Thank you Dr. Criner for that kind introduction, and thanks to Texas Southern University for inviting me to speak today on behalf of the National Transportation Safety Board at your Monthly Research Seminar. It is particularly an honor to be here during Black History Month because of my aviation history connection: that in 1926, my great uncle, James Herman Banning, was the first African American to receive a pilot’s license from the U.S. government.
To put my remarks in context, I would like to describe what the NTSB does. The NTSB is an independent federal agency that investigates accidents in all modes of transportation to determine what caused them and to make recommendations to prevent them from happening again. We are not a regulator. Instead, our primary product is recommendations, and we send them to any entity that can improve safety. Our world-class investigators and analysts don’t like to give up until they have the answer, and the recommendations that they create are so compelling that the recipients respond favorably more than 80% of the time, even though they are not required to.
I describe the NTSB as “independent” because of the structure that Congress, to its credit, gave us. The agency is led by five Board Members who are nominated by the President and confirmed by the Senate. The most important aspect of our independence is that the Members serve fixed terms, and the terms are staggered. Most political appointees, by contrast, serve at the pleasure of the President. In the real world, that means that if the appointee does something that is politically challenging or unpopular, the appointee may be out of a job. Serving in fixed terms helps to insulate Board decisions from lobbying by a manufacturer, an operator, or a union that is dissatisfied with our investigation of an accident that they are involved in.
In addition, very few political appointees have a substantive knowledge requirement. Our enabling statute, on the other hand, requires that at least three of the five of us have some relevant expertise. Moreover, the statute helps to create party balance by permitting only three of the five of us to be of the same political party as the President.
The purpose of these requirements is to help ensure that our determinations of causes of accidents, and our recommendations to help prevent more accidents, come from the facts and the evidence of our investigations, rather than from political forces or lobbying. The structure that Congress gave us does this very well.
What brought me to the NTSB? I trace it back to a book that I read in elementary school. The book was about accident investigations, and one that I particularly remember was about the Comet, the British-built jet that was the first jet airliner in commercial service. Because it was a jet, it could fly higher than previous airliners; and because it could fly higher, it was pressurized to a higher level than previous airlines, to enable the passengers to breathe at high altitudes without having to use oxygen masks.
Investigators had a major challenge because many Comets were departing from London, so many of them disappeared over the ocean. When they finally found enough pieces of an airplane to reconstruct it, they discovered that the problem came from the windows being square. As engineers know, stresses concentrate in sharp corners. The repeated pressurization, depressurization, expansion, and contraction of the fuselage, over and over again with each flight, finally caused one of the square window corners to crack, causing the airplane to decompress explosively. It was so amazing to me that they were able to put those gazillion pieces together and figure out the cause of the accidents in order to prevent future accidents. That is why airliners to this day have rounded corners on the windows and doors, and that is why I am at the NTSB today.
In addition to that, I am an airplane addict. My mother told me that the first thing she ever saw me draw was an airplane. I have always loved airplanes. That’s why I have a Master’s Degree in Aerospace Engineering, and that’s why I’m a pilot. After obtaining my Master’s Degree I went to law school, and I have been fortunate ever since that most of the positions I have worked in have drawn from both my engineering background and my legal background.
Now I would like to discuss how safe transportation is and describe some of the challenges in our efforts to continue improving that safety. With the exception of the recent tragic upturn in highway fatalities, all of the transportation modes that we investigate are generally becoming safer, and we like to think that we played a major role in that safety improvement.
The first issue I’ll discuss is fatigue. Fatigue is a fundamental challenge because most of the transportation we investigate is commercial transportation, and most commercial transportation is 24/7. Humans, however, are not 24/7, and that’s the fundamental disconnect. Many industries have hours-of-service rules for their drivers and operators, but we know from tragic experience that hours-of-service rules are necessary but not sufficient. In commercial trucking, for example, hours-of-service rules have been the norm for years. Yet we recently completed an accident investigation that, once again, demonstrated that hours of service rules cannot control what an operator does when he or she is not on duty.
In 2013, a tractor-trailer slammed into a line of slowed traffic on the New Jersey Turnpike, seriously injuring comedian Tracy Morgan and killing another passenger in the limo van in which he was riding. We found that the truck driver was in compliance with hours-of-service rules. Nevertheless, he had been awake 28 straight hours before the crash. He had been awake for 28 hours because on the day and night before picking up the tractor-trailer at his duty station in Wilmington, Delaware, he drove from his home in Georgia.
Thus, the challenge is how to ensure that employees arrive ready to perform their duties safely, and remain ready to perform their duties safely for the duration of their time on duty. In order to accomplish that, it is important to have a fatigue management program in addition to hours of service rules. A fatigue management program takes a holistic view of fatigue. It includes not only the operator, but also the dispatcher that assigns trips to the operator, the company’s rules that allow an operator to call in tired without punishment, and the operator’s family -- to help ensure that while dad is sleeping after his midnight driving shift, his daughter does not wake him up for money when the ice cream truck drives by.
Another aspect of fatigue that is emerging is obstructive sleep apnea, or OSA. As Americans gain weight, we’re seeing an increase in obstructive sleep apnea, which is strongly associated with Body Mass Index. Sleep apnea often goes undiagnosed, and even if it is diagnosed, it often goes unreported for fear of adverse consequences, such as job loss. But sleep apnea is treatable. Employers with sleep apnea programs find that when people seek treatment, they become safer drivers, their morale improves, the cost of training new drivers decreases, and productivity increases.
Another issue is distraction. Portable electronic devices give drivers more opportunities for distraction. Experience has shown that distraction is a big risk, whether it is texting, handheld, or hands-free. We have investigated fatal accidents in every mode of transportation that were caused by distraction.
Then there’s impairment. Alcohol has been a longstanding problem on our streets and highways, and the proportion of motor vehicle fatalities attributable to alcohol impairment has been stubbornly constant at about one-third for decades. The problem is being exacerbated by the legalization of marijuana in many states, and we anticipate an uptick in fatal crashes from that.
Last but not least, we’re seeing a troubling increase in the use of synthetic drugs. The NTSB recently investigated an accident in which a commercial truck crossed the median and struck a bus, killing the truck driver and four passengers on the bus. The truck-driver had been using a synthetic drug for which he had not been tested, and which was not illicit. In fact, while we don’t know where he purchased the drug, we do know that it is legally obtainable over the counter at truck stops. Something is definitely wrong with that picture.
The last issue I’ll discuss, because it may help address fatigue, distraction, and impairment, is automation. Most modes of transportation have increasingly been employing automation for years, especially aviation. As automation begins to appear on our streets and highways, our decades of experience investigating automation-related accidents could help inform the process.
Driverless cars are coming, and their potential for improvement is amazing. First and foremost, driverless cars could save many, if not most, of the tens of thousands of lives that are lost every year on our streets and highways – a very tragic and unacceptable number that has been decreasing for several years until it recently took a turn in the wrong direction.
Driverless cars could also increase the amount of traffic that our roads can safely carry because, instead of maintaining a car length separation for every 10 mph, as I’m sure we all do, driverless cars could reduce that separation. Stay tuned for what other changes might be possible.
How might that happen? Ideally, with automation.
It has been said that more than 90% of the crashes on our roads are due to driver error. The theory of driverless cars is that if there is no driver, there will be no driver error. Ideally, removing the driver would address at least four issues on the NTSB’s Most Wanted List – fatigue, distractions, impairment, and fitness for duty.
Extensive experience in a variety of contexts has demonstrated that automation can improve safety, reliability, productivity, and efficiency. That experience has also demonstrated that there can be downsides. The first downside is that the theory of removing human error by removing the human assumes that the automation is working as designed; so the question is what if the automation fails, as it will sooner or later. Will it fail in a way that is safe? If it cannot be guaranteed to fail safe, will the operator be aware of the failure in a timely manner, and will the operator then be able to take over to avoid a crash?
An example of the automation failing without the operator’s timely knowledge occurred in Washington in 2009 in a subway crash that tragically killed the train operator and 8 passengers. In that accident, a train temporarily became electronically invisible, whereupon the symbol of the train disappeared from the display board in the dispatch center. When a train became invisible on the board, an alarm sounded. This alarm, however, sounded several hundred times a day, so it was largely ignored.
Unfortunately, when the train became electronically invisible, there was no alarm in the train behind it regarding the electronic disappearance of the preceding train. Thus, the operator of the train behind was unaware of it. Instead, based upon the electronically unoccupied track ahead, the automation in the train behind began accelerating to the maximum speed for the area. By the time the operator saw the stopped train and applied the emergency brake after coming around a curve – which limited her sight distance – it was too late.
Another downside of automation is that even if the operator is removed from the loop, humans are still involved in designing, manufacturing, and maintaining the vehicles, as well as the streets and highways they use. Each of these points of human engagement presents opportunities for human error. Moreover, human error in these steps is likely to be more systemic in its effect – possibly involving several vehicles – and more difficult to find and correct. An example of this lesson learned is the collision of an automated – driverless – people mover into a stopped people mover at Miami International Airport in 2008. That collision was caused largely by improper maintenance.
Another challenge with automation occurs if it encounters a situation that was not anticipated by the designer of the automation. A textbook example of that problem is the crash in 2009 of Air France 447, a flight from Rio de Janeiro to Paris. After the airplane reached its cruise altitude of 37,000 feet at night over the Atlantic and began approaching distant thunderstorms, the captain left the cockpit for a scheduled rest break, giving control to two less experienced pilots. The airplane had pitot tubes that project from the fuselage to provide information about how fast it was going. Airspeed information is so important that there were three pitot tubes – for redundancy – and the pitot tubes were heated to ensure that they were not disabled by ice. At the ambient temperature of minus 50-60 degrees, and with abundant super-cooled water from the nearby thunderstorms, the pitot tube heaters were overwhelmed, and the pitot tubes became clogged with ice, so the airplane no longer knew how fast it was going.
The loss of airspeed information caused several systems to quit, including the automatic pilot that was flying the airplane and the automatic throttle that was maintaining the selected speed. As a result, the pilots suddenly had to fly the airplane manually. The loss of airspeed information also rendered inoperative the automatic protections that prevent the airplane from entering into an aerodynamic stall, in which the wings no longer produce lift. The pilots responded inappropriately to the loss of these systems, and the result was a crash that was fatal to all 228 on board.
As with most accidents that we investigate, several factors played a role. To begin with, the redundancy of having three pitot tubes was not effective because all three were taken out by the same cause. In addition, the pilots had not experienced this type of failure before, even in training, where the problem can be simulated in very realistic simulators, and they were unable to figure out what happened. Finally, use of the automatic pilot is mandatory at cruise altitudes, so the pilots had not flown manually at that altitude before, even in training in the simulator. This is important because the airplane behaves very differently at cruise than it does at low altitudes, such as during takeoff and landing. Other operational and design issues compounded the problem and led to a tragic outcome.
As an aside, the pitot tubes had frozen before in that type of airplane, but the pilots in those previous encounters responded successfully. Consequently, the fleet, including the accident airplane, was scheduled for the installation of more robust heaters, but given the previously successful encounters, an immediate emergency replacement was not considered to be necessary.
Automation in cars will also introduce ethical issues that we have not seen before. For example, if your car encounters an 80,000-pound truck coming at you in your lane, for whatever reason, and on the sidewalk next to you are 15 pedestrians, will your automation save you by going up on the sidewalk and taking out the pedestrians or will it send you into the truck to save the pedestrians? This is an issue that, in my view, should be addressed at the federal regulatory level. Not only will federal leadership on this issue avoid a patchwork quilt of requirements from the states, but the federal government is best situated to help ensure that our response to this issue is harmonized with the responses from other car producing nations, such as Germany, Japan, and Korea.
I’ve already seen a need for the auto manufacturers to learn from aviation’s automation experience. At the Detroit auto show recently, then-NHTSA Administrator Rosekind noted that the industry needs to focus more on human factors. In aviation, they discovered that automating something did not necessarily make it safer, so they evolved from “automate it because we can,” i.e., because it is technologically feasible, to “automate it only if it makes the person-machine system safer.”
Before I conclude, I would like to say a word, to those of you who are students, about your future. Kudos to you for being here to advance your education because the more education you have, the more likely you are to be engaged in your working career in ways that you thoroughly enjoy. Hopefully you will be as fortunate as I have been in putting your time and energy into something that you are passionate about and still earning a living doing it. Do what you love, strive to do it as well as you can, and continue raising the bar, and the rest will follow. I wish you the best of success in your future careers.
Thanks again for inviting me today. I would be happy to take your questions.