This is my final report for AT 573 Managing the Risk of Organizational Accidents at Purdue University West Lafayette, IN. Update April 15, 2011.

1. Accident Safety Analysis:Crash of Flight 3407 Revised 04/07/2011 By Chris Homko Orange Vest Aviation & Industry Safety and Risk Management www.todays-consulting.com

2. Disclaimer The opinions represented by this report do not reflect in any way the opinions or position, official or otherwise presented by Colgan Air, the National Transportation Safety Board, the Federal Aviation Administration or any other organization involved in the official investigation of the accident of Colgan Air flight 3407. The reader is so advised that this report is speculative in nature and the author did not consult with, be compensated by, or otherwise ask for or receive any official opinions or review by any investigating parties, the relatives of accident victims, or any stakeholder in this accident.

3. Factual Information

4. Introduction Date: February 19, 2009 Time: About 22:17 EDT Aircraft: Bombardier Dash 8 Q400 N200WQ Crash Location: 6038 Long Street, Clarence Center, NY Phase of flight: Approach to landing runway 23 BUF Passengers: 45 Crew: 4 Route of Flight: EWR to BUF Severity: 50 Fatalities (one on the ground)

5. NTSB Factual Cause Report The National Transportation Safety Board determines the probable cause(s) of this accident as follows: The captain’s inappropriate response to the activation of the stick shaker, which led to an aerodynamic stall from which the airplane did not recover. Contributing to the accident were (1) the flight crew/*o20s (sic) failure to monitor airspeed in relation to the rising position of the low-speed cue, (2) the flight crew failure to adhere to sterile cockpit procedures, (3) the captain’s failure to effectively manage the flight, and (4) Colgan Air’s inadequate procedures for airspeed selection and management during approaches in icing conditions.

6. Weather 02/12/09 22:15:31 5-MIN KBUF 130315Z 25014KT 3SM -SN BR FEW011 OVC021 01/M01 A2980 840 92 -600 260/14 RMK AO2 P0001 Basically visual meterological night conditions as defined by part 91 of the Federal Aviation Regulations (FAR’s).

7. N200WQ: Bombardier Dash 8 Q400 Kryst, M. (2008, December 20). 1453895. Retrieved April 26, 2010, from Airliners.net: http://www.airliners.net/photo/Continental-Connection-%28Colgan/De-Havilland-Canada/1453895/L/&sid=fc5022aaff7e7d1b8c07d71781f30f68

8. Cockpit Voice Recorder Timeline 21:18: 3407 departs EWR 21:35: 3407 reaches cruise altitude of 16,000 21:52: Captain confuses FO about runway 23 at Buffalo NY 21:55: 3407 asked by CLE Center to squawk 2762 confusing FO 21:56: FO mentions shallow descent might be easier on her ears 21:57: 3407 asked to cross BENEE at 11,000 22:00: FO responds incorrectly to Center request to switch frequencies intended for Mesaba 3045

9. Timeline (continued) 22:03: 3407 switched to BUF approach and reaches 12,000 descending to 11,000 22:04: 3407 cleared to TRAVA intersection 22:04: Captain starts approach brief without handing over the controls to the FO 22:05: 3407 cleared to descend to 6,000 – Captain selects 1,000 FPM descent 22:07: FO yawns then contacts BUF operations for in range call 22:07: BUF ops advises another Colgan aircraft on gate, confusion occurs about later flight arriving before them

10. Timeline (continued) 22:08: 3407 cleared to descend to 5,000, FO makes cabin announcement 22:09: 3407 cleared to descend to 4,000 – Captain asks how FO’s ears are doing and she responds “stuffy but popping” 22:10: FO asks about ice on windshield – Captain responds that is the “most ice I have seen on the leading edges in a long time” – irrelevant conversation started by FO about ice experience 22:11: 3407 descends through 5,000 for 4,000 22:12: 3407 cleared to descend to 2,300 and heading of 230

11. Timeline (continued) 22:13: Conversation about ice continues, 3407 descends through 3,300 for 2,300 22:13: Captain asks for the descent checklist then the approach checklist – Vref speeds not verbally mentioned – irrelevant conversation continues 22:14: 3407 cleared to fly heading of 310 22:15: Captain asks for “Flaps 5” and FO responds “what? Oh *” then selects flaps 5 22:15: 3407 cleared for the ILS 23 approach 3 miles from KLUMP intersection, fly heading 260 2,300 until established 22:16:04: Captain sees localizer alive asks for gear down

12. Timeline (continued) 22:16:06: 3407 asked to contact BUF tower, FO responds 22:16:14: Flight Attendant intercom double chime heard 22:16:23: Captain asks for flaps 15 22:16:27: Sound of stick shaker (for 7 seconds) and autopilot disconnect horn (continues to end of recording) 22:16:35: Sound of stick shaker (continues to end of recording) 22:16:37: FO says she put the flaps up 22:16:45: FO asks if the gear should come up – Captain responds “gear up” 22:16:53: End of the recording

13. Crash Site 3: Wreckage Diagram

14. Crash Site 1: 6038 Long Street

15. Crash Site 2: 6038 Long Street

16. Accident Analysis

17. Analysis Tool Used Need for a “macro” analysis: Human Factors Analysis and Classification System (HFACS) Developed by Douglas A. Weigmann and Scott A. Shappell between the years of 1997-2001 HFACS is an attempt at “defining the holes” of James Reason’s famous swiss cheese model (Weigmann, Shappell, 2003) “…developed and refined by analyzing hundreds of accident reports containing thousands of human causal factors” (Weigmann, Shappell, p. 50).

18. HFACS Overview Diagram Weigmann, D. A., & Shappell, S. A. (2003). A Human Error Approach to Aviation Accident Analysis. Burlington, Vermont, United States of America: Ashgate.

24. HFACS Analysis: Frequency of Factors Unsafe supervision, inadequate supervision with 8 factors Add new category “Outside Influences” with 7 factors Preconditions for unsafe acts, environmental factors, technological environment with 6 factors Unsafe acts of operators, errors, skill based errors and decision errors each with 5 factors Unsafe acts of operators, violations, exceptional with 5 factors Organizational influence, organizational climate with 4 factors Preconditions for unsafe acts, condition of operators, adverse mental state with 3 factors Preconditions for unsafe acts, personnel factors, crew resource management and personal readiness each with 3 factors

25. HFACS Root Branch Analysis Overview of each HFACS root branch Group root braches by common problems A few key factors from each group will be discussed

26. Internal and External Oversight:Unsafe Supervision and Outside Influences FAA: lack of trained and qualified personnel to handle oversight of the recent rapid growth of Colgan Airlines in 2007-2008 Flight crew of flight 3407 was presented with a situation that they clearly were not trained for (a stall warning with autopilot disconnect) Crew had exceeded a 14 hour duty day and were approaching 16 hour maximum (15:17)

27. About “Soft” Defenses Reason however states the following about written policies and procedures: “Over time, these additions to the ‘rule book’ become increasingly restrictive, often reducing the range of permitted actions to far less than those necessary to get the job done” (Reason, p. 49) “…one of the effects of continually tightening up safe working practices is to increase the likelihood of violations being permitted” (Reason, p. 51) “Most experienced workers know approximately where the ‘edge’ between safety and disaster lies and do not exceed it, except in extreme circumstances. What they do not always appreciate, however, is where they currently are in relation to that edge” (Reason, p. 51)

28. About “Soft” Defenses “…sometimes totally novel situations arise in which people have to improvise a suitable course of action on the basis of knowledge-based processing (lack of clearly defined policy/procedure). When the individuals are both highly skilled and highly experienced (like Captain Al Haynes), there seems to be a 50:50 chance of coming up with the right answers. Mostly, however, the odds are much lower” (Reason, pp. 80-81)

29. Economic Factors: Organizational Influences “…people will be tempted to take short-cuts whenever such opportunities present themselves…conflicts between production and protection pressures tend to be resolved in favour (sic) of the former – at least until a bad accident occurs” (Reason, pp. 48-49) A look at the Colgan Organizational chart (next page) on the day of the accident reveals some of these decisions

30. Economic Factors: Organizational Influences – Colgan Org. Chart

31. Economic Factors: Organizational Influences - continued Understaffing of the Line Operations Safety Audit (LOSA) program Flight Operational Quality Assurance (FOQA) program had been approved for use by the FAA in October 2008, but had not become active yet by February 2009 when the accident occurred

32. Preconditions for Unsafe Acts:Environmental Factors: Physical Environment Icing played some role - at 22:10 EST when the First Officer commented about ice buildup on the windshield – ice usually does not build on heated windshields unless the rate of accumulation is heavy or severe Q400 had been manufactured with a hydraulically powered elevator and was therefore not susceptible to an icing induced tail-plane stall – crew was unaware of this fact.

33. Preconditions for Unsafe Acts:Environmental Factors: Physical Environment Propeller aircraft slipstream effect on wing leading edge icing – note that ice on the left (yellow) extends beyond the black deicing boot due to the corkscrew wind pattern. This causes an asymmetric ice accumulation which can lead to a rolling stall due to differences in loss of wing lift Source: The Real Reason Behind Regional TurboProp Icing Accidents. (2010, April 26). Retrieved April 27, 2010, from International Aviation Safety Association: http://www.iasa.com.au/folders/Safety_Issues/FAA_Inaction/Continental_Flt3407.htm

34. Preconditions for Unsafe Acts: Environmental Factors: Technological Environment Increase Reference Speeds Switch in the Q400 allowed setting of Vref speeds below calculated stall speeds Display of “[INC REF SPEEDS]” was on the Engine Display (ED) not the Primary Flight Displays (PFD) No visual low airspeed warning (yellow or amber) on speed tape No aural stall warning Lack of simulator fidelity (flight model realism) to practice full stalls and upsets

35. Clumsy Automation and Errors Earl Weiner, an aviation psychologist at the University of Miami coined “Clumsy Automation”: “…flight management systems designed to ease the pilot’s mental burden tend to be most enigmatic and attention-demanding during periods of maximum workload” (Reason, pp. 44-45) “…failure of perception:…either the user makes a wrong assessment of the active mode at a particular time…. ..failure of attention:…or the user fails to notice transitions in mode status” (Reason, p. 46) Crew of flight 3407 made a perception error most likely due to the effects of fatigue

36. Preconditions for Unsafe Acts: Environmental Factors: Technological Environment – Increase Reference Speed Switch Location Source: Riis Anderson, K. (2001, August 19). 0184647. Retrieved April 26, 2010, from Airliners.net: http://www.airliners.net/photo/Scandinavian-Commuter--/De-Havilland-Canada/0184647/L/&sid=0c275ca8edf212c1d9eb3ceb38987ee0

37. Preconditions for Unsafe Acts: Environmental Factors: Technological Environment – Increase Reference Speed Display Location Source: NTSB. (2009). Operations Group Factual Report. NTSB. Washington DC: NTSB. P. 18.

38. Preconditions for Unsafe Acts: Environmental Factors: Condition of Operators and Personnel Factors Aero-medical and Crew Resource Management related factors First Officer showed indications on CVR of a head cold Fatigue brought on by sleep deprivation – each flight crewmember may have gotten 6 hours of useful sleep or less It is well known that the physiological effects of fatigue due to sleep loss are similar to the effects of alcohol (Williamson, Feyer, Mattick, Friswell, & Finley-Brown, 2001)

39. Preconditions for Unsafe Acts:Unsafe Acts (NTSB factual cause factors are included here) Errors of perception experienced by the crew were undoubtedly caused by the lack of aircraft icing flight characteristics and fatigue Flight crew errors and violations of company policy and Federal Aviation Regulations (FAR’s) such as sleeping in the Newark crew room and violations of “sterile cockpit and crew rest requirements The breakdown in CRM, leadership, and lack of procedural guidance about sterile cockpit were all contributing factors

40. Latent Conditions Reason recognized that in the last 20 years “people working in complex systems make errors or violate procedures for reasons that generally go beyond the scope of individual psychology” (Reason, p. 10) All too often we classify the accidents as simple “pilot error” “these inequities create quality, reliability or safety problems elsewhere in the system that may present at a later point in time” (Reason, p. 11)

41. Latent Conditions:Reason’s Four Points “First the quality of both production and protection is dependent upon the same underlying organizational processes. Safety is not a separate issue” (Reason, p. 36). “Second, we cannot prevent latent conditions from being seeded into the system since they are an inevitable product of strategic decisions” (Reason, p. 36). “Errors and violations committed by those at the sharp end are common enough in organizational accidents, but they are neither necessary nor sufficient causes” (Reason, p. 36). “Latent conditions…are always present in complex systems” (Reason, p. 36)

42. Recommendations Company policy: Revise company policies on deadheading, crew rest and sterile cockpit to exceed FAR 121 – no flight crew travel permitted 12 hours before report time and no use of electronic devices, newspapers and magazines while on the flight deck. Safety programs: Immediately implement the FOQA program and train sufficient staff for the LOSA program.

43. Recommendations -Continued Staffing: Realign the chief pilots reflect divisions of aircraft type not region and hire additional temporary help for the chief pilot as needed. Technological factors: work with Bombardier to change software to add a low speed warning to the speed tape, an aural stall warning, move the display of “Ice Detected” and “[Inc Ref Speed]” to the pilot’s flight displays and disallow setting of Vref speeds below the calculated stall speeds.

44. Recommendations -Continued Fatigue management: create a fatigue management system out of current fatigue reporting system. Add the requirement for a fatigue self risk management test form that scores a crewmembers fatigue level and advises a go/no go limit as a start. Train crews and dispatchers on the dangers of fatigue. Training: Include stick pusher and upset training in simulator curriculum as well as aircraft specific icing flight characteristics. Pilot records: keep paper records until electronic record keeping system is updated to include sufficient information of crews.

45. Recommendations -Continued SOP’s: Revise to include Vref speed setting procedure for icing conditions, speeds, configurations and recommended power settings for all phases of flight and proper use of Increase Reference speed switch. FAA oversight: Revise company policy on autopilot use in icing and educate crews on icing reporting levels to include definition of “heavy” icing. Risk Management: Perform a Management Oversight and Risk Tree (MORT) to identify other factors

46. Conclusion Identified factors cannot and should not be classified as blatant violations that broke the law. Indeed, it was clearly the actions of the flight crew personnel involved that made these latent factors line up like the links in a chain as identified by the NTSB direct causal factors James Reason however also makes the point that accident investigators are always blessed with 20/20 hindsight

47. Conclusion continued Although this case was labeled as “pilot error”, Reason states that “Outcome Knowledge” is an important factor to consider in determining the intention(s) of those on the sharp end whom the accident was experienced first-hand. “…some prior indication of a disaster is only truly a warning if you know what kind of disaster you will suffer…many accidents are impossible accidents – at least from the prospective of those involved…there was always something else more pressing” (Reason, p. 39)

48. Conclusion continued The accident of flight 3407 in the eyes of the crew was an “impossible accident”. From the evidence of the Cockpit Voice Recorder (CVR) and the Flight Data Recorder (FDR) tapes, they did not seem to fully understand exactly what was occurring. They perished thinking they did nothing wrong. Questions remain: Why did the Flight Attendant call the flight deck at 2:16:14 EST, seconds before the autopilot disconnected? Were they about to report a problem with the aircraft? We may never know. Sadly, we do know that the flight crew’s fatigue combined with all the identified latent conditions which impaired them from recognizing and correcting the real situation: A wing stall which was possibly brought on by icing conditions that became aggravated and unrecoverable by crew reactions to their incorrectly perceived situation.

49. Works Cited Babcock, C. (2010). Cockpit Voice Recorder Group Chairman Factual Report. NTSB. Washington DC: NTSB. Kryst, M. (2008, December 20). 1453895. Retrieved April 26, 2010, from Airliners.net: http://www.airliners.net/photo/Continental-Connection-%28Colgan/De-Havilland-Canada/1453895/L/&sid=fc5022aaff7e7d1b8c07d71781f30f68 NTSB. (2010). Brief of Accident Colgan Air 3407. NTSB. NTSB. NTSB. (2010). Factual Report Aviation Colgan Air 3407. NTSB. NTSB. NTSB. (2009). Operations Group Factual Report. NTSB. Washington DC: NTSB. NTSB. (2009). Structures Group Factual Report. NTSB. Washington DC: NTSB. NTSB. (2009). Weather Group Chairman Factual Report. NTSB. Washington DC: NTSB.

50. Works Cited (continued) NTSB. (2009). Wreckage Diagram. NTSB. Washington DC: NTSB. Reason, J. (1997). Managing the Risks of Organizational Accidents. Hants, England: Ashgate Publishing Limited. Riis Anderson, K. (2001, August 19). 0184647. Retrieved April 26, 2010, from Airliners.net: http://www.airliners.net/photo/Scandinavian-Commuter--/De-Havilland-Canada/0184647/L/&sid=0c275ca8edf212c1d9eb3ceb38987ee0 The Real Reason Behind Regional TurboProp Icing Accidents. (2010, April 26). Retrieved April 27, 2010, from International Aviation Safety Association: http://www.iasa.com.au/folders/Safety_Issues/FAA_Inaction/Continental_Flt3407.htm Weigmann, D. A., & Shappell, S. A. (2003). A Human Error Approach to Aviation Accident Analysis. Burlington, Vermont, United States of America: Ashgate. Williamson, A. M., Feyer, A.-M., Mattick, R. P., Friswell, R., & Finley-Brown, S. (2001). Developing measures of fatigue using an alcohol comparison to validate the effects of fatigue on performance. Accident Analysis and Prevention (33), 313-326.