Skip Ribbon Commands
Skip to main content
Bookmark and Share this page

Speeches

​“Lessons from the Ashes: Improving International Aviation Safety through Accident Investigations” 14th Annual Assad Kotaite Lecture Montreal Branch of the Royal Aeronautical Society, Montreal, Quebec
Robert L. Sumwalt
Montreal, Quebec
12/7/2017

Download the presentation

Good evening! I am absolutely thrilled to be in Montreal, speaking here at ICAO headquarters, to present the 14th Annual Assad Kotaite Lecture. I never had the pleasure of knowing Dr. Kotaite, but I do know that he provided profound leadership to further international aviation, and in particular, aviation safety. 

I’m also happy to be here at the hub of international aviation on a very special day - International Civil Aviation Day. It was 73 years ago today that the Chicago Convention was signed by the first signatory states.

As you may know, the current five-year theme of ICAO is “Working Together to Ensure No Country is Left Behind.” Today I met with ICAO Secretary General Liu and she and I both agree that we all have an obligation to help each other. When one of us has information that can help others, we need to share it. In the accident investigation world, we do that well and I’m absolutely convinced that aviation safety has dramatically improved by worldwide collaboration. When an accident occurs, through ICAO protocols, the “state of occurrence” – the country where the accident occurred – typically invites countries such as the state or manufacturer, registry, or operator to participate in the investigation. By working together, we can share expertise and knowledge to ensure that the investigation truly accomplishes the goal of learning what happened so we can prevent future accidents.

As Stewart [Schreckengast] said when he introduced me, I began flying for an airline in 1981. At that time, there was still some distrust of big brother and companies using Flight Data Recorders (FDR) and Cockpit Voice Recorders (CVRs) to “spy” on pilots.

Look how far we’ve come. For years now, not only are CVR’s in every airline cockpit, but now, airlines and several business aviation operators routinely monitor hundreds of parameters from flights to look for exceedances or deviations. And, to top it off, these operators actually share their data with government and industry to look for potential problems so they can be addressed before they lead to accidents. It’s a system that is built on trust. Honestly, I believe this is one of the big reasons our global aviation safety record has gotten as good as it is. 

I think it’s somewhat ironic that the reason aviation has gotten safer is because of accidents, but as an accident investigator, I believe that to be true. As ICAO Annex 13 states, “The sole objective of the investigation of an accident or an incident shall be the prevention of accidents and incidents. It is not the purpose of this activity to apportion blame or liability.” So, by conducting thorough accident investigations, we are able to identify deficiencies and issue safety recommendations to prevent future accidents.

I’m always a bit reluctant to tout the accident record because I don’t want to jinx it. That said, let’s talk about airlines in the US. The US air carriers have had a very good safety record for the past few years. The last passenger fatality onboard a US air carrier was the 2009 crash of Colgan Air near Buffalo, New York. In 2013, three passengers died when a foreign air carrier, Asiana, crashed at the San Francisco International Airport. Six weeks later, two pilots lost their lives when their Airbus A300-600 cargo plane crashed at Birmingham, Alabama. For general aviation, two weeks ago we announced that, last year - for the first time in the NTSB’s 50-year history - the general aviation fatal accident rate dropped below 1.0 fatal accidents per 100,000 flight hours. And, while we lose around 400 people annually in general aviation crashes, the single most deadly aviation accident in the US since the 2009 Colgan Air crash – general aviation or airline – occurred last year when a hot air balloon crashed and claimed 16 lives.

 People ask me what keeps me up at night. It is drones? Is it Controlled Flight Into Terrain (CFIT)? Is it Loss of Control? Is it runway safety? Is it automation? What is it?

I do worry about those things – each presents their own challenges. But for me, given the low accident rate that we’ve been fortunate to achieve – not just in the US, but for the most part, worldwide – what I really worry about is complacency. Complacency with operators, complacency with regulators, and complacency with maintenance and flight crews.

 An unfortunate example of complacency occurred in May 2014 when a Gulfstream G4 crashed after overrunning the runway during a takeoff in Bedford, Massachusetts. The investigation revealed that flightcrew attempted to depart without disengaging the flight control gust lock, a key element of pre-flight checklists for any airplane. After discovering that the gust lock was on, instead of rejecting the takeoff, the crew continued to troubleshoot the issue while accelerating down the runway. The delayed and poorly executed rejected takeoff led to a high-speed overrun. The aircraft collided with the bank on the far side of a narrow river. The aircraft erupted into a fierce fire, claiming the lives of all seven onboard. 

Releasing the gust lock was the fourth item on both the G4 Starting Engines checklist contained in the Airplane Flight Manual (AFM), and the checklist used by the pilots in training. The CVR revealed that not only was this checklist not verbalized, but neither were any of the four remaining checklists. Although it’s possible that the checklists could have been accomplished silently, this would have been contrary to the crew’s training, which called for ‘challenge-response’ checklist execution.  The NTSB noted there was no discussion of checklists before, during, or after engine start or throughout taxi, and there were no statements to denote the checklists were completed.  The NTSB concluded “the crewmembers’ lack of adherence to industry best practices involving the execution of normal checklists eliminated the opportunity for them to recognize that the gust lock handle was in the ON position and delayed their detection of this error.”

Based on information from the FDR, investigators learned that the crew did not accomplish a flight control check to check for freedom of movement of the controls. An even more troubling discovery was made by the NTSB by analyzing additional information from an onboard Quick Access Recorder: Of the 175 previous flights for this crew, a complete flight control check was skipped on all but two flights. “Given that the flight crew neglected to perform complete flight control checks before 98 percent of the crewmembers’ previous 175 takeoffs in the airplane, the flight crew’s omission of a flight control check before the accident takeoff indicates intentional, habitual noncompliance with standard operating procedures,” stated the NTSB.

The NTSB issued a safety recommended to the National Business Aviation Association (NBAA) to work with business aviation flight operational quality assurance (FOQA) groups to analyze existing data for noncompliance with flight control checks before takeoff. NBAA responded by analyzing data from over 143,000 business aviation flights and discovered that on nearly 18 percent of the analyzed flights, the flightcrews did not perform complete flight control checks before takeoff. “As perplexing as it is that a highly experienced crew could attempt a takeoff with the gust lock engaged, the data also reveals similar challenges across a variety of aircraft and operators. This report should further raise awareness within the business aviation community that complacency and lack of procedural discipline have no place in our profession,” stated the NBAA report.

From the Bedford crash, we also issued a recommendation to International Business Aviation Council (IBAC) to “amend International Standard for Business Aircraft Operations (IS-BAO) auditing standards to include verifying that operators are complying with best practices for checklist execution, including the use of the challenge-verification-response format whenever possible.”

Loss of control (LOC) in flight is another thing that keeps me up a night. As mentioned, we fortunately haven’t had many recent accidents involving major air carriers in the US, so I’ll again focus on general aviation where we continue to have around 1,200 accidents each year. General aviation loss of control inflight is on the NTSB Most Wanted List of Transportation Safety Improvements. From 2008 to 2014, nearly half of fatal fixed-wing general aviation accidents in the US were LOC-related. During this time, LOC in flight accounted for 1,194 fatalities.

Most LOC in flight accidents involve light single and twin-engine aircraft, but I’ll mention two that involved turbine-powered aircraft. The first was an Embraer Phenom 100 at Gaithersburg, Maryland, which occurred in December 2014. The NTSB determined that during the descent and approach, the aircraft flew in conditions conducive for structural icing for at least 15 minutes. Despite these conditions, the pilot did not activate the wing and tail deicing equipment. The icing conditions led to a stall prior to sounding of the aural stall warning or the activation of the stick shaker. Aircraft control was lost and unfortunately, when the upset occurred, the aircraft was too low for a successful recovery. The aircraft struck the first house in a 110-degree left-wing-down attitude. The three occupants of the aircraft were killed, as was a young mother and her two children who were in a house that was consumed by the post-crash fire.  

While discussing this accident, let me applaud Embraer for their decision to install a CVR and FDR, even though these recorders were not required for aircraft of this size. The NTSB’s report specifically stated: “Embraer’s decision to install a cockpit voice and data recorder in the [Phenom] fleet greatly benefited the NTSB’s investigation …. by ensuring investigators had access to critical information for determining the sequence of events that led to the accident and identifying actions needed to prevent a similar accident in the future.” So, if you have the opportunity to influence other manufacturers to do the same, please do.

The second accident occurred in November 2015. A Hawker 700A crashed into a neighborhood in Akron, Ohio where the lives of all nine onboard were lost. The investigation found multiple deviations from standard operating procedures, including continuing the instrument approach despite the approach being unstabilized. The entire approach was flown well below the reference approach speed. Upon reaching the minimum descent altitude, airspeed was 11 knots below the Vref speed. Consequently, when the pitch attitude was increased to arrest the descent, the aircraft stalled and aircraft control was lost.

So, LOC is still with us, as well as CFIT.

Terrain Awareness and Warning Systems (TAWS) have certainly significantly decreased CFIT accidents. But, as we saw in the 2013 crash in Birmingham, Alabama of a United Parcel Service (UPS) Airbus A300-600 freighter, even today’s TAWS can have limitations. TAWS provide two flightcrews with types of alerts: caution and warning. Caution alerts call attention to the aircraft state or presence of terrain but do not issue a command to the pilot. Warning alerts call attention to terrain or obstacles and also issue a command to the pilot. The intent of providing two levels of alerts is that the pilot will receive an escalating series of alerts (for example, one or more caution alerts followed by one or more warning alerts) as a collision with terrain or obstacles becomes more imminent. In this case, the caution alert did not sound until one second after the aircraft impacted trees.

Some TAWS units, including the one installed on the accident aircraft, become desensitized to reduce nuisance alerts when the airplane is in landing configuration or within 2 miles of the airport. As we saw in this crash, due to the aircraft’s high rate of descent and being close to the airport, combined with the TAWS desensitization, the TAWS did not generate a “caution” following by “warning” alert prior to impacting terrain.

The investigation also revealed that UPS did not update the TAWS operating software. The NTSB determined that if the airplane had been equipped with a newer software, the caution alert would have sounded about 6.5 seconds earlier and 150 feet higher than it did with the older software installed on the accident airplane. That said, because it could not be conclusively determined if the pilots would have responded within 2.5 seconds, the investigation was unable to determine whether these software enhancements would have prevented the accident. Although it cannot be said for certain that these upgrades would have prevented the crash, I can say with certainty that it would have provided the crew with a greater opportunity for avoiding the crash.

Moving back to the theme of sharing and learning from each other, I’d like to leave you with two things that I believe are crucially important to accident and incident investigation. I certainly don’t want to leave you with the impression that the NTSB has all the answers to everything involving accident investigation. We don’t. We certainly learn a lot by visiting with and listening to other accident investigation authorities across the globe. We certainly learn a lot by liaising with ICAO. We keep in touch with ICAO’s Marcus Costa. Frank Hilldrup is NTSB’s international liaison and he does a great job of keeping in touch with the international community. We often host representatives from other countries. In fact, we have two representatives from Nigerian Accident Investigation Bureau who are spending the month of December with us, working alongside our investigators in our labs. In October our senior leadership team traveled to Ottawa to spend the day with Transportation Safety Board of Canada so we could exchange ideas. So, in the spirit of sharing information, let me leave you with two thoughts that I believe are important aspects of accident investigations.

First, I believe it’s important that the investigation is independent of outside influences. When the NTSB was originally formed in 1967, it was administratively part of the US Department of Transportation (DOT). In 1974, however, Congress moved NTSB completely outside of DOT and made it independent of all other agencies.

Why did Congress do that? According to a Senate Committee report, “The Board was intended by Congress to be independent so that it would be free (and feel free) to criticize activities of the Federal Aviation Administration, where its investigations indicated that the FAA was at fault…. In retrospect, the arrangement specified [when the legislation was written] has not worked out well.”

The Senate report noted that in 1970, the then-FAA Administrator and Deputy Administrator tried to pressure the NTSB to rewrite the draft report of a mid-air collision that occurred the year before and claimed more than 80 lives. According to the report, “The Board planned to point out the fact that the FAA had not acted upon many of [the] recommendations [that may have prevented the accident].” The Senate report asked rhetorically: “How can a Board retain independence if its members are threatened if they vote to support comments critical of DOT?”

The Senate report said it quite well: “The most important single aspect of the National Transportation Safety Board must be its total independence from those governmental agencies it oversees in regard to their transportation regulatory functions. If the Board is under pressure from any administration to pull its punches or to tone down it’s reports or to gloss over Government errors in transportation safety, then its watchdog function has been fatally compromised. The public can then have no confidence that its interest are being protected by a professional agency which has no responsibility other than safety.”

The second critical aspect of accident investigations, in my opinion, is transparency. We live in a world where there is distrust of government. We live in a world of cynicism and skepticism. We live in a world where there is a 24-hour news cycle. Look what happened with the disappearance of MH370 – for weeks upon weeks, CNN had nearly continuous coverage of talking heads, all speculating on something they really knew nothing about.

One way to counter misinformation is being transparent. When I’m talking about transparency, I’m not talking about tweeting every single thing that you find. Rather, I’m talking about releasing factual information, in a controlled and deliberate manner. I’m talking about allowing the public to see inside the investigative processes so a reasonable person can draw the same conclusions as you did.

How do you do that? I imagine it depends on several factors that are unique to your culture and norms. For us at the NTSB – and again, this may not be what works best for your country or culture – we provide daily press briefings while on scene. Each day we release factual information that we discovered during the day. Sometimes is very general (e.g., “Today we conducted a preliminary audition of the CVR. The flightcrew did not discuss any problems with the aircraft prior to the crash”) or it may be very specific (e.g., “The preliminary readout of the FDR shows that at 208 feet above ground, the airspeed was 98 knots”). During these on-scene press briefings, we do not attempt to draw conclusions about what the facts may mean, nor do we ever speculate about the accident’s cause. After we leave the scene, some weeks or months into the investigation, we may provide an investigative update press release. After the majority of the investigative group chairmen have completed their factual reports, we place this information into a public docket that is available on our web page. With just a few clicks of a mouse, the public has access to a plethora of investigative information. (Information that is deemed to be proprietary or trade secrets are generally protected from public disclosure). Finally, when our Board deliberates the final report of the accident, it is done in a publicly-announced meeting that is open to the public. It is also webcast. The final report is also posted on our website after adoption by the Board.

If we don’t provide the information, someone else will, albeit talking heads on the TV, newspaper articles, or through social media. I believe it is in the best interest of the public and in the interests of improving safety, to be open and transparent with investigations.

So, if I were to leave you with two suggestions, it would be to ensure your investigations are independent and to ensure they are transparent. These concepts are so important to us at the NTSB that they comprise two of our four core values.

In closing, I think it’s important to keep in mind why the 192 member states of ICAO investigate accidents and incidents – it’s ultimately to improve international aviation safety. Outside of our training center, we have in etched glass the saying; “From tragedy we draw knowledge to ensure the safety of us all.” That’s what we do – we are in the business of preventing accidents, reducing injuries, and saving lives.

Thank you for all you do to accomplish these noble efforts.