Improving Air Safety: Long-Term Challenges

Air travel in the United States has seen dramatic improvements in safety in the past 50 years. Through the cooperative efforts of manufacturers, airlines, governments, and others, pilots are better trained with the help of increasingly sophisticated flight simulators, aircraft are more reliable, navigational aids are improved, and flights operate with more in-depth and timely weather information. More recent evidence, however, suggests that the rate of progress in aviation safety has slowed or possibly stopped (Figure 1). The accident rate for jet carriers, which had improved steadily since jets were introduced, essentially leveled out during the 1980s and 1990s. Commuter carriers, which were required to meet the same safety standards as jets by 1996, have improved to the point where they now have roughly the same accident rate as jets.

We shouldn’t be too surprised that the accident rate for jet airliners hasn’t fallen in the past two decades. With scheduled airline service in North America already the safest in the world, finding additional improvements has become more difficult. We’ve dealt with the most obvious and easily correctable causes of crashes, leaving us with less frequent crashes that often have more complex causes. Yet we must reduce the accident rate. The Federal Aviation Administration (FAA) projects a 37 percent growth rate in commercial aviation between 1999 and 2007. If this occurs, failure to reduce the accident rate will result in a growing number of accidents and fatalities that the public may find unacceptable.

Fearing such a possibility, in 1998 the Clinton administration launched the Safer Skies initiative, a safety program aimed at reducing the fatal accident rate by an ambitious 80 percent by 2007. The initiative is a commendable effort and will certainly have beneficial effects. However, it reflects three unfortunate, albeit understandable, tendencies in aviation safety programs. First, it focuses on learning lessons from past accidents instead of also trying to anticipate the safety problems that are likely to emerge as the aviation system grows. Second, it takes a single, pilot-centric approach to viewing the causes of accidents. And third, some of its attention has been diverted to issues with constituent support–passenger interference with crew, seat belt use, carry-on baggage, and child safety restraints–that are unlikely to contribute much to lowering the accident rate.

The basic approach of the Safer Skies initiative–trying to avoid future accidents by learning from past accidents–has been the cornerstone of improvements in aviation safety. For example, smoke detectors and floor-level lighting were installed because of lessons learned from an Air Canada DC-9 accident in Cincinnati. Pilot training and flight procedures designed to protect against wind shear were changed because of lessons learned from a Delta L-1011 crash in Dallas. Aircraft deicing and anti-icing procedures were changed because of lessons learned from a US Air Fokker 28 crash in New York. Inspection and maintenance procedures for structural fatigue and corrosion were changed because of lessons learned from an Aloha B-737 crash in Hawaii.

But studying the causes of accidents is not nearly as simple as it might first appear. Accidents are typically the culmination of a sequence of events, several of which might be considered a cause. How these multiple-cause accidents are viewed can influence the potential safety problems that are emphasized. Consider a hypothetical accident in which a plane loses one of its two engines during liftoff. Although large passenger jets are designed to suffer an engine failure and still fly safely, avoiding an accident in such a situation still requires the crew to diagnose the problem correctly and quickly take exactly the right action. If the crew hesitates or makes even a small mistake, the result could be a crash. If the airplane does crash, the cause could easily be attributed to pilot error. But it could also be attributed to equipment failure, because if the engine had not failed the pilot would not have been put in such an extremely demanding situation.

In trying to draw lessons from safety problems that have contributed to fatal accidents and serious incidents in the past, the Safer Skies initiative is focusing on the last point at which an accident could have been avoided. Such an approach inevitably emphasizes the pilot. It is a valid approach and one that can contribute to improvements in pilot training. But there is another, equally valid approach, which we’ve emphasized in our research, that focuses on what started the sequence of events that resulted in a crash (Figure 2). Which approach is right? Taken alone, neither is. Aviation safety experts must examine ways of preventing the sequence from starting as well as ways of preventing a sequence that has begun from culminating in an accident. If we use only the pilot-centric approach, we may miss opportunities to reduce the frequency of putting pilots in difficult situations.

Charting the future

Although we believe that learning lessons from past accidents is at the heart of improving safety, we also believe that aviation’s future growth and the changes we will see in the industry’s operations will likely lead to threats to safety that differ from those in the past. We’d like to see more thought and discussion about emerging challenges to aviation safety. Toward that end, here are eight areas that we believe pose the greatest challenges to improving airline safety.

Ground congestion. Between 1989 and 1997, there was an increase in the rate of accidents caused by ground crew error (Figure 2). Most of these accidents did not result in serious injury or loss of life but rather were accidents in which a vehicle such as a catering or fuel truck collided with an aircraft and damaged it or in which an aircraft was pushed back from the gate into another aircraft that was taxiing past. Some of these accidents may reflect an increase in inexperienced ground crew resulting from the industry’s recent rapid growth. In other cases, however, the likely culprit is increased ground congestion at airports. Although airline traffic grew substantially in the latter part of the 1990s, airport capacity has grown very little in the past two decades. The result has been more aircraft trying to operate at the same time in the same limited space.

Airport congestion can have a more serious consequence in the form of a runway incursion, in which an aircraft, vehicle, or pedestrian enters the runway and creates a collision hazard with an aircraft taking off, intending to take off, landing, or intending to land. Runway incursions can lead to fatal accidents with substantial loss of life. The worst such accident occurred in 1977 at Tenerife in the Canary Islands when two B747s collided, resulting in the deaths of 555 passengers and 30 crew members.

Runway incursions (see Figure 3) rose in the late 1980s, spurring the FAA to focus increased attention on this hazard. But after a drop in the early 1990s, incursions have increased fairly steadily since 1993. Through early December 2000, there had been more than 397 incursions, compared to 321 incursions in all of 1999. If airline traffic continues to grow, runway incursions will likely increase unless additional steps are taken. Many of the steps that need to be taken are well understood by the FAA and are included in their various runway incursion plans. The problem is less that we don’t know what to do and more that we’re not taking the needed steps with a sufficient sense of urgency.

Litigation and accident investigation. Historically, a variety of people, including surviving pilots and cabin crew, mechanics, ground workers, and surviving passengers, have willingly provided key information in accident investigations. The overriding emphasis of investigators was on understanding the accident so that lessons learned could be used in preventing future accidents. There was little concern with trying to punish those who might have unintentionally contributed to the accident. In recent years, however, there has been an increase in civil and even criminal litigation after aircraft accidents. As a result, more people are becoming reluctant to talk openly to investigators, and it has become increasingly common for people to talk to their lawyers before talking to investigators. Although it’s difficult to determine the specific effect of this litigious environment on the quality of investigations, it seems clear that accident investigators are being told less and are finding it difficult to gather information in a timely fashion. It may be time to consider immunity from prosecution for those involved in accidents, even if it means that some people who were negligent will escape punishment.

Investigative technology. Automatically recorded information is becoming ever more critical in determining the causes of increasingly complex accidents. Flight data recorders (FDRs) in newly manufactured aircraft must now record 57 different measurements and soon will have to record 88. However, older aircraft are not required to collect much of this information, largely because it is extremely complex and expensive to retrofit aircraft with the sensors that provide information to the FDRs. In addition, sensors already in use, even those on many newer aircraft, often are placed only on the component being monitored, not on the pilot’s controls to that component. Thus, it is often impossible to tell from an FDR whether a component was in a certain position because the pilot put it there or because there was a malfunction in the control system.

A much less expensive alternative to retrofitting would be to install cockpit video recorders. Although they would not provide as much information as a plane fully equipped with sensors, well-placed cockpit video cameras would show what pilots were doing and something about the cockpit conditions they faced and would be enormously valuable in detecting malfunctions or failures in control systems. The use of video recorders would raise privacy concerns among pilots, but so did cockpit voice recorders when they were first introduced. We should move quickly to develop safeguards regarding how this information is used so that these privacy concerns can be addressed and cockpit video recorders can be installed in aircraft.

Increasing automation. Automation has already taken over many of the functions previously performed by pilots, air traffic controllers, and mechanics. For example, after takeoff, the pilot can program the plane to fly itself. Some aircraft are even equipped with an automatic landing function. However, in highly automated aircraft, pilots no longer have a direct mechanical or hydraulic link to control aircraft components. Instead they provide inputs to a computer that issues commands to the components. In some aircraft, the computer can even alter pilot inputs to prevent action that has been programmed as unsafe. How can we be sure that this increasingly complex programming will work as desired under the huge array of circumstances that aircraft potentially face?

A key practical issue is ensuring that the pilot will be ready to resume control of an aircraft when needed. Take, for example, the problem of ice accumulation during flight. Even small amounts of ice can dramatically degrade an aircraft’s performance, and with sufficient icing the aircraft can become unflyable. Because the autopilot can compensate for the accumulating ice up to a point, the pilot may not realize that there is a problem. But by the time he or she resumes control from the autopilot, the plane may have deteriorated to the point where it is no longer controllable.

The broader question is how much automation we can safely tolerate. Equipment–even backup systems–can fail. The greater the reliance on automation, the larger the transition the pilot, air traffic controller, or mechanic must make to maintain function when the system fails. If we use all the automation we can devise, this transition may become unmanageable. Determining the point at which adding more automation becomes counterproductive to improving safety is a complex issue, and we don’t pretend to know where that point is. Our concern is that the industry may not always realize that just because we have the technical ability to automate something doesn’t mean we always should.

Investigating why planes don’t crash. Collecting more and better information about airplanes that crash won’t be enough to achieve the goals of the Safer Skies initiative. We must also address questions of why in some cases a particular sequence of events leads to an accident whereas in others the same sequence begins but some sort of intervention, usually by the pilot, prevents an accident.

Although a great deal could be learned from flights in which a dangerous situation didn’t result in an accident, those flights are simply not studied, at least not in the United States. In order to be able to study these, we must overcome the reluctance of pilots, who oppose routine flight monitoring because of litigation threats and labor relations concerns. We also have to figure out how to use this potentially large amount of information productively. Only a few flights provide the sort of lessons that we can learn from; identifying those flights and drawing the important lessons is a research challenge that has yet to be confronted.

Safety performance in a cyclical industry. Historically, many pilots have been trained in the military, but during the past decade civilians have become the major source of new pilots in the airline industry. A pilot moves from flying simple aircraft in easy-to-handle situations to increasingly more sophisticated aircraft in a variety of operations, including air taxi operations for freight or passengers, cargo airlines, commuter airlines, and finally passenger jet airlines. The pilot gains experience in a wide variety of situations, and a filtering process takes place as pilots with better flying skills and judgment advance.

The airline industry has always been strongly affected by business cycles. During periods of rapid growth, jet carriers’ increased demand for pilots means that pilots often move more quickly up the career ladder. There is always the concern that they do so with insufficient experience and with less filtering. With accelerated movement up the pilot career ladder and the resulting influx of less experienced pilots, we might expect to see an increase in pilot errors. Indeed, as seen in Figure 2, the rate of accidents initiated by pilot error was higher in the 1990s than in the 1980s. Although this is not definitive proof that a problem exists, we’ve also seen a higher rate of pilot error when examining the year-by-year distribution of accident causes during other periods of rapid industry growth. During strong growth periods, there may well be similar problems with airline mechanics and workers who build aircraft and their major components.

Aviation security. Aviation security moves in and out of public consciousness in the United States, depending on how recently there has been a hijacking or terrorist incident in this part of the world. The threat, however, remains. Defending commercial aviation from terrorists is inherently difficult because of the multiple points of access to air transportation, including checked and carry-on baggage; airport workers such as caterers, baggage handlers, and construction workers; and attack from weapons such as hand-held missiles.

Measures are in place to prevent terrorists from using these and other points of access, but none of the measures is foolproof. More steps could be taken in each of these areas, but they come with higher costs, added inconvenience to passengers, and more delays to the system. Technological approaches to the detection of explosives and weapons hold promise in some areas, but they are expensive and can slow the throughput of the system. Attempting to speed these processes tends to increase the rate of false positives (when the detector finds something that appears to be a threat but turns out not to be), which in turn adds to delays. Moreover, some of the technological approaches, such as x-rays that can see through clothing to detect weapons, explosives, and other contraband raise privacy issues. Of perhaps even greater long-run concern is the safety of airports themselves, which are also vulnerable to terrorists. We know of no easy or inexpensive solutions to the potential threat posed by terrorists. But it would be a mistake to downplay terrorist threats to domestic aviation simply because domestic aviation hasn’t yet been a victim.

Organizing governmental institutions for safety. Until recently, the question of how the government safety function should be organized hadn’t been given much thought. But with growing interest in the privatization of air traffic control, many countries have had to confront this question. Almost without exception, they have chosen to regard safety regulation as an inherently governmental activity and to separate safety oversight and regulation from operations. Yet in the United States, the FAA not only operates the air traffic control system, it also sets standards for the system and enforces them. There are inevitably tradeoffs between safety and capacity in air traffic control. Under the current U.S. system, the tradeoffs made by the FAA are not subject to any external review or oversight. We wouldn’t permit such a system for airline operations or manufacture. Because regulation works best when competing interests are exposed to public scrutiny, it’s time to consider separating the two roles.

A second element involved in organizing governmental institutions for safety is harmonizing international safety regulation. A persistent theme in aviation safety research is the disparity of safety performance in different regions of the world (Figure 4). Although North America, Western Europe, Australia, and New Zealand all have comparatively safe operations, operations in the remaining regions in the world are dramatically less safe. The reasons are varied, including differences in navigational and landing aids, airports, weather, and terrain. But there are also differences in regulatory standards and enforcement in areas such as pilot training, mandatory equipment on aircraft, and aircraft maintenance. These differences are aggravated by the tendency in some developing countries for airlines to buy older aircraft from developed countries. Although older aircraft can be operated safely when properly maintained, adequate maintenance is frequently lacking in developing countries. It is not surprising that equipment failure is responsible for a greater share of accidents in these regions. Controlled-flight-into-terrain accidents–crashes in which pilots lose track of where they are in relation to the ground–are vastly more frequent in the rest of the world than they are in the United States. The FAA long ago required that U.S. aircraft install relatively inexpensive devices called ground proximity warning indicators, which have virtually eliminated this kind of accident. U.S. airlines have gone even further and installed a second generation of these indicators that gives pilots still better information. But in most of the rest of the world, even the first-generation devices are not required at all.

There have already been considerable efforts at regulatory coordination and harmonization, particularly between Western Europe and the United States, but these efforts have mostly involved the approval and certification of new aircraft designs. There have been relatively few attempts at harmonizing international standards and enforcement on airline operations, aircraft maintenance, pilot training and licensing, and minimum required equipment on aircraft. Accident investigation is also more difficult in many countries, because FDRs and cockpit voice recorders are often less sophisticated, if they are even installed and functioning.

As air travel has become safer in the United States, further safety improvements have been harder to achieve. However, with the expected growth in air travel, simply maintaining the same accident rate will result in an increase in the number of accidents and fatalities. To avoid that increase, the accident rate will have to be lowered. The traditional approach of learning from past accidents will continue to be the cornerstone of that effort, but to push beyond the current level of safety, we’ll also have to address the longer-term challenges we’ve discussed.