Holes in the Swiss Cheese

In 1990, James T Reason, a British psychologist, put forward a model of human systems and the means by which these systems could break down, causing an accident. Often referred to as the Swiss cheese accident causation model, Reason explains that in a given human system, aviation related or otherwise, an accident is usually caused, not by one catastrophic failure, but rather by a series of failures within the system itself. Like the holes in Swiss cheese, the flaws in the different levels of the system, by themselves, typically would not lead to an accident. Bring about the circumstances which would allow the holes in a system to align though, and the possibility of an accident occurring greatly increases. Reason defines the four layers which contribute to an accident within a system as being; Organizational influences, unsafe supervision, preconditions for unsafe acts, and the unsafe acts themselves.

Looking at the crash of Colgan Flight 3407 through the perspective of Reasons model, it no longer becomes just a simple case of pilot error, but rather an intricate failure of the entire system itself. In this particular case, there were numerous holes in the cheese which were all contributing causes. Some likely existed for quite some time prior to the accident itself; small insidious flaws which by themselves were not enough to overcome the redundancies of the system, but together, they created an opportunity for an accident to occur.

Shortly after 10:00 pm, the Crew of Colgan 3407, initiated a descent from their cruising altitude of 16'000 feet to their cleared altitude of 11'000. The exact time at which this descent was initiated is unclear as the crew did not call that they were leaving 16'000 feet for 11'000 as would be expected in a multi-crew cockpit, nor did they run through the descent checklist, which under normal circumstances would have been completed prior to descent. At this stage in the flight, Captain Renslow and First Officer Shaw are talking about their past flying experiences. Renslow spoke of an air traffic controller which he dealt with in Texas whose demeanour and sense of humour were in stark contrast to the controllers who worked the more congested, complex airspace of the north east. The conversation that continued as the crew conducted their descent into the Buffalo area was not unlike conversations between crews on any other given flight. It was not so much the conversation itself, but rather the time and place in which that conversation took place that posed a problem.

Many companies have standard operating procedures that prohibit non flight related conversation below 10'000 feet allowing the flight crew to focus their attention on the operation of the aircraft during the periods of time in which their work loads tend to be the highest; during the departure and approach. On the arrival in to the airport area, the In Range or approach checklist, which is completed upon descending through 10'000 feet, typically signals the point at which conversations are put on hold and the crew's collective attention is turned to the business of flying an aircraft. While being a seemingly benign slip in procedure, in continuing their conversation below 10'000 feet, Captain Renslow and First Officer Shaw increased the possibility of becoming distracted during the approach that was to follow. While keeping up a conversation below 10'000 feet was against Colgan's standard operating procedures, and did increase the risk of distraction at a point in the flight where even small distractions could prove deadly, one would be hard pressed to find a pilot who has not experienced a violation of a sterile cockpit below 10'000 feet at some point. Some pilots will politely point at the altimeter, or simply stop talking altogether as the aircraft descends through 10'000 feet, reminding a talkative crew member that it is time to put the conversation away until they are on the ground. Others may allow the conversation to continue unimpeded not wanting to offend, or cut a good story short.

Given the number of times that the crew of Colgan 3407 yawned during the flight to Buffalo, one could quite safely guess that they were, at least to some degree, tired. Both had been up early that morning and due to a cancelled trip had spent the day in the crew room prior to their flight to Buffalo. While to an outsider it may seem as though remaining in a crew room for the better part of the day prior to departing for Buffalo would have allowed both Shaw and Renslow to get some rest in preparation for their flight that evening, Colgan lacked facilities which would have allowed the crew to get a restful sleep, in addition to the fact that sleeping in the crew lounge was prohibited. Shaw had commuted across the country, from Seattle to Newark, the day prior to her getting into the front right seat of flight 3407, which likely would have only added to her fatigue. Add on top of that a departure time of 9:18 in the evening, a point in the day when most peoples bodies and minds begin to spool down for the night, and it becomes easier to imagine how the crew may have been feeling that evening. While the regulations do make it clear that a pilot is responsible for removing themselves from duty if they suspect that fatigue will impair their ability to act as part of the flight crew, the reality is that at some companies calling in tired results not only in annoyed dispatchers, but also in the potential for disciplinary action.

I have experienced times in the past where accepting a flight, or series of flights becomes a call of common sense as much as a call of regulation. On a last minute call out this February past for a flight to Vancouver, our dispatcher asked whether we would be able to take another trip that had come up upon arriving back into Edmonton. With our planned arrival time of 1:30 am back into the city we could have accepted the second trip while still remaining within our 14 hour duty day although after already having been up since 8:00 am the previous day, we would have been fooling only ourselves if we were to believe that fatigue would have not been an issue had we decided to take the second flight. Ultimately we agreed that it only made sense to decline the flight as the only place we would be fit to be heading after arriving home to Edmonton was bed.

In addition to the long day that Shaw had already endured at the time of departure, she was also fighting a head cold which the crew discuss briefly during the descent into the Buffalo area. Much like the case of fatigue, pilots are required to remove themselves from duty if illness will adversely impact their performance while at work. At the time of the Flight 3407 crash, Colgan had a system in place in which it would take a newly hired first officer 9 months to accumulate a sufficient amount of sick time to cover a 4 day trip. The alternative of calling in sick and missing a few days pay, which although would not affect most people adversely, would have a proportionally sizable impact on Shaw's already low salary of $16,200 a year.

Given the details that are emerging in the Colgan Flight 3407 hearings, it would easy to simply shift a good deal of the blame from the pilots to the company itself. While many of the practices at Colgan seem to be unjustifiably flawed, and the pay disproportionally low, if accidents such as these are to be prevented in the future there are many changes that must take place not just in the way we as pilots make decisions or in the way that Colgan is managed, but in the way that the regional airline industry as a whole is operated. Until the time that those changes are made, it will remain the responsibility of the pilots to maintain their discipline in and outside of the cockpit, and when required, stand up for the safety of the crew, the flight and it's passengers, however difficult, financially and professionally that may sometimes be.

Two Perspectives of The Regionals

Colgan 3407

48 Seconds. A span of time this short could easily get lost in the minutes and hours of a normal flight. Enough time to complete about half of a landing checklist, fly 3/4 of a leg in a hold, or on occasion for a flight to proceed from normal to unrecoverable. In the latter situation, what would normally be otherwise insignificant moments in time become turning points where decisions made define the outcome of a flight, good or bad. Such was the case with Colgan Flight 3407.

At 22:16 and 4 seconds, the crew of Colgan Flight 3407 were turning to intercept the localizer for the ILS approach into Buffalo, while at the same time lowering the landing gear. The flight up to this point was proceeding, in most respects, quite normally. At 22:16 and 52 seconds the end of the CVR recording is marked by a scream from First Officer Rebecca Shaw immediately prior to the flights impact with a house underlying the approach path. These 48 seconds have been highly scrutinised since the recovery of the CVR and FDR from the wreckage of 3407, and will likely continue to be. While 22:16:04 marks the point at which the sequence of events began to deviate from what would be a normal flight, it was during the previous 30 minutes which preceded those fateful 48 seconds that the stage was set for the accident that would follow.

At 21:52:57 the crew picked up the ATIS for Buffalo which called the visibility at 3 miles in snow and mist, with the winds 250 degrees 15 knots gusting to 23. At 21:57:10 the flight is cleared to descend to 11'000. At the turn of the hour, the conversation in the cockpit turns to the crews' experiences with controllers and the past flying experiences of the Shaw while she was based out of the midwest. Neither crew member calls leaving their cruising altitude of 16'000, although at 22:03:41 a sound similar to the altitude alerter is picked up by the cockpit area microphone which could indicate that the aircraft was approaching their cleared altitude of 11'000.

At 22:04:12 Captain Marvin Renslow spends 38 seconds on a partial approach brief for the ILS to Runway 23 into Buffalo. Shortly afterward the flight is cleared to descend to 6000 by Buffalo Approach while the crew discusses an operating procedure used in the flying the Saab, one of the other aircraft types operated by Colgan. At 22:05:29 Captain Renslow finishes the approach brief started a minute earlier. At 22:08:41 the flight is cleared down to 5000, followed by a clearance down to 4000 36 seconds later at 22:09:15. Upon being cleared to 4000, the captain questions the first officer about how her ears were doing to which she replied they were "stuffy".

At 22:09:35 the crew makes mention of ice build-up which is starting to show on the windshield. With this discovery of the ice accumulation the first officer makes mention of her lack of exposure to icing conditions while flying out of Phoenix and that she is grateful for a winters worth of experience as a first officer prior to getting upgraded to captain on the Saab. At 22:12:17 the flight is cleared down to 2300, and shortly afterward is given a heading of 330 Degrees to fly for vectors for the ILS Runway 23. At 22:13:24 the Captain calls for the descent checklist, approximately 10 minutes after the crew had commenced the descent. 10 Seconds later the captain also calls for the approach checklist. In the period immediately before and after the descent and approach checklists are called for and for most of the remainder of the flight, the conversation is centered around the first officers inexperience with flight in icing conditions. At 22:15:06 the Captain calls for and the First Officer sets flaps 5. The flight is then given a heading of 260 degrees by Buffalo Approach to intercept the localizer for the ILS Runway 23. At 22:15:59 the cockpit microphone picked up a sound similar to a decrease in engine power and 17 seconds later the captain called the localizer alive and for gear down. At 22:16:14 the first officer confirmed the landing gear was down, after which the captain called for flaps 15 to be set and the landing checks. At 22:16:27 the sound of the stick shaker, which warns of an impending stall, activates.

Look at the Flight Data recorder information for the same period of time, and it becomes quickly clear what was happening behind the scenes that the CVR only hints to. At 22:16:00 Captain Renslow reduces the power to flight idle to slow for the approach. He then calls "gear down, loc's alive", and in response to this First Officer Shaw lowers the landing gear and moves the condition levers to their maximum position which gave a prop rpm of 1020. The action of both extending the gear and bringing the condition levers forward, while being a normal procedure, introduces a considerable amount of drag from the gear entering the airflow and the props moving to a fine pitch. These two actions, coupled with the engines being at flight idle, allowed the airspeed to decrease from 170 to 149 knots over the course of the next 10 seconds.
When Captain Renslow calls for "Flaps 15, before landing checklist." First Officer Shaw pauses for a few seconds, and when she does move the flap handle, positions it at Flaps 10 instead of the called for Flaps 15. Immediately after selecting Flaps 10, First Officer Shaw utters "uhhhh"
which may have been in response to the decaying airspeed which was decreasing through 130 knots at that point. At 22:16:27, the moment at which the stick shaker activated, the airspeed was at 126 knots and the flaps were moving through 6.7 degrees. The activation of the stick shaker disconnected the autopilot, which had been on up until that point in the approach.

The cockpit would have not been a place of calm and quiet at this stage in the flight. The stick shaker would have been aggressively shaking the controls to warn of an impending stall, while the autopilot disconnect horn blared in the background. Amid the chaos of the cockpit warnings, the crew exchanged no words, no acknowledgement of the stick shaker or the autopilot disconnect, nothing but silence for the next 10 seconds.

In response to the activation of the stick shaker, Captain Renslow almost immediately applies nearly 30 lbs of back pressure to the controls and brings the power levers forward to about 80% power. The action of applying back pressure on the controls resulted in the aircraft pitching up to around 30 degrees nose up, and with the applied increase in power the aircraft began to turn left, a normal tendency of prop driven aircraft. By the top of its short lived climb which peaked at 2600, the aircraft was banked 45 degrees to the left.
Shortly there afterward, the stick pusher, which is a last defense safety mechanism designed to help prevent a stall, begins to apply forward pressure to the controls. The Captain counters this with a 40 pound application of back pressure. At this point in time the airspeed is fluctuating around 100 knots and the angle of attack 23 degrees. The aircraft then begins to simultaneously pitch down and roll rapidly to the right, rolling from a left bank through wings level to a 110 degree bank to the right in the matter of seconds. "Jesus Christ" is all Captain Renslow responds with. As the aircraft was rolling right, First Officer Shaw, without being prompted to do so, selects Flaps Up, which she announces to Renslow shortly afterward.

Using full left rudder and aileron deflection, Renslow is able to roll the aircraft back to near wings level. For a moment the stick pusher stops and as it does the backpressure increases to 60 lbs. The Stick pusher activates once again, and again the Captain overrides it for the remaining 12 seconds of the flight with backpressure ranging from 80 to 120 lbs of force. As a result of these control inputs, the aircraft rolls rapidly again to around 90 angle of bank to the right and the nose falls to 45 degrees nose down.

First Officer Shaw asks "Should the gear up?"
"Gear up, ..ohh #" Responds Captain Renslow

While the crew did manage to get the angle of bank to around 30 degrees and the nose up to -25 degrees, the aircraft had developed a 10'000 foot per minute rate of descent from which there was little, if any, possibility of recovering. The scream emitted by Shaw at 22:16:52 makes it chillingly clear what would occur next.

Spring Ice

Pausing in position I look out the rain smeared view of the forward windscreen. The visibility off the departure end of the runway appears grim this morning, the city skyline barely visible through the mist. The tower breaks the silence of the cockpit;



- "Air189,. Pilot reports indicate moderate ice from the surface to seven thousand feet on departure, Departure is 119.5 airborne, cleared for takeoff runway 12"



-"Departure 119.5 airborne, cleared takeoff runway 12, check remarks, good morning, Air189"



As the noise increases within the cockpit as the engines begin to spool up, I rest my hand beneath the power levers in preparation for the takeoff



- "Props governing" I call, while I wonder how much ice the clouds ahead have in store for us.



- "Set take-off power" responds the captain



- "Take-off power set, in the green, 80 knots, 100 knots rotate, positive rate", comes the well rehearsed list of calls of a normal take-off



- He replies with a simple- "gear up"



With the landing gear safely stowed in their respective wheel wells I turn my attention to the slowly increasing altimeter, waiting for 400 feet.



-"Top of Second"

-"Flaps up, set climb power, after Take-off Checks" is the laconic reply out of the left seat



-"Departure Good Morning, Air 189 is off of Runway 12 at the City, through 3200' for 7000".

- "Air 189, Morning, left turn direct VIPVA climb and maintain Flight Level 190"

- "Left turn direct VIPVA, maintain Flight Level 190, Air 189"



The ground had long since disappeared into the murk below, and looking out the side window of the cockpit as I complete the after take-off checks, I can only see the dim interior of the overcast layer that is currently sitting over the southern half of the province. A look at the graphical area forecast before departure this morning showed an upper warm front moving in from the south, bringing with it an extensive area of cloud, snow and freezing drizzle. Pilot reports of flights that had already traversed this route earlier in the morning indicated that we would likely find moderate ice in the climb to 19'000 feet. With a near full load of 9 passengers sitting in the back, the aircraft seemed hesitant to climb already, the vertical speed reading akin to what one would expect in the small single engined Cessnas in which I did my training. Climbing north past the unseen northern edge of the city below, an accumulation of ice was beginning to make itself visible on the leading edge of the wing. I turned to look at the windshield wipers, which tend to accumulate ice before any other portion of the aircraft visible from the cockpit, to find a half an inch of ice clinging to their sturdy black frame.

Inflating the de-ice boots dislodged most of the ice from the wing, the airflow prying it from the leading edge and carrying it back over the wing. Glancing at the altimeter as we climb through 8000', I begin to think that unless we find the cloud tops soon, we will stand little chance of climbing the aircraft, and the ice we have acquired, to 19'000.



- "Edmonton Centre, Air 189 is requesting 15'000 for final"

- " Air 189, Edmonton Centre, Maintain 15'000"

- "Maintain 15'000, Air 189"



Climbing through 9'000 feet, the thick veil of grey cloud which has enveloped us since departure begins to lighten. Looking upwards I can begin to see the faint outline of the sun above, I sigh, hopefully the tops are not far off.

We continue the now familiar routine of inflating the boots, watching the ice crack and shed off, followed finally by waiting for more ice to collect to begin the process over again.

Climbing through the last few thousand feet to the tops the ice begins to collect more quickly, like a last chance effort on the part of Mother Nature to prevent us from climbing above the clouds. Moments later, we finally break through the tops into the sun lit world above.

Leveling at 15'000 I pause to think about the conditions we have flown through up to this point in the flight. The ice accumulations we have seen thus far in the flight exceed anything I have seen in my year and a half experience flying IFR in the typically dry air of the western prairies. The ice that is currently sitting out on the unprotected areas of the wings is likely more ice than I have encountered throughout all of the past winter's flights combined.

At the hotel after landing and securing the airplane, I am looking over the transcripts from the Cockpit Voice Recorder and Flight Data Recorder of Colgan Flight 3407 which crashed while on approach into Buffalo New York earlier this year. At the beginning of the approach the First Officer expressed concern over the icing they were experiencing, and her inexperience with dealing with icing conditions in general. While there were many other falling dominos which contributed to the Colgan accident in Buffalo, I could not help but wonder what part ice had played in the larger picture, and given my experience on the northbound flight this morning, what I may have done differently or the same compared to the ill fated crew if I were placed in their shoes. Having the benefit of hindsight and the ability to take ones time to think through the chain of events in which the crew of Colgan 3407 found themselves, it is easy to say that if put in their place, we would have made different decisions, possibly averting disaster. Unfortunately views such as these will only serve to allow the events which led to this accident to perpetuate. If anything useful is to be gained from the decisions and actions of this crew, we all must realize that as pilots that we are no less fallible, no less prone to error than the ill fated crew of Colgan 3407, and that their mistakes of today, if not looked at carefully, could well be our mistakes of tomorrow.