Wednesday, May 5, 2010

Hudson River Landing Illuminating But Not a Miracle

In bringing the official investigation into the Hudson River landing of USAirways flight 1549 to a close on Tuesday, the National Transportation Safety Board, did not conclude the ditching seen ‘round the world was a miracle.
“Even in an accident where everyone survives, there are lessons learned and areas that could use improvement,” said Deborah Hersman, the chairwoman of the board.

It is a valid and important point.
The so-called Miracle on the Hudson, fits into no category better than “other”, still there are those who would rather it be the poster child for a different way of looking at transportation safety, including the man who has become an icon of the event, Capt. Chesley Sullenberger.
At present, the popular gauge of safety is fatal accidents. No fatalities = a safe year. This is not true of course, but it is an easy leap and journalists as well as the general public often jump to that conclusion.
The flip side is a proactive philosophy of transportation safety that focuses on incidents as important precursors to accidents.
In 2006, the International Society of Air Safety Investigators held a conference in Mexico. While the sun beamed outside our overly chilled conference center, the spotlight for three days was not on accidents but incidents.
What’s the difference? Accidents wind up on the evening news. Incidents do not. They are the near-hits, the “What the f-?”, the there-but-for-the-grace-of-God-go-I events . Most of the time, passengers don’t even know they’ve been in one.
If the idea of discussing what didn’t happen sounds like a big snooze, let me assure you, it is not. Start with the premise that every accident lies at the end of a chain of events. To prevent that accident only one link in the chain has to be broken. In this reality, non events are exciting because they are exposing the places where accidents can be prevented.
This is what Ms. Hersman is talking about when she sends a delicate sprinkling of rain on the parade of accolades that have deluged everyone and everything associated with USAirways Flight 1549.
During the controversy over two books about the accident, Chesley Sullenberger’s Highest Duty and William Langewiesche’s Fly by Wire, which I wrote about for The New York Times, Capt. Sullenberger told me he was counting on the safety board to properly credit the many links in the chain of events on January 15, 2009.
At the time, he was referring to Langewiesche’s book in praise of the French designed Airbus A320 with its highly automated cockpit. But in subsequent conversations, Capt. Sullenberger continues to insist, it is not about the airplane, or the pilots, a proper allocation of credit is critical.
“This outcome was the result of more than one person,” he told me. “Among the things that went right you have to have a clear understanding of the degree to which each of these factors contributed and they have to be weighed in an accurate way.”
Why didn’t the 150 passengers and five crew members drown in the frigid waters of the Hudson River on that day in January? Why didn’t the loss of engine power contribute to a stall of the airplane? Why didn’t the pilots and flight attendants make critical errors in judgment faced with a horrifying lack of options shortly after takeoff?
Asking these questions turns the traditional investigation on its head. Asking why events went right can be as illuminating as examining the events that have gone tragically wrong.
In a presentation at the conference in Cancun, safety engineer Richard (Dick) Wood recalled having often been told “’If we want to prevent accidents, we have to work on preventing the incidents first.’ Is that true? Yes it is.”
I’m not alone in criticizing manufacturers and regulators for taking a tombstone approach to safety. When enough people die, a previously identified problem will get fixed. (When I worked in television news we had a variation we called the “if it bleeds it leads” decision.) Accidents capture public attention which turns to public pressure which results sometimes in changes to policy or regulation.
But Mr. Wood’s presentation makes it clear there’s more to it than that.
“We have neither the time nor the resources to investigate everything that might be reported as an incident under current reporting rules. We can’t do it! An actual accident is the least likely result of a particular series of events,” he said. “Because our ability to investigate everything is limited, we are in the position of waiting for the least likely event to occur and then investigating it thoroughly. This is not a proactive approach to safety.”
As the opposite of the tombstone mandate, glimmers of a comprehensive program to investigate incidents can be seen in confidential reporting programs and flight quality monitoring. Now, the chairwoman of the safety board is talking about room for improvement even in extraordinary events and 155 living breathing souls provide her with a backup chorus. Its enough to make one believe in miracles.

6 comments:

Jay Donoghue said...

I'm a bit confused by the drift of your blog. It starts out discussing the aviation industry's focus on incidents to get clues about what might happen in the future to cause an accident, which is completely true and has been the case since the CAST initiative began more than a decade ago. But then you end up slamming manufacturers and regulators for taking "a tombstone approach to safety." Since regulators and manufacturers are essential participants in CAST and the industry push towards a data-driven approach to safety, how can both be true?

Christine Negroni said...

Oh gosh, Jay, if I was slamming the industry in this blog, you'd know it. I'm not. I'm more critical of the leap to equate safety with lack of fatalities in any given time span. But Jay, I also don't accept as "completely true" that incidents have been studied with the vigor they deserve for the past decade. And neither, clearly does Dick Wood. Creeping progress is being made. More can be done. This is why I believe in miracles.

James Walters said...

I have to disagree...It has been specifically the incidents, and other "events", that safety professionals have focused on in the last decade. ASAP, FOQA and SMS gather (successfully, for the most part) exactly the data needed to analyze, understand and prevent future incidents. I do agree that safety is difficult to measure, and the number of fatalities in any given time period should not be the yardstick. But analysis of specific operator ASAP and FOQA trends does show significant improvement in many areas, particularly in events known to be precursors to incidents.

Jim Walters

Pete Frey said...

Well the idea that ASAP or FOQA, or somehow SMS, are investigative processes is somewhat of a leap. They mostly provide trend information that may point to specific problems, but does not always result in effective or thorough follow up nvestigation.

For example, I have yet to attend any briefing on foqa that doesn't mention flap overspeed trends. I don't recall flap overspeed as being a factor in any significant accident, but it is very easy to track. To often we seem to think that data will validate our processes, rather than start with known causal factors and use the data to see if we actually have them under control

critter757 said...

Hi Christine!

Enjoyed your article on USAirways Flight 1549.

Glad to see you are still busy in aviation.

Write and catch up when you get a chance!

Luci Crittenden (old ATSRAC member)
NASA Langley

Grant Brophy said...

Christine, I believe that your comments are insightful and well grounded.

Safety performance has traditionally been measured by "after-the-fact" types of metrics such as accident and injury
rates, incidents, and dollar costs. However, I belive that there is a small but growing consensus among aviation safety professionals that these "reactive" or “lagging” types of indicator, do not necessarily provide the insight for avoiding similar occurrences in the future. As you rightly point out, low accident rates, even over a period of years, are no guarantee that risks are being effectively controlled, nor does it preclude them from happening in the future. In safety-critical systems such as aviation, the likelihood of catastrophic events such as accidents is low; thus, the absence of an accident or "unlikely" event is not, in-and-of-itself, an indicator of effective safety performance.

Recognizing the "red flags" or "signals" that are accident precursors, has significant value in predicting undesirable safety states. Predictive safety indicators associated with proactive efforts to identify hazards and address risk have real value in identify current safety gaps and guiding actions for improving safety performance in the future.