http://scsi-inc.com/ The Southern California Safety Institute - Blog RSS Feed 2.0 en-us Tue, 07 Apr 2026 11:19:20 GMT Tue, 07 Apr 2026 11:19:20 GMT http://scsi-inc.com/blog/16289/Safety-Management-Systems blog Do You Really Need a Risk Matrix? Risk matrices are widely used across aviation to visually evaluate and prioritize risk by plotting likelihood (probability) against severity (consequence). Their intended purpose is to help organizations manage limited resources, focus attention on the most critical hazards, improve decision-making, and support effective mitigation strategies. However, many organizations rarely pause to ask a more fundamental question: what decision is the risk matrix actually informing—and does it do so reliably? More importantly, do risk matrices answer the questions safety managers are routinely asked to justify? Should we spend $1,000,000 to move this risk from "yellow" to "green"? Are our existing controls actually effective? Is this level of risk acceptable in relation to our safety objectives? If we invest $X, should we reasonably expect risk to be reduced—and by how much? In practice, risk matrices answer none of these questions. The Problem with Conventional Risk Matrices A substantial body of literature suggests that traditional approaches to risk assessment—particularly qualitative risk matrices—can degrade decision-making rather than improve it. The lack of quantitative rigor, heavy reliance on subjective judgment, and the intuitive appeal of color-coded boxes create the illusion of risk control without providing meaningful decision support. A key weakness is the over-reliance on Subject Matter Experts (SMEs) to estimate likelihood. While SMEs possess essential operational knowledge, expertise alone does not guarantee accurate probability estimates. Research consistently shows that human judgment is vulnerable to cognitive biases such as overconfidence, anchoring, and excessive focus on recent or vivid events. Compounding this issue, SMEs are rarely given feedback on the accuracy of past estimates. Without structured feedback loops, estimates do not improve over time—an outcome that directly undermines the SMS principle of continuous improvement. Without structured analytical tools, data, and training in cognitive bias awareness, SME input becomes inconsistent and unreliable as the primary basis for risk assessment. The Illusion of Communication Risk matrices also create an "illusion of communication." Numerous studies demonstrate that commonly used likelihood terms—such as unlikely, possible, or likely—are interpreted very differently by different individuals. Ask three safety professionals what "likely" means in numerical terms, and you will receive three different answers. When risk categories lack shared quantitative meaning, discussions about risk acceptance, prioritization, and mitigation become subjective and internally inconsistent. Why Risk Matrices Fall Short in SMS From an SMS perspective, risk matrices fail in several critical ways: They provide only a snapshot in time, not a dynamic view of risk. Likelihood estimates are highly unstable and rarely validated. They offer no direct feedback on control effectiveness. They do not clearly show which organizational objectives are at risk. They do not support determinations of whether risk is acceptable or reasonably reduced. In short, risk matrices may satisfy a procedural requirement, but they do not support robust safety assurance or evidence-based decision-making. Moving Beyond the Matrix So what should safety managers use instead? Improve estimation quality Train those involved in risk assessment to express uncertainty more precisely. Define likelihood terms quantitatively and explicitly account for control effectiveness rather than assuming it. Use quantitative decision-support tools Simple quantitative tools can dramatically improve insight. Monte Carlo analysis, as described in Doug Hubbard's The Failure of Risk Management, can be implemented using Excel and provides far more actionable information than qualitative scoring. Other effective methodologies include: Decision Trees Failure Mode and Effects Analysis (FMEA) Think Reliability's Cause Mapping  These tools support both hazard identification and risk quantification in ways that align with SMS principles. Measure control effectiveness Effective controls reduce risk—but only if they actually work. Control effectiveness cannot be assumed; it must be measured. The SMICG pamphlet Measuring Safety Performance – Guidelines for Service Providers provides practical guidance for developing safety performance indicators linked to controls. The Design, Implementation, Monitoring, and Evaluation (DIME) framework developed by Applied Mental Health Research Group is another valuable tool for assessing whether controls are producing the intended safety outcomes.   Final Thought If the goal of SMS is informed decision-making and continuous improvement, safety managers must move beyond reliance on simplistic risk matrices. Data-driven methods, structured analysis, and measurable controls provide far better insight into actual risk exposure. Risk management should illuminate decisions—not conceal uncertainty behind a grid of colored squares.   Mon, 09 Feb 2026 06:00:00 GMT http://scsi-inc.com/blog/16289/Safety-Management-Systems http://scsi-inc.com/blog/16091/Thinking-Like-An-Accident-Investigator blog When an aircraft accident occurs, a pilot's first impulse is to speculate on what went wrong. Read Full Article Fri, 12 Dec 2025 06:00:00 GMT http://scsi-inc.com/blog/16091/Thinking-Like-An-Accident-Investigator http://scsi-inc.com/blog/15645/Determining-Propeller-Blade-Angle-at-Impact blog When accident investigators examine a crash scene, one of the most important tasks is reconstructing the power condition of the engines. For constant-speed propellers, this often involves determining the blade angle at impact. Careful examination of the propeller hub can reveal witness marks—physical traces left during sudden deceleration—that help investigators answer crucial questions about flight performance and engine operation. Step 1: Removal and Initial Examination The process begins with the removal of the propeller hub from the engine. Once disassembled (under the watchful eye of a subject matter expert- there are springs that hold tremendous energy within the hub) investigators inspect the preload plate, blade pins, and pitch-change forks. These components often show evidence of high-force contact during impact, leaving behind telltale markings. Step 2: Identifying Witness Marks Witness marks may appear as smears, indentations, or scoring. They can be found on: The butt ends of the propeller blades, where the pins press into the preload plate. The hub yoke or fork bumpers, which arrest blade motion. The preload plate surface, where heavy contact occurs. Each mark provides a snapshot of the blade's pitch position at impact.     Step 3: Measuring with a Protractor To interpret these marks, investigators use a blade-angle protractor (such as the Hartzell BST-2960-3). The tool is aligned with a hub reference—commonly the split line or a designated cutout. The angular position of the witness mark is then read directly.   Preload plate with visible witness marks and a protractor aligned to hub reference. Step 4: Interpretation Determining blade angle helps investigators establish whether: The engine was producing power at impact. The propellers were in a low-pitch (takeoff/climb) or high-pitch (cruise) setting. Asymmetrical blade positions may have contributed to loss of control. This information provides critical context for reconstructing the aircraft's final moments. Conclusion By removing the hub, locating witness marks, and applying calibrated protractor measurements, investigators can accurately determine propeller blade angle at impact. These findings are essential for understanding engine performance and pilot actions during the accident sequence and should be combined with corroborating evidence from other components. At Southern California Safety Institute, we use these techniques in training to give investigators and safety professionals the hands-on skills needed for accurate accident investigation and reconstruction.   Mon, 08 Sep 2025 06:00:00 GMT http://scsi-inc.com/blog/15645/Determining-Propeller-Blade-Angle-at-Impact http://scsi-inc.com/blog/15550/Loss-of-Translational-Lift-in-High-Density-Altitude-Landings blog .blog-detail-image.img-fluid.w-100 { float: none !important; width: 100% !important; max-width: 100% !important; margin: 0 0 1rem 0 !important; } @media(min-width: 768px){ .blog-detail-image.img-fluid.w-100 { float: right !important; width: 350px !important; max-width: 55% !important; margin: 0 0 1rem 1rem !important; } } At the Southern California Safety Institute, we train helicopter accident investigators and pilots to recognize hazards before they become accidents. One such hazard—often underestimated—is the loss of effective translational lift (ETL) during landing in high density altitude conditions. This aerodynamic phenomenon has caused numerous helicopter crashes in mountainous and hot-weather environments. What Is Effective Translational Lift? Helicopter rotors are more efficient in forward flight than in a hover. As a helicopter accelerates through roughly 16–24 knots of airspeed, the rotor disc moves into undisturbed air, creating effective translational lift. This increased efficiency reduces the power required to hover and improves control. When airspeed drops below the ETL threshold—such as during final approach and landing—rotor efficiency decreases sharply. Power demand rises quickly, and if conditions are already challenging, the helicopter may not have the available power to maintain altitude. Why High Density Altitude Makes It Worse High density altitude—caused by hot temperatures, high elevation, and humidity—reduces air density. This has three major aerodynamic consequences for helicopters: Less rotor lift at the same blade pitch. Reduced engine power output due to less oxygen. Smaller power margins between available and required power. At high density altitude, losing ETL during landing can demand more power than the helicopter can deliver. The result? A rapid, unexpected sink rate just feet above the ground. The Accident Scenario Consider a helicopter at maximum gross weight approaching a confined landing zone in the mountains on a warm afternoon (like in the video). As the pilot decelerates through ETL to a hover, rotor efficiency drops. The pilot raises collective to maintain altitude, but the engine—already near maximum power—cannot keep up. Rotor RPM decays, lift collapses, and the helicopter settles with power. With no altitude to recover, a hard landing or rollover can occur—sometimes with fatal consequences. Prevention and Safety Training Avoiding ETL-related accidents in high density altitude environments requires training, planning, and situational awareness: Pre-Flight Performance Calculations – Use helicopter performance charts to determine power margins at the forecast density altitude and weight. Approach Technique – Maintain forward airspeed and ETL as long as possible before committing to a hover. Weight Reduction – Remove non-essential cargo or passengers to improve performance. Landing Site Choice – Use running or rolling landings when terrain and conditions allow, minimizing hover time. Safety Takeaway Loss of ETL at high density altitude is a common threat to helicopter safety, often unfolding within seconds during landing. Understanding rotor aerodynamics, performing accurate performance planning, and applying proven approach techniques can mean the difference between a safe arrival and a helicopter accident investigation. At the Southern California Safety Institute, we specialize in helicopter accident investigation training and safety education to help pilots and operators prevent such tragedies.   Mon, 25 Aug 2025 06:00:00 GMT http://scsi-inc.com/blog/15550/Loss-of-Translational-Lift-in-High-Density-Altitude-Landings http://scsi-inc.com/blog/14559/A-twin-tail-tale blog One of my favorite engine programs was the TF30 Navy engines for the F14 Twin Tail Tomcat. I had an amazing career.. right place, right time, and most importantly the right people. I thank you all.  Recently a friend commented to me about which aircraft I was referring to.  I realized that there are those that may read this story and not remember the Grumman F14 Tomcat. I've included a picture to assist.  To further help, it's the real star of the first Top Gun movie, not Tom Cruise and the hero of the Top Gun Maverick movie.   When you look at the Grumman pictures of the emblem the Tomcat always has two tails. Grumman built great aircraft. Their solid designs carried naval aviators to many victories that made significant contributions to defend not only U.S. troops but defenders of many nations during the second World War. Following those traditions the F14 was an amazing airplane.   Way better than it was portrayed by its detractors. (By the way, the threat imposed by U.S. fighters/ bombers to enemies of true Americans can be seen directly by how the communists in our congress limit the production of formidable deterrents.  As a bit of historical aside, the F14 had originally been scheduled for a higher thrust version of the Pratt&Whitney F100 engine designated the F401. It was a 28000 lb thrust class designation where the F100 initially for the F15 was a 25000 lb. thrust class designation.  Testing on the F401 at the Pratt&Whitney Florida Research and Development Center (FRDC) in the swamplands of West Palm Beach Florida was not proceeding well.  The increase in power required was proving a bit tricky and one of the main issues was the second stage turbine disk. The engine kept shedding this disk. There were stories of these disks being thrown across the test area and into the parking lot.  One story was about how a guard at the post to enter the secured area once instinctively put out his foot to stop a glowing hot, liberated 2nd disk as it sped past him. Lucky for him he missed. Not that the original F100 program was without it's faults, but maybe a subject for another time. The U.S. Navy grew impatient that the F401 had not yet passed its PFRT (Pre Flight Rating Test) which would allow the engine to proceed to flight test.  The aircraft was proceeding at a better pace and Pratt&Whitney was placed in a bad situation.   Sort of luckily, Pratt&Whitney was working with the USAF on another project, a swing wing bomber concept the F111.  More stories here for another time.  Pratt&Whitney offered to adapt one of the USAF engines to fit into the F14 until such time the F401 was ready for flight test.  These engines were the famous, or maybe infamous TF30's.  The TF30 family were the world's first Afterburning Turbofan jet engines incorporated into fighter/bombers.  Without a little research,  I'm not positive which TF30 engine was the origin of the F14 engine though initially the TF30 was built in several models, the TF30-P-3, -7 and -9 and eventually the P111 in USAF F111's, though the internal design favored that the F14 TF30 came from the P3,7 or 9 family because the P111 family had an entirely different turbine design.  The TF30 also served admirably with the RAAF (Australia) and strangely Iran. Where they once again show up to save the day in Top Gun Maverick.  At one time Yugoslavia was in line to acquire some, but that never transpired. Maybe someday I can coax that story from the only person I know that may remember.  And there was also a non afterburning version the TF30-P-408 that flew in the USN Corsair. I do ramble here but lots of history rattling around in this head. So back to the original story.  About midway in the TF30's life in the F14, after an engine model upgrade from the P412A to the P414A I was tasked along with my senior engineer to make some "environmental " changes.  Working with the design engineers we came up with some ideas and went about the decision process to pick the best candidate.   From there we turned the designers loose and as they drew up the designs for the hardware changes Rich and I worked on the test plan to verify we could do what the customer requested.  Here's the story related to us, and maybe embellished a tiny bit by my imagination, but probably pretty accurate.  From this point, please try to visualize these events as humorous.   Try and set aside the fact we're dealing with multimillion dollar assets and human lives. And feel free to laugh as no one was harmed during these tests. These occurrences all happened before the U.S.N. came to Pratt&Whitney to request assistance.  The issue:  the EPA got wind of the fact that fighter jets (and at the time, most commercial jet engines were equipped with a device called a P&D valve (pressurization and dump valve.). In its simplest explanation, when you go to start the jet engine, a valve closes allowing the fuel pump to supply fuel to the engine manifold and in turn the combustion chamber. This is the P in the P&D valve. The engine starts and runs for however long is required and then the engine is shutdown.   In the P&D Era, as soon as the fuel pump stops supplying pressure the P&D valve shuttles over to the dump side and allows all the fuel still trapped in the fuel manifolds to vent into drain manifolds then to discharge over board.  (read on the ground) this caused environmentalists all over the planet to explode. The Navy was told to cease and desist.  (Always remember those communist threatening American's security)  Take a moment to digest this,while the U.S. Navy operates places other than a carrier, let's concentrate here. So every jet the Navy operates at sea now has to worry not about threats to our lives but that a cup or so of fuel dumped on deck was going to be a huge threat.  Never mind that the fuel coming out is hot and it evaporates quickly, is coming out of a machine that was burning thousands of pounds per hour of this very substance and maybe there's a cup or so being expelled.  Forget the fact that any fuel that was on the deck evaporated, or the deck was hundreds or thousands of miles from the nearest snail darter, and don't jump me I value nature as much or more that many, but seriously, people that are thinking up such things certainly do give credence to Mel Brooks line "Gentlemen we have to protect your phony baloney jobs." I step off my soapbox.  That this came about put money in several people's pockets.  So the Navy, given orders to STOP dumping that fuel, set about performing that task. While this was a general order, we concentrate on the F14Tomcat. First. The Tomcat is a pretty squat cat when sitting on the deck.  The average person needs to get pretty close to the ground to be able to get under the bottom of the engine nacelles where the gang drains are.  For the uninitiated gang drain manifolds all connect to a central location at or near the bottom of the aircraft these gang manifolds connect to fuel,oil,hydraulic locations around the engine to provide overboard venting to volatile fluids that weep or leak out of a location on the engine. Why? You dont want hot flammable vapors trapped inside an aircraft nacelle.  Ok folks, imagination hats on. First attempt:  F14 returning from mission. Catches the wire stops, drops wire and taxi's off to the side, engines still running.  Deck hand, fresh with new orders to catch fuel before it dribbles out on the deck grabs a bucket, squats low snd runs under running F14, places bucket under gang drain and pilot given order to shut engine 1 down, remember the other engine is still running. By now the combined engines running have spewed more fumes into the air than the dumped fuel would have contributed to planetary demise, but orders are orders, they don't have to make sense.  The pilot shuts down the number one engine and the hot fuel runs into the plastic bucket, melts through and now there's a puddle of melted plastic and fuel on the deck. Feel free to giggle.  That test was a bust..... but undeterred and under orders the U.S.N perseveres. This time they find a metal bucket....no melting through this time. Same as first attempt, jet taxis over to spot where deckhand is awaiting with metal bucket. The deckhand squats to get under the spot in the nacelle where the hot fuel will be dispersed, positions the bucket in preparation for engine shutdown. Another factoid here. The fuel the Navy used at the time was JP5.  Near pure kerosene with some lubricity additives.  It has a flash point of 150 degrees Fahrenheit.  This is to be as safe a fuel as possible aboard ship. Compared to old JP4, approximately 50% gasoline with a flash point of -40 degrees.  Thing is, the JP5 has run through the fuel pump and into the diffuser area of the engine where temperatures regularly exceed flash point temps. The pilot cancels engine number one, the hot fuel. A mixture of liquid fuel and fuel vapor pour into the ungrounded metal bucket and a static spark jump igniting the vapor. A very cool headed deckhand comes running out from under the mulit million dollar aircraft, pail in hands bucket flaming away. Pratt&Whitney given contract to fix the fuel dumping. And so my little saga begins.  Again, feel free to laugh. No one harmed in this part of the story either. Back at the ranch a plan was devised to isolate the overboard drain pipes. There were two because there was primary and secondary fuel supplies.  The test team consisted of two engine operators (these were union guys, I NEVER touched the test stand controls in my 40+ years at Pratt) And on this day there were two test engineers, my Senior engineer Rich and myself.  Rich was an avid skydiver at this point of his life and he was laid up due to a base jumping incident a few weeks before.  He and other skydiving aficioanados had flown from South Florida to West Virginia in his airplane to base jump from the New River Gorge Bridge.  The state opens the bridge once a year for adrenaline junkies to plunge into the gorge between two mountains.  All had been going well for the group when Rich decided he had enough time for one more jump.  ImI'm not an expert on skydiving, I did make a tandem jump with Rich out of a hot air balloon but different story. I lived, but not by much.... here's what I remember.  It's this open span bridge with a lot of clear space below it and nearly a thousand feet to the river.  There are rescue people and boats in case you miss this little gravel bar next to the river. That your target landing spot.  There are steep wooded slopes on either bank and a rail line ( this becomes important) on the right slope as you look down stream. Rich repacks hie parachute, iI think it was his 3rd or 4th of the day.  He's usually very attention to detail, so maybe he was rushing to get in this last jump, maybe he was tired from the long flight up in a Cessna 182, who knows, if he did he wasn't telling. He takes his place in line, steps up then off into empty space, throwing out the drogue chute that begins the parachute opening process.  This is done to expedite the process since he was so close to impacting the planet.  All goes well, initially.  The drogue pulls out the main canopy it unfurls and opens.... 180 degrees opposite from where he expected it.  Now as the earth continues its unrelenting approach he's facing upstream away from the gravel bar. As landing in the river starts to become a realization, he notices what may be another option. He steers towards the new location that turns out to be the railroad tracks and gravel road bed. Time has run out, decisions have been made, as he lands one of his feet(I forget which one) makes hard contact with the steel rail causing a bone in his foot to break. Next point, he was the only pilot in the group.  The break was internal the medics could do little for him on site and he was forced to fly this group from West Virginia to West Palm Beach Florida. He was a hurting puppy.  I include this because while we were both in the control room, Rich was occupying a corner seat, in a cast, leg elevated and was relegated to running through the steps in the program.  Since we had effectively blocked off the drain manifold, note this had to be accomplished as a temporary condition so we could return the engine to normal. The drains on the test cell were plumbed to an actual drain system. That said, during these qualifications no fuel would actually drain.  As we were at a testing facility a lot of connections were geared for testing, resulting in conditions different from actual engine configurations when installed in an aircraft.  One of the differences was our ignition system had been connected to individual switches so we could simulate different scenarios. Both systems activated, the way an actual engine configuration worked, left ignitor on right off and right ignitor on left off, these simulated a normally functioning system or two scenarios where the ignition system experienced problems.  Our initial tests started with normal starts and shutdowns.  We had accumulator bottles to check the drains to make sure nothing was leaking. These tests were as expected. The engine started. We then we performed a series of cold flows to simulate the engine having difficulty starting.  A cold flow is where the engine rotates on the starter and the throttle is opened but the ignition is in the off position.  Typically this is performed at the beginning of an engine test after overhaul or major maintenance to purge the air from the fuel system. Again, with both ignition systems functioning starts were sluggish but normal with no hung or hot start events. Likewise the engine started a little slow on a single ignitor which we contributed to propagation of the flame around the 8 burner cans because with one ignitor the flames only had one way to go to get to all the cans.  Annular burners don't experience this.  Our outdoor Florida test stands had to be equipped with noise suppressors, giant mufflers where the engines could vent their noise and not enrage the neighbors.  This had gotten worse as civilization encroached on our island in the swamp. Our engine was poised in front of one of these noise suppressors a 60 ft long 10 ft diameter tube connected to a large metal box and a 90 degree deflector to turn the noise skyward.  We cold flowed the engine three times in accordance with what the Navy told us was how they conducted unsuccessful engine starts. Motored the engine on the starter for 90 seconds with fuel flowing. This created a fuel fog that flowed out of the engine nozzle and down into the noise suppressor tube. After the third attempt fuel was dripping out all over the engine.  At 90 seconds I gave the order to turn on the single ignitor.  Nothing happened, the engine continued to fog fuel down into the tube with no indication it was going to light. After maybe a minute I turned to Rich, I think to say I guess it's not going to light. Just then the control room filled with an eerie orange light, Rich's eyes grew wide as all he could see from his seat was that everything outside the control room window was orange. I quickly turned back toward the window to see the entire suppressor lit up in flames with fire coming out the vertical section. I looked quickly at the instrumentation readouts, expecting to make a callout to shut the engine down and turn on fire suppression but to my amazement the engine was running at idle with all parameters normal. We continued the remainder of the test program, wrote a report and passed the engineering change on to the USN for incorporation.  Just a day in the life..... And if you want to learn about jet engines from someone who has been there, check out my Gas Turbine Accident Investigation course at Southern California Safety Institute, scsi-inc.com held in Redondo Beach California or arrangements can be made for me to teach at your location.    Mon, 27 Jan 2025 06:00:00 GMT http://scsi-inc.com/blog/14559/A-twin-tail-tale http://scsi-inc.com/blog/14161/2025-European-Course-Series blog From June 16 to July 18 2025, SCSI will hold its annual European course series in Vienna, Austria. REGISTRATIONS RECEIVED PRIOR TO JANUARY 1, 2025 WILL ENJOY A 20% DISCOUNT ON COURSE TUITION Courses offered will be: Aircraft Accident Investigation ( June 16-27) Human Factors in Accident investigation (June 30-July 4) Safety Management Systems- Complete (July 7-11) Unmanned Aircraft Systems (July 14-18) Training Location: Federal Ministry Republic of Austria, Radetzkystraße 2, 1030 Vienna. The facility is located in central Vienna and within walking distance to many affordable hotels, restaurants, and attractions. For more course information and to register, visit our page at https://scsi-inc.com/Europe-Courses   Mon, 11 Nov 2024 06:00:00 GMT http://scsi-inc.com/blog/14161/2025-European-Course-Series http://scsi-inc.com/blog/6181/SCSI-training-to-the-Nigerian-Press-Corps blog The Southern California Safety Institute provided aircraft investigation and aviation human factors training to the Nigerian Press Corps. The purpose of the training was to educate Nigerian journalists into the process, methodology and challenges an aircraft accident investigator faces.  Wed, 07 Apr 2021 06:00:00 GMT http://scsi-inc.com/blog/6181/SCSI-training-to-the-Nigerian-Press-Corps http://scsi-inc.com/userfiles/1952/images/scsi%2Ejpg http://scsi-inc.com/ http://scsi-inc.com/blog/993/Course-raffle-winner- blog The winner of this year's CHC Safety and Quality Summit in Dallas for the "SCSI Course Program" drawing is Mr. David Benyair with Seneca. Congratulations, David!  David will be able to complete all required and elective courses for either our Safety Management Systems or Aircraft Accident Investigation Certificate Program. Mr. Benyair is the Quality and Safety Officer for Seneca College School of Aviation and former line manager at Bombardier Aerospace within the Approved Maintenance Organization. He also acted as the quality assurance manager and worked with Bombardiers SMS. He also worked at Pratt & Whitney Canada,  as a supervisor in both experimental test and production of jet engines. He is a commercial pilot and flight instructor and spent nine years as an aero engine technician within BAMEO, in the Canadian Air Force.   Wed, 16 Oct 2019 06:00:00 GMT http://scsi-inc.com/blog/993/Course-raffle-winner-