Skip Ribbon Commands
Skip to main content
Bookmark and Share this page


Assuring Safety in Aviation's Second Century, 8th Annual Assad Kotaite Lecture, Montreal, Quebec, Canada
Deborah A. P. Hersman
Royal Aeronautical Society, 8th Annual Assad Kotaite Lecture, Montreal, Quebec, Canada

 Good evening, and thank you, Captain Van Dyke, for that gracious introduction. It is an honor to be here with so many people who do so much for civil aviation and for aviation safety. And, it is a privilege to be invited to give this talk and be here with Assad Kotaite, a giant in international aviation. Dr. Kotaite's leadership advanced cooperation between ICAO, its contracting States, and the global aviation community, and dramatically fostered improvements in safety through standardization and technical leadership.

 I have not had the privilege to know Dr. Kotaite for as long as many of you in this room. But in speaking with my colleagues, they all credited him with the success of ICAO - its lack of politics and its focus on doing the technical work and being an efficient and effective organization. He excelled at leadership - of an organization, of people, and of ideas. He dramatically fostered improvements in safety through standardization. And that is my theme tonight - fostering improvements in aviation safety.

 As I look out at the audience and see so many of you from all around the world. I am reminded that global diversity and international perspective is what makes aviation so strong.

 Growing up, I spent most of my childhood overseas. I lived in Spain, England, and Amman, Jordan. I got to see other countries - their challenges, their successes, their diversity. I learned that one size does not fit all.

 In Jordan, I saw goat and sheep herders, which brings me to a story I want to tell. It's a Lebanese tale ... in homage of Dr. Kotaite's heritage.

 Once upon a time ... three goats - Siksik, Mikmik, and Jureybon - were grazing on a stony hill. Scenting them, a hyena lopes up.

 "Siksik," calls the hyena. "Yes, sir," says the goat. "What are those points on your head?" "These are my little horns, sir." "What is that patch on your back?" the hyena asks. "My hair, sir." "Why are you shivering?" roars the hyena. "Because I am afraid, sir." With that, the hyena gobbles him up.

 The hyena turns to Mikmik, who answers just as his brother, with the same tragic result.

 Next, the hyena approaches Jureybon. As the hyena draws near, Jureybon bellows, "May a plague be on you!" The hyena asks, "What are those points on your head?" "Why, those are my trusty sabers!" "And the patch on your back, what is that?" "My sturdy shield!" Jureybon replies. To the hyena's last question, "Why are you shivering?" Jureybon snarls, "Shivering? I'm shaking with rage to throttle you!

 Jureybon advances on the hyena, who runs for his life. Jureybon springs after him, slits open his belly, and frees his brothers.

 You could say that Jureybon was the world's first accident investigator.

 He saw what happened, learned from it, and adapted to prevent it from happening again.

 And, that's what I will talk about tonight: accident investigation - its past, present, and how it must adapt in order to play an even more pivotal role in creating civil aviation's safer and stronger future.

 Jureybon did exactly what the 185 delegates from 52 states intended two - thirds of a century ago at the 1944 Chicago Convention that created ICAO.

 Investigating, learning, and adapting from accidents so the deadly past would not be repeated. And that's what all of us and all of you are doing every day.

 Thanks to the vision in 1944 - and to the efforts of so many more - today's global airline accident rate is at its lowest ever. IATA reports that last year the global rate was one accident for every 1.6 million flights.

 That's a 42 percent improvement since 2000.

 How did we get to this low rate?

 What did we see? What did we learn? And how did we adapt?

 Here are three key areas that helped get us to that low rate: data, technology, and design.

 Those Chicago pioneers recognized the importance of data. Their plan: ICAO was to be a center for the collection, study, and distribution of information on all significant aircraft accidents.

 They did early work to define common terms and develop a standard method to present accident statistics. And, they laid important groundwork to develop an accident investigation manual.

 This focus was essential. For one, between 1946 and 1950, on average, U.S. carriers had a major aviation accident every 16 days. Think about that: Every 16 days.

 Here's another way our forebears recognized the importance of data. A report from the 1947 meeting of the Accident Investigation Section noted that flight recorders had proven valuable. The report recommended "these instruments should ideally record indicated air speed and acceleration as well as altitude."

 Those early foil flight recorders, followed by their second- and third-generation descendants, contributed significantly to today's outstanding global safety record.

 I could fill an entire book with examples of accidents solved - and countless accidents prevented - thanks to information obtained from data recorders. Much of that information led directly to technological improvements.

 In fact, just last month, Honeywell's Don Bateman was recognized by President Obama with the National Medal of Technology and Innovation for his breakthrough work developing ground-proximity warning and windshear detection systems.

 Bateman's EGPWS has all but solved CFIT accidents. And, with Doppler radar and so much more, aircraft now fly more safely in all kinds of weather conditions. Traffic collision alerting systems, or TCAS, have helped eliminate mid-air collisions.

 Those are just the tip of the technology iceberg.

 Through aviation's first century, the community learned a tremendous amount - the hard way - about aircraft design issues from a number of accidents, including the DC-10 with its poorly designed cargo door latches and the Boeing 737 and metal fatigue.

 As we ended that first century, we saw further design improvements on the workhorses of the airline industry - remedies for the rudder design issues in the 737 and the inflammability of the 747 center fuel tank. Today, we find fewer and fewer equipment and design failures.


 We investigated. We learned. And we adapted.

 So, what are we seeing in aviation's second century?

 Today, there is greater safety. Yet, at the same time, there are greater challenges in investigating accidents and assuring safety.

 This is because while modern technology has made aircraft more efficient, they are also far more complex.

 No one knows that better than you.

 Look at the changes. Old "steam gauges" have been replaced by electronic displays. Hand flying has been supplanted by increasing automation. Many flight controls now rely on electronic actuators compared with control cables. And, of course, there are more and more composite structures.

 While these all provide advantages, they require adjusting how accident investigators acquire evidence and information.

 The evidence and failure signatures we relied upon in yesterday's investigations are not always available today.

 For example, in 2001, when we pulled the vertical fin of the Airbus 300 out of the waters in the New York area it took us a long time to figure out where the failure began and why, and what the forces operating on it were. Because we didn't have typical overstress signatures that we used to see with metal.

 Or, before glass cockpits, investigators could determine an airplane's airspeed at impact because they could see the slap of a needle on the face of the gauge. These concrete physical traces are no longer there.

 The good news is that investigators have access to more data sources. Today's flight recorders collect thousands of parameters. And, investigators are able to retrieve information from non-volatile memory sources, which can be recovered from electronic components, including digital engine controls, flight control and maintenance computers, and much more.

 Even when these devices are severely damaged, we've had successes with chip-level data extraction. There's also data transmitted from onboard reporting systems, such as ACARS, which can provide investigators with critical real time information.

 And, we're seeing an immense amount of video data from surveillance cameras and personal cameras, as well as information from GPS devices and electronic flight bags.

 In fact, over the last seven years, there has been a 200 percent increase in the number of recording devices that come into our lab.

 All of this comes together to provide key pieces of the investigative puzzle.

 Yet, even with all the data sources, we continue to deal with the most complicated piece of equipment in aviation for which there is no data recorder.

 That's right, the human.

 For example, in the August 2006 accident in Lexington, Kentucky, the pilots tried to take off from the wrong runway - one intended for GA aircraft.

 This investigation highlighted issues of communication, runway signage, and the importance of cockpit discipline.

 Likewise, it was not a mechanical issue that caused the February 2009 crash near Buffalo, New York. This investigation shed further light on pilot professionalism, fatigue, and pilot training.

 Unlike the early accidents where investigators identified a structural or component failure, human factors accidents are even harder to investigate.

 We can figure out why a component failed, we can't always figure out - especially in a fatal accident - why humans made the decisions they made.

 It's important to identify the decision-making process that got them there so we can prevent it from happening again. Yet, unlike airplanes that come off the assembly line, that are intended to be exactly the same every time, and perform to predictable and repeatable specifications - human beings are not always predictable.

 As the mother of three boys, I can tell you that humans are not predictable.

 And, there's only so much data on the CVR, often the most scrutinized piece of equipment on an accident airplane. Investigators listen for inflections in the pilots' voices -yawns, straining on the controls, and many other subtle changes in speech to determine why pilots responded the way they did ... or did not.

 One of the most frustrating things our investigators encounter is listening to a CVR and hearing a pilot say, "Look at that!"

 It can take years of painstaking effort to finally determine what "that" was and its relevance to the accident.

 Unfortunately, there are no FDRs in pilots' heads.

 Adding to the complexity of accident investigation in aviation's second century is the increasing globalization of aviation. No longer is there a clear distinction between domestic and international accidents. Accidents involving U.S. operators and U.S. equipment can and do occur anywhere in the world. Likewise, accidents may happen in the United States, but involve a foreign-operated or foreign-manufactured aircraft.

 And, truly, what does "foreign-manufactured" mean today? Look at the Boeing 787 supply chain, which stretches from Japan to Italy. The Airbus A380 has 100-plus suppliers in more than 20 countries.

 This is why the accident investigation framework provided by Annex 13 is so crucial.

 Annex 13 provides the foundation - the protocols, the rights and responsibilities - for the States to work together.

 One of the challenges is when the accident investigation protocols defined in Annex 13 collide with the local political and judicial systems. This is where data and cooperation is so essential. The data - most often on the recorder - is needed first since for safety investigations it lays the foundation for all the activities to follow.

 The activities that enable us to investigate, to learn, and to adapt.

 Today, as we work together across boundaries to learn what caused an accident, we are doing even more to help those whose lives are affected by them.

 A number of states have instituted family assistance programs. Most recently, the European Union passed family assistance legislation for its member States.

 We applaud ICAO for its family assistance leadership.

 At the NTSB we were honored, at ICAO's request, to participate in a task force to revise ICAO Circular 285, first published ten years ago.

 As I mentioned in the beginning of my speech, we recognize that one size will not fit all cultures. In March, the NTSB held a family assistance conference attended by representatives from more than 30 countries - from North and South America, from Africa and Asia. Clearly, there is a widespread need for consistent principles for governments and air carriers.

 We are hopeful the Council and Assembly will embrace this issue. Because in the aftermath of an accident, we have seen what happens, we've learned about what needs to be done, and, now we need to adapt.

 With air travel's dynamic worldwide growth - projected to be some 3.6 billion passengers by 2014 - we know that as we plan ahead, we must be very intentional in how we work together, which is why the ICAO structure and Annex 13 are so important.

 How are we going to investigate, learn, and adapt in order to prevent accidents in aviation's second century?

 It's clear that accident investigation will depend far more on data and cooperation than in the past.

 While time honored tin-kicking will never go away, it is increasingly being joined by sophisticated data analysis.

 And, the amount of data is growing every day.

 Let me tell a story that illustrates the new model of accident investigation ... and the importance of data and cooperation.

 On January 17, 2008, a British Airways Boeing 777 crash-landed at London Heathrow.

 The plane, on a flight that had originated in Beijing ten-and-a-half hours earlier, was on short-final approach at 720 feet AGL when first the right engine and then the left engine stopped responding to auto-throttle.

 Two engines out. Never before on a 777. A 200-ton airliner with 151 souls on board was now gliding to Heathrow's runway 27L.

 Through outstanding airmanship, over busy roadways and dense population, the pilots brought the plane to land just beyond the perimeter fence at Heathrow.

 The UK's AAIB led the investigation, which the NTSB joined as an accredited representative.

 The FDR, CVR, and quick access recorder were recovered. Some 1,400 parameters on the data recorders. The pilots gave extensive interviews. All of this told the team nothing about why both engines failed.

 Nor did tests of the fuel, of water content, examining where the airplane was last serviced, and more. Everything came up blank.

 Yet, with the rich store of data, the team reviewed thousands of similar flights and compared the accident flight to those thousands. Several things stood out, including that the accident plane flew longer at colder temperatures than other flights. Temperatures at some points were as cold as minus 74° Centigrade.

 This led to scrutiny of fuel delivery to the engines. Lab tests looked at the effect of extreme cold temperatures and long idle times. Of particular interest was the fuel oil heat exchanger, which uses cold fuel to take heat away from the oil and leads to the engine running cooler, especially the bearings.

 The investigative team performed tests running the engine for hours with extremely cold fuel. They saw ice crystals form on the face of the fuel oil heat exchanger. If the engine throttle was applied, the newly formed ice broke up. But, with no throttle applied, the ice continued to form.

 It turned out that this "perfect" flight - with minimal throttle usage to conserve fuel - led to a "snow cone" forming on the face of the fuel oil heat exchanger. When the throttle was finally applied on short final the fuel encountered an icy barrier and could not get through to either engine.

 Corrections included interim procedures, which were followed by a redesign of the fuel oil heat exchanger.

 The team investigated, learned, and the community adapted.

 Safety was served.

 None of which would have been possible without data and cooperation.

 Here's another story about the importance of data to accident investigation.

 In late 2008, a Continental Airlines 737 crashed on takeoff at Denver's International Airport.

 It was a windy day, as it is so often on Colorado's high plains. In Continental's operation the 737 has a crosswind limit of about 30 knots. A Denver tower controller told the flight crew that the winds on the runway were 27 knots and were not pure crosswinds.

 The crew, assessing they were well within Continental's limits for operating in high winds prepared for takeoff. Yet, when they rolled down the runway they were hit by 90-degree crosswinds that exceeded 45 knots. This resulted in the plane, full of holiday travelers, weather-vaning and departing the side of the runway at about 90 knots. The airplane sustained substantial damage during the roll over uneven ground. Fortunately, no one was killed or seriously injured.

 Just as with the BA flight, the investigative team downloaded recorders, examined equipment, and interviewed the crew, dispatchers, meteorologists, Boeing aircraft performance engineers, and controllers. From this information, the team couldn't tell what was so unusual about this day, this flight, or this flight crew.

 The data revealed that frequently Denver's major airport experiences much stronger crosswinds than expected on takeoff.

 That led to the first key finding: the method ATC was using for reporting winds to flight crews was not providing the best possible information to flight crews. Then, questions about crew training took investigators to Continental's simulator training facility to see how it trained its 737 pilots on crosswinds. The training simulated up to 30 knots of crosswinds ... and then the trainer threw a switch to add an additional 5 to 6 knots of gusts.

 Sometimes it can be difficult to reach a simple finding. That was the case with this accident. Our investigation revealed that the pilots were being trained on a constant wind and no gusting.

 Yet, pilots are more likely to see crosswind gusts of 40 knots than engine failure. They are trained in engine out procedures and not gusts.

 Just like at Heathrow, there was investigation, learning, and adapting to improve safety.

 None of which would have been possible without data.

 Yes, data is key. And, in this era of dynamic growth and greater complexity, it is more important than ever.

 As Alan Mulally famously - and frequently - said when he was with Boeing: "The data will set you free."

 In our work, it does much more than that.

 Data saves lives.

 In aviation's second century, accident investigators need all the data available to put together the big picture of what happened. Some of that data - as we saw at Heathrow and at Denver - is from routine flights that can be compared with the accident flights.

 I applaud the agreement reached last year at the 37th Assembly to foster data sharing through the creation of the Global Safety Information Exchange.

 This information can be vital to learning what really happened and determining what can be done to improve safety.

 Data and cooperation. This is how we will continue to investigate, learn, and adapt.

 And, it is how aviation will maintain - and enhance - its strong safety record into the second century of powered flight.

 The recent General Assembly initiated this dialogue about data sources. This is essential in setting standards of protection for the use of data in accident investigations.

 The NTSB looks forward to continuing the conversation on cooperation next year when we host an international conference to share experiences, address the challenges with conducting Annex 13 investigations, and identify best practices.

 We will also address training needs for investigators on new and advanced equipment as well as follow up on the work underway on international family assistance.

 I began my remarks to honor Dr. Kotaite with that Lebanese story about three brothers. Let me close with a tale about three sisters that honors President (Raymond) Benjamin's French heritage. It's one of my favorites - "Cinderella."

 You know the story about the maiden outfitted in fine clothes by her fairy godmother who captivates the prince at the ball. Yet, when she races to leave before the stroke of midnight - as she was instructed - she loses one glass slipper. That lone slipper is how the prince - himself a clever investigator like Jureybon - finds the girl of his dreams.

 Today, with sophisticated data analysis, the prince would not have to try the glass slipper on every female in the kingdom.

 He could run a software program, compare all the shoe sizes, avoid the wicked stepsisters, and quickly find his princess. And live happily ever after.

 How will we in aviation fly more safely ever after?

 No matter how proud we are of the record of safety record we have achieved, we cannot - we must not - be complacent. We must make a constant commitment to further improve aviation safety - by observing, learning, and adapting. And by using the data and increased international cooperation through ICAO.

 But, when the inevitable accident occurs, we must also recognize our responsibilities to those that are left behind. Because life is not always a fairytale ending. There are accidents and there are families and friends who are left behind.

 Like Jureybon, we are our brothers' and our sisters' keepers.