Talk and book signing following the film

For those interested and in the Tampa, FL area on December 3rd, I will be doing  a talk and book signing following the film.  See below for details.Pilot Error Riverview

Posted in Safety

Practical Methods for Accident Investigation

526 067

In my previous article I posted a link to a paper I had written originally in 2014 and presented at a conference for the South East Regional meeting of ISASI.  The topic of investigations came up last Spring when I attended the Resilience Engineering Association meeting in Liege.  I expressed that part of the issue we should address is that the investigations themselves may be tainted and that I had written a paper regarding this.  The result was that I was asked if I would like to present it as they had a cancellation, so I found my old presentation and did so.

I continue to be concerned about the early stages of investigations.  I have spent enough time as part of the investigative team to see that an investigation can be overly impacted by first impressions.  That still leaves how to best gain the most knowledge and recommendations out of an accident investigation.  As I wrote in my last post, after spending more time with the methods, I have found that the STAMP method is the most practical to apply.  As I  also stated in the paper, though, STAMP does require training.  Unlike just culture, which is very easy to explain (the concepts understood inside of 15 minutes by most practitioners), one really has to sit down and work through it a few times to understand it, and, furthermore, it is only after doing so that one can see how it really outshines the other methods.  There are workshops available, and the material is available for free on the MIT website, but, at least for me, just reading the material did not do the trick.  Perhaps this is part of why there has been resistance in some quarters to it — it requires some cognitive work to understand it.

Over the past few months I have had an opportunity to do a lot more, and while previously I just saw the potential, now I am a believer.  After returning from Liege I got to work in earnest to prepare an analysis of the Asiana 214 accident for the ISASI annual seminar.  Up to that point, while we had planned to do it, most of the work consisted of just collecting the data and discussions.  I had read about how it yielded more findings and recommendations than other methods, and I believed that to be true, but I had not personally worked a new problem myself.  There was always the lurking thought in my mind that perhaps the additional results were just the outcome of being able to go through an accident again with the benefit of both the report and additional time and research, and not due to a particular method.  However, with MIT research professor, John Thomas, Ph.D., I was able to really apply the STAMP method.  The result was a presentation and paper, which was very well received (you can download it here: Learning from Accidents that are a Consequence of Complex Systems .  It was at that point that the power of STAMP truly became “real” for me.  I had thought I understood it before that, but I really had not fully grasped it.  There is no question in my mind now that STAMP yields far more than would be possible absent the application of the methods.  No question.

As you can see, I am now a strong advocate of STAMP and I believe it can be applied to many problems outside of just safety investigations.   I believe it provides a practical application that is not present in FRAM (at least not that I have been able to figure out).  HFACs just leads to classifying “error” and is the entirely wrong track, in my opinion, and HFIX does little to improve it.  I know they are popular.  Sorry.

There still remains the problem of the early stages of investigations and training investigators to use it when in the field, but that is not insurmountable.  It is a training problem, and perhaps a toolkit can be developed to aid in this area.  So with that, if you are not familiar with STAMP, I suggest you start some reading.   Stay tuned for more!


STAMP is System Theoretic Accident Models and Processes. 

See also:

FRAM is Functional Resonance Accident Model 

HFACs is the Human Factors Analysis and Classification System.



Posted in Safety

Just Culture Accident Model

At the time I wrote this I was working with various methods to investigate accidents. I have since found that Leveson’s STAMP provides the most robust method.  This paper may be useful in a technique to help the field investigator focus on the context of why a person did what they did, but after that I believe STAMP should be applied.  The abstract follows:

This paper proposes that the concepts developed for Just Culture may provide an avenue to broaden the scope of accident investigation and move away from the “blame” outcome of most reports through the use of a simple Just Culture algorithm to mitigate cognitive bias on the part of the investigator. Absent a formal strategy, cognitive bias has a high probability of occurring, and becoming integrated into the investigators subconscious during the early stages of an accident investigation. Just Culture is becoming widely accepted, and as such the transition to integrating an investigative model utilizing the concept should be easier to implement and may encounter less political push back than some of the more complex approaches proposed in recent years, yet still provide a robust path to causality and human factors aspects that is more comprehensive than that offered through the traditional models that are still in use by most organizations.

Click here to view the conference paper.

Posted in Safety | 1 Comment

High Altitude Flying and Radiation


There is much concern in the pilot community of the exposure to radiation as a consequence of high altitude flight.  There are FAA and NOAA pages that discuss the issue and the amount of radiation can even be tracked.  So, how much of a risk is there?

The truth is, nobody really knows, so the basic assumption is that we limit it as much as we can no matter what.  However, that does not tell us much about the actual risk.  There have, though, been several large studies of the issue.  It turns out that of all things that pilots die of, the types of cancer that would be a consequence of higher altitude flight is not one of them.  In fact, several large studies have shown that pilots have a lower rate of the types of cancer that would come from exposure to radiation at high altitudes.  What do pilots die more of?  Two things, mainly.  Melanoma and kidney disease.  Now kidney disease is attributed to not drinking enough water.  Flying dehydrates us, and we need to ensure we drink enough water to offset that effect.  Melanoma comes from being outside in the sun.  It is generally attributed to the fact that pilots do not spend 160 hours or more  indoors in every month.  While some studies indicate that the melanoma risk cannot be entirely attributed to our “outside” activities, there is no evidence that it is from flying either.

Now there have been studies that show higher rates of breast cancer for women (cabin crew), but it is not clear why that is, and one study found that the increased risk of breast cancer was associated with the length of employment prior to 1971 – before the operation of jet aircraft by the airline in the particular study group.  In another study it was found that the correlation was mostly due to fewer pregnancies later in life, although that does not fully explain the differences.

Now, as pilots we are charged with managing risk.  How much risk do we add by choosing to fly at lower altitudes with more exposure to weather, plus burning more fuel so we have less margin on arrival?  Those are real risk factors that are proven.  High altitude radiation risk, by all accounts, is relatively negligible.

So, is there some increase in risk?  Possibly a marginal increase, but it is very small if at all.  Other factors are larger risk factors, such as choosing to eat red meat or smoking, so if one is really concerned they should target those first.  Flying higher (within performance margins) can save fuel and, as I’ve outlined in previous articles, allow for better weather avoidance.  I know which one I choose!

For more information here are a few articles on the topic:

Posted in Safety

How much fuel?


Fuel.  It is an ongoing issue.  We all want to ensure that we arrive with enough fuel at the destination so we have options.  The best way to accomplish that is to have more fuel on departure, right?   Well, maybe not.  It turns out that is really depends on the type of aircraft we fly, and if we are flying big airplanes the issue is a bit more complex than just how much gas we have when we takeoff.

Now, we all agree that there is no question that we must have enough fuel to be safe.  We also agree that there is no question that the Captain is the final authority as to how much fuel that is necessary to meet that required.  No question.  This article is not about telling you how much to carry, but rather to help you make an informed decision.

How much fuel is enough to be safe?  Is it a number in pounds or time?  Ah, now we get to a real issue.  As a Captain, the pounds of fuel (aside from limitations for your aircraft or possible company specific requirements requirements) is actually less important than time.  The concern here is that picking a number of pounds as “safe” may, or may not be safe.

A performance analysis of fuel required for airplanes of B-757 size and larger showed that the amount of “time in our tanks” is about 50% more at a lighter weight as compared to max landing weight.  I did not run the numbers for “smaller” jets, but I would expect a similar outcome.  Weight makes a huge difference in the burn rate, so if we are just using a pound or kilogram value for how we assess our fuel quantity we can be wildly off of what we think we have, either more or less than what we are attempting to accomplish for safety of flight.

What can be seen is that when we are at a light weight we actually have about 50% more time in our tanks than we do if we are heavy.  The other thing that becomes clear in all this is that adding 2,000 pounds if it is only 4 minutes may not be enough to be helpful, particularly when one considers that we are burning perhaps 10% of that amount just to carry the extra weight.  As pilots we have safety as our first priority, but we do directly benefit from making the airline more efficient also.  Having more fuel is also not always more safe as it can adversely impact performance during takeoff and cruise.  It can make the difference between cruising over the top of the weather or slugging through it and deviating constantly thus burning more fuel than we added to “be safe”.  These are the decisions we are paid for and knowing how much fuel you have, in time, is your best path to ensuring you are carrying the amount you need.

One way to frame the thought of how much fuel over destination might be to consider how much time do you want to give ATC with a Minimum Fuel advisory call?  Recognizing this is a dynamic number and would be different for EWR, HKG or PVG on a bad weather day compared to TUL or PEN on a pleasant afternoon.  Let’s say we choose 30 minutes of fuel remaining as when we declare and emergency to get on the ground NOW (I’m just using this for a demonstration, I might very well declare an emergency sooner depending on what’s going on!).  Using typical performance values for the larger jets, 5 minutes of fuel equates to 17% (but for easier mental math, round it to 20%) of the amount of fuel it takes to hold at 30 minutes.  What ever values of fuel weight as compared to time you have, you can use that as a baseline to calculate what you are really adding in terms of safety margin in minutes.

If we use these values or something close to it and add fuel for a go around we may be giving ourselves a reasonable margin for safety and allowing for contingencies without creating a crisis in the middle of a busy arrival sequence, but remember again the potential for burning more of it enroute due to the weight of carrying it plus the higher fuel burn when stuck at lower altitudes.  The tops of the clouds, the winds and the potential for direct routing as we get over the bulk of the traffic are all factors to consider.  It is entirely possible to have more fuel at the destination by starting out with less on departure in many scenarios.

A few years ago I was headed from MEM to MIA.  There was a wide area of weather with imbedded thunderstorms enroute.  As we all have seen, when flying through the weather in an area like this it can be a challenge to pick out the storms from the general rain in the area.  Dispatch had put on plenty of fuel so we could weave as necessary on our way to MIA.  As a result of the amount of fuel we were limited to around FL310 due to the weight.  I noticed that the tops were not above FL350 with few exceptions so I did something that might seem counter-intuitive. I asked for less fuel.  Enough less that we were able to climb to FL370 and sail over the top with just some very minor visual deviations along the way.  Do you think I landed with more or less fuel than I would have if we had stayed on the original plan?  Comparing the flight plans our burn was significantly less even without deviating.  A similar outcome might happen on an Atlantic crossing, where adding more fuel might mean that we are unable to get a higher altitude on the crossing resulting in burning through all the fuel we added and more, and actually landing with less than if we had not added any fuel at all!

Again, it is a complex scenario that must include considering many factors. Weather, tops, winds, aircraft performance, the effect on traffic based on the time of arrival (which in turn is impacted by the other decisions).  Each flight is different and it is up to us to consider all the aspects.

Regardless of the decision made, remember to always to keep the flight dispatcher in the loop.  They share legal authority and regular communication is not only smart but is also required by regulation.

Posted in Safety

The Bluecoat Project

If you’re on LinkedIn, check out The Bluecoat Forum
An international Forum on the subject of FMS, EFIS and EICAS displays, automated subsystems, flight mode annunciators, flight directors, autopilots, and the integration of all avionics equipment in the modern cockpit.

Posted in Safety

The Briefing

I just thought I’d share something fun.  Pilot briefings are very important, and it is critical that these are, literally, “brief”, as well as hit the issues that are actually important.  Things that are just standard and expected are not helpful to include as they just distract from the core points while the person receiving the information tunes out to those aspects.   These are videos clips from the British show “People Like Us”.  The first illustrates a departure briefing, and second an arrival briefing.  Enjoy and let me know if you like these briefing styles.   Do they fit the description above?  Comment below! Click on the images below for the video.

Posted in Safety