Accident investigation

When something goes badly wrong, the aviation system has one more tool: independent safety investigation. Its purpose is not to find someone to blame but to find out what happened and why, so that it does not happen again. Investigations have produced many of the rules and practices covered in this course, from damage tolerance to crew resource management to wiring inspection. This lesson explains how investigations are organized internationally and in each country, how an investigation proceeds, and how the Petrel 19 program responds to a serious incident in its fourth year of service.

The international framework

ICAO Annex 13, Aircraft Accident and Incident Investigation, sets the international standards. Its central principle is that the sole objective of an investigation is the prevention of future accidents and incidents; it is not the purpose of the investigation to apportion blame or liability. Annex 13 assigns the right and duty to investigate to the state of occurrence, the state in whose territory the event happened. The state of registry, the state of the operator, the state of design and the state of manufacture are entitled to appoint accredited representatives, supported by advisers, usually from the operator and the manufacturers.

Annex 13 also defines the categories of occurrence. An accident involves death or serious injury, substantial damage to the aircraft or the aircraft being missing. A serious incident involves circumstances indicating that an accident nearly occurred, such as a fire in flight, a near collision or multiple system failures. Other incidents are recorded and may be investigated. The state conducting the investigation sends a preliminary report within 30 days, aims to publish the final report within twelve months, and if it cannot, publishes an interim statement on each anniversary.

The Transportation Safety Board of Canada

In Canada, safety investigations are conducted by the Transportation Safety Board of Canada (TSB), established by the Canadian Transportation Accident Investigation and Safety Board Act. The TSB is independent of Transport Canada and reports to Parliament through the President of the King's Privy Council. It investigates occurrences in air, marine, rail and pipeline transportation. Its mandate is to advance safety by investigating occurrences, identifying safety deficiencies, making recommendations and reporting publicly. The Act states explicitly that the TSB does not assign fault or determine civil or criminal liability.

Operators, crews and others must report certain occurrences to the TSB as soon as possible, under the Transportation Safety Board Regulations. Reportable occurrences include accidents and a list of incidents such as engine failures, fires, smoke and decompression. The TSB decides which occurrences to investigate and how deeply, classifying investigations by their expected safety benefit. It makes findings as to causes and contributing factors, findings as to risk and other findings, and issues recommendations, safety advisories and safety information letters. A federal minister who receives a recommendation must respond within 90 days, stating what action will be taken.

How an investigation proceeds

An investigation begins with notification and an initial assessment. For a field investigation, a team deploys to the site to document the wreckage, the scene, the weather and the witness accounts before evidence is lost. Recorders are recovered and sent to the investigating body's laboratory. Wreckage of interest is moved to a secure facility for examination. Interviews are held with crew, maintenance staff, air traffic controllers and others. Records are collected: maintenance, training, operational, design and certification.

The analysis phase asks what happened, then why. Investigators build a sequence of events, then look for the conditions that made each event possible: equipment design, maintenance, procedures, training, supervision, organizational decisions and regulatory oversight. Modern investigations look well beyond the immediate actions of the people involved, because those actions are usually the end of a chain that started much earlier. Models such as the one developed by James Reason, in which defences have holes that occasionally line up, help investigators look systematically for latent conditions.

Draft reports are sent confidentially to those with a direct interest for comment before publication, to correct facts and give them an opportunity to respond. The final report states the findings and the safety actions taken, and makes recommendations where action is still needed. Many safety improvements happen before the report is published, because organizations involved in the investigation act as soon as they understand the problem.

The Petrel 19 serious incident

In the Petrel 19's fourth year, an aircraft operated by Kivalliq Air Link is climbing out with fourteen passengers when the crew receive a battery temperature caution. They follow the checklist, reduce power, and shortly afterwards the power management system shuts down the right propulsion unit because of a high-temperature reading in the associated battery string. The crew declare an emergency and divert to the departure airport, landing without injury. Maintenance staff find that one battery module has vented, with smoke damage inside the compartment but no fire spread beyond it. Under the reporting rules, this is a serious incident, and the TSB launches an investigation.

Borealis Aerospace takes part as the manufacturer and type certificate holder, with Teresa Nakamura as its technical adviser. the FAA participates through an accredited representative because the Petrel 19 is validated in both countries. The recorders are downloaded and the data from the propulsion and battery monitoring system, stored in a crash-protected memory module required by the special conditions, are retrieved. The code below reconstructs the key timeline from the data.

# Reconstructing an incident timeline from recorder data: find when a parameter
# left its normal band and order the events.
data = [  # time s, battery temperature C, motor 2 power kW, crew event
    (0, 31, 650, ''), (20, 32, 655, ''), (40, 34, 660, ''), (60, 39, 640, ''),
    (80, 47, 600, 'BATT TEMP caution'), (100, 55, 420, 'crew reduce power'), (120, 58, 0, 'motor 2 shut down'),
    (140, 56, 0, 'divert decision'), (160, 51, 0, ''), (180, 46, 0, '')]
limit_rate = 0.25   # C per second: abnormal heating rate
events = []
for (t0, T0, *_), (t1, T1, P1, e) in zip(data, data[1:]):
    r = (T1 - T0) / (t1 - t0)
    if r > limit_rate and not any('heating' in x for _, x in events): events.append((t0, f'abnormal heating starts ({r:.2f} C/s)'))
    if e: events.append((t1, e))
peak = max(data, key=lambda d: d[1])
events.append((peak[0], f'peak temperature {peak[1]} C'))
for t, e in sorted(events): print(f"t = {t:3d} s  {e}")
print(f"time from abnormal heating to caution: {[t for t, e in events if 'caution' in e][0] - [t for t, e in events if 'heating' in e][0]} s")

t =  60 s  abnormal heating starts (0.40 C/s)
t =  80 s  BATT TEMP caution
t = 100 s  crew reduce power
t = 120 s  motor 2 shut down
t = 120 s  peak temperature 58 C
t = 140 s  divert decision
time from abnormal heating to caution: 20 s

Abnormal heating starts at 60 seconds into the recorded sequence, at about 0.40 degrees Celsius per second. The caution appears at 80 seconds, 20 seconds after heating began. The crew reduce power at 100 seconds, the power management system shuts down motor 2 at 120 seconds, when the module temperature peaks at 58 degrees Celsius, and the crew decide to divert at 140 seconds. The temperatures in the module as a whole stay well below the levels at which neighbouring cells would enter thermal runaway, which is consistent with the absence of propagation. The design's containment worked.

The investigation then asks why one cell vented. Teardown finds an internal short in a single cell, traced to a microscopic metallic particle introduced during cell manufacture. The cell supplier's contamination controls had been changed when it moved production to a new line, and the change was not reported to Borealis Aerospace, a sub-tier change of the kind Lesson 5 warned about. Analysis of the monitoring data from the fleet shows that two other cells from the same production lot have shown slightly elevated self-discharge, an early sign of internal shorts.

Findings and safety actions

The investigation's findings follow the standard structure. As to causes and contributing factors: a cell contained a metallic particle that caused an internal short and venting; the supplier changed its process without notifying the manufacturer; the manufacturer's supplier control did not detect the change. As to risk: if the cell had been in a module without effective containment, the event could have led to a fire; the caution threshold gave the crew 20 seconds of warning after heating began, which was adequate in this case but might not be for a faster event. Other findings note that the crew's actions were timely and consistent with their training.

Safety actions began within days. Borealis Aerospace issued an alert service bulletin to identify and replace all modules containing cells from the affected lot, and TCCA issued an emergency directive mandating it. The supplier reinstated its contamination controls and agreed to a new requirement to notify Borealis Aerospace of any process change. Borealis Aerospace added a self-discharge screening test to its module acceptance testing and to the maintenance program, using the battery monitoring data already being recorded. the TSB recommended that the authority review supplier change notification requirements for safety-critical electrical energy storage, a recommendation that reaches beyond this one aircraft type.

Investigation and other processes

A safety investigation is not the only process that follows a serious event. The authority may conduct its own inquiry into regulatory compliance, the operator's SMS will conduct an internal investigation, insurers will assess claims, and in rare cases police may investigate possible offences. Annex 13 and national law keep these separate. Safety investigation records such as cockpit voice recordings and witness statements are protected from use for purposes other than safety, to preserve the willingness of people to speak openly to investigators. The protection is not absolute, but courts must weigh the harm to future safety investigations before ordering disclosure.

This separation is essential to the system. Sam Littlechild, who has flown with the crew involved, tells the team that the captain was open with the investigators because she trusted that her account would be used to improve safety. If that trust were broken, the next crew in her situation might be less forthcoming, and the next investigation less effective.

Learning from other people's accidents

Most of what an organization learns from investigations comes from events that happened to someone else. Borealis Aerospace's in-service engineering team reviews published reports from around the world for any finding relevant to its products: battery events on other aircraft and vehicles, wiring fires, propeller failures, and organizational findings such as weak supplier control. Each relevant report is logged as a hazard in the company's SMS and assessed against the Petrel 19. Élise Fournier considers this one of the cheapest forms of safety improvement available: the lesson has already been paid for, and the only cost is reading it.

Investigations also shape certification. The special conditions for the Petrel 19's battery, covered in Lesson 12, draw on investigations of battery events on other aircraft types, which showed that containment and venting must be demonstrated by test, not just argued by analysis. The cycle runs from certification through service, to investigation, and back to the rules for the next design.