2. 4 th European STAMP Workshop, Zurich, SwitzerlandSeptember, 2016

3. Overview CH-53 helicopter brief 1977 and 1997 accidents overviews Israel Air Force (IAF)’s accident analysis model CAST analysis hazards and safety constraints IAFs’ safety control structure Examples of CAST analysis findings Conclusions Kanarit Baktare, 4 th European STAMP Workshop © 2

4. CH-53 helicopter brief CH-53 Sea Stallion manufacturer by the Sikorsky Aircraft Company (SAC) is one of the most reliable utility helicopters ever to exist. In service in the IAF since 1969. Old Israeli models CH-53A and CH-53D are about to be obsolete in the rest of the world. US NAVY operates the E model, which is a different aircraft comparing to the Israeli model in terms of the majority of its dynamic and electronic systems 3 Kanarit Baktare, 4 th European STAMP Workshop ©

5. 1977 CH-53 accident overview May, 10 th 1977, IAF CH-53 Tail Number (TN) 360 took off for a planned formation flying training (of three doubles) at night near the Jordan Valley 360 was grounded due to a technical malfunction and took off later than the rest 5 aircrafts (as a single) At height of 300 [ft], and speed of 80 [knots], aircraft 360 crashed into a mountainside, near Jericho 54 soldiers and staff were killed Crash site 4 Kanarit Baktare, 4 th European STAMP Workshop ©

6. 1997 CH-53 accident overview February 3 rd, 1997, an IAF CH-53s operational transport mission of IDF soldiers to their posts in Lebanon was aborted due to weather conditions. February 4 th, 1997, a formation flying of two IAF CH- 53’s TN 903 and 357 was executing the mission, took off from Mahanayim airport heading to Lebanon. 8 minutes after departure, TN 903 main rotor hit TN 357 tail rotor. Both helicopters crashed. 73 soldiers were killed. 5 Kanarit Baktare, 4 th European STAMP Workshop ©

7. 1977 CH-53 Mishap Investigation Commission all main findings 1.PILOT ERROR of flying the aircraft in low altitude with sight limits 2.Squadron commander misjudgment of allocating TN 360 with it technical history 3.Wrong debrief – “fly in the lowest altitude possible” 4.No formal operation definition or paper 5.No training flight limits protocol – sight vs. altitude tradeoff for example 6.Wrong datum point mark on map 7.No updated engine performances graphs 6 Kanarit Baktare, 4 th European STAMP Workshop ©

8. 1997 CH-53 Governmental Mishap Investigation Commission partial main findings 1.TN 903 PILOT ERROR - lack of visual contact on 357 2.Both pilots had no qualification for leading a formation flying 3.Night vision device limited angle is a contributing factor to the accident by limiting the pilot’s field of view and significantly restricting sight coverage. 4.Both aircrafts’ take-off-weights have breached the maximum limit 5.No CVR (Cockpit Voice Recorder) or black box were available to fully understand the accident circumstances 6.Behavioral analysis – no signs of competition were found between the pilots 7.No evidence for technical malfunctions was found 7 Kanarit Baktare, 4 th European STAMP Workshop ©

9. 1997 CH-53 NASA lab simulation of the last minute before the accident 903 357 1 minute before the accident 903 357 50 sec before the accident 903 357 30 sec before the accident 903 357 15 sec before the accident 8 Kanarit Baktare, 4 th European STAMP Workshop ©

10. 9

11. Hazards and Safety Constraints Safety constraintsHazards SC1: both helicopters must not violate safe separation between each other (either on flight path or height) H1: Helicopters can lose safe separation between them SC2: both helicopters must not violate safe separation from terrain H2: Helicopter (one or both) can lose safe separation from terrain SC3: flight regimes must be in accordance with helicopter’s manufacturer limits (in terms of velocity, maneuvers, and allowable carriage weights definitions H3: Helicopter (one or both) can enter to an uncontrolled maneuver into the ground SC4: verbal communication and coordination must exist during flight time in order to keep formation SC5: crew assignments must be in accordance with the single pilot training, qualification and health state H4: Helicopter (one or both) can lose formation flying 10 Kanarit Baktare, 4 th European STAMP Workshop ©

12. Safety Control Structure – Development and Operations Kanarit Baktare © 11

13. Safety Control Structure – management level Kanarit Baktare © 12

14. Safety Control Structure – 1997 physical level Kanarit Baktare © 13

15. 1997 CAST main findings -”Heritage Devices” H1: Helicopters can lose safe distance between them H3: Helicopter can get to an uncontrolled manuver into the ground Three options: Pilots were not aware to an inherent limit of the night sight device from the squadron management Apparently, pilots never complained about the 40 degrees limited field of view- (WHY?) Pilots complained, but no action was taken (by the squadron leadership or headquarters personnel) 14 Kanarit Baktare, 4 th European STAMP Workshop ©

16. Kanarit Baktare © “Mission comes above safety” context Squadron leaderships encouraged the pilots to fly at low altitude regardless of whether there were suitable environment conditions (and there were not in the case of the 1977 accident). No defined training procedures for low altitude flights Squadron personnel didn’t report TN 360 technical history to the IAF operation division 1977 CAST findings – Training and allocations H2: Helicopter can lose safe distance from terrain H3: Helicopter can get to an uncontrolled maneuver into the ground 15

17. 1997 accident CAST findings Training and allocations flaws H4: Helicopter can lose formation flying No evidence of formation flying training protocol was mentioned or investigated If there was a protocol: - Was it up to date and clear? -Were all squadron pilots familiar with the procedure? -Did it define the flying limits to keep the safety constraints? -Did it define the pilot’s training procedure? -Did it take into consideration the manufacturer limits? Other operator’s definitions? 16 Kanarit Baktare, 4 th European STAMP Workshop ©

18. If there was no protocol: -How does the IAF define a formation flying leader? -Was the need for such a protocol raised by the squadron to the air directorate? 1997 accident CAST findings / Cont. Training and allocations flaws H4: Helicopter can lose formation flying 17 Kanarit Baktare, 4 th European STAMP Workshop ©

19. 1997 CAST findings – Training and allocations flaws H1: Helicopters can lose safe distance between them H2: Helicopter can lose safe distance from terrain Mutual light inspection training: No evidence of training protocol for such inspection was mentioned or investigated training was not provided by the squadron management, has not been done by the crew, or both 18 Kanarit Baktare, 4 th European STAMP Workshop ©

20. 1977 CAST findings – crew exchange H2: Helicopter can lose safe distance from terrain H3: Helicopter can get to an uncontrolled manuver into the ground During on-site treatment of the intermediate gearbox chip malfunction on TN 360, a crew exchange was taking place. Many questions have not been asked or answered on MIC’s report: Was the crew exchange approved by the squadron leadership? Was it even reported? Did the new crew participate on mission debrief? Did the new crew have a formation flying leader qualification? 19 Kanarit Baktare, 4 th European STAMP Workshop ©

21. All 5 other aircrafts pilots’ mission maps pointed the flight plans to a datum points at north direction after departure, while TN 360 actual take off direction was to the south-east Was the air traffic control tower/unit updated with the mission’s details? If yes, why there was no warning sent to the aircraft? If not, why? 1977 CAST findings – Flight direction H2: Helicopter can lose safe distance from terrain H3: Helicopter can get to an uncontrolled maneuver into the ground 20 Kanarit Baktare, 4 th European STAMP Workshop ©

22. Did the pilot contact the tower for location update? If not, why? No protocol for preparation of flight accessories -Who approved the map’s datum point? 1977 CAST findings – Flight direction / Cont. H2: Helicopter can lose safe distance from terrain H3: Helicopter can get to an uncontrolled maneuver into the ground 21 Kanarit Baktare, 4 th European STAMP Workshop ©

23. Kanarit Baktare © Comparison between some CAST findings and MICs’ report conclusions MIC’S REPORTCRUCIAL CAST FINDINGS No reference(1977 accident) Flight direction and contact between the crew and the air traffic controls Contributing factor, no specific insights(1997 accident) Night vision device as a heritage mission device and questions raised (especially with regard to the limited field of view created by the night vision device) The 1997 report presented the issue as a misjudgment of the squadron leadership, no training protocol and questions were raised. Conclusions regarding the differences in training between jet crews and helicopters crews. (both accidents) Improper training and qualifications (e.g. formation flying) No reference, no behavioral analysis of flight crews, no reference to safety protocols/trainings (both accidents) systemic ”Mission above safety” context 22

24. Safety Culture - Mission oriented behavior context- “mission comes above safety” Basic non-routine procedures are missing (e.g. formation flying definitions and qualification procedures) The structure of IAFs’ air directorate and material directorate as an “Achilles’s hill”: Possess too many spans of control Contains too many feedback loops IAF’s risk analysis and assessments are not suitable to non-routine flight regimes Active communication between the IAF and the Israeli Aviation Authority is needed Systematic and systemic hazards in IAF between both accidents period of time 23 Kanarit Baktare, 4 th European STAMP Workshop ©

25. Using STAMP model and CAST analysis revealed more profound and systematic weaknesses of the IAF hierarchical structure Most of the findings showed lack of communication between the hierarchical levels and/or lack of needed feedback Formation flying matter – was never discussed After the 1997 accident, the air structure directorate was declared as a weakness point and was divided into two different authorities for a long term training agenda. The IAF separated training authorities between fighter jets and helicopters due to the large difference between their missions and training protocols Analysis General Conclusions 24 Kanarit Baktare, 4 th European STAMP Workshop ©

26. 25