Surviving Despite the System, Not Because of It

Based on the presentation, The Human Factor Behind a Successful Evacuation - From Compliance to Competence, by Dr. Mizuki Urano, Aviation Safety Advocate

On 2 January 2024, Japan Airlines Flight 516 landed at Haneda Airport in Tokyo and collided with a Japan Coast Guard aircraft on the runway. The Airbus A350 caught fire. All 367 passengers and 12 crew evacuated and survived. The world called it a miracle.

Dr. Mizuki Urano calls it a warning.

A former cabin crew member and cabin safety officer at Japan Airlines, and a former representative to ICAO's Cabin Safety Working Group, Dr. Urano's presentation at the recent WATS conference offered what she describes as the first public analysis of the areas for improvement that the accident investigation interim report did not address. Her core finding is uncomfortable: JL516 is also recorded as one of the longest evacuation times in a survivable aircraft accident — and the delays were not accidental. They were structural.

A Timeline That Should Disturb Us

The sequence of events Dr. Urano presents is precise and troubling. The PA system failed before the aircraft came to a complete stop. Cabin crew relied on megaphones and their own voices. They correctly identified usable exits — keeping L2, R2, L3, and R3 closed due to external fire, holding R4 closed because of sparks from a running engine, and managing the steep slide angle at L4. These were sound individual judgements.

Missed this presentation? View Dr. Urano's upcoming work this August during APATS.

And yet: it took 3 minutes and 16 seconds from the aircraft's stop before L1 and R1 were opened. By 3 minutes and 20 seconds, smoke was already visible in the cabin. In the rear compartment, the first sign that crew began assessing evacuation routes came at 4 minutes and 47 seconds, when a crew member asked which doors could be opened. Passengers were not directed forward until 5 minutes and 50 seconds had elapsed. The aft door L4 did not open until 6 minutes and 47 seconds after the aircraft stopped — and just two minutes later after all passengers and crew evacuated, flames appeared near L3 and black smoke from L4 increased rapidly. The rear cabin came within minutes of losing its only usable exit.

Every second in that timeline represents a decision that was delayed, a piece of information that did not travel, or a procedure that prioritized the wrong thing at the wrong moment.

Four Structural Failures

Dr. Urano's analysis identifies four interconnected areas where policy, procedure, and training failed to support effective performance.

The first is the primacy of panic control. Japan Airlines — and many Japanese carriers — begin their emergency response sequence with panic control: calming passengers before assessing the situation. This step does not exist in most international airline procedures, and it comes before checking conditions outside the aircraft. In the JL516 scenario, cabin crew continued performing panic control rather than reporting conditions or preparing for evacuation — for nearly three minutes after the aircraft stopped and the interphone had already failed.

The psychology here matters. True passenger panic is rare and occurs only under specific conditions. A small number of agitated passengers can be managed through role-sharing. The assumption that every emergency requires whole-crew focus on calming passengers is not supported by the evidence — and in JL516, it cost time that could not be recovered.

The second failure is information flow to the cockpit. Modern wide-body aircraft have grown to the point where flight crew cannot see what is happening behind the wings. On an A350, cockpit windows are completely hidden from the cabin. Cabin crew are, as Dr. Urano frames it, the eyes of the cockpit — and ICAO explicitly identifies reporting abnormal or hazardous conditions to the flight crew as a core cabin crew responsibility. In JL516, the interphone failed before the aircraft stopped. If the PIC became aware of the fire late, as the evidence suggests, a communication failure was almost certainly a contributing factor. The critical question is not why the interphone failed — it is why its failure meant the flight crew could not be informed.

The third failure is coordination between crew stations. With exits blocked and smoke increasing, passengers near L3 and R3 had already lost their closest escape routes — yet no meaningful coordination between cabin crew occurred for almost five minutes. Crew could not leave their door stations. Rear crew had no situational awareness of what was happening forward. When communication systems fail, coordination must become manual — through megaphones, through crew physically moving between stations, through able-bodied passengers used as information relays. Some airlines use a structured buddy system in which crew divide roles, with one managing the cockpit contact while the other shares information with adjacent stations. JL516 demonstrated that without structured fallback coordination, crew are left improvising in isolation.

The fourth failure is the absence of decision-making authority at the crew level. The procedures used by many Japanese carriers include multiple sequential steps before evacuation can begin: check the situation, report to the cockpit, retry contact, escalate to senior cabin crew, wait for their decision — all while still attempting to reach the flight deck. In contrast, many international carriers set clear time limits after which cabin crew can initiate evacuation directly if danger is imminent. The multi-step procedure structurally delays the moment of decision.

Building Competence, Not Just Compliance

Dr. Urano is direct about what needs to change. Policy must establish clear frameworks that trust cabin crew judgement — including the right to deviate from standard procedures when safety demands it — and provide specific guidance for scenarios where the PIC is unavailable or communication systems have failed.

Procedures must then translate those policies into documented action: fallback protocols for interphone and PA failures, explicit time limits on waiting for flight deck instruction, and clarity about when cabin crew authority to initiate evacuation is activated.

Training must build the knowledge and experience that makes all of this possible under pressure. Cabin crew need substantive aviation knowledge — engine shutdown timelines, danger areas around running engines, how to read external conditions accurately — so their judgements are grounded rather than purely procedural. They need scenario-based training that places them in situations where communication systems fail. And they need CRM training that develops timely, mature decision-making rather than compliance with a checklist written for normal conditions.

JL516 ended without fatalities. That reflects individual courage and sound judgement by crew working under extraordinary pressure. But it does not validate the system that put them there. As Dr. Urano concludes: cabin crew are trained as safety professionals. Policies, procedures, and training must reflect that — because in an emergency, every second of delay is a second the system created.

Conversations on more pressing issues in cabin crew training will continue at the Asia Pacific Aviation Training Summit (APATS). Have you reserved your spot?