1 Air Safety: End of the Golden Age? First-World aviation has become so safe that a passenger who takes a domestic jet flight every day would on average go 36,000 years before succumbing to a fatal crash. But certain aerial dangers that were practically absent from the First World in the 1990’s might be poised for a resurgence. (Among these hazards are terrorism, mid-air collisions, and ground collisions.) We explore recent data about the mortality risk of air travel, and discuss the prospects for the years ahead. Arnold Barnet Massachusetts Institute of Technology Cambridge, Masachusets, USA (Key Words: Transportation-Air; Reliability-System Safety; Statistics-Risk Analysis) Year 2000 Blackett Memorial Lecture (Royal Aeronautical Society, 27 November 2000) Air Safety: End of the Golden Age? The title of this paper is viable only if one accepts three premises. The first is that we are indeed enjoying a “golden age” in aviation safety, in which simply preserving risk 2 levels at their present values would be an attractive prospect. The second is that there are serious reasons to fear that air travelers will be less safe in the years ahead than in the ones just ended. But the third premise, embodied in the question mark, is that one can realistically hope that aviation safety will not diminish despite looming hazards. In the pages ahead, we will offer arguments for all of these premises. We will rely on empirical evidence, but also somewhat on interpretation. The reader, therefore, might therefore find some of the arguments more convincing than others. Thus, s/he might reach a different synthesis of the evidence than does the author. We start the analysis in the next section, with a discussion about how one might measure (passenger) aviation safety. Then we proceed to some overall calculations about recent safety levels. We thereafter identify three potential dangers that caused very few First-World deaths in the 1990’s but which could cause many fatalities in coming years. Then, without disavowing this assessment, we introduce some points in that work against pessimism. In the final section, we reach a prognosis of sorts. Measuring Passenger Air Safety We focus on passenger safety, and posit that the traveler’s greatest fear in aviation is of being killed in a crash. Under this assumption, information about the likelihood of that outcome takes on overarching importance. But there is a difficulty: several of the most common “barometers” about aviation safety bear an unknown relationship to mortality risk per flight. Here we illustrate the point by considering two such barometers; others are discussed in Barnett and Wang 1 . Fatal Accidents per 100,000 Flying Hours This metric is among those used by the US National Transportation Safety Board to measure airline safety performance. Thus, the agency reported in 1997 that scheduled US carriers averaged 0.2 fatal accidents per 100,000 flying hours over 1993-96, half the corresponding rate for the four-year period a decade earlier. The statistic, alas, has two shortcomings: its numerator and its denominator. The generic term “fatal accidents” includes all accidents that cause at least one death, and thus blurs the distinction between a crash that kills one passenger out of 250 and another that kills 250 out of 250. The measure gives no weight to safety improvements (e.g. fire- retardant materials) that reduce fatalities but do not prevent them. Moreover, safety statistics based on total “flying hours” (or, for that matter, miles covered) are questionable because the heavy majority of accidents occur during the takeoff/climb and descent/landing phases of flight. If average trip time changes from one period to another, accident rates based on flight duration could change for reasons having nothing to do with safety. 3 Hull Losses per 100,000 Departures This popular performance measure (used by Boeing among others) defines a serious accident as one in which the aircraft is sufficiently damaged that it cannot fly again (i.e. is a hull loss). In (wisely) using departures in the denominator, the ratio gives us the probability that a given flight will end in the aircraft’s immobilization. There is, however, only a limited connection between the fate of the aircraft and the fate of the passengers. There are some events (e.g. clear air turbulence) that can cause deaths while doing little damage to the airframe. But more important is the wide variation in outcomes across hull losses, as is illustrated by two such losses near Los Angeles in early 2000: Southwest Airlines, Boeing 737, Burbank, California Passengers Aboard: 137 Passengers Killed: 0 Alaska Airlines, MD-80, off Malibu, California Passengers Aboard: 83 Passengers Killed: 83 There have been many instances in which a plane landed with substantial damage but, because of superb emergency procedures, all passengers were evacuated before the plane was engulfed in flames and became a hull loss. Such a rescue is irrelevant to the hull- loss ratio, but it hardly seems so to an assessment about the mortality risk of air travel. Death Risk per Flight Discussions such as those above lead to a conclusion: To evaluate passenger death risk, the most fruitful approach might be to estimate that quantity directly rather than deal with proxy measures. A useful statistic arises if one considers an appropriate set of past flights (e.g. UK domestic jet flights over 1990-99) and asks the question: If a passenger had chosen one such flight completely at random, what is the probability Q that he would have perished in an accident? (By flight, we mean a nonstop trip from one point to another.) Q is the product of the chance that the flight selected suffers some passenger deaths and the conditional probability that the passenger is among the victims, given that deaths occur. If the flights are numbered 1 to N, then Q follows the rule: Q = G166x i /N (1) Here the summation is from 1 to N, and x i is the fraction of passengers on flight i who do not survive it. (For the overwhelming majority of flights, x I = 0; for a flight in which 20% of the passengers are killed, x i = 0.2.) 4 The statistic Q--hereafter described as death risk per flight—has a number of attractive properties. It weights each accident by the proportion of passengers killed, which is more informative than the response to such questions as “did any passengers perish?” or “was the hull badly hurt?” The statistic does justice to empirical evidence by ignoring the length or duration of a flight. And it is easy to understand and to calculate. (For further discussion of the statistic, see Barnett and Higgins 2 .) We will work with Q- statistics in the balance of the paper. First-World Domestic Jet Services Though the fact might surprise the reader, roughly 2/3 of passenger jet flights in the world are domestic services in First-World countries . (We define first-World countries as economically and technologically advanced political democracies, a category in which we place Australia, Austria, Canada, Denmark, Finland, France, Germany, Greece, Iceland, Ireland, Israel, Italy, Japan, Luxembourg, the Netherlands, New Zealand, Norway, Portugal, South Africa, Spain, Sweden, Switzerland, the United States and the United Kingdom.) We therefore turn first to the Q-statistic for First-World domestic jet flights, focusing on the 1990’s. There were approximately 75 million flights on First- World domestic jets over that decade, over which the total number of “full-crash equivalents” (i.e. G166x i ) was 5.78. Applying (1), therefore, we reach a death risk per flight estimate of 1 in 13 million. One in 13 million is obviously a low number, but how low? If one were to take one flight per day then, at that level of mortality risk, one could on average travel for 36,000 years before succumbing to a fatal crash. To put it another way, a child taking off on a First-World domestic jet is roughly ten times as likely to win a future Olympic Gold Medal as to fail to reach his destination today. In the Massachusetts lottery game called Megabucks, the chance of winning the Jackpot is 1 in 5.2 million. Thus, a Massachusetts resident who buys a lottery ticket is 2.5 times as likely to win the Jackpot as to “lose” disastrously on his next domestic flight. Such a minimal level of risk—which is well below the comparable figures for decades before the 1990’s (see Oster, Strong, and Zorn 3 at p. 81, Barnett and Higgins 2 )— could reasonably be identified with a golden age of air safety. Indeed, the statistic is so encouraging as to raise a question. Beyond a certain point, a risk becomes so small that it becomes impractical to worry about it. When we bite into a corn muffin, we do not actively consider whether it is poisoned. When we go to the grocery store, we do not fear a ceiling collapse. Is aviation safety likewise a problem that has been essentially solved, to the extent that talking about it might suggest a personality disorder? To that extreme question, the answer is decidedly “no,” as we discuss over the next several sections. 5 The Whole World There are several problems with the view that “everything’s glorious.” Table 1 raises an obvious issue: the safety successes of domestic First-World jets are not replicated elsewhere. Jet mortality risk is twice as high on First-World international flights as on domestic flights, and more than twenty times as high on jet flights between the First and Developing Worlds and on Developing World jet flights. One would not gauge progress in a school by the performance of the strongest student; we would do something analogous if we stopped reading Table 1 at its first line. Table 1 goes here Moreover, even within the First World, it is not foreordained that the recent record will continue to prevail. We grasp this point better if we consider a few specific hazards, namely, sabotage and the risk of collisions on the ground and in the air. Potential First-World Menaces Sabotage In the 1990’s, successful criminal acts against air travelers all but disappeared from First-World skies. (See Table 2.) There was only one incident that caused fatalities: three passengers (out of 267) died in an attempted hijacking at Algiers. This overall outcome is all the more remarkable given the record just before the 1990’s. In 1987, a disgruntled airline employee caused a US domestic jet to crash by killing the pilot and co-pilot; in 1988, Pan Am 103 exploded over Lockerbie; in 1989, a bomb destroyed a French DC-10 over Africa. There were no survivors in any of these events. Table 2 goes here There are two possible explanations for Table 2. Perhaps the desire to do harm to First-World air travelers genuinely diminished in recent years. Alternatively, improved security measures may have deterred some potential attacks and foiled others. This second explanation is arguably the more comforting, for it implies we would be protected from any future resurgence of malicious intent. Unfortunately, there is little basis for assuming a new-found infallibility in First- World security measures. The most advanced equipment and procedures are impressive, but a wide gulf sometimes separates the state-of-the-art and the status quo. 6 Potential terrorists need only read the newspapers to learn that current precautions may not be sufficient to prevent future acts of sabotage 4,5,6 . Nor need terrorists limit themselves to brief newspaper accounts: A surprising amount of detailed information is available on the web. And, broadly viewed, the 1990’s do not indicate any widespread disavowal of violence against innocent civilians. Terrorism grew in some parts of the First World unaccustomed to it: In the US, lethal bombings occurred at Oklahoma City and New York’s World Trade Center; in Japan, poison gas was released in the Tokyo subway. The decade also saw a horrific plan to attack civil aviation. In 1996, a defendant was convicted in New York of a (narrowly-averted) plot to destroy a dozen US jets coming home from Asia. (As part of the scheme, the conspirators successfully exploded a small bomb on a Boeing 747 in the Philippines.) One terrorism expert offered the less-than- reassuring view that the plot could have never felled twelve planes; at most, it would have claimed “four or five.” That Table 2 may offer a fragile basis for comfort was suggested in October 2000, when terrorists deployed a powerful bomb in Yemen against the USS Cole. A day later, a dispatch from London 7 reported that “fear of terrorist attacks after the explosion of violence in the Middle East hammered global airline shares Friday.” One analyst stated that “At the moment, aeroplanes are not the number-one target. But they could be.” Another opined that “it is a relatively easy jump (from recent events) to imagine someone also doing something to aircraft.” What might make airlines tempting targets is that an attack on an airplane has a realistic chance of killing everyone aboard. That prospect stands in contrast to outcomes in the Tokyo subway and the World Trade Center, where the aim may have been to kill hundreds if not thousands of people, but the actual death tolls were, respectively, twelve and six. Runway Collisions There were two runway collisions in the 1990’s, which killed a total of 30 First-World jet travelers. Both events occurred in the US; Table 3 presents mortality risk statistics based on the pattern. Table 3 goes here However, the years ahead could well be more dangerous, for the simple reason that airport traffic is growing. Indeed, intuition suggests that runway collision risk could 7 vary not with the level of traffic but, more ominously, with its square. For an analogy from the ground, consider a one-way street that has a stop sign at its intersection with a busy two-way street. Suppose that traffic increases by 20% in the area. Then, to a first approximation, one might expect the number of cars on the one-way street that violate the stop sign to increase by 20% per year. One might also foresee a 20% rise in the chance that, when a violation occurs, another vehicle traveling on the busier street is so close to the intersection that an accident results. The overall effect is that accidents would grow by a factor of 1.2x1.2 = 1.44, or by 44%. Of course, intuitive arguments can go in all directions: One could defend a variety of functional relationships between traffic and risk. However, there is empirical support for the quadratic rule just stated. Barnett, Paull, and Iadeluca 8 analyzed all 292 US runway incursions in 1997, focusing on the 40 events which (i) were described as having “extremely high” accident potential by a panel of experts that included pilots and air traffic controllers and (ii) took place under conditions of reduced visibility (dawn/dusk, night, haze/fog). The researchers investigated whether the spread of these dangerous incursions across US airports was proportional to the square of 1997 traffic levels. On a per-capita basis, for example, did airports with 500,000 operations that year have roughly four times as many dangerous events as airports with 250,000? The quadratic hypothesis passed statistical tests with flying colors. Interestingly, the “neighboring” alternative hypotheses, namely, that dangerous events varied linearly with traffic, or instead with the cube of traffic levels, both failed statistical tests against the data. The quadratic rule-of-thumb, therefore, emerges as more credible from the data analysis. So does its unpleasant implication that increases in airport activity could cause disproportionate growth in collision risk. A 50% rise in traffic, for example, could induce a 125% increase in collisions. Taking into account various phenomena, Barnett et al 8 estimated that the runway- collision death risk per US jet flight could rise to 1 in 25 million over 2003-2022, four times the corresponding figure in Table 3. Because of increased numbers of jet passengers, the annual death toll could grow more steeply, from three per year over 1990- 99 to about 30 per year over 2003-2022. It seems reasonable to fear that Western Europe—the scene of the two worst runway collisions in history (Tenerife, Madrid)--- will be subject to the same general trend. Midair Collisions Table 4 summarizes First-World death risk in the 1990’s caused by collisions between planes in the air. Table 4 goes here 8 The table speaks for itself, but we might add that it was based on approximately 100 million flights. Mid-air collisions come as close as anything in aviation to a problem that is fully resolved. But the danger is not extinct, because air traffic control is not a static entity. In Western Europe, there is strong pressure to replace the numerous national air-traffic systems with a centralized system. In the United States, the present arrangements--under which planes are confined to a network of prescribed flight paths--are slated to be revised in favor of “free flight,” which would allow planes to travel straight-line routes from origins to destinations. Free flight would ideally lead to shorter flight times and lesser fuel consumption, saving billions of dollars annually. Such changes present real safety challenges. Merging dozens of different air traffic control systems which, while similar, are nonetheless not identical in their procedures, is unlikely to be a straightforward process. And the vastly altered flight patterns under free flight could reduce “situational awareness” among air traffic controllers. The moving dots representing planes on controllers’ screens—which today line up like points on a grid—could in the future more closely resemble gas molecules in random scatter. Barring extremely reliable computer aids, it might be harder for controllers to identify menacing situations before they become critical. And, beyond specifics, it is conceivable that any major changes in air traffic control pose dangers. One of the fundamental notions of industrial sociology is the “learning curve,” under which new procedures beget errors and difficulties that had not been anticipated. Table 4 shows that innovations in air traffic control cannot diminish the likelihood of midair collisions, for there is literally nothing to reduce. If any change arises in the risk of such collisions, it must necessarily be for the worse. On the Other Hand… We have just examined three hazards to First-World aviation that caused almost no deaths in the 1990’s. For two of them—sabotage and midair collisions—there is plausible reason to fear that risks could increase in the years ahead. For the third— runway collisions-there is reason to expect that risks should increase in the years ahead. Furthermore, recent safety achievements in the First-World have not been matched elsewhere, and there could be sources of future peril that we do not yet recognize. (Before August 2000, who imagined that a tire blowout alone could cause the destruction of a Concorde SST?) Against this backdrop, aviation-safety can hardly be viewed as an obsolete source of worry. 9 Yet this sobering discussion might be overwrought. For one thing, it ignores a central tendency of aviation history: Time and time again, mortal hazards to air travel have been rendered harmless because of advances in technology, training, and procedures. (How else could the First-World safety record be so astoundingly close to perfect?) Fifteen years ago, for example, there was great concern about thunderstorm- induced wind shear, which had caused five disasters on US airlines in just over a decade. A whole host of measures since then has vastly reduced the danger; indeed, some new planes automatically execute escape maneuvers at the first sign of wind shear. Even for the specific dangers we discussed, there are hopeful elements to the story. In the US, both the National Transportation Safety Board and the Federal Aviation Administration have identified runway collisions as the number-one threat to US aviation. In consequence, public and private organizations are exploring with great intensity a number of innovations—technological and otherwise—that might prevent collisions at airports. If there is validity to the truism that recognizing a problem is halfway to solving it, then runway collisions are at least 50% towards oblivion. Likewise, we expressed concern that free-flight could seriously complicate the work of air-traffic controllers. But free-flight would also change the geometry of flight paths in ways that, in themselves, might reduce the risk of mid-air collisions 9 . For a simple example, consider Figure 1, which concerns one plane traveling from A to B and another from C to D. Under the present prescribed routings, the first plane might follow path A- E-F-B and the second, path C-E-F-D. The planes could therefore come in close proximity along segment EF. If they could instead travel straight-line paths to their destinations, they should get nowhere close to one another. Figure 1 goes here In any case, our risk analysis has been incomplete in a major respect. We have described menaces that caused scant fatalities in the 1990’s but which could cause more deaths in forthcoming years. We have said nothing, however, about the complementary menaces that caused air crashes in the 1990’s but might be less problematic in the future. Were enough safety improvements to occur, overall mortality risk could go down despite setbacks on some dimensions. It is useful in this connection to recall the only domestic-jet disaster in the 1990’s in Western Europe. The crash resulted largely from confusion about how a cockpit display measured the plane’s rate of descent: as an angle with the horizon or instead in meters per second. Travelers can rest assured that many cockpit displays are far easier to understand in the aftermath of the accident, and thus that a recurrence is not likely soon. Indeed, there is now strong determination to identify ambiguities and other difficulties long before they result in accidents. Data from routine operations are 10 collected, shared, and analyzed far more extensively and with far greater sophistication that was the case even ten years ago. As foresight replaces hindsight, reacting to tragedies will be a smaller component of the process of understanding risk. The result, one hopes, will be fewer tragedies from which we must learn. Final Remarks How does it all add up? Perhaps the pessimists will prove correct, and the greatest era in aviation safety has come to an end. But the fact remains that, in the First World, airlines, aircraft manufacturers, and regulatory agencies have shown an uncanny ability to keep getting better. One might therefore not be too hasty to bet against them. If the Golden Age of air safety is over, it might be because we are about to enter a Platinum Age. Acknowledgments In connection with the Blackett Lecture, I am grateful to Mike Pidd for help, encouragement and, not least, the invitation itself. I am also grateful to the Operational Research Society, the Royal Aeronautical Society, and British Airways for great effort and generosity in creating a splendid occasion. And I thank editor John Ranyard for his careful reading of this manuscript and his various suggestions. References (1) Barnett, A. and A. Wang (2000), “Passenger-mortality Risk Estimates Provide Perspectives about Airline Safety,” Flight Safety Digest, April 2000 (2) Barnett, A. and M.K. Higgins (1989), “Airline Safety: The Last Decade,” Management Science, November 1989 (3) Oster, C., J. Strong, and C. Zorn (1992), Why Airplanes Crash: Aviation Safety in a Changing World, Oxford University Press (4) Newsweek (1999),“The Inside Story of Flight 990,” November 21,1999 (cover story, many correspondents) 11 (5) USA TODAY (2000), “Security Vows Sputter as Pan Am 103 Memories Fade,” May 15, 2000 (6) Scotland on Sunday (2000), “Undercover Team Finds Gaping Hole in Airport Security,” November 19, 2000 (Peter Laing, correspondent) (7) Reuters Limited (2000), “Terrorism Fears Hammer Global Airline Stocks,” October 14, 2000 (dispatch by Bradley Perrett, European Airlines Correspondent (8) Barnett, A., G. Paull, and J. Iadeluca (2000), “Fatal US Runway Collisions Over the Next Two Decades,” Air Traffic Control Quarterly, Volume 8, Number 4 (9) Barnett, A. (2000), “Free-Flight and En Route Air Safety: A First-Order Analysis,” Operations Research, November-December 2000