A long-time expert in human factors and system safety, Miller argues that the situation is one of lost opportunity and the potential loss of credibility for the industry. "The flying public gets most upset when a current accident seems to involve a repeat performance, when a known precedent has not been corrected," he said.
Examples of the past repeating itself abound:
* In-flight fire: Although the investigation is far from complete, the tragic case of Swissair Flight 111 clearly involves an inflight fire and smoke in the cockpit. The issues it raises are remarkably similar to the November 3, 1973 case of a Pan American cargo flight which tried unsuccessfully to return to Boston's Logan International Airport. This accident 25 years ago, Miller pointed out, "illustrated the need to manage in-flight smoke and fire, and to get down as soon as possible." He hopes the Canadian investigators of the Swissair tragedy will read a succinct 1986 paper on this very subject by aviation safety expert Gerry Bruggink, titled "The Uncontrollable Cabin Fire - Land and Evacuate."
* Aging systems: The 1996 explosion of TWA Flight 800 raised the issue of aging systems, especially regarding wiring, connectors, and so forth. Miller recounted how the explosive decompression of an Aloha Airlines 737 in 1988 stimulated a massive effort to assure the structural integrity of high-time aircraft. While non-structural aspects were a point of concern even then, the focus was on structure. Miller expressed dissatisfaction with the Federal Aviation Administration's (FAA) April 2, 1999, Notice of Proposed Rulemaking (NPRM) on aging airplane safety, which speaks almost entirely to "damage tolerant" structural problems. "Some people even now do not seem to appreciate the scope of the aircraft age problem," he groused.
* Wiring. Problems with Kapton (aromatic polyimide) wiring surfaced in the Titan missile program more than 30 years ago (1965). Efforts to get the word out to the airline industry were killed. "It was argued myopically that the military's experience had no relevancy to civilian flight and maintenance activity, disregarding the fact that they both are manned by human beings," Miller said.
* Inflight icing. This area represents "my favorite example of lessons not being learned until the body count gets too high," Miller said. The grim story starts in the Italian Alps 12 years ago. On Oct. 22, 1987, an ATR-42 fell from the sky near Lake Como during an icing encounter. Miller was retained by the airline to assist in the investigation. With the aid of excellent flight data/cockpit voice recorder (FDR/CVR) records, the sequence of events was apparent. While climbing on autopilot, the aircraft dropped below the minimum recommend speed for flying in icing conditions. The autopilot was fighting the ice-induced degradation until, at its limit, it snapped off, at night, over mountains, in instrument conditions.
"The aircraft's impact was decided at the moment it rolled," Miller said. The key lesson: don't use the autopilot during icing conditions. The insight, Miller said, was quietly conveyed to the FAA and the National Transportation Safety Board (NTSB).
Yet on October 31, 1994, near Roselawn, Indiana, an ATR-72 crashed in a virtual carbon copy of the Lake Como experience. In an otherwise excellent report, the NTSB accident analysis made no reference to the Lake Como case, except to list the crash in a table of prior icing accidents, Miller observed.
Next, on Jan. 9, 1997, an Embraer-120 twin-turboprop crashed in icing conditions at Monroe, Michigan. The now-familiar roll departure occurred as the autopilot disconnected. The NTSB specifically urged autopilot disconnect during icing conditions, although considerable resistance to this stratagem remains in the industry, based on discussions at the FAA's recent inflight icing conference (see ASW, Feb 8).
This resistance persists even in the face of a Jan. 7, 1999 incident involving an ATR-42 flying in icing conditions near St. Louis, Missouri. The aircraft departed controlled flight during an instrument approach. Fortunately, the pilots recovered the aircraft at 1,600 ft. (MSL). Only a preliminary NTSB report is available, but Miller said, "It will be interesting to learn if this flight was on autopilot during the approach."
Why do these cases keep happening? Miller offers seven reasons and seven possible counter-actions:
1. Normal human behavior. There is a difference between what a person can do and what he/she will do in an operational situation. Human limitations need to be stressed more in systems design and procedures.
2. The endless ocean of accident prevention knowledge. A great body of knowledge has been accumulated in nearly a century of powered flight - hence the ocean metaphor. A smooth surface on this ocean can be likened to those periods where crashes have been absent for awhile (e.g., the "zero deaths" in 1998 for U.S. air carriers). Indeed, a smooth ocean may induce complacency, when in fact the hazards below represent a potential tsunami. Efforts like project GAIN (Global Analysis and Information Network), Miller said, are geared to contemporary monitoring of undesired events. What's needed, he urged, is a taxonomy of hazard identification and prevention to capture the hard lessons of the past.
3. No time for the past. "Time," Miller said, "tends to dilute institutional knowledge." In this respect, the legal system, demanding case citations that go back decades, may have taken the examination of precedent almost to a fault. But two correctives for the aviation industry come to mind. All previous cases and recommendations should be made a routine and required part of accident reports, Miller suggested. Similarly, past lessons should be incorporated into training programs for flight and ground crews. For instance, in the training for upgrade to captain, a review of previous crew resource management cases, particularly of the aircraft in question, should be included.
4. Influential persons and levels of ignorance. Citing recent blue ribbon panels and commissions convened to address concerns of safety and security, Miller complained, "You could count on one hand the number of true safety professionals" on their membership. "A couple of specific recommendations can be made in this touchy area of challenging the efforts of very well-meaning people," Miller suggested. First, membership could be solicited from professional safety groups. Among them, the International Society of Air Safety Investigators (ISASI), the System Safety Society (SSS), the National Safety Management Society (NSMS), the American Society of Safety Engineers (ASSE), and the safety committee of the Human Factors and Ergonomics Society (HF&E). Second, Miller urged, "These review commission should include personnel of potentially opposing views on the issues at hand." Their presence, he believes, would provide a "needed look at both sides."
5. Antiquated, excessive emphasis on accident causation. People tend to stop thinking with the pronouncement of "probable cause," Miller asserted. The "cause" language in the NTSB's enabling legislation can be interpreted broadly enough, he believes, to allow for a discussion of all broken links in the chain of events leading to an accident. "Getting out of the 'cause' business removes safety agencies from assessing blame and allows for more concentration on accident prevention," he said.
6. Recommendations and action failures. The floor of the ocean of accident prevention knowledge is littered with the hulks of recommendations that were never implemented. "It is astounding how these things get lost," Miller said. He pointed out that a 1998 report by the Flight Safety Foundation on approach and landing accidents recommends many preventive actions that were presented in a 1972 NTSB report on the same subject. He recommends two actions: expand the database to include the past 20-30 years worth of recommendations. In addition, accident reports should feature a section for the investigator(s) to suggest remedial actions (e.g., "designing out" the identified hazard).
7. Increased aviation system complexity. One way to cut through the complexity is a systems approach to hazard identification and mitigation. The U.S. military's approach, as documented in MIL-STD-882 (now in revision) can serve as a model. Above all, Miller urged, "We need to get into a preventive mindset. Don't look for blame; that will come of itself."
|
