Corporate Failure

I watched the documentary on the Boeing 737 MAX 8 last night. It’s on Prime[1]. Called Flight/Risk. It starts with the launch of the new aircraft and ends as the aircraft returns to service and the consequences of the disaster that are still rippling through aviation. Seattle Times journalist, Dominic Gates appears frequently. His perspective is one that I was reading as the accidents and following events unfolded.

It’s a well-made production. I my view it focuses too much on whistle-blowers and too little on the appalling design errors made in certifying the aircraft. However, I can understand the choices made by the film makers. It’s primarily aimed at a public audience and not technical experts.  

This was a massive and fatal corporate failure. My recollections of working with Boeing in Seattle, in the mid-1990s are that such events could never have occurred in that era. It was a preeminent engineering company, with a proud heritage and safety was as important as the blood that flows through our veins. What happened in this last decade is beyond shocking.

Now, corrective action is being taken. Efforts are being made to re-establish an effective safety culture. All over the world technical experts have securitised the modified Boeing 737 MAX to the n-th degree. The company expects the Boeing 737 MAX 7 will be certified by the end of the year and the larger MAX 10 in the first half next year.

What is regretful is how long the design and manufacturing industries resisted the introduction of Safety Management Systems (SMS). I remember doing presentations to industry on that subject more than 2-decades ago.

So, what does a bad corporate and safety culture look like? We must recognise it, and not ignore the signs. What concerns me is, however much we have learned from the Boeing 737 MAX saga; it will soon be forgotten. Pasted over like wallpaper.

As if to give me an illustration, I was standing in a high street shop, browsing sale items in the normal way. It’s always nice to pick up a bargain. Even though it was a busy Saturday afternoon, there wasn’t many people in the shop. Behind me, were two store employees chatting away. They didn’t pay much attention to me until they had finished. They were close enough for me to hear most of what they were saying. One of them was the store manager.

Basically, they were having a whinge about the company that owned the shop. One key aspect was the waste of time, as they saw it, of being sent on company training courses where expensive consultants rabbited on to them about matters that were totally irrelevant to their day-to-day business. They blamed the corporate management. They haven’t got a clue, and it’s getting worse was the gist of the chat. They both expressed love of their jobs. It was a cry of desperation and frustration as they feared the company was on the road to go bust.

I guess that’s it. When little, or no communication exists between shop floor, literally in this case, and corporate management then that’s a big indicator of grave troubles ahead.


[1] https://www.amazon.co.uk/Flight-Risk-Karim-Amer/dp/B0B5K615MZ

Humans in Space

Smart people have strong views on human space flight. In my mind, human space flight isn’t a football for arguments over public verse private. How missions are funded is less important than the fact that they are funded. Space flight will always be a high-risk activity. Those risks will sometimes be borne by the public sector and sometimes by the private sector.

Saying that all we need is robotics in space is to overstate the case for robotics. No doubt, robotics will play a fundamental part in exploration. It’s one component in a bigger picture. Humans need to go to space. That’s a rather a didactic statement. It needs to be challenged. So, my answer has several parts, and here they are:

Firstly, it’s not that we have a choice, given the nature humans have demonstrated over the last million years. Discontent with staying in one place, we are constantly on the move. We’ve inhabited every part of the globe. Even the most inhospitable parts. It’s extremely unlikely we will counter that instinct to travel, to go, and to see for ourselves. First-hand.

Secondly, every robotic mission has limitations based on the design of the machines we send into space. A designer must use the knowledge of their time to anticipate what may be needed, often a decade from the first moment they sat at their computer. The adaptive capability of humans is unmatched. However, machines advance, it will be unmatched for tens of decades ahead.

Thirdly, our lives are full of stories of imaginary flights. From Leonardo da Vinci vivid creativity to the practical achievements of the Wright brothers. Imagination spurred on inventors to bring to life ways in which humans could take to the air. The same applies to space flight. Flash Gordan is a comic book character. We know that Star Trek is a fiction. The film Gravity stressed the dangers of space. None of this detracts from an imbedded predisposition we have for space-based adventures.

Fourthly, when faced with the new it’s not always clear what to do. However, if unprecedented situations arise, we humans rise to the occasion. The inventive capacity of people is unique. When the machinery around us fails we come up with answers. We work out a way to get over the problems. Being able to rapidly fix things matters in space[1].

Fifthly, our species is successful, in part, is because we face risks. It could be said that existence requires us to face risk, but we do it anyway. Our enjoyment of dangerous sports is one indicator. People train to face perils and are thrilled to overcoming challenging circumstances. Collectively we delight in their achievements. Why go to space? – Because it’s there[2].

It’s more than evident that from the perspective we have in the here and now, we can only see so far ahead. A few will see further. What seems obvious to a highly educated commentator on human space flight may be rendered null and void at a stoke come the next discovery.

NOTE 1: On the third point, I found a quote from Orville Wright. “No flying machine will ever fly from New York to Paris. That seems to me to be impossible. What limits flight is the motor.” So, even with his inventiveness and imagination it only went so far. [Early Flight – From Balloons to Biplanes].

NOTE 2: On the fourth point, the experience of my early career working on ground test equipment for communications satellites comes into play. Extensive testing is needed on any space borne systems. As I remember it being said – we don’t make ladders that high.


[1] https://www.nasa.gov/mission_pages/apollo/missions/apollo13.html

[2] Why climb a mountain? British climber George Mallory gave a famous response in a New York Times interview in 1923: “Because it’s there.”

Safety Performance Indicators

What’s happening? Two words, and what seems like the easiest question in the world. Open your phone, look at the screen and a myriad of different sources of information are screaming for your immediate attention. They are all saying – look at me, look now, this is vital and don’t miss out. Naturally, most of us will tune out a big percentage of this attention-grabbing noise. If we didn’t life would be intolerable. The art of living sanely is identifying what matters from the clutter.

So, what happens in aviation when a Chief Executive or Director turns to a Safety Manager and askes – what’s happening? It’s a test of whether that manager’s finger is on the pulse, and they know what’s happening in the real world as it happens.

This is a place I’ve been. It’s a good place to be if you have done your homework. It’s the way trust is built between the key players who carry the safety responsibility within an organisation.

One of the tools in the aviation safety manager’s toolbox is that of Safety Performance Indicators (SPIs). In fact, it’s part of an international standard[1] as part of a package for conducting safety assurance. Technically, we are talking about data-based parameters used for monitoring and assessing safety performance.

The ideas are simple. It’s to create a dashboard that displays up-to-date results of safety analysis so that they can be viewed and discussed. Like your car’s dashboard, it’s not a random set of numbers, bar-charts, and dials. It should be a carefully designed selection of those parameters that are most useful in answering the question that started this short blog.

That information display design requires great care and forethought. Especially if there’s a likelihood that serious actions will be predicated on the information displayed. Seems common sense. Trouble is that there are plenty of examples of how not to do this running around. Here’s a few of the dangers to look out for:

Telling people what the want to hear. A dashboard that glows green all the time it’s useless. If the indicators become a way of showing off what a great job the safety department is doing the whole effort loses its meaning. If the dashboard is linked to the boss’s bonus, the danger is that pressure will be applied to make the indicators green.

Excessive volatility. It’s hard to take indicators seriously if they are changing at such a rate that no series of actions are likely to have an impact. Confidence can be destroyed by constantly changing the tune. New information should be presented if it arises rapidly, but a Christmas tree of flashing lights often causes the viewer to disbelieve.

Hardy perennials. There are indicators, like say; the number of reported occurrences, which are broad brush and frequently used. They are useful, if interpreted correctly. Unfortunately, there’s a risk of overreliance upon such general abstractions. They can mask more interesting phenomena. Each operational organisation has a uniqueness that should be reflected in the data gathered, analysed, and displayed.

For each SPI there should be an alert level. It can be a switch from a traffic light indication of green to amber. Then for the more critical parameters there should be a level that is deemed to be unacceptable. Now, that might be a red indicator that triggers a specific set of significant actions. The unscheduled removal or shutdown of a system or equipment may be tolerable up to a certain point. Beyond that threshold there’s serious safety concerns to be urgently addressed.

The situation to avoid is ending up with many indicators that make seeing the “wood from the trees” more difficult than it would otherwise be. Afterall, this important safety tool is intended to focus minds on the riskiest parts of an operation.


[1] ICAO Annex 19 – Safety Management. Appendix 2. Framework for a Safety Management System (SMS). 3. Safety assurance. 3.1 Safety performance monitoring and measurement.

Is Airworthiness Dead? 2/

Where I left the discussion there was a question mark. What does conformity mean when constant change is part of the way an aircraft system works?

It’s reasonable to say – that’s nothing new. Every time, I boot up this computer it will go through a series of states that can be different from any that it has been through before. Cumulative operating system updates are regularly installed. I depend on the configuration management practices of the Original Equipment Manufacturer (OEM). That’s the way it is with aviation too. The more safety critical the aircraft system the more rigorous the configuration management processes.

Here comes the – yes, but. Classical complex systems are open to verification and validation. They can be decomposed and reconstructed and shown to be in conformance with a specification.

Now, we are going beyond that situation where levels of complexity prohibit deconstruction. Often, we are stuck with viewing a system as a “black box[1]. This is because the internal workings of a system are opaque or “black.” This abstraction is not new. The treatment of engineered systems as black boxes dates from the 1960s. However, this has not been the approach used for safety critical systems. Conformity to an approved design remains at the core of our current safety processes. 

It’s as well to take an example to illustrate where a change in thinking is needed. In many ways the automotive industry is already wrestling with these issues. Hands free motoring means that a car takes over from a driver and act as a driver does. A vehicle may be semi or fully autonomous. Vehicles use image processing technologies that take vast amounts of data from multiple sensors and mix it up in a “black box” to arrive at the control outputs needed to safely drive.

Neural networking or heuristic algorithms may be the tools used to make sense of a vast amount of constantly changing real world data. The machine learns as it goes. As technology advances, particularly in machine learning ability, it becomes harder and harder to say that a vehicle system will always conform to an understandable set of rules. Although my example is automotive the same challenges are faced by aviation.

There’s a tendance to see such issues as over the horizon. They are not. Whereas the research, design and development communities are up to speed there are large parts of the aviation community that are not ready for a step beyond inspection and conformity checking in the time honoured way.

Yes, Airworthiness is alive and kicking. As a subject, it now must head into unfamiliar territory. Assumptions held and reinforced over decades must be revisited. Checking conformity to an approved design may no longer be sufficient to assure safety.

There are more questions than answers but a lot of smart people seeking answers.

POST 1: Explainability is going to be one of the answers – I’m sure. Explained: How to tell if artificial intelligence is working the way we want it to | MIT News | Massachusetts Institute of Technology

POST 2: Legislation, known as the Artificial Intelligence Act ‘Risks posed by AI are real’: EU moves to beat the algorithms that ruin lives | Artificial intelligence (AI) | The Guardian

POST 3: The world of the smart phone and the cockpit are here How HUE Shaped the Groundbreaking Honeywell Anthem Cockpit


[1] In science, computing, and engineering, a black box is a device, system, or object which produces useful information without revealing information about its internal workings.

Is Airworthiness dead?

Now, there’s a provocative proposition. Is Airworthiness dead? How you answer may depend somewhat on what you take to be the definition of airworthiness.

I think the place to start is the internationally agreed definition in the ICAO Annexes[1] and associated manuals[2]. Here “Airworthy” is defined as: The status of an aircraft, engine, propeller or part when it conforms to its approved design and is in a condition for safe operation.

Right away we start with a two-part definition. There’s a need for conformity and safety. Some might say that they are one and the same. That is, that conformity with an approved design equals safety. That statement always makes me uneasy given that, however hard we work, we know approved designs are not perfect, and can’t be perfect.

The connection between airworthiness and safety seems obvious. An aircraft deemed unsafe is unlikely to be considered airworthy. However, the caveat there is that centred around the degree of safety. Say, an aircraft maybe considered airworthy enough to make a ferry flight but not to carry passengers on that flight. Safety, that freedom from danger is a particular level of freedom.

At one end is that which is thought to be absolutely safe, and at the other end is a boundary beyond which an aircraft is unsafe. When evaluating what is designated as “unsafe” a whole set of detailed criteria are called into action[3].

Dictionaries often give a simpler definition of airworthiness as “fit to fly.” This is a common definition that is comforting and explainable. Anyone might ask: is a vehicle fit to make a journey through air or across sea[4] or land[5]? That is “fit” in the sense of providing an acceptable means of travel. Acceptable in terms of risk to the vehicle, and any person or cargo travelling or 3rd parties on route. In fact, “worthiness” itself is a question of suitability.

My provocative proposition isn’t aimed at the fundamental need for safety. The part of Airworthiness meaning in a condition for safe operation is universal and indisputable. The part that needs exploring is the part that equates of safety and conformity.

A great deal of my engineering career has been accepting the importance of configuration management[6]. Always ensuring that the intended configuration of systems, equipment or components is exactly what is need for a given activity or situation. Significant resources can be expended ensuing that the given configuration meets a defined specification.

The assumption has always been that once a marker has been set down and proven, then repeating a process will produce a good (safe) outcome. Reproducibility becomes fundamental. When dealing with physical products this works well. It’s the foundation of approved designs.

But what happens when the function and characteristics of a product change as it is used? For example, an expert system learns from experience. On day one, a given set of inputs may produce predicable outputs. On day one hundred, when subject to the same stimulus those outputs may have changed significantly. No longer do we experience steadfast repeatable.

So, what does conformity mean in such situations? There’s the crux of the matter.


[1] ICAO Annex 8, Airworthiness of Aircraft. ISBN 978-92-9231-518-4

[2] ICAO Doc 9760, Airworthiness Manual. ISBN 978-92-9265-135-0

[3] https://www.ecfr.gov/current/title-14/chapter-I/subchapter-C/part-39

[4] Seaworthiness: the fact that a ship is in a good enough condition to travel safely on the sea.

[5] Roadworthy: (of a vehicle) in good enough condition to be driven without danger.

[6] https://www.apm.org.uk/resources/what-is-project-management/what-is-configuration-management/

Safety Research

I’ve always found Patrick Hudson’s[1] graphic, that maps safety improvements to factors, like technology, systems, and culture an engaging summary. Unfortunately, it’s wrong or at least that’s my experience. I mean not wholly wrong but the reality of achieving safety performance improvement doesn’t look like this graph. Figure 1[2].

Yes, aviation safety improvement has been as story of continuous improvement, at least if the numbers are aggregated. Yes, a great number of the earlier improvements (1950s-70s) were made by what might be called hard technology improvements. Technical requirements mandated systems and equipment that had to meet higher performance specifications.

For the last two decades, the growth in support for safety management, and the use of risk assessment has made a considerable contribution to aviation safety. Now, safety culture is seen as part of a safety management system. It’s undeniably important[3].

My argument is that aviation’s complex mix of technology, systems, and culture is not of one superseding the other. This is particularly relevant in respect of safety research. Looking at Figure 1, it could be concluded that there’s not much to be gained by spending on technological solutions to problems because most of the issues rest with the human actors in the system. Again, not diminishing the contribution human error makes to accidents and incidents, the physical context within which errors occur is changing dramatically.

Let’s imagine the role of a sponsor of safety related research who has funds to distribute. For one, there are few such entities because most of the available funds go into making something happen in the first place. New products, aircraft, components, propulsion, or control systems always get the lion’s share of funds. Safety related research is way down the order.

The big aviation safety risks haven’t changed much in recent years, namely: controlled flight into terrain (CFIT), loss of control in-flight (LOC-I), mid-air collision (MAC), runway excursion (RE) and runway incursion (RI)[4]. What’s worth noting is that the potential for reducing each one of them is changing as the setting within which aviation operates is changing. Rapid technological innovation is shaping flight and ground operations. The balance between reliance on human activities and automation is changing. Integrated systems are getting more integrated.

As the contribution of human activities reduces so an appeal to culture has less impact. Future errors may be more machine errors rather than human errors.

It’s best to get back to designing in hard safety from day one. Safety related research should focus more on questions like; what does hard safety look like for high levels of automation, including use of artificial intelligence? What does hard safety look like for autonomous flight? What does hard safety look like for dense airspace at low level?

Just a thought.


[1] https://nl.linkedin.com/in/patrick-hudson-7221aa6

[2] Achieving a Safety Culture in Aviation (1999).

[3] https://www.flightsafetyaustralia.com/2017/08/safety-in-mind-hudsons-culture-ladder/

[4] https://www.icao.int/Meetings/a41/Documents/10004_en.pdf

Objects falling from the sky

In so far as I know, no person on the ground has been killed by an object falling from a commercial aircraft in flight. I’m happy to be corrected if that situation has changed. Strangely, in contrast there are plenty of reports of people falling from aircraft and being killed as a result[1]. Additionally, there are cases of parts shed by aircraft that subsequently contribute to an aircraft accident[2].

The most frequent reports of falling objects, in and around airports are not parts of an aircraft but that which is in the atmosphere all the time. Namely, ice. When it hits the ground in the form of a hailstorm it can be damaging. In flight, it can be seriously damaging to an aircraft.

What I’m writing about here are the third-party risks. That’s when an innocent individual finds themselves the target of an improbable event, some might call an act of God. Ice falls are rare. However, given the volume of worldwide air traffic there’s enough of them to be alert to the problem. As soon as ice accretes to create lumps bigger than a kilo there’s a real danger.

Can ice falls be prevented? Here again there’s no doubt some are because of poor maintenance or other preventable factors, but others are just nature doing its thing. Regulators are always keen to collect data on the phenomena[3]. It’s something that goes on in the background and where the resources allow there can even be follow-up investigations.

Near misses do make the newspaper headlines. The dramatic nature of the events, however rare, can be like a line from a horror movie[4]. Other cases are more a human-interest story than representing a great risk to those on the ground[5].

It’s worth noting that falling objects can be quite different from what they are first reported to be. That can be said about rare events in general.

I remember being told of one case where a sharp metal object fell into a homeowner’s garden. Not nice at all. The immediate reaction was to conclude it came from an aircraft flying overhead. Speculation then started a new story, and the fear of objects falling from aircraft was intensified.

Subsequently, an investigation found that this metal object had more humble terrestrial origins. In a nearby industrial estate a grinding wheel had shattered at highspeed sending debris flying into the air. Parts of which landed in the garden of the unfortunate near-by resident.

One lesson from this tale is that things may not always be as they first seem. Certainly, with falling objects, it’s as well to do an investigation before blaming an aircraft.  

POST 1: There’s a threat outside the atmosphere too. The space industries are ever busier. That old saying about “what goes up, must come down” is true of rockets and space junk. More a hazard to those on the ground, there is still the extreamly unlikly chance of an in-flight aircraft getting hit Unnecessary risks created by uncontrolled rocket reentries | Nature Astronomy

POST 2: EASA Safety Information Bulletin Operations SIB No.: 2022-07 Issued: 28 July 2022, Subject: Re-Entry into Earth’s Atmosphere of Space Debris of Rocket Long March 5B (CZ-5B). This SIB is issued to raise awareness on the expected re-entry into Earth’s atmosphere of the large space object.


[1] https://nypost.com/2019/07/03/man-nearly-killed-by-frozen-body-that-fell-from-plane-is-too-traumatized-to-go-home/

[2] http://concordesst.com/accident/englishreport/12.html

[3] https://www.caa.co.uk/Our-work/Make-a-report-or-complaint/Ice-falls/

[4] https://metro.co.uk/2017/02/16/10kg-block-of-ice-falls-from-plane-and-smashes-through-mans-garage-roof-6453658/

[5] https://www.portsmouth.co.uk/news/national-ice-block-falls-aircraft-and-smashes-familys-garden-1078494

Social media and aviation safety. Part 2.

Reports of aviation accidents and incidents and occurrence reports vary greatly in quantity and quality. Improvements have been made, as legislation has demanded basic data be recorded and retained.

Nevertheless, the one-line narrative is still with us. These reports are frustrating for safety analysts. If a bland statement about an aviation occurrence is received a couple of weeks after an event it can be almost impossible to classify. The good that social media can do is to supplement official information.

In most cases, mobile phone video taken by a passenger or onlooker can be checked for veracity. It needs to have the characteristics that confirm that it was taken at the time and place of the event it depicts. Photographs often have location, picture size, resolution, and device information.

It’s as well to recognise that this work can’t be taken for granted. There is work for aviation safety analysts to do verifying information. Images can be edited by effects that create an exagerated sense of drama.

Image copywrite does have to be considered. Professional photographers make it clear that their work is protected. This is often stamped on the material in some manner.

Impromptu videoing of an aviation incident, that may involve the person taking the video changes its status once its launched on social media. At least that is my understanding of the legal paperwork that few people ever read, namely the common clauses of End-User License Agreements. 

So, advice might be, to try to avoid copyright infringement it’s always a good idea to credit the source of the material used. Using copyed material in good faith is no defence for ignoring ownership.

The pursuit of aviation safety can be argued to be the pursuit of the greater public good. Unfortunately, the lawyers of some newsgathering organisations will not give the time of day to anyone who argues that they are in pursuit of the greater good.

Suprisingly, the subject of who is a press reporter or newsgathering organisation is vague in a lot of national legal frameworks. Protecting free speech is a strong case for not drawing too many boundaries but a complete free for all has a downside as “truth” goes out the window.

On another subject, privacy is a sticky one. Where people are identifiable in randomly taken pcitures or video of accidents and incidents there is currently no protection.

Again, there are questions to be answered in relation to use of social media derived safety information.

NOTE:

Example: Dramatic footage shows firefighters tackling fire on British Airways passenger plane at Copenhagen airport. [Dailymotion embeded video].

An Online Safety Bill in the UK will shake up the regulation of material on-line even if its not designed to address the issue raised in my blog. Online Safety Bill: factsheet – GOV.UK (www.gov.uk)

Social media is changing aviation safety

You may ask, how do I sustain that statement? Well, it’s not so difficult. My perspective that of one who spent years, decades in-fact, digging through accident, incident, and occurrence reports, following them up and trying to make sense of the direction aviation safety was taking.

In the 1990s, the growth of digital technology was seen as a huge boon that would help safety professionals in every way. It was difficult to see a downside. Really comprehensive databases, search capabilities and computational tools made generating safety analysis reports much faster and simpler. Getting better information to key decision-makers surely contributed to an improvement in global aviation safety. It started the ball rolling on a move to a more performance-based form of safety regulation. That ball continues to roll slowly forward but the subject has proved to be not without difficulties.

Digging through paper-based reports, that overfilled in-trays, no longer stresses-out technical specialist quite the same as it did. Answers are more accessible and can reflect the real world of daily aircraft operations. Well, that is the theory, at least. As is often the case with an expansion of a technical capability, this can lead to more questions and higher demands for accuracy, coverage, and veracity. It’s a dynamic situation.

Where data becomes public, media attention is always drawn to passenger aircraft accidents and incidents. The first questions are always about what and where it happened. A descriptive narrative. Not long after those questions comes: how and why it happened. The speed at which questions arise often depends on the severity of the event. Unlike road traffic accidents, fatal aviation accidents always command newsprint column inches, airtime, and internet flurries.

Anyone trying to answer such urgent public questions will look for context. Even in the heat of the hottest moments, perspective matters. This is because, thankfully, fatal aviation accidents remain rare. When rare events occur, there can be a reasonable unfamiliarity with their characteristic and implications. We know that knee-jerk reactions can create havoc and often not address real causes.

In the past, access to the safety data needed to construct a context was not immediately available to all commers. Yes, the media often has its “go-to” people that can provide a quick but reliable analysis, but they were few and far between.

This puts the finger on one of the biggest changes in aviation safety in the 2020s. Now, everyone is an expert. The immediacy and speed at which information flows is entirely new. That can be photography and video content from a live event. Because of the compelling nature of pictures, this fuels speculation and theorising. A lot of this is purely ephemeral but it does catch the eye of news makers, politicians, and decision-makers.

So, has anyone studied the impact of social media on developments in aviation safety? Now, there’s a good topic for a thesis.

Safety in numbers. Part 4

In the last 3 parts, we have covered just 2 basic types about failures that can be encountered in any flight. Now, that’s those that effect single systems, and their subsystems and those that impact a whole aircraft as a common effect.

The single failure cases were considered assuming that failures were independent. That is something fails but the effects are contained within one system.

There’s a whole range of other failures where dependencies exist between different systems as they fail. We did mention the relationship between a fuel system and a propulsion system. Their coexistence is obvious. What we need to do is to go beyond the obvious and look for relationships that can be characterised and studied.

At the top of my list is a condition where a cascade of failures ripple through aviation systems. This is when a trigger event starts a set of interconnected responses. Videos of falling dominoes pepper social media and there’s something satisfying about watching them fall one by one.

Aircraft systems cascade failures can start with a relatively minor event. When one failure has the potential to precipitate another it’s important to understand the nature of the dependency that can be hardwired into systems, procedures, or training.

It’s as well to note that a cascade, or avalanche breakdown may not be straightforward as it is with a line of carefully arranged dominos. The classical linear way of representing causal chains is useful. The limitation is that dominant, or hidden interdependencies can exist with multiple potential paths and different sequences of activation.

The next category of failure is a variation on the common-mode theme. This has more to do with the physical positions of systems and equipment on an aircraft. For example, a localised fire, flood, or explosion can defeat built-in redundancies or hardened components.

Earlier we mentioned particular risks. Now, we need to add to the list; bird strike, rotor burst, tyre burst and battery fires. The physical segregation of sub-systems can help address this problem.

Yes, probabilistic methods can be used to calculate likelihood of these failure conditions occurring.

The next category of failure is more a feature of failure rather than a type of failure. Everything we have talked about, so far, may be evident at the moment of occurrence. There can then be opportunities to take mitigating actions to overcome the impact of failure.

What about those aircraft systems failures that are dormant? That is that they remain passive and undetected until a moment when systems activation is needed or there’s demand for a back-up. One example could be just that, an emergency back-up battery that has discharged. It’s then unavailable when it’s needed the most. Design strategies like, pre-flight checks, built-in-test and continuous monitoring can overcome some of these conditions.