Air France 447: Critique of Otelli's French book

Heard about the book today. Jean-Pierre Otelli who specializes in aviation safety, publishes his book "Piloting Error, Volume 5" today.

But in my opinion, he only re-analyses the facts collected in BEA's report. I believe that the BEA's report is seriously flawed and the book adds little to mishap prevention.

Read my many articles in my other safety blogs to learn more.

http://safetyforecasts.com/
http://bettersafeaviation.blogspot.com/

Would you like proof that BEA's investigation is flawed?

Simple: there is little if any recommended corrective action contained in the report, that, if followed, would have prevented this mishap. Rather, the book and report appears to center on finding fault, assigning blame and extracting tribute for damages. So, the investigation is really a legal investigation and not a Safety Investigation. I have explained in the blog that the only value to a Safety investigation is to find ways to prevent a recurrence.
It appears to me training is weak at AF as well. So, that is a managerial responsibility and regulatory duty. Remember that this crew was certified by the airline's training dept and national aeronautical regulators before they were assigned to operate this flight. If their performance as a crew and as individuals was substandard, as alleged in the BEA's report, then that would be a direct indictment of the training and certification authority credibility, would it not?

From my background training experience, when we first learned basic and radio instrument procedures in basic jet training, an important segment of that training were procedures to employ when some of the instruments failed. Some of this training focuses on the failure of attitude and/or directional gyro equipment and is called partial panel procedures. Some other procedures focused on loss of pitot-static instruments, some or all and teach you to remain in stable flight using attitude instruments and standard engine power settings. Other procedures cover magnetic and/or directional gyro or heading instrument failures, still others cover what to do if part of your navigation instrumentation fails.

We practiced all of these procedures this right from the beginning. Along the way with every new aircraft, with every new organization, these procedures remained a significant part of regular training. At my last sim/training session a year before retirement, we practiced these procedures and focused especially on the loss of pitot-static instruments. We trained heavily on this.
So, were these AF447 crew members trained by AF in this area? There certainly appears to be a question here. However, does the report by BEA or the book by Otelli investigate this?

AF 447: Pitot Tube Loss Procedures?

The loss of pitot static instrumentation is an emergency for which commercial pilots are or should be trained. In the case of the loss of pitot static instrumentation, a general procedure is to use the instruments available that are not dependent on the pitot static systems or to use back up pitot static systems and instruments. In either case, the safety of the flight is possible and the crew should be able to maintain safe flight until either the aircraft can be moved out of the icing conditions which are often the cause of the loss of pitot static instruments or the aircraft can be moved to VMC so that the crew can land the aircraft with use of available instrumentation and procedures.

In the case of AF 447, there appears to be a procedural issue as well as an equipment failure. That said, the crew I am sure was more than capable of operating in the condition where the pitot static system failed. Why did they not?
Were the clues to determine this condition not available or masked or conflicted by other clues?

I wonder what each commercial pilot reading this and other reports thinks? We have read what BEA thinks and their reports are not credible.

Safety Risk

Consider the mathematics formula, Z=XY. When plotted on a 3D graph, the function gets very large very quickly.

Consider that Z is risk and that X is severity and that Y is probability. Then this formula is saying that severity and probability are multiplied, they are not added or otherwise combined mathematically.

If this Z=XY then risk is a very rapidly increasing number. That means that unresolved safety risks are very dangerous.

Plot this graph on your own graphing program. But remember to use only the positive part of the graph, that is, the positive values of X and Y. This will yield just the positive values of Z, that is, just the positive values of Risk, since mathematically, these are the values which make sense in reality.

Working Jointly as a Safety Manager: How does that work?

So now you are probably asking, "Okay, how do I get 14 pilot association committees to work with me, the airline safety manager?"

I am so glad that you asked!!!

The key to success here is by working Jointly with the pilot association. What is that? Your airline does not have a pilot association? Hmmm, I wonder if the airline management has done everything possible to discourage a pilot union from forming? If so, they have really done the airline a great disservice. What is that? You say that this same airline management team has only provided the minimum of one person for the entire airline safety program? Wow! That same team has really done the airline a disservice!

In the case about which I previously spoke, our pilot union had 14 committees and well in excess of 100 people doing volunteer safety work on behalf of the union membership. But who also benefited?

Well of course the answer is that the company benefited greatly.

So, how many airlines have the model of a Joint Safety Program?

Not too many.

How many could have an exceptionally effective safety program at very little extra cost by working Jointly with the pilot group?

I would say, just about everyone could.

Should Safety Managers be good listeners?

Safety managers must be good listeners. It has been my experience that few if any reports from people participating in safety suggestions are actually "trivial."

My experience is actually just the opposite. My experience is that everyone who came to my office to make a report had an important idea to share or an important here-to-fore unreported risk to which to bring our attention.

By listening to the person reporting and taking time to clarify their concern, our safety programs achieved two important goals. First, we found risks that only one person recognized. Funny how in an organization of 300 people, that only one person will see and be willing to report a very valid hazardous risk. Not sure why that is so, but it is. Second, by listening to all who came in to report, and publishing all reports and recognizing the best each week, we developed the excellent reputation of being the "good listener." You would be amazed at the things that really need to be fixed that no one else noticed or bothered to tell anyone about.

So, my suggestion is do not worry about "triviality." In fact the report may be of quite some significance when you later understand its true potential for prevention.

Again that is my experience and I would add, that by doing so, our safety program achieved the goal of reducing losses due to injuries and deaths, property damaged or destroyed to zero. So, I would say that this program worked very well in four very different organizations.

Can Safety Be Done by One Manager? I would add, that Safety is not a job that can be done by one. In fact at my pilot association we had 14 committees that dealt with some portion of the safety pie, yes 14! And we were not the company, we were just the pilot group. Safety is not something that can be done from an asset poor point of view! Safety requires a great deal of attention.
What many airlines have found is that by failing to do the safety job of prevention well, that instead they wind up doing the mishap investigation job. And what a huge waste of time and money that is!!

There has never been a mishap investigation in which I participated, where in the end the conclusion that this mishap was preventable was not reached!

It has been said, "You seem to be convinced that a flawed world can be actually made flawless."

My response is this. Human error is part of our nature. However we can make our own flight operations mishap free by remembering Miller's Rule for Safety Management: ALL SAFETY IS LOCAL.

Any one safety manager cannot make a "flawed world ..... flawless." He or she can only affect the operation over which they have control.

I can personally recommend steps to each LOCAL Flight Operations Safety Manager that have worked extremely well to achieve mishap free flight operations.

One person commented, "In a process oriented investigation "human error" cannot be the ultimate root cause. You need to ask yourself, "Why did the humans make the errors?"

My response to this is, "True, but you also need to go further and ask what procedures can be put into the SOP and become part of the training program that will help flight crew members overcome their human errors.

For example, lets say that a very important system characteristic is buried on page 49 of a chapter in the Aircraft Operating Manual. Well, maybe if it is considered to be so important, should it be bold faced, underlined and not buried on page 49? In other words, humans make errors that can easily be corrected. Safety managers need to find ways to help the flight operation correct errors as they are occurring and are reported.


Some have also said, that crew selection and training criteria are often driven by both financial and safety level aspects. FAA and other civilian authorities have criteria set at minimal requirements. But one company may decide to exceed those.
For example, one company may decide to select pilots (1) which have a Commercial Pilots License from a school with a weak syllabus and accept those after a minimal medical and psychological selection process, accepting captains with only 3,000 flight hours. Another company may have require at least a masters degree in technical sciences and demand a very strict medical and psychological selection criteria and accept captains only after 30,000 hrs. The same could and often does apply to training. One set of training requirements are used for a Government operation and another set of training criteria are used for a major airline."

But my response is this. You still have to train flight crew in the company SOP. You still have to check to the SOP and make your operation "procedure oriented" and not technique oriented. This way flight crew are performing procedures and not using their own techniques to operate.

Further, as the operation improves its control, it will develop a need to have more standardization in procedures just so that mixed crews can operate efficiently.

Should the FAA tolerate such a wide variance between airlines? It is the Topic for another day.

Forecasting involves learning from previous mishaps

We can forecast by learning from the mishaps of other organizations.

We learn by observing the mistakes that are made. That being said, I would add that we actually have a more superior ability to observe these mistakes as they are made on the line and before they contribute to a mishap.

Did you know for example that Safety Theory tells us that flight crew will make 1000 errors which could lead to 100 reportable events, which could lead to 10 incidents and which could lead to 1 major mishap.

Many people do not believe that or do not understand this very valuable nugget of safety information. This is the key to succeeding in the safety profession and I will tell you this from my own 43 years of experience. You can achieve zero mishaps, you can prevent mishaps at your airline.

Here is how to do it. You must have a reporting system that allows flight crew members to speak about and report their errors and those that they observe. Next the safety person has to investigate these errors, figure out how they impact the operation and take steps to correct the organic reason for the errors. Most often in my experience this involved some adjustment, modification or addition to SOP. But the safety person has to be well versed in flight ops and SOP so that the changes to SOP make sense.

Unfortunately all too many people believe that until an event, incident or mishap occurs, that their operation doesn't "have a problem." However the problems are there because we are human. They will always be there. The key is to incorporate the error reporting process into day to day operations, to talk about them and fix them right then and there.

Allowing human errors to "fester," to unreported and uncorrected is to set the operation up to failure. Can an operation be made error free? Of course not. But at the same time can an operation be made mishap free? Absolutely so, by finding and fixing errors as they occur.
But I believe that as humans we are constantly making errors. A good program that enables us to report and act on these errors as they first occur will enable us to always be one step ahead of the hazards and therefore operate free from mishaps.