2019 ~ IRM 26

Summary Bulletin
A Message from IATA
Nancy Rockbrune, Head, Safety Management

I would like to personally thank everyone who has ever participated or

attended an IATA Issue Review Meeting (IRM), as well as the numerous
organizations that have generously hosted this event over the years. The
information that is freely shared in this closed forum in the interest of
improving safety for all is a testament to how Safety is our Industry’s most
revered value.

Not only does the information help those that attend the meetings, but the lessons learned are also shared
with the broader community through the resulting Bulletin – this document. Since expanding the Bulletin
distribution, we have received numerous letters of thanks and several requests to see if it could be forwarded
on to stakeholder’s employees, which of course it can. This further illustrates the value of this meeting.

IATA provides the forum; however, this event is created by airlines for airlines and your active participation is
key. If you have never attended an IRM, I encourage you to do so. If you have attended but have never
presented, I encourage you to do that as well. Everyone has a safety story to tell, and we all benefit by hearing
them.

A Message from the IATA Safety Group Chair

Rick Howell ~ General Manager Group Safety and Operational Risk Management, Cathay Pacific

It is my final privilege to write this introduction to the Issue Review Meeting (IRM)
Bulletin, before I step down as Chair of the IATA SG after several years. I hope you will
agree that the IRM remains an extremely useful forum that your respective airlines can
participate in to improve safety management. It does this by providing the mechanism
for airlines to have open and honest discussions around the challenges we face and
take learnings from accidents, hazards and near misses, in order to prevent serious
incidents and ultimately accidents and fatalities. We also met at a time when the world
was facing an extremely difficult time dealing with the tragic loss of 2 B737 MAX
aircraft, which also illustrated the point that we can never be complacent and there is
always something new to learn.

We have also reached a time in aviation, where the projected growth rates in the industry are so high that we
are in a situation for the first time where could see a reduction in the actual number of fatal accidents, yet the
rate could actually go up. Traditional Safety Management has served us and continues to serve us well (Safety
I). However, we also now need to look at things differently. So, I was extremely pleased when we had a robust
discussion on Safety II, where we also learn from what goes right, rather than simply focusing on what goes
wrong. We have all talked about introducing proactive and predictive safety measures for years – well now we
have something concrete to consider further and I hope these discussions will continue in Luxembourg next
month.

2
A Message from the IATA Hazard Identification Technical
Group (HITG) Chair
Shannon Masters ~ Manager, Air Safety Investigations, Delta Air Lines

As I reflect on the events in the last 12 months, I am reminded that our roles
as safety professionals are critical to operations safety. Safety programs
have evolved from reactive to more preventative programs. These
preventative programs led to enhanced technology, which in turn can lead to
predictive safety programs.

The incorporation of Safety Management System (SMS) and good data

collection and analytics allows us to holistically look at our operation and
identify areas of improvement that weren’t visible before. However, for the
SMS process to work, we must have trust in the system. Just culture and non-
punitive safety programs require the front-line employee/operator, management, and oversight groups must
have open honest communication and trust that the process will be respected.

This year, the industry has been tested on this philosophy. Is it important for the end user to understand every
aspect of the system? Does self-auditing allow for too much bias in the process? I cannot answer these
questions, but I can look at my company’s programs and assess their effectivity.

As an industry, we must collectively integrate our SMS processes and begin to look at hazards, processes, and
mitigations across the globe. As a single operator you can influence your silo, but as a community we can
change the industry. A true predictive safety system requires us to collaborate, share, and guide rule makers,
manufactures, operators, and end users towards a safer industry.

3
 TABLE OF CONTENTS

INTRODUCTION ..........................................................................................................................................................................5

IRM 26 Presentation Summary..............................................................................................................................................5

1. UPDATE FROM THE ACCIDENT CLASSIFICATION TECHNICAL GROUP (ACTG) .............................. 6
2. TCAS RA ISSUES AT DENVER INTERNATIONAL AIRPORT (KDEN) ......................................................... 8
3. ICAO REGIONAL AVIATION SAFETY GROUP – PAN AMERICA (RASG-PA) ....................................... 11
4. BRAZILIAN COMMERCIAL AVIATION SAFETY TEAM (BCAST) .............................................................. 13
5. A319 – GENERATOR ELECTRICAL SHORT CIRCUIT .................................................................................. 15
6. B787-8 – BOTH ENGINE SEIZURE DURING LANDING ROLLOUT .......................................................... 16
7. B737-8 – FLIGHT PATH AND SPEED DEVIATION ........................................................................................ 17
8. A318 – GPWS WARNING DURING LIFUS......................................................................................................... 19
9. B737-900 – LOCALISER DEVIATION ................................................................................................................ 20
10. GNSS JAMMING – AIRBUS PERSPECTIVE ..................................................................................................... 21
11. UNDESIRED TAKE-OFF OPERATION ................................................................................................................ 24
12. SAFETY-I TO SAFETY-II ......................................................................................................................................... 25

NEXT IRM MEETINGS ............................................................................................................................................................. 27

 
 
 
 
 
 
 
 

4
 

INTRODUCTION
This year’s 26th biannual IATA Issue Review Meeting (IRM), the IATA Safety Group (SG) and the IATA Hazard
Identification Task Group (HITG) meetings, were held in Sao Paulo, Brazil from March 13th to 14th,2019, and
hosted by GOL Airlines.

The presentations were shared and conducted under the Chatham House rule for the purpose of identifying
and sharing of industry specific hazards.

 
 
 
The IRM continues to evolve in an open, constructive and valuable way. This can only take place with the
active participation of industry stakeholders like you.

IRM 26 Presentation Summary

Please note the following:
 Lessons learned / comments are remarks by the IRM Chair, Vice-Chair or the Presenter
 Hazard Details are identified hazards and further information as per HITG analysis
 Not all presentations are summarised

5
1. UPDATE FROM THE ACCIDENT CLASSIFICATION TECHNICAL GROUP (ACTG)

The ACTG is a sub-group to the Safety Group (SG) and is comprised of representatives from operators and
manufacturers, which ensures that a variety of accident and incident aspects are covered. The group analyses
accidents, identifies contributing factors, determines trends and areas of concern relating to operational
safety and develops prevention strategies. The group uses the IATA Accident Database, which covers all
commercial aviation accidents worldwide that meet IATA accident inclusion guidelines since 2005.

It assists in the preparation of the annual IATA Safety Report, which provides the industry with critical
information derived from the analysis of aviation accidents to understand safety risks in the industry and
propose mitigation strategies. The report contains essential insight into global and regional accident
rates and contributing factors, key trends and statistics on accidents by category and region,
revention strategies as applicable to major accidents contributing factors, and It is made available to
the industry for free distribution.

Some of the top key points discussed in the January 2019 meeting were:

 Incorrect surface line-ups, which will be added to the safety report

 Unnecessary weather penetration, which will be highlighted in the report since it was a top contributing
factor in 2018 accidents
 Language factors since it has been proven that the language barrier is one of the major contributing
factors in incorrect runway line-up incidents
 In flight decision making

The IATA Safety Report 2018 can be downloaded through the following link:

6
https://libraryonline.erau.edu/online-full-text/iata-safety-reports/IATA-Safety-Report-2018.pdf

 
 
   

7
2. TCAS RA ISSUES AT DENVER INTERNATIONAL AIRPORT (KDEN)
 
KDEN was designed for efficiency and operates with segregated arrivals and departures to and from parallel
runways. With winds from the south the airport uses parallel arrivals to runways 16L and 16R, with departures
conducted from runways 17L and 17R. This ‘south mode’ configuration is designed to minimise taxi times for
both arriving and departing aircraft and results in a unidirectional flow on the ground. During the ‘north mode’
configuration, the airport uses parallel arrivals to runways 35L and 35R with departures conducted from
runways 34L and 34R.

Questions
Confidential & Privileged

The separation between runways 16L and

16R is shorter than the separation SMS Monthly Safety Data Analysis Working Group
between runways 35L and 35R and a high
number of TCAS RA events occur during TCAS RA on Arrival – KDEN for 36 months

approaches when the airport operates in

the ‘south mode’ configuration.

Contributing factors to these events are

the close proximity of the approach fixes
where the aircraft turn final, the high
aerodrome elevation leading to higher 36% Increase Over Pre
vious 3 Years

ground speeds, different ATC controllers

for runways 16L and 16R and TCAS
software logic. 14

8
 The high frequency of TCAS
onsets have resulted in flight
crews disregarding the TCAS
RAs, and it was deemed
necessary to investigate the
root causes of the TCAS RAs
since it appeared that flight
crews might have been
conditioned to disregard the
TCAS RA commands.

During the investigation, it

was determined that the
majority of the events occur
between positions KIKME and
LEETS on approach to runway
16L and between MERYN and
JETSN on approach to runway
16R, which is the area where
the parallel approaches
merge.

9
The findings determined that an arriving aircraft experiencing a TCAS RA:

 Is three times as likely to have an unstabilised approach, and

 10 times as likely to go-around

It was also determined that 38% of the carriers flying into KDEN operate in TA/RA mode and 62% operate in
TA only mode and that this TCAS mixed mode may exacerbate the risk of a potential loss of separation,
particularly when overshooting the turns to final.

A contributing factor is the TCAS Sensitivity Level (SL) logic, which changes to a lower SL (SL3) at 2,350 feet
AAL. However, during most arrivals to KDEN when the ‘south mode’ is operational the SL is still at a higher level
(SL5) as flights are at a higher altitude.

32

TCAS Sensitivity Level at DEN

DEN 16R elevation = 5326’ MSL
SL3
DEN 16L elevation = 5357’ MSL

KIKME elevation ~ 8000’ MSL SL5

LEETS elevation ~ 7000’ MSL

16R 16L

5000’ - 10000’ 1000’- 2350’ AGL TCAS SL2

MSL TCAS SL 3
DEN Runway 16L
5357’ MSL TDZE 2,600’
TCAS SL 5
Terrain North of DEN
LEETS 7000’ MSL
KIKME 8000’ MSL
TCAS SL3 begins when Radio
Altitude = 2350’ AGL (7707’MSL)

10
At other airports in the US, which operate with simultaneous parallel approaches the mergers occur at lower
altitudes when the TCAS sensitivity level is already reduced, thus preventing reoccurring spurious TCAS RAs.
The SL issue will be resolved with a future upgrade of the TCAS system.

Potential mitigation strategies evaluated include changes to:

 Approach altitudes
 Merger points
 Distance between aircraft

Potential industry mitigation strategies include:

 Evolutional changes to TCAS logic

 Rebalancing arrivals when the ‘south mode configuration’ is in effect
 Introduction of offset RNAV Visual procedures
 Staggered arrivals on simultaneous visual approaches
 Standardisation of TCAS procedures across all carriers operating into KDEN

3. ICAO REGIONAL AVIATION SAFETY GROUP – PAN AMERICA (RASG-PA)

  
The RASG-PA was established in 2008, the first regional aviation safety group to be established. It serves as
the focal point to coordinate all regional efforts and programmes aimed at mitigating safety risks and support
the implementation of the ICAO Global Aviation Safety Plan (GASP).

 
The group is comprised of representatives from the industry operators and regulators, including aircraft
manufacturers. Its mission is to reduce the fatality risk in commercial aviation by ensuring prioritisation,

11
coordination and implementation of data. It drives safety enhancement initiatives in the Pan American Region
through the active involvement of all civil aviation stakeholders.

Safety Enhancement Initiatives (SEIs) have been developed together with Detailed Implementation Plans (DIPs)
for the top accident categories in the PA region, which are:

 Runway Excursion (RE)

 Controlled Flight Into Terrain (CFIT)
 Loss of Control-Inflight (LOC-I)
 Mid-Air Collision (MAC)

The work of the group contributed to the reduction in the yearly hull loss rate in the LATAM7CAR region from
9.7 in 2007 to 0.4 in 2017.

The current objective is to reduce the fatality rate by 50% by 2020, using 2010 as the benchmark. To achieve
this, the group analyses data, identifies hotspots and discuss with local operators and stakeholders in order to
issue recommendations that are achievable. Some of these recommended safety enhancements include:

 Landing training with a focus on stable approaches, flare and touchdown

 Training for Rejected Take-Off (RTO) decision making
 Changes to ATC procedures. As an example, Aruba was identified by the data as the airport where most
unstable approaches occurred. Pilots were aware about the issue as ATC always vectored the flights
above the optimal profile. RASG-PA discussed this with the local ATC and Aruba is now number 15 on
the unstable approach ranking.
 Runway Overrun Awareness and Alerting Systems development and implementation

The presentation concluded by stating that collaboration is the key to improve safety even further.
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

12
4. BRAZILIAN COMMERCIAL AVIATION SAFETY TEAM (BCAST)
BCAST is a committee composed of representatives from civil aviation service providers and other
organisations that have the capacity to propose and promote improvements in commercial aviation safety.
The committee counts on professionals dedicated to improving safety in Brazilian civil aviation.

BCAST tries to find the main causes and contributing factors to events as well as finding problem areas at
airports. The close working relationship and open interaction fostered by BCAST between operators and the
regulatory authorities has resulted inidentified issues being resolved resolutely. BCAST looked at the IATA
accident review for the region and selected four focus areas:

 Runway Excursion (RE)

 Controlled Flight Into Terrain (CFIT)
 Loss of Control-Inflight (LOC-I)
 Mid-Air Collision (MAC)

13
Safety Enhancements (SE) are distributed to the relevant stakeholders after identified issues are analysed and
solutions discussed. One example of the work was the finding that chart updates were not being issued in a
timely manner by the state. This issue was discussed with the state authorities during BCAST meetings and
solutions were worked out.

Examples of other issues analysed by BCAST are:

 TCAS RA events at Sao Paulo terminal area. The number of events was reduced following discussions
with DECA (ATC), which resulted in changes of the traffic flow in the terminal area.

 CFIT hotspots around Santos Dummond airport (SADU) following several GPWS warnings due to the
environmental conditions with terrain in close proximity to the airport. Unstable approaches and go-
arounds due to helicopter traffic were also discussed. A contributing factor mentioned was that many
approaches were manually flown visual approaches. An RNAV PNP approach was developed for the
carriers who were able to fly such type of approach and currently an RNAV Visual approach is being
developed. The discussions with the state authorities will pave the way for more RNAV visual
approaches to be developed for other airports within the country.

 A 10-year review of runway excursions was conducted and its was determined that the main cause was
long landings. Brazil has a number of airports with short runways being serviced by regional and
domestic operators. It was determined that a contributing factor was that runways have two different
types of runway Touch Down Zone (TDZ) markings, one for runways with less than 2,400 metres and
one for runway with more than 2,400 metres in length, which pilots were unaware of. From the data
analysed, only 43% of the flights landed within the correct TDZ. An awareness campaign for pilots was
launched by BCAST and a bulletin issued for operators.

 Loss of Control Inflight (LOC-I) during go-arounds was also identified and an SE was issued. However,
research has revealed that the go-around SE was the least implemented SE by operators despite being
considered second in ease of implementation.

BCAST is considered a good model on how to drive changes; share information and work together with the
authorities and IATA would like to promote similar groups. Having the authorities forming part of the CAST
helps to put pressure on ICAO for global changes.

 
 
 
 
 
 
 

14
5. A319 – GENERATOR ELECTRICAL SHORT CIRCUIT
 
The presenting airline analysed two events following reported failures of Generator one (GEN1) on two
separate Airbus 319 aircraft. The first report was an engineering non-compliance report following GEN1
troubleshooting, and the second report was an in-flight report filed by the pilots. Initially there was nothing
linking the two events. However, throughout the investigationit it was revealed that a screw holding the
generator cable assembly had come in contact with the feeder cables to GEN1 in both events. This resulted in
the deterioration of the insulation, which ultimately led to a short circuit. It was further revealed that the root
cause was non-compliance to procedures by maintenance personnel, which resulted in the wrong screw being
used. Airbus stated that it was not the first time this issue had manifested itself and that a solution is under
study to improve the cable routing. One remedial action performed by the airline was to shift the generator
harness position to avoid cable contact if the long screw is incorrectly used.
 
 
 

The safety department of the airline determined that one potential risk was that the electrical system could
have reverted to the emergency electrical power level if the aircraft had been dispatched with GEN2
inoperative. From the period analysed, out of 200,000 sectors 10 flights were dispatched with GEN2
inoperative.

The Airbus fleet of the airline is being inspected for the integrity of the feeder insulation, and so far two aircraft
have been found with the first layer of insulation damaged. As a remedial action, the airline does not permit
dispatch with GEN2 inoperative.

After the presentation, the discussion focused on what to do when events are initially low risk graded. Following
the first event it was thought it was only a single mistake by one person. The first report assisted in the
identification and follow-up of the second event.

Maintenance standards are one of the top priorities for the IATA SG, which is working with the engineering
safety group. Culture problems are ingrained in the engineering departments of the industry, especially the on-
time departure mentality that might drive engineers to short cut procedures.

Lessons Learned / Comments

 Humility needed even after 30 years of operation
 Maintenance errors are among the top safety issues
 Importance of reporting culture and record keeping

15
6. B787-8 – BOTH ENGINE SEIZURE DURING LANDING ROLLOUT
 
A Boeing B787-8 suffered a simultaneous dual engine failure during landing. Immediately after touchdown, the
thrust reverse levers were set to full reverse and then returned to reverse idle. After deploying the thrust
reversers after touchdown the pilots noticed that both Rolls-Royce Trent 1000 engines had shut down. The
aircraft came to a complete stop on the runway after 2,447 metres with no directional control due to the loss
of the main electrical power. The APU was subsequently started and the aircraft was towed to stand.

During the internal investigation it was determined that the cause was the malfunction of the Thrust Control
Malfunction Accommodation (TCMA) function, which is installed on high thrust Boeing twin-engine aircraft. The
function forcibly closes the fuel shutoff valve in case the engine outputs excessive thrust against the thrust
commanded by the thrust lever, in order to avoid asymmetric thrust and assist in directional control on the
ground. TCMA is only activate on the ground and operates in the following situations:

 Engine thrust increases excessively beyond command

 Engine thrust does not decrease despite a command for forward (or reverse) idle thrust

TCMA will not activate during normal operation, but it may be activated under the following circumstances:

 When the TCMA is armed it monitors reverse thrust lever position and actual thrust during reverse
operation
 It is activated when the actual N1 value exceeds the maximum N1 threshold set by the position of the
reverse lever
 It will not be activated so long as actual thrust follows thrust lever position. However, if the lever is
returned to idle reverse immediately after selecting full reverse, actual thrust momentarily keeps
increasing to follow the initial thrust lever position of full reverse
 At this moment, TCMA could be armed if commanded thrust temporarily falls below actual thrust due
to the time lag between the commanded and actual thrust, which activates the TCMA

It was noted that although the description of TCMA is published in the AOM, there is no explanation of how the
system should be treated during reverse thrust operations. The discovered issue was known since 2016 from
a previous event, but the recommendations and preventative measures were not implemented until the event
occurred again. The preventive defences introduced include the following mitigations:

 During the landing roll, reverse levers should not be moved from reverse idle to full reverse and then
back to idle in a short time
 Also, crews must verify ‘Speed brake Lever Up’ to ensure that the main landing gears are grounded
before operating the reverse levers.

A software modification to prevent inadvertent operation of the TCMA is being provided during 2019.

16
Lessons Learned / Comments
 Check your fleet to see if the B787/B777 has TCMA/TCMP features 

 During the landing roll, do not move the reverse levers from reverse idle to full reverse and then back to reverse 
idle in a short time 

 Make  sure  to  check  ‘Speed  brake  Lever  Up’  to  ensure  that  the  main  landing  gears  are  on  the  ground  before 
operating the reverse levers 
 

7. B737-8 – FLIGHT PATH AND SPEED DEVIATION

A Boeing B737-8 experienced a non-

intentional lateral path and speed
deviations after take-off. To avoid
convective weather, a deviation to the left
of the SID track was requested by the Pilot
Monitoring (PM). Simultaneously the Pilot
Flying (PF) selected HDG SEL and released
the flight controls, believing that the
autopilot was engaged. Shortly after, an
EGPWS BANK ANGLE warning activated.
Approximately five minutes after take-off,
the autopilot was engaged after several
attempts.

The internal investigation revealed that:

 The AFDS was correctly configured for take-off

 Both the PF and PM believed the autopilot was engaged after take-off
 The aircraft flew more than one minute with no flight control inputs
 The only manual flight control input from the PF occurred after the EGPWS warning
 Both pilots focused on the automation problem instead of flying the aircraft at a critical phase of flight
 Two similar events had previously occurred at the airline with manual intervention taking place only after
EGPWS warnings

The root cause to the autopilot failure to engage is unknown, however the following causes may be considered:

 A control wheel force was still applied when the autopilot was commanded on
 The STAB TRIM AUTOPILOT cut-out switch was not at NORMAL
 There may have been a malfunction in the control wheel pressure logic when the autopilot was
commanded on
 The autopilot was commanded on with insufficient switch pressure applied

17
Lessons Learned / Comments
The lesson learned from the incident is that monitoring is an essential defence against equipment failure and/or
pilot error. However, due to the very nature of Human Factors, monitoring is a barrier that can easily fail. In a
critical and complex phase of flight, a human error or system failure may easily be overlooked.

An analysis of the IATA Accident Database dashboard indicates that runway/taxiway excursions seem to be
the biggest issue to resolve when it comes to preventing aircraft accidents with fatalities.

However, runway/taxiway excursions only contribute to 3% of all fatalities, to be compared with Loss of Control
Inflight (LOC-I), which contribute to 61% of all fatalities.

18
8. A318 – GPWS WARNING DURING LIFUS
 
During a LIFUS training flight with the first officer as Pilot Flying (PF), an EGPWS PULL UP alert activated. The
flight crew was following a STAR to the destination and inadvertently descended to 13,980ft QNH (1,500ft RA)
over the surrounding mountains in a sector where the MEA is 17,000ft. The flight crew conducted an avoidance
manoeuvre and climbed back to 20,640ft QNH. The flight subsequently continued to a normal landing.

The investigation revealed that the following root causes led to the event:
 The flight crew omitted their PF and PM duties as established by the airline when the instructor was
correcting an FMGC error that previously had been entered by the trainee. This generated a fixation on
the FMGC, which resulted in both pilots being heads down when the aircraft was descending.
 Lack of cross-cockpit communication when Open Descent mode was selected without pilot awareness
 Company failure to provide sufficient guidelines to instructors. No guidelines existed which clearly
defined the scope and details about what an instructor may or may not do during a training flight
 Company failure to enforce standardisation meetings involving flight training
 

 
 
The subsequent Annex 13 investigation revealed that company procedures did not include guidance to
trainers when to stop providing training and when to revert to their normal roles as PF or PM. Training standards
meetings were not being attended, as trainers were not being rostered for them. In addition, the airline did not
generally share events with the pilots due to a fear factor that events could be distributed to media. However,
this event was published to the pilots since promotion is part of the SMS. It was also found that the airline had
developed a tolerance towards GPWS warnings at what was considered special airports.

Safety Performance Indicators (SPIs) for GPWS were introduced, and to avoid complacency no more GPWS
warnings at special airports are tolerated. After the event, the GPWS became a NO GO item for dispatch since
it is the last engineered safety barrier. New operational limitations for instructors were introduced to limit the
maximum amount of training flight hours, and standardisation meetings were scheduled.

19
9. B737-900 – LOCALISER DEVIATION
 
During an ILS PRM approach, the first officer who was PF disengaged the autopilot in visual conditions shortly
after passing the FAP. At approximately 1,000 feet AGL the aircraft entered instrument conditions and deviated
to the left at approach minimums, and a go-around was flown since the flight crew did not visually acquire the
runway. ATC issued instructions for the go-around and advised the flight crew that the aircraft appeared to
have been aligned with a parallel taxiway.

The Annex 13 and internal investigations revealed that the autopilot was disengaged at approximately 1,140ft
AGL and that the autothrottle was disengaged at approximately 520ft AGL. A left roll began at 500ft AGL and
reached a maximum bank angle of 19.3 degrees. The go-around was initiated by the application of TOGA thrust
at 124 feet RA. At the time of the go-around, the aircraft had deviated approximately 2.5 dots to the left of the
localiser course and was aligned with a taxiway, which was occupied by another aircraft. The minimum altitude
attained was 50ft RA. Seven and a half seconds after selecting TOGA, the thrust was manually increased to
80% N1.

The findings from the investigation concluded that the flight crew conducted an approach briefing but did not
discuss the usage of the autopilot or autothrottle, which were required for this approach since the visibility was
below 4,000ft RVR. With the autothrottle disengaged, the thrust did not automatically advance during the go-
around beyond the flight crew’s initial thrust setting of approximately 80% N1. The flight crew failed to identify
the low thrust setting and did not increase thrust until 20 seconds after the TOGA selection.

Recommendations following the investigation:

 Review of the go-around procedure for all fleets and consideration of revising the procedures to include
‐ Adding an action and verification to set a go-around pitch attitude
‐ Adding an action and verification to set go-around thrust
 Review and update flight crew training programs to
‐ Place emphasis and create simulator scenarios that require and evaluate go-around decision
making using real world examples
‐ Place an emphasis on instructors not announcing go-arounds during training, allowing for startle
 Evaluate the role and duties of the PM during approaches with an emphasis on expectations during
unstable approaches

20
Lessons Learned / Comments
 Despite training, unanticipated go-arounds continue to be a hazard
 Ensure go-around procedures include basic pitch and power verification and callouts
 Emphasize the role of the PM during training
 Annex 13 agencies continue to exercise their authority and expect air carriers to not know their rights
and the rules of the process

10. GNSS JAMMING – AIRBUS PERSPECTIVE

 
For many years, the availability and faultless function of GNSS has been taken for granted. Jamming (intentional
interference targeting the unavailability of the system) as well as spoofing (faking of a false position/time
towards a target GNSS receiver) was of no concern for nearly all users except the military. However, recent
events involving jamming and spoofing have started a gradual shift from this view.

Due to the inherently low power of GNSS signals (approx. -130 dBm received signal power on earth), the GNSS
bands are dominated by white Gaussian noise. The noise is about a hundred to a few thousand times stronger
than the GNSS signals. As a consequence, GNSS signals are extremely susceptible to all types of interference.
These interferences can be unintentional, e.g. the harmonics of certain oscillators that translate into single or
multi-tones in the GNSS spectrum, co-operation in bands with radio amateurs, co-operation with distance
measurements equipment (DME) near airports, etc. However, there are also more and more intentional
interferers readily available on the Component-off-the-self (COTS) market, mostly sold over the Internet, even
though their use is illegal in most countries. Whereas jammers are used for denial-of-service attacks, spoofers
pose an even bigger threat, since they can intentionally cause a receiver to estimate a fake position.

 
 

21
Jamming is the act of intentionally directing electromagnetic energy towards a communication and navigation
system to disrupt or prevent signal transmission. A jammer attack can be categorized as a denial of service –
the GNSS is still available but its broadcast signals are totally exceeded by the jammer power. In crisis
situations, the military or governments are authorised to intentionally jam civilian signals. The objective is to
restrict the positioning service to military users only in order to weaken a potential enemy's tactical
possibilities. Over the last few years’ commercial jammers, so-called Personal or Privacy Protection Devices
(PPDs) have become increasingly popular. These PPD devices can be bought over the internet starting from
30 Euros for a plain car cigarette lighter powered jammer to very sophisticated GPS jammers with external
antenna connectors and configurable operation modes for over several hundred Euros.

Spoofing is a deliberate transmission of fake GNSS signals with the intention of fooling a GNSS receiver into
providing false Position, Velocity and Time (PVT) information. The goal of spoofing is to force a GNSS receiver
to track the spoofed signal, or deceptive signals, with the objective to provide or at least to induce a wrong
position solution.

South Korea is considering turning away from GNSS and back to eLoran for maritime navigation due to heavy
GPS jamming from North Korea. It is reported that within 16 days of jamming from North Korean forces, over
1.000 airplanes and over 250 ships experienced GPS disruption.

RFI can be either intentional or unintentional. Intentional jamming

22
Interaction of GNSS RFI effects on aircraft architecture:
 Impact on MMR
 Impact on displays and ECAM
 Effects on navigation, surveillance and communication systems

Operational considerations
 
 During flight preparation:
‐ Review and consider NOTAMS related to known or expected GNSS RFI
‐ If NOTAM related GNSS RFI review non-GNSS based routes and approaches (ILS, VOR, DME)

 During Flight Phase

‐ Detected by systems which indicate loss of capability
‐ Indication provided on ECAM displays or Navigation Displays, such as NAV/GPS POS Disagree and
GPS PRIMARY LOST. Under GNSS RFI, the aircraft can use alternate on-board alternate navigation
means: IRS/DME/VOR/ILS
‐ Follow existing FCOM Normal or Abnormal/Emergency procedures as required
‐ No need to specifically deselect the GNSS
‐ If ADS-B OUT required, then notify ATC due to loss of GNSS signal

 Post Flight
‐ Report possible GNSS interference and associated cockpit effects

23
Maintenance Recommendations

1. Transient symptoms when overflying known GNSS RFI area

‐ Perform systems test of affected systems
‐ If tests pass – No further action. If test fails – Perform TMS task

2. Transient symptoms in an area not known for GNSS RFI

‐ Analysis required to confirm if aircraft level issue, GNSS constellation anomaly or GNSS RFI
‐ Report the information to Airbus
‐ Report suspected interference to regional (ANSP) and international organisations (e.g. EVAIR)

3. Other Symptoms observed during GNSS RFI exposure

‐ Other failures potentially linked to GNSS but require additional analysis
‐ E.g. GNSS losses not recovered during flight; spurious TAWS, ADS-B erroneous position
‐ Provide additional troubleshooting data to understand the issue

Airbus continues to work with the industry and is conducting research of new tecnologies and solutions. In the
mean time, they request all airlines to continue to report GNSS jamming events. The also stressed that during
Jamming, the aircraft can still safely fly, navigate and communicate.

11. UNDESIRED TAKE-OFF OPERATION

The presentation and discussion on undesired take-off operations was based on two scenarios. In the first
scenario, the flight crew didn’t set the take-off flaps, which resulted in a configuration warning when the thrust
levers were advanced. The take-off was continued after the take-off flaps were selected on the runway. The
second scenario involved an aborted take-off at a very low speed for weather ahead, or for any reason.

The primary preventive barrier in scenario one was the take-off configuration warning, which stopped the take-
off from being continued in the wrong take-off configuration. The presenter stated that the airline SOP requires
the flight crew to abort the take-off and to vacate the runway for evaluation in such a case. In the second
scenario, the critical barrier was the re-evaluation of the take-off conditions at the point where the aircraft
came to a full stop, remaining runway distance etc.

The importance of vacating the runway for re-evaluation of the take-off performance and conditions was
emphasised.

 
 
 
 
 
 
 
 

24
12. SAFETY-I TO SAFETY-II
 
Safety-I can be regarded as the absence of
accidents and incidents or as an acceptable level of
risk. According to this viewpoint, things go wrong
due to technical, human and organisational causes.
Humans are regarded as predominantly as a liability
or as a hazard. Accident investigations try to
determine the causes and contributing factors
involved in an accident, and risk assessments try to
determine the likelihood of the accident happening.
Both approaches try to eliminate the causes of an
accident or to improve preventive barriers.

However, this view does not explain why human performance practically always goes right. The reason for this
can be attributed to the fact that people adjust their performance to the conditions they are facing. The
challenge is to understand how things usually go right, which safety management has paid little attention to.

Safety-II moves away from the viewpoint that as few things as possible should go wrong to ensuring that as
many things as possible should go right. In this perspective, humans are regarded as a resource necessary for
system flexibility and resilience. Accident investigations conducted under this viewpoint changes to an
understanding of how things usually go right to be able to explain how things sometimes go wrong.

25
To move towards Safety-II, organisations should:

 Start seeing people as a solution

 Develop methods that help you gain a better understanding of normal work
 Make learning the main purpose of your investigation
 See safety management as a way of improving work, not just avoiding harm
 Measure safety by its presence rather than its absence

Lessons Learned / Comments

 Safety is the presence of positive capacities that help us to succeed under varying conditions
 The flexibility of people is critical for adapting to the varying conditions of work
 Improve safety by understanding why things go right most of the time – understand normal work

---- END ----

26
NEXT IRM MEETINGS
IRM 27 will be held September 10-11, 2019 in Luxembourg, hosted
by Cargolux.

To register via the IRM SharePoint website you will first need to sign up here for access to the site
https://extranet.iata.org/Registration/pages/GetEmailPage.aspx?siteUrl=hitf.

This is a one-time registration and will provide you on-going access to the IRM Share Point site. You will receive
confirmation within 48 hours, which will allow you to sign into the IRM SharePoint website
https://extranet2.iata.org/sites/hitf/default.aspx.

This is where you can access meeting information and self-register for upcoming meetings.

For more information on the IRM, please contact the IRM team at irm-safety@iata.org.

27