St. Gallen-Altenrhein (LSZR) 06/08/2012 Accident
EMB 505
On 6 August 2012 the Embraer EMB-505 Phenom 300 aircraft, registration CN-MBR, took off at 12:59 UTC from
Geneva (LSGG) on a commercial flight to St. Gallen-Altenrhein (LSZR). After the initial call to the aerodrome con-
trol centre St. Gallen tower, the crew quickly decided, after an enquiry from the air traffic controller, on a direct
approach on the runway 10 in-strument landing system (ILS). Shortly thereafter, the landing gear and flaps were
extended. The flaps jammed at approximately 10 degrees and the FLAP FAIL warning message was displayed.
The crew carried out a go-around shortly before landing. The landing gear subsequently remained extended.
The flaps remained jammed for the remainder of the flight.
The crew decided immediately on a second ILS approach with jammed flaps, which accord-ing to the manufactur-
er’s information required an increased approach speed. During the ap-proach, the crew had difficulty in reducing
the airspeed to this increased approach speed. At 13:40 UTC, the aircraft subsequently touched down on the wet
runway at an indicated air speed of 136 kt, approximately 290 m after the runway threshold, and could not be
brought to a standstill on the remaining length of runway. The aircraft then rolled over the end of run-way 10,
broke through the aerodrome perimeter fence and overrun the road named Rhein-holzweg running perpendicu-
lar to the runway centreline, on which a public transport bus was travelling. The aircraft rolled very close behind
the bus and came to a standstill in a maize field, approximately 30 m from the end of the runway.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 185
The female passenger and the two pilots were not injured in the accident. The aircraft was badly damaged.
There was crop damage and damage to the aerodrome perimeter fence.
Causes
The accident is attributable to the fact that the aircraft touched down late and at an excessively high speed on
the wet runway after an unstabilised final approach and consequently rolled over the end of the runway.
The flaps remained jammed at approximately 10 degrees, a position that is almost consistent with the
flaps 1 position.
Together with the aircraft manufacturer, the European aviation safety agency (EASA) should examine how the
manuals can be amended so as to provide optimal assistance to pilots in abnormal situations.
Flugverlauf
Der Pilot der HB-3373 startete um 11:55 Uhr im Birrfeld und beabsichtigte, einen Segelflug entlang des Juras in
Richtung Neuenburger See auszuführen. Beim Flug der HB-DFP von Lommis nach Ecuvillens handelte es sich um
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 186
einen Einführungsflug zwecks Kennenlernen der verschiedenen Systeme und des Autopiloten. Im Raum Villigen
leitete die Besatzung der HB-DFP um 12:16 Uhr einen Steigflug mit eingeschaltetem Autopiloten ein. In der Re-
gion Linn steuerte die Besatzung der HB-DFP in Richtung Süden, mit der Absicht, den Regionalflugplatz Birrfeld
zu umfliegen.Nachdem der Pilot mit der HB-3373 über dem Chestenberg eine Höhe von etwa 1450 m/M erreicht
hatte, folgte er um 12:17 Uhr zwei anderen Segelflugzeugen in westlicher Richtung zur Gisliflue.
Ab diesem Zeitpunkt befanden sich beide Flugzeuge auf einem Kollisionskurs und die HB-3373 war für die Be-
satzung der HB-DFP bis mindestens 5 Sekunden vor der Kollision durch die Cockpitverstrebung respektive den
Magnetkompass verdeckt. Nachdem die HB-3373 die Aare überflogen hatte, blickte der Pilot in Richtung Norden,
um das Wetter im Schwarzwald zu beurteilen. Ungefähr eine Minute später nahm der Pilot der HB-3373 im rech-
ten Bereich seines Sichtfeldes ein Flugzeug wahr, das von rechts her kommend auf ihn zuflog.
Um 12:18:52 Uhr kollidierten die beiden Flugzeuge über dem Raum Auenstein auf einer Höhe von 1285 m/M
(4216 ft AMSL). Die HB-3373 wurde derart beschädigt, dass sie unkontrollierbar wurde. Der Pilot konnte sich mit
dem Fallschirm retten. Die Besatzung der schwer beschädigten HB-DFP konnte die Flugverkehrsleitung alarm-
ieren und flog anschliessend zum Startort zurück. Der Pilot der HB-3373 verletzte sich bei der Landung mit dem
Fallschirm leicht, während das Segelflugzeug beim Aufprall zerstört wurde.
Ursachen
Der Unfall ist auf eine Kollision zwischen einem Segel- und einem Motorflugzeug zurückzuführen, weil die
beiden Besatzungen den Luftraum zu wenig aktiv überwachten. In der Folge wurde das Segelflugzeug unkon-
trollierbar und stürzte ab.
Die Transpondersignale des Motorflugzeuges konnten durch das Kollisionswarnsystem des Segelflug-
zeuges nicht empfangen werden.
[German] - Das Bundesamt für Zivilluftfahrt (BAZL) sollte in Zusammenarbeit mit den Anspruchsgruppen und der Eu-
ropäischen Agentur für Flugsicherheit (EASA) ein Konzept für die Einführung von kompatiblen, auf Standards der
Internationalen Zivilluftfahrt basierenden Kollisionswarnsystemen für die allgemeine Luftfahrterarbeiten und einen
Aktionsplan für die kurz-, mittel- und langfristige Umsetzung erstellen und umsetzen. [Sicherheitsempfehlung Nr. 499]
According to the EASA Annual Safety Review 2016, MACs contributed to 6% of the fatalities in the 2006-
2015 period in Non-Commercial operations with aeroplanes. The related fatalities mainly involved loss
of control (47%) or controlled flight into terrain (15%). The Agency recognises that the safety barriers of
the Visual Flight Rules (VFR), which rely on the “see and avoid” principles, should be reinforced. Cost-ef-
ficient electronic conspicuity devices can be one contributor.
The European Plan for Aviation Safety (EPAS) 2016-2020 already addressed the issue under the umbrella
of the safety topic “general aviation safety”. The current version of the plan, (EPAS 2017-2021) includes
further actions for MAC/NMAC in general aviation, under the strategic safety area “General Aviation -
Preventing mid-air collisions”.
At 15:03 on 6 June 2013 the pilot took off in the HB-ZRS helicopter on a technical flight. On board was a hoist op-
erator and on the ground was a mechanic with the prepared load. The mechanic’s task was to attach the load to
the hoist hook.
After the helicopter took off and climbed to an estimated height of 7 m above ground level, the hoist operator
received clearance from the pilot to extend the hoist cable while the helicopter was hovering. The hoist opera-
tor extended the cable to approximately 7.5 m. The mechanic on the ground had difficulty attaching the load to
the hoist hook, whereupon the hoist operator extended the cable further.
After the load had been attached to the hoist hook, the hoist cable was touching the ground. The hoist opera-
tor gave the pilot the command to position the helicopter approximately one metre further forward. At the same
time, the hoist operator slowly began to retract the hoist cable. When the helicopter was directly above the load,
the hoist operator continued to retract the hoist cable and told the pilot that the cable was under tension and
that the load could be lifted. According to the statement of the hoist operator, his focus at this time was on what
was happening below him and how the cable was being guided on the rescue hoist was outside his field of vi-
sion. When lifting the load, the pilot noticed a sudden change in the helicopter’s attitude to the left and heard
a bang. The hoist operator then informed the pilot that the hoist cable had broken. Up until the cable broke, nei-
ther the pilot nor the hoist operator had noticed anything unusual.
After the cable broke, the helicopter pilot hovered in place until he had gained an overview of the situation on
the ground. He then landed on the apron at the Rega-Center.
The hoist operator wore gloves and a helmet with a radio while on duty. He was in constant radio contact with
the pilot and the mechanic on the ground.
Causes
The serious incident is attributable to the fact that the rescue hoist cable became snagged behind the handle as-
sembly nut and broke when the test load was lifted.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 188
The design of the rescue hoist attachment assembly was identified as a causal factor.
The restricted visibility from the hoist operator’s working position was identified as a contributing factor.
The European Aviation Safety Agency (EASA) in cooperation with the helicopter manufacturer, should introduce
technical measures to ensure that the hoist cable is prevented from snagging on the rescue hoist attachment as-
sembly. [Safety recommendation No. 528]
STUDY various
“Studie Nr. 3 der Schweizerischen Sicherheitsuntersuchungsstelle SUST über die Organisation und die Wirksamkeit
des Such- und Rettungsdienstes der zivilen Luftfahrt (search and rescue – SAR) in der Schweiz“
In den vergangenen Jahren haben sich wiederholt Unfälle mit Luftfahrzeugen der allgemeinen Luftfahrt ereig-
net, bei denen Besatzung und Luftfahrzeug nur mit erheblicher Verzögerung gefunden und geborgen werden
konnten. Im Rahmen der Sicherheitsuntersuchung dieser Unfälle wurde verschiedentlich festgestellt, dass die am
Such- und Rettungsdienst (search and rescue – SAR) beteiligten Organisationen nicht in der Lage waren, eine ra-
sche Suche und Rettung sicherzustellen.
Es zeigte sich auch, dass selbst viele Fachleute und Nutzer der Zivilluftfahrt nur unzureichende Kenntnisse des
SAR und seiner Eigenheiten aufwiesen.
Deshalb entschloss sich die Schweizerische Sicherheitsuntersuchungsstelle (SUST), in Zusammenarbeit mit den
beteiligten Verkehrskreisen eine umfassende Studie zu diesem Thema durchzuführen.
[German] - Das Bundesamt für Zivilluftfahrt (BAZL) sollte zusammen mit der Europäischen Agentur für Flugsicher-
heit (European Aviation Safety Agency – EASA) Anstrengungen unternehmen, ELT konstruktiv und einbautechnisch
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 189
so zu verbessern, dass ihr korrektes Funktionieren möglichst in allen Fällen gewährleistet ist. [Sicherheitsempfe-
hlung Nr. 515]
AGUSTA
HB-ZRV Rega-Basis Erstfeld 26/02/2015 Accident
A109
Um 14:15 Uhr startete der Rettungshelikopter AgustaWestland AW109SP, eingetragen als HB-ZRV, vom Dach des
Kantonsspitals Altdorf zum Überflug zur Einsatzbasis der Schweizerischen
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 190
Rettungsflugwacht (Rega) in Erstfeld. Während des Anfluges zur Basis reduzierte der Pilot die Vorwärtsgeschwin-
digkeit des Helikopters bei gleichbleibender Sinkgeschwindigkeit.
Der Pilot erhöhte den kollektiven Blattverstellhebel (collective) kontinuierlich, um die Sinkgeschwindigkeit zu
reduzieren. Diese verminderte sich jedoch nicht. In der Phase des Übergangs vom Vorwärts- zum Schwebeflug
(transition) erhöhte sich der Leistungsbedarf des Helikopters.
Bei einer Vorwärtsgeschwindigkeit von weniger als 20 kt vergrösserte sich die Sinkgeschwindigkeit in den letz-
ten Sekunden vor dem Aufprall von 1100 ft/min auf über 1300 ft/min und liess sich nicht mehr kontrollieren. Um
14:18 Uhr schlug der Helikopter rund 30 m südlich des Landeplatzes der Einsatzbasis der Rega auf einer Wiese
auf. Drei der vier Insassen wurden verletzt und mussten in Spitalpflege gebracht werden.
Ursachen
Der Unfall ist darauf zurückzuführen, dass der Helikopter während eines steilen Landeanfluges mit grosser
Vertikal- und minimaler Vorwärtsgeschwindigkeit in geringer Höhe über Grund in den Bereich des Wirbelring-
zustands geriet, der Pilot die Kontrolle über die Sinkgeschwindigkeit verlor und der Helikopter schliesslich auf
dem Boden aufschlug.
Die folgenden Faktoren wurden als kausal für den Unfall ermittelt:
Der Pilot nahm die zu hohe Sinkgeschwindigkeit bei zu geringer Vorwärtsgeschwindigkeit während
des Endanfluges nicht wahr.
Der Pilot erkannte den sich entwickelnden Wirbelringzustand des Helikopters zu spät.
Die folgenden Faktoren haben zwar nicht zur Entstehung des Unfalls beigetragen, wurden aber im Laufe der Un-
tersuchung als risikoreich (factors to risk) erkannt:
The Federal Office of Civil Aviation (FOCA) and the European Aviation Safety Agency (EASA) should take measures
to ensure that crews of helicopters are alerted by an acoustic warning to the danger of an imminent or develop-
ing vortex ring condition near the ground. [Safety recommendation No. 525]
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 191
The Federal Office of Civil Aviation (FOCA) and the European Aviation Safety Agency (EASA) should check wheth-
er the test procedures for impact resistant seats in the AgustaWestland AW109SP helicopter model correspond to
the actual conditions that actually occur in the event of a fundamentally survivable collision. Where appropriate,
the test and approval conditions should be improved in such a way that the seats provide adequate protection
against such accidents. [Safety recommendation No. 530]
The Federal Office of Civil Aviation (FOCA) and the European Aviation Safety Agency (EASA), together with the
manufacturers of the AgustaWestland AW109SP helicopter type and the ARTEX C406-N HM emergency locator
transmitter, should take appropriate measures to ensure the functioning of the aforementioned emergency lo-
cator transmitter after an accident. [Safety recommendation No. 531]
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 192
ATR
D-ANFE Zurich Airport (LSZH) 04/12/2014 Accident
ATR72
At 05:33 UTC on 4 December 2014 the ATR 72-202 aircraft, registration D-ANFE, took off from Dresden airport
(EDDC) on a scheduled flight to Zurich (LSZH), with two pilots, two flight attendants and 26 passengers on board.
After an uneventful descent and approach, D-ANFE touched down normally at 07:02 UTC on runway 14 at Zurich
airport in a light northerly wind. After the nose landing gear wheels had come into contact with the runway ap-
proximately 1050 m after the runway threshold, both tyres separated from the wheel rims, whereby the left tyre
got blocked between the wheel rims and the right tyre completely detached and was found 2080 m after the
runway threshold. The nose landing gear continued to slide only on the wheel rims approximately 1520 m after
the runway threshold.
By means of an asymmetrical power setting of the two engines and asymmetrical braking of the main landing
gear wheels, the flight crew managed to vacate the runway at the next intersection. The flight crew then request-
ed the fire brigade, as they suspected there was a problem with the landing gear.
All the occupants were uninjured. The passengers left the aircraft using the onboard steps and were taken by bus
to the arrival terminal. The runway was closed immediately after this event and re-opened for operation with
a reduced rate of arrivals after a runway inspection at 08:07 UTC.
Causes
The accident is attributable to the fact that during landing the nose landing gear was not centred and so the two
nose gear wheels could not turn freely. Subsequently it was no longer possible to exercise control via the nose
landing gear steering system, as the nose landing gear was substantially damaged.
The interaction of the following factors was determined as the most probable cause of the accident:
a valve input lever of the differential control selector valve which had been fitted to the nose landing
gear in an inverted state (rotated through 180°);
The fact that the valve input lever can be attached incorrectly, in an inverted state (rotated through 180°) as a re-
sult of its structural design was determined to be a contributing factor.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 193
Though the small parts of the aircraft found on the runway during a runway inspection performed hours later
did not contribute to the origin and history of the accident, they nevertheless constitute a factor to risk.
The European Aviation Safety Agency (EASA), together with the aircraft manufacturer, should ensure that it is no
longer possible to attach the valve input lever of the hydraulic differential control selector valve (DCSV) incorrect-
ly. [Safety recommendation No. 529]
BOEING
N571UP Dubai Airport UAE 03/09/2010 Accident
747
On September 3rd 2010, a Boeing 747-44AF departed Dubai International Airport [DXB] on a scheduled interna-
tional cargo flight [SCAT-IC] to Cologne [CGN], Germany.
Twenty two minutes into the flight, at approximately 32,000 feet, the crew advised Bahrain Area East Air Traffic
Control [BAE-C] that there was an indication of an on-board fire on the Forward Main Deck and declared an emer-
gency. Bahrain Air Traffic Control advised that Doha International Airport [DOH] was ‘at your ten o’clock and one
hundred miles, is that close enough?’, the Captain elected to return to DXB, configured the aircraft for the return
to Dubai and obtained clearance for the turn back and descent.
A cargo on the main cargo deck had ignited at some point after departure. Less than three minutes after the first
warning to the crew, the fire resulted in severe damage to flight control systems and caused the upper deck and
cockpit to fill with continuous smoke.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 194
The crew then advised Bahrain East Area Control [BAE-C] that the cockpit was ‘full of smoke’ and that they ‘could
not see the radios’, at around the same time the crew experienced pitch control anomalies during the turn back
and descent to ten thousand feet.
The smoke did not abate during the emergency impairing the ability of the crew to safely operate the aircraft for
the duration of the flight back to DXB.
On the descent to ten thousand feet the captains supplemental oxygen supply abruptly ceased to function with-
out any audible or visual warning to the crew five minutes and thirty seconds after the first audible warning. This
resulted in the Captain leaving his position. The Captain left his seat and did not return to his position for the du-
ration of the flight due to incapacitation from toxic gases.
The First Officer [F.O], now the Pilot Flying [PF] could not view outside of the cockpit, the primary flight displays,
or the audio control panel to retune to the UAE frequencies.
Due to the consistent and contiguous smoke in the cockpit all communication between the destination [DXB]
and the crew was routed through relay aircraft in VHF range of the emergency aircraft and BAE-C. BAE-C then
relayed the information to the Emirates Area Control Center (EACC) in the UAE via landline, who then contacted
Dubai ATC via landline.
As the aircraft approached the aerodrome in Dubai, it stepped down in altitude, the aircraft approached DXB run-
way 12 left (RWY 12L), then overflew the northern perimeter of the airport at 4500 ft at around 340 kts. The PF
could not view the Primary Flight Displays [PFD] or the view outside the cockpit.
The PF was advised Shajah International Airport [SHJ] was available at 10 nm. This required a left hand turn, the
aircraft overflew DXB heading East, reduced speed, entering a shallow descending right-hand turn to the south
of the airport before loss of control in flight and an uncontrolled descent into terrain, nine nautical miles south
west of Dubai International Airport.
FAA and EASA regulatory certification standards to consider the development of a quantitative framework for
assessing the degradation of cargo compartment liner polymer matrix or the current industry standard panel
material properties and the resulting degradation in the structural integrity of these structures when subjected
to extreme heat, vibration and/or thermo-mechanical energy.
The NTSB, FAA and/or EASA fire test divisions to perform a test on lithium batteries to determine the ignition
properties for lithium type batteries when subjected to external sources of mechanical energy, including acous-
tic energy in flight range modes, acoustic harmonic modes and a separate test to determine the susceptibility
of lithium batteries to vibration from a mechanical source. The purpose of this testing is to determine the safe
limits for the air carriage of lithium type batteries in dynamic aeroelastic, vibrating structures where the battery
electrolyte composed of an organic solvent (and dissolved lithium salt) could become unstable when exposed to
these forms of mechanical energy.
AIRBUS Serious
A6-EDQ Dubai International Airport 09/11/2016
A380 incident
An Airbus A380 operated by Emirates Airline from London Heathrow, the United Kingdom, to Dubai, the United
Arab Emirates, experienced a green hydraulic system overheat warning. The crew isolated the green hydrau-
lic system in accordance with the Flight Crew Operations Manual (FCOM) which resulted in a number of flight
control limitations and the requirement for the emergency freefall landing gear extension for landing (gravity
extension).
When the crew selected the gravity extension, the left wing landing gear remained locked in the Up position,
whereas the remaining landing gear locked in the Down position. The Aircraft proceeded with an uneventful
landing and came to a stop on the runway.
After the passengers disembarked and the payload was off loaded, the aircraft was towed to a maintenance
hangar where troubleshooting was carried out in the presence of Airbus landing gear specialists. It was found
that three electrical wires on each of the two independent circuits of the left wing landing gear emergency un-
lock actuators were broken near the connector plugs.
EASA is recommended to issue a mandatory fleet inspection requirement for all Airbus A380 operators in accord-
ance with Airbus All Operator Transmission (AOT) A32-R009-16-00 instructions, to ensure that all A380 operators
perform the inspection, and rectify any damage where required.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 196
Depending on the data collected from all Airbus A380 operators; EASA is recommended to ensure that Airbus
determine the probable cause of the flexure endurance fatigue and develop a design improvement for the re-
duction of possible future wire failure incidents.
On 22 January 2014, an Airbus Helicopters EC-130B4 Aircraft, registration A6-DYR, operated by Helidubai impact-
ed the heliport during departure to Dubai International Airport (OMDB) from the Atlantis Palm hotel heliport.
The Aircraft had operated six passenger tourist flights over Dubai prior to the positioning flight from the Atlantic
Palm heliport to the Dubai Air Wing fixed operating base (FOB) at OMDB. The final flight of each day was a posi-
tioning flight from the heliport to the Operator’s FOB at OMDB.
The departure was normally a coastal departure along the Palm, inbound to OMDB.
The flight required lifting to a hover position, a pedal turn to a northerly heading, and a standard climbing de-
parture from the heliport. The Aircraft was airborne at 1132:21 UTC for the 15-minute positioning flight.
On lift-off, the Pilot simultaneously pulled power into the climb while applying continuous left pedal, turning
the Aircraft counter clockwise (to the left). This turn continued past the optimal northerly heading for departure,
with the Aircraft turning rapidly counter clockwise.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 197
The turn rate accelerated, increasing to approximately 180° per second at a height of approximately 22 meters
(72 feet) above the heliport. The Aircraft then descended rapidly, pitching forward, while continuing in a coun-
ter clockwise turn prior until impact with the heliport. The Aircraft impacted the heliport vertically, with a level
attitude, minimal forward speed, with approximately 5° nose down attitude and a rapid rate of descent (ROD),
until impact.
The Air Accident Investigation Sector (AAIS) determines that the causes of the Accident were intentional entry
into a continuous left hand pedal turn, which rapidly increased the rotation rate of the Aircraft leading to an un-
stable condition developing outside of the Pilot’s ability to respond, resulting in a loss of control in-flight (LOC-I)
and impact with the heliport.
The Pilot was in a spatial disorientation resulting from the rapid onset of the yaw/high speed rotation combined
with the effects of the rotational inertia forcing the Pilot and HLO forward.
The Pilot was unable to determine the cause of the induced turn rate and apply the corrective actions necessary
to return to a stable, steady state condition. The Pilot lowered the collective resulting in an uncontrolled descent
onto the heliport.
Provides adequate guidance on the definition of ‘Aerobatic Flight’. Specifically, a maneuver limitation in the flight
manual which clearly and unambiguously states that yaw rates have to be controlled within defined margins with
a clear warning that excessive intentional induced yaw can lead to pilot disorientation and onset of an uncon-
trollable flight condition.
Considers the option for a mandated locking mechanism for crew harness restraints where the risk during take-
off or maneuvering is that the inertia reel ‘g’ lock limit of 1.5 g will not be exceeded.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 198
United Kingdom
Registration Aircraft Type Location Date of event Event Type
After an uneventful flight from Ben Gurion Airport, Tel Aviv, the crew made an ILS approach to Runway 26 Left
at London Gatwick Airport. The commander was ‘pilot not flying’ (PNF) in the right seat and another captain was
the ‘pilot flying’ (PF) in the left seat. Prior to commencing their approach, the crew had received ATIS Informa-
tion ‘Delta’, timed at 1920 hrs, which broadcast the following information: “Runway in use 26 Left; surface wind
180°/10 kt; visibility 10 km or more; cloud, scattered two thousand feet; temperature +16°, dew point +13°; QNH
1015, QFE 1008.” There was no significant change in ATIS Information ‘Echo’ timed at 1950 hrs. Along with their
landing clearance, the crew were advised by ATC that the surface wind was 190°/ 9 kt. The landing was made
with Flap 25 and Mode 2 autobrake selected in conditions of slight drizzle. The crew considered that a normal
landing had been made, touching down at approximately 135 kt, just beyond the PAPIs and slightly left of the
runway centre-line. Shortly after touchdown the commander stated that the autobrake had disconnected. The
PF acknowledged and reselected Mode 2 on the autobrake. The PF had selected reverse thrust and both pilots
considered that retardation was normal until 100 kt when some vibration was felt. Around this time an engineer
working on an aircraft to the north of the runway heard what he described as two separate distinct “bangs”, sep-
arated by some 5 to10 seconds. The PF continued to slow the aircraft and, on the instructions from ATC, cleared
the runway at fast exit ‘Golf Romeo’. On initial check-in with the ground controller, the PNF advised that they
would be holding position as they suspected a “flat tyre”. The crew had also noticed an indicated loss of some
hydraulic fluid contents in both Left and Right Systems. The controller cleared the crew to hold at ‘Golf 1’ and
advised them that the AFS were on their way to inspect the aircraft. He also declared an ‘Aircraft Ground Inci-
dent’ and advised the tower controller. As a precaution, the tower controller instructed the next landing aircraft
to goaround and then initiated a runway inspection. The inspection revealed tyre debris on the runway and the
runway was declared closed at 1955 hrs. By now, the AFS had inspected the aircraft and informed the crew that
the two right rear tyres had burst. The passengers deplaned via the normal exits and the aircraft was then towed
onto stand. The runway was swept and, following a further inspection, was declared open at 2044 hrs.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 199
It is recommended that Airworthiness Authorities such as the JAA and FAA consider implementing the measures
outlined in AAIB Safety Recommendations 99-11 and 99-12 concerning requirements for tyre pressure monitor-
ing and warning systems.
During taxi for takeoff at Manchester International Airport, the aircraft passenger cabin filled with smoke and an
emergency evacuation of the aircraft was carried out. The evacuation was carried out expeditiously, but the cab-
in crew had difficulty opening the Galley Service Door and some passengers using the overwing escape hatches
were unsure of how to descend to the ground. The smoke had originated from a damaged Auxiliary Power Unit
(APU), which had allowed oil from the unit to leak into the bleed air system.
The CAA and JAA should review the requirements for passenger safety cards to ensure that, for aircraft with over-
wing exits, the safety card is required to clearly depict the emergency escape route(s) from the cabin, via the
wing, to the ground.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 200
BOMBARDIER
N90AG Birmingham Airport 04/01/2002 Accident
CL600 2B19
Immediately after takeoff from Runway 15 at Birmingham International Airport the aircraft began a rapid left roll,
which continued despite the prompt application of full opposite aileron and rudder. The left winglet contacted
the runway shoulder, the outboard part of the left wing detached and the aircraft struck the ground inverted,
structurally separating the forward fuselage. Fuel released from ruptured tanks ignited and the wreckage slid to
a halt on fire; the Airport Fire Service was in attendance less than 1 minute later. The accident was not survivable.
Numerous possible causes for the uncontrolled roll were identified but all except one were eliminated. It was
concluded that the roll had resulted from the left wing stalling at an abnormally low angle of attack due to flow
disturbance resulting from frost contamination of the wing. A relatively small degree of wing surface roughness
had a major adverse effect on the wing stall characteristics and the stall protection system was ineffective in this
situation. Possible asymmetric de-icing by the Auxiliary Power Unit (APU) exhaust gas during pre-flight prepara-
tions may have worsened the wing-drop tendency.
N90AG’s pilots should have been aware of wing frost during pre-flight preparations but the aircraft was not
de-iced and the ice detector system would not have alerted them. It was considered that the judgement and con-
centration of both pilots may have been impaired by the combined effects of a non-prescription drug, jet-lag
and fatigue.
Possible contributory factors were; the inadequate warnings on the drug packaging, Federal Aviation Adminis-
tration (FAA) guidance material suggesting that polished wing frost was acceptable and melting of the frost on
the right wing by the APU exhaust gas.
1. The crew did not ensure that N90AG’s wings were clear of frost prior to takeoff.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 201
2. Reduction of the wing stall angle of attack, due to the surface roughness associated with frost con-
tamination, to below that at which the stall protection system was effective.
3. Possible impairment of crew performance by the combined effects of a non-prescription drug, jet-lag
and fatigue.
It is recommended that the FAA and JAA review the current procedural approach to the pre takeoff detection and
elimination of airframe ice contamination and consider requiring a system that would directly monitor aircraft
aerodynamic surfaces for ice contamination and warn the crew of a potentially hazardous condition.
The Glasgow based Islander aircraft was engaged on an air ambulance task for the Scottish Ambulance Service
when the accident occurred. The pilot allocated to the light had not flown for 32 days; he was therefore required
to complete a short light at Glasgow to regain currency before landing to collect a paramedic for the light to
Campbeltown Airport on the Kintyre Peninsula.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 202
Poor weather at Campbeltown Airport necessitated an instrument approach. There was neither radar nor Air
Traffic Control Service at the airport, so the pilot was receiving a Flight Information Service from a Flight Infor-
mation Service Officer in accordance with authorised procedures. After arriving overhead Campbeltown Airport,
the aircraft flew outbound on the approach procedure for Runway 11 and began a descent. The pilot next trans-
mitted that he had completed the ‘base turn’, indicating that he was inbound to the airport and commencing an
approach. Nothing more was seen or heard of the aircraft and further attempts at radio contact were unsuccess-
ful. The emergency services were alerted and an extensive search operation was mounted in an area based on
the pilot’s last transmission. The aircraft wreckage was subsequently located on the sea bed 7.7 nm west-north-
west of the airport; there were no survivors.
1. The pilot allowed the aircraft to descend below the minimum altitude for the aircraft’s position on the
approach procedure, and this descent probably continued unchecked until the aircraft flew into the
sea.
2. A combination of fatigue, workload and lack of recent lying practise probably contributed to the pi-
lot’s reduced performance.
3. The pilot may have been subject to an undetermined influence such as disorientation, distraction or
a subtle incapacitation, which affected his ability to safely control the aircraft’s flightpath.
Considering the circumstances of air ambulance flights, the Civil Aviation Authority in conjunction with the JAA
should review the circumstances in which a second pilot is required for public transport flights operating air am-
bulance services.
To be complete, a more specific review of helicopters emergency medical services (HEMS) occurrences
was conducted, because it introduces specific risks when selecting the landing site compared to air am-
bulance flight and the MOPSC is often below 9. This type of operation is covered by a Specific Approval
(Part SPA Subpart J) and a minimum crew of 2 pilots at night or one pilot and one HEMS technical crew
member under specific conditions is defined (SPA.HEMS.130 (e)). Part-ORO subpart TC defines training re-
quirements for HEMS technical crews.
On this basis, the restrictions and mitigation means applied for single-pilots operations appear coherent
with the safety review.
The incident occurred at 1926 hrs on 22 October 2005, to an Airbus A319-131 aircraft which was operating
a scheduled passenger flight between London Heathrow and Budapest […].
As the aircraft climbed to Flight Level (FL) 200 in night Visual Meteorological Conditions (VMC) with autopilot and
autothrust engaged, there was a major electrical failure. This resulted in the loss or degradation of a number of
important aircraft systems. The crew reported that both the commander’s and co-pilot’s Primary Flight Displays
(PFD) and Navigation Displays (ND) went blank, as did the upper ECAM1 display. The autopilot and autothrust
systems disconnected, the VHF radio and intercom were inoperative and most of the cockpit lighting went off.
There were several other more minor concurrent failures.
The commander maintained control of the aircraft, flying by reference to the visible night horizon and the stand-
by instruments, which were difficult to see in the poor light. The co-pilot carried out the abnormal checklist
actions which appeared on the lower ECAM display; the only available electronic flight display. Most of the af-
fected systems were restored after approximately 90 seconds, when the co-pilot selected the AC Essential Feed
switch to Alternate (‘ALTN’). There were no injuries to any of the 76 passengers or 6 crew. After the event, and
following discussions between the crew and the operator’s Maintenance Control, the aircraft continued to Bu-
dapest […].
It was not possible to determine the cause of the incident due to a lack of available evidence, however, nine ad-
ditional Safety Recommendations are made in this report.
It is recommended that the European Aviation Safety Agency should, in consultation with other National Airwor-
thiness Authorities outside Europe, consider requiring training for flight by sole reference to standby instruments
to pilots during initial and recurrent training courses.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 204
Whilst on approach to London (Heathrow) from Beijing, China, at 720 feet agl, the right engine of G-YMMM
ceased responding to autothrottle commands for increased power and instead the power reduced to 1.03 En-
gine Pressure Ratio (EPR). Seven seconds later the left engine power reduced to 1.02 EPR. This reduction led to
a loss of airspeed and the aircraft touching down some 330 m short of the paved surface of Runway 27L at Lon-
don Heathrow. The investigation identified that the reduction in thrust was due to restricted fuel flow to both
engines.
It was determined that this restriction occurred on the right engine at its Fuel Oil Heat Exchanger (FOHE). For
the left engine, the investigation concluded that the restriction most likely occurred at its FOHE. However, due
to limitations in available recorded data, it was not possible totally to eliminate the possibility of a restriction
elsewhere in the fuel system, although the testing and data mining activity carried out for this investigation sug-
gested that this was very unlikely. Further, the likelihood of a separate restriction mechanism occurring within
seven seconds of that for the right engine was determined to be very low.
The investigation identified the following probable causal factors that led to the fuel flow restrictions:
1. Accreted ice from within the fuel system released, causing a restriction to the engine fuel flow at the
face of the FOHE, on both of the engines.
2. Ice had formed within the fuel system, from water that occurred naturally in the fuel, whilst the air-
craft operated with low fuel flows over a long period and the localised fuel temperatures were in an
area described as the ‘sticky range’.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 205
3. The FOHE, although compliant with the applicable certification requirements, was shown to be sus-
ceptible to restriction when presented with soft ice in a high concentration, with a fuel temperature
that is below -10°C and a fuel flow above flight idle.
4. Certification requirements, with which the aircraft and engine fuel systems had to comply, did not take
account of this phenomenon as the risk was unrecognised at that time.
It is recommended that the Federal Aviation Administration and the European Aviation Safety Agency review the
current certification requirements to ensure that aircraft and engine fuel systems are tolerant to the potential
build up and sudden release of ice in the fuel feed system.
The glider was being winch launched from a grass airfield. At an early stage of the launch the right wing tip con-
tacted the ground, the left wing lifted and the glider cartwheeledto the right before coming to rest, inverted.
The pilot was fatally injured.
It is recommended that the European Aviation Safety Agency amend the certification standard for Sailplanes and
Powered Sailplanes (CS 22) to include the requirement that the cable release mechanisms can be operated at any
stage of the launch without restricting the range of movement of any flying control.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 206
It is recommended that the European Aviation Safety Agency require that Type Certificate holders of EASA Type
Certificated gliders ensure, where practicable, that the cable release control can be operated at any stage of the
launch without restricting the range of movement of any flying control.
AIRBUS
G-VSXY Gatwick Airport 16/04/2012 Accident
A330
The aircraft was operating a flight from London Gatwick Airport to McCoy International Airport in Orlando, USA
with three flight crew, 10 cabin crew and 304 passengers on board including three infants. Early in the flight
the crew received a series of smoke warnings from the aft cargo hold and the commander elected to return to
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 207
London Gatwick. The crew carried out the appropriate emergency drills, including the discharge of the fire extin-
guishers in the aft cargo hold, but the smoke warnings continued. The aircraft landed safely, the crew brought it
to a halt on the runway and endeavoured to establish the extent of any fire. This produced conflicting evidence
and, with smoke warnings continuing, the commander ordered an emergency evacuation.
The passengers all left the aircraft within 90 seconds but two injuries, classed as ‘Serious’, were incurred. Subse-
quent examination of the aircraft and its systems showed that the smoke warnings had been spurious.
The investigation identified that injuries were sustained during the evacuation of the aircraft. The evacuation
was initiated based on the commander’s assessment of the available sources of information, including the repet-
itive and intermittent nature of the aft cargo smoke warnings.
The investigation identified the following causal factor for the intermittent cargo smoke warnings:
1. A latent fault on the T1 thermistor channel of smoke detector 10WH, in combination with a CAN Bus
fault and possible high levels of humidity in the cargo compartment due to the carriage of perishable
goods, provided circumstances sufficient to generate multiple spurious aft cargo compartment smoke
warnings.
The investigation identified the following contributory factors for the intermittent cargo smoke warnings:
1. The thermal channel fault in 10WH was not detected prior to the event by the internal smoke detec-
tor temperature monitoring.
It is recommended that the European Aviation Safety Agency amend AMC1 CAT.OP.MPA.170, ‘Passenger briefing’,
to ensure briefings emphasise the importance of leaving hand baggage behind in an evacuation.
It is recommended that the European Aviation Safety Agency develops recommendations on the content of visu-
al aids such as safety briefing cards or safety videos to include information on how passengers, including those
with young children, should use the escape devices.
AIRBUS
G-EUOE London Heathrow Airport 24/05/2013 Accident
A319
As the aircraft departed Runway 27L at London Heathrow Airport, the fan cowl doors from both engines de-
tached, puncturing a fuel pipe on the right engine and damaging the airframe, and some aircraft systems. The
flight crew elected to return to Heathrow. On the approach to land an external fire developed on the right en-
gine. The left engine continued to perform normally throughout the flight. The right engine was shut down and
the aircraft landed safely and was brought to a stop on Runway 27R. The emergency services quickly attend-
ed and extinguished the fire in the right engine. The passengers and crew evacuated the aircraft via the escape
slides, without injury.
Subsequent investigation revealed that the fan cowl doors on both engines were left unlatched during mainte-
nance and this was not identified prior to aircraft departure.
It is recommended that the European Aviation Safety Agency amends Certification Specification 25.901(c), Ac-
ceptable Means of Compliance (AMC) 25.901(c) and AMC 25.1193, to include fan cowl doors in the System Safety
Assessment for the engine installation and requires compliance with these amended requirements during the
certification of modifications to existing products and the initial certification of new designs.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 209
EUROCOPTER
G-SPAO Glasgow City Centre, Scotland 29/11/2013 Accident
EC135
The helicopter departed Glasgow City Heliport (GCH) at 2044 hrs on 29 November 2013, in support of Police
Scotland operations. On board were the pilot and two Police Observers. After their initial task, south of Glas-
gow City Centre, they completed four more tasks; one in Dalkeith, Midlothian, and three others to the east of
Glasgow, before routing back towards the heliport. When the helicopter was about 2.7 nm from GCH, the right
engine flamed out. Shortly afterwards, the left engine also flamed out. An autorotation, flare recovery and land-
ing were not achieved and the helicopter descended at a high rate onto the roof of the Clutha Vaults Bar, which
collapsed. The three occupants in the helicopter and seven people in the bar were fatally injured. Eleven others
in the bar were seriously injured.
Fuel in the helicopter’s main fuel tank is pumped by two transfer pumps into a supply tank, which is divided into
two cells. Each cell of the supply tank feeds its respective engine. During subsequent examination of the helicop-
ter, 76 kg of fuel was recovered from the main fuel tank. However, the supply tank was found to have been empty
at the time of impact. It was deduced from wreckage examination and testing that both fuel transfer pumps in
the main tank had been selected off for a sustained period before the accident, leaving the fuel in the main tank,
unusable. The low fuel 1 and low fuel 2 warning captions, and their associated audio attention-getters, had been
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 210
triggered and acknowledged, after which, the flight had continued beyond the 10-minute period specified in the
Pilot’s Checklist Emergency and Malfunction Procedures.
The helicopter was not required to have, and was not fitted with, flight recorders. However, data and recordings
were recovered from non-volatile memory (NVM) in systems on board the helicopter, and radar, radio, police
equipment and CCTV recordings were also examined.
During the investigation, the EC135’s fuel sensing, gauging and indication system, and the Caution Advisory
Display and Warning Unit were thoroughly examined. This included tests resulting from an incident involving
another EC135 T2+.
Despite extensive analysis of the limited evidence available, it was not possible to determine why both fuel trans-
fer pumps in the main tank remained off during the latter part of the flight, why the helicopter did not land
within the time specified following activation of the low fuel warnings and why a MAYDAY call was not received
from the pilot. Also, it was not possible to establish why a more successful autorotation and landing was not
achieved, albeit in particularly demanding circumstances.
1. 73 kg of usable fuel in the main tank became unusable as a result of the fuel transfer pumps being
switched off for unknown reasons.
2. It was calculated that the helicopter did not land within the 10-minute period specified in the Pilot’s
Checklist Emergency and Malfunction Procedures, following continuous activation of the low fuel
warnings, for unknown reasons.
3. Both engines flamed out sequentially while the helicopter was airborne, as a result of fuel starvation,
due to depletion of the supply tank contents.
4. A successful autorotation and landing was not achieved, for unknown reasons.
1. Incorrect management of the fuel system allows useable fuel to remain in the main tank while the con-
tents in the supply tank become depleted.
2. The RADALT and steerable landing light were unpowered after the second engine flamed out, leading
to a loss of height information and reduced visual cues.
3. Both engines flamed out when the helicopter was flying over a built-up area.
It is recommended that the European Aviation Safety Agency mandate the ICAO Annex 6 flight recorder require-
ments for all helicopter emergency medical service operations, regardless of aircraft weight. The last two hours
of flight crew communications and cockpit area audio should be recorded. The cockpit area audio recording
should continue for 10 minutes after the loss of normal electrical power.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 211
At 1717 hrs UTC on 23 August 2013, an AS332 L2 Super Puma helicopter with sixteen passengers and two crew
on board crashed in the sea during the approach to land at Sumburgh Airport. Four of the passengers did not
survive.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 212
The purpose of the flight was to transport the passengers, who were employees of the UK offshore oil and gas in-
dustry, to Aberdeen. On the accident flight, the helicopter had departed the Borgsten Dolphin semi-submersible
drilling platform in the North Sea, to route to Sumburgh Airport for a refuelling stop. It then planned to contin-
ue to Aberdeen Airport.
The commander was the Pilot Flying (PF) on the accident sector. The weather conditions were such that the fi-
nal approach to Runway 09 at Sumburgh Airport was flown in cloud, requiring the approach to be made by sole
reference to the helicopter’s instruments, in accordance with the Standard Operating Procedure (SOP) set out in
the operator’s Operating Manual (OM). The approach was flown with the autopilot in 3-axes with Vertical Speed
(V/S) mode, which required the commander to operate the collective pitch control manually to control the hel-
icopter’s airspeed. The co-pilot was responsible for monitoring the helicopter’s vertical flightpath against the
published approach vertical profile and for seeking the external visual references necessary to continue with the
approach and landing. The procedures permitted the helicopter to descend to a height of 300 ft, the Minimum
Descent Altitude (MDA) for the approach, at which point a level-off was required if visual references had not yet
been acquired.
Although the approach vertical profile was maintained initially, insufficient collective pitch control input was
applied by the commander to maintain the approach profile and the target approach airspeed of 80 kt. This re-
sulted in insufficient engine power being provided and the helicopter’s airspeed reduced continuously during
the final approach. Control of the flightpath was lost and the helicopter continued to descend below the MDA.
During the latter stages of the approach the helicopter’s airspeed had decreased below 35 kt and a high rate of
descent had developed.
The decreasing airspeed went unnoticed by the pilots until a very late stage, when the helicopter was in a critical-
ly low energy state. The commander’s attempt to recover the situation was unsuccessful and the helicopter struck
the surface of the sea approximately 1.7 nm west of Sumburgh Airport. It rapidly filled with water and rolled in-
verted, but was kept afloat by the flotation bags which had deployed.
Search and Rescue (SAR) assets were dispatched to assist and the survivors were rescued by the Sumburgh-based
SAR helicopters that attended the scene.
The helicopter’s flight instruments were not monitored effectively during the latter stages of the non-
precision instrument approach. This allowed the helicopter to enter a critically low energy state, from
which recovery was not possible.
Visual references had not been acquired by the Minimum Descent Altitude (MDA) and no effective
action was taken to level the helicopter, as required by the operator’s procedure for an instrument
approach.
The operator’s SOP for this type of approach was not clearly defined and the pilots had not developed
a shared, unambiguous understanding of how the approach was to be flown.
The operator’s SOPs at the time did not optimise the use of the helicopter’s automated systems dur-
ing a Non-Precision Approach.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 213
The decision to fly a 3-axes with V/S mode, decelerating approach in marginal weather conditions did
not make optimum use of the helicopter’s automated systems and required closer monitoring of the
instruments by the crew.
Despite the poorer than forecast weather conditions at Sumburgh Airport, the commander had not al-
tered his expectation of being able to land from a Non-Precision Approach.
It is recommended that the European Aviation Safety Agency considers establishing a European Operators Flight
Data Monitoring forum for helicopter operators to promote and support the development of Helicopter Flight
Data Monitoring programmes.
It is recommended that the European Aviation Safety Agency collaborates with National Aviation Authorities and
helicopter operators to develop and publish guidance material on detection logic for Helicopter Flight Data Mon-
itoring programmes.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 214
SAAB Serious
G-LGNO en-route 15/12/2014
2000 incident
The aircraft was inbound to land on Runway 27 at Sumburgh when the pilots discontinued the approach be-
cause of weather to the west of the airport. As the aircraft established on a southerly heading, it was struck by
lightning. When the commander made nose-up pitch inputs the aircraft did not respond as he expected. After
reaching 4,000 ft amsl the aircraft pitched to a minimum of 19° nose down and exceeded the applicable maxi-
mum operating speed (VMO) by 80 kt, with a peak descent rate of 9,500 ft/min. The aircraft started to climb after
reaching a minimum height of 1,100 ft above sea level.
Recorded data showed that the autopilot had remained engaged, contrary to the pilots’ understanding, and the
pilots’ nose-up pitch inputs were countered by the autopilot pitch trim function, which made a nose-down pitch
trim input in order to regain the selected altitude.
Five Safety Recommendations are made relating to the design of the autopilot system and the certification re-
quirements for autopilot systems.
It is recommended that the European Aviation Safety Agency review the design of the Saab 2000 autopilot sys-
tem and require modification to ensure that the autopilot does not create a potential hazard when the flight crew
applies an override force to the flight controls.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 215
BEECH
G-BYCP Near Chigwell, Essex 03/10/2015 Accident
B200
The aircraft was climbing through approximately 750 ft amsl after takeoff when it began to turn right. It con-
tinued to climb in the turn until it reached approximately 875 ft amsl when it began to descend. The descent
continued until the aircraft struck some trees at the edge of a field, approximately 1.8 nm southwest of the
aerodrome. The evidence available was consistent with a loss of aircraft control in Instrument Meteorological
Conditions (IMC), but this could not be concluded unequivocally because of a lack of evidence from within the
cockpit. However, it is possible the pilot became incapacitated and the additional crew member was unable to
recover the aircraft in the height available.
Three Safety Recommendations are made regarding the fitment of Terrain Awareness and Warning Systems
(TAWS).
It is recommended that the European Aviation Safety Agency require all in-service and future turbine aircraft
with a Maximum Certificated Take-off Mass of 5,700 kg or less and with a maximum operational passenger seat-
ing configuration of between six and nine passengers to be fitted with, as a minimum standard, a Class B Terrain
Awareness and Warning System certified to ETSO-C151b.
The Opinion includes proposals for amendments to Commission Regulation (EU) No 965/2012 to require
turbine-powered aeroplanes performing commercial operations for which the individual Certificate of
Airworthiness (CofA) is first issued after 1 January 2019, having a Maximum Certified Take-Off Mass (MC-
TOM) of 5 700 kg or less, and a Maximum Operational Passenger Seating Configuration (MOPSC) of six
to nine, to be equipped with a TAWS that meets the requirements for Class B equipment, as specified in
an acceptable standard. Existing guidance material defines ‘acceptable standard’ as the applicable Euro-
pean Technical Standards Order (ETSO) issued by the Agency (e.g. ETSO-C151 (any revision) or equivalent.
Mandating TAWS to be installed on existing aeroplanes (retrofit) and to be applied to aircraft used for
non-commercial operations was also considered under the RMT. The outcome of the data analysis and
impact assessment did not support this, especially taking into account the principle of proportionality
for general aviation legislation. However, considering the potential safety benefits of TAWS, i.e. further
reducing the probability of CFIT accidents, and taking into account that ICAO recommends that all tur-
bine-engined aeroplanes of a MCTOM of 5700 kg or less and authorized to carry more than five but not
more than nine passengers should be equipped with a ground proximity warning system, EASA consid-
ered that there were significant grounds to recommend the installation of TAWS on such aeroplanes.
Therefore, the Agency published a Safety Information Bulletin (SIB No 2017-14), on 06 September 2017,
recommending that owners and operators of the afore-mentioned aeroplanes, as well as affected aero-
plane manufacturers, install a TAWS that meets the requirements for Class B equipment, as specified in
an acceptable standard, e.g. ETSO-C151 (any revision), or equivalent.
During the RMT, when building the safety case during a regulatory impact assessment (RIA), one of the
major aspects taken into account was that the absence of TAWS in the aircraft within the scope of the task
was a factor in only two accidents in Europe in the last 10 years.
Technology has evolved and most terrain awareness functions are nowadays an integral part of the avi-
onics. Manufacturers in Europe and the US offer this system with their new aircraft, in line with the
recommendation from ICAO and the FAA requirements on TAWS. Furthermore, a significant proportion
of operators have voluntarily installed TAWS or an equivalent terrain awareness system to existing air-
craft in Europe (20 % of those responding to an EASA survey conducted under the TAWS RMT).
Lastly, the risk area of terrain conflict, including controlled collision with terrain, features in the pub-
lished EASA Rulemaking and EPAS programme 2017-2021. The Agency is committed to the continuous
assessment and improvement of risk controls to mitigate the risk of controlled flight into terrain, through
monitoring of safety issues identified in the Commercial Air Transport Fixed Wing Portfolio (see the EASA
Annual Safety Review 2016) for this particular risk area.
This includes the establishment of a Member State Task MST.006 to include CFIT in national State Safety
Programmes, including, as a minimum, agreeing a set of actions and measuring their effectiveness. Any
weaknesses identified in the regulatory framework will be acted on appropriately in order to close any
emerging safety gaps.
GLASFLUGEL
G-GSGS Parham Airfield 10/08/2017 Accident
304
The pilot had fully charged both Front Electric Sustainer (FES) batteries on 4 August 2017, after which they were
removed from the chargers for storage. He installed them in the glider on the morning of 10 August, with the
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 217
intention of flying the glider that afternoon. He initiated the FES battery self-checking procedure before con-
ducting a daily inspection of the glider, after which the self-checking procedure had completed with no faults
indicated on the FES Control Unit (FCU). He then fitted the FES battery compartment cover and applied tape
around the edges of the cover.
The pilot conducted a ground run of the FES propeller, which operated normally. He then switched the Power Switch
OFF, and also turned the FCU OFF, which was contrary to his normal practice of leaving the FCU switched ON.
The pilot launched from Parham Airfield by aerotow at 1021 hrs and flew in ridge lift for a period of 38 minutes
before encountering a rain shower. He decided to use the FES propulsion system and turned the Power Switch
ON. He then noticed that the FCU was switched OFF, so he switched the FCU ON without moving the Power
Switch position.
After waiting a few seconds for the FCU green LEDs to show that the FES propulsion system was available, he op-
erated the FES motor which responded normally and operated for 4 minutes. The pilot did not recall observing
any fault messages on the FCU during the motor operation.
After stopping the FES motor the pilot noticed that the propeller did not realign itself correctly against the nose
of the glider. The pilot had experienced this problem previously and did not consider it to be a significant issue,
so he did not attempt to realign the propeller. He switched the Power Switch OFF, leaving the FCU switched ON
and continued in soaring flight for a further 1 hour 15 minutes before positioning the glider to land on grass
Runway 22 at Parham Airfield. The circuit was flown normally to a smooth touchdown, however at the moment
of touchdown the pilot heard an unexpected noise.
As the glider slowed during the ground run, the pilot smelled burning and the cockpit filled with smoke that
was moving forwards from behind the pilot’s head. The pilot did not report observing any warning messages
or illuminated LEDs on the FCU, although his attention was drawn outside the cockpit during landing. He vacat-
ed the cockpit normally, without injury, and observed that the FES battery compartment cover was missing and
that smoke, followed shortly by flames, was coming from the battery compartment. The airfield fire truck ar-
rived promptly and an initial attempt was made to extinguish the fire using a CO2 gaseous extinguisher, but this
proved unsuccessful. Aqueous film-forming foam (AFFF) was then sprayed into the FES battery compartment and
the fire was extinguished.
The FES battery compartment cover was found close to the glider’s touchdown point. The cover’s rear carbon
fibre catch was fractured, consistent with a vertical load acting on the inside of the cover. The cover did not ex-
hibit any overheating damage.
It is recommended that the European Aviation Safety Agency (EASA) requires that all powered sailplanes, oper-
ating under either an EASA Restricted Type Certificate, or an EASA Permit to Fly, and fitted with a Front Electric
Sustainer (FES) system, are equipped with a warning system to alert the pilot to the presence of a fire or other
hazardous condition in the FES battery compartment.
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 218
United States
Registration Aircraft Type Location Date of event Event Type
Loss of Thrust in Both Engines After Encountering a Flock of Birds and Subsequent Ditching on the Hudson River
On January 15, 2009, about 1527 eastern standard time, US Airways flight 1549, an Airbus Industrie A320-214,
N106US, experienced an almost complete loss of thrust in both engines after encountering a flock of birds and
was subsequently ditched on the Hudson River about 8.5 miles from LaGuardia Airport (LGA), New York City, New
York. The flight was en route to Charlotte Douglas International Airport, Charlotte, North Carolina, and had de-
parted LGA about 2 minutes before the in-flight event occurred. The 150 passengers, including a lap-held child,
and 5 crewmembers evacuated the airplane via the forward and overwing exits. One flight attendant and four
passengers were seriously injured, and the airplane was substantially damaged.
The scheduled, domestic passenger flight was operating under the provisions of 14 Code of Federal Regulations
Part 121 on an instrument flight rules flight plan. Visual meteorological conditions prevailed at the time of the
accident.
The National Transportation Safety Board determines that the probable cause of this accident was the ingestion
of large birds into each engine, which resulted in an almost total loss of thrust in both engines and the subse-
quent ditching on the Hudson River. Contributing to the fuselage damage and resulting unavailability of the aft
slide/rafts were (1) the Federal Aviation Administration’s (FAA) approval of ditching certification without deter-
mining whether pilots could attain the ditching parameters without engine thrust, (2) the lack of industry flight
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 219
crew training and guidance on ditching techniques, and (3) the captain’s resulting difficulty maintaining his in-
tended airspeed on final approach due to the task saturation resulting from the emergency situation.
Contributing to the survivability of the accident was (1) the decision-making of the flight crewmembers and
their crew resource management during the accident sequence; (2) the fortuitous use of an airplane that was
equipped for an extended overwater flight, including the availability of the forward slide/rafts, even though it
was not required to be so equipped; (3) the performance of the cabin crewmembers while expediting the evacu-
ation of the airplane; and (4) the proximity of the emergency responders to the accident site and their immediate
and appropriate response to the accident.
The National Transportation Safety Board makes the following recommendations to the European Aviation Safety
Agency: Modify the small and medium flocking bird certification test standard in Joint Aviation Regulations–
Engines to require that the test be conducted using the lowest expected fan speed, instead of 100-percent fan
speed, for the minimum climb rate. [A-10-88]
The National Transportation Safety Board makes the following recommendations to the European Aviation Safe-
ty Agency: During the bird-ingestion rulemaking database (BRDB) working group’s reevaluation of the current
engine bird-ingestion certification regulations, specifically reevaluate the Joint Aviation Regulations–Engines
(JAR-E) large flocking bird certification test standards to determine whether they should
1) apply to engines with an inlet area of less than 3,875 square inches and
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 220
2) include a requirement for engine core ingestion. If the BRDB working group’s reevaluation determines
that such requirements are needed, incorporate them into JAR-E and require that newly certificated
engines be designed and tested to these requirements. [A-10-089]
The National Transportation Safety Board makes the following recommendations to the European Aviation Safety
Agency: Require modifications to life vest stowage compartments or stowage compartment locations to improve
the ability of passengers to retrieve life vests for all occupants. [A-10-95]
AIRBUS
N14053 Belle Harbor 12/11/2001 Accident
A300
On November 12, 2001, about 0916:15 eastern standard time, American Airlines flight 587, an Airbus Industrie
A300-605R, N14053, crashed into a residential area of Belle Harbor, New York, shortly after takeoff from John F.
Kennedy International Airport, Jamaica, New York. Flight 587 was a regularly scheduled passenger flight to Las
Americas International Airport, Santo Domingo, Dominican Republic, with 2 flight crewmembers, 7 flight attend-
ants, and 251 passengers aboard the airplane. The airplane’s vertical stabilizer and rudder separated in flight and
were found in Jamaica Bay, about 1 mile north of the main wreckage site. The airplane’s engines subsequent-
ly separated in flight and were found several blocks north and east of the main wreckage site. All 260 people
aboard the airplane and 5 people on the ground were killed, and the airplane was destroyed by impact forces
and a postcrash fire. Flight 587 was operating under the provisions of 14 Code of Federal Regulations Part 121
on an instrument flight rules flight plan. Visual meteorological conditions prevailed at the time of the accident.
The National Transportation Safety Board determines that the probable cause of this accident was the in-flight
separation of the vertical stabilizer as a result of the loads beyond ultimate design that were created by the first
officer’s unnecessary and excessive rudder pedal inputs. Contributing to these rudder pedal inputs were charac-
teristics of the Airbus A300-600 rudder system design and elements of the American Airlines Advanced Aircraft
Maneuvering Program.
The National Transportation Safety Board recommends that the European Aviation Safety Agency modify Eu-
ropean Aviation Safety Agency Certification Specifications for Large Aeroplanes CS-25 to ensure safe handling
qualities in the yaw axis throughout the flight envelope, including limits for rudder pedal sensitivity. [A-10-119]
This SC will be applied to new Type Certificates for which an application is made after the publication
of the final SC. In accordance with Part 21.A.101 the applicability will be evaluated for major significant
changes to previously certified aeroplanes.
Rulemaking task RMT.0397 will introduce new certification specifications in CS-25 (applicable to new cer-
tification projects for large aeroplanes) to mitigate the risk of pilots unintended or inappropriate rudder
pedal usage. RMT.0397 started on 30 May 2017 with the publication of its terms of reference on the EASA
Website:
https://www.easa.europa.eu/document-library/terms-of-reference-and-group-compositions/tor-rmt0397
ATR
N902FX Lubbock, Texas, United States 27/01/2009 Accident
ATR42
On January 27, 2009, about 0437 central standard time, an Avions de Transport Régional Aerospatiale Alenia ATR
42-320, N902FX, operating as Empire Airlines flight 8284, was on an instrument approach when it crashed short
of the runway at Lubbock Preston Smith International Airport, Lubbock, Texas. The captain sustained serious in-
juries, and the first officer sustained minor injuries. The airplane was substantially damaged. The airplane was
registered to FedEx Corporation and operated by Empire Airlines, Inc., as a 14 Code of Federal Regulations Part
121 supplemental cargo flight. The flight departed from Fort Worth Alliance Airport, Fort Worth, Texas, about
0313. Instrument meteorological conditions prevailed, and an instrument flight rules flight plan was filed.
The National Transportation Safety Board determines that the probable cause of this accident was the flight
crew’s failure to monitor and maintain a minimum safe airspeed while executing an instrument approach in ic-
ing conditions, which resulted in an aerodynamic stall at low altitude. Contributing to the accident were 1) the
flight crew’s failure to follow published standard operating procedures in response to a flap anomaly, 2) the cap-
tain’s decision to continue with the unstabilized approach, 3) the flight crew’s poor crew resource management,
and 4) fatigue due to the time of day in which the accident occurred and a cumulative sleep debt, which likely
impaired the captain’s performance.
The National Transportation Safety Board makes the following recommendation to the European Aviation Safe-
ty Agency: evaluate all European Aviation Safety Agency-certificated transport-category airplanes equipped with
stick pushers to ensure that the stick pusher activates at an angle of attack that will provide adequate stall pro-
tection in the presence of airframe ice accretions. [A-12-27]
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 223
AEROSPATIALE
N390LG Frisco, Colorado 03/07/2015 Accident
AS350
EUROCOPTER
N356AM St. Louis, Missouri 06/03/2015 Accident
EC130
On March 6, 2015, about 2310 central standard time, an Airbus Helicopters EC130 B4 helicopter, N356AM, oper-
ated by Air Methods Corporation, doing business as ARCH, struck the edge of a hospital building and impacted
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 224
its parking lot near St. Louis, Missouri, during approach to an elevated rooftop helipad. The helicopter was
destroyed by impact forces and a postcrash fire. The pilot was the sole occupant and sustained fatal thermal in-
juries. Night visual meteorological conditions prevailed for the flight conducted under the provisions of 14 Code
of Federal Regulations (CFR) Part 135. The NTSB’s ongoing investigation determined that the accident was imme-
diately survivable in the absence of a postcrash fire.
On July 3, 2015, about 1339 mountain daylight time, an Airbus Helicopters AS350 B3e helicopter, N390LG, oper-
ated by Air Methods Corporation, partially impacted a parked recreational vehicle in a parking lot near Summit
Medical Center in Frisco, Colorado, after takeoff from a ground-based hospital helipad. The helicopter was de-
stroyed by impact forces and a postcrash fire. Visual meteorological conditions prevailed for the flight conducted
under the provisions of 14 CFR Part 135. Video footage from a parking lot surveillance camera revealed a post-
crash fire initiating a few seconds after ground impact concurrent with large quantities of fuel flowing from the
helicopter wreckage. The pilot and two flight nurses survived the initial ground impact. One flight nurse sus-
tained a back injury and the other sustained serious thermal injuries. A medical staff member on the ground near
the crash site also sustained thermal injuries while attempting to rescue the pilot from the helicopter wreckage.
The pilot ultimately died from his injuries.2 The NTSB’s investigation of this accident is ongoing.
Neither the AS350 B3e nor the EC130 B4 helicopter was equipped with a crash-resistant fuel system, which if in-
stalled, may have prevented or reduced the risk of thermal injuries.
Once Airbus Helicopters completes development of a retrofit kit to incorporate a crash-resistant fuel system
into AS350 B3e and similarly designed variants, prioritize its approval to accelerate its availability to operators.
[A-16-011]
AEROSPATIALE
N390LG Frisco, Colorado 03/07/2015 Accident
AS350
2017 Annual Safety Recommendations Review
List of 2017 Safety Recommendations Replies PAGE 225
On July 3, 2015, about 1339 mountain daylight time, an Airbus Helicopters AS350 B3e helicopter, N390LG, oper-
ated by Air Methods Corporation, partially impacted a parked recreational vehicle in a parking lot near Summit
Medical Center in Frisco, Colorado, after takeoff from a ground-based hospital helipad. The helicopter was de-
stroyed by impact forces and a postcrash fire. Visual meteorological conditions prevailed for the flight conducted
under the provisions of 14 CFR Part 135. Video footage from a parking lot surveillance camera revealed a post-
crash fire initiating a few seconds after ground impact concurrent with large quantities of fuel flowing from the
helicopter wreckage. The pilot and two flight nurses survived the initial ground impact. One flight nurse sus-
tained a back injury and the other sustained serious thermal injuries. A medical staff member on the ground near
the crash site also sustained thermal injuries while attempting to rescue the pilot from the helicopter wreckage.
The pilot ultimately died from his injuries.2 The NTSB’s investigation of this accident is ongoing.
After the actions requested in Safety Recommendation A-17-10 are completed, require operators of Airbus Hel-
icopters dual-hydraulic AS350-series helicopters to incorporate changes to the dual hydraulic system to both
ensure pedal control hydraulic assistance and mitigate the possibility of pilot error during any check of the hy-
draulic system.
[A-17-10 addressed to Airbus Helicopter is the following: for existing dual-hydraulic AS350-series helicopters,
assess and implement changes to the dual hydraulic system that would both ensure pedal control hydraulic assis-
tance and mitigate the possibility of pilot error during any check of the hydraulic system.]
CHAPTER 1
CHAPTER 2
CHAPTER 3
CHAPTER 4
CHAPTER 5
CHAPTER 6 Definitions
ANNEX A.
ANNEX B.
ANNEX C.
2017 Annual Safety Recommendations Review
Definitions PAGE 227
Definitions
The following definitions are extracted from Regulation (EU) No 996/2010 of the European Parliament and of the
Council of 20 October 2010.
Accident: occurrence associated with the operation of an aircraft which, in the case of a manned aircraft, takes
place between the time any person boards the aircraft with the intention of flight until such time as all such per-
sons have disembarked, or in the case of an unmanned aircraft, takes place between the time the aircraft is ready
to move with the purpose of flight until such time it comes to rest at the end of the flight and the primary pro
pulsion system is shut down, in which:
direct contact with any part of the aircraft, including parts which have become detached from the air-
craft, or,
except when the injuries are from natural causes, self- inflicted or inflicted by other persons, or when the injuries
are to stowaways hiding outside the areas normally available to the passengers and crew; or
(b) the aircraft sustains damage or structural failure which adversely affects the structural strength, performance
or flight characteristics of the aircraft, and would normally require major repair or replacement of the affected
component, except for engine failure or damage, when the damage is limited to a single engine, (including its
cowlings or accessories), to propellers, wing tips, antennas, probes, vanes, tires, brakes, wheels, fairings, pan-
els, landing gear doors, windscreens, the aircraft skin (such as small dents or puncture holes) or minor damages
to main rotor blades, tail rotor blades, landing gear, and those resulting from hail or bird strike, (including holes
in the radome); or
Incident: an occurrence, other than an accident, associated with the operation of an aircraft which affects or
would affect the safety of operation;
Serious incident: an incident involving circumstances indicating that there was a high probability of an accident
and is associated with the operation of an aircraft, which in the case of a manned aircraft, takes place between
the time any person boards the aircraft with the intention of flight until such time as all such persons have dis-
embarked, or in the case of an unmanned aircraft, takes place between the time the aircraft is ready to move
with the purpose of flight until such time it comes to rest at the end of the flight and the primary propulsion sys-
tem is shut down.
2017 Annual Safety Recommendations Review
Definitions PAGE 228
A list of examples of serious incidents is given below. The list is not exhaustive and only serves as guidance with
respect to the definition of ‘serious incident’:
a near collision requiring an avoidance manoeuvre to avoid a collision or an unsafe situation or when
an avoidance action would have been appropriate,
take-offs from a closed or engaged runway, from a taxiway, excluding authorised operations by heli
copters, or from an unassigned runway,
fires and smoke in the passenger compartment, in cargo compartments or engine fires, even though
such fires were extinguished by the use of extinguishing agents,
aircraft structural failure or engine disintegration, including uncontained turbine engine failures, not
classified as an accident,
multiple malfunctions of one or more aircraft systems seriously affecting the operation of the aircraft,
runway incursions classified with severity A according to the Manual on the Prevention of Runway In-
cursions (ICAO Doc 9870) which contains information on the severity classifications,
take-off or landing incidents. Incidents such as undershooting, overrunning or running off the side of
runways,
system failures, weather phenomena, operation outside the approved flight envelope or other occur-
rences which could have caused difficulties controlling the aircraft,
failure of more than one system in a redundancy system mandatory for flight guidance and navigation.
Safety investigation: process conducted by a safety investigation authority for the purpose of accident and
incident prevention which includes the gathering and analysis of information, the drawing of conclusions, in-
cluding the determination of cause(s) and/or contributing factors and, when appropriate, the making of safety
recommendations;
2017 Annual Safety Recommendations Review
Definitions PAGE 229
Safety recommendation: proposal of a safety investigation authority, based on information derived from a safe-
ty investigation or other sources such as safety studies, made with the intention of preventing accidents and
incidents.
Safety recommendation of Global Concern (SRGC)8: is defined as a safety recommendation made to a State civil
aviation authority, to a regional certification authority, or to ICAO regarding a systemic deficiency having a prob-
ability of recurrence with potential for significant consequences, and requiring timely action to improve safety.
a) the deficiency underlying the recommendation is systemic and not solely a local issue;
b) the probability of recurrence of the accident and the adverse consequences are high;
f) the deficiency underlying the recommendation constitutes a risk to the airworthiness, design, manu
facture, maintenance, operation and/or regulation of the involved aircraft type;
g) the deficiency underlying the recommendation constitutes a risk to more than one aircraft type, to
more than one operator, to more than one manufacturer and/or to more than one State; and
h) the mitigation of the risks associated with the deficiency will require coordinated efforts of more
than one entity of the air transport industry, such as civil aviation authority(ies), manufacturer(s) and
operator(s).
Safety recommendation of Union-wide Relevance (SRUR): a safety recommendation identified by the Euro
pean Network of Civil Aviation Safety Investigation Authorities according to Article 7 (g) of Regulation (EU) No
996/2010.
A safety recommendation of Union-wide Relevance (SRUR) would meet one or more of the following criteria:
The deficiency underlying the safety recommendation is systemic, not related to a specific aircraft
type, operator, manufacturer component, maintenance organization, air navigation service and/or ap-
proved training organisation, and not solely a national issue, or;
8 Source: ICAO Manual of Aircraft Accident and Incident Investigation (Doc 9756 -2014), Part IV Reporting, Chapter 1.6 RELEASE AND
DISTRIBUTION OF SAFETY RECOMMENDATIONS.
CHAPTER 0
CHAPTER 1
CHAPTER 2
CHAPTER 3
CHAPTER 4
CHAPTER 5
CHAPTER 6 ANNEX C
ANNEX A.
ANNEX B.
ANNEX C.
2017 Annual Safety Recommendations Review
ANNEX C PAGE 231
Safety Recommendations
classification
The classification has been established in the scope of the safety recommendations taxonomy working group in
cooperation with representatives from European Accident Investigation Bodies, Eurocontrol, the European Joint
Research Center (JRC) and EASA. The aim of this group was to initiate a taxonomy dedicated to recommendations.
This activity took place in 2007 and is being used to implement a safety recommendation database developed
by the JRC.
In addition to common definitions, the taxonomy also defines a unique pre-defined format for referencing safe-
ty recommendations. This format is composed by a 4 digits originating state name followed by the year it was
issued and then a three digits number (ex: UNKG-2007-001 for recommendation #1 issued by United Kingdom in
2007). Consequently, all references comply with this taxonomy foreseeing that existing safety recommendations
will be imported in a central database and shared with a community of users.
Agreement: safety recommendation for which the safety concern is agreed by the addressee and sub
sequent action is planned or implemented.
Partial agreement: safety recommendation considered relevant by the addressee but not applicable
and for which a safety issue has been recognised and a new orientation has been given to the recom
mended action.
Disagreement: safety recommendation considered not relevant or not applicable by the addressee.
No longer applicable: safety recommendation has been superseded or has become no longer
applicable.
Not Responsible: safety recommendation wrongly allocated or not in the scope of responsibility of
the addressee.
More information required: safety recommendation for which more information is required by the
addressee before any action initiated. Additional information should be sent by the originator.
Unknown: safety recommendation which was issued before any tracking implementation status and
for which insufficient information to assign any other status has been received.
Response assessment: The classification of the response as determined by the originator (when a response is
received):
Adequate: safety recommendation for which appropriate action is planned or implemented or suffi
cient evidence of completed action satisfying the objective has been received by the originator.
2017 Annual Safety Recommendations Review
ANNEX C PAGE 232
Partially adequate: safety recommendation for which the planned action or the action taken will
reduce but not substantially reduce or eliminate the deficiency or for which a safety issue has been
recognised and a new orientation has been given to the recommended action.
Not adequate: safety recommendation for which no action has been taken or proposed that will
reduce or eliminate the deficiency, or for which the proposed action is considered not applicable/
unacceptable.
Response is awaited: safety recommendation for which no response has been received.
Response received awaiting assessment: response to the safety recommendation has been received
by the originator and is awaiting assessment.
Unknown: the safety recommendation is one which was issued before any tracking implementation
status and for which insufficient information to assign any other status has been received.
Open safety recommendation: safety recommendation for which the reply has not yet been defined
or the appropriate action addressing the safety concern is still in progress.
Closed safety recommendation: safety recommendation for which appropriate action has been tak-
en and completed addressing the safety issue.
European Aviation Safety Agency
Safety Intelligence & Performance
Department
Postal address
Postfach 10 12 53
50452 Cologne
Germany
Visiting address
European Aviation Safety Agency
Konrad-Adenauer-Ufer 3, D-50668
Köln
Germany