Life After #Germanwings 4U9525: Lessons in Risk Management

A memorial service was held on Friday, at Cologne Cathedral, for the 150 people who died an untimely death when #Germanwings 9525 crashed. The comment by one of the mourners set my mind racing on a tangent.

A relative of one of the victims remarked, “To know that this was a murder and not an accident, makes our grief even more. The question that now comes to my mind is WHY?” It was further reported that parents of 27 year old Late Mr. Andreas Lubitz, who appears to have to deliberately locked the captain out of the cockpit and taken control of the plane so that he could crash it, had been invited to the service but did not come. The couple have not spoken publicly since the crash and are trying to mourn the loss of their son in dignified isolation and silence, no doubt tormented by the events.

These two news items highlight everything that the French investigators are to blame for in their extremely unprofessional conduct of making public statements before all the facts were collected, all the evidence analysed and even before any nature of professional investigation had gotten underway! While loss of a loved one in an accident has an element of grief, but one can accept such event as fate. However, when it is told that it was not an accident, but a murder, the grief takes-on a very different connotation, and not just for the victims’ families! This is the reason why it is all the more important to deal with these matters very sensitively, confidentially and methodically. All available evidence needs to be collected, analysed scientifically with latest techniques of forensic science. The possibilities that emerge then need to be tested through simulations to close the gaps and evaluate the alternate scenarios. Only then can the investigators arrive at the most likely event scenario. In all this, it is very important to remember the basic principles of any investigation, as well as natural justice: Evidence must be weighed, not counted; and every individual is innocent unless proved guilty.

The French investigators have violated both these basics of accident investigation. Weight of evidence of “human breathing” heard in the CVR tapes is far heavier than weight of evidence of manual input to controls. In a normal CVR recording, it is not possible to hear a pilot breathing and if this sound can be heard, it is a clear indication that the individual was not in normal state of health…clearly breathing hard and heavy…like in a “Panic Attack”, for instance! There have been further statements in the press, attributed to the French Prosecutor, that report him stating, “Pilot tried to break the door using an Axe”! I hope that he has been misquoted on this one, because anyone who has ever flown in a commercial airliner in recent years would know that there are no Axe’s available inside a commercial airliner today! Even if we assume that one was available, how can this conclusion be reached merely from hearing sounds recorded in a CVR tape?

Clearly, public statements have been made here without properly analysing and processing the available evidence. This projects the BEA and the French Prosecutor in very poor light, because they have through this action caused immeasurable and unnecessary avoidable pain to over 150 families!

That being said, one cannot escape the fact that at the centre of this controversy is the armed cockpit door. I had stated, in one of my earlier posts in this blog that in today’s world there are rarely any new accidents. Almost every Accident has happened before, and for the same reasons.

The case in point is Ethiopian Airlines Boeing 767-300 that was en route from Addis Ababa to Rome operating as Flight ET702 on Feb. 14, 2014. At one point during cruise, the captain left the cockpit to use the lavatory. The first officer did not allow him back inside and hijacked the aircraft. At this point he could have done anything with the airliner. He could have crashed the 767 into a crowded square in London, Paris or Berlin. Instead, he decided to fly wide circles over Geneva and finally land there to request political asylum. No injuries. The world forgot. The debate on cockpit security procedures should have happened then. However, there was no blood, so no one thought it important to take any further action. The safety process loop was not fed…

Cockpit doors were provided with armed security after 9/11 incidents. This was a mitigation measure to reduce the risk of a hijack to ALARP…the yellow or the green region in the inverted triangle above. However, this mitigation measure did create an additional risk…that of keeping the good guys out as well! While the American regulator developed a further mitigation by regulating that two crewmembers must always be present in the cockpit, the European regulators did not do so…and this was not updated even after the February 2014 incident that highlighted the need for a further mitigation strategy here. Therefore, while one can go to eternity blaming a suicidal pilot, the fact remains that a regulatory lapse allowed this to happen. A regulatory lapse that was not corrected even when highlighted by another similar event over one year ago. The essential continued to remain invisible!

The job of safety risk management needs to happen at the base of this iceberg…in the region of 1000-4000 latent conditions that exist for every 1-5 fatal accidents. The latent condition was highlighted through the event of February 2014 and missed, causing the conditions to remain favourable for the Germanwings accident to occur! In the game of safety risk management, there are no runners-ups. Either we win or we lose. Yes, Flight 9525 ended in tragedy and ET702 did not. They are vastly different in public perception and attention, but in both cases one of the pilots managed to take control of the aircraft because a decade earlier, secure cockpit doors were introduced that cannot be opened against the will of the person left in the cockpit. This is why it is so important to design a system properly and professionally as per the flow chart below.

This is the one discussion the industry and regulators should have had more than a year ago, or after the Nov. 13, 2013, crash of a Lineas Aereas de Mocambique Embraer 190 that was in all likelihood caused by the captain committing suicide: 33 people died. That the debate did not happen back then is cynical, but now that it is taking place the danger is that wrong conclusions will be drawn.

Some press reports are debating if the secure cockpit doors should be relinquished. This, in my opinion, is nonsense. There are still valid reasons for the cockpit to be a protected space; the threat from terrorists trying to use aircraft as weapons does not seem to have decreased over the past decade.

It took European regulators mere three days to decide that a minimum of two people have to be in the cockpit at all times, effective immediately, with no serious discussion. While there are no obvious drawbacks to the new occupancy rule, its advantages are even less obvious than at first sight. Would a flight attendant really stop a pilot committed to intentionally crashing an aircraft? Probably not. Could a committed flight attendant with access to knives in the galley be a potential safety threat to the pilot left in the cockpit? I believe that yes, this is possible.

The moves are clearly based on rushed judgments made under enormous public pressure. It would have been much better to slowdown, evaluate, debate and then decide professionally in a cool headed manner when emotions are no longer the guiding factor!

The most important thing this industry needs to look at is whether cockpits should continue to be so secure that they cannot be entered even under reasonable circumstances. Right now, the pilot remaining in the cockpit can prevent door from opening even when the emergency code is entered on the keypad outside, the idea being that a hijacker might force a flight attendant to reveal the code to gain access. When secure doors were introduced after the 9/11 terrorist attacks, the possibility of a rouge, or disabled, pilot in the cockpit was not considered. It was taken for granted that pilots would never do something like that, or suffer from any affliction preventing him from opening the door. Today we know that the assumption was wrong.

There is also a reason to doubt if the Captain indeed knew the emergency access code. For this, it is important to look at the pre-flight briefing procedures, and the culture, at Germanwings to understand how seriously this matter was being dealt on a day-to-day basis. At this time, there seems to be no evidence that the Captain indeed tried to seek entry using his emergency access code, and more importantly, there is also no evidence that the Co-pilot prevented him from entering!

However, one still needs to put things into perspective. There have been a handful of events that can be linked to pilots intentionally crashing aircraft. However, in the broader debate about how we perceive and accommodate mental health issues, in particular depression, in the workplace,  The DSM-IV criteria say that a Major Depressive Disorder or Depressive Episode may be present where a patient exhibits a majority of these symptoms every day:

• Depressed mood or irritable most of the day, nearly every day, as indicated by either subjective report (e.g., feels sad or empty) or observation made by others (e.g., appears tearful).
• Decreased interest or pleasure in most activities, most of each day
• Significant weight change (5%) or change in appetite
• Change in sleep: Insomnia or hypersomnia
• Change in activity: Psychomotor agitation or retardation
• Fatigue or loss of energy
• Guilt/worthlessness: Feelings of worthlessness or excessive or inappropriate guilt
• Concentration: diminished ability to think or concentrate, or more indecisiveness
• Suicidality: Thoughts of death or suicide, or has suicide plan

We see here that “suicidality” is only one symptom of a severe depressive condition and indeed, may be the least common. It is notable that the condition is not typically marked by signs of outwardly turned hostility or violence. Indeed, depression is more an emotional implosion than explosion.

In the noise erupting around Germanwings, we must remember two simple facts: depression does not normally lead to suicide and suicide almost never leads to murder.

Therefore, in this emotionally charged debate on how to keep suicidal pilots out of our cockpits, it is important to note that we do not yet have all the facts. A known devil, it is said, is better than an unknown God! Any decision taken in the heat of this emotionally charged environment without proper and complete scientific process will have consequences in the future. It is not enough to do something…it is important to do the RIGHT thing. The right thing here is to wait for the complete evidence to be available. For it to be scientifically processed and weighed. For the residual or new risks generated out of every proposed mitigation measure to be analysed too, and properly mitigated. Only then will we be in a position to take a correct decision that will prove its worth over a long period of time.

Stay Safe,

The Erring Human.

Rest in Peace Paolo

Photo courtesy Captain Mohan Ranganathan

It is with a very heavy heart that I am writing this post today. My mentor and friend, Paolo Pettinaroli left us for his heavenly abode on Saturday. Paolo was a great leader and a man of exceptional talents. He touched the lives of everyone in more ways than any other. He has been instrumental for the Aviation Industry's focus on Passenger Rights and for the recent regulatory initiatives in that direction. He has made the Italian Aviation Industry what it is today...a proactive and safety conscious industry that cares for its passengers.

Paolo touched my life very deeply. He was a source of great inspiration and motivation. For the first time in my life, words that have always been my best friends, escape me in expressing my feelings.

Rest in peace Paolo. Great men like you do not die...they merely fade away! The spark you ignited is today a flame and we shall not let this fame go out. The work you started is only half done and none of us will rest until the job is complete.

Adieu,

The Erring Human

WHAT AILS INDIAN CIVIL AVIATION? (Part 2)

On 20 March 2015, while FAA was in the process of re-evaluating India's safety rating, I had written a post on this same subject (WHAT AILS INDIAN CIVIL AVIATION?). FAA has subsequently considered it appropriate to upgrade India's rating to category 1. Now we have some disturbing news from India that only goes to support my view that India, at this time, does not deserve the Category 1 status! The news from India is as follows:

 

In my opinion, this incident in which the crew are being hailed as “Hero’s” for this “Amazing Feat”, and Indian DGCA’s lack of any reaction to it, represents everything that is wrong with Indian Civil Aviation. The arguments I have heard in the social media are as follows:

“Extreme circumstances require Extreme Solutions.... Better than an assured and painful death...”

“So you mean that under those conditions people should have been left to die... Please get real... No need to be an Academic in the situation that was...”

“Rules do not apply in toto for a Humanitarian Aid...”

“I believe that at the end of the day... 240 Thankful Souls and Human lives have been saved. Humanitarian consideration is supreme.”

“…calculated risks. Today's aviation is rule bound with no room for discretion. I am of the view that a bit of room needs to be given for discretion…”

Well, the answer to these arguments is that just like light is not absence of darkness, but presence of energy, safety is not absence of accidents, but presence of risk management. Principles of basic aviation risk management must be followed always and every time. To have an accident is not a crime but violation of standards is a crime!

“240 Thankful Souls and Human lives” were not saved in this flight, but lives of 240 unsuspecting innocent people were put to needless and avoidable risk! People who were desperate. People who had no option but to trust the professionalism and competence of the Indian Civil Aviation System to take them safe. People whose trust and faith has been betrayed by that very same system in the end!

My question is, if this flight had crashed, would we still be hailing this crew as “Hero’s” or would we be screaming “Pilot Error” and asking for the Pilot’s head to roll for overloading the aircraft? So, what message are we sending out there? The message I am getting is that it is Ok to violate as long as you do not have an accident! This is a very dangerous message, because once we set out on this path, there is no knowing who will violate what, when and to what extent! So, how many passengers more than the aircraft’s seating capacity are we willing to accept in a flight? In this case, the flight was loaded to 60 more than the seating capacity. So, if 60 is OK, is it also Ok to have 80 more? 180 more? 1,000 more? Where will we draw a line? Who will decide? On what basis will this decision be made?

The logic of putting lives of 240 people at risk to save 60 (who will also be included in this body count) escapes me! The basic mantra of Safety Risk Management cannot be overstated…while having an accident is not a crime; violation of standards is a crime…Always, and every time.

https://www.createspace.com/4583791

To understand the full implications of this incident, we need to go a bit deeper into how human minds work. I had also touched on this subject in the last chapter of my book “Waiting…To Happen!” and this will also be the prime subject matter of my next book that is, at this time, under production. However, to elaborate very briefly, humans are very adaptable. It is this trait of adaptability that has been one of the major factors in our survival as a race. A flip side of this adaptability is that we also adapt, very quickly, to risks in our environment and stop perceiving them as threats. An example can be found in driving a car. Initially, one may feel afraid to cross, say 40 Km/hr. speed. Nevertheless, one trip on the highway, driving at 60 or 80, and we stop seeing 40 as a risk any more. Then we quickly adapt to 60, 80, 120 or even more! In addition, humans are motivated by, among other factors, a “Need for Professional or Social recognition”. Seeing someone recognized/rewarded for an act motivates us to follow in that persons footsteps and do something similar. On the other hand, seeing someone punished or shunned for an action motivates us to avoid putting ourselves in the same situation. This is the basic theory on which “Carrot and Stick” policy works to modify human behavior and maintain discipline in an organization while also creating an “Organizational Culture”. 

Now, put these two concepts together. By recognizing the crews action (of overloading aircraft by 60 passengers more than the aircraft’s seating capacity) as an act of bravery, we are sending a message that it is more important to help someone than to follow correct procedures. The further message that goes across is that it is OK to violate safety standards and regulations to help someone. Now, a young and aspiring crew-member would latch on to this message very, very quickly. This will put them on a path where, in the end, there will be no control over who will violate what, when and to what extent! As long as they themselves feel justified, they would go ahead and violate…and while in this case the crew got away with the violation without an accident, the same will not be true every time or in every situation…and we will be left wondering, why did someone so well trained and experienced do something so stupid? The answer is simple. They did something so stupid because we set a precedence by recognizing and rewarding someone else’s violation instead of nipping the problem in the bud by strong action to send a message that INTENTIONAL violation of standards, and negligence, are never acceptable, whatever the circumstances! This is what is called an “Exceptional Violation” and in the chart below, an exceptional violation that amounts to negligence, is the ONLY violation that warrants a punishment.

So, PLEASE WAKE-UP INDIA! By praising this action and by not taking strong action to nip this in the bud, you are on a path whose end will only be in destruction and disaster!

Stay Safe,

The Erring Human.

#GermanWings: Do we need protection from suicidal pilots?

As investigation into #GermanWings flight progresses, there seems to be a growing evidence that 27-year-old co-pilot Andreas Lubitz deliberately crashed the Airbus A320 into the mountainside in the French Alps, killing 150 people. The captain, Patrick Sondenheimer, had stepped out of the cockpit, during which time Lubitz locked the door and began the aircraft’s lethal descent by allegedly reprogramming the autopilot to its minimum possible setting.

Sondenheimer reportedly tried to regain access to the cockpit by first knocking, then pleading and finally attempting to breakdown the door, while Lubitz showed no reaction and spoke no words during the final moments of his life. On the black box recording that also captured the terrified screams of passengers; Lubick can allegedly be heard "breathing normally".

While the investigation is far from over and many questions still need to be answered (like how can “Normal Breathing” be heard in a CVR recording and why there are no sounds associated with Captains use of Emergency access code to enter the cockpit, and Lubitz’s action to block this entry, recorded in the CVR), the question that is being debated is, how can we protect ourselves from a suicidal pilot?

In my opinion, the question itself is flawed. The question we need to ask is not how to protect ourselves from suicidal pilots, but how can we protect ourselves from a system that allowed a suicidal pilot to be present in the cockpit!

Pilots do not work in a vacuum. They are employed by an organization. The organization is expected to have in place policies and procedures to control the quality of pilots hired. Thereafter, it is a matter of management. Humans cannot be managed by books. Humans and objects have one essential difference…humans have feelings. Human need to be managed humanely. They need to provided leadership and they need to be supervised by other humans who have the skill-sets and experience to be recognized as leaders. I find it amazing that none at #GermanWings ever noticed any behavioural changes or signs of stress and depression in Andreas Lubitz. Clearly, his managers were not connected to him. They did not know the man they were managing.

Theories of Lubitz’s motives proliferated in the aftermath of the crash. An ex-girlfriend of Lubitz’s has come forward to claim that the co-pilot fantasized about fame and notoriety, and wanted to do something to make an impact and to make the world remember him. If Lubitz did intentionally crash this plane, one factor that primes all is his struggle with depression.

According to news reports, he suffered from a depressive episode of burnout in 2009, and was forced to withdraw from pilot training as a result. Investigators searching Lubitz’s home found several doctors’ notes attesting that he was too ill to work, including one from the day of the crash; evidently none of these notes, one of which was torn up, had been delivered to Lubitz’s employer. Medications for “severe depression” were also discovered in Lubitz’s residence. In addition, on Monday, according to the New York Times, the German prosecutor in Düsseldorf said that Lubitz had been treated for “suicidal tendencies” before he got his pilot’s license. There is little doubt that Lubitz was suffering intensely from depression at the time of his death. The question that comes to my mind is, why none among his family, friends, work colleagues and managers ever noticed the signs of his losing battle with depression?

As regards suicidal tendency, a prevailing theory of suicide holds that the decision is usually impulsive and sudden. “In people with severe depression who are suicidal, the thing we worry the most about is impulsivity,” says Dr. Charuvastra. “Many studies of suicide, at both the individual level and population level, demonstrate that impulsivity is one of the major risk factors that can catalyse suicidal thoughts into action.”

In the book “Suicidal Behaviour: Underlying dynamics” edited by Updesh Kumar, to which many renown psychologists have contributed, Professor Michael Anestis, Director of the Suicide and Emotional Dysregulation Lab at the University of Southern Mississippi, states that there is more to suicide than the impulse theory.

“Where everybody would agree on impulsivity is that impulsive folks attempt and die by suicide more than non-impulsive folks,” Dr. Anestis states. Where he disagrees with most is that according to him, it stops at that level. Contrary to the idea that suicide is born of an instantaneous burst of emotional pain, Dr. Anestis believes that the capability to commit suicide develops over long periods of time, during which a person becomes habituated to both the pain and the idea of dying.

Working with US Military, Dr. Anestis and his colleagues have found that those who have completed basic training, for example, have a higher suicide capability than those who have not, suggesting that learning to cope with the idea of death and significant physical stress builds up the endurance it takes to go through with suicide. Thus, there may be more time between a person’s initial consideration of suicide and the act itself than impulse theory would allow—and more of an opportunity for intervention than many suspect.

Preventing suicide requires a web of support: adequate and accessible mental healthcare, employment provisions that protect employees struggling with mental health problems, and, perhaps least often acknowledged, a society that is willing to express honest concern for people in pain.

In cases like Lubitz’s, it is hard to strike a proper balance between holding a person responsible for what they have done and taking into account factors, like severe depression, that may have mitigated their judgment. Therefore, it is worth being clear: Lubitz is guilty of his crime, and the realities of depression and suicidality are worth considering, not to tidy up his reputation, but to help establish a safer, more conscientious world for those left behind. Humane management of personnel, being connected to the staff on a human level, knowing the people one manages and providing leadership & mentoring to those in need is the only way to achieve this. In the end, it all boils down to a proactive and interactive management.

I am surprised this was missing at an airline like #Lufthansa and #GermanWings…and I wonder where else this is still missing! In the end, humans perform inside an organizations policies and procedures and it’s only through correct, coherent and scientific application of principles of Human Resources Development and Leadership can we mitigate the risk of suicidal pilots in our cockpits.

Stay Safe,

The Erring Human.