Proactive Safety: It Is a Marathon, Not a Sprint

Safety culture is naturally biased toward reactive processes because mishaps are confirmation of hazards. When a Class A or B aviation mishap involves an Air Mobility Command (AMC) aircraft, the safety investigation process is poised to marshal tremendous resources to determine the cause and implement changes to avoid a recurrence. There are mandatory reporting requirements, a carefully choreographed investigation process, and a highly structured timeline that demands a focused effort. According to DAFI 91-204, Safety Investigations and Reports, the final message timeline for Class A and B mishaps includes thirty days for the investigation, fifteen days to brief the Convening Authority, and three days to release the message after the brief. That is a fast turnaround! For a rough (not a perfect apples-to-apples) comparison, the National Transportation Safety Board generally tries to complete an investigation in twelve to twenty-four months. Following a Class A or B mishap, a semi-annual Hazard Review Board, chaired by the AMC Deputy Commander, closely manages recommendations provided by a Safety Investigation Board until the hazards are eliminated or mitigated to an acceptable level. Whether it is a publication change, an update to a training syllabus, or a fleet-wide aircraft modification, significant oversight and engagement are baked into the recommendation resolution process, and that is a good thing.

In contrast to the mishap investigation process, proactive safety programs—including Military Flight Operations Quality Assurance (MFOQA), Line Operations Safety Audit (LOSA), and Aviation Safety Action Program (ASAP)—provide a means to identify hazard trends and implement safety solutions without a mishap. In other words, proactive safety shares the same goal as reactive safety—mishap prevention—but at a fraction of the cost. However, proactive safety programs also have their share of challenges. LOSA, MFOQA, and ASAP do not wield the concentrated effort and support inherent to mishap investigations. Proactive safety programs are more “grassroots” programs in that they are highly dependent on participation and buy-in from the rank and file to improve safety in their communities. Participation is voluntary and often falls outside what is explicitly expected of individuals. As with most grassroots efforts, results do not always come easy. Sometimes, proactive safety feels like a marathon, not a sprint. However, when we put in the work, the result is that hazards are mitigated or eliminated but with no mishaps. To illustrate this point, I will summarize three proactive safety success stories that resulted in tangible improvements to flight safety.

KC-135 ASAP + MFOQA = Change

In 2013, a KC-135 crew conducted a full-stop taxi back (FSTB). When the crew performed the After Landing portion of their FSTB checklist, they missed the step to close the speed brakes. Resist the urge to apply your groundspeed-zero judgment here; we have all missed a checklist item. Also, do not get ahead of the timeline. In 2013, step three in the Before Takeoff portion of the FSTB checklist (Speed Brakes – zero degrees) did not exist. So, the speed brakes remained fully extended as the crew commenced their takeoff roll. Everything seemed normal until the pilot pulled back on the control column after the “Rotate” call. The airplane struggled into the air. Once airborne, the Ground Proximity Warning System immediately announced, “SPEED BRAKES, SPEED BRAKES.” The pilot pushed the speed brake lever forward to zero degrees and safely recovered. Thankfully, the pilot submitted an ASAP describing the events.

During the analysis of this ASAP, two questions emerged. First, why did the warning horn not sound when the pilot advanced the throttles for takeoff with the speed brake lever pulled back more than two degrees? The short answer is that the flap and speed brake warning switch is not one hundred percent effective. The KC-135 Performance Manual states, “During some minimum N1 takeoff settings, the flap/speed brake warning switch may not be actuated.” Second, why is there not another step in the FSTB checklist to ensure the pilot sets the speed brake lever to zero degrees before takeoff? The initial response from some of the more cynical members of the community went something like this: this item is covered in the After Landing portion of the checklist. Just be better at your job.

Fortunately, MFOQA analysis was available to add unemotional context to this ASAP. Seven other KC-135s took off with their speed brake lever greater than two degrees within twelve months of the ASAP. There were approximately 28,000 initial takeoffs in the same twelve-month period, including full-stop taxi backs. According to MFOQA analysis, approximately thirty-three percent of those takeoffs used a power setting at or below that of the ASAP event and may not have had the intended protection of the flap and speed brake warning system. So, one individual submitted an ASAP that identified the hazard, and MFOQA quantified the risk as far greater than an isolated case of poor checklist discipline.

The scope of this hazard provided solid justification for flight manual changes and plans to modify the fleet. The flight manual changes came “relatively” fast. The existing Performance Manual warning was essentially replicated in the Takeoff section of the Flight Manual, and step three (Speed Brakes – zero degrees) was added to the Before Takeoff portion of the FSTB checklist. An airplane modification takes much longer than a flight manual change, especially when it involves hardware versus software. It has been more than eleven years since that ASAP was submitted, and KC-135 Block 45.4 is finally visible on the horizon. It includes changes to the flap and speed brake warning system to protect every takeoff regardless of the power setting.

MFOQA—That Is Not Us…Is It?

I briefed MFOQA trends for one AMC aircraft at the Realistic Training Review Board (RTRB) at Scott AFB, IL, a few years ago. For those unfamiliar with the RTRB, it is an event that senior instructors and training managers from every wing in the Mobility Air Force attend, along with a few evaluators who are also in town for the Stan/Eval Board (SEB). The RTRB and SEB are great opportunities to spread the word about the MFOQA program and showcase the power of trending more than a handful of training sorties or checkrides—MFOQA sees almost everything.

As I presented the analysis of a particular Flight Safety Alert (FSA) that highlighted noncompliance with a Flight Manual Safety Supplement, one of the evaluators became visibly annoyed and pulled me aside after my presentation to discuss. His base stood above the others in the count and rate of this FSA, and apparently, the data struck a nerve. It was not just an anonymous blob of fleet-wide data in a bar graph or pie chart; the analysis showed things that were happening in his unit that he did not see when administering evaluations. I am not sure what bothered him more, the fact that I was contradicting his perception of reality or the realization that crews might operate differently when Stan/Eval was not on the jet. After our discussion, I assumed that, like so many others, he was processing the five stages of MFOQA grief and might never arrive at acceptance.

Fast forward a year later, and I am briefing the same FSA at the next RTRB. It dawned on me that this base no longer had the highest rate for that FSA but now had one of the lowest. I scanned the room for someone from that unit to find out what was up.

Unbeknownst to me, this evaluator returned what he had learned to his unit and instituted a Special Interest Item to address the trend, with dramatic results.

Despite having the highest probable exposure to the hazard because of their specific mission, this unit continues to have one of the lowest occurrence rates for this FSA.

Erroneous Altimeter Reporting—ASAP 28774

As a crew prepared to taxi for a night local training sortie, they checked the Automatic Terminal Information Service (ATIS) and dialed in their barometric altimeter correction. However, this altimeter setting resulted in a readout that was approximately four hundred feet above the airfield elevation. Something was wrong with the altimeter setting reported via ATIS. The crew queried ground control about the altimeter setting. Ground informed them that the local weather technician gave them the same altimeter setting and insisted that ATIS was correct. The crew checked the Terminal Aerodrome Forecast for a nearby airfield and discovered a significant difference in the altimeter setting between the two fields. Furthermore, when the crew set that altimeter from the nearby airfield, it matched their airfield elevation perfectly. The crew contacted the local weather flight directly and informed them of the apparent altimeter setting error. The on-duty weather technician dismissed the crew’s concerns as the automated observation system reported no maintenance flags. Then, the crew escalated their assertiveness and contacted the tower to ensure that the arriving aircraft would not be issued the errant altimeter setting. The tower subsequently began using the altimeter for the adjacent airfield.

After flying a night local, we all just want to complete the necessary post-flight paperwork and go home. There was no obvious requirement to report this incident, and it would have been easy to assume that the appropriate authority probably already knew about it. However, this crew took the time to submit an ASAP, thinking it might make a difference, and it did!

This ASAP uncovered two issues. The first issue was a previously undetected design flaw in the automated weather observation system used across the Air Force and Army. In the simplest of terms, the triple redundant barometers in this equipment share a common ambient air tube that the manufacturer believed to be impervious to moisture. However, engineers determined this assumption was incorrect in a subsequent laboratory test. Under certain conditions, ice formation generated an equally erroneous altimeter setting from each of the system’s three barometers such that the system reported no discrepancy. The second issue was the weather technician’s assumption that the automation could always be trusted to accurately report its status despite being provided contradicting reports from the surrounding area.

When a crew takes the time to submit an ASAP like this one, they are not stuffing a complaint in a comment box. It is reasonable to expect that someone on the receiving end of that ASAP (usually the Major Command staff) will run the issue to ground, but in this case, they hit it out of the park. The weather personnel on the staff at AMC and Air Combat Command (the lead command for weather equipment) ensured that the appropriate agencies investigated the incident thoroughly, then devised and disseminated comprehensive mitigation for users of this system across the globe until the manufacturer designed a permanent fix. That happened in less than sixty days!

Proactive flight safety programs like MFOQA and ASAP may never wield the influence or focused attention inherent in reactive or mishap-based safety programs. Sure, proactive safety is sometimes a marathon, not a sprint. However, as these three vignettes illustrated, proactive safety can be incredibly effective when participation and buy-in are high. Submitting that ASAP after a long day could be the catalyst to uncovering something that affects the entire fleet. Using MFOQA to quantify hazards objectively provides insight beyond our personal experience and removes emotion from decision-making. The more we participate in and embrace these programs, the more momentum we create to improve flight safety without mishaps.