Sunday, June 17, 2012

How Many Fatalities Does CASARA Need to Learn A Lesson?

In a previous post I shared with you a quote from a member of CASARA who thought that regularly finding the beacon on training flights meant that what ever techniques were used must be OK. Here is that part again:
This would suggest that from a practical point of view, what we are doing is okay, or we would have been told to stop. In the meantime we continue to be successful in locating ELTs using these techniques and procedures.
And that is great, but it doesn't prove the techniques they're using are sound. To understand that we will have to delve into some safety theory.

Risk Assessment Matrix

For more in depth reading on this I recommend Risk Management in the Process Industries.

In safety analysis we try to asses risk, not just in terms of the likelihood of something bad happening, but also in terms of the severity of the consequences. This leads us to consider two independent variables: consequences or severity, and frequency. Consequences or severity may be assessed in terms of the impact on people, to the environment, economic impact, or any other factor important to the enterprise. In Table 1 below we have some examples of consequences of varying severity:

Table 1

LowNoneLimited or easily corrected<$10,000
ModerateMinor InjuryReportable, remedial action needed$10,000 to $100,000
SevereHospitalization or serious injuryIrreversible damage$100,000 to $1 Million
Very SevereFatality or multiple serious injuriesIrreversible damage to environmentally sensitive area> $1 million

The frequency or likelihood of the risk could be assessed according to Table 2:

Table 2

Low< 1 in 1000 yearsVirtually impossible
Moderate1 in 100 to 1 in 1000 yearsConceivable, may not have happened locally, but may have somewhere in the world
High1 in 10 to 1 in 100 years"Once in a lifetime"
Very High> 1 in 10 yearsLikely to have happened or happen soon

By combining severity and likelihood in one table we construct a risk assessment matrix like Table 3. The selection of terms, and their corresponding values will depend on the type of enterprise. Each cell in the matrix is colour coded to indicate the level of risk, low to high, acceptable to unacceptable, or some other appropriate risk assessment.

Table 3

LowModerateSevereVery Severe



Very High

The image below is published by the Federal Aviation Administration divides risk into acceptable, acceptable with mitigation and unacceptable.

It may help to consider some case studies.

Driving While Under the Influence

Driving while under the influence, also known as DWI or drunk driving, is universally understood to be a dangerous undertaking. If a person does decide to drive while intoxicated the consequences vary from none (they make it home without mishap), to very severe as described in Table 4:

Table 4

NoneThe driver arrives at the destination without mishap
ModerateRoadside suspension, minor property damage. Criminal charges
SevereSerious property damage or injury to persons. Criminal charges
Very SevereFatality or multiple serious injuries. Serious criminal charges

Assessing frequency is not quite so easy. Should we asses the frequency from the point of view of a habitual drunk driver? If we do the most frequent outcome may well be no consequences because the driver is able to drive home each time he drinks without having an accident or being stopped. Still, the spectre of a severe or very severe outcome still hangs over his head, even if may only happen once in a lifetime. If we asses frequency from the point of view of society we arrive at a similar conclusion though by a different route. Every day many hundreds, if not thousands of people might drink and drive. We only hear about consequences infrequently, but the consequences we do hear about are severe or very severe. So with infrequent but severe consequences, driving while under the influence is clearly a high risk or unacceptable activity. Not surprising considering the penalties society imposes on those who are caught and convicted.

An appropriate risk assessment matrix for Drunk Driving might look like this:

LowModerateSevereVery Severe



Very High


Continued Visual Flight into Instrument Conditions

In aviation pilots can maintain control of, and navigate the aircraft by visual reference to the surface of the Earth, or by reference to aircraft instruments. There are rules which govern each type of flying, and what weather (meteorological) conditions are acceptable. The rules governing visual flight are Visual Flight Rules, abbreviated VFR, those governing instrument flight are Instrument Flight Rules or IFR. The weather needed to be able to fly under VFR is called Visual Meteorological Conditions, abbreviated VMC; and weather conditions that require one to fly under IFR are called Instrument Meteorological Conditions or IMC.  When a pilot who is only certified for VFR flight flies into IMC regulators and investigators call that continued VFR into IMC. In. 2010 the Transportation Safety Board of Canada called this the number one cause of fatal accidents in VFR flight. In 2008 a CASARA pilot was killed when he flew VFR into fog, IMC and crashed.

Just like drunk driving there are regulations that prohibit pilots who lack the qualifications from flying in instrument conditions. Also like drunk driving, every year many pilots with only VFR qualifications, either accidentally, through negligence, or on purpose fly into IMC. And just like drunk driving most of those pilots reach their destinations. Never the less, because the potential consequences are very severe, continued VFR into IMC is an unacceptable risk.

CASARA lost a pilot in 2008 to what appears to have been continued VFR into IMC. In this case a fatality does not seem to have been enough for this lesson to be learned. Of the five continued VFR into IMC cases I was called on to deal with as a safety officer in CASARA, one was after the tragic loss of Herluf Nielsen.

On September 22, 2010 the Transportation Safety Board of Canada issued a press release on the subject of continued VFR into IMC and dispatch pressure causing controlled flight into terrain. They cite the final report into a 2008 accident that claimed 7 lives on Thormanby Island, BC.

How would you construct a risk assessment matrix for continued VFR into IMC?


Hand Propping

Some models of airplane are equipped with engines that don't have electric starters. Occasionally pilots attempt to start an engine only to find the battery is dead. Airplane engines can often be started by a procedure called hand propping which is similar to starting a small gasoline lawn mower. Instead of pulling on a starting cord, the engine is started by swinging the propeller by hand. It doesn't take much thinking to realize the potential hazards involved. If successful, the pilot ends up standing  very close to a running engine turning a propeller at a speed, even at idle, sufficient to cause serious or even fatal injuries. This is one of the cases where the FAA risk matrix area "acceptable with mitigation" comes in. The mitigation in this case is proper starting technique, and ensuring the airplane can't move forward when the engine starts. In Canada, this last part is actually written into aviation regulations.

Usually we can only observe the results of hand propping gone wrong. On one occasion an FAA cameraman was in position to film a hand propping incident as it evolved. This film is available below.

An example of the results of hand propping gone wrong is in this article from the Aviation Safety Letter volume 1 of 2002. Another may be found in the accident synopsis from the summer of 2008 (near the bottom).

There is no way to tell how many successful hand propping starts happen without proper mitigation, either tying the airplane down or having a person qualified to operate the controls in the cockpit, between cases when damage or injury occur.

Cardinal Pass/Off-Tuning

In a previous article, and at the beginning of this article, I shared with you a quote from a CASARA member who believed that since they were able to use these techniques to find ELTs during training that the techniques must be good. Would the members who feel the same way argue that they should be able to drive while under the influence because most drunk drivers make it home without incident? Would they suggest that CASARA units should be able to fly in instrument conditions without training or qualification because more often than not they are able to complete mission without incident but in weather that would prevent them from flying by doing so? Would they tell pilots that there is no need to follow regulations pertaining to hand starting an airplane because most of the time that works out just fine?

Just like driving under the influence, continued VFR into IMC, and improper hand propping technique the dangers of the Cardinal Pass and Off-Tuning during aural searches is well understood by those qualified in electronic and radio frequency engineering. There is also evidence of the dangers in the archives of the Transportation Safety Board of Canada in aviation report a01w0261.

Diabetes Test

To conclude it may be helpful to contrast the CASARA reaction to being informed that a technique in use was dangerous with the reaction of a school when informed that actions taken by a lecturer put students in danger.

A pediatrics professor was invited to lecture students on diabetes prevention. As part of the lecture he tested 80 students' blood sugar levels. Similar to the CASARA case, the professor, not himself a physician, was neither qualified nor authorized to perform the procedure. While he changed the lancet and performed proper sterilization for each test, he used a glucometer designed and approved for single use on all 80 students. This put the students at risk of contracting HIV and hepatitis.

Unlike CASARA, Southeast Collegiate did not try to silence the individuals involved, but publicly acknowledged the incident while taking appropriate remedial action. Which organization would you trust to act correctly in the future? How many fatalities or serious injuries is it going to take for CASARA to acknowledge that the Cardinal Pass and Off-Tuned aural search techniques are dangerous?

Not being a physician myself, or a pharmacist, I don't know why one glucometer might be single use when another may be used on different patients; nor indeed if multiple use is even a possibility. I do understand that I'm not qualified to make that determination, or to perform blood sugar testing on 80 strangers. I also understand that I'm not qualified to determine what level of blood alcohol will render a driver incapable of safely driving, nor what weather conditions mark the boundary between safe and unsafe VFR flight. I know what the laws have to say on the subject. Apparently some members of CASARA don't have a similar understanding of where their qualifications in electronic engineering or signals analysis begins and ends; nor when that lack of understanding might put others in danger.

No comments:

Post a Comment