Welcome to the doxastic safety model

Amphibious Scoopers – wrong landing gear configuration

The most repeated accident

Recently, a Fireboss landed on the runway with its gear up while fighting a fire in Coimbra, Portugal.

Over 18 years, the same organization has experienced the same accident seven times.

Three of these accidents on the water resulted in a risk to the pilot’s life.

Four were minor accidents on the runway,  where although it represents a mess for the airport and ATC,  the damage is minor, only to the bottom of the floats, similar to what we see in the following video, where a Canadair 215 goes through the same event, but going around instead of stopping.


Here are the official reports of the four reported accidents.

As for the remaining three, they were either not reported or not investigated by the accident investigation boards

Accident rates

The first question that comes to mind is:

Are 7 accidents in 18 years too many for the same organization?

Would you say yes or no?

At first glance, it appears that yes, but we need to measure accidents against flying hours in order to draw reasonable conclusions.

Analysis of aviation safety can be made more meaningful by matching accident statistics with flight hours. Fleet utilization is taken into account when calculating accident rates, which are expressed as accidents per 100,000 flight hours. Using this method, it is possible to compare one year to another accurately.

The following is an example from Safety Study NTSB/SS-01/01

Considering that there are few studies for General Aviation and Aerial Work, let’s attempt to determine the approximate number of hours flown during that period for the Fireboss fleet, to compare them with the industry average.

In firefighting, the average contract for a specific aircraft ranges from 120 to 180 hours for the season, although there are busy seasons where aircraft use extra hours – one example was 2013 in Portugal, where between 6 aircraft we counted 1195 hours, 360 sorties, and 5141 drops.

During other seasons and locations, there could be less than 100hrs / aircraft, sometimes as little as 50hrs.

Therefore, let’s shoot for 120 hrs/year on average. This also matches my personal pilot logbook, during 16 seasons as a firefighting pilot for different operators in different countries of the world.

Copyright 2021 Saab AB. A fleet of 4 Fireboss from SAAB, an operator with a different approach and currently with the best safety record

As regards the number of planes for that other specific organization that had all the landing events, they went from a couple of planes in the early days of the model, to 10-12 units operating during the busier seasons, spread between Spain, Italy, and Portugal. Therefore, an average of 8 units operating every year sounds reasonable, which at 120 hrs per year, during 18 years, brings an estimate of 17.000 hrs.

According to simple math, 7 accidents occur every 17.000 hours, resulting in 41 accidents every 100,000 hours.

Considering that those 41 would only be for one category of accidents, and there were many other events in different categories such as LOC-W (loss of control in water) during scooping, or recurrent wire strikes, as I described recently in this entry. Therefore, that 41 could easily be doubled or tripled to reach 100 accidents or more per 100,000 hours.

When we compare 41, or 100, to the 7.2 rate of general aviation more than 20 years ago, as shown in the chart above, or to the 0.27 rate of airlines (Part 121 – scheduled air carriers), we begin to understand where we stand.

The following chart from AOPA confirms that the general aviation (GA) fixed-wing safety record tends to stay between 6 and 7 per 100.000 hrs flown.

Copyright AOPA


In light of this, yes, it’s quite a lot for an organization, and it’s worth looking into.

Apples – Barrels and Hanlon’s Razor: Tracking down the root cause

The bad apple

Do you think all those pilots involved in the accidents were untrustworthy or stupid?

Having known them all, I can confirm they are far from stupid, they were among the best cohorts the organization had.

If the organizational safety culture is still to be developed, our tendency is to assume that organizations’ mega-complex systems would be perfect if not for some untrustworthy or just plain stupid people who cause procedural drifts. (Bad apple theory).

I have seen this happen.

The bad barrel

When the accident repeats over and over without an effective barrier being in place, we need to examine systemic and organizational issues.

The barrel could be rotten or in a bad state, contaminating the good -by nature- apples.

Employees of a company are not inherently ethical or unethical but rather are influenced by the corporate culture and procedures.

People don’t go to work to perform poorly or cause accidents, except for violators who should be filtered and detected during selection processes.

In the accident “Gear down for water landing 2,” the pilot was and remains a good friend. Great pilot. In the wake of the accident, he was silenced, “this shouldn’t happen”, so we were unable to learn from it.

A few years later, on “Gear down for water landing 3”, it turned out that he had also been a good friend and an excellent pilot. We were once again not in a position to learn much from it, and no significant changes were made in procedures, which meant we were still far from the root cause of the problem.

Hanlon’s razor

Why is the barrel rotten? Is there a reason why they don’t fix the issues? Is this a group of evil people?

Probably not.

The way accidents are normalized every season may have led many of us to think the showrunners are to blame. And they are to some extent, but not probably the way I envisioned.

Nowadays I still like to keep them as far as possible, but instead of believing they always act deliberately or bring a moral debate impossible to win, I would like to think, to preserve some degree of faith and drive, that we should not attribute malice to things that could be explained more adequately by ignorance (Hanlon’s razor concept).

No conspiracy, no evil.

In other words, those running the show high up in the hierarchy, have no idea what they’re doing, as we’ll see in the next point; mitigation


As mitigation after the last gear-up runway landing, they are adding extra flybys before a runway landing.

Imagine an Iberia, Air France, or American Airlines performing a routine low approach and going around to cross-check with the tower that they did not forget the gear up.

Probably not the most effective way to tackle the issue.

Before that, it was the sticker on the flaps. That was another point of the master plan.

As there is no flap indicator in the cockpit, and the flap setup is done visually, they thought that reading “Check Gear” on the flap would solve the problem.

Surprise, surprise, the idea did not work.

The procedure to check the landing gear is a memory scan flow, repeated in the form of a crosscheck between the aircraft flying in the same group. There has been no success with this system. When pilots speak, they don’t always look, and when they do, they aren’t always seeing. There is a difference between looking and seeing.

We know pilots had trouble seeing and identifying the landing gear indicator and there were recommendations from the authorities, to train them more effectively. Why would they see the sticker if the problem is not what they check but the way they perform the check?

Their approach is to use the same tools that did not work in the past to fix the symptoms.

The solution

It is called a checklist, and it has been around forever. If you are used to another type of aviation, it will seem strange that there is no checklist and everything is done by memory.

There is an inherited belief that checklists are not necessary for single-engine low-level aircraft because we don’t have time to read them.

This is true for emergency procedures, and we can even find it in the official Air Tractor literature.

However, for normal procedures, we can develop an abbreviated checklist in the form of a flip card that is easy to see and follow.

Easy to grab and flip. No excuse to not having a professional means of checking

In our operational checklist (flip card), we should determine what are the less relevant points, the killer items,  what flow makes more sense, which items should be “Read & Do”, and which ones can remain in memory. The items that must be crosschecked within a formation or group of aircraft should also be clarified.

Checklists should be brief. Overpacking will result in not being used or being vomited without proper checks.

Here is an example of a self-explanatory flip card that was implemented on a new operator, where we were able to start the operation from scratch, leaving inherited paradigms behind.

The blue is the flip card for water operations and fire. The green is the flip card for land operations when interacting with a runway.

Cut them through the middle, and you will have 2 flip cards, one for water and one for runway

This part, extracted from the flip card is of utmost importance:

It must be crystal clear how we wish to operate through the checklist, what to read and do, what to check in memory, and what to crosscheck from one aircraft to another.

The old school way of thinking is rooted in the agricultural view when aircraft were simpler and scenarios different.

Flying a single-engine air tanker locally is not the same as operating a group of amphibious scoopers overseas.

The field of human factors psychology has conducted a great deal of research on checklist design and effectiveness. A key component of human factors research is looking beyond specific technologies to the guiding principles that govern human behavior. CRM and non-technical skills play a much more substantial role, as do checklist procedures and their training.

Therefore, pilots should be trained on checklist procedures, make sure they are aware of their systems (looking but also seeing), or intentionally interrupt them so they will start over.

No checklist, it will bite you sooner than later. You are not different from all of those who bite the dust (or swallow water in this case).

Recommended related read: 

“The Checklist Manifesto” by Atul Gawande emphasizes the importance of using checklists in complex environments to improve decision-making and reduce errors. Gawande, who is a renowned surgeon, investigates how checklists, despite their apparent simplicity, have a significant impact on various fields, such as medicine, aviation, and construction. Through compelling anecdotes and research, Gawande shows how these simple tools can effectively manage complex tasks, making sure that critical steps are not overlooked and thus improving overall performance and reducing failures. The book advocates for the adoption of checklists as a practical strategy to handle the intricacies of modern life and professions, highlighting their ability to enhance performance and prevent oversights.

Soft skills – CRM

Here is an example, extracted from a competence-based program, on how to train those specific CRM items:

If during the training or the supervised real operation, the pilot gets caught speaking but not looking, or looking without awareness, not seeing things,  I am sorry but you are not competent yet.

The same thing goes for not managing to recover effectively from interruptions, distractions, variations, and failures.

There is a lot more going on than individual mistakes, as you can see.

In an organization, safety culture determines performance and results.

Once the modus operandi is well established, it’s easier for an individual to be influenced by the culture than for the wrong culture to be changed.

Let´s keep dry out there, and our keels unscratched!


Did you find the article interesting? You can share it

Share on facebook
Share on twitter
Share on linkedin
Share on pinterest
Share on whatsapp

Would you like to receive our latest articles by mail?, no problem leave us your email and we will take care of it

Responsable » Eder Navacerrada Paris
Purpose »Send you our latest articles
Legitimation »Your consent
Recipients »I will store your data in a Database managed by the Mailchimp email marketing platform located in the US and hosted by the Privacy Shield
Rights »Of course you will have the right, among others, to access, rectify, limit and delete your data, requesting it through our contact form

You may also like

Leave us your comment

Leave a comment

Responsable » Eder Navacerrada Paris
Purpose »To respond or thank you for the comment
Legitimation »Your consent
Recipients »I will store your data in the Database hosted on Raiola Networks, under the privacy laws
Rights »Of course you will have the right, among others, to access, rectify, limit and delete your data, requesting it through our contact form

Are you leaving ?, I hope you have been at ease. If you want to keep up to date with our articles, subscribe to our newsletter

Responsable » Eder Navacerrada Paris
Purpose » Send you our latest articles
Legitimation » Your consent
Recipients » I will store your data in a Database managed by the Mailchimp email marketing platform located in the US and hosted by the Privacy Shiel d
Rights »Of course you will have the right, among others, to access, rectify, limit and delete your data, requesting it through our contact form