Some scholars play a critical role in founding a whole field of study: Sigmund Freud, in psychology. Noam Chomsky, in linguistics. Albert Einstein, in modern physics. In the field of safety, Dr. James Reason has played such a role. In this field, no single name is better known.
Dr. Reason turns 80 today, and if you’re reading this, it’s possible that you owe your life to his ideas.
NTSB reports have frequently cited Dr. Reason’s work, and I personally quote him liberally in my talks to industry and safety stakeholders.
His contributions to safety have been influential not only in transportation and workplace safety, but also in fields as varied as healthcare, nuclear power, and fraud prevention.
His books include Human Error; Organizational Accidents; Managing the Risks of Organizational Accidents; Organizational Accidents Revisited; The Human Contribution: Unsafe Acts, Accidents, and Heroic Recoveries; and A Life in Error: From Little Slips to Big Disasters.
He views safety as a system, and accidents as the result of any individual’s mistakes in combination with other failings in the system. People are fallible, but that doesn’t make accidents inevitable.
Focusing on a safer system, instead of only an individual’s mistakes, can help diminish individual error (for example, through better training and procedures). More importantly, studying the system reveals much more of “what went wrong” – and will go wrong again if not corrected, because other individuals will make mistakes.
Dr. Reason came up with a handy analogy for his view, called the “Swiss Cheese Model of Accident Causation.” (Just say “Swiss Cheese Model” to a safety or risk management professional, and they’ll probably nod knowingly.)
In this model, layers of protection against an accident, each of which has weaknesses, are visualized as slices of cheese riddled with holes. An accident occurs when the weaknesses, or holes, align.
We’re all living in the Age of Reason. It’s a good age in which to live, one during which accidental deaths and injuries have been on the decline.
The continuous improvement of safety depends on safety professionals living with what Dr. Reason called a “chronic unease.” The paradox of safety is that the moment we think we’ve arrived, we introduce another hazard: complacency.
However, even in the chronically uneasy profession of safety, we find cause to celebrate every now and then. So, on that note, Happy 80th birthday to Professor Emeritus James Reason, on behalf of safety professionals everywhere—and on behalf of all those he’s saved, from every walk of life.
On July 17, 1996, about 12 minutes after takeoff from John F. Kennedy International Airport, New York, Trans World Airlines (TWA) flight 800 (TWA-800), a Boeing 747-131, crashed in the Atlantic Ocean near East Moriches, New York. The accident killed all 230 people on board, and the airplane was destroyed. The NTSB’s investigation of this accident was the most extensive, complex, and costly air disaster investigation in US history, and was the subject of high public interest and front-page headlines for years.
On August 23, 2000, a little more than 4 years after the crash, the NTSB determined the probable cause to be an explosion of the center wing fuel tank (CWT), resulting from ignition of the flammable fuel/air mixture in the tank. Because multiple potential sources were identified, the singular source of ignition for the explosion could not be determined with certainty, but the likely source was a short circuit outside of the CWT that allowed excessive voltage to enter the vapor-laden fuel tank through the fuel-quantity–indicating system in the CWT.
On December 13, 1996, while the investigation was still ongoing, the NTSB issued the first of three sets of safety recommendations to the FAA. We based these initial recommendations on early findings of the investigation to address the threat of a fuel tank exploding on an airliner. Two recommendations included the development of design or operational changes to prevent explosive fuel-air mixtures in the fuel tanks—including the development of nitrogen-inerting systems. A nitrogen-inerting system replaces the air in an empty fuel tank with nitrogen, creating an environment in which neither a fire nor an explosion can occur. A total revision to FAA regulations for wiring and maintenance, including those of fuel-quantity–indicating systems, also resulted from our findings in this accident investigation.
The FAA’s initial response to our inerting recommendations was to convene a group of industry experts, who found that the costs of implementing the recommendations was too high to be practical. We disagreed and urged the FAA to consider other options. The FAA tried again, tinkering around the edges of the problem, focusing on the wiring and electrical systems in aging aircraft. We welcomed these improvements but reiterated that the agency was ignoring the core issue—the hazard posed by potentially explosive aircraft fuel tanks. To its credit, the FAA chose to apply some “out of the box” thinking, and, together with Boeing, developed a system on the airplane to address the threat.
That innovative technology, called a molecular sieve, separates air into nitrogen and oxygen, the two primary gases. The oxygen is vented overboard while the nitrogen is used to inert the fuel tank. The FAA performed in-depth analysis of the technology, and Boeing produced several prototype systems for testing and evaluation. These tests showed the system to be effective, have minimal operational challenges, and to be reasonably priced. Boeing began installing these systems on some of the new airplanes it was producing.
On November 23, 2005, the FAA proposed a new regulation that required newly manufactured and in-service airliners to reduce the chances of a catastrophic fuel-tank explosion. A final rule was enacted by in 2008, and 100 percent compliance with the rule became mandatory on December 26th of 2017—21 years after the NTSB first recommended fuel-tank inerting to the FAA.
The enactment of the fuel-tank flammability rule is a major safety improvement, addressing a critical safety problem at the heart of many aviation accidents over 45 years. However, its enactment was clearly far from easy; it took the persistent advocacy of the NTSB and the efforts of FAA and Boeing staff unsatisfied with cursory cost-benefit analyses. It took the commitment of senior management at the FAA and DOT—including the Director of the Certification Service, Associate Administrator of Safety, the FAA Administrator, and the Secretary of Transportation—to implement this needed safety regulation.
The traveling public is safer today because these organizations, working together, refused to take “no” for an answer.
March is Women’s History Month, so it’s only appropriate to look at some of the American women who have helped influence and shape today’s transportation system, including those working at the NTSB today.
We have witnessed the extraordinary accomplishments of women like Bessica Raiche, the first female pilot in the United States to make a planned flight, and our very own Member Bella Dinh-Zarr, the first Asian American to become a Board Member at the NTSB. Member Dinh-Zarr has spent years advocating for and promoting safe and sustainable transportation. These women have reached great heights in their careers and are renowned nationwide for their successes.
Yet, there are many more women—perhaps not as nationally known but just as important to the NTSB’s critical mission—that we would like to recognize. In celebration of Women’s History Month, we recently sat down with some of the exceptional women who have emerged from the NTSB’s ranks to become leaders in management and safety. They inspire staff every day to work hard to improve transportation safety, sharing NTSB safety messages and encouraging us all to remember our mission to save lives. They are role models for many at the agency—men and women. We asked them to share their thoughts on leadership with staff last week at a special briefing, and we think their lessons are beneficial to all, even those outside our organization. Here’s what they had to say.
Dana Schulze is the deputy director of the NTSB’s Aviation Safety (AS) Office. As second-in-command of AS, she oversees all aviation accident and incident investigations in the United States and those involving US products or operations overseas. More than 50 air safety investigators and supporting staff within AS report directly to her. She approves information AS releases and routinely briefs Congressional staff and industry stakeholders on behalf of our agency. She began her career in the aircraft manufacturing industry as a mechanical engineer and has experience developing, manufacturing, and conducting failure investigations involving aircraft systems. From there, she rose through the NTSB ranks to her current position. She attributes her success to a continuous learning approach and her interest in improving aviation safety. Because of her critical-thinking skills and ability to lead others, she quickly rose to a leadership position at the agency.
According to Schulze, she did not initially set out to join management, but when the opportunity was offered, she recognized that she could add value and be a good fit. She believes a leader should be able to inspire and motivate others. Through integrity, consistency, and transparency, a leader “can instill a balance of vision and practicality,” she says. She says she has been inspired by thought leaders such as Steven Covey. Transportation has long been a male-dominated industry, and Schulze encourages women to get involved with transportation-related STEM programs that interest them, even those outside their comfort zones.
Sharon Bryson is the NTSB’s deputy managing director. She joined the agency more than 20 years ago after a career providing services to military families at Dover Air Force Base. When she arrived at the NTSB, the agency had just been given the responsibility for family assistance by Congress. Bryson took a lead role in setting up the NTSB’s first family assistance program. This program, now called Transportation Disaster Assistance, is still in place today and has served thousands of families over the years. Later, after serving as director of the Office of Safety Recommendations and Communications, Bryson became the agency’s deputy managing director, a position that involves assisting the Managing Director with managing the day-to-day activities of the agency.
According to Bryson, having the opportunity to mentor others and share what she has learned about leadership is very important to her. She strives daily to engage with staff members and actively highlights their individual abilities, with the goal of seeing them thrive. “A leader is supposed to support and guide,” she says. By recognizing the strengths and weaknesses of the people around her, she puts value in their diverse opinions; there is no room for judgement or negativity. “When all of these are combined, it creates an environment where people feel engaged and encouraged,” she says.
Shannon Bennett came to the NTSB’s Office of General Counsel in June 2010 before becoming an advisory and special assistant to Board Member Dinh-Zarr in June 2015. She comes from a long military history, having enlisted in 1993 as an Air Force ROTC cadet during college, then serving 11 years on active duty as a judge advocate. She continued to serve in the Air Force Reserve and was assigned as a judge advocate in the Office of The Judge Advocate General at the Pentagon. According to Bennett, when she separated from active duty in 2010, she wanted to find a job where, as in the Air Force, she felt that she was serving her country and making a difference in people’s lives. That’s how she wound up at NTSB.
Leadership is “the art of influencing and directing people to accomplish the mission,” Bennett says, quoting the Air Force Pamphlet on Leadership she received as an ROTC cadet. She tries to live by the adage “saw the log in front of you,” meaning, do your very best in every job that’s given to you no matter how big or small, rather than seek the glory of a job you don’t have. Mentoring is also very important to her, and she encourages all leaders to guide others.
As we celebrate Women’s History Month, let’s all take the time to look around us and celebrate the unique and powerful women in our own lives. We are so grateful to have Dana, Sharon, and Shannon as members of our “Women Dream Team,” as well as all the other female employees at the agency who work daily to improve transportation safety and inspire those around them.
We launched Safety Compass in March 2011 to provide you an inside-out view of the investigative and advocacy efforts we’re engaged in and the important safety issues we’re focused on. As we close out 2017, we want to say “thank you” to you, our readers. Thank you for your interest in the work we do and for sharing our safety messages and recommendations for improving transportation safety.
From teens and sleep to drones, autonomous vehicles to our investigative processes, we’ve given you an inside look at the NTSB and highlighted our comprehensive approach to improving transportation safety across all modes and for all people.
To wrap up the year, here’s a list of some of our most popular blogs of 2017:
Last month, we released data revealing that 2,030 more people died in transportation accidents in 2016 than in 2015. Of those fatalities, 95 percent occurred on the nation’s roadways. Many of those deaths were completely preventable! As we approach 2018, we call on each of you to help us reverse the trend of increasing transportation fatalities, especially on our roadways. Continue to read our blog, see the lessons we’ve learned through our investigations, and share the safety recommendations we’ve made to prevent transportation accidents and crashes, deaths, and injuries.
We encourage you to keep up not only with our blogs, but with other NTSB materials. Sign up to be on our Constant Contact list. Follow us on Facebook (@NTSBgov), Instagram (@NTSBgov), LinkedIn (@NTSB), and Twitter (@NTSB). And in case you missed it, we launched a podcast in 2017, too! Check out Behind-the-Scene @NTSB wherever you get your podcasts. If you’d like to suggest a blog topic, e-mail SafetyAdvocacy@ntsb.gov.
As 2017 comes to an end, we again extend our gratitude to you for working with us to improve transportation safety. We wish you safe travels this holiday season and in 2018.
Rumor has it that, just before the December 15, 1967, collapse of the US Highway 35 Bridge in Point Pleasant, West Virginia, a 7-foot-tall monster with large, piercing red eyes and huge, mothlike wings was seen lurking nearby, warning of the impending catastrophe. This “Mothman” was soon blamed for the tragedy in which 46 people died and 9 were injured. Of the 37 vehicles on the bridge at the time of the collapse, 31 fell with it, many plunging into the Ohio River. Fifty years after the collapse of what was then known as the Silver Bridge, paranormal speculation still swirls around the event, perpetuated by movies (like the Mothman Prophecies), legends, and myths. As a civil engineer, though, I put my trust in the laws of physics, materials science, and the findings of the NTSB investigation completed five decades ago, which proved without a doubt that the Mothman wasn’t to blame.
The Silver Bridge collapse was the first significant highway accident investigation in NTSB history. Working with experts from the Federal Highway Administration, the states of West Virginia and Ohio, and leading engineering consulting firms, we determined conclusively that the cause of the collapse was an eyebar fracture in one of the bridge’s suspension chains. The fracture resulted from stress corrosion and corrosion fatigue that had developed over the bridge’s 40-year lifespan. Not surprisingly, no evidence was ever found connecting the Mothman to the failure.
This catastrophic event prompted national concern about the safety of bridges across the United States. President Lyndon B. Johnson ordered all US bridges to undergo safety inspections. Congressional hearings resulted in mandates requiring the US Department of Transportation to develop and implement National Bridge Inspection Standards. In December 1970, landmark legislation was enacted that established national requirements for bridge inspection and evaluation. One would think that these rigorous new inspection standards would take care of bridge failures forever. Unfortunately, during the past half century, that’s not been the case.
Other notable bridge failures we investigated in the late 1980s involved localized flooding and water scouring. One collapse occurred on April 1, 1989, near Covington, Tennessee, when two columns supporting three bridge spans collapsed, sending an 85‑foot section of the US Route 51 bridge 20 feet into the Hatchie River. Five vehicles fell with it, killing eight occupants. Again, our investigation identified deficiencies in the state authority’s bridge oversight. In response to our investigations of these events, additional requirements were developed for periodic underwater inspection of bridges.
Probably the most memorable bridge collapse we investigated occurred 10 years ago in Minneapolis, Minnesota, when a catastrophic failure occurred in the main span of the deck truss in the Interstate 35W highway bridge. As a result, 1,000 feet of the deck truss collapsed during rush hour, with about 456 feet of the main span falling into the river. A total of 111 vehicles were on the portion of the bridge that collapsed; 13 people died and 145 were injured. We determined that a design error in the gusset plates compromised the bridge’s load capacity, causing it to fail under substantial weight increases. Our investigation prompted the development of additional bridge quality assurance and improved bridge inspection requirements.
On December 15, as we mark the 50th anniversary of the Silver Bridge collapse, let’s focus on the infrastructure improvements we need still need to make five decades later rather than try to place the blame on mythical creatures like the Mothman. Throughout the NTSB’s history, we have investigated catastrophic bridge collapses with one goal in mind: preventing future tragedies. Despite efforts to continually enhance the quality of bridge inspections, unforeseen disasters continue to occur, highlighting the need to thoroughly inspect and replace bridges before they collapse. Supernatural forces do not bring down bridges; neglect does.
Don Karol is a Senior Highway Accident Investigator and National Resource Specialist in the NTSB Office of Highway Safety.
A car that is fully controlled by a computer doesn’t get drowsy or distracted. It doesn’t get drunk or impaired by other drugs. If it’s instructed not to go above the speed limit, it won’t. Human error, which is at least partly responsible for 94% of today’s highway crashes, can largely be eliminated if the human driver becomes just another passenger. And with the unacceptable carnage of more than 37,000 deaths in motor vehicle crashes in 2016 alone, we can use all the help we can get. There’s no question that the potential benefits of autonomous vehicles are nothing short of phenomenal.
Getting there, however, will not be as easy as many people think. We recently held a Board meeting to consider the crash in 2016 of a partially automated Tesla into a tractor‑trailer near Williston, Florida. The driver wasn’t paying attention to the road as he should’ve been, and the system allowed the driver to use its “Autopilot” feature in places where it wasn’t designed to operate. The automation system used torque on the steering wheel as a proxy for driver engagement and alerted the driver if too much time passed without detectable movement on the wheel, but the driver treated the alerts as nuisances, dutifully applying torque each time the alert sounded before taking his hands off the wheel again. Although the driver was ultimately responsible for the resulting crash in which he tragically lost his life, the automation allowed him to make unsafe choices.
Flash back to 1914. An airplane flies past reviewing stands full of spectators. The pilot holds his hands high in the air to demonstrate that the airplane is flying itself. The plane makes another pass, then another. According to aviation lore, by the third pass, the pilot, Lawrence Sperry, is walking on the wings. Sperry was showing off his entry in an international aviation safety exhibition: the world’s first primitive autopilot, the gyroscopic stabilizer. It allowed a plane to fly straight and level without pilot input for short periods at a time.
In the years since, aircraft automation has become much more sophisticated. In addition, planes now have systems that sense terrain, they use GPS to know where they are, and they employ a vehicle-to-vehicle technology called a traffic collision avoidance system to help them avoid other planes. Thanks, in large measure to these technologies, aviation has become much safer. Yet, in 2013, nearly 100 years after Sperry’s demonstration, Asiana Flight 214, with more than 300 people on board, approached San Francisco International Airport too low and too slow and crashed into a seawall, killing three passengers.
The Asiana crash demonstrated automation confusion: the pilot thought that the auto‑throttle was maintaining the speed he selected, but he had inadvertently and unknowingly caused the auto‑throttle to become inactive. It also demonstrated that, due to longstanding overreliance on the automation, the pilot’s manual flying skills had degraded so much that he was uneasy about landing the plane manually on a 2‑mile‑long runway (that’s a long runway!) on a beautiful, clear day.
We’ve investigated automation-related accidents in all modes of transportation. In fact, our investigators see accident after accident involving problems with the interface between the automation and the human operator; we also see far too often that humans are not reliable about passively monitoring automation. And in cases like the Asiana crash, we see that humans get rusty when they don’t use their skills.
The Williston crash showed error types that are not surprising with what’s called level 2 automation. The human driver was responsible for monitoring the environment, but the automation allowed him to shirk this responsibility. This result was foreseeable, given the unfortunate use of the moniker “Autopilot,” which may suggest to the ordinary driver that the car can fully control itself (as compared with pilots, who know that they must still be engaged even when their airplane is operating on autopilot). Thus, one lesson learned is that if the automation should only be usable in certain circumstances, it should be “geo-fenced” so that it will work only in those circumstances instead of depending on the driver to decide appropriately.
What can we expect as our cars move beyond level 2? The aviation experience has demonstrated that as automation increases, so do the challenges. As automation becomes more complicated, drivers are less likely to understand it, and as automation becomes more reliable, drivers will become more complacent, less skillful, and less vigilant to potential failures. As a result, if a failure occurs in a more complicated and reliable system, the likelihood increases that most drivers will not be able to recover successfully from the failure.
In the Asiana investigation, we found that the airline used the available automation as fully and as often as possible. After the crash, we recommended that the airline require more manual flying, both in training and in line operations—not because we’re against technology, but because we see what can happen when pilots lose their skills because they’re not using them.
Then there’s the question of removing the driver altogether. Airliners will have pilots for the foreseeable future because aviation experts have not yet developed a “graceful exit” regarding failure of the automation or what to do if it encounters unanticipated circumstances. Similarly, drivers will be in the picture until the industry develops a graceful exit for their automation failing or encountering unanticipated circumstances . . . and unanticipated circumstances are certainly abundant on our streets and highways.
In every one of our investigations, we study the human, the machine, and the environment. Even across modes, humans and their interactions with automation are a common denominator in an accident’s probable cause. For 50 years, we’ve been finding answers to help the transportation industry save lives, and when our recommendations are put into practice, the industry and the public generally realize safety benefits. We are excited about the opportunities to use the lessons we’ve learned over these many years to help the transportation industry move toward safer vehicles, regardless of who (or what) is operating them.
We’ve come a long way since Lawrence Sperry’s gyroscopic stabilizer, but as accidents like Asiana and Williston show, we’ve still got a way to go before automation can significantly reduce fatalities on our streets and highways. We look forward to continuing to work with vehicle manufacturers to help them develop safer and more reliable automated transportation.
I recently had the privilege of speaking in Manchester, England, at the National Safer Roads Partnerships Conference. The United Kingdom has some of the lowest road-user fatality rates in the world. While our annual vehicle miles traveled vary greatly, on a typical day, about 109 road users are killed on America’s roadways, while only 5 Britons lose their lives the same way. But, as I reminded the conference audience, even one fatality is still too many.
This was a unique opportunity to represent the NTSB because the audience was mainly British law enforcement officers, and the British tradition of “policing by consent” was tailor‑made for a prevention-focused discussion. Policing by consent means that, because most people want law and order, the goal should be to prevent crime rather than focus on punishing perpetrators. Our Safety Advocacy Division operates with much the same philosophy, working to prevent transportation accidents by encouraging stakeholders to implement the agency’s recommendations. We also explain road safety to vulnerable populations, such as young drivers, to bring lifesaving information to the traveling public, and we share our findings with colleagues.
We know that, as we face coming challenges in road safety, prevention opportunities abound. Our recent speeding study noted the value of a “safe system” approach, which depends on layers of safety in a given road environment and recognizes preventive uses of technology, such as automated speed enforcement. Our recent investigation into the fatal crash of a partially automated vehicle allowed us to consider the double-edged sword of automation. Our investigations have shown that, as vehicles rely more and more on automated sensors, they also collect more data, which should be gathered in a standard format and reported when vehicles with enabled control systems crash.
The world is changing, crash factors are changing, and our tools are changing. The data that cars themselves can provide about crashes is expanding. As I told the law enforcement officers in Manchester, the NTSB has learned that everything an accident can tell us is worth our attention. We are conscious that every safety lesson learned is worth retelling, both to spur acceptance of our recommendations and to prepare ourselves, our colleagues, and the public for the challenges of a fast-approaching future. By sharing lessons learned across borders, we improve our chances at reaching zero transportation fatalities worldwide.
Nicholas Worrell is Chief of the NTSB Safety Advocacy Division.