Air Safety: End of the Golden Age? First-World aviation has become so safe that a passenger who takes a domestic jet flight every day would on average go 36,000 years before succumbing to a fatal crash. But certain aerial dangers that were practically absent from the First World in the 1990s might be poised for a resurgence (Among these hazards are terrorism, mid-air collisions, and ground collisions. We explore recent data about the mortality risk of air travel, and discuss the prospects for the years ahead Arnold barnett Massachusetts Institute of Technology Cambridge Massachusetts. USA (Key Words: Transportation-Air; Reliability-System Safety; Statistics-Risk Year 2000 Blackett Memorial Lecture (Royal Aeronautical Society, 27 November 2000) Air Safety: End of the golden age? are indeed enjoying a"golden age "in aviation safety, in which simply preserving ns bis The title of this paper is viable only if one accepts three premises. The first is that
1 Air Safety: End of the Golden Age? First-World aviation has become so safe that a passenger who takes a domestic jet flight every day would on average go 36,000 years before succumbing to a fatal crash. But certain aerial dangers that were practically absent from the First World in the 1990’s might be poised for a resurgence. (Among these hazards are terrorism, mid-air collisions, and ground collisions.) We explore recent data about the mortality risk of air travel, and discuss the prospects for the years ahead. Arnold Barnett Massachusetts Institute of Technology Cambridge, Massachusetts, USA (Key Words: Transportation-Air; Reliability-System Safety; Statistics-Risk Analysis) Year 2000 Blackett Memorial Lecture (Royal Aeronautical Society, 27 November 2000) Air Safety: End of the Golden Age? The title of this paper is viable only if one accepts three premises. The first is that we are indeed enjoying a “golden age” in aviation safety, in which simply preserving risk
levels at their present values would be an attractive prospect. The second is that there are serious reasons to fear that air travelers will be less safe in the years ahead than in the ones just ended. But the third premise, embodied in the question mark, is that one can realistically hope that aviation safety will not diminish despite looming hazards In the pages ahead, we will offer arguments for all of these premises. We will rely on empirical evidence, but also somewhat on interpretation. The reader, therefore, might therefore find some of the arguments more convincing than others. Thus, s/he might reach a different synthesis of the evidence than does the author We start the analysis in the next section, with a discussion about how one might measure(passenger) aviation safety. Then we proceed to some overall calculations about recent safety levels. We thereafter identify three potential dangers that caused very few First-World deaths in the 1990s but which could cause many fatalities in coming years. Then, without disavowing this assessment, we introduce some points in that work against pessimism. In the final section, we reach a prognosis of sorts Measuring Passenger Air Safety We focus on passenger safety, and posit that the traveler's greatest fear in aviation is of being killed in a crash. Under this assumption, information about the likelihood of that outcome takes on overarching importance. But there is a difficulty: several of the most common"barometers "about aviation safety bear an unknown relationship to mortality risk per flight. Here we illustrate the point by considering two such barometers. others are discussed in barnett and Wang Fatal Accidents per 100.000 Flying Hours This metric is among those used by the US National Transportation Safety board to measure airline safety performance. Thus, the agency reported in 1997 that scheduled US carriers averaged 0. 2 fatal accidents per 100,000 flying hours over 1993-96, half the corresponding rate for the four-year period a decade earlier The statistic, alas, has two shortcomings: its numerator and its denominator. The generic term"fatal accidents "includes all accidents that cause at least one death, and thus blurs the distinction between a crash that kills one passenger out of 250 and another that retardant materials) that reduce fatalities but do not prevent them ovements(e.g.fire- kills 250 out of 250. The measure gives no weight to safety impI Moreover, safety statistics based on total"flying hours"(or, for that matter, miles covered)are questionable because the heavy majority of accidents occur during the takeoff/climb and descent/landing phases of flight. If average trip time changes from period to and ident rates based on flight duration could change for reasons having nothing to do with safety
2 levels at their present values would be an attractive prospect. The second is that there are serious reasons to fear that air travelers will be less safe in the years ahead than in the ones just ended. But the third premise, embodied in the question mark, is that one can realistically hope that aviation safety will not diminish despite looming hazards. In the pages ahead, we will offer arguments for all of these premises. We will rely on empirical evidence, but also somewhat on interpretation. The reader, therefore, might therefore find some of the arguments more convincing than others. Thus, s/he might reach a different synthesis of the evidence than does the author. We start the analysis in the next section, with a discussion about how one might measure (passenger) aviation safety. Then we proceed to some overall calculations about recent safety levels. We thereafter identify three potential dangers that caused very few First-World deaths in the 1990’s but which could cause many fatalities in coming years. Then, without disavowing this assessment, we introduce some points in that work against pessimism. In the final section, we reach a prognosis of sorts. Measuring Passenger Air Safety We focus on passenger safety, and posit that the traveler’s greatest fear in aviation is of being killed in a crash. Under this assumption, information about the likelihood of that outcome takes on overarching importance. But there is a difficulty: several of the most common “barometers” about aviation safety bear an unknown relationship to mortality risk per flight. Here we illustrate the point by considering two such barometers; others are discussed in Barnett and Wang1 . Fatal Accidents per 100,000 Flying Hours This metric is among those used by the US National Transportation Safety Board to measure airline safety performance. Thus, the agency reported in 1997 that scheduled US carriers averaged 0.2 fatal accidents per 100,000 flying hours over 1993-96, half the corresponding rate for the four-year period a decade earlier. The statistic, alas, has two shortcomings: its numerator and its denominator. The generic term “fatal accidents” includes all accidents that cause at least one death, and thus blurs the distinction between a crash that kills one passenger out of 250 and another that kills 250 out of 250. The measure gives no weight to safety improvements (e.g. fireretardant materials) that reduce fatalities but do not prevent them. Moreover, safety statistics based on total “flying hours” (or, for that matter, miles covered) are questionable because the heavy majority of accidents occur during the takeoff/climb and descent/landing phases of flight. If average trip time changes from one period to another, accident rates based on flight duration could change for reasons having nothing to do with safety
Hull Losses per 100,000 Departures This popular performance measure(used by boeing among others)defines a serious accident as one in which the aircraft is sufficiently damaged that it cannot fly again (i.e a hull loss ) In(wisely)using departures in the denominator, the ratio gives us the probability that a given flight will end in the aircraft s immobilization There is, however, only a limited connection between the fate of the aircraft and the fate of the passengers. There are some events(e.g. clear air turbulence) that can cause deaths while doing little damage to the airframe. But more important is the wide variation in outcomes across hull losses, as is illustrated by two such losses near Los Angeles in early 2000 Southwest airlines, boeing 737, Burbank, California Passengers Aboard: 137 Passengers Killed Alaska airlines. MD-80. off Malibu. California Passengers aboard: 83 Passengers Killed There have been many instances in which a plane landed with substantial damage but, because of superb emergency procedures, all passengers were evacuated before the plar was engulfed in flames and became a hull loss. Such a rescue is irrelevant to the hull- loss ratio, but it hardly seems so to an assessment about the mortality risk of air travel Death risk per Flight Discussions such as those above lead to a conclusion: To evaluate passenger death risk, the most fruitful approach might be to estimate that quantity directly rather than deal with proxy measures. A useful statistic arises if one considers an appropriate set of past flights(e.g. UK domestic jet flights over 1990-99)and asks the question: If a passenger had chosen one such flight completely at random, what is the probability Q that he would have perished in an accident? (By flight, we mean a nonstop trip from one point to another. )Q is the product of the chance that the flight selected suffers some passenger deaths and the conditional probability that the passenger is among the victims given that deaths occur. If the flights are numbered 1 to N, then Q follows the rule Q=∑xN(1) Here the summation is from 1 to N, and xi is the fraction of passengers on flight i who do not survive it. ( For the overwhelming majority of flights, xI=0; for a flight in which 20% of the passengers are killed, xi=0.2.)
3 Hull Losses per 100,000 Departures This popular performance measure (used by Boeing among others) defines a serious accident as one in which the aircraft is sufficiently damaged that it cannot fly again (i.e. is a hull loss). In (wisely) using departures in the denominator, the ratio gives us the probability that a given flight will end in the aircraft’s immobilization. There is, however, only a limited connection between the fate of the aircraft and the fate of the passengers. There are some events (e.g. clear air turbulence) that can cause deaths while doing little damage to the airframe. But more important is the wide variation in outcomes across hull losses, as is illustrated by two such losses near Los Angeles in early 2000: Southwest Airlines, Boeing 737, Burbank, California Passengers Aboard: 137 Passengers Killed: 0 Alaska Airlines, MD-80, off Malibu, California Passengers Aboard: 83 Passengers Killed: 83 There have been many instances in which a plane landed with substantial damage but, because of superb emergency procedures, all passengers were evacuated before the plane was engulfed in flames and became a hull loss. Such a rescue is irrelevant to the hullloss ratio, but it hardly seems so to an assessment about the mortality risk of air travel. Death Risk per Flight Discussions such as those above lead to a conclusion: To evaluate passenger death risk, the most fruitful approach might be to estimate that quantity directly rather than deal with proxy measures. A useful statistic arises if one considers an appropriate set of past flights (e.g. UK domestic jet flights over 1990-99) and asks the question: If a passenger had chosen one such flight completely at random, what is the probability Q that he would have perished in an accident? (By flight, we mean a nonstop trip from one point to another.) Q is the product of the chance that the flight selected suffers some passenger deaths and the conditional probability that the passenger is among the victims, given that deaths occur. If the flights are numbered 1 to N, then Q follows the rule: Q = xi/N (1) Here the summation is from 1 to N, and xi is the fraction of passengers on flight i who do not survive it. (For the overwhelming majority of flights, xI = 0; for a flight in which 20% of the passengers are killed, xi = 0.2.)
The statistic Q--hereafter described as death risk per flighf--has a number of attractive properties. It weights each accident by the proportion of passengers killed which is more informative than the response to such questions as"did any passengers perish? "or"was the hull badly hurt? The statistic does justice to empirical evidence by ignoring the length or duration of a flight. And it is easy to understand and to calculate (For further discussion of the statistic, see Barnett and Higgins We will work with Q statistics in the balance of the paper First-World Domestic Jet Services Though the fact might surprise the reader, roughly 2/3 of passenger jet flights in the economically and technologically advanced political democracies, a category in which%p world are domestic services in First-World countries. (We define first-World countries we place Australia, Austria, Canada, Denmark, Finland, France, Germany, Greece Iceland, Ireland, Israel, Italy, Japan, Luxembourg, the Netherlands, New Zealand Norway, Portugal, South Africa, Spain, Sweden, Switzerland, the United States and the United Kingdom We therefore turn first to the Q-statistic for First-World domestic jet flights, focusing on the 1990s. There were approximately 75 million flights on First World domestic jets over that decade, over which the total number of full-crash equivalents"(i.e. 2xi) was 5.78. Applying(1), therefore, we reach a death risk per flight estimate of I in 13 million One in 13 million is obviously a low number, but how low? If one were to take one flight per day then, at that level of mortality risk, one could on average travel for 36,000 years before succumbing to a fatal crash. To put it another way, a child taking off on a First-World domestic jet is roughly ten times as likely to win a future Olympic Gold Medal as to fail to reach his destination today. In the Massachusetts lottery game called Megabucks, the chance of winning the Jackpot is 1 in 5.2 million. Thus, a Massachusetts resident who buys a lottery ticket is 2.5 times as likely to win the Jackpot as to"lose disastrously on his next domestic flight Such a minimal level of risk--which is well below the comparable figures for decades before the 1990s(see Oster, Strong, and Zorn'at p 81, Barnett and Higgins could reasonably be identified with a golden age of air safety. Indeed, the statistic is so encouraging as to raise a question. Beyond a certain point, a risk becomes so small that it becomes impractical to worry about it. When we bite into a corn muffin, we do not actively consider whether it is poisoned. When we go to the grocery store, we do not fear a ceiling collapse. Is aviation safety likewise a problem that has been essentially solved, to the extent that talking about it might suggest a personality disorder? To that extreme question, the answer is decidedly"no, as we discuss over the next sever al sections
4 The statistic Q--hereafter described as death risk per flight—has a number of attractive properties. It weights each accident by the proportion of passengers killed, which is more informative than the response to such questions as “did any passengers perish?” or “was the hull badly hurt?” The statistic does justice to empirical evidence by ignoring the length or duration of a flight. And it is easy to understand and to calculate. (For further discussion of the statistic, see Barnett and Higgins2 .) We will work with Qstatistics in the balance of the paper. First-World Domestic Jet Services Though the fact might surprise the reader, roughly 2/3 of passenger jet flights in the world are domestic services in First-World countries. (We define first-World countries as economically and technologically advanced political democracies, a category in which we place Australia, Austria, Canada, Denmark, Finland, France, Germany, Greece, Iceland, Ireland, Israel, Italy, Japan, Luxembourg, the Netherlands, New Zealand, Norway, Portugal, South Africa, Spain, Sweden, Switzerland, the United States and the United Kingdom.) We therefore turn first to the Q-statistic for First-World domestic jet flights, focusing on the 1990’s. There were approximately 75 million flights on FirstWorld domestic jets over that decade, over which the total number of “full-crash equivalents” (i.e. xi) was 5.78. Applying (1), therefore, we reach a death risk per flight estimate of 1 in 13 million. One in 13 million is obviously a low number, but how low? If one were to take one flight per day then, at that level of mortality risk, one could on average travel for 36,000 years before succumbing to a fatal crash. To put it another way, a child taking off on a First-World domestic jet is roughly ten times as likely to win a future Olympic Gold Medal as to fail to reach his destination today. In the Massachusetts lottery game called Megabucks, the chance of winning the Jackpot is 1 in 5.2 million. Thus, a Massachusetts resident who buys a lottery ticket is 2.5 times as likely to win the Jackpot as to “lose” disastrously on his next domestic flight. Such a minimal level of risk—which is well below the comparable figures for decades before the 1990’s (see Oster, Strong, and Zorn3 at p. 81, Barnett and Higgins2 )— could reasonably be identified with a golden age of air safety. Indeed, the statistic is so encouraging as to raise a question. Beyond a certain point, a risk becomes so small that it becomes impractical to worry about it. When we bite into a corn muffin, we do not actively consider whether it is poisoned. When we go to the grocery store, we do not fear a ceiling collapse. Is aviation safety likewise a problem that has been essentially solved, to the extent that talking about it might suggest a personality disorder? To that extreme question, the answer is decidedly “no,” as we discuss over the next several sections
The whole world There are several problems with the view that everythings glorious. Table l raises an obvious issue: the safety successes of domestic First-World jets are not replicated elsewhere. Jet mortality risk is twice as high on First-World international flights as on domestic flights, and more than twenty times as high on jet flights between the first and Developing Worlds and on Developing World jet flights. One would not gauge progress in a school by the performance of the strongest student we would do something analogous if we stopped reading Table 1 at its first line Table i goes here Moreover. even within the first world it is not foreordained that the recent record will continue to prevail. We grasp this point better if we consider a few specific hazards namely, sabotage and the risk of collisions on the ground and in the air Potential First-World Menaces Sabotage In the 1990s, successful criminal acts against air travelers all but disappeared fron First-World skies. (See Table 2. There was only one incident that caused fatalities three passengers(out of 267)died in an attempted hijacking at Algiers. This overall outcome is all the more remarkable given the record just before the 1990s. In 1987,a disgruntled airline employee caused a Us domestic jet to crash by killing the pilot and co-pilot; in 1988, Pan Am 103 exploded over Lockerbie; in 1989, a bomb destroyed a French DC-10 over Africa. There were no survivors in any of these events Table 2 goes here Fir There are two possible explanations for Table 2. Perhaps the desire to do harm to First-World air travelers genuinely diminished in recent years. Alternatively improved security measures may have deterred otential attacks and foiled others This second explanation is arguably the more comforting, for it implies we would be protected from any future resurgence of malicious intent Unfortunately, there is little basis for assuming a new-found infallibility in First- World security measures. The most advanced equipment and procedures are impressive, but a wide gulf sometimes separates the state-of-the-art and the status quo
5 The Whole World There are several problems with the view that “everything’s glorious.” Table 1 raises an obvious issue: the safety successes of domestic First-World jets are not replicated elsewhere. Jet mortality risk is twice as high on First-World international flights as on domestic flights, and more than twenty times as high on jet flights between the First and Developing Worlds and on Developing World jet flights. One would not gauge progress in a school by the performance of the strongest student; we would do something analogous if we stopped reading Table 1 at its first line. Table 1 goes here Moreover, even within the First World, it is not foreordained that the recent record will continue to prevail. We grasp this point better if we consider a few specific hazards, namely, sabotage and the risk of collisions on the ground and in the air. Potential First-World Menaces Sabotage In the 1990’s, successful criminal acts against air travelers all but disappeared from First-World skies. (See Table 2.) There was only one incident that caused fatalities: three passengers (out of 267) died in an attempted hijacking at Algiers. This overall outcome is all the more remarkable given the record just before the 1990’s. In 1987, a disgruntled airline employee caused a US domestic jet to crash by killing the pilot and co-pilot; in 1988, Pan Am 103 exploded over Lockerbie; in 1989, a bomb destroyed a French DC-10 over Africa. There were no survivors in any of these events. Table 2 goes here There are two possible explanations for Table 2. Perhaps the desire to do harm to First-World air travelers genuinely diminished in recent years. Alternatively, improved security measures may have deterred some potential attacks and foiled others. This second explanation is arguably the more comforting, for it implies we would be protected from any future resurgence of malicious intent. Unfortunately, there is little basis for assuming a new-found infallibility in FirstWorld security measures. The most advanced equipment and procedures are impressive, but a wide gulf sometimes separates the state-of-the-art and the status quo