Remarks of the Honorable Deborah A.P. Hersman
National Transportation Safety Board
April 29, 2010
NOTE: Text was corrected May 4, 2010.
Thank you, Ron [Schleede] and Frank [Del Gandio], thank you for inviting me to join you tonight. I’m grateful for the opportunity to visit with men and women who share a passion for making aviation as safe as it can possibly be.
And the fact is, air travel has never been safer. I am constantly reminded of that from my office at the Safety Board, where from my window, especially on a beautiful clear day like today, I can watch the constant stream of planes entering and exiting National Airport like clockwork. We have reached an era when aviation accidents are extremely rare – even shocking – and that has everything to do with the relentless commitment to perfection of many of the current and former NTSB investigators as well as our fellow investigators at the FAA, in the aviation industry, and our international counterparts – your hard work has paid off.
But with all that we have accomplished over the years, it is our job at the NTSB to never leave well enough alone. We always look at the glass as half empty. We are the parents at the playground who get nervous when their child climbs the jungle gym. Because no matter how reliable air travel has become, we’re always looking for what might go wrong -- and we still have a long way to go to make aviation safer.
Shortly after I became Chairman last July, I had the privilege of speaking at your International Seminar in Orlando. Looking forward to the work ahead, I identified three main goals for the NTSB: transparency, accountability and integrity. Let me update you on how some of those priorities have been advanced in the last year. In February Tom Haueter’s staff produced, and the Board adopted, the report on the Colgan accident investigation in advance of the one year anniversary. While we have completed our work within a year on a handful of investigations since I came to the Board in 2004, including the Lexington Comair and New York City Corey Lidle accidents, this marked the first time in over 15 years that we had held a public hearing and adopted a major accident report within a year of the accident. As Member Suwalt knows, in our tenures, the Board was criticized for not holding public hearings, last year we held five public hearings and this year we will hold two accident hearings, a forum on pilot and air traffic controller professionalism, a forum on fishing vessel safety and a symposium on code sharing arrangements and their role in aviation safety.
We began posting our dockets to the web last summer and when I checked today, Todd Gunther and his fellow investigators have posted 1,549 dockets to the web in less than a year. We have responded to requests from the co-chairs of IHST to gather more information in our helicopter accident investigations – after several years of encouraging regional investigators to use an enhanced checklist if they chose, Jeff Guzzetti has now made it mandatory and more organizational information will be collected in our investigations. We have also looked inward at the composition of our career management ranks and determined that we are not very diverse, so Vice Chairman Hart and our Executive Officer are leading a Diversity Task Force that will make recommendations to me in the coming weeks about how we can improve when it comes to recruitment, retention, and advancement – something that applies to all of our employees.
We are working hard to be more transparent, and accountable and demonstrate integrity, and there is more that needs to be done, but one element that unites these three goals is a willingness to openly and thoroughly investigate tough and even controversial questions. That is really the core of our job. When it comes to our investigations and our recommendations, our only agenda is safety, and our only client is the American people.
Right now, the NTSB is engaged in spirited consideration and debate over an issue that I know is front-of-mind for many of you: the use of data – particularly as it relates to Safety Management Systems, or SMS – in accident prevention and investigation.
Now, as you know, the concept of SMS is not new. In fact, since 2000, the NTSB has made 17 formal recommendations in favor of implementing SMS, five of them specifically directed at the aviation industry. For example, one of those recommendations – A -07-10 –recommends that the FAA require all Part 121 operators to establish Safety Management System programs.
For some of our board members and many in the industry, there is no question that we should move full speed ahead toward SMS. And lately the rhetoric in favor of SMS has bordered on exuberance. It concerns me that this approach often views SMS as a panacea to accident prevention.
For example, in 2008, the FAA Independent Review Team wrote that “Aviation accidents have become ‘one of a kind’ events. The forensic approach has been pushed to its limits” and at a presentation at the ICAO High Level Safety Conference last month, the FAA noted that due to SMS “Repetitive, recurrent common cause accidents will be essentially eliminated”.
Many of you have probably heard the old saying on Wall Street – “be fearful when others are greedy.” In other words, when you see a crowd all stampeding in one direction, it’s probably a good time to take a deep breath and ask questions.
And that’s my view: I will enthusiastically support any approach that will make our nation safer, but I think we need a measured approach -- one that acknowledges the potential benefits and limitations of SMS. And further, doesn’t discount tried and true methods for identifying vulnerabilities, such as accident investigations. So this evening, I will address the good, the bad and – the unknown -- of SMS – in the hope that it will help foster a richer, more thoughtful dialogue on this important issue.
As I’ve said, there is no question that when implemented correctly, SMS holds real promise in a variety of scenarios – and in fact, we have more than promise, but tangible results in many instances already. One good example can be found in a presentation by a corporate operator at a recent safety conference. The company in this example initiated an SMS program and the associated risk assessment of its operations. As part of the assessment, they incorporated Flight Operations Quality Assurance – or FOQA -- data and found some unusual excedences in bank angle and takeoff rotation rate. Further research indicated the excedences took place on positioning flights. When this was brought to the attention of the flight operations managers, their follow up with the operating crews resulted in a reduction of these events by about 80%.
Why was SMS successful at identifying and resolving this safety risk? For one reason, most of us agree on the parameters of normal operations, and deviations are easy to detect -- whether through recorded flight data or voluntary reporting systems. Because it’s relatively easy to identify problems like this one, they are similarly easy to solve.
The same can be said for improving air traffic control. San Francisco and Dallas-Fort Worth are historically congested airports, prone to runway delays and serious traffic flow conflicts. The FAA’s analysis of multiple airline’s aggregate Ground Proximity Warning Systems activations in San Francisco/Oakland led to major routing changes and significantly improved conditions. The same strategy was applied to Traffic Collision Avoidance System – TCAS -- warnings in the DFW area and led to changes that significantly reduced the warnings and, at the same time, improved the traffic flow. Here, again, the use of available data adeptly identified a clearly measurable set of red flags and allowed for a relatively simple and effective solution.
As a structured process for internal review and analysis, SMS clearly has merit. As we saw in the example given at the recent safety conference where unusual excedences in bank angle were dramatically reduced, SMS is a natural extension of existing methods for companies that have well-established safety review structures already in place. This example was successful because once the issue was identified, the company had a mechanism in place for quickly and effectively enforcing the necessary change. And if varieties of SMS are already working internally within companies with excellent safety records, perhaps an industry-wide standard for data collection will provide a framework that all companies can benefit from in equal measure.
But this raises a dilemma: all companies can’t benefit in equal measure if all companies don’t input and extract data with equal diligence and expertise. Further, companies that do not have a positive safety culture, companies that do the bare minimum to get by are not likely to look for problems – SMS isn’t going to make it any easier to make hard or expensive choices that affect a company’s bottom line. In other words, SMS will probably work well for the companies that are already getting it right, but may provide little more than false confidence for companies with less than robust safety cultures.
There is no doubt that SMS is an effective tool for collecting and organizing an enormous amount of information. But we must be equally focused on what we do with the information we collect. This reminds me of a news article I read regarding the recent safety recall by Toyota in response to accounts of stuck gas pedals and unintended acceleration in Toyota automobiles. The article revealed that driver complaints about speed control problems were higher for Toyota than for other big automakers – and that the pattern had been almost unbroken since 2004. Toyota and NHTSA both had the data; they just didn’t see the problem until it was too late.
Let me cite a couple examples involving Part 121 carriers where there was data pointing to problems that were not effectively addressed until after an accident occurred. If you think about it, CASS is really a mini-SMS focused on maintenance. Malcolm Brenner, you’ll remember that our investigators found there was plenty of data that amounted to major warning signs for the Grumman Mallard operating by Chalks, BEFORE the wing fell off in December 2005 – that information just wasn’t heeded. There were regular fuel leaks from the right wing of the almost 60-year old airplane in the months leading to the accident. Each time, rather than identify the root cause of the leaks, the fuel leak discrepancies were corrected by removing the existing sealant and applying new sealant. We determined that the probable cause of the accident was the in-flight failure and separation of the right wing during normal flight, which resulted from (1) the failure of the Chalk’s Ocean Airways maintenance program to identify and properly repair fatigue cracks in the right wing and (2) the failure of the Federal Aviation Administration (FAA) to detect and correct deficiencies in the company’s maintenance program.
In 2007 we saw an in-flight engine fire involving American Airlines 1400 in St. Louis. The fire was caused because crews used an unapproved procedure when attempting manual engine starts because it was quicker, more practical, and easier. Since the cause of the engine no-start condition was incorrectly diagnosed, the left engine ATSV had been replaced six times during the 12-day period before the accident to address these engine no-start events. Because of the intermittent nature of the failure, maintenance personnel found that replacing the ATSV appeared to allow the engine start system to work properly in all but one case; therefore, they cleared the logbook discrepancy and took the ATSV off of MEL status. But while each mechanic at stops along the way might not catch the problem, this is exactly the kind of data that should be picked up by a CASS program – but in this case it was not.
As we look to the implementation of SMS within the aviation industry, we should be mindful that SMS was actually pioneered by the maritime industry. After a number of very serious accidents which occurred during the late 1980's, were manifestly caused by human errors, with management faults also identified as contributing factors, the maritime industry recognized that something dramatic needed to be done. These management failures were famously characterized as “the disease of sloppiness.”
As a consequence of these accidents, the International Maritime Organization -- the UN body that plays a similar role in maritime as ICAO does for aviation – adopted a resolution on guidelines for the management of the safe operation of ships and for pollution prevention. The purpose of these was to provide those responsible for the operation of ships with a framework for the proper development, implementation and assessment of safety and pollution prevention management in accordance with good practice; to ensure safety, prevent human injury or loss of life, and to prevent damage to the environment. After some experience in the use of these guidelines, in 1993 IMO adopted the International Safety Management Code for the Safe Operation of Ships and for Pollution Prevention (the ISM Code).
The ISM code became mandatory in 1998. It establishes safety-management objectives and requires a safety management system (SMS) to be established by "the Company.” The procedures required by the Code should be documented and compiled in a Safety Management Manual, a copy of which should be kept on board.
Here, I am reminded of the Cosco Busan maritime investigation. When this tanker crashed into the San Francisco Bay Bridge, releasing 53,000 gallons of fuel oil into the water, I was the NTSB Board member on scene. As I mentioned SMS is required by the International Maritime Organization on all ships that travel internationally, including the Cosco Busan. But an SMS is only effective if the crew incorporates the principles and priorities into their day-to-day operations. In the probable cause we cited as a contributing factor to the accident, the failure of Fleet Management Ltd. to adequately train the Cosco Busan crewmembers before their initial voyage on the vessel, which included a failure to ensure that the crew understood and complied with the company’s safety management system. Let me tell you what I saw on a similar vessel in the port of San Francisco when I visited the bridge of the container ship, they had an SMS too. In fact, a bookshelf on the bridge was crammed full with binder after binder of SMS materials, but it was clear to see that unlike the ship’s navigational charts and operating manuals, which were clearly used heavily, the SMS binders were untouched.
This illustrates a critical point. With all the focus on creating appropriate data points and entry methods, let’s not lose focus on outcomes. The success of SMS won’t be measured by how much data we collect, but by how many lives we save.
Let’s also consider the dilemma of accidents caused by a combination of factors that SMS can’t possibly detect. Because, as we all know, the pages of our history books are filled with examples of accidents caused by an improbable chain of events.
Take the example of the British Airways 777 incident in January 2008. Some of you will remember that this flight experienced an incredibly rare dual engine power reduction. Both of the aircraft’s engines were reduced to idle during a normal descent to Heathrow Airport. On short final, when a power increase was commanded, the engines failed to respond. Fortunately, the crew did a tremendous job of getting the airplane within the airfield where they landed in the overrun area, despite being unable to get the engines above idle.
The extensive post-incident data analysis was ultimately not able to solve this accident. Here’s why: the dual engine power loss was the result of a freak phenomenon. The normally-occurring water molecules that can be found within fuel happened to collect on a single component in the fuel system, which formed an ice blockage. This was eventually only determined after a thorough forensic analysis – and because the event was so unique, none of the contributing factors were monitored by a data analysis system.
The same can be said for the TWA Flight 800 accident back in 1996. NTSB determined that the fuel tank explosion was the result of minimal fuel in the center fuel tank, allowing vapor to develop. Combined with an unusually hot day which heated the tarmac, the plane sat on the tarmac for a longer time than usual, which created a high level of flammable vapor in the fuel, and, most likely, a compromised wire which created a spark. There was no data set that could have predicted this tragedy, because the hazardous fuel vapors were known but the risk of this unusual set of circumstances was not appreciated before the accident.
So, there will be situations when the necessary data is available, but risks may not be identified and therefore effective solutions are not extracted. And, there will be situations where the chain of events that lead to an incident or accident are impossible to detect through SMS. But there will also be a third category – events that are accurately assessed with data, along with effective solutions, yet no action is taken to implement those solutions.
The fact is, our problem is not lack of information or ideas for making aviation safer. Every year, NTSB releases scores of formal safety recommendations based on extensive research and analysis – 860 in the past decade. We make these recommendations with a high level of certainty that if implemented, they will work. Yet we are frustrated by the the number of recommendations every year that are not acted upon.
This last point is not so much a critique of SMS but rather a question of how we should be focusing our time and efforts. The NTSB’s lifeblood is information, and we always stand ready to embrace methods that provide more of it. Yet it’s not clear to me that our biggest problem right now is lack of information or knowledge, but rather lack of resolve to affect positive change with the knowledge we have.
I began by saying that aviation has never been safer than today, and that is absolutely true. But we didn’t reach this point by natural evolution through the years. We reached it because generations of aviation professionals and investigators, like those of you here today, dedicated themselves to the constant pursuit of perfection.
My biggest concern about SMS and many of the programs that rely so heavily on data is that it will give the industry a false sense of security. A false sense that, with SMS, the hard work of safety has changed and that we have found something new to replace the old. Possessing data is not a panacea for any safety shortcoming. We know from years of history that aviation will only get safer because we take the time to investigate every angle, consider every problem, question the standard procedure and stand up to anyone who stands against change. Communicating what we find in our investigations is what we have always done at NTSB and what we always will do. Sadly, with respect to data, there is one thing that the data has borne out time and again -- merely communicating is not enough. Communication has to be translated into action. If changes are not made as a result of our investigations, history is bound to repeat itself.