Category: Aviation

How can we prevent organisational accidents?

Part 4

What goes around comes around[1], so it is said. I think that idiom is often about bad things but can be about good things too. In other words, something done years ago can pop-up and have an impact on the here and now.

Some Microsoft PowerPoint presentations from the 1990s are difficult to read. One that I kept did convert into a readable format. The subject was Safety Management Systems (SMS). In the mid-90s, as a UK CAA Surveyor, I was presenting at a national workshop on design and production issues talking about the need for SMS. Describing what that term meant and how it should be used by approved organisations in the UK.

Airworthiness is about past, present and future. It’s about aircraft, procedures, and people. It’s about design, production, maintenance, repair, and overhaul. It’s a long-lived discipline that has developed over decades and delivered a remarkably good level of aviation safety performance.

What we were looking at 30 years ago was not only the experience of civil aviation but the results of investigation of tragic accidents in other industries. In 1986, the Space Shuttle Challenger was lost. 35 years ago, saw the Zeebrugge car ferry[2] disaster that killed 193 people. In 1988, explosions destroyed the Piper Alpha oil platform in the North Sea. Each accident pointed to the need for stronger safety management. Often the question was asked: how could such fundamental errors have been made? One response was: “Of all God’s creations, corporations seem to have the shortest memories of all”[3].

Lots of good people agreed that civil aviation needed to practice safety management but primarily on a voluntary basis. Not only that but there were numerous interpretations as to the meaning of SMS as applicable to the different disciplines in aviation. So, Air Traffic Services and Aircraft Operations went ahead with their own versions of SMS. Unfortunately, design and production organisations lagged. In the background, some specialists were attempting to distil a generic template for SMS.

It was the year 2005 that shook the tree. Measuring safety performance everyone had become accustomed a story of constantly improving global aviation safety. That year saw a series of major accidents which shook confidence and led to a High-level Safety Conference[4] at ICAO’s Headquarters in Montreal. This HLSC brought together Directors General of Civil Aviation and aviation organisations from most of ICAO’s Member States. Resulting from the HLSC was the Recommendation 2/5 and it was dramatic. It called for a new ICAO Annex on SMS. And so, ICAO Annex 19 was born.

It’s 2022. You might reasonably ask – why is it that we are only now implementing SMS for design and production organisations? Good question.

[1] The results of things that one has done will someday have an effect on the person who started the events.

[2] 6 March 1987, the roll-on, roll-off passenger, and freight ferry capsized 4 minutes after having left harbour.

[3] Safety Management, Strategy and Practice, Roger Pybus, Butterworth-Heinemann 1996.

[4] https://www.icao.int/Meetings/AMC/HLSC/HLSC%202010%20Report/HLSC.2010.DOC.9335.EN.pdf

How can we prevent organisational accidents?

Part 3

Make “challenging” better. Group think can be a source of innumerable problems. It doesn’t necessarily cause unethical organisational behaviours, but it sure does support them when they take hold. One method that can bust a cycle of self-deception is that of peer review. That is the sort of peer review where qualified participants can act independently, use their expertise and comment without prejudice.

I’m going to go back to the early 1990s. I have been fortunate to experience several different ways that aircraft certification and validation can be conducted. The method applied by the UK prior to the gradual harmonisation that took place to form the Joint Aviation Authorities (JAA) was unique.

A multidisciplinary team would visit an aircraft manufacture for a week or more. This was an intense activity of technical investigation. The output was an “orange book” and a series of findings that the aircraft manufacture must address before a national type certificate could be granted.

This process was hard work. It’s advantage was that a complete exploration of an aircraft type could be documented and that an applicant for a type certificate would be left in no doubt what needed to be done next. The first part of the activity was technical familiarisation. Each technical discipline would get a briefing on either the actual aircraft type or what was planned. This was done at the infancy of word processing. Believe it or not, I remember scissors and glue being used to cut and paste text to make-up the explanations and findings.

The purpose of these words is not to describe the use of airworthiness requirements (BCARs and the early JARs) but to describe what happened when the technical team returned home.

Having created an “orange book” with its key findings there was a need to inform colleagues of the who, what, where when and why. The authority’s senior management had to buy-in to the work of the technical team.

There were often a series of genetic findings that would deal with typical additional UK requirements. However, often more contentious was the technical findings that addressed flaws in compliance or design or unique technical features or controversial issues.

Having returned to the office members of the technical team had to justify their findings to their peers. This was done in a formal manner. It could be a daunting process. No stone was left unturned in questioning the investigation that had been done on-site at the aircraft manufacture. It was initiating to do this for the first time. Particularly when standing in front of the grandees who had been doing such work for decades. Some who had written the rules in the first place.

Although this was a tough process, it’s one that benefits a mature organisation a lot. It shakes complacency out of the system. It’s truly to be challenged.

How can we prevent organisational accidents?

Part 2

Make “challenging” better. It’s generally better to have more than one set of eyes on an issue.

The classical challenge is to perform an audit. To take a sample of the work being performed and check that its everything that it’s said to be. This can be done at any stage: design, development, test, production, and in-service. Unfortunately, audits can get bogged down in process, procedures, customs, and practice that get so heavy as to distract from the essences of the task.

There’s a focus on the tangible aspects of work too. How many reports? How many corrective actions? Show me the measurements. Nevertheless, well focused auditing is a powerful tool.

It would be wise not to discount the intangible benefits of an audit. Such activities provide a chance to view the more intangible aspects of work. Here’s a few anecdotes.

Often when being taken for an official guided tour around a design or production facility there time to look beyond what the hosts want you to see. I often found a moment to look at notice boards around a factory, or office and they gave a hint as to the culture in that organisation. Cartoons and jokes of good humour led me to put a “normal” tick in the box. But if they strayed into harsh lampooning of the management or the way of working then there was something to note.

Siting in a manager’s office being briefed as to the timetable for an audit it’s as well to take in the whole scene. All those certificates displayed on the wall. Were they pertinent? Were they there to show off? Or were they showing genuine pride in the achievements of the organisation?

Timetables for an audit are necessary but can be a menace if every second is filled. But an auditor should never be intimidated by a timetable. On occasion, I’ve walked past a pile of records only to turn back and say – and what about this one? Then being told we must hurry on. To which my reaction was to dig in and follow the trail.

It’s true that the environment has changed. Digitisation has made the random selection of a sample more difficult. Digital records lend themselves to more pre-prepared situations.

Mealtimes can be a revelation on organisational culture too. This doesn’t happen anymore, I’m sure. The factory canteen that serves alcohol is truly a thing of the past. However, an auditor being taken out for lunch is still commonplace. It’s possible to get moralistic about such invitations only to miss out on getting a sense of those intangibles that might help understanding.

Additionally, I will warn that there’s the small danger of vexatious challenge. It’s a rarity but obsessions can follow even the most capable of people around. There’s a risk too that focusing on one pet subject can mean gapping great holes are missed. Each subject needs to be taken proportional to its potential impact.

How can we prevent organisational accidents?

Reading the commentary, deep and wide, that has flowed from the saga of the certification and introduction to service of the Boeing 737 MAX there’s palpable frustration. A large volume of analysis and evidence is now in the public domain. It has taken a long time and the persistence of many good people to bring out the results of investigation to the fore.  Frustration stems from knowing that the factors involved in the MAX saga are not new or unique. They have been seen far too often in fatal accidents and serious incidents right across the globe.

One common reaction is to place all the blame on the corrupting effect of large amounts of money. The line “follow the money” became common usage as a result of the 1976 movie “All The President’s Men[1]” despite the theory that it came from elsewhere.

“Follow the money” is good advice for investigators whether they be journalists, air accident investigators or police detectives. It’s certainly one of the known motivators for people to circumvent or disregard rules and regulations.

I could go on to talk about corporate liability[2]. There’s often a distinct lack of capability or inclination to hold large corporations, and the individuals running them liable for gross negligence and unethical behaviours. Another problem with this is that this is the button to press after the event. Yes, strong corporate liability laws rigorously applied can have a deterrent effect. However, the calculation made by those people at the source of the problem is often that of slim likelihood of failure or getting caught or, as with banks during the financial crisis, being too big to fail.

Although all the lessons learned from the analysis of organisational accidents is a good route to prevention of future accidents, that just one part of the puzzle.

Another common reaction is to reach for the human factors’ textbooks. There’s absolutely no doubt that human action is at the root of the events discussed. It takes people, and groups of people to choose to do the wrong thing knowing of the risks they take. Indefensible actions done with the awareness of an organisation are more than just process or procedural failure.

I started writing with the assumption that organisational accidents are preventable and must be prevented. This is to say that zero accidents are achievable. Yet, organisational accidents keep happening and prevention keeps failing. All be it, relative to the volume of global activity, a rare occurrence in civil aviation.

Maybe it’s better to accept that the motivations of a minority of people are to act unethically for personal gain and to take unacceptable risks. The larger problem is the failure of a greater number of people to act when they become aware of that behaviour.

In the cockpit pilots are taught to challenge bad decisions. Maybe we need to teach people how to challenge effectively.

[1] The movie takes protagonists Bob Woodward and Carl Bernstein through their quest to figure out the suspicious acts around US President Richrd Nixon.

[2] https://www.cps.gov.uk/legal-guidance/corporate-prosecutions

Aircraft Level View

The latest innovations in aircraft design are, without question, highly integrated systems. We have departed from the days when every aircraft system was a box. An autopilot, a display computer, a power controller may all sit in one cabinet of equipment. Each one interdependent upon the other.

The other day, I saw advertised as an antique a British P8 aircraft compass. Maybe, 80 years old, it was claimed to be still working. This bit of kit was fitted to the Spitfire, Hawker Hurricane and Mosquito. Truly, a discreet equipment. One basic function and independent of all other aircraft systems except cockpit lighting. Afterall, a compass isn’t much use if you cant see it.

One reflection of mine from times past is the real difficulty of getting people to take an aircraft level view. Some might say this is aerospace design history. It certainly was a major struggle in the mid-1990s. It was a message that was not always well received.

Without mentioning any names, I’d roll up at an aircraft manufacture and be confronted with a hanger sized office divided up into cubicles. Sound absorbing partition walls of shoulder hight stretching far into the distance. This is where the Scott Adams[1] got the idea for the Dilbert cartoons.

In one corner of the engineering building would be a venerable grey-haired gentleman who had spent his entire life working on toilet flush motors. At another corner would be a gaggle of whizz kids developing software specifications for the latest computing hardware.

Everything was the same placid light green with only a few signs to give identity to groups of people working together. Segregation and segmentation were a part of the process. Each functional group developed their skills to the highest degree in their chosen specialisation.

My role in all this was to sit in a rectangular meeting room receiving briefings from each technical team. The certification task had been divided up and everyone was doing their part. Certification plans for an autopilot, a display computer or a power controller were all competently presented. Preliminary safety assessments were dutifully described.

After a while it became all to clear to me that everyone was dedicated to their assignment but that communication between different teams was sketchy to say the least. So, questions like, where did you get that number from, when talking about a failure probability number taken from someone else’s analysis wasn’t always convincingly answered. As a result, I got to hammer on about the need to take an aircraft level view to the point of great irritation. It’s not that people didn’t want to hear the message. It was more that the means to look at interdependencies between aircraft systems was fragile and underdeveloped. We changed and progressively the challenge of integration was met.

Today, I sit and wonder if the new entrants in the aerospace world, rapidly putting together advanced new forms of air mobility, have taken on-board the lessons we learned in the 1990s. It’s not as easy to learn the above lessons unless the reason why is abundantly clear.

[1] https://www.scottadamssays.com/

Certification

In the wake of the Boeing 737 MAX troubles the purpose of aircraft certification has come under fire. It was intense fire too, as the subject was taken into the political arena. Both informed, and not so informed public accusations had to be addressed in a comprehensive and systematic manner. The outcome is real change impacting the way organisations and administrations work.

A basic framework is set by international agreement. The standards and recommended practices of ICAO Annex 8 sets a framework within which aircraft certification work is undertaken. Across the globe Administrations/ Agencies/Authorities cooperate to set common minimum standards.

We can talk about process, procedures and standards until the cows come home. These are ever evolving to cope with technical challenges and the experience of operation. What’s more fundamental, and almost never mentioned is what practitioners do day-to-day. Ultimately, despite the subject being highly technical it is people that are at the core of the activity.

Practical necessity mean that an aircraft project has an ambition and a time scale. Although projects are often known to overrun there’s no infinite pot of resources to carry on regardless. Good project management can be the make or break in realising an ambition.

What that means is that there is a constraint on aircraft certification. There is a window of opportunity to undertake the work in a comprehensive and systematic manner.

The true art becomes asking the right question at the right time. Yes, there is an intricate structure within which questions are asked but it is the nature of those questions that makes the diffidence. Ask a bland and easily answered question and the value added is negligible. Ask a probing and pertinent question and it can lead to a better and safer product.

The importance of the act of asking questions is underestimated. It’s not well taught. For the most part technical experts learn to do this on the job. From one project to the next they develop a set of approaches based on experience. Members of Administrations/ Agencies/Authorities have a great privilege in that they can expect their questions to be answered in full.

There’s a peer-to-peer relationship. To ask an effective question, technical experts on either side of the table don’t have to know everything the other knows. What is needed is a mutual respect and a sufficiency of command of a subject. Being able to pinpoint a gap or omission or inadequate coverage of a subject, or even waffle and evasion requires an intelligent and determined person.

Avionics

Segmenting, categorising, and naming technical subjects has a long history. However, it’s not often there’s a back story to say what’s in each name. Numerous definitions exist. These are quite often an afterthought. Naming that evolves rather than can be traced to a single author.

The subject on my mind is Avionics. It’s a ubiquitous term in aircraft engineering. In fact, it’s applied much more widely than that because administrators, pilots and air traffic controllers all use it. So, let’s look at the history, etymology and usage of the word.

The word seems obvious, as to not need a definition. Bring the world of aviation and electronics together and there it is – Avionics. However, Avionics often extends beyond the world of aviation and into space. So, it may be better to say, bring the world of aeronautics and astronautics and electronics together and there it is – Avionics.

Notice that it’s electronics and not electrics that forms the definition. A loose distinction between the two might be to say that, in terms of electric current, electronics is anything below an ampere[1] and electrics is that above an ampere.

Marconi was the first to experiment with airborne radio. It was even available to pilots in the First World War. However, spark-gap radio was unloved, heavy, and awkward.

The name Avionics started being used in the 1940s. VHF radio communication between aircraft and ground stations was vital to an aircrafts’ operation. The fabrication of radio valves in high volumes and at low costs led to the use of numerous radio technologies: communications, navigation, RADAR and Radio Altimeters to name a few.

The science and technology of electronics, and the development of electronic devices has advanced faster than that of aircraft design and manufacture. Avionics engineering has been divided into numerous sub-fields as a result.

Where once an aircraft could complete safe flight and landing with a complement of defective avionic equipment that is no longer the case. It’s quite the reverse, as the current generation of both military and civil aircraft are highly depended upon the correct functioning of their avionic systems.

Often the more complex an aircraft and its operation becomes, the more complicated the avionic systems become. Aircraft flight-control systems can be of great sophistication. By contrast a VHF radio hasn’t changed much, in its basic function, for decades.

Although avionics is a common term, it doesn’t often find its way into legislation or everyday usage. There’re certainly great swathes of the population for which the word means nothing. It’s an unusual day if the six-o’clock news has a reference to this technical word. 

[1] https://www.npl.co.uk/si-units/ampere

Tea or Coffee

I’ll grab a newspaper and flick through the pages. I can almost guarantee in all the thousands of words use to describe the events of the week nowhere will you see the word “determinism”. Now, that shouldn’t surprise anyone. Or at least anyone who doesn’t spend their days in the systems engineering world. Yet, the basic idea of determinism is ingrained in everyday thinking.

Yesterday, I bought a new kettle. It works well. I can take cold fresh water from my kitchen tap, fill it to the two-cup line and press the button with confidence that within a couple of minutes I’ll have boiling water. Cause-and-effect are truly well connected. I pay my electricity bill and expect current to flow when the switch is thrown. I’d be really annoyed if my new kettle didn’t do what it said it would do on the box it was packaged in. My cup of tea is assured.

Now, let’s step into an imaginary future. Well, a future that not as imaginary as might first be thought. I’ll set aside my morning tea drinking habit and brew a coffee instead. I haven’t got one, but they are certainly being advertised. That’s a coffee machine that’s connected to the INTERNET[1]. It can be given voice commands to brew my favourite brew. It has an app where I can set-up my preferences. It’s a whizzy way to get an espresso.

I don’t say this function exists, only that as soon as the connection is made to an external service what happens next becomes just a little less predictable. A coffee machine with an integrated voice activation system will do as it’s told. At least we assume it will do as it’s told. Thus, cause-and-effect remain connected. Stand back. The door has now been opened. Let’s say, after I acquired the coffee maker the anxious manufacture changes the algorithm that runs the machine. They want me to drink the maximum number of their wonderful coffees but without going to the dark side.

Next time, I go for a smart espresso the machine talks back: “Are you sure? You’ve had 5 coffees already this afternoon.” I have no knowledge of, or control over the algorithm that’s coming up with this talk back. The question might be fair, sensible, and looking after my health but, in that moment, I have no ability to predict what the machine will do next. Will it let me carry on regardless? Or will it say: “No, you’ve had enough. Come back and talk to me in an hour.” The simple cause-and-effect relationship I have with my new kettle is no more. Without being warned, I’ve strayed into the world of non-determinism.

I think you can now appreciate the purpose of this short article. It’s to point out that our quaint classical deterministic world is going to go through a shakeup. Think of the scenario above for a car or an aeroplane. It’s not inevitably bad. In fact, non-deterministic systems offer huge potential benefits. My message is that we’d better be ready for all aspects of this transition.

I’ve made the contrast between either one or the other. In realty, there will be a fuzzy zone between what’s deterministic and what’s non-deterministic. The tea or coffee drinker may have a choice in different places at different times for different reasons.

[1] https://www.lavazza.co.uk/en/landing/voicy.html

FR4978

The case of the forced diversion of Ryanair flight #FR4978, a commercial passenger aircraft over Belarus on Sunday, 23 May 2021, is a matter for grave concern.

So, what’s the problem? A civil aircraft with passengers on-board, on a scheduled flight, flying over a sovereign State was diverted because of an alleged terrorist threat. Aircraft lands safely and in the end most of the passengers continue to their intended destinations.

Well, the case of the forced diversion of Ryanair flight #FR4978, a commercial passenger aircraft over Belarus on Sunday, 23 May 2021, is a matter for grave concern. The aircraft was carrying European citizens and residents between two European Union (EU) capitals.

The track of the Ryanair flight FR4978 from Athens (ATH) to Vilnius (VNO) was posted on Twitter[1]. The Boeing 737-800 was diverted to Minsk in Belarus whilst it was about to start its approach to Vilnius airport in Lithuania.  The Ryanair flight maintained 39,000 ft toward Lithuania before beginning a diversion about 73km from VNO and only 30 km from border.  The Polish registered Boeing passenger aircraft (SP-RSM) was forced to land in Belarus.  

More than 5 hours after the landing of flight FR4978, the aircraft remained on the ground in Minsk.  Whilst the aircraft was on the ground the Belarusian authorities detained opposition activists, Raman Pratasevich and Sofia Sapega.

Was the aircraft hijacked to go to Minsk? Well, there’s no report of force being used on-board the aircraft, so strictly speaking this may not be a hijacking.  The mystery deepens when considering that if the alleged terrorist threat was credible, it would have been far safer to continuing into Lithuanian airspace and land at the intended destination. 

Also, there’s the Belarusian military fast-jet aircraft (MIG 29) that accompanied flight FR4978. This could be considered aggressive intimidation of the Ryanair flight crew.  It certainly limited their flight’s options in respect of the situation.  The military interception of a civil aircraft for political reasons is a serious act and one that can put the safety of passengers in peril. So, whether it’s called a “forced diversion” or a “State Hijacking” it could be in contravention of the Chicago Convention. That’s the basis on which international civil aviation is normally conducted. 

It’s now clear that the International Civil Aviation Organisation (ICAO)[2] will carry out an independent investigation into this Ryanair flight[3].   Strong condemnation has come from the European Union (EU)[4]. The aircraft operator, the State of Registry, and many of the passengers were from EU Member States. 

If the investigation concludes that officials in Belarus faked a bomb threat to divert this Ryanair flight for political purposes, then this is a gravely troubling act that has horrendous implications for international civil aviation.  No other authorities had knowledge of a bomb threat to this Ryanair Athens-Vilnius flight. The Greek Civil Aviation Authority, as the aircraft took-off from Athens, has stated that it received no bomb warning.

This event is an attack on European democracy, freedom of expression, freedom of movement and safety. The Belarus authorities need to immediately release Raman Pratasevich and Sofia Sapega.

Update 1: EASA issues Safety Directive calling on Member States to mandate avoidance of Belarus airspace.

Update 2: Simillar thoughts: The interception of #Ryanair Flight #FR4978 – legal or not, carriers have been put on notice.

[1] https://www.flightradar24.com/

[2] https://www.icao.int/Newsroom/Pages/ICAO-Council-agrees-to-pursue-fact-finding-investigation-into-Belarus-incident.aspx

[3] https://news.un.org/en/story/2021/05/1092812?123

[4] https://www.consilium.europa.eu/en/press/press-releases/2021/05/24/belarus-declaration-by-the-high-representative-on-behalf-of-the-eu-on-the-forced-diversion-of-ryanair-flight-fr4978-to-minsk-on-23-may-2021/

Here’s where we are, I think.

May is a month of rebirth. Trees look greener than they do all year round. A fresh breeze and light rain fans this greenness as the natural world wakes up. It’s a good time for looking at life anew.  Sunny spells and showers come and go as we take stock of the spring. 

Worldwide COVID-19 pandemic deaths are up to just over 3.3 million[1].  Despite the successes of its suppression in the UK, the virus continues to rage around the world.  Sadly, desperation continues to spread across India.  On the positive side, vaccination plans are successfully being implemented. I’m more than ready for my second jab in just over a week’s time. 

What hasn’t changed is that aviation chiefs continue to provide roadmaps to bring back some semblance of normal but often sit back mystified at Government reactions and peculiar decisions. 

For international travel, to and from the UK, a curious traffic light system[2] is being put in place in the UK.  Unfortunately, there’s a lack of transparency as to why countries are categorised as they are in this unique national system.  Obviously, it’s better than a national lockdown with unending uncertainty but there’s little to be happy about. 

On entry control, the practice of quarantine hotels is unpopular and of highly questionable effectiveness. They are a crude measure that is discriminating, expensive and unsustainable.

The European Union (EU) has been slow in reaction and is still testing COVID-19 vaccination, test, and recovery certificates.  There are reports that this system is on-track to be rolled out next month.

It’s a miserable time to travel across borders. Plans are made and cancelled and re-made. Travellers are often left out of pocket and in limbo.  Yes, these are extraordinary circumstances but as advanced nations our general performance in managing the situation is remarkably poor. 

Although UK Government decisions are said to be guided by evidence and the science, there’s a fair amount of ideology driving decisions contrary common sense. 

Surprisingly, if the recent round of elections is anything to go by, the UK Government is sitting pretty. Now, its political opponents who are the ones who are struggling.  Commentators have speculated that this is a kind of national Stockholm syndrome[3]. I wonder. 

Post Coronavirus recovery of UK air traffic may not be seen until the end of 2022. 

The EU has developed a broad system of relationships with neighbouring states. Post Brexit there remains lots of loose ends in the relationship between EU and UK.  In fact, it’s probably time to stop using the word Brexit altogether. It’s not a meaningful word looking forward.    

Calls for a Bilateral Aviation Safety Agreement (BASA) and a Comprehensive Air Transport Agreement (CATA) between the EU and UK are muted but their importance remains.  Aviation and aerospace industry voices are being ignored. 

[1] Worldwide (from Johns Hopkins): Deaths: 3,322,294.  

[2] https://www.gov.uk/government/speeches/traffic-light-system-safe-return-to-international-travel

[3] What is Stockholm syndrome? https://www.bbc.co.uk/news/magazine-22447726