Remarks by Jim Hall
Chairman, National Transportation Safety Board
Global Summit on International Aviation Infrastructure
The George Washington University
November 3, 1999
Thank you, Congressman Mineta. Thank you for your kind comments and for your hard work over the years to improve transportation safety for the American people and for your support of the Safety Board.
I appreciate being invited to be here this morning to speak to such a prestigious gathering of aviation experts.
As all of you know, aviation is one of the safest modes of transportation available to the world's travelers. Many of you in this room share in the responsibility for maintaining that enviable safety record. Undoubtedly, we all have theories about how to best fulfill that responsibility. But, hopefully, we can all agree that it takes everyone's efforts to ensure the continued safety of the aviation system -- whether it is by developing priorities based on statistical analysis or by focusing attention on what, on occasion, has been pejoratively named the "accident du jour."
It may surprise some in this room that I believe there is a place for both. But, if we are to have a truly safe system, each must be given equal priority and attention by the industry and the regulators. If they aren't, the system will never be as safe as it can -- or should -- be. To be sure, in some cases, the industry and the regulators have the "luxury" of developing statistical databases and observing developing trends that can help them make safety decisions.
Accident investigators, on the other hand, must effectively deal with those accidents as they occur, determine their implications for aviation safety, and recommend ways to prevent the next accident. The rest of the aviation community must then implement those recommendations.
I'm sure many of you are aware of the National Transportation Safety Board's (NTSB) work -- in fact, over the years, we've worked with many of you and your countries on accident investigations. The Board's job is to investigate all commercial and general aviation accidents in this country, and to lead the United States' team that assists other governments with their investigations of accidents involving U.S. airlines and U.S.-manufactured aircraft. In just the past two years, we have assisted foreign nations with their investigations of some 40 accidents.
It is important to note that we don't investigate accidents in isolation. We involve all of the organizations with an interest in a particular accident -- the regulators, the airlines, the manufacturers, the unions --- through what is known as the party system. The primary goal of every investigation is to prevent other accidents from occurring by conducting thorough, independent, and objective investigations of accidents and incidents. And, then recommends ways to correct the problems found.
In order to accomplish that goal, the Safety Board uncovers and reports on the deficiencies it finds -- whether they're in pilot training or performance; aircraft design and manufacture; air traffic control services; airline management oversight; or Federal Aviation Administration (FAA) certification, surveillance, and oversight. But, even as we do this, our investigators never lose appreciation for the professionalism and dedication of the people in the aviation community or the precision and safety of the aircraft.
The U.S. Congress, more than 30 years ago, established the Safety Board to serve as an independent agency -- separate from the Department of Transportation (DOT). In addition to investigating accidents, we were given the responsibility of providing oversight for the transportation industry and DOT's modal administrations.
This system has served the country well. And, has helped give the American people confidence in their transportation system. But, maintaining that confidence requires constant vigilance and is the duty of all of us in the aviation community -- the FAA must properly regulate the industry; the airlines must ensure the safety of their operations; the manufacturers must design and build safe aircraft; and the NTSB must assure the traveling public that there is an independent review of how well those entities are fulfilling their responsibilities. Obviously, this interrelationship creates a healthy tension between all of the participants. It's meant to be that way -- by design -- and it works.
The system has resulted in, as I said earlier, a remarkable safety record. In fact, 1998 was the safest year in U.S. aviation history. But, that record suggests that to reduce the accident rates further, it will take extraordinary measures because the "easy" accident causes have been isolated and corrected. That leaves the "tough" ones to be solved and prevented. The Rand Corporation, an international "think tank", in a soon-to-be-released report on the NTSB, indicates that although future major accidents in the United States will probably be fewer in number, they will also be more complex. In other words, accident investigations such as USAir flight 427 and TWA flight 800 will more likely be the norm rather than the exception.
If Rand is correct, we believe they are, that accidents will only become more complex, we'll need more -- and better -- data to help us determine the cause of such accidents. In fact, no accident prevention program by either the government or industry will be successful unless better data is available to investigators. There is no better argument for improving both flight and cockpit data recorders. At a minimum, we need more parameters recorded, longer recording time, backup electrical power, and improved crash survivability. The Board has been asking for those enhancements for years. Yet, progress to date has been glacial. The result has been extensive and exhaustive search and recovery efforts that have proven to be very expensive for the American taxpayers -- efforts that may not have been necessary if more information had been available to investigators.
That has been one of my major frustrations in my five years as Chairman of the Safety Board. I have heard no viable justification for the delay in making these improvements. If we all agree that only the most difficult problems remain and that we need improved data to solve them, one must wonder why we aren't all doing everything possible to gather as much accurate data as possible. Perhaps part of the answer lies in the perception that FDR data is of more interest and benefit to those responding to an accident. This information has not been routinely used in programs such as the FAA's Safer Skies and the industry's Commercial Aviation Safety Team (CAST) that focus on statistical assessments of existing accident databases to identify problems, assess risks, and focus their efforts and resources. However, the success of other initiatives such as Flight Operations Quality Assurance (FOQA) will also depend on the collection and analysis of FDR data.
Don't misunderstand me, as I indicated earlier, the Safety Board is supportive of any endeavor that improves aviation safety and I am confident that these initiatives will show some positive results. In fact, some of the concerns identified by those programs, such as runway incursions, are also on the Board's Most Wanted List of Safety Improvements. However, I also believe that using simple statistics and an actuarial approach should not be -- in fact, cannot be -- the sole approach to making our skies safer. While we must deal with the most frequently occurring types of accidents, such as Controlled Flight Into Terrain (CFIT), we must also address catastrophic accident causes that haven't yet become statistically obvious - such as uncommanded rudder deflections and fuel tank explosions - causes that must be addressed and eliminated. While some may argue that the 365 people killed in the three accidents caused by those factors aren't statistically relevant -- the families of the victims and I believe they are.
I am also concerned that there is one factor that isn't addressed by either Safer Skies or CAST -- one that the Board has repeatedly discussed in its reports and frequently named as part of the probable cause -- corporate culture. We all know that accidents are rarely caused by a single cause -- rather, they are usually the result of a number of interdependent causes -- many of them related to the culture -- the operating environment -- of an organization.
Professor James T. Reason, in his forward to the book, Human Error in Medicine1, stated that:
Unsafe acts are like mosquitoes. You can swat them one at a time, but there will always be others to take their place. The only effective remedy is to drain the swamps in which they breed. In the case of errors and violations, the "swamps" are equipment designs that promote operator error, bad communications, high workloads, budgetary and commercial pressures, procedures that necessitate their violation in order to get the job done, inadequate organization, missing barriers and safeguards.... not all of these latent failures are, in theory, detectable and correctable before a mishap occurs.
It becomes the job of the investigator, following an accident, to explore the swamps to find out what role, if any, they played. If you look at the chart (figure 2), you'll see that it depicts the causes of past airline accidents and is used to focus resources on accident prevention endeavors. You'll notice that management and organizational factors -- a company's corporate culture -- isn't listed. Yet, these factors have contributed to the cause of a number of accidents. Let me give you just a few examples:
· The 1988 Aloha Airlines 737 accident in Hawaii (figure 3). The severely deteriorated condition of that plane's fuselage had been identified and reported to the management of the airline, the manufacturer, and FAA before the accident. Yet, nothing was done.
As a result of our investigation and safety recommendations, major worldwide programs were implemented to improve maintenance and inspections of aging aircraft structures. However, that experience didn't cause either the industry or the FAA to consider whether age might affect other systems on the aircraft as well. No one transferred the lessons learned from the Aloha accident to the aircraft's wiring and systems. Those lessons had to be relearned eight years later following the crash of TWA flight 800.
· The 1994 USAir flight 427 accident in Pennsylvania. (figures 4 & 5) I would also add the 1991 United flight 585 in Colorado and the numerous incidents of rudder system-induced upsets that the Board has investigated. Soon after the USAir accident, the NTSB recommended modifications to the rudder system. Both the industry and FAA maintained the changes aren't necessary -- although they are in the process of making some of the modifications. Yet, we continue to have rudder-related incidents reported to us - including one just before our Board Meeting on 427 in March. And, we're still waiting for the 11-parameter FDRs on the 737 to be upgraded so that we can better understand what anomalies may still exist.
· The 1996 ValuJet flight 592 accident in the Everglades. (figures 6 & 7) This accident occurred even though the Safety Board had issued safety recommendations eight years earlier that urged the installation of fire detectors and extinguishers in passenger airline cargo compartments. Those recommendations stemmed from the findings of an earlier non-fatal accident (the 1988 American Airlines MD80 accident in Nashville). But, the industry and the FAA believed that the costs to fix the problem outweighed the benefits. Another 110 people had to die before any action was taken. Yet, to date, according to the FAA, only 16 percent of the more than 4,000 aircraft that require fire detection and suppression equipment have had it installed. And, airlines have been given until March 2001 to complete the retrofit.
· And, lastly, the 1996 TWA flight 800 accident in New York. (figures 8 & 9) Three months ago, we learned of a Boeing report, done in the 1980s, that discussed the high temperatures in the center wing tank's configuration on the military version of the 747. Apparently, we weren't told of it because the commercial and military divisions of Boeing do not communicate with one another -- despite using similar aircraft designs. Unfortunately, this isn't the first time we've found that a problem surfaced in the military version of an aircraft, but the information wasn't shared with the commercial sector -- information that was paid for by the American people.
Just last week, after three long years, the FAA finally announced new procedures for inspecting and maintaining aircraft fuel tanks and changes to the certification process for new planes. This after both they and the industry have argued that fuel tanks were safe, were not flammable under most conditions, could not explode, and that all ignition sources had been designed out the tank. Sadly, their reluctance to move forward on our recommendations -- made only three months after the accident -- has helped perpetuate speculation that a missile or some other projectile brought down the plane.
What all of this illustrates is that individual accidents can -- and do -- highlight failures in the system -- failures that must be identified and corrected long before they can become statistically relevant. And, I believe that it also shows that independent accident investigative bodies are a necessity -- not a luxury. No entity should be expected to oversee itself -- it doesn't work. I have long advocated that all countries should have an investigative organization separate from other governmental agencies.
There has also been considerable progress made in the international arena under the leadership of the International Civil Aviation Organization (ICAO). The Global Aviation Safety Action Plan and the Safety Oversight Program being implemented by ICAO are impressive and positive steps toward improving airline safety on a worldwide basis. Bilateral and regional partnerships and cooperative action plans are being put in place around the world to ensure adequate communication of safety information and timely notifications and reporting of accidents and incidents.
The Swissair flight 111 crash, in September 1998, near Halifax, Nova Scotia demonstrated the need for such plans. Between 1993 and 1995, the FAA had conducted flammability tests of aircraft insulation following fires on five airliners. Despite findings that suggested airworthiness concerns, the FAA took no corrective actions. The fires had occurred in three countries, Italy, Denmark, and China, but the NTSB only participated in the Italian and Danish investigations. Although the Chinese did an excellent job of investigating the three fire events in their country and forwarded their findings and concerns to the manufacturers and the FAA, the Safety Board was never told of the events.
The Canadian Transportation Safety Board will determine whether those accidents are relevant to the Swissair accident. However, they certainly illustrate the need for notification and reporting of incidents and accidents by an independent investigation authority in accordance with ICAO guidance.
Despite what some may think, my message today is not meant to be negative. Statistical analyses are invaluable -- they give us the ability to develop and analyze trends in aircraft accidents. However, we can't wait for statistics to tell us where to focus our attention. Unfortunately, catastrophic accidents continue to occur that don't fit the statistical models -- and may never fit them.
And, when those accidents occur, one of the keys to preventing a similar accident is an in-depth, independent investigation to identify the underlying factors that led to the accidents. As I said earlier, most of the "easy" accident causes have been fixed and future occurrences prevented. We are left with the "tough" ones, the ones with multiple causes, and they will by their nature make us work harder to solve them. It will take all of us, working together in that effort, to make aviation even safer in the next century. That is certainly the case in the crash of EgyptAir flight 990 in which 217 people lost their lives. The investigation of that accident promises to be long and arduous.
Thank you, again, for inviting me to be with you today.