Use the table of contents below to jump to the stories that interest you, or use the scroll bar to browse through the entire issue.

Table of Contents

• Terrorist Missile Attacks Could be Blunted With Laser System
• Premeditated Mass Murder versus Protection
• What Else Can Go Wrong?
• Taking Seafood Safety To The Skies
• Point To Ponder
• Correction
• Thought for the week
• Accidents and Incidents
• The Geometric Curve of Risk

Terrorist Missile Attacks Could be Blunted With Laser System

Hundreds of aircraft could be retrofitted in 28 months from 'go' order

The missile threat to commercial airliners burst into public view last week, with the arrest of three illegal arms dealers bent on acquiring the lethal SA-18 portable missile receiving the full media "treatment."

What best to do about the risk from an operational and hardware standpoint is another matter. Spiraling descents and take-offs to minimize exposure to surface-to-air missiles would dramatically reduce airport capacity, not to mention the increase in passengers' use of airsick bags. Installing defensive hardware to airliners involves added weight, another demand on aircraft electrical power, and an additional item to maintain.

These considerations may pale in the face of the penalty for doing nothing. There is no question that a successful missile attack on a U.S. airliner would shut down the industry, and keep it grounded until aircraft were retrofitted with defensive systems. Not only would passengers refuse to fly, so would pilots - especially if they were to embrace a concept outlined recently in Canada. Under the Canada Labor Code, employees have a right to refuse dangerous work and, as indicated in a Transport Canada safety letter, that coverage includes pilots.

Capt. Paul Onorato of the Coalition of Airline Pilots Associations (CAPA) described portable missiles as "an immediate threat to commercial aircraft worldwide." He reiterated CAPA's support for legislation introduced earlier this year by Sen. Barbara Boxer (D - Calif.) that would mandate installation of defense systems on all airliners (see ASW, March 3).

Calls in Congress for such a retrofit are mirrored overseas. Arch Bevis, member of Australia's Parliament, declared, "It seems to me a major flaw in Australia's approach to these things that we are not requiring at least Qantas aircraft going to high risk locations to have appropriate countermeasures installed."

"This is a threat that exists today," Bevis added. "For us not to be taking action, as a parliament or for the government not to be taking action or indeed Qantas itself not to be taking action, I think is negligence."

Evil undone

Bevis' remarks followed the Aug. 12 arrest of three men, one in Newark and two in New York City, bent on obtaining missiles to employ against U.S. airliners. The timely arrests illustrate that the most effective means of blunting the threat begins long before terrorist "triggermen" can get into firing position in the environs of an airport. Just as the hardened cockpit door is the last line of a layered system of security against hijacking, a proactive defense would extend all the way to counter-offensive operations in the terrorists' presumed "safe" havens. A tiered defense against man-portable air defense systems (MANPADS) involves first reaching out and intercepting the threat before it gets close to an airliner.

This paramount imperative was amply demonstrated in the coordinated U.S.-British-Russian "sting" operation that left the plotters with nothing but a harmless decoy missile for their money. This success in the shadowy war against terrorism notwithstanding, the threat persists - and because of the publicity, may be worsening. The unsuccessful attack on a departing Israeli B757 charter jet Nov. 28, 2002, in Mombasa, Kenya, involved the launch of two SA-7 heat-seeking missiles. Industry sources speculate the missiles may have been launched prematurely by anxious gunners, and perhaps too close to the airliner to stabilize and lock onto the target (the potential role of defensive avionics on Israeli airliners, often rumored, has not entered public discussions of the incident). The missiles used also may have been training models (i.e., with built-in safety limitations).

The lethal needle

The subject of the Federal Bureau of Investigation (FBI) and other government agencies' sting operation was the illegal sale of the SA-18 "Igla" missile (Igla is Russian for "Needle," the symbol of which is emblazoned on the weapon), an advanced successor to the SA-7. As one industry source said, it is quite possible that "everyone who shouldn't have it, now does have it."

The Russians have sold the SA-18 to North Korea, Vietnam and Iran. Last year, the Israelis attempted to block the sale of SA-18s to Syria. Some reports suggest that Palestinian cells have been trained in Iraq to employ the SA-18. Although at least seven fatal attacks against commercial airlines have occurred from 1996 to 2000, killing more than 300, the SA-18 has not yet been used in this deadly role.

With a time of flight of 7-15 seconds (depending upon firing position and relative direction of the target aircraft's flight), the SA-18 has a slant range of about three miles and a maximum altitude of more than 11,000 feet. Its infrared (IR) guidance system is claimed to offer better protection against electro-optical jammers. According to defense industry literature, the SA-18 has a single-shot kill probability against unprotected military fighters of 30-48 percent, and that the use of infrared countermeasures (IRCMs) only degrade the missile's effectiveness some 20 percent, to a single-shot kill probability of 24-30 percent.

However, so-called directed IRCM countermeasures (DIRCM) may be more effective. "We are all about directed IRCM's," declared Jack Pledger, director of IRCM business development at Northrop Grumman [NYSE: NOC]. He and other Northrop Grumman officials have proposed retrofitting onto commercial aircraft a variant of the company's Large Aircraft Infrared Countermeasures (LAIRCM). This defensive system is used to protect many large military jets, such as the C-17, the KC-10 and B737, the latter two of which are very similar to their commercial cousins.

Foiling the attack

In contrast to flares or strobe lights, Pledger said, "Our LAIRCM allows us to direct much higher energy on the missile seeker."

The defensive system would be mounted in an upside-down "canoe" shaped pod on the belly of the airplane. Four fixed sensors, each with a 120º field of view, are arrayed in the pod to cover forward, aft, left and right. The overlapping coverage of these "staring sensors" would provide full 360 coverage.

Operating in the ultraviolet range (UV), the sensors are designed to detect the distinct spectral "signature" of a missile launch. Working in the UV bandwidth allows for better discrimination of a missile launch from background clutter.

Alerted by the staring sensors, a rotating scanner working in the IR bandwidth (to further discriminate a missile threat from clutter) tracks the inbound missile. It quickly transmits a narrow laser beam of IR energy in a modulated, classified waveform. This energy disrupts the missile's tracking system, causing it to break IR lock and veer off course and away from the airplane.

If the airplane is attacked at close range (e.g., Mombasa scenario), as little as three seconds will elapse from missile detection to its divert. At longer ranges, total LAIRCM engagement time would be on the order of 6-7 seconds.

The combination of UV and IR detection and tracking has much to do with the system's effectiveness, Pledger proclaimed.

How well does it work? Pledger said LAIRCM is designed to defeat all missiles on the U.S. military's threat list. He stressed the word "all."

The system has undergone successful operational tests. "The military requirement was to defeat multiple threats in the air, which we have demonstrated in live firing tests," Pledger added.

Deploying defenses

Pledger said the concept envisioned by Northrop Grumman would involve installing LAIRCM on four airliners, representing a mix of narrowbody and widebody airplanes, for purposes of Federal Aviation Administration (FAA) flight tests. "We can be ready for FAA-authorized flight tests in nine months from the decision date," Pledger said. He estimated that FAA certification could be obtained within three months.

This timeline suggests that a defensive system for airliners could be tested and certified for deployment in 12 months.

Northrop Grumman officials envision partial deployment, initially to 300 airplanes in the U.S. fleet. This population includes those large jets flying to destinations "outside U.S. borders," Pledger said. Most of these aircraft also are in the Civil Reserve Air Fleet (CRAF). CRAF aircraft often fly to the same locations as military aircraft already protected by LAIRCM systems. Thus, the first-stage retrofit to these 300 airliners would provide near-term protection for international flights and for mobilization aircraft.

From contract award to completion of the 300^th aircraft, the work could be done in 28 months, Pledger estimated. That schedule implies an average retrofit rate of slightly more than 10 airplanes per month. The work would be done during C or D checks. Cost would average $2 million per plane, not including design and FAA-certification costs. The commercial version of LAIRCM would be common among all aircraft. It can operate on 28 volt DC or 115 volt AC aircraft power, further simplifying fleetwide installation. "It's the leisure suit approach, one size fits all," Pledger quipped. A specific adapter plate is all that would be required for each model of airplane, he explained.

In March 20 testimony before the House Aviation Subcommittee about the missile threat, Dr. Robert DelBoca, Northrop Grumman's vice president for infrared countermeasures systems, said the military's LAIRCM system is "proven, effective, affordable means of providing [missile] protection to America's airline industry and our flying public."

More to the point, he added, "It is available now."

Even so, the retrofit program envisioned by Northrop Grumman may not be aggressive enough. Retrofitting 300 airplanes over a period in excess of two years (28 months to test, certify and retrofit) covers less than 10 percent of the U.S. fleet. This schedule implies that it could take nearly a decade to retrofit the entire U.S. fleet. Expanding the retrofit program to cover a larger fraction of the more than 4,000 jetliners estimated to be in U.S. service would drop the installation cost to $1 million. Northrop Grumman officials estimate the entire fleet could be equipped in a six-year period at a total cost of around $3 billion (which places the average cost below $1 million per airplane).

In the meantime, the loss of a single jetliner - from a regional jet to a widebody - on any flight in the U.S., not just overseas, from a portable missile would be intolerable. >> Pledger, e-mail jack.pledger@ngc.com; Onorato, tel. 202/756-2956 <<

A Concept Pilots Might Embrace

In the event of a successful missile attack on an airliner

From Transport Canada, Aviation Safety Letter 3/2002 (extracts):

"The Canada Labour Code ... provides employees with three basic rights:

• The right to know;
• The right to participate; and
• The right to refuse dangerous work.

For pilots, refusals to work in dangerous, or potentially dangerous, situations could occur under a variety of scenarios, including:

• Security issues on board aircraft;
• Concerns about improperly packaged, loaded or secured cargo;
• Pressures to complete flight on schedule; or
• Deteriorating weather conditions.

While not meant to be an exhaustive list, the above are possible situations that could result in a pilot having reasonable cause to believe that taking-off or continuing flight constitutes a danger, or a potential danger, to themselves or others. Should a pilot believe an operation is dangerous, for whatever reason, he or she would be acting within his or her legal right to refuse to work."

Premeditated Mass Murder versus Protection

The would-be agent of attack:

United States of America vs. Hemant Lakhani (arrested Aug. 12), criminal complaint filed Aug. 11, U.S. District Court of New Jersey, Attachment A (extracts):

"Defendant Lakhani and the CW [cooperating witness] discussed Osama bin Laden. Defendant Lakhani sated ... that bin Laden 'straightened them all out' and 'did a good thing.' "

"Lakhani stated that he had traveled from London to New Jersey specifically to meet with the CW concerning this deal, indicating that 'it can be done' ... and that [the buyer] wanted the missiles for a 'jihad,' 'a plane,' and 'want[ed] to hit the people over here.' "

"Defendant Lakhani and the CW ... discussed the importation of surface-to-air missiles into the United States ... In a recorded conversation ... regarding delays in completing the deal, defendant Lakhani stated that he understood the buyer of the missile wanted it for 'the anniversary,' a reference to the upcoming anniversary of the terrorist attacks of Sept. 11, 2001."

"They discussed how the missile to be imported would be used. When, in this regard, the CW gestured to commercial aircraft taking off and landing at the airport, defendant Lakhani confirmed his understanding that such aircraft the target of a missile attack ... [in order to] 'make one explosion - to shake the economy.' "

"On or about Aug. 20, 2002, defendant Lakhani faxed to the CW in New Jersey a document listing the price for an 'Igla-S' portable anti-aircraft missile."

"In a recorded conversation ... defendant Lakhani made an apparent reference to the model of surface-to-air missile used in the Kenya attack, stating 'ours is much higher quality.' "

"On or about July 25, 2003, defendant Lakhani faxed to the CW a copy of the bill of lading ... indicating that the goods being shipped were 'medical equipment.' Also in or about late July ... Lakhani and the CW discussed ... the larger deal for the purchase of [50] surface-to-air missiles."

The would-be defender:

Dr. Robert DelBoca, vice president of infrared countermeasures systems, Northrop Grumman, March 20 testimony to House Transportation Aviation Subcomittee (extracts):

"MANPADS are easy to use, require minimal training, and can be set up to fire in less than three minutes ... Unfortunately, they are available on the arms black market [and] at least 27 terrorist ... groups are believed to have MANPADS in their arsenals."

"Numerous civilian aircraft have been shot down and over 350 deaths were attributed to terrorist-launched MANPADS between 1996 and 2002."

"I am here today to say that if the U.S. Government elects to take steps to protect commercial aircraft ... our Large Aircraft Infrared Countermeasures (LAIRCM) system can be easily configured to protect commercial airliners. LAIRCM is the latest version of our AN/AAQ-24(V) IRCM [infrared countermeasure] system and provides protection using a multi- band laser jammer. With our [system] we will protect over 300 military aircraft, approximately 100 of them large jet aircraft such as the C-17, B-737, KC-10 and KC-135."

"The high level of confidence in the AN/AAQ-24(V) reflects the extensive government investment in the testing and deployment of this system ...We have conducted more than 200,000 jamming effectiveness tests and successfully completed over 100 live-fire missile engagements."

"Instead of the internal installation used on military aircraft, we are proposing a small, relatively unobtrusive conformal pod installed in the lower rear of each aircraft type. This approach would minimize the amount of integration required with other aircraft systems, reduce installation time to less than a week, and allow the system to be fully tested prior to installation."

"This conformal pod does not compromise the effectiveness of LAIRCM because the flight patterns of commercial aircraft are not as robust as the flight patterns of military aircraft. After installation, the system operates without pilot or flight-crew action to defeat missiles. The system has a built-in self test similar to [other] avionics systems."

"The bottom line is that LAIRCM is in production and will protect commercial aircraft."

Sources: U.S. District Court, New Jersey, and U.S. Congress

What Else Can Go Wrong?

To summarize from the Spanish investigation report: Iberia crew in a classic B747-300 with 355 passengers aboard on Sept. 14, 2002, at Madrid got pushed back and braked heavily due to a misunderstanding - while still attached to the tractor tug. Passengers upset by the violent motion started to mutiny (an apparently inebriated passenger loudly leading the peasant revolt), fetching hand luggage and trying to disembark (fuel meanwhile leaking from the wing, which passengers had noted anxiously through cabin windows during boarding). There was no evidence that the refueling checklist had been followed. The chief cabin attendant went to the cockpit and advised the captain of the "riot" or "uprising" on the main deck.

Tug driver left in a huff and meanwhile the cockpit crew decided, after starting three engines, that they had a "no go" MEL (minimum equipment list) discrepancy - an exhaust gas temperature (EGT) gauge - and it was necessary to go back to the gate.

No tug, so they decided to taxi back, forgetting a few critical hydraulic checklist items addressed in the #4 engine starting checklist, that start having been aborted.

They applied power and taxied toward the terminal, without advising insurgent passengers standing in the aisles to take their seats. Moving faster than usual on the thrust of three engines and suddenly realizing they had no brakes, each pilot tried to hand over to the other ("This does not brake! You brake!"). The captain decided that in order to avert a greater tragedy - another B747 full of passengers looming ahead - he had to steer intentionally into the jetway, and destroyed it. The two technicians waiting to fix the failed EGT gauge had to run for their lives as the aircraft crashed into their car (parked in the waiting position). In the last second of panic, the crew applied near-full reverse on the operating engines, re-arranging the equipment on the ramp somewhat. And of course, the digital flight data recorder (DFDR) failed (but then, even though it had 119 parameters, braking wasn't among them).

The full report of the Comision de Investigacion de Accidentes e Incidentes de Aviacion Civil (CIAIAC) may be viewed at http://www.mfom.es/ciaiac/publicaciones/informes/2002/2002_069_IN_ENG.pdf

No Brakes

Causes and Considerations System description:

The B747 has four hydraulic systems. Systems 4, 1 and 2 are used for providing pressure to the brake system. Each system is pressurized by an engine driven pump (EDP) and an air driven pump (ADP) ... Additionally, there is an electrical pump (ACP) powered by alternate current. This pump is installed on hydraulic system 4 with the intent of providing brake pressure for ground operations when pumps EDP and ADP are not available to pressurize system 4 ... This pump is devised to be used on the ground only (p. 11 in the CIAIAC report).

Conclusions from taxi tests:

• The ACP disconnects itself at the very first "crank" of engine #4 (p. 33).
• If the starting sequence of engine #4 is discontinued, a deliberate human action is required to avoid leaving the aircraft without any brake system available (p. 33).
• There is no "warning" for this situation. However, the operations manual advises that the ACP must be connected again if the starting of engine #4 is discontinued (p. 33).
• Accumulator pressure was ... enough to stop the aircraft ... from a low taxi speed, but it is quickly bled off if continuous pressure or several touches are applied to the pedals (p. 33).
• If the crew is not aware of the abnormal situation, when normal brake pressure is not available, it is likely that accumulator pressure will be inadvertently and quickly wasted well before actually used for stopping the aircraft (p. 33).
• It seems that there could be a narrow "window" on the operation of the aircraft in which, if engine 4 is cranked but not started and a [flight engineer] action is not taken (connect again electrical pump ACP), the aircraft could be left without brake pressure (p. 43).

Considerations:

Normal starting sequence is 4, 3, 2 and 1 [when the aircraft is on its own] except if the start is performed during pushback, in which case the recommended sequence is 1, 2, 3 and 4 (p. 43).

It seems that starting engine 4 in the first place during pushback too, as it is done in the other case, would eliminate the problem of taxiing with engine 4 not running and [the] ACP inadvertently left in [the] OFF position, because if starting of engine 4 is discontinued there is no other engine to taxi by its own means (p. 44).

It is not clear at this point whether the change in sequence would increase the safety of the process without adding any additional potential source of other problems to the operation of the aircraft [e.g., additional loads to the pneumatic system for landing gear steering, which is powered up when engine 1 is started] (p. 44).

Source: CIAAIC, Technical Report IN-069/2002

Taking Seafood Safety To The Skies

For creative argument, consider the Aug. 7 letter to Transportation Secretary Norman Mineta sent by John Carr, president of the National Air Traffic Controllers Association (NATCA), extracts of which are reprinted here with permission:

"Dear Secretary Mineta:

I wish to applaud the Bush administration's decision to declare seafood inspection an inherently governmental function. The safety of our nation's seafood supply should be a national priority.

I ask that you extend the same level of safety to our skies as you do to our seafood. If seafood inspectors are inherently governmental, shouldn't air traffic controllers (who are responsible for guiding more than one million passengers every day) receive the same designation?

I ask that you urge President Bush to prevent any efforts to privatize our nation's air traffic control system, or even one of our air traffic control towers."

To put this letter in context, a congressional committee recently introduced language to the Federal Aviation Administration (FAA) reauthorization bill limiting the ban on privatization to four years, and to allow it at dozens of smaller airports where radar is not available to help guide air traffic.

In further support of its position against privatization, NATCA has wallpapered the town with a fact sheet, a few extracts of which leave no doubt as to NATCA's position, if not illustrative of how politics and safety are often enmeshed:

"In a curious action the night before Congress recessed for its summer break, Rep. Don Young (R-Alaska), chairman of the House Transportation and Infrastructure Committee, bowed to White House pressure and approved language allowing privatization of air traffic control. Interestingly enough, Chairman Young exempted his own state's airports and retained staffing by FAA controllers." (Emphasis in original)

"Contract towers have fewer controllers, provide less training, and personnel are subjected to inadequate working conditions. These elements degrade the level of safety and service that controllers are able to provide."

"We firmly believe that no city should be relegated to second class treatment when it comes to air safety and funding."

Point To Ponder

Every restaurant in the Washington, DC, area is supposed to be inspected four times a year, according to an Aug. 12 article in the Washington Post newspaper. What does this factoid have to do with aviation safety? A great deal, one might argue. Restaurant meals are to home cooking as contract maintenance is to operator-performed maintenance. According to the Department of Transportation/Inspector General (DOT/IG), aircraft repair stations are inspected by the Federal Aviation Administration (FAA) once or twice a year (see ASW, July 21). Consider some of the DOT/IG findings:

• "While inspectors make multiple visits to in-house maintenance facilities each year, they are not required to visit repair stations used by the air carrier they oversee."
• "[District office inspectors] only inspect repair stations once or twice a year ... in addition, the amount of time dedicated to these inspections can be surprisingly short."
• "While international agreements allow [the] FAA to conduct sample inspections of stations that Germany, France and Ireland oversee on their behalf, current FAA guidance limits the number of inspections to 10 percent of the repair stations located in each country."

As Capt. Miller noted in his comments about aviation safety, prompt problem resolution is key to a safe operations. And "prompt problem resolution" relates to prompt problem rectification, which in turn relates to frequency of outside inspection, and hence the case for applying to repair stations the inspection frequency for restaurants. Unsanitary culinary practices can lead to indigestion and food poisoning; sloppy maintenance practices can lead to fatal crashes. While the probability of maintenance error may be lower than the probability of kitchen error, the consequence severity of error can be, as Miller pointed out, "extremely high."

Hard Lesson Of History

The serious discussion about the demonstrated missile threat to airliners stands in sharp contrast to the lack of focus, to say the least, regarding the hijacking threat prior to the Sept. 11, 2001 attacks. The lack of coordination and concern is documented in the joint House/Senate intelligence committees' inquiry into the tragedy. The report, recently released after much haggling with the White House over deletion of sensitive material, amply documents the cost of complacency. Herewith, a few extracts:

No reaction to potential pain, or "the Rip van Winkle mode:"

"From at least 1994, and continuing into the summer of 2001, the intelligence community received information indicating that terrorists were contemplating, among other means of attack, the use of aircraft as weapons. This information did not stimulate any specific intelligence community assessment of, or collective U.S. government reaction to, this form of threat."

The culture problem, or "jocks versus nerds:"

"Prior to September 11 ... Analysis and analysts were not always used effectively because of the perception in some quarters of the intelligence community that they were less important to agency counterterrorism missions than were operations personnel."

Threat up, coverage down, or "the triumph of bureaucratic formalism:"

"During the summer of 2001, when the intelligence community was bracing for an imminent al-Qa'ida attack, difficulties with FBI [Federal Bureau of Investigation] applications for Foreign Intelligence Surveillance Act (FISA) surveillance and the FISA process led to a diminished level of coverage of suspected al-Qa'ida operatives in the United States."

Gaps in the coverage, or "falling between the bureaucratic cracks:"

"There were gaps between NSA's [National Security Agency] coverage of foreign communications and the FBI's coverage of domestic communications that suggest a lack of sufficient attention ... Prior to September 11, neither agency focused on the importance of identifying and then ensnaring coverage of communications between the United States and suspected terrorist-associated facilities aboard.

"Consistent with its focus on communications aboard, NSA adopted a policy that avoided intercepting the communications between individuals in the United States and foreign countries.

"NSA adopted this policy even though the collection of such communications is within its mission ... NSA director Hayden testified to the Joint Inquiry that NSA did not want to be perceived as targeting individuals in the United States and believed that the FBI was instead responsible for conducting such surveillance. NSA did not, however, develop a plan with the FBI to collect and to ensure the dissemination of any relevant foreign intelligence to appropriate domestic agencies.

"The Joint Inquiry has learned that one of the future hijackers communicated with a known terrorist facility in the Middle East while he was living in the United States."

The full report may be accessed at http://a257.g.akamaitech.net/7/257/2422/24jul20031400/
www.gpoaccess.gov/serialset/creports/pdf/fullreport_errata.pdf

Correction

In the third paragraph of last week's story about the crash of an Emery Worldwide Airlines DC-8 freighter, the elevator control retrofit actions called for by the National Transportation Safety Board (NTSB) affect about 110 DC-8s in U.S. service, not DC-9s.

Thought for the week

On the need for a cost-benefit calculation to justify a safety initiative, which must be couched in terms of the dollar value of accidents avoided, from a frustrated government source: "You can't lower the accident rate unless you have accidents."

Accidents and Incidents

The Geometric Curve of Risk

Capt. Paul Miller, Safety Committee Member, Independent Pilots Association

In the area of 'risk' permit me to add a few points from a pilot's point of view to engineer Lu Zuckerman's perspective of 'mythical safety' (see ASW, July 28).

1. Risk is a mathematical product of probability of failure times the severity of the failure. Risk (Z) is equal to probability (X) times severity (Y), or Z = XY. I call this relationship Miller's Safety Formula. Set aside the negative values of X and Y and only consider the positive (+) values of X and Y, in other words only positive probability and positive severity. This results in a positive Risk (Z) value, a very useful segment of the overall product. The resulting risk data lies on a continuous surface, curving upward from the origin like a bent playing card.

The surface is somewhat flat near the origin yet quickly curves upwards. What the curved surface tells us is that risk is a product and that if we allow the product to continue to multiply, it will increase rapidly in a manner similar to a geometric curve.

Z = XY will rapidly increase because the factors X (probability) and Y (severity) are independently variable.

Therefore, in order to reside on the flat part of the risk curve, which I would label the safe part of air operations, we need to rapidly resolve issues of probability and severity as soon as they are discovered. In other words, rapid resolution is as important as the resolution itself!

If we all would like to reside in the flat part of the risk curve in relative safety, then we will have to become much more rapid problem solvers.

2. Risk cannot be pinned solely on probability of failure of a mechanical piece, part or system. As a pilot, I am so glad the Federal Aviation Administration (FAA) is pushing for more reliable parts and systems. On a recent night B767 flight eastbound from Bombay to Hong Kong, I want to say that I felt a big debt of gratitude to all of the engineers who made my great plane! There are not many landing fields amidst the cyclones and miles of open ocean.

By the same token, the National Transportation Safety Board (NTSB) has gone to great lengths to point out that human error (pilot, maintenance and supervisory) is the root cause of air disasters. Even mechanical failures have been traced to human error in manufacture, installation and maintenance. In other words, it is not the broken part that does us in. It is flying with a 'known broken part' repeatedly that finally does us in.

So human error is as much, if not more, of the equation as bench test engineering failure data. How we pilots handle broken parts and how mechanics are told to defer broken parts and how operational pressure causes us to operate with broken parts are all in the probability equation mix.

3. If we are to believe the NTSB, then we must acknowledge that human error (read 'human factors') is a critical part of the accident equation and therefore a critical part of the accident prevention equation.

4. What more debilitating human factor issue is there amongst line flight crew than fatigue? In what one area of safety has the FAA been more reluctant to lead than flight crew fatigue? Metal fatigue is given generous research attention by the FAA, but human fatigue is all but ignored and, until recently, its existence was hardly recognized as a causal factor in accidents. It is poorly studied and it is poorly regulated. Line flightcrews are left to their own defenses, with contractual language the only bulwark against 16 hour+ day fatigue inducing operations. The FAA has said line flight crews should self-police fatigue, holding the crews themselves responsible for being fatigued and operating fatigued! Human factors is more important than it has been recognized so far by regulators in accident prevention.

5. Probability can only be expressed mathematically as much as it can be measured mathematically. The truth is that it is more often estimated, concluded from averaging data, deduced or even induced in engineering studies. Perhaps the full range of probability and severity should be looked at instead, and presented to management when trying to make a 'go-no go' decision. While the probability data may show a low value, the severity data may be extremely high, causing the risk value to be much higher than the probability would indicate.

6. Risk equals dollars. If you bet big you can loose big, but with today's seat revenues, you really can't win big by operating a heightened risk flight.

So risk is really the measuring yardstick, not probability. (ASW note: Capt. Miller last appeared in this publication Sept. 6, 1999, p. 10, 'A Pilot Perspective on Maintenance & Safety') >> Miller, e-mail PaulLMiller44@cs.com <<

Return to the Table of Contents

Thank you for visiting Air Safety Week.