Dying To Save A Life
Bob Baron, Ph.D
On January 29, 2019, a Bell 407 helicopter, being operated by Survival Flight as a helicopter air ambulance flight, collided with forested terrain about 4 miles northeast of Zaleski, Ohio. The pilot, flight nurse, and flight paramedic died, and the helicopter was destroyed. The National Transportation Safety Board (NTSB) investigation determined that the probable cause of the accident was, “Survival Flight’s inadequate management of safety, which normalized pilots’ and operations control specialists’ noncompliance with risk analysis procedures and resulted in the initiation of the flight without a comprehensive preflight weather evaluation, leading to the pilot’s inadvertent encounter with instrument meteorological conditions, failure to maintain altitude, and subsequent collision with terrain.”
This is among a long stream of Helicopter Emergency Medical Services (HEMS) accidents that have claimed the lives of well-intentioned pilots losing their lives while trying to save the lives of others. HEMS operations are among the riskiest type of helicopter operations due to their time-critical nature, dynamic weather conditions, and challenging landing sites. However, these risks should be mitigable if the helicopter operator has a strong safety culture with effective risk analysis and mitigation strategies in place.
Unfortunately, on January 29th, 2019, that was not the case. On that particular day, all the holes in the Swiss Cheese lined up (more on the Swiss Cheese model shortly). As with most accidents, there were multiple failures, from the top of the organization down to the line personnel, leading to yet another preventable helicopter accident. According to the NTSB, a poor safety culture and ineffective operational risk management existed at Survival Flight at the time of the accident. This was indicated by the following findings, including employee interviews:
- Current and former Survival Flight pilots and mechanics revealed a lack of effective risk management by company personnel, including a lack of tracking of pilots’ actual duty and rest times and management pressure both for bases to remain operational and for employees to accept flights. Additionally, Survival Flight had no processes in place to keep track of actual duty times.
- Survival Flight’s director of safety and training was aware that pilots were not comfortable reporting safety issues to management.
- A former employee described an environment where “reporting to management that management is unsafe” would be difficult.
- A former employee described the safety culture as “so damaging and so toxic.”
- Several interviewees reported that company management would challenge red risk assessment levels. A red risk assessment would take a base out of service for reasons related to maintenance, pilot compliance with duty and rest requirements, or weather.
- One pilot described a situation in which he told the operations control specialist (OCS) his base was “red” for aircraft maintenance, but the OCS changed his risk assessment to “amber.” When he questioned the change, he received a call from the director of operations (DO) asking, “why are you red... that’s not the way we do things.”
- A former Survival Flight pilot reported that he attempted to classify his base as “red” due to an inoperative helicopter so the mechanic wouldn’t feel rushed as he was working to return the helicopter to service. However, the operational control manager (OCM) decided to place the helicopter on a 20-minute delay rather than take it out of service.
- Survival Flight management pressured personnel to accept flights by encouraging the solicitation of hospitals for flights that other operators had previously refused and advertising that Survival Flight would fly in weather that other operators would not fly in.
- At the time the accident flight occurred, pressure on personnel to accept flights was also evident in a Survival Flight policy where a base would be rewarded with a massage chair one time if its pilots conducted 30 flights in 1 month; the accident flight occurred on the 28th day of the month and was the 26th flight for the base that month.
- Interviews with pilots and medical crewmembers also revealed an expectation from Survival Flight management to depart from the helipad within 7 minutes of receiving a call for a flight. At Base 14, the base from which the accident helicopter departed, the departure timeframe included a drive from the housing area to the helicopter pad; at other bases, the timeframe included walking from the housing area to the helicopters. While pilots reported it was possible to depart within 7 minutes if all conditions were normal, additional time was sometimes required to prepare for the flight. The director of safety and training also stated the 7-minute expectation was not realistic if pilots needed to complete a weather check; this expectation also did not allow enough time for a comprehensive preflight risk assessment to be performed. That the evening shift pilot prepared the helicopter for the accident flight and that neither he nor the accident pilot performed a comprehensive weather evaluation or a preflight risk assessment suggest that the pilots likely felt pressured to meet the 7-minute timeframe for takeoff.
- According to the Survival Flight general operations manual (GOM), at the time of shift change, outgoing and incoming pilots were expected to conduct a shift change briefing consisting of helicopter status, anticipated flights, safety updates, schedule changes, and any other information deemed necessary. However, no documented shift change procedures were performed before the accident flight; because the accident pilot boarded the already-started helicopter when she arrived for her shift, it is unlikely a shift change procedure was performed, and she may have agreed to the flight based on her trust of the outgoing pilot’s risk assessment. Additionally, no guidance was in place for pilots to determine who should take the flight if a flight request came in around the time of a shift change. In the case of the accident flight, this lack of guidance allowed for an outgoing pilot to accept a flight on behalf of an incoming pilot.
Based on the above, the NTSB concluded that, “Survival Flight’s inconsistent compliance with standard operating procedures and regulations, combined with management’s procedural gaps in risk management, advertising of flights in lower weather minimums, pressure to complete flights, and punitive repercussions for safety decisions, were indicative of a poor safety culture at the company. The NTSB also concluded that Survival Flight’s poor safety culture likely influenced the accident pilot’s decision to conduct the accident flight without a shift change briefing, including an adequate preflight risk assessment.”
This was a textbook organizational accident (due to latent organizational failures). The stage was set for an accident waiting to happen. And on January 29, 2019, the pilot was the ‘trigger puller’ who enabled that accident to happen (committed the unsafe act). This is depicted graphically in the following figure:
Figure 1. The Swiss Cheese Model.
As you can see from the figure above, on the day of the accident, the holes in the Swiss Cheese lined up, allowing the trajectory for the accident to occur. It is important to understand that although the pilot committed the active failure, the apportionment of culpability extends upward on the organizational chart, all the way to the very top.
A formal safety management system (SMS) helps to ensure that safety is driven from the top. According to the NTSB, “Although the DO stated Survival Flight had an SMS program, no documentation existed to corroborate this statement. Additionally, Survival Flight’s operation was not consistent with defined and industry-recognized components of an SMS. For example, while a healthy safety policy establishes senior management’s commitment to continually improving safety, Survival Flight’s management’s behavior toward safety decisions elevated and reinforced operational performance over safety (see Figures 2 and 3 below). Although the company had a defined structure for safety personnel and designated safety representatives at each base, safety initiatives were driven from the bottom up and not reinforced from above. The tenuous reporting culture at the company was symptomatic of this dichotomy.”
Figure 2. The Management Dilemma (ICAO Doc 9859).
Figure 3. Production/Protection Scales (ICAO Doc 9859).
As mentioned above, Survival Flight’s management’s behavior toward safety decisions elevated and reinforced operational performance over safety. Figure 3 shows what can happen when the scale is weighted too heavily on operational performance. If there is too much emphasis on production [operational performance], a company is much more likely to have an accident. On the other hand, if there is too much emphasis on protection, a company could go bankrupt. Needless to say, this very rarely happens. Companies must strive to keep the scale balanced, as shown in Figure 2.
Survival Flight’s scale was weighted too heavily on production. When this happens, it is nearly impossible to achieve—and/or sustain—a healthy safety culture, let alone a just culture. A just culture is a culture in which employees are encouraged to provide safety-related information, typically through a formal, confidential reporting system. This type of culture also promotes safety by acknowledging "to err is human," and errors will always occur. However, some of these errors should not be addressed by retribution to the employee, when in fact the system itself might be flawed.
The same principle applies to an SMS. It will be very difficult, if not impossible, to implement—and/or sustain—a functional SMS when management’s only concern is productivity, with little to no interest in safety. Sure, Survival Flight claimed it had an SMS. But it didn’t. Just like so many other companies that falsely claim they have an SMS, it often comes down to a misunderstanding of what a formal SMS really is. The company might think that just because it follows the regulations and checks compliance audit boxes, it has an SMS. More disturbingly, for some companies, their SMS is nothing more than a book that sits on a shelf. Needless to say, without a healthy safety culture and a formal SMS, the company will be more susceptible to incidents and accidents. Survival Flight, lacking a healthy safety culture and an SMS, created numerous safety issues at the operational level of the company. These issues were bulleted earlier and reiterated in summary as follows:
- Employees were afraid to report safety issues for fear of retribution.
- Management would challenge red risk assessments; in one situation, the DO asked a pilot, “Why are you red... that’s not the way we do things.”
- Management pressured personnel to accept flights by telling hospitals they would fly in weather that other operators would not fly in.
- There was pressure to accept flights by offering rewards if pilots conducted 30 flights in 1 month.
- Management expected pilots to depart from the helipad within 7 minutes of receiving a call for a flight. This was not realistic if pilots needed to complete a weather check and conduct a comprehensive preflight risk assessment. The accident pilots did not perform a comprehensive weather evaluation or a preflight risk assessment, suggesting that the pilots likely felt pressured to meet the 7-minute timeframe for takeoff.
- There were also issues with shift turnovers. At the time of shift change, outgoing and incoming pilots were expected to conduct a shift change briefing. However, no documented shift change procedures were performed before the accident flight.
There was unmitigated operational pressure. Employees could not communicate safety concerns to management. These factors, among many others, led to the accident. The accident was simply the breaking point for a company that clearly put profit over safety and falsely believed that it could continue to operate in that mode without having an accident.
Since the accident, I’m sure Survival Flight has made significant changes in its approach to safety. The accident was a “wake-up call” and, reactively, the company had to fix the numerous problems plaguing its approach to safety. If the company had been more proactive toward safety, this accident would not have happened. There would have been defenses in place. There would have been safety communication, rather than suppression. There would have been a healthy safety culture. There would have been a functional SMS in place. I could go on and on.
Yes, HEMS operators operate in an already risky environment. But that’s all the more reason why these companies need to have a healthy safety culture and a formal safety management process. The pilot was trying to save a life on the day of the accident. Unfortunately, due to the confluence of upstream organizational failures, she lost her own life, along with the flight nurse and flight paramedic.
Download this article