Life After #Germanwings 4U9525: Lessons in Risk Management

A memorial service was held on Friday, at Cologne Cathedral, for the 150 people who died an untimely death when #Germanwings 9525 crashed. The comment by one of the mourners set my mind racing on a tangent.

A relative of one of the victims remarked, “To know that this was a murder and not an accident, makes our grief even more. The question that now comes to my mind is WHY?” It was further reported that parents of 27 year old Late Mr. Andreas Lubitz, who appears to have to deliberately locked the captain out of the cockpit and taken control of the plane so that he could crash it, had been invited to the service but did not come. The couple have not spoken publicly since the crash and are trying to mourn the loss of their son in dignified isolation and silence, no doubt tormented by the events.

These two news items highlight everything that the French investigators are to blame for in their extremely unprofessional conduct of making public statements before all the facts were collected, all the evidence analysed and even before any nature of professional investigation had gotten underway! While loss of a loved one in an accident has an element of grief, but one can accept such event as fate. However, when it is told that it was not an accident, but a murder, the grief takes-on a very different connotation, and not just for the victims’ families! This is the reason why it is all the more important to deal with these matters very sensitively, confidentially and methodically. All available evidence needs to be collected, analysed scientifically with latest techniques of forensic science. The possibilities that emerge then need to be tested through simulations to close the gaps and evaluate the alternate scenarios. Only then can the investigators arrive at the most likely event scenario. In all this, it is very important to remember the basic principles of any investigation, as well as natural justice: Evidence must be weighed, not counted; and every individual is innocent unless proved guilty.

The French investigators have violated both these basics of accident investigation. Weight of evidence of “human breathing” heard in the CVR tapes is far heavier than weight of evidence of manual input to controls. In a normal CVR recording, it is not possible to hear a pilot breathing and if this sound can be heard, it is a clear indication that the individual was not in normal state of health…clearly breathing hard and heavy…like in a “Panic Attack”, for instance! There have been further statements in the press, attributed to the French Prosecutor, that report him stating, “Pilot tried to break the door using an Axe”! I hope that he has been misquoted on this one, because anyone who has ever flown in a commercial airliner in recent years would know that there are no Axe’s available inside a commercial airliner today! Even if we assume that one was available, how can this conclusion be reached merely from hearing sounds recorded in a CVR tape?

Clearly, public statements have been made here without properly analysing and processing the available evidence. This projects the BEA and the French Prosecutor in very poor light, because they have through this action caused immeasurable and unnecessary avoidable pain to over 150 families!

That being said, one cannot escape the fact that at the centre of this controversy is the armed cockpit door. I had stated, in one of my earlier posts in this blog that in today’s world there are rarely any new accidents. Almost every Accident has happened before, and for the same reasons.

The case in point is Ethiopian Airlines Boeing 767-300 that was en route from Addis Ababa to Rome operating as Flight ET702 on Feb. 14, 2014. At one point during cruise, the captain left the cockpit to use the lavatory. The first officer did not allow him back inside and hijacked the aircraft. At this point he could have done anything with the airliner. He could have crashed the 767 into a crowded square in London, Paris or Berlin. Instead, he decided to fly wide circles over Geneva and finally land there to request political asylum. No injuries. The world forgot. The debate on cockpit security procedures should have happened then. However, there was no blood, so no one thought it important to take any further action. The safety process loop was not fed…

Cockpit doors were provided with armed security after 9/11 incidents. This was a mitigation measure to reduce the risk of a hijack to ALARP…the yellow or the green region in the inverted triangle above. However, this mitigation measure did create an additional risk…that of keeping the good guys out as well! While the American regulator developed a further mitigation by regulating that two crewmembers must always be present in the cockpit, the European regulators did not do so…and this was not updated even after the February 2014 incident that highlighted the need for a further mitigation strategy here. Therefore, while one can go to eternity blaming a suicidal pilot, the fact remains that a regulatory lapse allowed this to happen. A regulatory lapse that was not corrected even when highlighted by another similar event over one year ago. The essential continued to remain invisible!

The job of safety risk management needs to happen at the base of this iceberg…in the region of 1000-4000 latent conditions that exist for every 1-5 fatal accidents. The latent condition was highlighted through the event of February 2014 and missed, causing the conditions to remain favourable for the Germanwings accident to occur! In the game of safety risk management, there are no runners-ups. Either we win or we lose. Yes, Flight 9525 ended in tragedy and ET702 did not. They are vastly different in public perception and attention, but in both cases one of the pilots managed to take control of the aircraft because a decade earlier, secure cockpit doors were introduced that cannot be opened against the will of the person left in the cockpit. This is why it is so important to design a system properly and professionally as per the flow chart below.

This is the one discussion the industry and regulators should have had more than a year ago, or after the Nov. 13, 2013, crash of a Lineas Aereas de Mocambique Embraer 190 that was in all likelihood caused by the captain committing suicide: 33 people died. That the debate did not happen back then is cynical, but now that it is taking place the danger is that wrong conclusions will be drawn.

Some press reports are debating if the secure cockpit doors should be relinquished. This, in my opinion, is nonsense. There are still valid reasons for the cockpit to be a protected space; the threat from terrorists trying to use aircraft as weapons does not seem to have decreased over the past decade.

It took European regulators mere three days to decide that a minimum of two people have to be in the cockpit at all times, effective immediately, with no serious discussion. While there are no obvious drawbacks to the new occupancy rule, its advantages are even less obvious than at first sight. Would a flight attendant really stop a pilot committed to intentionally crashing an aircraft? Probably not. Could a committed flight attendant with access to knives in the galley be a potential safety threat to the pilot left in the cockpit? I believe that yes, this is possible.

The moves are clearly based on rushed judgments made under enormous public pressure. It would have been much better to slowdown, evaluate, debate and then decide professionally in a cool headed manner when emotions are no longer the guiding factor!

The most important thing this industry needs to look at is whether cockpits should continue to be so secure that they cannot be entered even under reasonable circumstances. Right now, the pilot remaining in the cockpit can prevent door from opening even when the emergency code is entered on the keypad outside, the idea being that a hijacker might force a flight attendant to reveal the code to gain access. When secure doors were introduced after the 9/11 terrorist attacks, the possibility of a rouge, or disabled, pilot in the cockpit was not considered. It was taken for granted that pilots would never do something like that, or suffer from any affliction preventing him from opening the door. Today we know that the assumption was wrong.

There is also a reason to doubt if the Captain indeed knew the emergency access code. For this, it is important to look at the pre-flight briefing procedures, and the culture, at Germanwings to understand how seriously this matter was being dealt on a day-to-day basis. At this time, there seems to be no evidence that the Captain indeed tried to seek entry using his emergency access code, and more importantly, there is also no evidence that the Co-pilot prevented him from entering!

However, one still needs to put things into perspective. There have been a handful of events that can be linked to pilots intentionally crashing aircraft. However, in the broader debate about how we perceive and accommodate mental health issues, in particular depression, in the workplace,  The DSM-IV criteria say that a Major Depressive Disorder or Depressive Episode may be present where a patient exhibits a majority of these symptoms every day:

• Depressed mood or irritable most of the day, nearly every day, as indicated by either subjective report (e.g., feels sad or empty) or observation made by others (e.g., appears tearful).
• Decreased interest or pleasure in most activities, most of each day
• Significant weight change (5%) or change in appetite
• Change in sleep: Insomnia or hypersomnia
• Change in activity: Psychomotor agitation or retardation
• Fatigue or loss of energy
• Guilt/worthlessness: Feelings of worthlessness or excessive or inappropriate guilt
• Concentration: diminished ability to think or concentrate, or more indecisiveness
• Suicidality: Thoughts of death or suicide, or has suicide plan

We see here that “suicidality” is only one symptom of a severe depressive condition and indeed, may be the least common. It is notable that the condition is not typically marked by signs of outwardly turned hostility or violence. Indeed, depression is more an emotional implosion than explosion.

In the noise erupting around Germanwings, we must remember two simple facts: depression does not normally lead to suicide and suicide almost never leads to murder.

Therefore, in this emotionally charged debate on how to keep suicidal pilots out of our cockpits, it is important to note that we do not yet have all the facts. A known devil, it is said, is better than an unknown God! Any decision taken in the heat of this emotionally charged environment without proper and complete scientific process will have consequences in the future. It is not enough to do something…it is important to do the RIGHT thing. The right thing here is to wait for the complete evidence to be available. For it to be scientifically processed and weighed. For the residual or new risks generated out of every proposed mitigation measure to be analysed too, and properly mitigated. Only then will we be in a position to take a correct decision that will prove its worth over a long period of time.

Stay Safe,

The Erring Human.