Control before performance in Air Combat Command safety Published May 25, 2016 By Brian Grasky and Antonio Cortés, Ph.D. KIRTLAND AIR FORCE BASE, N.M. -- Note: Long before the Air Force Safety Center stood up at Kirtland Air Force Base, N.M., on Jan. 1, 1996, Airmen were sharing their lessons learned in a variety of safety publications such as Aerospace Safety, Aerospace Maintenance Safety, Air Force Driver, among others. During a year-long commemoration of the safety center's 20th anniversary, the Public Affairs Office will highlight previously-published articles and reprise historic Rex Riley cartoons to emphasize that long-standing safety practices and lessons learned remain relevant to the mishap prevention program of today's Air Force. Ever since we showed up for Undergraduate Pilot Training, pilots have been taught the concept of control and performance in flying. We use the control instruments--the attitude indicator and power instruments--to control the aircraft, and the performance instruments--altimeter, airspeed indicator, vertical velocity indicator, heading and angle of attack scale--to monitor aircraft performance. And as pilots, we take great pride in flying precisely; using a micrometer to measure and being as accurate as possible. But in the safety world, we all too often rely on gut instinct and on the anecdotal perception of hazards--we can't actually detect all significant hazards in our radar search coverage and often neglect invisible threats because we are focused on those hazards on the radar that appear imminent and dangerous. We focus on the performance instruments of safety--results, mishaps, after-action reports--and neglect the controls that cause these results. Psychologists tell us that what holds our attention is what determines action. Unfortunately, what holds our attention isn't always what should determine our action. Our attention is easily seduced by what we believe are pressing issues, but in reality we often don't know the gravest safety threats. "We don't know what we don't know." Invisible hazards often inflict more harm than the obvious hazards. Leaders, and thus pilots, are often unaware that a mission is drifting toward disaster because they lack the means to detect the numerous weak signals of failure, trends, or close calls that precede most mishaps--the chain we speak of cutting that may lead to a mishap. For example, contemplate the difference that a few inches can make in our profession: An aircraft can come within a few inches of scraping a tail on landing, but if no sparks are made, no one will hear of the event. However, if a tail actually scrapes on landing, even if by just a few inches, maximum dissemination of the event will occur. How can we ethically allow a few inches to determine whether an event recedes into obscurity or flashes across a commander's desk? After all, the unsafe acts and conditions that went into the near-scrape are probably identical to those that resulted in the actual scrape. The only difference between both scenarios is luck. Can we call ourselves safety professionals if we allow luck to dictate the terms of our hazard reporting? What if we can see trend information for those close calls? Over the past decade the U.S. Air Force--and just recently, Air Combat Command-- implemented a scientific approach to uncover the weak signals that precede mishaps. We've implemented a program to look at the control side of mishap prevention in an effort to proactively take control of hazard reporting. The initiative is called Military Flight Operations Quality Assurance (MFOQA), a military version of the civilian Flight Operational Quality Assurance (FOQA). Whatever we choose to call it, the idea is to routinely download flight data in order to detect mishap precursors. Philosophically, the great challenge of mishap prevention is that safety is often defined by the intensity of its absence. In other words, we often try to manage safety by measuring the rates of mishaps. Smoking holes are, rather tragically, the traditional metric used to measure safety. Unfortunately, they are trailing indicators of safety, or it is like flying by the performance instruments. MFOQA allows us to use the control instruments, to actually measure the leading indicators of safety by examining close calls, which we know occur in far greater numbers than actual mishaps, and thus furnish our analyses with far more data than what our infrequent mishaps provide. With the trend data from the almost mishaps we can measure our drift toward failure instead of just the actual failures. ACC's and Air Education and Training Command's MFOQA program is overseen and promoted by the U.S. Air Force Safety Center at Kirtland Air Force Base in Albuquerque, N.M. Currently, only select F-16s and the T-6 join the majority of heavies that participate in the program. Four prerequisites must be met in order to participate in MFOQA: An aircraft must have the ability to record the proper types of flight data, an experienced pilot trained in the MFOQA processes must analyze the data to detect mishap precursors, the command structure must know how to use the resulting analyses to manage risk, and a safety culture must exist that protects aircrew when errors are made. In order to promote the proper use of flight data and to ensure the program is NOT used to punish aircrew, the Office of the Secretary of Defense published a memo, Military Flight Operations Quality Assurance (MFOQA) Process Implementation, dated Oct. 11, 2005. This memo states that data generated from the MFOQA process shall not be used for monitoring aircrew performance to initiate punitive or adverse action, except for cases of suspected willful disregard of regulations and procedures. The Secretary of the Air Force included identical language in AFPD 90-13, Military Flight Operations Quality Assurance. We go to great lengths to ensure that MFOQA is a "white hat" program. We look at trends and aggregate data--we accumulate data from many flights and de-identify the data before we try to detect instances where aircraft operated outside of preset parameters. We are especially interested in finding unsafe latent conditions, such as normalization of deviance or poor actuation or equipment limitations that may point to poorly designed procedures. We work closely with human factors experts to determine root causes of the mishap precursors detected by MFOQA. In the decade since commencing our MFOQA initiative, the Air Force has learned to value the analyses produced from flight data. Aircrew flying MFOQA aircraft can learn the latest hazards at deployed locations and use such information to brief threats and errors germane to unfamiliar airfields, terrain, air traffic control and navigation. MFOQA analyses can be used to validate the effectiveness of tactics, training and procedures by measuring what actually happens during flight operations, versus what we think is happening. Actual aircraft performance data can be used to validate or correct calculated performance figures. Insights can be gleaned on how tightly flights are following mission profiles. Safety officers can learn what airfields are associated with a high volume of wake turbulence and what locations are triggering the most GPWS alerts. Flight profiles can be examined to discern where asymmetric over-Gs and transient over-temps are most likely to occur. We can also ID and trend "nuisance" faults that typically get overlooked and identify aircraft that might have a minor hardware or software malfunction before it becomes a large malfunction. Analysts are also able to determine whether procedural changes have improved operations or made things worse. In a nutshell, MFOQA allows us to make information-based decisions, instead of relying on our gut instinct, which is often wrong. MFOQA is not a new program. It originated with British Airways in the 1960s. Academic researchers have documented significant decreases in mishap rates and maintenance costs at those airlines that have started flight data programs when compared to other air carriers that do not analyze flight data. The U.S. Federal Aviation Administration estimates a net savings of $892,000 per year for each 50 aircraft flown in FOQA programs. This partly explains why more than 40 civilian companies in the U.S. have FOQA programs and why foreign airlines operating aircraft with maximum takeoff weights in excess of 60,000 lbs. have flight data monitoring programs. The U.S. Navy has used MFOQA for years to detect mishap precursors on the Super Hornet and the Royal Netherlands Air Force recently started MFOQA on the F-16. More analysis and more data will find new and better use of the data as we move forward. This is an opportunity to get back to the basics. As in the cockpit where we fly off the control instruments and get resultant data from the performance instruments, MFOQA allows the fighter community to potentially see situations that lead to mishaps before they happen, rather than looking at why they happened. Let's use this to manage flying programs using controls rather than by watching the performance after the fact. (Reprinted from www.afsec.af.mil, October 2012)