Gulfstream’s Culture of Safety

On the very first page of the briefing package and flight test cards that describe each maneuver in detail is a declaration of the risk involved in the flight. Details of the risk are described in the following "test safety hazard analysis" page. The TSHA, as Gulfstream calls it, is a brutally honest analysis of what could go wrong with the machine or the people flying it.

For my recent flight to see the new Gulfstream synthetic vision and enhanced vision system in action (see related article), the flight was declared to be "medium/low" risk, and the TSHA summary of the risk involved the enhanced ground proximity warning system and terrain.

The mission was to fly to Asheville, North Carolina, to see the new safety equipment in action in the dark and then again after the sun came up. It would not be a standard flight because we would actually fly at terrain and obstructions to experience the warnings the new system provided.

The safety analysis is based on FAA guidance provided in Order 4040.26A and FAA Advisory Circular 25-23. The "hazard" of this flight was as blunt as possible - "injury to the crew, damage to the aircraft structure." That certainly summed it up.

The causes of a potential hazard were: Loss of the ground proximity warning function. Unannunciated failure of the warning and caution alerts. False warning or cautions of terrain hazards. And hazardous or misleading information from the system.

The "effect" of these possible causes would be "no warning to flight crew of possible controlled flight into terrain situation, and the potential for unnecessary PULL UP maneuvers."

Now that the hazards had been identified and detailed, what would the Gulfstream test team do to prevent or minimize the risks? The first action would be a thorough preflight briefing covering all maneuvers and familiarization with the geographic area to be used. The briefing would also familiarize the crew with the airport environment, surrounding terrain and so on. The possibly hazardous flight toward terrain tests could only be done in daylight VFR conditions, and the pilots were familiar with the test site and EGPWS testing.

Finally, to minimize risk, the tests would be conducted with a third pilot or observer in the observer's station to serve as a monitor for approaching terrain and/or obstacles.

This test safety hazard analysis sheet was then approved and signed by the Gulfstream engineer in charge of the program, the test conductor and coordinator, the manager of flight test engineering and the test pilot who would command the flight.

All of this care and attention to safety detail was done for a flight in a mature G450 with the experimental equipment being display formats on one side of the cockpit. That equipment had been flown by the FAA, and final signoff was expected within days. But when you establish a culture of safety, consistency is essential. This flight went through the same safety analysis and approval system that every flight undergoes, whether it be tests with obvious risks such as the first stalls of a newly designed airplane, or something benign such as testing a new airborne telephone, which was in fact part of the test flight I made.

All of the major jet makers have similar procedures in their flight test departments. The stakes in developing new jet airplanes, and the equipment for them, are extremely high, and risks must be minimized. But the culture of safety that begins in the experimental test flight department also permeates the entire company, particularly at Gulfstream.

Gulfstream has been the first business jet maker to embrace almost every safety technology, including autothrottles, electronic primary flight displays, comprehensive flight management systems, collision avoidance equipment, ground proximity warning systems, head-up displays and, most recently, enhanced and synthetic vision displays. Many of the concepts, and certainly the actual development of new safety systems, originate within the Gulfstream flight test and engineering department rather than being fully developed by suppliers who then present the equipment to the company.

For example, forward-looking infrared cameras had been around in military and law enforcement use for years. And head-up displays (HUD) had also been flying in military and civilian airplanes to show pilots primary flight guidance while looking through a combining glass at the outside world. But it was Gulfstream people - primarily test pilot Gary Freeman - who recognized the value of showing an infrared image of what lies ahead of the airplane on the HUD and drove the program forward. There was no guidance from the FAA, no competitive pressure from other airplane or avionics makers to push the enhanced vision system (EVS) along through countless hours of flight testing, and who knows how many millions of dollars of expense were required. But Gulfstream management agreed the system offered enhanced safety and backed the program to certification.

The synthetic vision displayed on the PFD is another situation where Gulfstream was the only jet transport maker to press ahead with what it believes was an obvious safety improvement. Gulfstream didn't invent SVS, but it did have to create the procedures for earning approval and design the way the system functions for transport category airplanes. Test pilot Tom Horne was project pilot for SVS and led the charge in its development.

Gulfstream has built layers upon layers of warning and automation systems into its airplanes to help the crew be safer. For example, the system will automatically calculate the minimum safe speeds for approach and maneuvering at your actual weight and show them to the pilots, and then adjust the autothrottles to maintain those speeds. The new synthetic vision system gives you an accurate view of the terrain no matter what the weather. EVS allows you to see through clouds and darkness to the actual runway and any obstructions that may be on it. The PlaneView cockpit makes it easy to flight plan graphically by simply putting the cursor over the fix you are cleared to, instead of having to type in letters or numbers. And operation of all essential systems such as fuel or ice protection is automated.

The interesting thing is that most of the Gulfstream test pilots are active light airplane pilots and owners. Several have A&P mechanic's licenses, and at least a couple maintain inspection authorization (IA) to sign off annual and other aircraft inspections. These are guys - virtually all military trained - who love to fly, but understand that automated systems and warnings are the key to safety at the transport level. Automated systems free the human pilot from routine chores and allow him to focus on the big picture. The human can intervene at any time, or choose to hand fly as much as he likes, but the automated safety systems continue to work in the background ready to help. As one test pilot told me, "we try to make the Gulfstream idiot proof, but nature can always create a more resourceful idiot, so we have more work to do."

Though we can't bring the actual level of Gulfstream safety to a light airplane, any more than the test pilots can be as safe in their Barons or Cessna 210s as they are in a Gulfstream, we can adopt key elements of the culture of safety. The most important is the unvarnished realistic assessment of the risk of each flight. If we think clearly about the condition of our airplane, the weather, the airports, terrain and ourselves before each flight, we can assign a risk level and decide if it is acceptable. At Gulfstream the team declared the risk of my flight to be "medium/low" and we all agreed that was acceptable.

For our own personal flying we may find that the risk of a particular flight is not low, and may even be medium, but we may find that to be acceptable for ourselves. But everybody onboard should also sign off on that level of risk. Bottom line, a culture of safety is not avoiding all risk, but is attempting to identify each risk and then systematically decide what level is acceptable, how to minimize the risk and be consistent. At Gulfstream nothing but low risk is acceptable for a finished airplane entering its transportation mission. Only test pilots are permitted to assume any higher level of risk, and they do it with eyes wide open. All of us should look at our personal flying the same way.