NTSB Chair Deborah Hersman Accepts ISASI Honorary Membership CONTENTS

JULY–SEPTEMBER 2011

Volume 44, Number 3 Publisher Frank Del Gandio FEATURES Editorial Advisor Richard B. Stone Editor Esperison Martinez Design Editor William A. Ford 5 Using Commercial Satellite Imagery in Associate Editor Susan Fager Aircraft Accident Investigation Annual Report Editor Paul Mayes By Dr. Matthew Greaves (AO7700) and Professor Graham Braithwaite (MO3644), ISASI Forum (ISSN 1088-8128) is published Cranfield Safety and Accident Investigation Centre, Cranfield University, UK—The quarterly by International Society of Air authors evaluate the current state of the art focusing on the needs and priorities of Safety Investigators. Opinions expressed by authors do not necessarily represent official an accident investigation and reporting on live trials conducted in Cyprus in 2009. ISASI position or policy. Editorial Offices: Park Center, 107 East 10 Safety Reporting and Investigation— Holly Avenue, Suite 11, Sterling, VA 20164-5405. Telephone (703) 430-9668. Cornerstone of SMS Fax (703) 430-4970. E-mail address isasi@ By Paul E. Mayes, Vice President, ISASI—Although the 1979 DC-10 crash on the erols.com; for editor, espmart@comcast. slopes of Mount Erebus occurred long before the concept of an integrated safety net. Internet website: www.isasi.org. ISASI Forum is not responsible for unso- management system, there were elements of SMS already in place. licited manuscripts, photographs, or other materials. Unsolicited materials will be 14 Accident Trends in Asia: returned only if submitted with a self-addressed, stamped envelope. ISASI Forum Major Improvements and Remaining Challenges reserves the right to reject, delete, sum- By Robert Matthews, Ph.D., Senior Safety Analyst, Federal Aviation Administra- marize, or edit for space considerations any submitted article. To facilitate editorial tion, USA—The author uses accident data, exposure data, and other standard avia- production processes, American-English tion measures to document where and to what degree positive change has or has not spelling of words will be used. occurred in Asia and comments on remaining challenges. Copyright © 2011—International Society of Air Safety Investigators, all rights reserved. Publication in any form prohibited without 19 No More Cheese Please: permission. ISASI Forum registered U.S. Accident Modeling from Symptom to System Patent and T.M. Office. Opinions expressed by authors do not necessarily represent of- By John Stoop, Delft University of Technology and Lund University, and Sidney ficial ISASI position or policy. Permission to Dekker, Key Centre for Ethics, Law, Justice, and Governance at Griffith University reprint is available upon application to the —The authors present a framework for safety enhancement based on a new view on editorial offices. human error, a dynamic systems engineering design approach, analytical foren- Publisher’s Editorial Profile: ISASI Forum is printed in the United States sic abilities, and institutional conditions for independent and qualified accident and published for professional air safety investigations. investigators who are members of the In- ternational Society of Air Safety Investiga- tors. Editorial content emphasizes accident investigation findings, investigative tech- DEPARTMENTS niques and experiences, regulatory issues, industry accident prevention developments, 3 President’s View and ISASI and member involvement and 4 V.P.’s Corner information. 26 ISASI RoundUp Subscriptions: Subscription to members 32 Who’s Who—A brief corporate member is provided as a portion of dues. Rate for nonmembers (Domestic and Canada )is profile of Curt Lewis & Associates, LLC US$28; Rate for nonmember international is US$30. Rate for all libraries and schools is US$24. For subscription information, call (703) 430-9668. Additional or replace- ment ISASI Forum issues: Domestic and Canada US$4; international member US$4; domestic and Canada nonmember US$6; and international nonmember US$8. About the Cover National Transportation Safety Board Chairman Deborah A.P. Hersman accepts honorary membership in the International Society of Air Safety Investigators from ISASI President Frank Del Gandio. Shown is the certificate plaque presented to Chairman Hersman. Photo: Esperison Martinez, ISASI Forum Editor

2 • ISASI Forum July–September 2011 PRESIDENT’S VIEW NTSB Chair Hersman Accepts ISASI Honorary Membership By Frank Del Gandio, ISASI President On April 14, I was privileged to present and the agency to meet that challenge, which benefits investigators have U.S. National Transportation Safety everywhere. Board Chairman Deborah A.P. Hersman ac- We have seen an elevation of the agency’s transparency by a cept an honorary membership in our Society. more prompt release of factual investigation information to the This is only the eighth honorary membership public both through the news media and through the opening awarded in 47 years. It is our first since 2001, of agency dockets to the public via the NTSB website. Board when Congressman James L. Oberstar was meetings and hearings are now not only open to the public, but presented the award. are also webcast, so anyone can listen and watch. In terms of The significance of this award to our society is embedded in accountability, the NTSB has become stronger, more efficient, ISASI’s creation in 1964 as envisioned by Joseph O. Fluett and and more Truman (Lucky) Finch, Society forefathers. Our first set of nimble in both by-laws established that “It is the policy of the Society of Air its domestic Safety Investigators to offer honorary memberships to those and interna- persons recommended…who have made outstanding contribu- tional roles. tions to air safety.” And while the Our presentation was made in the chairman’s 6th floor office “cooperation of NTSB headquarters in Washington, D.C., which offers a challenge” has view of Ronald Reagan Washington National Airport’s expan- brought closer sive airspace, which is continuously filled with airliners coming coordination and going. It is against this backdrop of our aviation world and support that I took great pleasure in awarding the title of honorary between the member in the International Society of Air Safety Investiga- agency and tors. Hersman is truly one of us, as demonstrated by her tena- accident cious and ever-persistent approach to safety. investigations Many persons may not recall that for five years prior to authorities accepting the chairmanship of the NTSB on July 28, 2009, she from other served as a member of the NTSB. In that time, she oversaw countries, 17 major transportation accident investigations. These events it has also covered all modes of transportation: airliners, emergency enhanced ex- medical service and sightseeing helicopters, business jets, pri- z E. M artine isting systems vate aircraft, light rail trains, freight trains, container ships, President Del Gandio presents Chairman of keeping recreational boats, school buses, and motor coaches. Since Hersman her certificate of honorary membership. families of ac- being sworn into office, she cident victims ISASI Honorary has become the public face informed and strengthened the agency’s “listening” role. Members of the agency’s investigators Chairman Hersman’s contributions to aviation safety and and investigations. her support of ISASI have been phenomenal. Her ability to HO0001—Alan S. Boyd In addressing our Soci- deal with a myriad of issues and tragedies, coupled with her June 1, 1965 (deceased) HO0002—Najeed E. Halaby ety’s annual seminar in 2009, tenacious approach to safety, identifies her as a true represen- June 1, 1965 (deceased) just seven weeks after being tative of the traveling public. She more than fulfills the lasting HO0003—Charles S. Murphy sworn into office, Hersman code etched on her certificate of membership, which reads: April 1968 (deceased) HO0004—Mike A.S. Monroney spoke of her self-imposed “Deborah A.P. Hersman is an honorary member of ISASI, May 14, 1968 (deceased) challenge to raise the bar of which is dedicated to promote that part of the aeronautical HO0005—Walter Tye three attributes she believed endeavor wherein lies the moral obligation of the air safety Jan. 1, 1969 (deceased) HO0006—Joseph J. O’Connell, Jr. were critical to the NTSB’s investigator to the public.” 1969 (deceased) mission and work: transpar- In presenting the certificate, I said: “You are the most ‘safety HO0007—James L. Oberstar ency, accountability, and motivated’ person I’ve seen in my 30-years of accident investi- April 27, 2001 HO0008—Deborah A.P. Hersman cooperation. It is a mark gation. Your approach to safety mirrors the aims of our Society; April 14, 2011 of her fidelity that she has therefore, I am proud to make you an honorary member of the been successful in leading International Society of Air Safety Investigators.” ◆

July–September 2011 ISASI Forum • 3 V.P. ’S Corner Reporting on My Washington Visit to the International Council By Paul Mayes, ISASI Vice President The main activity since the previous issue of The Council decided not to make changes at this time. ISASI Forum was my travel to Washington In an effort to retain members, one suggestion was to for the spring ISASI International Council reduce the dues for members who had reached retirement Meeting (ICM) on May 6. I also took the age and were no longer employed. For retired members, a opportunity to visit ISASI’s office in Sterling, 50% reduction in annual dues could be considered. There Va., and spend time with Ann Schull, our was mixed reaction to the proposal, including concern that office manager, and Tom McCarthy, ISASI’s there may be practical difficulties in deciding when a member treasurer. I encourage members to call on Ann in the office if has actually retired. I raised some ideas to reduce our costs, you are in the Sterling area. The office is the center of ISASI which included electronically distributing ISASI Forum operations, and I am sure Ann would be very pleased to meet and reducing the Proceedings to an electronic copy. Forum any of our members. currently costs about $50,000 to produce and distribute. But All Council members attended the ICM except Peter there was little support from the members for any significant Williams from NZSASI, who participated by telephone, and changes. Reducing the quantity of magazines printed for each International Councillor Caj Frostal, who was not available. edition would not significantly reduce the overall cost, and the The national societies agreed to fund the costs for their representatives’ travel to this meeting on this occasion, which ISASI had declined to do because of its current financial position. The day before the meeting, the Executive met and concentrated discussions on ISASI’s financial situation. The financial reports from Treasurer Tom McCarthy and President Frank Del Gandio were discussed at length, and the Executive was satisfied that we had a complete and accurate understanding of the current financial situation. The conclusion was that ISASI is very sound financially with extensive assets, but we will concentrate on building our cash reserves in the next 2 years. The ICM lasted all day (about 8 hours), and at times there were vigorous discussions. Frank pointed out that meeting ISASI International Council members’ travel expenses to the ICM is expensive (approximately $15,000) and asked once ISASI website home page (www.isasi.org) again whether we should be continuing with two face-to-face meetings per year or cut back to one. There was divided president was against reducing the number of editions from opinion, but eventually the Council decided that two face- four to three per year. to-face meetings should be the norm, although on occasion, I raised some ideas for increasing communications. Frank one may need to be a teleconference. Frank mentioned that agreed to produce a newsletter on a regular basis. There are the number of ISASI Fellows remains at a low level and several ideas for improving the website and making it more encouraged those who feel that they meet the eligibility friendly and informative. With 1,430 members in 67 different criteria to consider applying. Costs are $50 on application and countries around the world, the website is our shop front and $50 if and when accepted. should provide current information and news. I believe we I reported on a review I had commenced on how to build need to make significant changes so that it is can be the link our membership and the preliminary suggestions on how with all our members. to recruit and maintain members. There was considerable These will be some of several ideas to be canvassed from discussion about paying dues online directly to ISASI, but members in a membership survey I will be developing and national societies were largely against this. They normally sending out in the next few months. We want to get your ideas collect dues on behalf of ISASI and forward a consolidated and feedback on the Society so that we can determine ways list and payment to Ann. This allows the national societies to we can move forward. We need to utilize the latest technology maintain direct communication with their membership and in and ideas for communications and improve our services to some cases assist members by subsidizing part of ISASI dues. members. ◆

4 • ISASI Forum July–September 2011 Using Commercial Satellite Imagery in Aircraft Accident Investigation The authors evaluate the lated areas, this may come from police, air There is a wide range of satellites offer- ambulance, or even news helicopters; but ing images in the visible spectrum, all with current state of the art again, this will be absent in more remote different resolutions and characteristics. focusing on the needs and regions. Some agencies and organizations Table 1 shows some of the higher resolu- priorities of an accident may have arrangements that allow access tion satellites and the best resolution avail- to imagery from military satellites, which able from each. This indicates the smallest investigation and reporting may have different capabilities than com- dimension that can be resolved and hence on live trials conducted in mercial satellites. Following the loss of a lower number is better. Resolutions Cyprus in 2009. Flight 447, a request was made for the U.S. are shown for both panchromatic images

By Dr. Matthew Greaves (AO7700) Table 1. Available Resolutions of Commercial Satellites and Professor Graham Braithwaite *Subject to restrictions, see below. (MO3644), Cranfield Safety and Accident Investigation Centre, Satellite Panchromatic (m) Multispectral (m) Cranfield University, UK OrbView-3 1 4 IKONOS 0.82 4 (This article is adapted, with permission, EROS-B 0.7 - from the authors’ paper entitled The QuickBird 0.61 2.44 Use of Commercial Satellite Imagery in WorldView-1 0.5 - Aircraft Accident Investigation presented WorldView-2 0.46* 1.84* at the ISASI 2010 seminar held in Sap- GeoEye-1 0.41* 1.64* poro, Japan, Sept. 6–9, 2010, which carried the theme “Investigating ASIA in Mind—Accurate, Speedy, Independent, government to use satellite technology to (black and white) and multispectral (color and Authentic.” The full presentation, assist in the search for wreckage. However, and other bands). Clearly, the panchro- including cited references to support the there are often issues surrounding the matic resolutions are much greater than points made, can be found on the ISASI priority of acquiring this imagery and its the multispectral. One useful concept website at www.isasi.org.—Editor) subsequent access and use in the civilian when dealing with satellite imagery is that domain. As a result, attention has turned to of ground sample distance (GSD), which is n the majority of aircraft accidents, the use of commercial satellite imagery for the size of area on the ground represented the wreckage is easily located and is accident location and investigation. as a pixel at nadir (i.e., overhead). As Iaccessible to investigators; however, the viewing angle changes from directly there are notable exceptions. The loss of Commercial satellite imaging overhead, i.e., increasing off-nadir angle Air France Flight 447 over the Atlantic The availability and use of commercial (ONA), the available resolution reduces. Ocean in 2009 and Adam Air Flight satellite imagery has grown markedly in While satellite resolutions continue to 574, which crashed near Indonesia in recent years with no better demonstrator improve, the distribution and use of im- 2007, show the difficulty that can be than the ubiquitous Google Earth. How- agery from U.S.-owned satellites at better experienced in locating aircraft wreck- ever, acquiring this imagery on demand than 0.50 m GSD panchromatic and 2.0 m age. Similarly, the RAF Nimrod, which is not cheap, and therefore it is useful for GSD multispectral are subject to prior crashed in Afghanistan in 2006, and investigators to know what can potentially approval by the U.S. government. Without UTA Flight 772, which broke up over the be achieved by this technology. For exam- this approval, images at resolutions better Sahara Desert in 1989, both show that ple, it would be helpful to know whether, than 0.5 m will be resampled to give 0.5 wreckage can be difficult or even impos- say, a flight data recorder can be identified m resolution. While this approval may be sible to access due to either political or by a particular satellite before spending granted in the case of accident investiga- geographical constraints. many thousands of pounds acquiring tion and resolutions will continue to im- For these reasons, there has been an in- the image to order. While the published prove, it is at least feasible that resolutions creasing interest in the use of general aerial specifications of the imaging satellite can better than those currently offered will not imagery for the location and subsequent provide some of this information, they are be available in the near future. analysis of aircraft accidents. In more popu- not the whole picture. One useful technique aimed at maxi-

July–September 2011 ISASI Forum • 5 Figure 1a. Handheld image from helicopter of the grid.

ability of commercial radar imagery, albeit Table 2. Available Resolutions of at slightly lower resolutions. Table 2 shows Commercial Radar Satellites three of the commercial radar satellites available and their associated resolutions. Satellite Resolution (m) EO satellites are unable to image through RADARSAT-2 3 thick cloud, whereas radar does not suffer dling. The majority of current handheld COSMO-SkyMed 1 from the same limitation. This is particu- devices will not deal with a file this size. TerraSAR-X 1 larly relevant when considering that poor An additional complication arises from weather is a factor in many accidents. the file format. While it is often possible In general when obtaining satellite to specify the delivered format, the default mizing the information available from imagery of a particular location, it is pos- format can be, say, the National Imagery electro-optical (EO) imagery is that of sible either to purchase a pre-existing Transmission Format (NITF) rather than pan-sharpening, which can often be speci- “library” image or to task the satellite to the more common TIFF or JPEG. This fied when requesting the imagery. This acquire a new image. Clearly, while library means that the processing chain should involves fusing the color information from imagery is useful for planning, recovery, also be considered when acquiring imag- a multispectral image with the geometric visualisation, etc., it offers little to support ery as specialist software may be required information from the panchromatic im- the process of investigating the accident. to view the image. In some cases, further age, essentially yielding a high-resolution Therefore, if up-to-date imagery of the post-processing is required before any- color image. accident site is required, it will be neces- thing resembling an image is produced. Commensurate with this growth in EO sary to task the satellite to acquire specific These points are not raised to dis- satellites has been an increase in the avail- imagery. The speed with which this can courage the investigator, but rather to be done depends on a number of factors highlight the need to prepare for the Matthew Greaves is a including budget, priority, and satellite possibility of a need to use imagery in lecturer in the Safety orbit. However, as a general guideline, the future. Attempting to understand the and Accident Investi- the minimum time it would take to task different satellite parameters should not gation Centre at Cran- a specific image, from point of request be done while searching for a lost aircraft. field University. Prior to having the image, would generally be Therefore, it may be appropriate for a to joining Cranfield, he between 1 and 2 days. representative to engage with a satellite worked for the science Imaging satellites are scientific instru- imagery provider to establish a “standard” and technology organization QinetiQ. ments with a wide range of parameters set of parameters and a processing work- He holds an engineering degree and that need to be specified before acquir- flow before it is needed. a Ph.D. in aircraft engine noise and ing an image. An analogy can be drawn vibration. His research deals with the with SLR cameras where there are many Trial configuration application of technology to the accident modes and settings, some of which will To assess the potential utility of satellite investigation process. drastically affect the outcome of the im- imagery in aircraft accident investigation, age. While it is beyond the scope of this a trial was conducted in which known Graham Braithwaite article to discuss the specifics of acquir- targets were set out and imaged. The is head of the Depart- ing an image, parameters that can be trial was conducted in collaboration with ment of Air Transport adjusted include file type, imaging mode the UK Ministry of Defence (MOD), the at Cranfield Uni- (related to imaged area and resolution), UK Air Accidents Investigation Branch versity, UK. He was datum and projection, post-processing, (AAIB), and the Defence Science and appointed director of dynamic range, etc. It should be noted Technology Laboratory (DSTL). Cyprus the Safety and Acci- that just like the zoom lens on a camera, was chosen as a location for the trial due dent Investigation Centre in 2003 and most satellites can image a range of areas to the generally clear skies and the avail- awarded a chair in safety and accident (e.g., 5 km x 5 km, 10 km x 10 km, etc.) but ability of open space. investigation in 2006. Prior to this, he that an increase in area will often lead to Three test sites were set up: the first worked as a lecturer at the University a reduction in resolution. used accident-damaged aircraft compo- of New South Wales, Sydney. Graham Once an image has been acquired, it is nents (metallic, carbon fiber, and mixed holds a Ph.D. in aviation safety man- usually delivered as a digital file. Depen- materials) in representative terrain, and agement from Loughborough Univer- dent upon the size of the imaged area, the the second used a helicopter door and tail sity, and his research has focused on file size involved can be significant, e.g., boom floating at sea. The third site con- issues of safety, culture, and investiga- 1 GB for a 10 km x 10 km image, which sisted of a grid of objects of various sizes tor training. has implications with respect to file han- and materials including metal squares

6 • ISASI Forum July–September 2011 Figure 1b. Commercial satellite image (left). Figure 1c. Radar image of the grid (radar reflectors circled) (right).

x 0.5 m white square, a canopy section, and a pair of seats. Those targets that were deemed undetectable included a 0.5 m x 0.5 m black square, a 4 m x 4 m Perspex square, a helicopter rotor blade, and a flight data recorder. These results highlight the other factors that impinge upon the interpretability of an image. While the panchromatic GSD of 0.6 m gives an indication of the results that might be available, the results are also heavily affected by other factors such as the surrounding area, object color, viewing geometry, etc. It is interesting to note, for example, that the 2 m x 2 m black square is clearly visible occupying approximately ranging from 0.5 m x 0.5 m to 4 m x 4 m and the region of £10,000. 4 pixels by 4 pixels, but also is the 1 m x real wreckage, all for use as a “testcard” The TerraSAR-X image was acquired of 1 m white square occupying 2 pixels by 2 for the satellite. These sites offered an a 10 km x 10 km area in “spotlight” mode pixels, while the 1 m x 1 m black square is array of problems at the more challeng- giving a 1 m GSD. However, by the nature considered marginal. Because of the colors ing end of wreckage location and plotting. of its operation, the preferred range of present in the surrounding area, a white Clearly, finding an intact 50 m fuselage will acquisition angles for this satellite is 20° pixel is much higher contrast than a black be easier than a 4 m x 4 m square panel. to 55° with the trial image being acquired pixel, making it more prominent. All three sites were also surveyed by the at 48°. This acquisition angle results in a In order to test the geolocational ac- Joint Aircraft Recovery and Transporta- reduction in resolution to approximately curacy of the satellite image, 20 items tion Squadron (JARTS) using differential 1.5 m. The file was delivered as a complex were chosen from the grid, the location of GPS mapping. SAR image and was approximately 220 the item’s center was estimated, and the Two images were acquired of the site; MB in size. Analysis was performed using coordinates were noted, as displayed by an electro-optical image from the Quick- Radar Tools, an open source application. the software based on the geographical Bird satellite and a radar image from the The commercial cost of tasking this image information embedded within the image. TerraSAR-X synthetic aperture radar would be in the region of £7,000. These coordinates were then compared satellite (courtesy of infoterra GmbH). Figures 1a–3a show handheld imagery with the surveyed data. The QuickBird image was of a 10 km x of the three sites taken from a helicopter, Comparing the coordinates for absolute 10 km area, taken with a 0.6 m (panchro- corresponding pan-sharpened electro-op- accuracy (i.e., comparing merely the pre- matic) and 2.4 m (multispectral) ground tical images extracted from the QuickBird cise coordinates), the average error was sample distance at an average off-nadir image, and two images extracted from the 10.25 m for the easting and 3.56 m for the angle of 3°. The file was supplied in NITF TerraSAR-X image. northing with a maximum error of 10.80 2.1 format with a file size of 960 MB. The m and 3.7 5 m, respectively. Assessing image was requested at “assured” task- Analysis the relative accuracy (i.e., the distance ing level for a time window of Aug. 17–21, Each of the items in the grid was analyzed between items), the average error was 2009, and was acquired on Monday, August for interpretability by examining the im- 0.20 m for the easting and 0.08 m for the 17, at 08:42 GMT. (This is relevant because age and deciding whether it was distinct northing with a maximum error of 1.05 m painting of the target was completed at from the background, i.e., whether there and 0.23 m, respectively. approximately 10:00 GMT; a comparison was “something there.” No attempt was Given the distances involved from sen- of Figures 1a and 1b shows that the 4 m x made to interpret the detail of the item. sor to object and the potential errors due 4 m orange square is only three-quarters Of the 50 targets that were in the grid, to pixellation and center estimation, these completed and the other two “orange” 20 were clearly visible, 7 were marginal, accuracies are exceptional. Notwithstand- squares are unpainted and not raised!) The and 23 were undetectable. The clearly ing the issues of interpretability above, a file was viewed using GeoGenesis Lite, a visible targets included a 2 m x 2 m black typical maximum error of 20 cm would be free NITF viewer from IAVO. The com- square, a 1 m x 1 m white square, a tail deemed more than accurate enough for mercial cost of tasking this image, given panel, and a bulkhead (each 2 m x 1 m wreckage plotting from a distance. the assured tasking level and relatively approximately). The marginal targets One technique that is often referred narrow acquisition window, would be in included a 1 m x 1 m black square, a 0.5 m to in imagery analysis is that of change

July–September 2011 ISASI Forum • 7 detection. This involves taking a “before” image and comparing it to the “after” image in order to highlight any differences. This can either be done manually or in software. The manual approach may be Figure 2a. Handheld image from heli- as simple as viewing the two images on copter of the Harrier site. (Both wings the screen simultaneously and moving and tailplane circled.) them around in a synchronized way looking for differences or anomalies. While a find is, the more likely it will be found by Figure 2b. Commercial satellite image this method is labor intensive, it can be the analyst early in the process. of the Harrier site. extremely effective. Examination of the radar image of the The software approach uses algorithms grid highlights some of the difficulties of the wreckage from the surrounding scrub to compare the before and after image. working with radar. The five radar reflec- land. The wreckage visible in this image However, this technique works most ef- tors (laid out like the face of a die) are includes both wings, the rear fuselage, and fectively when using “matched” images, visible and circled in Figure 1c, as are both drop tanks from a Harrier. There are i.e., images taken from the same sensor, some of the other components including also many other smaller parts in the im- at the same resolution, with the same the tail plane. However, the resolution ages, such as pipes and a nose gear leg, but geometry with only differences of inter- is such that each item occupies no more these are only visible from the helicopter est present. than one pixel in size. This makes it very image when zoomed and are not visible on Clearly, since the next accident location difficult to interpret the image. the satellite image. is unknown, the likelihood of matched im- Figures 2a and 2b show the Harrier site. Figures 3a and 3b show the helicopter and agery being available is low. Therefore, au- While the bright blue parachute in the top satellite image of the sea site. The handheld tomated change detection was attempted left-hand corner of the image is clearly vis- image shows a helicopter tailboom floating in on the QuickBird image of the grid, with ible, comparison of the two images clearly the water and a red door on the beach. How- an image from the GeoEye satellite pro- highlights the difficulties in distinguishing ever, it is not possible to distinguish any of viding the reference from which to detect change. While it would be possible to ad- Figure 3a. Handheld image just the detection parameters in order to from helicopter of the sea highlight the areas of known change, the site (left). Figure 3b. Com- point of using this technology is to detect mercial satellite image of change where it is unknown. Therefore, the sea site (below left). Fig- the change detection was performed using ure 3c. Radar image of the standard parameters. Harrier and sea sites (below A piece of software called Matisse, right, sea site circled). written by DSTL, was used in an attempt to detect change. After performing the change detection, one of the panels in the grid was highlighted by the software as the most prominent change in an area of 700 m x 700 m around the grid. Expand- ing this to a 4 km x 3 km area resulted in the software highlighting the same panel as being one of the 50 most prominent changes in the scene. Clearly, this technique will not be used as a totally automated process, but rather as a way of highlighting possible areas of interest to an imagery analyst. Therefore, given the results above, it is feasible that an analyst may be able to process the changes highlighted in, say, a 10 km x 10 km scene in a day—although as the algorithm ranks possible detections, the more highly ranked

8 • ISASI Forum July–September 2011 of producing high- role to play in the analysis of this specific quality images with accident, it provides a valuable proof of a resolution 0.46 concept, particularly because it uses one m for panchromat- of the highest resolution commercial satel- ic and 1.84 m for lites available, WorldView-2. multispectral. In addition to the tra- Conclusion ditional red, green, The growth in commercial satellite imag- and blue bands, it ery means that access to imagery is widely also offers two near- available. However, as the discussion has infrared bands, a outlined, the tasking and acquisition of red-edge band, a this imagery is not trivial, with a wide Figure 4a. Wreckage trail and surrounding area. yellow band, and a range of factors and parameters to be coastal band. Us- taken into account. It would be prudent ing the latter band, for organizations that may wish to acquire WorldView-2 has commercial satellite imagery to contact the ability to per- an imagery provider in order to establish form bathymetry their typical requirements in advance of (measurement of requesting imagery. This is particularly depth in water). important if imagery is required quickly, The image in say, in response to an accident at sea where Figure 4a clearly buoyancy may be time limited. shows the wreck- Commercial satellite imagery is not yet age trail in the top of a quality to replace ground imagery or right corner. It also handheld imagery taken from a helicopter. shows the vehicles, However, the results of this trial and ex- tents, and access ample have shown that there is potential routes being used utility in commercial satellite imagery by emergency ser- for both wreckage location and wreckage vices and investiga- plotting in specific situations. However, Figure 4b. Wreckage trail enlarged. tors. It is clear from there are a wide range of factors affecting this figure that at performance that are outside the control the wreckage from the surrounding land or this resolution, a trained analyst could of the investigator, including wreckage the sea. Similarly, the resolution offered by easily identify this wreckage trail as the lo- and scene color, wreckage size, acquisi- the radar image in Figure 3c, coupled with cation of an accident. However, this image tion geometry, etc. The perceived risk of the noise and returns from the surround- represents an area of approximately 150 m a wasted collection posed by these factors ing area, make it impossible to identify any by 100 m. Clearly, at this magnification, the will obviously depend upon the situation wreckage and difficult to even identify the time taken to manually search, say, 20 km faced by the investigator. local geography. by 20 km would be considerable, although Future plans for research in this area in- not completely impractical. clude further trials into higher resolution Practical example Figure 4b shows the same image multispectral satellites and the possible On April 10, 2010, a Tupolev 154 aircraft zoomed on the wreckage trail with the use of radar and hyperspectral sensors crashed near Smolensk, Russia, killing all rear section of the aircraft in the center of for detection of fuel and oil patches for 96 people on board, including the Polish the image. Other footage of the accident location of accidents at sea. ◆ president. Satellite imagery of the accident site suggests this piece is of the order of site was acquired from the WorldView-2 10m in length, which is consistent with Acknowledgements satellite and archived. This imagery was the number of pixels depicting it. How- The authors would like to gratefully then provided to Cranfield courtesy of ever, unfortunately, this is clearly a high- acknowledge the support provided by DigitalGlobe for research purposes. energy accident resulting in significant the UK Ministry of Defence, the UK Air WorldView-2 is a high-resolution multi- destruction of the aircraft, and hence it is Accidents Investigation Branch (AAIB), spectral satellite and is one of the most re- difficult to distinguish many other parts the Defence Science and Technology cent commercial satellites available. It was of the aircraft. Laboratory (DSTL), and infoterra (UK launched in October 2009 and is capable Although satellite imagery had no and GmbH).

July–September 2011 ISASI Forum • 9 as a “class” of accident. I personally find this term inadequate as it tends to dehu- manize what are usually complex human Safety Reporting performance accidents. CFIT accidents involving commercial turbojet aircraft still occur. Figure 1 shows a declining 5-year And Investigation— average, but only in 2004 were there no recorded CFIT accidents. One of the advances since 1979 is the Cornerstone of SMS development of improved ground proximity warning systems, enhanced GPWS. Although the 1979 DC-10 crash on the slopes of The GPWS of 1979 that only gave an Mount Erebus occurred long before the concept of inadequate 6-second warning to impact in the Erebus case has been replaced by the an integrated safety management system, there EGPWS of today with its advanced terrain were elements of SMS already in place. awareness features. All the CFIT accidents over the last 5 years have involved By Paul E. Mayes, Vice President, ISASI aircraft without an EGPWS fitted. So the investigation of what happened (This article is adapted, with permis- damaged. Dennis Grossi from the National was relatively straightforward based on sion, from the author’s paper entitled Transportation Safety Board (NTSB) in the evidence from the DFDR. A service- The Contribution of Safety Reporting Washington, together with Milton Wylie able aircraft had flown into rising terrain. and Investigation to safety management from the New Zealand Air Accidents The question or questions were why, why, systems presented at the ISASI 2010 Investigation Office, arrived on site on why? These are often the most difficult seminar held in Sapporo, Japan, Sept. December 1 (2 days after the accident) and questions to answer because they involve 6–9, 2010, which carried the theme “In- after a few hours returned to New Zealand human beings and human performance. vestigating ASIA in Mind—Accurate, with the DFDR and CVR. The cockpit voice recorder, or more aptly Speedy, Independent, and Authentic.” As New Zealand did not have the facili- called the cockpit audio recorder, is often The full presentation, including cited ties to play back and analyze the record- the key to answering these questions, even references to support the points made, ers, they were taken to the NTSB labora- if the crew survives the accident. can be found on the ISASI website at tories in Washington, D.C. There the initial In the case of the DC-10, the CVR was www.isasi.org.—Editor) playback and analysis proceeded without configured to record the cockpit audio difficulty. The obvious conclusion was that signals in accordance with the FAA speci- ov. 28, 1979, was a very auspicious the aircraft had been fully serviceable and fications. One channel records the audio date for aviation safety. That’s the that this was a classic controlled flight picked up by the remote cockpit-area Nday of the worst aviation accident in into terrain (CFIT) accident. The term microphone centrally located on the flight the Australasian region—257 people lost CFIT has been used now for many years deck. The other three channels record their lives when a DC-10 impacted the slopes of Mount Erebus in the Antarctic. Figure 1 It was also a major impetus to changes in the way we investigate and analyze accidents. Many investigations are complicated by engineering or operational issues requiring technical expertise. This aspect has become even more of a problem for the investigation of accidents involving later- generation aircraft with advanced systems and technology. However, although the DC-10 was in 1979 still considered a very modern aircraft, the investigation was not confronted with such problems. The investigation on site was difficult due to the accident location on the slopes of Mount Erebus. But the investigation was relatively straightforward because the digital flight data recorder (DFDR) and cockpit voice recorder (CVR) were recovered almost un-

10 • ISASI Forum July–September 2011 SMS elements Underwater searches were required Although the Ere- for 26 aviation accidents over the last bus crash occurred 30 years. The searches lasted anywhere long before the from 3 days in the case of Alaska Airlines concept of an inte- Flight 261, which crashed in the Pacific in grated safety man- January 2000, to more than 200 days to agement system find the recorders in the Indonesian sea (SMS), there were in April 2008 from the Adam Air Boeing elements of SMS 737 accident. already in place. The Air France Flight 447 (Airbus One of these was an A330) accident in the Atlantic was the internal reporting most challenging as far as recovering the system. The cap- flight recorders—with three extensive tain of the previous searches before they were located and an sightseeing flight to estimated $40 million spent on the initial the Antarctic on No- two searches Alaska Airlines Flight 261 CVR recovery. vember 14, 14 days The research emphasis resulting from before the accident the Air France accident is on satellite tech- the radio transmissions from each of the flight, compared the coordinates of the nology to transmit critical safety informa- three pilot stations. In the case of Erebus navigation beacon at McMurdo and the tion from the aircraft. The idea of sending and many other investigations up to that waypoints that the flight crew had been real-time safety data to a ground station time, this arrangement of recording had given by the Navigation Department. He has been around for a while. Certain proved to be less than optimum. As radio discovered that there was a significant maintenance data are transmitted now, transmissions are not a factor in many distance between the two tracks, almost 30 and was in the Air France case. However, accidents, the investigations would rely nautical miles. He advised the Navigation technology does not currently allow large on the recordings from the one channel section, which during the night prior to the quantities of data to be transmitted due recording all the sounds from the cockpit- accident flight “corrected” the waypoints. to bandwidth and cost. When consider- area microphone; the determination of Unfortunately the captain of the accident ing that flight recorders have hundreds what was being said was often difficult and flight was not advised of this change and of parameters recording each second, to open to misinterpretation. was expecting the track to take them into transmit that data to a ground station In the Erebus case, although the back- the area of the McMurdo Sound rather becomes very problematic. ground noise was low, there were five than directly toward Mount Erebus. One suggestion is to send basic flight people on the flight deck, four flightcrew As was demonstrated at Erebus in information such as the heading, altitude, members and one flight commentator who 1979 and at many subsequent accident speed, and geographical location to a relayed information to the passengers on investigations, the prompt recovery and ground station on a regular basis. This is the progress of the flight and the sights analysis of the recorders are essential for an interesting suggestion as it mirrors the to be seen. Hence, the determination of the successful outcomes of complex inves- original flight data recording requirements what was said by which individual was not tigations. But many accidents occur over introduced in the 1960s, which were for a entirely without doubt. water, and the recovery of the recorders basic five or six parameters. These proved from the seabed becomes a major exercise. to be too limited for useful accident analy- Paul Mayes was the The location of the recorders, and in many sis. The easiest development would be to manager of safety inves- cases also the location of aircraft wreck- lengthen the duration of the locator signals. tigations and analysis age, depends upon the underwater locator It has been suggested that the specifica- for the Cobham Group device, which emits a sonar signal for 30 tion should be increased to 3 months. Operations in Austra- days when activated by water. Other options for satellite tracking, such lia and Papua New Since the mid-1970s, missing or dam- as EPIRBs, should be considered. Guinea. He is a Fellow aged recorders have only prevented a full Despite ongoing studies of the potential of the Royal Aeronautical Society and analysis of the accident in a small number for streaming data to a ground station a Chartered Engineer, a flight instruc- of major accidents. Out of more than during flight, the traditional onboard flight tor, and holds an ATPL. He served for 3,000 accidents involving Western-built data recorder will still be the essential tool 21 years as an air safety investigator commercial aircraft, fewer than a dozen for air safety investigation. The reasons with the Bureau of Air Safety Investiga- CVRs and FDRs have not been found ac- are the high costs of data streaming and tion, Australia, including head of air cording to the International Air Transport the massive amounts of data currently safety investigations and head of safety Association. And in most cases, enough recorded and often needed to understand systems and analysis. He was with wreckage was retrieved to piece together the complexity of aircraft systems. A Air New Zealand in Auckland, New a probable scenario, although this could recent study found that even with a 50% Zealand, where he held senior safety have taken many months and probably reduction in current satellite transmission management positions, including that did not result in a definitive conclusion of costs, the price tag for streaming data of aviation safety advisor for 8 years. why the accident happened. could be millions of dollars. Obviously, in

July–September 2011 ISASI Forum • 11 today’s financial environment this is not Reason’s work on causation and the de- completed after the end of a flight, at the most economic solution to the problem. velopment of his model is well known and home, or in the hotel. However, the technology is available, and has become a basic tool for investigations. Safety assurance is accomplished there are some military and commercial It is interesting that in talking to flight through flight data monitoring, line op- applications already in operation. So like crews from various backgrounds, most erations safety audits, and safety actions many of the advances in aviation safety, are familiar with the Reason model and from system improvement recommen- this may well become an accepted practice the so-called Swiss cheese analogy. dations. An operator’s SMS is an easy in the future. If James Reason was the innovation of target for investigators after an accident. Let’s return now to November 1979 the 1980s and 1990s, safety management Determining why the SMS failed is not and the implications for air safety inves- systems could be considered the next so easy. However, it has been reported tigation. The investigation was conducted stage in the development of improved that many smaller operators have met the in the established manner, collecting all safety of operations. For many of us, safety letter of the legislation by constructing a available factual information, using the management systems have been a way of SMS manual, in some cases supplied by resources of the U.S. NTSB, the Brit- life. It was not until ICAO defined safety external consultants. But the elements of ish AAIB, the equipment and aircraft management systems in 2005 that we SMS have not been rolled into day-to-day manufacturers, the CAA, and the various realized what had become relatively com- operations. Some of the reasons include organizations representing the company monplace for many of us. The regulations, cost and a reluctance to be open with and the staff. This resulted in a standard eventually introduced by the Australian the staff about safety issues. This must ICAO Annex 13 report and included a Civil Aviation Safety Authority as CAO change if the promise of SMS in reducing probable cause of the accident. 82.5 in 2009, defined the various elements accidents is to occur. For that time, there was nothing un- and the need for a documented SMS. If we return to the Air France accident, usual in this approach. However, a royal it has been reported that pitot failures had commission was appointed to enquire into Classic SMS been reported on the Airbus long-range the Erebus accident. This commission had It seems we are bombarded with informa- fleet. Air France had reported problems the advantage of not only the evidence tion about safety management systems to Airbus and Thales, the manufacturer from the investigation report but also the these days in everything we read in the of the pitot probes. The interim BEA mandate to call witnesses from all areas safety press and publications. The classic investigation report documents the his- associated with the aircraft, the aircraft SMS includes elements of safety occur- tory of the probe issues, yet the risk of operation, and the public. “By the time rence and hazard reporting and safety these failures did not appear to have the hearings of the commission had con- investigations. It could be argued that been recognized. There may have been cluded, every aspect of the disaster and without a good reporting culture, the many reasons for this. These reports, for its surrounding circumstances had been management of “safety” is almost impos- example, were only a small part of the total explored by counsel in considerable de- sible. If we do not know what is happening reports received regarding Airbus aircraft tail.” However, the circumstances of the on the flightline or in the hangar, then operations. The critical step in any SMS final stages of the approach without the we cannot make the necessary improve- is to determine the severity and risk level advantage of the CVR and DFDR would ments to reduce risk and improve safety associated with one or more reports and never have been known. levels. Managers and supervisors will be consequential potential for a catastrophic The airline witnesses who appeared in blissful ignorance of the real situation outcome. This is a fundamental step in a were intent on establishing pilot error as until a serious event occurs that cannot safety management system. the effective cause of the accident. This be ignored. There is no shortage of occurrence was not unusual even in 1979 and late in The ideal situation is that any safety reports and safety hazards identified by the 1980s. A review of reports from that hazard or safety concern is reported and staff. Although we encourage open report- time, for example, will show that “pilot action is taken to address these before ing of any safety concern, it is not always error” was still a common conclusion. they become an incident or accident. This successful. From my experience, for ex- However, the Erebus Commission went is the utopia of preventive or proactive ample, an operator of 40 jet aircraft could much further. It looked into the company safety. In practice, this is very hard to expect 1,000 operational safety reports decisions, policies, and procedures as well achieve as operational staff members per year. Of these, less than 5% would be as the actions of the board and the middle- usually have very little time for non- considered other than minor, low risk. The manager levels. This was perhaps one of operational tasks and do not perceive the most difficult task is how to ensure that the the first applications of the “Reason” model, benefit from reporting something “that reports that could be indicative of a criti- which did not come into practice for another did not happen.” cal failure, in the right circumstances, are 10 years or more. But it certainly began Changing the mindset is essential if treated with the appropriate level of re- the advances in air safety investigation SMS is to be successful. It is also greatly sponse. Risk ratings are used as the main where we looked back into the sequence of assisted if the reporting process is simple tool, but these are open to interpretation. decision-making, training, and basic human and readily accessible such as being able Experience and corporate knowledge can factors and human performance. Later this to submit a safety report during the cruise be essential in this process. Some types of became the standard for safety investiga- phase, for example. Electronic reporting occurrences have obvious risks and are tion through the work of James Reason and is ideal, but the use of paper forms is still rated reasonably consistently. Patrick Hudson, among others. widespread and effective. Forms can be However, other proactive (preemptive)

12 • ISASI Forum July–September 2011 safety concerns can be much harder to risk of a regulatory nature are also covered. guidance to the flight crew as they should. rate. The concern of a line pilot may be an It is also concentrating on auditing the With multiple failures or erroneous data isolated instance and then it becomes a operator’s safety management systems to inputs generating various confusing and difficult judgment issue. Very often these ensure that the operator carries out a full sometimes opposing signals, the auto- safety concerns are related to changes in and unbiased investigation so that safety mated systems should ideally review and procedures, processes, or documentation. lessons can be learned. advise the flight crew on the most optimum The investigation often finds that changed Analysis of serious accidents indicates response. management procedures were not fol- that many established aircraft operators Although modern flight decks make lowed or were incomplete. Communica- have exhausted the advances offered by a positive contribution to safety per- tions are the key, and they were lacking the earlier safety management strategies formance, pilots are not as practiced at in November 1979. developed in the late 1990/2000s and that manual flying as they used to be so that In Australia, the Australian Transport new ideas are needed. A step for the better flying aircraft that have reverted to raw Safety Bureau (ATSB) is the government in airline safety performance took place flight and navigational conditions becomes safety investigation agency that has a around the year 2000, but those advances too demanding in difficult situations. mandatory reporting requirement. Any have become entrenched. And while safety Since the year 2000, serious accidents accidents or serious incidents, as defined today is at an all-time high, improvements have frequently involved pilot failure by ICAO Annex 13, are immediately in the safety rate stopped in the mid-2000s. to manage situations that they should reportable including a death or serious The plateau marked a departure from a really have been able to handle success- injury, serious damage, or missing aircraft. century of aviation safety that had shown fully. The year 2009 was no exception. However, the ATSB also has a list of fur- a steady improvement since the Wright Examples include the Turkish Airline ther immediately reportable events that Brothers. Boeing 737-800 at Amsterdam, the Colgan include such things as airprox, violation of The review of accidents that occurred Air Bombardier Q400 at Buffalo, N.Y., the controlled airspace, taking off or landing in the year 2009 shows that most were FedEx Boeing MD-11F landing accident on closed or occupied runways, uncon- preventable. If accidents are analyzed by at Narita, Tokyo. Notice that we are not tained engine failures, fuel exhaustion, broad category, then runway excursions using the term “pilot error” but rather undershooting, over running or running and incursions, and loss of control, are the looking at the human performance issues, off the side of a runway among several main types of accidents in recent years. If the system designs, the training, and lack other event types. we look at runway excursions, the major- of understanding of the degraded states of The ATSB also has a class of reportable ity can be linked to poor decision-making, the automation. Hence, the lessons from events called routine reportable, which breakdown in SOPs, and poor CRM. Most Erebus in 1979 are still very much part of have to be reported. These include injuries, occur off an unstabilized approach, which safety investigation today. other than serious, other than serious dam- results in landing long and fast. If we look In aviation, we are very proud of our age, a ground proximity warning system back 10, 20, or 30 years, we see the same safety record and the advances in safety alert, runway incursion, and several other symptoms and the same results. Why over the years through technology and broad definitions related to aircraft per- didn’t the crew execute a missed approach improving human performance. We are of- formance, weather, loading, and air traffic rather than persevering with a bad ap- ten compared with other modes of travel, system events. The result is that the ATSB proach? The investigations have not had and depending upon how you analyze the receives around 15,000 notifications per the optimal outcome of safety actions to statistics, aviation comes out as the model year on average, 8,000 of which are acci- prevent these reoccurrences. for safety. However, as many analysts dents, serious incidents, or incidents. Dr. Tony Kern believes there is a need have commented, we may have reached However, the ATSB only carries out for check and training organizations to a plateau and further improvements may approximately 30 investigations per year. reinforce basic flying skills so that pilots be very hard to achieve. These potentially have greater systemic fly accurately and do not accept deviations In conclusion, in the 30 years since the safety issues and are usually extremely from target speeds, localizer and glide worst accident in the Australasian region, complex, with fleet wide or worldwide slopes, and the required stabilized ap- there have been many important advances implications. So less than 0.2% of reports proach criteria—basic flying skills we in technology, in systems, in understand- are investigated. Another 0.2% are pub- were all taught during our training. There ing, and in influencing human behaviors lished as Level 5 factual reports where is a train of thought that we are not as and in safety assurance. However, it ap- the operators’ investigation reports are diligent in our aircraft operations in an pears that we have reached a plateau in edited and published. automated flight deck as we were in the the quest for improved safety. We still With so many reports, there will be is- previous technology flight decks. have accidents that have the same ele- sues that warrant investigation but that What is beginning to evolve is the comments of many previous ones and should are not always obvious from one or two plexity of flying highly automated aircraft therefore have been preventable. There is reports. A robust effective analysis sys- when the automation starts to fail. What no shortage of reports, but the challenge tem is essential to filter out the reports is apparent from some situations is that for safety investigators is to have effective that can be indicative of a significant the failure modes and degraded status investigation findings and actions so that risk. The Civil Aviation Safety Authority of some automated flight decks can be we can eliminate accidents such as runway is taking a greater role in the process of very confusing. It would appear that the excursions, loss of control, and CFIT once safety investigation to ensure that events designs do not provide as much help or and for all. ◆

July–September 2011 ISASI Forum • 13 Accident Trends in Asia Major Improvements Remainingand Challenges The author uses accident data, exposure of change has been uneven. In a number of countries, improvement has been less impressive, while recent trends have gone in data, and other standard aviation measures to the wrong direction in a few countries. document where and to what degree positive change has or has not occurred in Asia and Defining “Asia” comments on remaining challenges. Terms like “Asia” or “Europe” often are defined slightly differ- ently by different speakers. A non-Asian country makes the point By Robert Matthews, Ph.D., Senior Safety Analyst, well. Aviation officials in Mexico often joke that their country Federal Aviation Administration, USA belongs to more regions than any other country. Some speakers include Mexico in North America, while others put it in Central (This article is excerpted, with permission, from the author’s America or the Caribbean or Latin America, or OECD—the paper entitled Accident Trends in Asia: Major Improvements Organization for Economic Cooperation and Development— and Remaining Challenges presented at the ISASI 2010 semi- countries (or not), or any of several other groupings. The same nar held in Sapporo, Japan, Sept. 6–9, 2010, which carried is true of certain countries that sometimes are included in “Asia” the theme “Investigating ASIA in Mind—Accurate, Speedy, and sometimes not included. Independent, and Authentic.” The full presentation, including Figure 1 illustrates the definition of “Asia” used in this article. cited references to support the points made, can be found on the It includes 29 countries with a variety of political and economic ISASI website at www.isasi.org.—Editor) systems, a broad range of wealth, and national populations that range from very small at one end of the scale to three of the everal aviation systems in Asia have had low air carrier world’s four largest countries at the other end of the scale. It accident rates for decades, including Japan, Singapore, is bordered from northeast to northwest by Japan, Mongolia, Hong Kong, and, depending on where the line is drawn, and Kazakhstan, on the west by Uzbekistan, Turkmenistan, and Malaysia. However, as recently as the early and mid- Afghanistan, the Maldives in the southwest, in the south by In- 1990s, accident rates in the rest of Asia were fantastically donesia, and in the east by the Philippines and several Japanese Shigh compared to the four countries noted above, or compared to islands further east. Though this is a fairly standard definition, rates in Western Europe and North America. That is no longer the it excludes what some define as southwest Asia (or “the Middle case. A number of countries in Asia have achieved enormous gains East”). Finally, for the sake of clarity, it excludes the continent in aviation safety and now have long-term accident rates that are of Australia, as well as New Zealand and the Pacific states. among the lowest in the world, and several other Asian countries are approaching that level. The most impressive improvements Changes in Asia’s accident record include China, South Korea, and Vietnam. Table 1 compares 5-year hull-loss rates for the 29 countries of On balance, aviation safety in Asia has become a good story Asia to the rate of a “control group” of countries long recognized to tell, but the good news is not shared by all countries. As we as setting a safety standard for the world, and then the rest of might expect with a geopolitical region as large as Asia, the pace the world, including Central and South America, Africa, the Middle East, much of central Europe, plus Australasia. From Bob Matthews has been with the FAA since 1990 through 1994, Asia had a hull-loss rate that was nearly 8 1989, where he has been the senior safety times greater than that of the control group and 38% higher than analyst in the Office of Accident Investigation the rest of the world. Note that Asia’s data for 1990–94 includes for the past 15 years. His previous professional Japan, which then was, by far, the largest system in Asia, plus experience includes 9 years in national trans- Hong Kong and Singapore, all three of which had already estab- portation legislation with the U.S. Department lished safe systems. Without those three systems, the rest of Asia of Transportation, 2 years as a consultant exceeded the hull-loss rate of the control group by more than with the European Union and the Organization of Economic 10 times and nearly doubled the hull-loss rate in the rest of the Cooperation and Development in Paris, and several years as world. By 2005–2009, just 15 years later, the ratio for Asia was an aviation analyst for the Office of the Secretary at the U.S. just a bit more than four times the rate for the control group and, DOT. His academic credentials include a Ph.D. in political instead of exceeding the rate for the rest of the world by nearly economy from Virginia Tech’s Center for Public Administra- 40%, it was just less than half the rate for the rest of the world. tion and Policy Analysis, and he has been an assistant profes- Though the improvement indicated above is dramatic, the sor, adjunct at the University of Maryland since 1987. aggregate data presented for all 29 countries obscures several

14 • ISASI Forum July–September 2011 Table 2. 10-Year Rates for Selected Groups of Countries Per Million Aircraft Departures, 1990–99 and 2000-09 1990–99 2000–09 Hong Kong, Japan, Malaysia, and Singapore 0.29 0.10 China, RO, and Vietnam 3.68 0.287 India, Taiwan, and Thailand 4.00 1.53 Indonesia, Pakistan, and Philippines 4.78 3.66 Central Asia (six countries) 10.59 5.20 Control Group 0.55 0.34

the control group. Over the next decade, their combined rate was slightly lower than the rate for the control group. That is a very Figure 1. Definition of Asia for this paper: 29 systems— impressive change. excludes southwest Asia (“Middle East”). Vietnam had a very high hull-loss rate in the 1990s, followed by no hull losses the following decade. The high rate of the 1990s involved three hull losses produced by a very small system. Though Table 1. Hull Losses per Million Aircraft Departures the system remains relatively small, it has grown from fewer than 5-Year Rates, Asia Compared to Control Group and the 15,000 flights in 1990 to nearly 100,000 flights today. That rapid Rest of the World growth coincided with a sharp improvement in safety. 1990–94 1995–99 2000–04 2005–09 Much of that improvement came partly from upgrading the Asia 4.61 2.91 1.42 1.52 fleet, but some of it came as one benefit of opening up to foreign Control Group 0.61 0.51 0.33 0.35 investment. Though Vietnam continues to struggle with the policy Rest of World 3.35 3.90 3.70 3.07 issues related to foreign investment and “foreign” brand names, Control Group consists of Canada, USA, and the EU-15. the infusion of others’ experience has contributed. The improvement achieved by South Korea may be even more great success stories. Table 2 consolidates the data shown above dramatic than Vietnam’s. From June 1991 through December into two 10-year periods for selected groups of countries. The 1999, South Korean operators had eight hull losses in a system table presents a telling story, supported by the data in Figure that then averaged fewer than 200,000 flights per year. Most of 2. Figure 3 presents a similar decade-to-decade comparison for the eight accidents could qualify as egregious accidents, including selected, individual countries. three fatal accidents that killed a total of 304 people. Table 2 shows that in the 1990s, the four countries identified South Korea’s Civil Aviation Safety Authority (CASA), along earlier as having long established good safety records (Hong Kong, with its major carriers, KAL and Asiana, undertook an active Japan, Malaysia, and Singapore) already had combined hull-loss effort to ensure appropriate training and establish and adhere rates that were only about half those of the control group. Over to good standard operating procedures. The government and the next decade, those four countries compiled a hull-loss rate that the industry also moved away from relying on punishment as a was just 30% of the rate for the control group. In short, these four response to incidents or accidents, such as transferring authority countries already had set the world’s standard for aviation safety in selected, lucrative markets from one airline to another after an in the 1990s, only to extend the margin that the standard already incident. Instead, CASA upgraded its own staff and implemented had enjoyed compared to the rest of the world. more contemporary analytical procedures to improve safety Japan, in fact, has not had a major fatal accident since 1985. throughout the system. With the world’s sixth largest system measured by aircraft A closely related factor was pressure from the market. Both departures, Japan’s only hull loss in 25 years occurred in 1993 the U.S. FAA and the European Union, particularly the United when a DC-9-41, operated by the former Japan Air Systems, Kingdom, restricted Korea’s access to their markets until safety landed hard at Morioka-Hanamaki Airport. In that accident, all improved. Simply put, the loss of access to the world’s biggest 76 occupants evacuated without injury, but a fuel leak led to a markets will get the attention of most companies. Simultaneously, fire that eventually destroyed the aircraft. During the same two international alliance and code-share partners pressed Korean car- decades, Hong Kong had zero hull losses, and Singapore had one riers to upgrade safety and actively participated in the effort. major accident at Taipei in October 2000, which was the lone fatal The results have been dramatic. After eight hull losses in just accident since 1972 from either Hong Kong or Singapore. Each 9 years, South Korea has had no hull losses for the past 11 years, of those systems is considerably smaller than Japan’s, but they despite system growth of more than a third over that period. produced nearly 4 million flights over the 20 years. To everyone’s credit, Korea’s CASA and its carriers continue to invest resources and their administrative energies to ensure The most dramatic changes that the improvement is permanent. The story is perhaps most dramatic for the second group dis- Finally, China is perhaps the best recognized success story. played in Figure 1 and Table 2 (China, South Korea, and Viet- Aviation and aviation safety have changed so dramatically in nam). Those three countries combined for a hull-loss rate in the the past two decades or so that the change is hard to overstate. first decade that was nearly seven times higher than the rate for The early signs of change occurred in the 1970s when China first

July–September 2011 ISASI Forum • 15 rate among the control group. The magnitude of that turnaround is simply stunning. See Table 2 and Figures 2 and 3. The truly impressive part of this improvement in safety is that it has been achieved during very rapid growth in the system. Through the 1990s, China’s airline fleet increased by an average of 13.3% per year, a pace at which the fleet would double every 5.5 years. In the following decade, the rate of increase averaged a comparable 11.9% per year, with the fleet doubling every 6 years. As one might expect, the number of revenue flights has increased at a comparable pace over the past two decades, averaging 12.1% per year. China’s aviation system has had a sustained and rapid growth. Figure 2. Hull Losses Per Million Aircraft Departures, In 1990, the system had fewer than 300 aircraft and generated All of Asia Versus Control Group* about 250,000 flights. These figures made China the 16th largest *Control group consists of EU-15 plus USA and Canada. Rest of world system in the world at that time. By 2005, China’s system was includes South and Central America, Caribbean, central-eastern Europe, the second largest in the world by either measure. “Middle East,” Africa, Australia, New Zealand, and Russia. Rapid growth in any nation’s aviation system can pose safety challenges. Yet China’s aviation system has sustained a blistering purchased a small number of Western-built aircraft, starting rate of growth while simultaneously achieving nothing short of with Vickers and a small number of Tridents, followed by larger a revolution in safety. That combination is the truly impressive purchases of Boeing aircraft and more Tridents, and eventually achievement. Yet, the rapid growth is part of the explanation for Airbus aircraft. By the early 1990s, China had undertaken a the improved safety. Not only did China retire its older, mostly conscious effort to retire most or all of its older, Soviet-era fleet Soviet-built fleet, but it continued to accelerate the introduction and upgrade the fleet, again with Boeing and Airbus products of ever-advancing state-of-the-art avionics and automation. That and, later, Embraer and Canadair products. All these changes alone ensured a significant improvement in safety. Add the other were accompanied or followed by significant investments in efforts that China undertook, noted above, and the net result is satellite-based air traffic control technology and a major effort a hull-loss rate that once was simply an embarrassment to one to construct new airports throughout the country. that, today, many countries must view with more than a little Different people may offer somewhat different time lines, but envy, and certainly a fair amount of respect. the profound change arguably began with a major structural change in the 1980s, when China’s government reorganized the Countries with more modest improvement airline services operated by the Civil Aviation Administration of India, Taiwan, and Thailand constitute a third group within Asia China into regionally based carriers. By the late 1990s, China where hull-loss rates registered significant but more modest restructured its industry again by consolidating the industry improvement than the successes noted above. Combined, India, around three successful carriers. China Southern, which is Taiwan, and Thailand achieved a 62% reduction in their hull-loss China’s largest airline, eventually absorbed China Northern, rate in 2000–2009 compared to the 1990s. However, even with China Xinjiang Airlines, and Urumqui Airlines, as well as several such a substantial decrease, since they started with very high subsidiaries of those former carriers, and it has a controlling rates, their combined rate for 2000–2009 remains well above ei- interest in Xiamen Airlines. In the same period, China Eastern ther the control group or the seven Asian countries noted above. absorbed China Northwest Airlines, China Yuan Airlines, and In addition, though Figure 3 shows all three countries achieved Great Wall Airlines. China Airlines, which already had been significant gains decade to decade, the hull-loss rates increased structured as China’s long-haul overseas carrier, remained based in two of the three countries in the past 5 years (2005–2009). in that market and absorbed China Southwest Airlines. Taiwan achieved the most sustained improvement among Safety was a significant part of the rationale for the latter these three countries, and for reasons similar to those that help restructuring. In addition to restructuring its airline industry, to explain the positive changes in China and South Korea. Be- China, much like South Korea did, also took strong action to ginning around 1997, Taiwan’s authorities accelerated its active ensure proper training and the establishment and adherence oversight of the industry. Regional airlines, such as Formosa to good standard operating procedures. China simultaneously Airlines, were among the early targets, but China Airlines quickly accelerated its fleet modernization, which introduced state-of- followed. Aircraft and selected crewmembers were grounded the-art automation, avionics, etc. or suspended for various periods, and the authorities initiated a The net results have been dramatic. Throughout the 1980s and sustained effort to improve crew training and the establishment into the very early 1990s, China averaged two air carrier hull losses of good standard operating procedures. per year in an era when annual volume in China was the equivalent Taiwan also established its Aviation Safety Council (ASC). of about 1 week of exposure in the U.S. At that pace, we can only The ASC was responsible for regulation and accident investiga- imagine the reaction if the U.S. were having a hull loss every week. tion, but it also significantly upgraded the role of analysis and However, in the 1990s safety improved substantially in China, monitoring of trends. though its hull-loss rate still was six times greater than the hull-loss However, Taiwan’s improvement also was influenced by pres- rate among the control group. However, in the past decade of 2000 sure from other aviation regulators. Much like South Korea, through 2009, China’s hull-loss rate was slightly lower than the Taiwan’s carriers found themselves either excluded from major

16 • ISASI Forum July–September 2011 regulatory structure to ensure a more independent and stronger regulator. Nevertheless, judgment on long-term improvement needs to wait. In Thailand, the system expanded rapidly in the early 1990s, stagnated briefly, and then expanded rapidly again from 2000 through early 2007. Since then the system has contracted by about 15%. Like other countries, Thailand has had several new carriers enter and exit the system, and had to cope with the Asian financial crisis of the late 1990s and then the SARS scare. However, political uncertainty probably is the greatest current source of erratic growth patterns in the industry.

No improvement or marginal improvement Figure 3. Change in hull loss rates, selected groups of systems, Figure 3 shows that the accident rate actually deteriorated in 1990–1999 (left) and 2000–2009 (right). recent years in significant parts of Asia or improved only marginally. The hull-loss rate in the Philippines improved slightly markets or found that future growth was precluded due to their from 4.5 per million departures to a still very high 3.8 per mil- high accident rates of the 1980s and mid-1990s. Those restrictions lion. Elsewhere, Indonesia’s hull-loss rate increased slightly in major markets helped Taiwan focus its attention. from an already high level of 5.4 per million departures to 5.8 This did not prevent the takeoff accident at Singapore in October in 2000–2009, while Pakistan’s rate jumped from 2.7 to 8.15 per 2000, which killed 83 people. However, that is Taiwan’s most recent million departures. In the six countries of central Asia, the rate fatal passenger accident. Taiwan’s hull-loss rate has improved in improved by exactly half, from a very high level of 10.6 hull losses each 5-year period. The rate for 2005–2009, at 0.8 hull losses per per million flights to 5.3 per million. million revenue flights, was 83% lower than in 1990–1994. If Taiwan Indonesia’s rates increased in the second half of the 1990s, and sustains its steady improvement, it soon will approach the very low then increased again over the past 5 years. In the Philippines, rates enjoyed by the seven Asian countries noted above. the rate also increased in the latter 1990s but increased again in The hull-loss rate in India improved sharply through the early 2000–2004, albeit marginally, then decreased in the past 5 years. 2000s, leading to glowing commentaries similar to those about But the rate remains very high compared to all the countries China’s improvement. As with China, some of the improvement discussed above. Pakistan had no hull losses for 6 years (1995 was explained by fleet modernization, with the government seek- through 2000), but its rate inflated again in 2000–2004 and re- ing to establish a 5-year cap on the age of passenger aircraft. mains very high. India’s system has expanded rapidly since 2003. Prior to that, Finally, the six countries of central Asia show an erratic pattern its system, measured by aircraft departures, doubled from 1990 for rates over the two decades. Part of that is the problem of small to 2003. The pace of growth in that period, which averaged about numbers. A single accident or the avoidance of a single accident will 5.3% per year, was not dramatically higher than the increase ex- significantly affect the computed rates for this region. Neverthe- perienced in much of the world in that era. However, since 2003, less, other factors help to explain the erratic pattern. For example, the system has expanded rapidly, averaging about 13.8% per the rate for 2000–2004 is only a small fraction of the rate for the year. Yet, despite this growth, India still generates just 4 million periods 90–94, 95–99, 05–09, with a sharp increase once again in passengers per year in its domestic system, or about 2 days of the past 5 years. To a large degree that pattern reflects the virtual passenger traffic in the U.S. Growth in supply has outstripped disappearance of aviation activity in Afghanistan from 2000 to 2004, demand, creating excess capacity in many domestic markets, followed by the reemergence of limited civil aviation activity in while leaving other markets underserved. 2005–2009, accompanied by the reemergence of accidents. India’s growth has created other challenges as well. New carriers have entered the market, some of which were short-lived, Summary of trends while others prospered and then encountered hard times, such as Several national systems in Asia have had good safety records for Kingfisher and Jet Airways, which now cooperate through a rather a long time, and their fatal accident rates continue to be among close alliance. In the meantime, India’s former domestic trunk car- the lowest in the world. They include Japan, Hong Kong, Malay- rier, Indian Airlines, has been absorbed by Air India, with many sia, and Singapore. China, the Republic of Korea, and Vietnam of the normal difficulties of any large airline merger. have achieved dramatic improvement and have joined this club, Though a cause-and-effect relationship may or may not exist, while Taiwan/Chinese Taipei is rapidly approaching this level. the improvement in India’s accident rate has been reversed in However, the pace of improvement has been slower elsewhere or recent years. A spike of non-fatal hull losses in just more than 4 in some cases it has been negative. In short, the pace of change years began in October 2005. That spike was followed shortly by has been somewhat uneven, but the overall story is good. the India Air Express accident in May 2010, in which 158 people died. Though that accident is not part of the rates computed for Remaining challenges this work, it dramatically makes the point that the sharp improve- Asian countries that have long enjoyed safety civil aviation sys- ment in rates has reached at least a temporary interruption. tems and those countries that have achieved impressive gains in The good news is that India has responded by developing the past decade or so generally will continue to enjoy the benefits comprehensive aviation legislation and by reorganizing its of a civil aviation system that becomes increasingly safer. How-

July–September 2011 ISASI Forum • 17 ever, this will not come without some challenges. Many of those increased competition from other modes of transport. Though challenges will occur within the domain of the aviation community, airport investment has been nothing short of dramatic, it pales but some will come from the broader economy. The aviation com- compared to China’s recent and continuing investment in rapid munity will be able to act upon some challenges, but others are rail and roads. Rapid intercity rail already is shifting travel external to aviation. The mix and severity of challenges will vary, from air to rail in some interurban markets, with corresponding but most systems face one or more of the following: reductions in airline capacity in those markets. Roads eventually • Adequate domestic workforces. Countries with rapidly also will become a major modal challenge within certain markets, expanding systems will have to meet an equally rapid increase depending on the time and distance between cities. in the demand for pilots, controllers, mechanics, and managers, China, like several other countries, also is entering the field of which in turn will place demands on or be affected by educational civil aircraft manufacturing. New domestically produced turbo- systems, demographics, and access to the economy enjoyed by props and regional jets, and the spin-off technological benefits to the entire population. the entire economy, are clearly an opportunity for China. However, • Competing demands for national resources where human entry into that market requires the development of a basically new development needs are great. regulatory capacity in design, production, and continued airworthi- • National challenges of basic governance and stability. ness. That challenge will not be unique to China, as other Asian These issues are or have been resolved in some countries, but countries also are preparing to enter that market. are chronic or newly emerging in others. Even the recent boom in airport construction has introduced • Rapid expansion of low-cost carriers (LCC). Though LCC risk, with serious doubts about some airport locations. Those inherently suggests nothing more than an alternative business doubts likely will be part of the ongoing investigation into the model, it implies nothing more than a business model that need recent Henan Airlines accident at Yichun Lindu Airport in not have any inherent implications for safety. Nevertheless, the northeastern China, where an Embraer E190 flew into terrain LCC expansion also implies some level of overall volatility, the in heavy night fog. Site selection for that airport had become possibility of rapid entry and rapid exit from the industry, and the controversial months before the accident, when China Southern possibility of rapid growth for some successful LCC operators. abandoned night flights into the airport. All this, in turn, imposes challenges of resource allocation on the Conversely, with continued rapid growth ensured for at least regulator, the ability to reallocate those resources quickly in re- the next decade if not more, China could be challenged to pro- sponse to entry, exit, and expansion, and a general sense of scale duce the broad range of professionals that any large, modern for the regulator as the sheer number of operators expands. aviation system requires, from pilots and air traffic controllers • Entry by several countries into the manufacturing of air to managers, mechanics, etc. China soon will have to meet this transport aircraft (China, Japan, and India), while some coun- challenge just as its working-age population begins to decrease. tries are significantly expanding their presence in the mainte- Most demographic projections cite 2014 or 2015 as the watershed nance and overhaul industry (Singapore and Malaysia). All this year when that decrease is likely to begin. Total population could is a great opportunity, but it also requires the development of decrease by as much as one-third in the following several decades, a basically new regulatory capacity in design, production, and as India, with the opposite demographic future approaching in continued airworthiness. the next couple of decades, likely surpasses China as the most • Getting ready in some countries for growth in general populous country by about 2030 or sooner. aviation, such as a small but rapidly growing civil helicopter China’s aviation system also could face challenging demands market in India and a promising market for corporate aviation for resources in other sectors of the economy. Despite the truly in China. Again, this is an opportunity, but it also requires the impressive gains in national wealth, China, in fact, remains a development of basically new regulatory capacities, plus a shift fairly poor country, with a GDP per capita that ranked 102nd. in operating environments. The challenge, of course, will be to expand the benefits of the • Aviation infrastructure. As or if systems continue rapid ex- recent growth further down into the population, especially the pansion, which everyone expects will be the case, some countries rural population. may have difficulty keeping pace with the demands on aviation Yet, if China succeeds in this challenge, and few concrete rea- infrastructure. The recent accident in China is a case in point sons exist to suggest China will not succeed at least somewhat, as is the recent Air India Express accident at Mangalore. At the aviation industry would benefit from an increase in the share Mangalore, the aircraft landed 5,000 feet down an 8,000-foot of the overall population that could then afford to fly. In short, runway, overran at high speed, and traveled down a steep em- the aviation industry in many countries might envy China for bankment at the end of the runway. The same accident in many having such “problems.” In the end, despite real challenges, the richer countries likely would have occurred with a longer runway next decade or two should continue to be an impressive period remaining after touchdown and with an overrun area or at least for aviation in China. The same may be true of Asia’s aviation the absence of obstacles at the runway end. Though the result in system in general over the next decade or two. a richer country may not have been benign after landing so long and so fast, it likely would not have produced 158 fatalities. Conclusions China, where some of the most dramatic improvement has Asia has achieved dramatic improvement in aviation safety over the taken place, may provide the best single example of how many past decade to 15 years. However, like any other region, improve- of these challenges might interact. First, airline travel, though ments in Asia have been uneven. Yet, despite different challenges certain to continue expanding at impressive rates for another that face different countries, Asia has a good story to tell, and the decade or so, eventually will flatten out as the industry faces story should continue to get better for the foreseeable future. ◆

18 • ISASI Forum July–September 2011 (This article is adapted, with permis- from formal analytical methods. Much of sion, from the authors’ paper entitled No More Cheese the accident data are conceptually flawed Limitations of “Swiss Cheese” Models because of the inadequacies of underly- and the Need for a Systems Approach Please ing accident models in existing programs presented at the ISASI 2010 seminar (Benner, 1985). Due to these pragmatic held in Sapporo, Japan, Sept. 6–9, 2010, objections, during the conduct of an in- which carried the theme “Investigat- vestigation, the limitations and mutual ing ASIA in Mind—Accurate, Speedy, Accident dependence between causation model and Independent, and Authentic.” The full investigation methods should be explicitly presentation, including an index of taken into account. (Kletz, 1991; Sklet, cited references to support the points Modeling 2004; Katsakiori et al, 2008). made, can be found on the ISASI web- Over a period of about 20 years, the site at www.isasi.org.—Editor) Swiss cheese model of Reason has gained From popularity among many accident investi- lthough accident models have gators and has become a benchmark of been applied on a large scale in investigation practices. In particular, the practice, a reflection on their transformation of the concept of hazards, methodological assumptions, Symptom mitigation strategies, and managerial scope,A and deficiencies reveals several intervention capabilities into a commu- schools of modeling. Several surveys in- nication metaphor has supported the dicate consecutive generations of models, To System dissemination, providing transparency their poor methodological basis, absence into risk management for lay people and of a systems approach, and a focus on The authors present a frame practitioners (see Figure 1). the application of models by lay people work for safety enhancement (Benner, 1975, 1985, 1996, 2009; Sklet, based on a new view on human The Reason model 2004; ESReDA, 2005). The first accident error, a dynamic systems The widespread application of the meta- causation models, as derived by Heinrich, phor, however, also has raised concern referred to accident analysis by meta- engineering design approach, from a scientific perspective and has raised phors, such as the Iceberg Principle and analytical forensic abilities, questions on the application as an ana- Domino Theory. In a second generation, and institutional conditions lytic tool during accident investigations Bird and Loftus applied a linear causality, for independent and qualified (Dekker and Hollnagel, 2004; Leveson, while Kjellen introduced the deviation 2004; Young, Braithwaite, Shorrock, and concept. Multi-causality was introduced accident investigations. Faulkner, 2005; Dekker 2006). Also Reason by Reason, defining accident as an inter- By John Stoop, Delft University of and Wreathall, who created the metaphor, action between latent and active failures; Technology and Lund University, have some concerns about the practical and in order to avoid such interaction, a and Sidney Dekker, Key Centre application as an analytic tool. proactive involvement of top management for Ethics, Law, Justice, and Concerns of the Swiss cheese metaphor is needed. Governance at Griffith University applied as an investigation model can be Based on attribution theory, Hale and categorized as Glendon were concerned about how people accident modeling based on the Reason • Remote factors have little causal speci- process information in determining the model proved difficult to apply, resulting ficity, are mostly intractable, and have causality of events. They focused on the in an increasing amount of varieties and no predictive potential. Their impact is non-observable elements of the system: simplifications (Sklet, 2004). shared by many systems and shift error perceptions and decisions. While Reason Most of the models restrict themselves up the ladder and do not discriminate be- developed his model on organizational to the work and technical systems levels tween normal and deviant system states or accident causation, a next step was taken and exclude the technological nature and take system dynamics into account. by Hollnagel, who identified the system development of the inherent hazards. • There are no stop rules in the expan- as the full context in which errors and Sklet concludes that accidents occur. this means that in- A gradual development of accident mod- vestigators, focus- eling shows three generations of human ing on government error modeling, from a sequential accident and regulators in model via human information processing their accident inves- accident models toward systemic accident tigation, to a great models (Katsakiori et al, 2008). The evolu- deal need to base tion expands the scope of the investigation their analysis on ex- from sequencing events toward a repre- perience and practi- sentation of the whole system (Roelen cal judgment, more Figure 1. Reason’s “Swiss cheese” model et al, 2009). In practice, however, such than on the results of organizational accidents.

July–September 2011 ISASI Forum • 19 sion of the scope. The more exhaustive Rather than allocating the cause of an Do we actually have adequate models of the inquiry, the more likely it is to identify accident to human error by complacency, accident causation in the present dynamic remote factors. As such, it is a represen- loss of situational awareness, or loss of society, he states that modeling is done by tative of the epidemiological school of control, the analysis could focus on falsifi- generalizing across systems and their par- thinking, dealing with a linear agent-host- able and traceable assertions, linked to ticular hazard sources. Risk management environment model. features of the situation and measurable should be modeled by cross-disciplinary • It assumes technology as a constant, and demonstrable aspects of human per- studies, considering risk management and focuses on barriers, rather than formance (Dekker and Hollnagel, 2004). to be a control problem and serving to hazards, reducing risk management to Rather than focusing on hypothetical represent the control structure involving a control issue, not a systems adaptation intervening variables, more manifest all levels of society for each particular and redesign issue. It lacks resilience and aspects of behavior should be recorded hazard category. This, he argues, requires adaptation on the level of systems archi- during an investigation. While accuracy a system-oriented approach based on func- tecture and configuration. and comprehensiveness are rarely criteria tional abstraction rather than structural • It does not deal with uncertainty and for explanations, plausibility and credibil- decomposition. Therefore, task analysis knowledge deficiencies, nor does it take ity are. In addition, it becomes a necessity focused on action sequences and occasional into account the variety of operational to shift the focus from the performance of deviation in terms of human errors should conditions and systems states expressed in an individual toward the performance of a be replaced by a model of behavior-shap- an encompassing operating envelope. As joint system, according to the principles of ing mechanisms in terms of work system such, the model is linear and single-actor systems engineering. constraints, boundaries of acceptable based in its control potential, not taking The analysis should look at the orderli- performance, and subjective criteria guid- into account a systems perspective and a ness of performance rather than the men- ing adaptation to change. System models multi-actor environment. tal states of operators. If such an orderli- should be built not by a bottom-up aggre- • The model is normative and deals with ness of performance breaks down, this can gation of models derived from research in implicit standards of performance by be the start of further hypothesizing and the individual disciplines, but top down, compliance with rules and regulations and investigations. This raises questions about a normative concept of failure instead of the rationale of why the performance John Stoop is interested recovery and reliance on human perfor- seemed reasonable to the operator at the in accident investiga- mance capabilities. time of the event (Dekker, 2006). Such a tions in relation to Similar to a technical toolkit for repair- shift toward the systems level in identify- engineering design and ing technical systems, an accident inves- ing new knowledge during air crash inves- safety management, tigator has to be able to choose proper tigations has been proposed by Benner, focusing on the develop- methods, analyzing different problem applying an event-based analysis, defined ment of accident inves- areas (Sklet, 2004). This raises the issue in terms of relations among events, set in tigation methodology. He cooperated of ethics involved in selecting an investiga- a process and operating context. Such an with RAND Europe on the development tive method. It is of particular significance approach permits a distinction between of a conceptual model for independent that hypotheses can be validated and knowledge of systems processes and their multimodal safety boards and was falsified during the investigation process. operation and knowledge of the accident involved in establishing the safety board If not, it requires additional losses to vali- process. Such an event-based analysis in the Netherlands. He is an associate date hypotheses and to permit a pattern should be favored because of the amount professor on the faculty of aerospace recognition or statistical analysis (Benner, of new knowledge discovered, the relative engineering at the Delft University 1975 and 1985). Finally, such modeling and efficiency of the search, and the timely of Technology and holds a position as accident phenomenon perceptions do not availability of corrective action guidance. guest professor at the School of Aviation comply with the needs of investigators: Such knowledge can provide more valid of Lund University in Sweden. a translation of human error models to indications of comparative performances practical investigation tools is still in its and events (Benner, 1985). Sidney Dekker, who re- early phase of development (Benner, 1996; ceived a Ph.D. from Ohio Strauch, 2002; Dekker, 2006). Investiga- The Rasmussen model State University in 1996, tion methods should support the visualiza- Rasmussen takes this modeling issue one is a professor and direction of the accident sequence, providing a step further. He distinguishes the stable tor of the Key Centre for structured collection, organization, and conditions of the past versus the present Ethics, Law, Justice, and integration of collected evidence, and dynamic society, characterized by a very Governance at Griffith identifying information gaps in order to fast change of technology, the steadily University, Brisbane, Australia. He facilitate communication among investiga- increasing scale of industrial installations, previously worked in Sweden, the U.S., tors (Sklet, 2004). the rapid development of information and New Zealand, the Netherlands, the UK, Developing such methods in the domain communication technology, and the ag- and Singapore. His recent books include of human behavior will require a shift of gressive and competitive environment that Just Culture: Balancing Safety and Ac- focus from inferred and uncertain states influence the incentives of decision-makers countability (2007) and Drift into Failure of mind toward characteristics of human on short-term financial and survival cri- (2011). He is an active pilot, flying the factors (Dekker and Hollnagel, 2004). teria. In answering the basic question: Boeing 737NG part-time.

20 • ISASI Forum July–September 2011 the line organiza- sources in order to select a proper manage- tion and loses its in- ment policy and information system. The dependent position dimensions of a taxonomy for classification during the assess- depend on the nature of the hazard source ment. This requires and the anatomy of accidents. Rasmussen an explicit formula- identifies only a limited series of hazards: tion of value criteria loss of control of large accumulations of and effective means energy, from ignition of accumulations of of communication of inflammable material, loss of containment values down through of hazardous material. When the anatomy society and organi- is well bounded by the functional structure zations. The impact of a stable system, then the protection of decisions on the against major accidents can be based on objectives and val- termination of the flow of events after ues of all relevant release of the hazard. When particular stakeholders are to circumstances are at stake, the basis for be adequately and protection should be on elimination of the formally considered causes of release of the hazard. Figure 2. Rasmussen’s systems hierarchy modeling. by “ethical account- Defenses can be based on predictive by a systems-oriented approach based on ing” (see Figure 2). analysis. The design of barriers is only control theoretic concepts. Depending on the nature of the hazard accepted on the basis of a predictive risk His risk management concept is a con- sources, three different categories are analysis demonstrating an acceptable trol structure, embedded in an adaptive defined, characterized by their frequency overall risk to society. When the predicted socio-technical system. Since decisions of accidents and the magnitude of loss con- risk has been accepted, the process model, made in a complex and dynamic environ- nected to the individual accident: the preconditions, and assumptions of the ment are not only rational and cannot be • occupational safety, focusing on fre- prediction then become specifications of the separated from the social context and quent but small accidents. The average parameters of risk management. Precondi- value system, a convergence occurs of level of safety is typically controlled em- tions and assumptions must be explicitly the economist concept of decision-making, pirically from epidemiological studies of stated in a probabilistic risk assessment the social concept management, and the past accidents. (PRA). In this view, fortunately, it is not psychological concept of cognitive control. • protection against medium-sized, in- necessary for this purpose to predict per- Modeling task sequences and errors is frequent accidents. Safety systems evolve formance of operators and management. considered not effective for understand- from design improvements in response When a plant is put in operation, data on ing behavior. One has to dig deeper to to analysis of the individual, latest major human performance in operation, mainte- understand the basic behavior-shaping accident. Safety control is focused on nance, and management can be collected mechanisms. Rather than striving to con- particular, reasonably well-defined hazard during operations and used for a “live” trol behavior by fighting deviations, the sources and accident processes. risk analysis. focus should be on making the boundaries • protection against very rare and un- Thus, predictive risk analysis for opera- explicit and known and by giving oppor- acceptable accidents. In such cases, the tional management should be much simpler tunities to develop coping skills at bound- design cannot be guided by empirical evi- than the analysis for a priory acceptance aries. For a particular hazard source, dence from past accidents due to the very of the design. Such performance data can the control structure must be identified, large mean-time between accidents. be collected through other sources than including controllers, their objectives, Design and operation must be based on accident investigations; incident analysis performance criteria control capability, reliable predictive models of accident pro- and expert opinion extraction may com- and information available about the actual cesses and probability of occurrences. A pensate for the lack of abundant accident state of the system. full-scale accident then involves simultane- data. According to Rasmussen, the models The fast pace of technology has led to ous violations of all the designed defenses. required to plan effective risk manage- the introduction of the “general due clause” The assumption is that the probability of ment strategies cannot be developed by and has enhanced the regulator ability to failure of the defenses individually can and integrating the results of horizontally protect workers. Each employer “shall will be verified empirically during opera- oriented research into different features furnish to each of his employees a place of tions, even if the probability of a stochas- of hazard sources and systems configura- employment that is free from recognized tic coincidence has to be extremely low. tions. Instead, vertical studies of the control hazards that may cause death or serious Monitoring the performance of the staff structure are required for well-bounded harm.” By stating safety performance during work is derived from the system categories of hazard sources, characterized objectives, safety becomes just another design assumptions, not from empirical by uniform control strategies (Rasmussen criterion of multi-criteria decision-making evidence from past evidence. and Svedung, 2000). and becomes an integrated part of normal It therefore should be useful to develop operational decision-making. In this way, more focused analytical risk management Expansion toward “real” models the safety organization is merged with strategies and a classification of hazard In accordance with the desire to create

July–September 2011 ISASI Forum • 21 more encompassing models in a dynamic Modeling accidents particular, in complex high-tech systems, environment, the Reason and Rasmussen Across the various domains, accident such an assumption of full and transpar- model are superseded by a new series of investigation and event modeling have ent information supply is not realistic and risk management models. In shifting from seen different points of departure. On one hence in conflict with bounded and local accident investigation to other system hand, there is a bottom-up approach in rationality theory. performance indicators and their data on a occupational risk and road safety: preven- —Second, cross-corporate dissemina- daily basis, there is a need for modeling all tion of accidents and separating process tion of lessons learned. In the Durkheim- possible causal event sequence scenarios safety from personal safety. Focus on iso- ian and Weberian tradition, social sciences in order to understand what is happening. lated causational factors and single-actor copied the notions of the most prominent Such an analysis should include technical, strategies (corporate management or the scientific domain of the 19th century, the human, and organizational factors, deem- three E’s of engineering, education, and natural sciences, to mirror themselves to ing the Reason model to be insufficient, enforcement). their merits and to surpass them by adapt- due to its theoretical and partial model- On the other hand, a top-down approach ing their methodology (Matthews, 1978). ing and the amount of occurrences that is applied in aviation, railways, and ship- This mechanism in establishing scientific have to be processed every day (Roelen ping aiming at systems change and learn- esteem seems to be repeated in the 20th et al, 2009). ing without separation between personal century, by mirroring management con- There is a need for “real” models, safety, process safety, external safety, or trol modeling against engineering design covering every aspect and systems level, rescue and emergency handling (ETSC, principles. In 1972, the psychologist Ed- requiring a substantial mathematical 2001). Modeling accidents by decompos- wards claims a more prominent role for background and user-friendly software ing accidents into a limited category of the behavioral sciences in the integral de- tools. Such models should incorporate hazards and a predefined set of generic sign of aircraft and postulates the HELS fault trees, event trees, and influence dia- failure types deprives the analysis of the model (Edwards, 1972). A “traditional” grams, which were adopted in the nuclear following three major components. focus on technical components should be power industry in 1975. Sophisticated —First, learning lessons for prevention unjustified, the “linear” design method PRA methods should provide establish- of similar events. Prescriptive modeling an anachronism. This claim is even more ing a relation between cause and effect, of accidents forces the decomposition and interesting because it is stated at the very while influence diagrams should represent description of the event into the format of moment of the development and rollout of the influence of the context. Since airline the model. It also forces the event into an the major aviation innovation at the time: safety analysts, safety managers, and assessment of the correctness of the event the first of the widebody generation of chief pilots have detailed knowledge but in terms of compliance with the model’s commercial jet aircraft, the Boeing 747. fail to identify systemic shortcomings, normative assumptions and notions. In In his plea for involving psychology into a framework is needed to help them to particular, with human error modeling, aircraft engineering design, Edwards also see the whole picture. Most of the effort such normative assessment remains im- criticizes accident investigation in aviation: is in classification of the data entry, with plicit and obscures an explanation of the the value should be limited, the frequency relatively little effort spent on analysis behavior, based on motives, conditions, too low to draw useful conclusions, while (Roelen et al, 2009). Such a “real” model constraints, and context. the complexity should prevent an adequate should be integrated in order to represent Prescriptive modeling denies local ratio- analysis. Edwards follows the criticisms of the complexity and interdependencies, nality at the operator level. In particular, Frank Lees in 1960, who did not see an should be quantitative and transparent, where pilots, mariners, and drivers have added value for accident investigation in and should provide reproducible results, their discretionary competence, such mod- the process industry. Frank Lees shifts a covering the whole aviation system. eling rather obscures than clarifies human preference toward incidents, loss control, This approach does not favor the intro- behavior in high-tech operating tasks. and risk management. According to Ed- duction of new concepts or models. The Their adaptive potential to new situations wards, accident investigations should only concepts of Dekker to see socio-technical and ability to respond and recover in a flex- be based on negative experiences, instead complexity as a web of dynamic, evolv- ible manner is the basis of their learning. of positive experiences as well. Accident ing relationships and transactions or the It is a part of their internalization process investigations should only be descriptive Leveson concept of systems as inter- of processing experience into knowledge. and lack explanatory potential. related components that are in a state In a normative assessment, the operator However, international aviation is a of equilibrium by feedback and control is assumed to have a timely and full trans- global, open transport network that can are not considered useful (Roelen et al, parent oversight over all the available function exclusively on the basis of mutual 2009). The aviation industry should be information, systems properties, and of all harmonization and standardization, high- too conservative and too slow responding his actions and their consequences. Such level performance demands, and open in accepting new ideas, while Reason’s an investigator hindsight bias obscures access to the global network. Learning Swiss cheese model is still relatively new. the decision-making in uncertainty, which from an accident in aviation, therefore, An event model that fits current practice the operator is submitted to in practice takes place at the international and sec- should make more sense than to develop (Kletz, 1991; Dekker, 2006). Such an torial level, not on a national or corporate new models with a completely different analysis in which operator performance level, such as in the process industry or concept, however correct these concepts is assessed against normative behavior is nuclear power supply. This learning is might be (Roelen et al, 2009). in contradiction with learning theory. In focused on technological improvements

22 • ISASI Forum July–September 2011 and open exchange of information at the • There are differences in the dynamics interventions reinforce the design space in level of international institutes such as the and pace of technological adaptation. In the detailed design phase by reallocating International Civil Aviation Organization the transport modes, rapid adaptation by factors, by more stringently complying (ICAO) instead of national governmental technological harmonization and standard- with rules and regulations, and by elimi- inspection and limiting learning to the ization creates the basis for accessibility of nating deviations applicable to simple, level of the private, multinational company. the network, interoperability, and reliability stand-alone systems Safety as a societal value is a prerequisite for all actors. In the process industry, there • Complex interventions and second for the international transport community is a more restricted pace of technological order solutions. Complex dynamic prob- due to its existence as a public transport development, while the conversion of mate- lems demand expansion of the design system. rial properties produce only a limited set space. Such solutions focus on concepts —Third, its specific analytic potential. of hazards and critical events, such as fire, and morphology, reallocating functions Modeling of accidents has been derived explosion, loss of containment, and health to components, reconfiguring and syn- from the paradigm as defined by Lees problems. In the transport modes, a wide thesizing sub-solutions, involving actors, and initially elaborated by Reason and variety of events in a rapidly evolving aspects, teamwork, communication, test- Rasmussen for the process industry. It operating environment will occur, creating, and simulation. Such an expansion of is a legitimate question, however, to see ing exposure to kinetic energy releases the design space occurs in the functional whether the inherent characteristics inherent to speed and mass. Consequently, design phase by developing conceptual of the process industry are generically managing the consequences of catastrophic alternatives and prototypes applicable to applicable in other high-technology and failure is different. complex and embedded systems. knowledge-intensive industrial sectors, It therefore is a legitimate question as When first order solutions fail and do such as the transportation sector. to whether formal models on a managerial not prevent an event, a redesign of the There are fundamental differences level of safety decision-making processes system becomes necessary. between the process industry and the vari- are appropriate for accident investigation In order to achieve such redesign, the ous transport modes. The most prominent and should replace metaphors or whether event must be redefined in the first place differences in system architecture and modeling, as such, is inappropriate for ac- by applying an engineering design meth- characteristics between the sectors are cident investigation of transport modes and odology (Stoop, 1990; Dym and Little, • closed versus open systems. In public should be replaced by another concept. 2004): transport, safety is a public governance In overcoming present limitations • decompose the event to identify contrib- value, managed in a dynamic network of and the necessity to achieve a shift from uting variables and their causal relations. mutually dependent actors and stakehold- managerial control strategies toward a • recompose the event by synthesizing ers. In the process industry, risk control socio-technical systems perspective, the safety critical variables into credible is allocated to the corporate level from a latter might be the case. scenarios. top-down managerial perspective, dealing • provide analytical rigor to the sce- with fixed sites on a stand-alone basis. A Toward new concepts narios by identifying their explanatory company structure in the process industry If we shift from managerial control strat- variables, based on undisputed empirical is of a multinational nature, while entities egies toward applying an engineering and statistical evidence and scientific in the transport modes are international design approach to safety at the socio- research. by nature. technical level, what does this mean for • make the transition from explana- • continuous versus intermittent opera- the accident investigation process? How tory variables toward control and change tions. The transport industries are operat- do we substantiate such an engineering variables. ing on a 24/7 demand basis, providing direct design approach in the accident investiga- • develop prototypes of new solutions. and individual services at the level of global tion methodology? How do we substantiate • test the prototypes by exposure to the networks, while the process industry oper- the concept of resilience engineering in accident scenarios in a virtual simulation ates on a supply basis, facilitating intermit- practice (Hollnagel et al, 2008)? Two steps environment. tent production organization, creating room are to be taken into account: identification for temporary shutdown, reconfiguration, of the design solution space and the use of Designing safer solutions and adaptation of specific products without empirical evidence as an input for safety In designing safer solutions, two funda- the requirements of a permanent availabil- design specifications based on forensic mental questions are raised about ity of production capacity. engineering principles. • how to design safer solutions? • the role of the human operator is fun- Safety-enhancing interventions can be • how to generate the requirements for damentally different. In transport modes, categorized into two main classes: such a design? the concept of human-centered operations • Linear interventions and first order so- In contrast with linear interventions will be irreplaceable for decades, if full lutions. Simple problems allow restricting and first order solutions, in complex sys- automation is ever desirable and feasible, the design space. This is valid only if the tems there is no direct relation between a such as in the process industry. Conse- number of solutions is small, the number single contributing factor and its remedy. quently, various cognitive levels of opera- of design variables is small, their values In redesigning safer solutions, there are tions are required and various delegated have limited ranges, and optimizing within three different focus groups for commu- responsibilities have to be allocated to the these values deals with sacrificing aspects nication of the safety solutions: (1) opera- various control levels of the system. among the limited set of variables. Such tors and actors within the system able to

July–September 2011 ISASI Forum • 23 achieve a safe performance, (2) knowledge the system, a synthesis should take place decomposed level. A recomposition of providers for a better understanding of the of all aspects in an encompassing program these elements and building block takes system behavior, (3) and change agents, of requirements. Such a program of replace into a more complex communication able to govern and control the system. quirements becomes a consensus docu- structure to facilitate meaningful conver- Each of these parties has a specific set of ment, in which all actors involved have had sation. In an analogy with music, poetry, communication means, applying, respec- the opportunity to express and incorporate and literature, such a communication tively, metaphors, models, or prototypes. their requirements, constraints, and con- language is also applicable for accident Each of these parties applies its own vo- ditions during the assignment phase of analysis. The scenario concept provides cabulary and reference frameworks, but the redesign. such a common language, creating event should share a common notion in the end narratives that form the basis for com- by a common means of communication. A language issue, creating scenarios mon understanding and agreement on Applying a “barrier” notion is a powerful In reconstructing an event sequence, we the description of accident phenomena communication metaphor, but does not easily refer to the mechanical reconstruc- in their context. Achieving consensus on help in the case of a scientific modeling of tion from an engineering perspective. In such accident scenarios provides a basis the issue or applying a prototype in test- unraveling the event sequence from a psy- for a common risk assessment and shared ing a solution. chological or sociological perspective, we solution space. Synthesizing solutions is necessary might prefer the phrasing of reenactment to establish a shared solution, based on of the event or reconfiguration of the sys- Shared solutions, redesign, the credibility, feasibility, compatibility, tem state and operating environment. and prototyping and selection of preferred alternatives Recomposition of an event enables In complex interventions, the focus is on in order to create consensus among all event analysis. To communicate, a common events in a systems context rather than on parties involved in accepting the solu- reference framework as shown below is isolated factors and generic aspects, such tion. Synthesizing is about recreating required, clarifying the various perspec- as is the case with linear interventions. interdependencies into a new concept, tives in recomposing the event: The reconstruction of events takes place network, or configuration based on shared • A technical perspective dealing with by identifying and synthesizing explanato- values. Complexity then can be defined a reconstruction of the physical system ry variables into scenarios in their specific as the interdependences of variables, performance. operating environment and constraints. choices, and design assumptions. To deal • A behavioral perspective dealing with Such synthesizing is primarily evidence with this complexity, it is not sufficient the reenactment of decisions and discern- based. The redesign of the systems is to decompose a system or event into its able actions. conducted along the lines of engineering contributing variables and explanatory • A systems perspective dealing with the principles by generating design alterna- variables within its existing solution space; reconfiguration of the systems state and tives in the enlarged design space into the the design variables must also be identified operating environment. form of a limited set of prototypes. These in order to serve as input for the systems To create a common understanding prototypes contain a relocation and addi- engineering design process. among actors, a common language and tion of functions, changing the morphology In addition, dealing with complexity and common notions are necessary. In risk and configuration and incorporating ad- context does not mean adding more detail discussions, the perception and acceptance ditional actors and aspects. The testing of and levels to an event by increasing the of risk varies across actors, dependent these prototypes is conducted by running decomposition. It does mean providing on their position and interest. They may scenario tests, defining limit state loads, transparency at higher systems levels apply either a frequentistic or a scenario and simulating complex, dynamic systems with respect to its functioning and primary approach, dealing with either the fre- in virtual reality. processes, and clarification of the con- quency or the consequences of an event, Analyzing system responses, before ceptual properties, and its configuration a technological or a sociological approach, they are put into practice, are based on and composition. Increasingly complex or may apply a rationalist or an empathic first time right and zero defect strate- accident modeling such as Accimap or approach (Hendrickx, 1991). These differ- gies. The responses of a system can be STAMP does not make the transition ent approaches each have developed their determined by a gradual enlargement of from the event toward systems charac- own notions and language. To facilitate the disruptions, which are inflicted upon teristics (Rasmussen and Svedung, 2000; communication, there is a need for either the system until oscillation and instability Leveson, 2004). If the inherent proper- a common language or a translation be- occur. Responses of systems may become ties of a system are not identified during tween these languages. This implies an visible by a gradual or sudden transition design, they will manifest themselves as understanding of each of the languages in to another system state by passing a emergent properties during operations. the first place with respect to its linguis- bifurcation point. After such a transition, Such properties are to be specified by tics, syntaxes, grammar, and vocabulary. the safety of the systems can be assessed stakeholders, actors, and other parties Decomposing such a language identifies according to the acceptability of the new that are to be exposed to the system’s the elements and building blocks of the safety integrity level. operational consequences and formulated language and facilitates analysis of their Technology in itself contains many in an overall program of requirements, meaning and usefulness. forms, incorporating invisible knowledge, leading to design specifications. For communication purposes, however, notions, principles, and decisions from To assess the integral performance of a language cannot be spoken at such a previous lifecycle phases. The physical

24 • ISASI Forum July–September 2011 and toolbox of investigation methods for conducting accident investigations at a systems level is not yet fully developed. Designers need counterparts for the assessment of their designs. Such a role is provided by accident investigators.

Conclusion Although the Reason and Rasmussen models may well serve risk management in the process industry and nuclear power supply, there are doubts about their gen- eralization toward the aviation industry. In practice, they are exposed to the risk of serving as reference metaphors for the benefit of risk communication and standards for generating generic, linear Figure 3. Stoop’s systems architecture DCP diagram. solutions. On methodological grounds, Reason’s model shifts the focus from appearance of a product and process ability to recompose the socio-technical accident causation toward human er- does not disclose inherent properties, context and operating environment. ror analysis, while Rasmussen’s model principles, or interactions to end-users in From an investigator perspective, three replaces accident investigation by man- their operational environment. kinds of systems designers should be agement control in a socio-technical Design decisions are frequently made supplied with a counterpart, each quali- systems context. Hence, both models do under conditions of high uncertainty. fied with diagnostic and analytical skills not comply with the needs of accident Safety margins and design standards, from a technological/engineering design, investigation theory and practices and identification of failure mechanisms, organizational/managerial, or governance/ systems engineering design needs in probability assessment, consequence control perspective in order to cover the the aviation industry. Consequently, analysis, and identification of a design architecture of the overall socio-technical engineering design methodology may envelope should reduce the uncertainty system. This can be expressed in the DCP provide an alternative for improving the again to an accepted level. Designers diagram (see Figure 3). safety performance of complex systems deal with optimizing performance and These three design-counterpart roles at a socio-technical level. are not in a position to gain oversight into for investigators have been developing The potential for systems engineer- all uncertainties and unforeseen behavior gradually over the past decades. Initially, ing design in providing safer solutions of their designs (Petroski, 1991; Carper, with the development of technology, the requires 2001). Such behavior, however, can be technical investigator has matured, creat- • identifying inherent properties before designed into their processes such as with ing specialist approaches in many techno- they manifest themselves as emergent the Japanese design philosophy of limit logical domains such as propulsion, struc- properties. state design or critical state design meth- tures, avionics, stability, and control. • dealing with complexity and dynamics odologies. Designers need an intellectual Although the domain of human factors by focusing on functions rather than on counterpart in assessing the safety of their has seen major progress over the last factors. design; accident investigators as forensic two decades, the notions that have been • focusing on design principles and engineers play such a role. developed in this domain are not yet read- properties rather than optimizing per- ily applicable for investigation purposes formance. Forensic engineering (Strauch, 2002; Dekker, 2006). Translating • introducing systems dynamics by Historically, designers needed a technical theories on human factors into investi- synthesizing interrelations into accident investigator capable of recomposing the gation tools is progressing, developing scenarios. actual and factual sequence of events, the notions on bounded and local rationality, • applying a proof of concept by testing operating conditions and context, and the naturalistic decision-making theories, a solutions in a dynamic simulation environ- factual technical functioning of the designs blame-free view on human error, high ment. in practice. Such recomposition facilitated reliability organizations, and resilience in Therefore, it is necessary to drafting redesign requirements. However, organizational design. • develop event scenarios separated from a recomposition ability should not only In the domain of governance and systems models. reproduce the physical reality, but also control, the development is in an even • develop prototypes of safer solutions. should encompass the knowledge, assump- earlier phase: this domain is developing • create dedicated virtual systems mod- tions, decisions, and safety-critical issues classification schemes on failure, but is not els, representing their specific charac- that have been taken into account and as- yet in a phase of developing general con- teristics. sessed with respect to their acceptability. cepts and notions of systems governance • facilitate testing and validation in these Such ability should also incorporate the and control. Consequently, a framework models, parallel to the real system. ◆

July–September 2011 ISASI Forum • 25 ISASI ROUNDUP ISASI Updates Membership Criteria; Expands Qualifications The International Society of Air Safety of other aviation professional groups. ISASI—join—individual.” Please note Investigators (ISASI) International To be eligible for full membership, one that the website is undergoing an update Council has unanimously voted to update must have three (3) years’ experience and that the new membership applica- its long-standing professional member- in an aviation safety position involv- tion may not yet be posted, but will be in ship class criteria by expanding the qual- ing aircraft accident investigation or the very near future. ◆ ifications needed to gain full member prevention. An affidavit signed by a status into the premier professional or- military applicant’s supervisor will be ISASI 2011 Releases ganization of air safety investigators. Its considered when investigations or ex- present membership of 1,430 includes perience is classified. Aircraft accident Event Technical Program representatives from 67 nations. litigation is not qualifying experience “The ISASI 2011 technical program This action results from recognizing for this membership classification. is now available on the ISASI website that the role of accident investigator is Commenting on the updated criteria, for viewing,” announced Jim Stewart, transitioning from primarily that of “tin Ron Schleede, a former NTSB inves- ISASI 2011 Technical chairman. He kicker” to one encompassing accident tigator and manager, past ISASI vice noted that the selection process of the prevention beyond investigation. This president, and current president of the technical papers to be presented was a transition is being brought on by the Mid-Atlantic Chapter, said: “One of the daunting task because of the number sharp reduction in the world’s aircraft reasons I encouraged the changes we and caliber of the submissions. To accident rate due to corrective actions made at the Council meeting stemmed keep to the time schedule and to allow resulting from past accident investiga- from my experiences with more than two speakers sufficient time to explore their tions, development of accident preven- dozen airlines during Reachout Work- subject, only these 23 papers, originat- tion processes in areas such as human shops and other teaching I have done for ing from 10 countries, were selected for factors, the explosion of information SCSI and Cranfield University. There presentation: technology data-driven systems, and were scores of airline ‘safety’ people who • British Airways B-777 Investigation innovations such as safety management did not understand the limitations of • Flight Path Analysis systems and other similar air safety the old application. Since many airlines • Using “ASTERIX” in Accident Inves- enhancements. may go 30 years without a fatal acci- tigation The past requirement for ISASI full dent, there is insufficient ‘business’ for • Who Is Onboard in GA and Air Taxi membership status was participation someone to qualify as a full member of Accidents? in a minimum of “eight intervening ISASI under the old requirement. How- • Preventing the Loss of Control Ac- accidents” identified by date, location, ever, I know full well that most airline cident make, and model of aircraft. Equivalent safety folks are conducting many, many • Building Partnerships in Unmanned experience included “supervisory air ‘investigations’ on a daily basis. Some Aviation Systems safety responsibilities, safety committee of them never go into the field—rather, • Teamwork in the Cause of Aviation assignments, participation in complex they sit at a computer analyzing data Safety incident/mishap investigations, and/or and taking safety actions to prevent • Long Distance Investigations hearings/boards of inquiry, etc.” Five accidents based on the data. Others in- • Smaller Nations and Annex 13 years of experience was also required. terview flight crews, etc., as part of their • Timeliness, an Investigator’s Challenge The updated criteria for full ISASI investigation duties. Still others are • Major Investigations, New Thinking membership includes— involved in related accident prevention Ahead An air safety investigator is one who work in cabin safety, dangerous goods, • Post-Turbulence Structural Integrity has been actively engaged in the inves- flight operations, airport operations, etc. Evaluation tigation of aircraft accidents, incidents, I know that part of their daily work is • Analysis of Fuel Tank Fire and Explo- or conducted prevention activities to investigation and prevention.” sion identify, analyze, eliminate, or control All persons who believe they are • Elimination of Aircraft Accidents aviation hazards before they result in qualified under the new criteria are Through Flightdeck Technology aircraft accidents or incidents. They encouraged to visit ISASI’s website at • Helicopter Design for Maintainability may be representatives from aircraft www.isasi.org for more information and • B-787 Safety Presentation manufacturers, air carriers, govern- to download an application form. • Human Errors and Criminal Guilt ment agencies, the military, or members Once on the site, click on “About • Pilots’ Cognitive Processes for Making

26 • ISASI Forum July–September 2011 Inflight Decisions Under Stress March 2011 issue of Forum, page 26. ment, safety culture, and change and • Human Factors Standardized Proce- Registration information is also avail- risk management. dures able via e-mail: [email protected] or via Guselli, chairman of the Reachout • “Back to Basics” Still Works? telephone: 604-874-4806. ◆ program, said that the workshop • Update on the AF 447 Investigation received valuable support from ISASI • An Investigation Media/Communica- Reachout Completes corporate members, including the tions Strategy Australian Transport Safety Bureau and • Accident Communication in Today’s Three Workshops the Civil Aviation Safety Authority, with Media The ISASI Reachout program continues Aviation Australia providing excellent Key speaker for the event is Marcus to deliver in diverse areas of the world facilities and support at Cairns Airport. Costa of the Chief Accident Investiga- with the completion of three programs in He noted that student feedback again tion Section, ICAO. ISASI President Almaty, Kazakhstan, in February; Doha, illustrated the continuing need for this Frank Del Gandio will open the air ac- Qatar, in April; and Cairns, Australia, in type of training in some of the more cident investigation conference following May. remote areas of Australia. ◆ the general welcome by Capt. Richard Reachout 39, held in Almaty, delivered Stone, Seminar chairman. Preceding the topics that revolved around the key ANZSASI Regional Seminar 3-day technical program is a full day of elements of incident investigation and two tutorial workshops: Digital Photog- safety risk management. The valuable Scores Another Success raphy for Accident Site Investigation training delivered by Caj Frostell and The New Zealand Society hosted the and Improving Aircraft Integrity from Mike Doiron was gratefully acknowl- joint annual seminar of the Austra- Accident/Incident Analysis Informa- edged by the 18 participants. The gener- lian and New Zealand Societies of Air tion—Closing the Loop. ous hospitality of Air Astana was instru- Safety Investigators in Wellington, New Registration is still open for ISASI mental in the success of the seminar. Zealand, on June 10–12. More than 75 2011, the Society’s 42nd annual interna- Hosted by Qatar Airways, Reachout people registered for the event, with tional conference on air accident investi- 40 was held in Doha and was instructed another 12 partners present for the gation to be held in Salt Lake City, Utah, by Ron Schleede, who teamed up with social functions. The reduced attendance USA, from Monday, September 12, Caj Frostell and Mike Doiron. They seemed to reflect the difficult global through Thursday, September 15. The reinforced safety and investigation economic conditions and perhaps the conference theme is “Investigation—A through instruction to 21 participants on disruption caused by earthquakes in Shared Process.” safety risk management requirements Christchurch, the initial choice of venue The seminar’s website is accessible for SMS and airline safety programs; this year. through the ISASI website, www.isasi. incident investigation and analysis The program was well received by org, and is now accepting registrations using the SHELL model; developing those attending, including the director for both the conference and hotel accom- stress strategies and managing fatigue; of civil aviation for New Zealand, who modations. The seminar program regis- government investigations; witness was present for part of the first day. tration fee (in U.S. dollars) before Aug. interviews; cabin safety investigation; Although there were fewer presenta- 15, 2011, is member, $550; non-member, developing the right safety culture; and tions than usual on recent accident $600; and student member, $200. A 1-day mandatory incident reporting systems, investigations, a wide range of technical pass is $200; tutorial only, $150; and among other subjects. and “soft” skills were covered. These companion, $325. If registration is made Reachout 41 was successfully hosted included a presentation on the prepara- after August 15, the fees are members, by ASASI in response to a growing need tions being made by the Singapore Air $600; non-members, $650; and student for safety-related training in Cairns, Accident Investigation Branch for sea member, $225. A 1-day pass is $225; the remote area of north Queensland. search and recovery, which was deliv- tutorial only, $175; companion, $350. The ASASI volunteer instructors for the ered by David Lim. Other presenta- cost of a single event is—Welcome re- 4-day workshop, which 31 persons at- tions included a scientific experiment ception, $50; Tuesday night dinner, $100; tended, included Lindsay Naylor, Paul by Samuel Watson, the youngest-ever and awards banquet, $100. Mayes, Rick Sellers, and John Guselli. presenter at ANZSASI, on the release Full conference details may be found They discussed emergency manage- of carbon fibers in lightning strikes, on the ISASI website or in the January- ment, human factors, safety manage- analysis techniques and logic processes,

July–September 2011 ISASI Forum • 27 ISASI ROUNDUP Continued . . .

purchased and repainted in the same time period and had exhibited scribe marks in their lap joints. Exponent’s investigation had two goals: 1) Identify the type(s) of sealant removal tool (metal, plastic, wood, etc.) that likely created the scribe marks found on the subject aircraft and 2) Estimate the number of cycles required for a scribe to grow into a through-thickness crack and compare that estimate to the service history of the subject aircraft. “Through a series of experiments, Exponent’s investigation demonstrated that unapproved metal tools produced scribe marks with physical characteristics (depth and shape) consistent with the scribe marks found on the subject aircraft, while approved plastic and wood tools produced much shallower and broader marks than those produced by the metal tools and, in some instances, Some of the 75 people who attended the seminar. with nearly undetectable depths. Only metal tools produced scribe marks with performance-based navigation, aging depths sufficient to initiate a fatigue aircraft, and national preparedness for ISASI Member Rakow crack (greater than 0.0026 inch, as handling the social expectations after a Shares B-737 Failure determined by fracture mechanics), and mass casualty disaster. The Reason mod- Analysis only metal tools produced gouges with el was revisited, practical skills in main- depths as large as those measured on tenance human factors were offered, ISASI member Joseph F. Rakow, Ph.D., the subject aircraft (0.005 inch, nearly and the work of the Asia-Pacific Cabin P.E., and senior managing engineer with twice as deep as the threshold). Fatigue Safety Working Group was described. Exponent Failure Analysis Associates, analysis indicates that a scribe mark Presentations by a military investigator recently shared with ISASI Forum and of the depth measured on the subject and a private investigator, who described his clients an abstract of an investigation aircraft requires approximately 23,000 their training and experiences, attracted of fatigue cracks in lap joints of a fleet of flight cycles to propagate a crack from much interest. 10 B-737 aircraft completed by Expo- the time of scribing to a through-thick- The Third Ron Chippindale Memorial nent 3 years ago. The abstract is printed ness crack. The subject aircraft had Presentation was delivered by aviation as received. accumulated approximately 22,000 flight lawyer Kim Murray, a former colleague “In March 2003, two through-wall cycles since the repainting process in the of Ron’s who spoke on the international cracks were discovered in fuselage lap mid-1990s. and national law relating to the protec- joints of Boeing 737-200 aircraft oper- “This investigation highlights the sen- tion of ATC recordings and similar ated by a major commercial airline. The sitivity of aircraft structures to mechani- issues. airline suspected the cracks were associ- cal damage and emphasizes the extreme The opportunity was also taken to ated with scribe marks created by an care that is required when performing hold general meetings of the two na- unapproved metal sealant removal tool maintenance and other services such as tional societies. employed by their painting contractor repainting.” The next ANZSASI seminar will be during a repainting process in the mid- The full investigation is currently held in Australia on June 1–3, 2012, at a 1990s. The aircraft was retired, along summarized in a white paper available venue to be announced. ◆ with nine other aircraft that had been upon request. ◆

28 • ISASI Forum July–September 2011

NEW MEMBERS

Corporate Marc Hookerman, Lake Saint Louis, MO, USA PT. Merpati Nusantara Airlines Jeffrey Hutchinson, Lincoln University, PA, Capt. Rilo N. Raja USA Dian Harris Robert Kelly, Ormond Beach, FL, USA Jakarta Pusat, Indonesia Bobby Looney, Williamson, GA, USA Heather McCarley, Ladner, BC, Canada Navy for undersea search and recovery Individual Heidi Moats, Leesburg, VA, USA operations. Hjalmar Beijl, Greensboro, NC, USA Shane Murdock, Geelong, VIC, Australia Phoenix provides manned and un- Tammy Crowell, San Jose, CA, USA Daniel Scalese, Los Angeles, CA, USA Crystal Ferguson, Palm Coast, FL, USA Daniel Siegenthaler, CH-6060 Sarnen, manned underwater operations, design Erica Garcia, Daytona Beach, FL, USA Switzerland engineering, and project management Thomas Haueter, Great Falls, VA, USA Harriet Taukave, Nadi Airport, Fiji services to clients in the offshore oil and Deborah A.P. Hersman, Washington, D.C., James Terrell, St. Peters, MO, USA USA Peter Upton, Auckland, New Zealand gas, defense, and other ocean-interest industries worldwide. Expertise is available from six regional offices in NTSB Releases Year 2010 of critical items from Air France Flight the areas of wet and dry hyperbaric 447. The downed Airbus has been the welding, conventional and atmospheric U.S. Aviation Statistics object of three extensive, but previously diving, robotic systems, and tooling. The The safety of civil aviation in the United unsuccessful, search missions since its company’s capabilities support plug and States continued to incrementally im- loss June 1, 2009, on a flight from Rio abandonment; underwater inspection, prove across most industry segments in de Janeiro to Paris. Wreckage from the maintenance, and repair; construction; 2010, based on the preliminary aviation aircraft was successfully located on April deep ocean search and recovery; and accident statistics recently released 3, 2011, during a fourth search and was submarine rescue. ◆ by the National Transportation Safety found lying in 3,900 meters of seawater. Board. The Phoenix-designed Remora is Twenty-six accidents were recorded one of very few ROVs with the depth for U.S. scheduled Part 121 airlines and capability to search for and recover the six accidents on scheduled Part 135 com- flight data and cockpit voice recorders, Moving? muters, all non-fatal. two items that are of primary interest to Please Let Us Know Total accidents of on-demand opera- crash investigators. Upon a successful Member Number______tors (charter, air taxi, air tour, and air conclusion of this essential task, Phoenix Fax this form to 1-703-430-4970 or mail to medical operations) decreased from 47 in will be advised on the need to recover ISASI, Park Center 2009 to 31 in 2010, despite a slight rise in other objects from the aircraft. The 107 E. Holly Avenue, Suite 11 Sterling, VA USA 20164-5405 the number of annual flight hours from experienced Phoenix ROV crew will then 2,901,000 to 2,960,000. However, fatal ac- rig and recover every item of interest to Old Address (or attach label) cidents increased from two in 2009 to six the investigator-in-charge, Alain Bouil- Name______in 2010. The number of fatalities for both lard of the French Bureau d’Enquetes years was 17. et d’Analyses (BEA), and investigative Address______The decline in general aviation ac- team members. The recovery operation City______cidents in 2010 continues its downward is being conducted from Alcatel-Lucent’s State/Prov.______trend, but this sector still accounts for CS Ile de Sein, a 140-meter-long tele- Zip______the greatest number of civil aviation communications cable ship. accidents and fatal accidents. There Phoenix has a substantial history Country______were a total of 1,435 such accidents in of performing deep water search and New Address* 2010, 267 of them fatal, resulting in 450 recoveries for the airline industry. Name______fatalities. ◆ Past recovery projects have included Address______Yemenia Flight IY626 (also conducted Phoenix Conducts Flight 447 for BEA), Adam Air Flight 574, and City______Tuninter Airline Flight 1153. The com- State/Prov.______Critical Item Recoveries pany also provides search and recovery Zip______Phoenix International Holdings, Inc. expertise to other publicly owned and Country______(Phoenix), an ISASI corporate member, private entities, the U.S. Navy, national is under contract to provide its 6,000 and international agencies, and foreign E-mail______*Do not forget to change employment and meter depth capable remotely operated governments. Phoenix is in its 11th e-mail address. vehicle (ROV) Remora for the recovery year as prime contractor to the U.S.

July–September 2011 ISASI Forum • 29 cations and telemetry, and UAS remote sensing. In addition, the major cur- riculum includes aviation safety, human factors, and crew resource management related to unmanned aircraft operations. "We spent a lot NTSB Viceof Chairtime and ef Hart- Addresses MARC Meeting fort putting NTSB Vice therefore,this that program “the military pipeline to of the- Chairman pastgether is gone for good.” beca use Christopher A. thereTo clarify the was importance no ofmod the loss,- Hart was the heel discussed for some it," accidents said that he guest speaker believesBen Trapnell,illustrate “lack of professional as-- at the annual ismsociate and judgment,” profesand “no stick-and-- spring ISASI ruddersor skills.” of Heaviation. stated that none of Mid-Atlantic the"We noted had accidents to involved bridge military- Regional Chap- trainedthe pilots. gap The between FAA, he said, needs ter on May 5 in aengineers much more robust way and of putting Herndon, Va., peoplepilots in the cockpit beca of commercialuse Vice Chairman USA. He was airliners.our hope “What worked is in that the past Hart speaks to the sworn into of- willou notr work grad in the ufutureates because of loss of military- fice on Aug. 12, thefrom loss of military-trainedthis pro pilots.”- The trained pilots. 2009, to serve military,gram he noted,will has becomeshown that it has the remainder the type ofleaders clearing and training in systems an of a 5-year term that expires on Dec. toemerging determine if pilot applicants civil “have 31, 2012. Hart served a previous term theUAS right ind stuff. Thisustry. is not to say that all as a member of the NTSB, and from military-trainedThey need pilots to are betterhave than 1994–2009 he was with the FAA. He civilian-traineda broad pilots, perspec because we have- holds a law degree from Harvard top-notchtive civilian and trained the pilots, abil too. The- University and a master’s and a bach- problemity to is that expand the two bell curvesthe don’t elor’s degree in aerospace engineer- overlap;base we ofneed toknowledge bring the civilian ing from Princeton University. He bellwe curveprovide." up to where the military bell is a licensed pilot with commercial, UND collaborat- curve is. That is our challenge.” multiengine, and instrument ratings. ed with Corsair But the vice chairman didn’t speak In his opening remarks, Hart made EngineeringMARC Meeting to only of the negative, he also spoke of clear that he was not speaking for the provideDonati trainon List - accidents that produced demonstrations NTSB, but for himself, about three ingISASI to Rudy st Kapustinudents Memorial of “abundant professionalism,” and in issues that he wishes to pursue while pursuingScholarship their which teamwork, use of cockpit resource at the Board and which he believes UAS(In memory majors. of all ISASI members They management, and piloting skills were need some serious attention: The loss used thewho have Sca died) - top notch. of the military pipeline for air carrier nEagleVictoria UAS Anderson simu- He next turned to criminalization of Ron Battocchi pilots, criminalization of inadvertent latorToby/Kathy to learn Carroll inadvertent error, noting that the “in- error, and prioritization. mission-relatedDenise Daniels creasing tendency today is to punish.” Regarding the military pipeline, UAS employmentFrank/Candy Del Gandio Hart noted that too often the profes- David J. Haase he noted three commercial airline ac- and operationalCindy Keegan sionals caught up in the punishment cidents since 1994 in which the pilots techniqTom/Gingeru es.McCarthy The craze are charged because of inadver- showed lack of judgment, professional- simuEsperison/Gladyslator Martinez was tent error, not error caused by willful Christine Negroni ism, and, in one accident, even basic createdMichael jointly J. Pangia by wrongdoing. He noted that he favors piloting skills. He noted how in the CorsairJohn Purvis/Nancy and Wright the criminalization for intentional wrongdo- past, airline pilots’ skills were generally aircraft'sRon Schleede manu- ing, such as coming to work drunk, but Richard/Ruth Stone much higher because of the world-class factuRTI–Joerer Reynolds to accu- he emphasized his belief that criminal training of military pilots from WW II, ratelyCanadian represent Society of Air Safety punishment of inadvertent error not Korea, and Vietnam. He noted, “We are the Investigators/Barbaraexperience Dunn of only does not help improve safety of the Dallas-Fort Worth Chapter/Tim Logan losing that pipeline of military pilots flyingAtlantic Regional the Chapter/Ron real Schleede system, but may actually subvert the and will never see it again because big aircraft.Pacific Northwest Regional Chapter/ safety of the system. wars are hopefully something of the "They Kevindon't Darcy He said, “The threat of criminaliza- San Francisco Regional Chapter/ past, and many future military air- just learnKevin Darcy how tion only creates silence in all reports planes won’t have pilots.” He believes, to operate an un- of accidents. It also chills willingness to manned aerial ve-

30 • ISASI Forum July–September 2011 NTSB Vice Chair Hart Addresses MARC Meeting he noted, “most welcomed all and urged participation improvements in in a special fund-raising challenge for safety came from the ISASI Rudy Kapustin Memorial things that went Scholarship. He described the funding wrong, but that methods used for the scholarship, not- now most safety ing that contributions made in the U.S. improvements are to the fund were tax-deductible and coming from things that all funding comes from contribu- that could go wrong tions. He emphasized that no member but that haven’t yet dues were used to fund the scholar- MARC President gone wrong,” allud- ship. He added that the largest fund- Schleede wel- ing to findings of raiser is the spring MARC meeting. comes attendees. accident investiga- He began the challenge with a $200 tions for the past donation in the name of his deceased and advances in information technology in wife, Kathy, who “loved ISASI.” analyzing data for the present. Responses came quickly and unhesi- Because the ever-enlarging safety pie tatingly. The donation total reached consists less of things that have gone $4,851. The winning challenge was a Richard Stone announces ISASI’s wrong, i.e., accidents and incidents in $601 donation by the Dallas-Ft Worth scholarship winners. which the NTSB gets involved, and more Regional Chapter. Other donors are Below: Attendees fill plates of things that could go wrong, the NTSB listed in the adjacent sidebar. from the buffet table. must rethink the role that it must play Richard Stone, co-chair of the to maintain its leadership in the continu- scholarship program, announced the ously safer aviation industry. In addi- 2011 winners who received an award of tion, the entire industry must figure out $2,000, on the basis of their excellent how best to prioritize its scarce safety 1,000-word essay addressing “the chal- improvement resources, deciding which lenges for air safety investigators.” issues to address first and which to defer Awardees are Ainsley M. Robson from until later, because the pie of things that Embry-Riddle Aeronautical Univer- could go wrong is getting bigger, but the sity in Miami and Daniel Scalese from resources to address those issues are not the University of Southern California. generally increasing. The MARC meeting is held in conjunction with the spring ISASI Other meeting events International Council meeting, which Preceding the guest speaker, the 81 meets the next day. ISASI President participate in proactive information pro- attendees enjoyed a lively “refreshment Frank Del Gandio addressed the grams that have been so tremendously hour” and a superb buffet dinner that group and talked about the ISASI effective in enhancing aviation safety by was followed by the call of winning door Reachout program. He said that 2,053 collecting and analyzing large quanti- prize ticket holders. In all, 10 prizes persons have been trained through ties of data to help identify precursors were available from donors that included the workshop-style training sessions. of problems that haven’t yet occurred AirTran Airways; Southwest Airlines; Of those attending, he said, “Many and to do something about them before the Air Line Pilots Association, Inter- generally don’t have the opportunity the problems hurt anyone or bend any national; Airbus Industries; RTI Group; to get the same type of training that metal.” The threat of criminalization is a the University of Southern California; many of us have had. Reachout is cost global problem, he added. Omega Travel; the National Air Traffic free to attendees, and instruction is In addressing prioritization, he said that Controllers Association; and the Trans- by ISASI volunteers.” He also noted the aviation industry’s proactive informa- portation Institute. Top prizes included that much of the cost for any specific tion programs have increasingly enabled round-trip tickets for two from AirTran program is borne by the host-spon- it to spot precursors involving things that and Southwest. soring entities of the area in which haven’t gone wrong yet. “In the past,” Ron Schleede, MARC president, the workshop is conducted. ◆

July–September 2011 ISASI Forum • 31 Non-Profit ISASI Org. U.S. Postage 107 E. Holly Ave., Suite 11 PAID Sterling, VA 20164-5405 USA Permit #273 CHANGE SERVICE REQUESTED ANNAPOLIS, MD

WHO’S WHO Targeting Safety and Risk Management

(Who’s Who is a brief profile prepared Curt Lewis & Associates, LLC and are engineer/director, and air safety inves- by the represented ISASI corporate provided to more than 35,000 subscrib- tigator. Lewis holds an airline transport member organization to provide a more ers worldwide. Flight Safety Informa- pilot license (ATPL) and certified flight thorough understanding of the organi- tion (www.fsinfo.org) provides a free instructor certificate (ASMEL-I) and has zation’s role and functions.—Editor) daily electronic newsletter on current more than 10,000 hours of flight experi- topics concerning flight safety from ence. In addition, he has earned bachelor urt Lewis & Associates, LLC is an around the world. The newsletter con- degrees in aeronautical engineering and international firm headquartered sists of article summaries from news- physics and a masters degree in aviation Cin Arlington, Tex., with a Latin papers, websites, and other industry and system safety. He is completing a American office in Rio de Janeiro, Bra- sources containing information on the Ph.D. in safety management. zil. The firm is also globally sponsored latest accidents, incidents, recommen- Darwin Copsey is currently the by satellite representatives/partnerships dations, and industry information. The vice president of operations and chief in Chennai, India, and Calgary, Alberta, Flight Safety Information journal also operating officer (COO) of Curt Lewis & Canada. Curt Lewis & Associates is a produces periodical journals with a focus Associates, LLC. He has held positions multidiscipline technical and scientific on current trends, technologies, and ele- of increasing responsibility in safety consulting firm specializing in aviation ments of safety. management systems, accident inves- and industrial safety, audits, training, Curt Lewis, P.E., CSP is currently tigation and reconstruction, program and services. the president/owner of Curt Lewis & and project management, education The firm’s expertise and specialties Associates, LLC. He has been an ISASI and training, production and genera- include safety management systems member since 1988, is the past U.S. tion, simulation, and human resources. (SMS), aviation safety programs and councillor/president for the U.S. ISASI Copsey’s corporate experience in the training, airport safety programs and Society, past president of the DFW aviation field has been enhanced and rec- training, emergency response planning, ISASI Chapter, and is a Fellow with the ognized while serving in both the active accident investigation, aviation litigation Society. He retired from American Air- and reserve military forces for 23 years. support, auditing (compliance assess- lines after 17 years, serving as the head His experience as an aviator includes ments/audits), human factors, security of flight and system safety. Additionally, flight crew duties on both fixed-wing and programs and training, quality and he serves as an assistant professor at rotary-wing aircraft in the military and risk management programs and train- Embry-Riddle Aeronautical University commercial sectors. He currently holds ing, system safety, product safety, staff (ERAU) and is the discipline chair for multiple Federal Aviation Administra- acquisition, and SMS software. aviation safety. tion (FAA) certificates and licenses, The Flight Safety Information news- He has more than 35 years of safety including pilot, flight engineer, and letter and journals are a free service of experience as a professional pilot, safety airframe and powerplant (A&P). ◆

32 • ISASI Forum July–September 2011