After Germanwings - Cagnoli A. - ebook

The Germanwings airline disaster, on 24 March 2015, has shaken the public opinion worldwide, since the pilot deliberately crashed his aircraft full of passengers into the French Alps. Such an event has undermined trust both in the vocational job of pilots, who always do their best to protect human lives, and in the aviation system. An analysis of the Germanwings crash, is the starting point for the authors, who broadened and gained a 360° perspective on life and working conditions of the airline pilots. Their study brings forward some proposal focused on prevention, detection and mitigation of uneasiness phenomena of crew members, to prevent this type of accident from happening again.

Ebooka przeczytasz w aplikacjach Legimi na:

czytnikach certyfikowanych
przez Legimi

Liczba stron: 464

Odsłuch ebooka (TTS) dostepny w abonamencie „ebooki+audiobooki bez limitu” w aplikacjach Legimi na:




Chialastri A., Bartoccini F., Scialanga M., Cagnoli A.

Copyright © IBN Istituto Bibliografico Napoleone 2018

Via dei Marsi, 57-00185 Roma (Italy)

Tel. 06-4469828

Fax. 06-4452275




Original Title of the book


La vita del pilota di linea



Cover graphics: Tiziana Bernardini








Translated by Maura Coppino


For the production of this book the authors only referred to official documents, which are freely accessible by the readers through different information sources. Analyses, research material and considerations exclusively refer to facts specifically under both a scientific and a didactic point of view. There is no identification either with actual persons (living or deceased) or public/private entities associated with the occurred facts.






ISBN: 9788875654160


All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise without the prior permission of the publisher in conformity with the State laws and with the International laws.


















To friends and relatives,

Victims of aviation accidents,

To whom we had to say goodbye too soon.



This collaboration work has been made possible under the following fundamental conditions shared by the authors.

Firstly, there must be a firm human and professional relationship, competence in the respective disciplines, time available and above all total commitment. I feel that all this apply to and can be shared with my colleagues, as it is not easy to reconcile the professional activity with the family management and in between to come about with a project that requires time and dedication.

Therefore, we pat ourselves on the back for our achievement.

Readers and critics will decide whether or not it is to be considered a good job.

Books authors risk to face self-confidence in writing their works, a rereading activity transforms the text into something familiar, so errors and omissions become difficult to be spotted.

So, it is necessary that competent persons careful scrutinize the work, bringing critical areas, weak parts and typing errors to the fore, as they come out from an inexhaustible source.

We owe our thanks to these persons, who have contributed in making this book better.

All of them come from different professional backgrounds, they are pilots, managers, journalists, association members, psychologist, and physicians. Everyone has his/her personal point of view, but everyone is focused on the topic of the book.

It is always difficult to list them, as it may seem to follow a kind of merit list.

Instead, each one has given an essential contribution, so that they will not be mentioned according to their importance, but simply at random, due to a faulty memory that works in an erratic manner.



List of contributors

Andrea Trespidi, is an expert inspired by a culture of justice and a regional foreman for the Rete Ferroviaria Italiana (Italian Rail Network) and an ambassador of “Italylovessicurezza”. He was the first to read the draft and succeeded in firmly grasping the essential points that determine the book structure, which follows the rule of three: what is the problem, what are the causes and which solutions are put forward.


Antonio Bordoni, is the author of a very interesting book on airline accidents, which were caused by the state of health of pilots1. He read the draft with the usual zeal of a journalist who is used to write on topics related to aviation.

His wide experience helped him to identify some points to work on and to elaborate in details.


The Senior Captain Vincenzo Rossitto is a special person: besides his professional expertise he also has the rare gift of knowing how to read texts with meticulousness, identifying incongruities, typing errors or unclear parts. The number and quality of his observations made him almost a co-author of the work. The general reader, not being an aviation expert, owes his/her thanks to him, if many parts, are not more technical than necessary.


Franco Di Antonio, is a senior captain and a human factor expert. In supporting his point of view he backed arguments and suggested modifications about dates and situations cited in the text.


A special thanks is due to Alberto Mazzei, who is an Airbus captain and graduate in medicine. He is particularly interested in the normative aspects related to health. His fundamental contribution on the theme of burn-out and elaboration of the normative at European level, has given a contribution which is not at all secondary in the drawing up of this book.


Captain Giampaolo Meotti, gave his precious suggestions on some aspects of the rules and has helped us to put some assertions into a better context, thanks to his extensive knowledge of both the medical and aeronautical worlds,


Ivan Anzellotti was one of the first enthusiastic readers. We took his opinion in great consideration since in these years he has accrued vast experience as an international pilot, working for several airlines throughout the world. His eccentric point of view compared to the one of those who have only limited experience of organizations, mainly European ones, has helped to put some assertions into context, and not to take for granted that what happens in Europe is also applied elsewhere in the world. Among his most valuable suggestions, there is the one of translating this book in English, as he thinks there is a great need to spread safety concepts that seem to be universally known but which instead are not.


Alessandra Rea, aviation psychologist, contributed by making observations which turned out to be very valuable, prompting the authors to revise some firmly held stances in the psychological field, particularly those aspects linked to the selection of personnel.

At times, few words from a person with vast experience in the sector and an expert eye for picking out the good and weak points of the text are enough to seriously consider to revise whole chapters and ponder on the formulation given.


Tony Licu, is a passionate safety expert, he read the draft giving us important tips concerning the human factor history. He pushed our motivation in deciding to translate the work in English, to allow people all around the word, somehow involved in the aviation industry, to get to know these topics.

Glauco Trebbi,aviation psychologist, member of EEAP (European Association for Aviation Psychology), he meticulously read the book, giving his valuable point of view.

Annamaria Fadda,is apsychologist of ASPAL Sardegna. She read the draft and pointed out some important methodologies under the psychological point of view.

The journalists Francesca Ambrogetti e Andrea Tornielli underlined the peculiarities of all the professions involved in the aviation industry, as sometimes people tend to reduce to routine some jobs which are extremely skilled and challenging.

A special mention is given to Silvia Chaves,the president of Association of Victims of Germanwings Flight 9525. She read the draft even though this might have meant remembering terrible moments. Her commitments and that of all other members of the association are to avoid other similar disasters to happen.

Captain Arturo Radini is actively involved with the Association October 8 2001, thanks to his technical- professional knowledge. He carefully read the draft and invited the authors to trust their project to widen the safety culture among different fields.

The lawyer Felice Cuzzilla,is an expert of the Aviation Law. He read through the draft, to avoid any legal inconveniences.

Everlasting thanks to the publisher, Angelo Napoleone, who, unperturbed, keeps on publishing books on safety, notwithstanding the low interest of public opinion on the topic.


Our most grateful thanks go to all friends, colleagues and experts for trusting our project, believing not only in the success of the book, but also in the importance of taking care over safety, that eventually is the true purpose for this publication.



1 Bordoni A. (2015), Piloti malati, LoGisma editore Roma (II edizione)↩


Desde la Asociaciòn de afectados del vuelo GWI9525 en los Alpes, queremos agradecer a Mayday Italia y en especial a Antonio chialastri, que haya decidido escribir este libro. Estamos convencidos que se necesitan iniciativas corno esta, para concienciar al mundo de la importancia de ehorar los sistemas actuales de seguridad y salud, sobre todo en el caso de enfemedades mentales.

Cuando nos golpeò la tradedia, el dolor se aduenò de nuestras vids y muchos de nosotros creimos morir. El tiempo nos està ayudando a reconstruirnos, a seguir viviendo de forma diferente y sobre todo nos ha ayudado a darnos cuenta que no podemos cruzarnos de brazos. UNIDOS es nuestro lema y el motor que nos llevò a contituir la Asociaciòn. Queremos evitar que otras familias tengan que posar or la terrible situacin vìvid y qyeremos que la sociedad y nuestros gobernantes tomen conciencia de la necesidad de velar por todos. Es evidente que los protocolos de actuaciòn en caso denfermedades mentales han fallado. La sociedad, las leyes y las empresas no estàn preparadas para este tipo de enfermedades y estamos obligados a preteger a la sociedad y a los propios enfermos. Iniciativas corno la publicaciòn de este libro, nos da fuerzas para seguir alzando nuestra voz al mundo, necesitamos y debemos mehorar la seguridad ublica. Evetemos que un Si nuestro corno el de Germanwings, se vuelva a producir.

Gracias Antonio por este excelente trabajo,

Silvia Chaves Presidenta de Asociaciòn de Afectados del vuelo GWI9525 en los Alpes

The book has kept me a breath from the beginning to the end. Once you will start it you will devorate page after page intrigued by the story to be unfolded- it gives the evolution of aviation Human Factors in past 30-40 years through a series of aircraft accidents that changed way how we look at safety in industry. It then dives into emergent issues from Germanwings 9525 accident and phenomenology of modern times, day to day pressures from society, employers, health or family over pilots and how those are impacting their style of life and work.

The authors are not only fine experts of Human factors but also gifted narrators that can translate complex socio-industrial disasters and soft issues like stress, burn-out, suicidal phenomena, resilience etc. and identify and advance solutions. A must read for all professionals of the aviation industry as well as for any non-expert lecturer, I would say any travelling passenger that has an interest in air transport. Hopefully soon available also in English.

Tony Licu Head of Safety Unit within Network Manager Directorate of Eurocontrol

On 29 November 2013 the 49 years old Captain Herminio Fernandes flying over the Namibian territory, deliberately crashed his Embraer 190 into the Bwabwata National Park killing all the 32 people aboard. No one paid attention to such event either in Italy or elsewhere. And yet this would have been exactly what occurred on 24 March 2015 to the Germanwings Airbus on the Alps of Provence. In this case International media immediately reacted. Obviously both the fame of Lufthansa and the amount of passengers that every year fly with it considerably differ from those of the Mozambique Airlines. But it is quite impressive that the International Civil Aviation community did not consider the first tragedy worth of attention as much as the no-specialized press did. The International Civil Aviation Community continuously improved reaching the high standard of safety, learning, wherever and whenever possible, right from previous tragedies reports. The main purpose of aviation investigations is to prevent that similar air crashes happen again. We expect that readers keep in great consideration that there had been several air crashes before the Andreas Lubitz one, where a pilot had a clear intention to crash. Preventive measures should have been adopted upon these disasters, but we are dealing with the puzzling subject of mental desease.

The Germanwings 9525 crashed during the return flight from Barcelona to Düsseldorf and reports confirm the initial analysis of the aircraft’s flight data recorder that during the earlier outbound Flight 9524 from Düsseldorf to Barcelona, Lubitz had practised setting the autopilot altitude dial to 100 feet several times while the captain was momentarily out of the cockpit. This confirms the pilot’s willingness to destroy the aircraft, but showing no signs of behavior alteration during normal operations. If only the captain had noticed something suspicious, he would not have left the cockpit during the return flight and would have changed the co-pilot once landed in Barcelona.

The crucial question Captain Chialastri is trying to give an answer to is: how is it possible that no one had noticed any suspicious behavior in a person diagnosed with mental disease and willing to commit a suicide attack even working close to him?

It is Captain Chialastri’s questioning of why this occurs, and his explanations of it that drive the book forward.

This is somehow owed to reassure the four billion passengers who board the aircrafts every year everywhere in the world. It is a paradox that, despite being the aircraft the safest means of transport, yet passengers risk their lives because of someone who deliberately wants to crash the aircraft.

We cannot forget that the psychotic patient under treatment is not the worst danger on board, as many pilots might experience a tough period in their private life. They could experience mournings, marriage separations, existential difficulties, personal, emotional or mental distress that might affect their mental fitness to fly an aircraft under safety conditions. Certainly the difference between the two types of mental disorders is huge.

In the first case the person is a patient who needs medical treatment, medical support, and whose abnormal behaviour must be reported by colleagues or relatives to the company management. These might prevent any potential suicide act. Preventive measures are not applicable in the second case, as it might not be easy to detect states of uneasiness of the pilot. Aside from medical treatments, there are some actions that will implement the safety levels on board, namely the EASA recommendation concerning the “at least 2 persons in the flight deck”. Moreover there will be national regulations to ensure that an appropriate balance is found between patient confidentiality and the need of the employer to grant safety standards.

The book of Captain Chialastri and his colleagues has the privilege to point out these and many other aspects that public opinion need to know. We are all still waiting to know if even the flight MH370, carried out with a Boeing 777, which disappeared from the Asian radars on 8 March 2014 with 239 people on board has to be included in this horrible list of air crashes.

Antonio Bordoni

Journalist and manager of


This book came into being, because of the considerations shared by a group of aviation experts in the aftermath of the tragedy of the Germanwings flight 9525. Although that tragic accident was the motivation for this book, and yet it permeates every single page, we decided to leave it in the background, abstaining ourselves from opinions or judgements.

Therefore, we did not indulge in psychopathic analysis or psychiatric judgements, neither scrutinizing the ins and outs of the pilot’s biography to get pieces of evidence, nor confirming simplistic theories.

This accident is an important tragic occasion to reflect on, to enable the experts in resilience in the complex systems to reconstruct the precursors of the growing uneasiness, which is affecting a traditionally sought profession.


The objective of this book is to go beyond the personal story. We intend to study the condition of the airline pilot today, who notwithstanding the continual introduction of technology and innovation, is still a human being anchored to individual and social dynamics, from which he cannot escape. As we remind in many parts, we are not islands but peninsulas. We maintain a life-long connection to the contexts of our origins, which determine our roots and our cultural and social anthropologic constraints.


Being a pilot today is not only a job but a lifestyle that is increasingly affected by requestsfor exasperated productivity, accompanied by levels of psychological alienation, both cultural and social, which can provoke a phenomenon of psychological uneasiness, leading in some cases to burn-out. As we will see, burn-out is a psychological syndrome, which breaks out from individuals, making them exhausted and demotivated. Therefore, it is necessary for them to rely on their individual resilience, on the abilities to establish long term relationships, to recognize their own limitations and resources using these non-technical skills to approach life within organizations.

As often happens in aviation, we shall analyse this problem and its relation to flight safety.

Therefore, the ideal readers of this book are not only flight personnel, but everyone who deals with them and are affected by them, be they the airline managers, called on to manage the professional life of their employees, or the passengers who have the right to know if they can entrust the people who take care of their lives once aboard.

With this book, we would like to give a small contribution to the research of the root causes of this new type of accident, because dealing with reality is the most effective way to improve the aviation safety.

This type of approach made the commercial airlines the safest mode of transport any way you look at it.






A new threat is emerging in the sphere of air safety, which the experts in the sector define as unlawful interference, but which is labelled by the public opinion as a “pilot’s suicide˝. With an eye on the real dynamic of the accidents that happened in the last three years and with no intention to overdramatize, it is worthwhile to focus the root causes of them.

The human beings on board an aircraft are always to be considered both a resource and a threat. On the one hand, they are a resource, if we consider their capacity to resolve complex problems that the computer, up to now, is not able to solve. On the other hand, they are a threat, because of the quantity of errors that they commit daily. As we shall see, the label “human error” or “pilot error” is an over-simplification that fits newspaper columns. Safety scholars have to analyse thoroughly this phenomenon in order to elaborate suitable strategies in terms of prevention.

Today, a new particularly thorny issue is affecting flight safety, because it is a boundary problem between safety and security. Historically, the countermeasures taken to avoid the repetition of specific types of errors, such as mistakes, wrong actions or flawed decisions, were based upon the assumption that the subjects involved were unaware of their actions. Starting from this assumption it was possible to elaborate strategies that helped pilots to improve, providing them training tools to avoid, perceive and mitigate errors. Therefore, from time to time, the use of technology, training, or procedures was suitable to cope with new types of threats. However, with this new typology of accident, the basic assumption of unwillingness is no more valid. Here, the pilot voluntarily carries out an insane action. Thus, the remedy cannot only focus on the cognitive aspects, in terms of attention, reasoning and decision making, but must take into consideration above all the emotive aspects that push a pilot to commit this type of action.

The phenomenon of committing suicide, deliberately carried out by a pilot, the person into whose hands people on board entrust their own lives, naturally attracts the attention of the safety scholars. As Nicolas Taleb highlights so well, we probably find ourselves facing the classic “black swan” (Taleb, 2014), which focuses on the extreme impact of certain kinds of rare and unpredictable events and humans’ tendency to find simplistic explanations for these, based on the limits of the human knowledge.

Hence, we face the risk this type of accidents will happen again if we don’t understand its root cause.

The purpose of this book is to deepen the knowledge of the working conditions in which pilots, flight attendants and front-line operational personnel live.

We have decided to subdivide this analysis into three parts: the phenomenon of the suicide, the existential conditions related the pilot lifestyle and the analysis of the psychological resilience of the individuals facing traumas.

So, there are three approaches that intersect in this book: sociological, philosophical and psychological.

Suicide is a very old phenomenon, but in this case we should investigate why it is not any longer only a self-destructive behaviour, but it includes the destruction of innocent bystanders. The pilot lifestyle does not only concern the strictly professional sphere, but also family and private life. Being able to stay twenty days abroad or away from home base, it necessarily requires a flexible and psychologically robust character; in a word, resilient. Psychological resilience is a characteristic that can balance out the negative effects of excessive stress and preventing it from developing into burn-out.

The psychological uneasiness deriving from a high risk job can either be prevented, recognized or intercepted when it is revealed or mitigated after the event. Protocols of intervention, such as the peer support have been validated over the years, in particular in the United States.

From a purely normative point of view the European aviation authorities (EASA) have issued a series of recommendations, which in our opinion are not able to intercept a phenomenon like the one arose on the Germanwings flight. The will to do something (whatever it be) is understandable, especially following an event that has literally shocked public opinion. Nevertheless, to obtain results from the adoption of structured intervention it is necessary to direct our attention on understanding the phenomenon.

The proposal we make is focused on three areas: prevention, detection and mitigation of the phenomenon.

At a preventive level, it is necessary to investigate those areas that induce a state of uneasiness like the industrial relations that involve pilots having to deal with airline management, colleagues, passengers and authorities. Some airline managers often underestimate the physical – psychological well‐being of the pilots. It is precisely because burn-out has psychological-social roots, that we must investigate the dynamics in the phenomenon that leads a person to lose his mind.

At the level of detecting the symptoms, we must ask ourselves how an organization can detect this phenomenon.

The arduous hiring process to make a pilot flying for an airline is structured according to a set of procedures that are made up of an integrated process of selection (psychological tests, medical examinations, and aptitude tests), formation (courses directed to inculcate organizational values and to give a kind of company imprinting), training, (training in the simulators, theoretical courses in the classroom, professional meetings) and control (technical-professional examinations in the simulators and on the airline flights, plus regular medical assessments). Human interaction in this process takes place daily. This increases the chances that states of uneasiness emerge and be noticed either face to face with colleagues or with other people involved in the organization.

Once the initial measurement period has ended, an airline pilot keeps in touch with the organization as an average, once every forty days, while the duty days are about twenty per month.

A pilot seldom flies with the same colleague (and even less with the same crew). Should the pilot go through a period of psychological uneasiness, it is unlikely that this will be detected by anyone. Moreover, only extreme cases will be reported to the management for remedial actions. Nevertheless, As J.N. Butcher recalls in a study of 2002: “It may take a very extremenegative behavioural event to occur for one crew member to report another to the chief pilot”.

By “social control˝ we intend the possibilities that people with no specialization in the psychological field may detect states of uneasiness in their peers using their common sense and experience, perceiving the state of mind of people who work with them every day. Obviously, this can work in a situation of a clearly abnormal behaviour. Social control is also tied in with initial and periodic medical examinations which, even if they are not specific, help to highlight if there are latent problems of psychological or psychiatric type.

However, it is also to be considered that the pilot is aware that the medical check-up could result in harming his/her professional prospects (temporary suspension or definitive loss of pilot’s license), so will tend to minimize the difficulties or even to evade the medical checks.

From the point of view of the mitigation of this phenomenon, there are several ways to dampen the devastating effects. We can break it down into several areas of intervention, by using the normative approach firstly. EASA (European Aviation Safety Agency) issued a recommendation just after the Germanwings event, stating that there should always be two crew members in the cockpit. In fact, this rule looks as a palliative to calm down a fretting public opinion. When we have to face criminal intentions inside the cockpit we realize how fragile we are. Let’s think of a pilot voluntarily cutting off the engines after taking off from an airport, while being over the sea or close to a mountainous area. It is just a matter of a couple of seconds, in which by moving a lever of five centimetres triggers off an irreversible situation.

Another way to mitigate the phenomenon, is the creation of an information data base concerning the pilots who are temporarily unfit to fly. In this way, when the pilot is fit to fly again, following a period of illness, will have no longer to report his fitness directly to his own employer, but the specialized doctor will directly inform the airline.

Actually, a very effective strategy to mitigate the phenomenon is the peer support, which is to say the support of a group of “peers” (colleagues). This has been tested out with success in several countries and enables overcoming difficult moments. Even though they do not have a background of psychological studies, the “peers” are persons that have followed an extensive training in giving moral, psychological and professional support. They know what they are talking about, because they have shared the same professional experience and background. Therefore, they can soften the most significant asperities deriving from possible states of stress.

In short with this book we hope to encapsulate a phenomenon, to provide some points of view from those who are inside the system and to put forward workable solutions. Certainly, safety is obtained with the contribution of everyone, but the first necessary step is the proper understanding of the phenomenon. We only hope to have given a small contribution in this direction.



Chapter 1. Germanwings Flight 9525

On 24 March, 2015 Germanwings flight 9525 was a scheduled international passenger flight from Barcelona–El Prat airport in Spain to Düsseldorf Airport in Germany, which crashed killing all 144 passengers and six crew members on board. The Airbus A320-200 crashed into the French Alps, after a constant descent that began shortly after the aircraft had reached its cruise altitude. 2

The BEA preliminary report concluded that the accident was caused by an intentional act from the co-pilot to down the aircraft. Shortly after reaching cruise altitude and while the captain was momentarily out of the cockpit, he locked the cockpit door and initiated a controlled descent that continued until the aircraft impacted a mountainside.

The hypotheses formed for this voluntary action were based on the medical disorder of the co-pilot, who had suffered from the syndrome of burn-out several times. The accident happened while he was being officially treated by a private physician who diagnosed a possible psychosis and recommended psychiatric hospital treatment. Furthermore there is a torn-up doctor’s note, signing him off work on the day of the crash. Neither of those health care providers informed any aviation authority, nor any other authority about the co-pilot’s mental state. Several sick leave certificates were issued by these physicians, but not all of them were forwarded to Germanwings.

Other contributing factors, namely some necessary conditions, but not sufficient to provoke the crash, have been attributed mainly to the co-pilot’s fear of losing his pilot’s license if he had reported his decrease in medical fitness, the potential financial consequences generated by the lack of specific insurance covering the risks of loss of income in case of unfitness to fly and the need to pay back a loan received to obtain the pilot’s license. Moreover, it has come to light the lack of clear guidelines in the German health system to support the doctors when a threat to public safety outweighs the requirements of medical confidentiality.

Immediately after the impact suspicions of an accident due to unlawful interference had quickly emerged. This situation has some legal implications; for instance, the prosecutor is directly involved. Therefore, there were two investigations running parallel: a technical and a judicial one.

The final report gives an account of a flight that was to all practicable purposes normal, a flight which any airline would carry out daily. Weather conditions were fair, no significant technical problems affected the aircraft and the crew had rested adequately before going on duty. During cruising phase, the Captain exited the cockpit to go to the toilet. It was then that the co-pilot shut himself inside the cockpit and started to manoeuver the aircraft, he kept the autopilot engaged and set up a continuous descent from flight level 380 (an altitude of about 11600 meters) down to the ground. The rate of descent was not excessive, but conformed to a normal descent that is carried out when preparing for landing. For about twenty minutes the voice recorder on board captured several (unsuccessful) attempts by the rest of the crew to enter the cockpit. They also violently bashed against the door.

The normal procedure for entering the cockpit is simple: the crewmember who wants to request access to the cockpit has to dial a code on a small keyboard, the pilots are notified via a chime that someone is requesting access to the flight deck. Once the chime sounds, they have a set time to allow or deny the request. This is usually done with a switch which has ‘ALLOW’ and ‘DENY’ selections. Moreover, if no action is taken by the pilot, or if both pilots become incapacitated, the crew member can enter an emergency code that automatically unlocks the door after an interval of fifteen seconds, during which an acute specific chime sounds in the flight deck. However, if during this length of time the pilot wants to continue to refuse access, he will only have to act on a small switch that will interrupt the emergency unlocking sequence of the door and will keep the cockpit inaccessible.

The co-pilot refused the permission to enter.

The French air traffic controllers observing the aircraft descending (unauthorized)on the radar screen, tried to call the Germanwings flight 9525 several times but without any answer. After many unanswered calls it was decided to alert a military jet to monitor the situation. The first military flight took off at 9.48 local time. The Germanwings flight had already crashed in the mountainous locality, Prads-Haute-Blèone, eight minutes before. As an examination of the black box revealed, just before the impact the alarm of the ground proximity warning system sounded. In searching for the causes of the accident, the investigators immediately concentrated on the motives for the voluntary action made by the co-pilot and focused on his private and professional life.

They came up with the portrait of a young man, twenty-seven years old, who had obtained his pilot’s license and then started to fly at the Lufthansa flight school in 2008. He had to interrupt his training course because of succumbing to a “nervous breakdown”3. He had then resumed his training activity after eight months, passing the theoretical examination, and moving to the United States to continue the practical part. In 2011, while still a trainee pilot, he worked as a flight attendant for about a year and a half. He finally qualified to fly on the Airbus A-320 in 2013. At the time of the accident, he had accumulated little more than five hundred flight hours out of a total necessary experience of about a thousand hours.

Both during the initial training and the periodic professional assessments, which pilots regularly undergo, he was judged to be not only proficient, but above average. Moreover, none of the captains, or crew members who had flown with him in the months before the accident, had ever reported anything weird in his attitude or behavior during flights.

His medical examinations had instead shown some flaws, since he had initially been judged physically fit to hold the role of co-pilot, but then his pilot’s license was suspended for medical reasons in April 2009, because of depression that needed to be treated. Once again, in July 2009 the Lufthansa medical centre had refused his request to renew his pilot’s license. Then, fifteen days later, he was given the medical fitness for a year, with a special note that invited the next medical examiner to evaluate the reasons of the previous restriction.

The co-pilot had taken out a loan of about sixty thousand euros to obtain his pilot’s license. The refusal to renew his pilot’s license for medical reasons, would have caused not only the end of his own professional career, but also heavy financial problems, such as repay his loan to the bank.

Lufthansa, the airline company where he had attended the training to become a pilot, had signed an insurance that granted a one-time payment in case of the loss of a pilot’s license. This was contracted for the young co-pilots aged less than thirty-five years (and until ten years of service). That could have permitted the co-pilots to pay back most of their own debt. On his part, he had not contracted any private insurance to protect himself against the loss of income. On the other hand, he would not have been able to obtain any, because of the limitation that was pending over his own pilot’s license due to the recurrent psychological problems.

Beyond the routine medical checks that every pilot has to undergo periodically, the co-pilot followed an additional therapy with his own doctors, because his frequent depression crisis. In August 2008, a deep depression without psychotic symptoms affected him. After this event his doctor gave him a referral for hospital treatment.

This condition required to take anti-depressive medicines from January to July 2009, accompanied by a psycho-therapeutic treatment from January to October 2009.

The therapist who was responsible for the treatment stated that the co-pilot had fully recovered from the depression illness in July 2009. In July 2009 the Lufthansa aero-medical centre renewed the pilot’s license with a waiver. It stated that it would become invalid if there was a relapse into depression. In February 2010 the psychotherapist who was treating him issued a new certificate in which he stated that “thanks to his patient’s motivation and spirit of collaboration” a remission of the previous symptoms had been verified.

In 2010, the co‐pilot also applied to undergo the medical examination in the United States, at the FAA Aerospace Medical Certification Division, but the renewal of his pilot’s license was denied because he still showed depressive symptoms. The Federal AviationAdministration sent him a letter which clearly stated the reasons why his license was not renewed. Furthermore, he was asked to send the entire documentation regarding his psycho-therapeutic treatment that he had undertaken in Germany. After the co-pilot translated his own clinical position, the American centre issued a third-class4 authorization to fly, with the clause that should the depressive symptoms reappear again in the future the authorization to fly would have been revoked.

Apparently, there were not any other limitations during the years that went from 2011 to 2015, apart from a brief inconvenience regarding problems with his eyes, which nevertheless did not have an organic origin.

In February 2015, about a month before the accident, the co-pilot obtained a medical certificate of temporary unfitness to fly for eight days. It was not reported to his airline. The co-pilot contacted several other doctors in this period, who all confirmed his altered psychological state, and one of them also prescribed some drugs for the treatment of mental conditions. Probably no doctor knew of the diagnoses and therapies provided by the other colleagues.

A doctor issued a certificate for absence from work, which had an indefinite prognosis on 9 March 2015. This certificate, too, was not forwarded to the airline’s management. Another doctor issued a medical certificate for absence from work for eighteen days on 12 March, but for the tenth time Germanwings was not informed. His psycho-therapist continued to prescribe anti-depressive anti-depressants, which the co-pilot probably took up to the day of the accident.

This is the starting point for our analysis.


Other consequences…

Besides many losses of human lives, there are other consequences that derive from an accident, since this leaves some long term effects. It is particularly true for the so-called paradigmatic accidents, which are remembered for a long time. It is not by chance that the very name Germanwings has been gradually replaced by Eurowings.

Moreover, Lufthansa, Germanwings’ parent company, offered victims’ relatives an initial aidcompensation of fifty thousand euros each, leaving aside other possible legal actions that may be brought forward in the future.

Reinische Post has reported an estimate prepared by Elmar Giemulla, a professor of aviation law at the Technical University in Berlin, according to whom the airline company will have to pay between ten and thirty million euros in compensation. According to the Montreal convention, a maximum compensation of 143,000 euros is set per- victim should the airline company be held responsible, unless further elements denote serious negligence.

Some experts in the insurance field retain that notwithstanding Andreas Lubitz had hidden his pathology, it should not exonerate Germanwings (or Lufthansa) from compensation. In fact, it seems from journalistic reports that Lufthansa insurance has already set aside 300 million US dollars for compensation to the victims’ relatives and for the cost of the aircraft.


2 The Final Technical Report, namely the report on the causes of the accident was led by the BEA (Bureau d’Enquêtes et d’Analyses pour la Sécurité de l'Aviation civile), and was published on 13 March 2016.↩

3 The term “nervous breakdown” is not a medical term, but it is sometimes used by people to describe a stressful situation in which they’re temporarily unable to function normally in day-to-day life. It’s commonly understood to occur when life’s demands become physically and emotionally overwhelming.↩

4 A first class medical certificate is required for all pilots involved in commercial aviation. This certificate has the most restrictive medical standards. The holder of a medical certificate must be mentally and physically fit to exercise safely the privileges of the applicable license. A second class medical certificate is required only for General Aviation pilots – those that fly as a hobby. As the holder is not involved in commercial activities, the certificate is not so restrictive. Third Class Medical Certificate: necessary to exercise the privileges of a Private pilot license or certificate, or any lower pilot certification level. ↩

Chapter 2. Human factor and safety

Let’s see now what the “human factor” is, because under this label several phenomena have been grouped together over time. The overwhelming majority of accidents has been attributed to human error. Actually, we should focus on the root cause that led to errors if we wish to understand the accidents’ dynamic and put forward solutions to avoid their repetition.

2.1. The evolution of the aviation threats to safety

Let’s observe this graph that represents the curve of accidents in commercial aviation.

Fig. 2.1 - Yearly accident rate

The x-axes indicates the decades starting from the late fifties to nowadays. The y-axes indicates the rate of accidents, namely the yearly fatal accident rate per million departures. Even before going into details, we can note some characteristics of such a curve.

First of all, the yearly fatal accident rate (per million departures) in commercial jet operations has drastically declined from 4 in mid-60’s to well below 1 in 2014, according to the latest Airbus statistics shown above, meaning that safety increased. Secondly, we notice that the curve never reached the value zero.

Finally, occasionally, during the years, we observe some upward trends caused by the change in the root causes that led to accidents. The number of take-offs along the years has exponentially increased, but not with a constant rate (wars, economic crises, globalization etc.), passing from about four million a year in the sixties to more than thirty million take-offs nowadays. An aircraft accident that happens in whatever part of the world, immediately obtains a planetary echo both for the psychological impact that an air disaster has on public opinion, and for the pervasive capacity of mass media, to inform about daily events in real time.

Therefore, during the Seventies four million flights with a rate of ten accidents for every million take-offs meant forty accidents a year. Today the accidents’ rate is low but the flight volumes are high. So, given one accident per million take-offs and thirty-five millions departures, the total number of accident would be thirty-five a year, or one every ten days. That’s why the aviation industry constantly struggles against systematic threats, with the purpose of lowering the risks and keeping under control the possibility of accidents. The aircraft is by farthe safest means of transport, and the facts show that air accidents happen with low frequency.

Nevertheless, all of us would like to see this value reaching zero, although this number has never appeared in the world-wide safety statistics.

Let’s go into details to see how the causes of accidents have changed over time during the years. We shall also take into consideration that aviation investigations have started to assume values of evidence, lessons learnt and tools for change from the Seventies onwards. ICAO Annex 135 disciplines aviation investigations. It was first published in 1951 and it is now in its IX edition. At the beginning, the research of the primary cause of air disasters was based upon no-validate methods, unsuitable means, and little technology (it was only After BEA Flight 548 incident in June 1972 that all British-registered airliners have mandatory cockpit voice recorders).6

Therefore the results were inevitably poor. It was only in 1973 that the aviation accidents’ investigations manual was published by ICAO. It has been subjected to various revisions over the years. Some integrations, like the human factor manual, were added to explain the underlying causes attributed to the human factors.7

Anyway, as the methodologies for the technical analysis of accidents improved, enhanced by sophisticated tools and techniques, explanatory theoretical schemes to establish causes, underlying causes and contributing factors, investigations became more accurate. In the aviation history, in fact, some accidents represent turning points, milestones, assuming the role of paradigmatic events; after them nothing remains as it was. They force us to look at safety in a new way. We can indicate as paradigmatic incidents Tenerife (1977), Dryden (1989), Flight AF 447 (2009), the attacks of 11September (2001), and the Germanwings case (2015).

2.2. The 1960s

During the Sixties, the primary cause of accident was attributed to the loss of control of the aircraft (Loss of control in flight) such as stall, unusual flight attitudes, and/or exceeded speed limits and so on. However, the root causes of loss of control, which is the epiphenomenon, were the human performance and limitations: tiredness, jet lag, sleepiness, excessive mental workload and in general the pilots’ poor knowledge of their own limits as human beings.

It was really challenging to fly all night long, with the accumulated effect of the time zone on an intercontinental journey, and then having to cope with adverse weather conditions in carrying out the final approach to an airport, with limited technological aids to support the pilot’s tasks. By its very nature, the pilot job requires the maximum performance at the beginning and end of duty (take-off and landing). Therefore, the longer the duty hours, the lesser the ratio between resources available and difficulty of task (“safety rate”).

The explanatory model of the accidents, at that time, was centred on the “name and blame approach”, namely “find a guilty person and punish him”. Proven that the accident was caused by pilot’s error, the blame was attributed to the one having committed the main action leading to disaster. This approach showed its limit because it was ineffective to lower the accident curve. To overcome our psycho-physical constitution and our limitations, the solution came from the introduction of more and more technology on-board. A series of systematic redundancies able to reduce the workload of pilots like autopilot, auto-throttle lever, flight director and other aids helped a lot. Hence, the cause and effect relationship becomes human problem- technological solution.

2.3. The 1970s

During the Seventies the accidents’ curve raised significantly. Pilot error continued to be addressed as the main cause of accident, but in a new light. Controlled Flight into Terrain (CFIT) became the first cause of accident. This typology of accidents is particular because pilots fly a perfectly manoeuvring efficient aircraft, in terms of attitude, speed and engine thrust, and eventually impact against an obstacle or a mountain during the intermediate and final phases of the flight, namely approach and landing.

Investigators pointed out that in this typology of accident, in many cases someone inside the cockpit realized an anomalous situation, but didn’t speak out. The reasons were linked to human interaction issues: pilot’s fear of reprimands by the captain or a sense of subjection, that led to self-censorship and made the pilot unable to express his/her own doubts. When it was the Captain to monitor the co-pilot (as in the captain monitored approach) this condition washardly observable.

Case study: The accident in Tenerife

Let’s see why this accident is to be considered paradigmatic.

Tenerife accident occurred in 1977, because of a collision on ground between two B-747s. During the IATA conference in Istanbul, in 1975, emerged that the human factor represents a threat to air safety and that it was therefore necessary to study it, in order to develop useful countermeasures.

Two years after that conference the worst air accident in the commercial aviation happened because of the human factor. In short this is the story of the accident.

Two Boeing 747 aircraft, working on intercontinental flights between Europe and the United States, planned to land in the island of Las Palmas, in the Canaries.

A terrorist incident at Gran Canarias Airport had caused many flights to be diverted to Los Rodeos, including the two accident aircraft. The airport quickly became congested with parked aircraft blocking the only taxiwayand forcing departing aircraft to taxi on the runway instead. Patches of thick fog were also drifting across the airfield, preventing aircraft and control tower from seeing each other.

Two B-747s were there at the same time, belonging respectively to the Dutch airline KLM and the American Airline PAN AM. Both needed to refuel and depart as quickly as possible, but the operations were proceeding slowly, since the Airport at Tenerife was not equipped to deal with those big aircraft.

The Pan Am aircraft was ready to depart from Tenerife, but the KLM plane and a refuelling vehicle obstructed its access to the runway. The Pan Am aircraft was unable to manoeuvre around the fuelling KLM, reach the runway and depart due to a lack of safe clearance. The Dutch Captain Veldhuyzen van Zanten had decided to fully refuel at Los Rodeos instead of Las Palmas, apparently to save time. The refuelling took about thirty-five minutes. After that, the passengers were brought back to the plane.

The delay made the KLM Captain Van Zanten very nervous, since an appreciable delay was in prospect and the company rules did not allow to exceed the daily maximum flight time limitation. Had someone infringed that rule, he/she would have faced disciplinary measures. In fact, at the time of the accident, investigators learned that the Dutch rules regarding duty time limits had recently been changed. Prior to this, the captain had a great deal of discretion in extending his crew’s duty time in order to complete the scheduled service. However, new rules imposed absolute rigidity with regard to duty time limits. The captain was forbidden to exceed these limits and, in the event that duty times were exceeded, could be prosecuted under the law.

Therefore, the captain was facing the real possibility of having to disembark all the passengers, to wait for the crew to rest, according to the dictates of the KLM regulations and only then take off again.

Furthermore, Tenerife, probably would not have been able to grant the passengers an overnight stay, since there would not have been enough beds available for all the passengers on-board. The crew felt in a deadlock. Therefore, haste played a fundamental role. Spurred by the restraints of time, the crew brought all the operations to a conclusion, requesting the authority to leave.

This was the situation on the day of the accident. The investigators noted that during the delay at Tenerife, the KLM captain, using HF radio, contacted the company’s operations office in Amsterdam. He was told that if he was able to take off before a certain time it seemed that there would be no problems with duty time. However, if there was any risk of exceeding the limit, the company would send a telex to Las Palmas. This uncertainty of the crew as to their duty time limit was found by the accident investigation to be an important psychological factor.

The tower instructed the KLM to taxi down the entire length of the runway and then make a 180-degree turn to get into take off position. While the KLM was back-taxiing on the runway, the controller asked the flight crew to report when it was ready to copy the ATC clearance. Because the flight crew was performing the checklist, copying this clearance was postponed until the aircraft was in take-off position on Runway 30. Shortly afterward, the Pan Am was instructed to follow the KLM down the same runway, exit it by taking the third exit on their left and then use the parallel taxiway. Initially, the crew was unclear as to whether the controller had told them to take the first or third exit. However, to do this, it would have done a very challenging manoeuvre. The taxiway was too small and at acute angle to permit a B-747 to turn into the taxiway.

The American crew was unease at the idea to vacate the runway where the air traffic controller had instructed them. They thought it was impossible to comply with that instruction, so they planned to vacate at the next taxiway (number 3 as shown in the figure). The crew asked for clarification and the controller responded emphatically by replying: “The third one, sir; one, two, three; third, third one.” The crew began the taxi and proceeded to identify the unmarked taxiways using an airport diagram as they reached them. The crew successfully identified the first two taxiways, but their discussion in the cockpit never indicated that they had sighted the third taxiway, which they had been instructed to use. There were no markings or signs to identify the runway exits and they were in conditions of poor visibility. The Pan Am crew appeared to remain unsure of their position on the runway until the collision, which occurred near the intersection with the fourth taxiway. The official report from the Spanish authorities explains that the controller instructed the Pan Am aircraft to use the third taxiway because this was the earliest exit that they could take to reach the unobstructed section of the parallel taxiway.

Fig. 2.2 Tenerife runway

Meanwhile the situation aboard the KLM flight was no less tense, as the crew members were in a hurry to leave, in order to comply with the rules regarding flight time limitations. Once lined-up with the runway the KLM Captain advanced the throttles to take-off, but the first officer warned him “We are not clear to take-off”. The Captain was probably annoyed by this correction and asked the first officer to get the departure clearance. The accident report noted that perhaps influenced by the KLM captain’s “.....great prestige, making it difficult to imagine an error of this magnitude on the part of an expert pilot, both the co-pilot and the flight engineer made no further objections.”

When the air traffic controller gave the authorization he used a non-standard language, which misled the Dutch crew. In fact, the word “Clear” used in the language for aviation radio-telephony at that time, was ambiguous, since it could be understood both “authorized”, and “vacated”. For example, you could say both “Clear to take-off” and “Runway clear” The air traffic controller used the expression “Authorized to Amsterdam/flying to Amsterdam etc.” (Clear to…) meaning the authorization to fly the filed flight plan to Amsterdam. Instead, the Captain, spurred on by haste, understood he was authorized to take off.

In the meantime, the American aircraft was still on the runway, immersed in a thick fog. The Dutch First Officer, who had already corrected the captain once, stopping him from taking off in the absence of an explicit authorization to take off, did not have the assertiveness to object once again. Probably, he knew that they did not have obtained this clearance, but he didn’t speak-out his doubts. The flight engineer, for his part, asked if the other airplane had vacated the runway.

The Captain reassured both and imposed his authority to take-off.

The American crew, realizing that something was going wrong, radioed a message stating they were still on the runway, but this communication never got through to the air traffic controller. In fact, the technology ruling the communication between the aircraft and air traffic controllers did not permit to different stations to talk at the same time. Therefore, if the air traffic controller and the pilot were transmitting contemporarily a message, the communication would be cut.

Moreover, it was difficult to notice if themessage sent had been correctly received.

The crash in which 587 people died happened a few seconds later. The KLM aircraft was accelerating along the runway with the runway covered with fog, when it crashed into the PAN AM B-747 which was still on the runway. Based on the Pan Am cockpit voice recording, investigators determined that the Pan Am flight crew saw the KLM coming at them out of the fog about nine and a half seconds before impact.

Until now, it is the biggest crash due to human error in the commercial aviation domain.