Sixty Years Safe
Fighter, airline and glider pilot Alan Munro looks back at sixty years of flight safety.
As I write this it is sixty years ago to the day that my ex-RAF instructor got out of the Tiger Moth saying, “one circuit lad, then pick me up here”. There was no radio at all at Fairoaks in 1959, so the signal to all that here was an idiot on his first solo was the instructor taking his cushion and standing with it on his head. The flying scholarship was massive fun; we worked hard at the PPL academics, but I really don’t remember anyone mentioning Safety at all. Yet no one crashed or even caught a finger hand- swinging (except for the mechanic swinging an EP9’s three-bladed prop for the first time), so how was it done?
When civil aviation started up again after the Second World War, the vast majority of pilots had been in military service, and we even had ex-national service instructors. All we had to understand was that Leadership and Airmanship solved most problems, and even in the 60s when I started to instruct, all lessons started with these two topics. You did as you were told, planned for the worst and hoped for the best. And, of course, we all knew that half the wartime fatalities were in accidents. Nobody except the widows, including my own mother, seemed to mind too much; it was the price of winning. When I was flying my Moth, the RAF was losing Meteors at a colossal rate; causing even Churchill to take note, but that was the unstated price of flying. I should add that the previous year on my cadet gliding course at Hornchurch, the approach was identical.
Your GASCo editor discovered that in those 60 years I had been an RAF Flight Safety Officer (Phantoms at Coningsby), then later an Airline FSO (the A320 with Excalibur if you can remember them) and finally as a gliding Club Safety Officer (Buckminster GC at Saltby). I was given little choice in the matter, but at least the airline paid a small amount for the extra work. I also ran a Quality and Safety business for some 15 years, the brief was to write about the differences between military, civil and gliding safety, and how things had changed over those 60 years. No pressure.
My first tour was flying the Javelin with 60 squadron at Tengah in Singapore. We certainly enjoyed strong leadership. There was little sympathy to be had if things went wrong, but we had a well-thought-out set of orders and procedures, and we were well trained in jungle and sea survival. The occasional aircraft did crash, and the crew sometimes died. We all went to the funeral and had a great party afterwards. Close ranks and carry on. The Navy, whose accident rate was worse than ours, summed it up in the ‘Sea Vixen Song’ – “Dust to Dust / Ashes to Ashes, / We all get pissed and another one crashes.” This was not so much a cavalier attitude as a coping mechanism. It was another form of survival, I think. Britain was still a strong proud nation, and we were its warrior caste.
Even when my navigator and I flew back to Singapore from Gong Kedahon the Thai border, the flight plan was never passed, our radio failed (we had an emergency back-up), and we ended up diverting into Paya Lebar (AKA Singapore Civil), under a stack of airliners and between two giant thunderstorms. Everyone thought it was hilarious. My nav’s only worry - quite rightly - was that the coconuts on the floor of his cockpit might explode as we climbed to cross an airway at 46,000ft.
After WW2, there were a vast number of small air operators, generally flying surplus aircraft with ex-service pilots. The Dragon Rapide, the Anson and the Dakota were favourites. There were many accidents, some from poor maintenance and others from trying to set up a new, inadequately- regulated industry in British weather. The pilot usually got the blame, but aircraft were comparatively easy to repair. The Chicago Convention and ICAO were new concepts as governments tried with varying success to regulate this exciting new industry. My mother worked in the Ministry of Civil Aviation at the time, and I remember her saying that accidents were simply the price of commercial flying.
In fact, Ernst Gann describes in ‘Fate is the Hunter’ how he arrived at the West Coast of South America with little fuel in a Lockheed Lodestar. If he turned the right way there would be an airfield, and the wrong way would bring certain death. He got it right, but it made the point that Safety was – at times – literally a 50/50 bet. Possibly the first airliner accident that really impacted on public consciousness in the UK was the Airspeed Ambassador crash at a snow-covered Munich Airport in 1958 while carrying the victorious ‘Busby Babes’ home from Belgrade. More than half of the passengers were killed. The cause (an underpowered aircraft trying to take off from an inadequately cleared slush-covered runway) was overlooked in favour of the perennial ‘Pilot Error’ (failing to clear ice off the wings) although the Captain was exonerated ten years later. Every advance in airliner capability brings new previously unknown problems; for example, the Comet losses, the B727 flying into Mt Teide in Tenerife and the A330 diving into the South Atlantic. Each of these accidents was the result of a major technical advance bringing unknown hazards.
More than fifty years ago D P Davies, Chief Test Pilot of the UK Air Registration Board, wrote Handling the Big Jets. In this seminal work, he suggested that in the future airline pilots should have access to simple aerobatic aircraft to maintain handling skills, with a raw instrument flight once every six months in something like an HS125. It’s never happened, (with the honourable exception of South African Airways while they still had Harvards), and although the excellence of modern simulators is great for honing a pilot’s instrument skills, do many airlines let their pilots fly ‘raw data’ (even in the sim) or is the emphasis on correct use of the automatics?
In the air defence business, we used to regard the ground as the only weapon with a 100% kill probability. You must, at some stage, learn fear.
What of General Aviation and especially Gliding? Initially, GA aircraft were comparatively simple wood and fabric structures, not cheap to build but affordable to repair. The Safety record culture was really not too different. A local gliding club used a reverse auto tow around a pulley and had three fatalities after the wire broke. Even at my cadet gliding school, spin training in the T-31 was started at 900ft AGL, because that was as high as the winch could take you. These days you’d never initiate a spin that low, but a K-21 is a very different machine from a T-21.
Even in the seventies risks could be taken that would be unacceptable and possibly illegal today. In 1970, we started night flying at Shobdon with flares made from gallon paint tins half full of sand and a few pints of diesel. When a student pilot was overdue after dithering on his land away cross country, we got him back in the dark, on this occasion with car lights providing the flare path this time. Gliders were difficult to rig; mistakes were made and accidents were all too common.
Really, for the first half of the last 60 years, attitudes to Safety changed little, while design, training, operations and regulation all improved dramatically. In the 90s, however, the RAF suffered the Nimrod R1 ditching in the Moray Firth, which moved fear of death to fear of career, and in the civil world JAR-OPS arrived, along with detailed studies of the human factors involved. I never heard human factors mentioned as such until I joined Excalibur. It focussed on the Mount Teide B727 and seemed to be an overstatement of the obvious.
However, in 1994 we had an incident where some rushed, unscheduled servicing, (a slat replacement), almost caused an accident. A spoiler popped out in flight and the pilot very nearly lost control getting the aircraft back into Gatwick. The AAIB ruled that it was an engineering error, but behind that lay a chain of management mistakes, including Airbus design and training. It was acknowledged that pretty well everyone goes to work intending to do a good job and that negligence is very rare. It clearly identified the accident chain so that behind the traditional pilot or engineer error, there was a whole line of failures leading to the inevitable accident trigger. The engineer was fined but kept his job.
In 1997 Professor James Reason, Professor of Psychology at Manchester University, wrote his game-changing book called ‘Managing the Risks of Organisational Accidents’. From this came the now famous ‘Swiss Cheese’ model in which a hazard comes up against layers of defences (for example training, equipment, procedures). If it manages to get through these, there is a consequent loss. The layers were then compared to a Swiss cheese, and you don’t always know where the holes are. It’s when the holes line up that the hazard gets through and the accident or loss happens. This is now so well accepted by many that at Saltby it’s not unusual that when pressure starts to back up someone will say something like “Hold it. The holes in the cheese are starting to line up”. Yes, it’s valid for all flying machines, be it a B747, a C152 or an F-35.
The introduction of JAR-OPS scared the airlines badly with its Quality System, actually a form of self-regulation by which the operator had to keep checking its own processes and doing something about measured failures. This was a dramatic shift from management being told by the CAA Inspector what to do. It was inevitably linked in to ISO 9001, the Quality standard by which the operator would inevitably have to look at areas like the control of the sub-contractor, while all the regulator needed to see was regulatory compliance. This led to untold arguments about Quality versus Safety when in fact both are critical business processes for an operator. The engineers were quite unfazed by it all, and the certificatory authority congratulated us on finally catching up. Some operators did indeed use the new disciplines for business enhancement, especially amongst the low- cost operators, and the results show to this day.
Compliance and Self-regulation found their way into all parts of EASA, and the MoD mirrored this with the creation of its Military Aviation Authority. In fact, the RAF has moved to a Safety Centre, I quote:
“A safety organisation which delivers effective Total Safety Management and leads on intelligent application of critical thinking. To provide independent assurance of the RAF Safety Management System underpinning CAS’ commitment to Total Safety in order to maximise the delivery of RAF capability.”
The RAF has boldly gone where civil aviation has just fallen short, combining all aspects of Safety. Health and Safety? No problem. It’s just another key business process to be managed. I just hope that Leadership and Airmanship have not been forgotten.
Safety management has percolated down through commercial aviation into GA. Accountability is achieved though specified management positions, usually approved by the CAA. Even at flying club level, it is pretty well understood that when something is discovered to have gone wrong, there are three courses of action.
?Do nothing. When the cost of the cure overwhelms the cost of the loss;
?Remedial Action. The ‘Band-Aid’ solution to get by for now;
?Corrective Action. To remove the root cause of the problem.
There is a fourth though, the goal of all safety departments, right down to the Gliding Club Safety Officer. Preventive action is taken when we have evidence from auditing, incident reports and regulatory oversight, that it would be pound foolish not to take some form of prophylactic action. At Saltby we recently spent a fortune on our EuroFox, when there were subtle indications that the engine was sub-optimum. A loss of power at low-level while towing a glider could cause a nasty accident, so although the engine was still within its Time Before Overhaul the club changed it anyway.
The BGA, along with the LAA, the British Microlight Aircraft Association and others are at the bottom of the regulatory stack. The BGA, however, has taken upon itself to be the Air Operator in EASA terms, with the key nominated posts of accountability and responsibility (Accountable Manager and Post holders for Maintenance, Training and Operations, along with a Quality Manager). However, while each club in regulatory terms is an integral part of the BGA, the Chairman is automatically Post holder Club. That’s where it gets interesting.
The Club managers, like all other GA clubs, now have a statuary responsibility for a safe operation. The BGA does a great job pushing risk awareness and risk avoidance into the clubs but I hear too many CFIs and Club Safety Officers saying that their own Management doesn’t really understand. At Saltby I enjoy fantastic support from our Chairman and Board, but on the other hand I use all the tools at my disposal, including a mini safety management system, to present a Safety Action Plan to every Board meeting. We have records of management actions on safety going back nearly five years now so that we can demonstrate that risk is As Low as Reasonably Practicable (ALARP). If there’s a weakness it may be the fierce independence of the average glider pilot not caring for too much oversight.
What else has changed? I suppose that in the gliding world the iron hand of the insurance companies is not far away. The cost and frequency of glider repairs have rocketed to the point where the very sport is threatened. We must do better to bring these costs down.
Have I answered the task? ‘What are the safety differences and similarities between the disciplines, and what’s changed over the years?’ I hope so. The unasked question must be ‘What have I learned?’ Put simply it’s that “you don’t know what you don’t know”. It took a while to find that out, but that’s what modern safety is all about, working out what you don’t know and then doing something about it before the holes in the cheese line up.