Post on 08-Apr-2015
Organizational Accidentsin Aviation
Jim Reason
University of Manchester
Two kinds of accidents
Individual accidents
Organizational accidents
FrequentLimited consequences
Few or no defencesLimited causes
Slips, trips and lapsesShort ‘history’
RareWidespread consequences
Many defencesMultiple causes
Product of new technologyLong ‘history’
Two ways of looking at accidents
• The person approach: Focuses on the errors and violations of individuals. Remedial efforts directed at people at the ‘sharp end’.
• The system approach: Traces the causal factors back into the system as a whole. Remedial efforts directed at situations and organisations.
The person approach
• Since human actions are implicated in 80-90 per cent of accidents
• And human actions are perceived as under voluntary control
• And behaviour is viewed as being the least constrained factor in the prior events
• Then accidents must be due to carelessness, negligence, incompetence, recklessness, etc.
Although . . .
• Blaming individuals is emotionally satisfying and legally convenient
• It gets us nowhere
• Fallibility is part of the human condition
• You can’t change the human condition
• But you can change the conditions in which humans work
The system approach
• Accidents arise from a (usually rare) linked sequence of failures in the many defences, safeguards, barriers and controls established to protect against known hazards
• The important questions are: – How and why did the defences fail?
– What can we do to reduce the chances of a recurrence?
Hazards, losses & defences
LossesHazards
Defences
‘Hard’ defences‘Soft’ defences
The Swiss cheese model ofaccident causation
Some holes dueto active failures
Other holes due tolatent conditions
(resident ‘pathogens’)
Successive layers of defences, barriers, & safeguards
Hazards
Losses
How and why defences fail
Unsafe acts
Local workplace factors
Organisational factors
LossesHazards
Defences
Latentconditionpathways
Causes
Investigation
Types of unsafe act
• Errors– Slips, lapses and fumbles– Mistakes
• Rule-based mistakes• Knowledge-based mistakes
• Violations– Routine violations– Violations for kicks– Situational violations
Two influential accidents
• Mount Erebus, 1979: one accident, two inquiries:– Chippindale Report (‘pilot error’)
– Mahon Report (‘orchestrated litany of lies’)
• Dryden, 1989: Moshansky Report, an indictment of the entire Canadian air transport system.
Three aviation applications of the ‘Swiss cheese’ model
• Bureau of Air Safety Investigation (BASI), Canberra.
• International Civil Aviation Organization (ICAO): Amendment to Annex 13, the guide to accident investigators.
• As applied by an airline to a recent air accident in North America.
BASI
• 1n the early 1990s, BASI resolved to apply the model to all accident investigations.
• In June 1993, a small commuter aircraft crashed at Young, NSW. All died.
• The BASI report focused on the deficiencies of the regulator, the Oz CAA.
• Following a similar accident in 1994, the Oz CAA was disbanded. Replaced by CASA.
ICAO Accident Investigation Divisional Meeting (2/92)
Traditionally, investigations have been limited tothe persons directly involved. Current accidentprevention views supported the notion that additionalpreventive measures could be derived frominvestigations if management policies and organisational factors were also investigated.(excerpt from minutes)
Implemented in 8th Edition Annex 13 (1994)
The ‘Harrytown’ accident
• A modern 50-passenger glass cockpit jet aircraft hit the runway wing down on landing. Slid off and ended up in trees 2000ft away. Nine people injured.
• F/O flying. Temp -8oC. Visibility 1/8 mile. Fog, snowy, no wind. 23.47 hrs.
• Both pilots were seriously surprised.
Wing hitsground
Stall
Too low
Aircrafthandlingfeatures
Too slow
Prone to inducing ‘ground shyness’
Prone to stall wing down?
Stick pusher problems?
Poor visibility (white hole)
Inexperienced copilot (jet)assigned landing (SOPs?)
Inappropriate aircraftattitude at 100ft and below
Inadequate monitoring by Captain (SOPs)?
Delayed go-around order
= AND gates (each necessary, none sufficient)
Nose-up response to power increase?
= Causal pathways
+
+
+
+
+
Sufficient?
Leading edge contamination?
No leading edge flaps?
HARRYTOWN:SPECULATIVEEVENT TREE
Implications of event tree - 1
• Two main clusters of contributing factors:– those relating to the aircraft
– those relating to handling and flight operations
• Two main pathways for back-tracking:– to the manufacturer (not our immediate
concern)
– to flight operations and the system as a whole (the priority pathway)
Implications of event tree - 2
• The Harrytown accident involved the combination of several contributing factors that were very hard to anticipate.
• The local circumstances were such that it took very little in the way of less-than-adequate pilot performance to push the system over the edge.
• This was an ‘organizational accident’.
Pruned event tree
Prone to inducing ‘ground shyness’
Nose-up response to power increase
Poor visibility
Inexperienced co-pilot (jet)assigned landing
Problems with aircraftattitude at 100ft and below
Monitoring and cross-checking problems
Delayed go-around order
+
+
+
Aircraftfactors
Operationalfactors
TRAINING
TRAINING
TRAINING, SOPs
SOPs, HIRING, etc.
TRAINING, CHECKING
TRAINING, HIRING, SOPs
ORGANIZATIONAL ISSUES
TRAINING, SOPs
Defences that failed inHarrytown accident
Stall protectionsystem
Airmanship
Training, checking,SOPs
Hiring, placement, contracts,exposure to safe culture
Key issues for review
• Operating procedures
• Training
• Checking
• Hiring and placement of pilots
• Assimilation of new hires into airline culture
Comments on the culture
• A strong culture: Embodied in a few widely known and well understood beliefs and values.
• A safe culture: Values solidity, reliability, accuracy; proud to be ‘dull’ in the pursuit of quality and safety.
• A collective culture: No one person is indispensable, interchangeable units.
The moral
• No point replacing ‘pilot error’ attribution with ‘management error’.
• All top level decisions, even sound commercial ones, have a downside for someone, somewhere in the system at some time. All create resident pathogens.
• Challenge: to identify and rectify latent conditions before they combine to cause accidents.
Accident/incident questions
• What defences failed?• How did they fail?• Why did they fail?
– Unsafe acts?– Team factors?– Workplace factors– Technical factors?– Organizational factors?