EASA Task Force Report on #GermanWings 9525 - A tale of missed opportunities and Accidents "Waiting...To Happen!"

The European Aviation Safety Agency (EASA) was tasked by the European Commissioner to establish a Task Force to look into the accident of #GermanWings flight 9525 including the findings of the French Civil Aviation Safety Investigation Authority (BEA) preliminary investigation report.

Chaired by EASA Executive Director, the Task Force consisted of 14 senior representatives from airlines, flight crew associations, medical advisors and authorities. Additional contributions were provided by invited experts and representative bodies. Three formal Task Force meetings took place from May to July 2015.

As a result of its work, the Task Force delivered a set of 6 recommendations to the European Commission on 16 July 2015, as follows:

• Recommendation 1: The Task Force recommends that the 2-persons-in-the-cockpit recommendation is maintained. Its benefits should be evaluated after one year. Operators should introduce appropriate supplemental measures including training for crew to ensure any associated risks are mitigated.
• Recommendation 2: The Task Force recommends that all airline pilots should undergo psychological evaluation as part of training or before entering service. The airline shall verify that a satisfactory evaluation has been carried out. The psychological part of the initial and recurrent aeromedical assessment and the related training for aero-medical examiners should be strengthened. EASA will prepare guidance material for this purpose.
• Recommendation 3: The Task Force recommends to mandate drugs and alcohol testing as part of a random programme of testing by the operator and at least in the following cases: initial Class 1 medical assessment or when employed by an airline, post-incident/accident, with due cause, and as part of follow-up after a positive test result.
• Recommendation 4: The Task Force recommends the establishment of robust oversight programme over the performance of aero-medical examiners including the practical application of their knowledge. In addition, national authorities should strengthen the psychological and communication aspects of aero-medical examiners training and practice. Networks of aero-medical examiners should be created to foster peer support.
• Recommendation 5: The Task Force recommends that national regulations ensure that an appropriate balance is found between patient confidentiality and the protection of public safety. The Task Force recommends the creation of a European aeromedical data repository as a first step to facilitate the sharing of aeromedical information and tackle the issue of pilot non-declaration. EASA will lead the project to deliver the necessary software tool.
• Recommendation 6: The Task Force recommends the implementation of pilot support and reporting systems, linked to the employer Safety Management System within the framework of a non-punitive work environment and without compromising Just Culture principles. Requirements should be adapted to different organisation sizes and maturity levels, and provide provisions that take into account the range of work arrangements and contract types.

Following the 11 September 2001 attacks, several measures were introduced to mitigate the risk of unwanted persons entering the cockpit. Secure cockpit door locking was rapidly mandated, and rules were subsequently fine-tuned to address the risks in the areas of rapid aircraft depressurisation, double pilot incapacitation, post-crash cockpit access, and door system failure including manual lock use.

The focus for all the measures that were introduced was put on the threat from outside of the cockpit. A potential threat from inside the cockpit was not fully considered in either the initial phase or the period that followed, when the regulations were fine-tuned.

As I have also pointed out in my earlier blog posts in this blog, the risk mitigation measure introduced to mitigate the risk of unlawful interference (Secured Cockpit Door) has actually facilitated the very event it was meant to prevent! There have been many cases, even before #GermanWings 9525, where the secure cockpit door was locked from inside by a rouge pilot, preventing the other pilot from entering, while he proceeded to unlawfully interfere with the flight by hijacking or crashing it. The risk mitigation measure had been introduced and implemented in a hurry, without a full assessment of Residual Risks or Additional Risks created by its implementation.

This was a mandate that the EASA task force was charged with. Here was an opportunity to carry out a professional risk assessment and properly evaluate all the additional/residual risks and develop a system to mitigate them as well. Here was an opportunity to reform the cockpit door technology and to improve the procedures surrounding its use. Here was an opportunity to, maybe, introduce new technology; develop new policies and/or new procedures.

Unfortunately, the task force has missed the bus! They have chosen to limit themselves to the “2-persons-in-the-cockpit recommendation”, instead of being more creative and developing further on this base to introduce more security measures in addition to merely two-persons-in-the-cockpit. The technology today has advanced considerably since the days of 2001 and many additional and secure measures are today possible beyond the mere four digit numeric code to lock or open a door. These additional measures, like biometrics etc., are not only readily available but are competitively priced and readily implementable.

I was reminded by my colleague, Carlo Cacciabue, of Professor James Reason’s ground breaking research and work on Safety Management Systems. He used to say, mistakes by humans, be they errors or violations, are like mosquitoes. You can try to swap them individually, but they will keep coming back. The only way to save ourselves from being bitten is to drain the swamps where these mosquitoes breed. All human performance happens inside an organizations policies and procedures. Erroneous or insufficient policies/procedures are the swamps where these mosquitoes called errors and violations breed. Unless we develop organizations measures to prevent breeding of these mosquitoes, we will never be able to prevent another event like #GermanWings 9525!

It is very unfortunate that the EASA Task Force has failed to deliver any meaningful recommendation. One did not need a task force to arrive at the very basic and on-the-surface kind of recommendations that have emerged here. We all knew this within days of the accident. What one expected from a task force of this level was a more professional risk assessment and recommendations in tune with the complexity of the problem. The task force needed to go into the depth of this problem and emerge with recommendations with far reaching impact on safety of civil aviation. It needed to develop organizational policies and procedures for dealing with distressed employees and those that need help, in addition to a complete relook and revamp of how we secure our cockpits.

Once again, it has been forgotten that at the end of the day, pilots are as human as rest of us and susceptible to as many human problems and issues as the rest of us. Any human can be regulated only to a certain extent. There is a limit to the amount of stress and regulation that can be piled onto a specific job role. The Pilots are the goal keepers of the Aviation industry…and a goal keeper can only save so much if rest of the team does not support the aim of winning the match!

An opportunity has been missed, and yet another accident, similar to #GermanWings remains waiting…“Waiting…To Happen!”.

Stay Safe,

The Erring Human.

Life After #Germanwings 4U9525: Lessons in Risk Management

A memorial service was held on Friday, at Cologne Cathedral, for the 150 people who died an untimely death when #Germanwings 9525 crashed. The comment by one of the mourners set my mind racing on a tangent.

A relative of one of the victims remarked, “To know that this was a murder and not an accident, makes our grief even more. The question that now comes to my mind is WHY?” It was further reported that parents of 27 year old Late Mr. Andreas Lubitz, who appears to have to deliberately locked the captain out of the cockpit and taken control of the plane so that he could crash it, had been invited to the service but did not come. The couple have not spoken publicly since the crash and are trying to mourn the loss of their son in dignified isolation and silence, no doubt tormented by the events.

These two news items highlight everything that the French investigators are to blame for in their extremely unprofessional conduct of making public statements before all the facts were collected, all the evidence analysed and even before any nature of professional investigation had gotten underway! While loss of a loved one in an accident has an element of grief, but one can accept such event as fate. However, when it is told that it was not an accident, but a murder, the grief takes-on a very different connotation, and not just for the victims’ families! This is the reason why it is all the more important to deal with these matters very sensitively, confidentially and methodically. All available evidence needs to be collected, analysed scientifically with latest techniques of forensic science. The possibilities that emerge then need to be tested through simulations to close the gaps and evaluate the alternate scenarios. Only then can the investigators arrive at the most likely event scenario. In all this, it is very important to remember the basic principles of any investigation, as well as natural justice: Evidence must be weighed, not counted; and every individual is innocent unless proved guilty.

The French investigators have violated both these basics of accident investigation. Weight of evidence of “human breathing” heard in the CVR tapes is far heavier than weight of evidence of manual input to controls. In a normal CVR recording, it is not possible to hear a pilot breathing and if this sound can be heard, it is a clear indication that the individual was not in normal state of health…clearly breathing hard and heavy…like in a “Panic Attack”, for instance! There have been further statements in the press, attributed to the French Prosecutor, that report him stating, “Pilot tried to break the door using an Axe”! I hope that he has been misquoted on this one, because anyone who has ever flown in a commercial airliner in recent years would know that there are no Axe’s available inside a commercial airliner today! Even if we assume that one was available, how can this conclusion be reached merely from hearing sounds recorded in a CVR tape?

Clearly, public statements have been made here without properly analysing and processing the available evidence. This projects the BEA and the French Prosecutor in very poor light, because they have through this action caused immeasurable and unnecessary avoidable pain to over 150 families!

That being said, one cannot escape the fact that at the centre of this controversy is the armed cockpit door. I had stated, in one of my earlier posts in this blog that in today’s world there are rarely any new accidents. Almost every Accident has happened before, and for the same reasons.

The case in point is Ethiopian Airlines Boeing 767-300 that was en route from Addis Ababa to Rome operating as Flight ET702 on Feb. 14, 2014. At one point during cruise, the captain left the cockpit to use the lavatory. The first officer did not allow him back inside and hijacked the aircraft. At this point he could have done anything with the airliner. He could have crashed the 767 into a crowded square in London, Paris or Berlin. Instead, he decided to fly wide circles over Geneva and finally land there to request political asylum. No injuries. The world forgot. The debate on cockpit security procedures should have happened then. However, there was no blood, so no one thought it important to take any further action. The safety process loop was not fed…

Cockpit doors were provided with armed security after 9/11 incidents. This was a mitigation measure to reduce the risk of a hijack to ALARP…the yellow or the green region in the inverted triangle above. However, this mitigation measure did create an additional risk…that of keeping the good guys out as well! While the American regulator developed a further mitigation by regulating that two crewmembers must always be present in the cockpit, the European regulators did not do so…and this was not updated even after the February 2014 incident that highlighted the need for a further mitigation strategy here. Therefore, while one can go to eternity blaming a suicidal pilot, the fact remains that a regulatory lapse allowed this to happen. A regulatory lapse that was not corrected even when highlighted by another similar event over one year ago. The essential continued to remain invisible!

The job of safety risk management needs to happen at the base of this iceberg…in the region of 1000-4000 latent conditions that exist for every 1-5 fatal accidents. The latent condition was highlighted through the event of February 2014 and missed, causing the conditions to remain favourable for the Germanwings accident to occur! In the game of safety risk management, there are no runners-ups. Either we win or we lose. Yes, Flight 9525 ended in tragedy and ET702 did not. They are vastly different in public perception and attention, but in both cases one of the pilots managed to take control of the aircraft because a decade earlier, secure cockpit doors were introduced that cannot be opened against the will of the person left in the cockpit. This is why it is so important to design a system properly and professionally as per the flow chart below.

This is the one discussion the industry and regulators should have had more than a year ago, or after the Nov. 13, 2013, crash of a Lineas Aereas de Mocambique Embraer 190 that was in all likelihood caused by the captain committing suicide: 33 people died. That the debate did not happen back then is cynical, but now that it is taking place the danger is that wrong conclusions will be drawn.

Some press reports are debating if the secure cockpit doors should be relinquished. This, in my opinion, is nonsense. There are still valid reasons for the cockpit to be a protected space; the threat from terrorists trying to use aircraft as weapons does not seem to have decreased over the past decade.

It took European regulators mere three days to decide that a minimum of two people have to be in the cockpit at all times, effective immediately, with no serious discussion. While there are no obvious drawbacks to the new occupancy rule, its advantages are even less obvious than at first sight. Would a flight attendant really stop a pilot committed to intentionally crashing an aircraft? Probably not. Could a committed flight attendant with access to knives in the galley be a potential safety threat to the pilot left in the cockpit? I believe that yes, this is possible.

The moves are clearly based on rushed judgments made under enormous public pressure. It would have been much better to slowdown, evaluate, debate and then decide professionally in a cool headed manner when emotions are no longer the guiding factor!

The most important thing this industry needs to look at is whether cockpits should continue to be so secure that they cannot be entered even under reasonable circumstances. Right now, the pilot remaining in the cockpit can prevent door from opening even when the emergency code is entered on the keypad outside, the idea being that a hijacker might force a flight attendant to reveal the code to gain access. When secure doors were introduced after the 9/11 terrorist attacks, the possibility of a rouge, or disabled, pilot in the cockpit was not considered. It was taken for granted that pilots would never do something like that, or suffer from any affliction preventing him from opening the door. Today we know that the assumption was wrong.

There is also a reason to doubt if the Captain indeed knew the emergency access code. For this, it is important to look at the pre-flight briefing procedures, and the culture, at Germanwings to understand how seriously this matter was being dealt on a day-to-day basis. At this time, there seems to be no evidence that the Captain indeed tried to seek entry using his emergency access code, and more importantly, there is also no evidence that the Co-pilot prevented him from entering!

However, one still needs to put things into perspective. There have been a handful of events that can be linked to pilots intentionally crashing aircraft. However, in the broader debate about how we perceive and accommodate mental health issues, in particular depression, in the workplace,  The DSM-IV criteria say that a Major Depressive Disorder or Depressive Episode may be present where a patient exhibits a majority of these symptoms every day:

• Depressed mood or irritable most of the day, nearly every day, as indicated by either subjective report (e.g., feels sad or empty) or observation made by others (e.g., appears tearful).
• Decreased interest or pleasure in most activities, most of each day
• Significant weight change (5%) or change in appetite
• Change in sleep: Insomnia or hypersomnia
• Change in activity: Psychomotor agitation or retardation
• Fatigue or loss of energy
• Guilt/worthlessness: Feelings of worthlessness or excessive or inappropriate guilt
• Concentration: diminished ability to think or concentrate, or more indecisiveness
• Suicidality: Thoughts of death or suicide, or has suicide plan

We see here that “suicidality” is only one symptom of a severe depressive condition and indeed, may be the least common. It is notable that the condition is not typically marked by signs of outwardly turned hostility or violence. Indeed, depression is more an emotional implosion than explosion.

In the noise erupting around Germanwings, we must remember two simple facts: depression does not normally lead to suicide and suicide almost never leads to murder.

Therefore, in this emotionally charged debate on how to keep suicidal pilots out of our cockpits, it is important to note that we do not yet have all the facts. A known devil, it is said, is better than an unknown God! Any decision taken in the heat of this emotionally charged environment without proper and complete scientific process will have consequences in the future. It is not enough to do something…it is important to do the RIGHT thing. The right thing here is to wait for the complete evidence to be available. For it to be scientifically processed and weighed. For the residual or new risks generated out of every proposed mitigation measure to be analysed too, and properly mitigated. Only then will we be in a position to take a correct decision that will prove its worth over a long period of time.

Stay Safe,

The Erring Human.

Rest in Peace Paolo

Photo courtesy Captain Mohan Ranganathan

It is with a very heavy heart that I am writing this post today. My mentor and friend, Paolo Pettinaroli left us for his heavenly abode on Saturday. Paolo was a great leader and a man of exceptional talents. He touched the lives of everyone in more ways than any other. He has been instrumental for the Aviation Industry's focus on Passenger Rights and for the recent regulatory initiatives in that direction. He has made the Italian Aviation Industry what it is today...a proactive and safety conscious industry that cares for its passengers.

Paolo touched my life very deeply. He was a source of great inspiration and motivation. For the first time in my life, words that have always been my best friends, escape me in expressing my feelings.

Rest in peace Paolo. Great men like you do not die...they merely fade away! The spark you ignited is today a flame and we shall not let this fame go out. The work you started is only half done and none of us will rest until the job is complete.

Adieu,

The Erring Human