Analyzing human error in aircraft ground damage … human error in aircraft ground damage incidents...

*Corresponding author. Fax: #1-716-645-3302.E-mail address: drury@bu!alo.edu (C.G. Drury).

International Journal of Industrial Ergonomics 26 (2000) 177}199

Analyzing human error in aircraft ground damage incidents

Caren A. Wenner, Colin G. Drury*

State University of New York at Buwalo, Department of Industrial Engineering, 342 Bell Hall, PO Box 606050, Buwalo, NY 14260, USA

Received 10 June 1997; accepted 18 February 1998

Abstract

Ground damage incidents (incidents in which airline personnel cause damage to an aircraft on the ground) occur asairline personnel are working on, or around, an aircraft on the ground, either on the ramp or at a maintenance facility.Each incident can be quite costly to the airline, with costs both tangible (repair costs and lost revenue) and intangible(passenger inconvenience, increased maintenance workload). Thus, airlines have a "nancial incentive to reduce thenumber of ground damage incidents that occur. One of the airline's most di$cult tasks has been to utilize the informationcollected in their existing error reporting systems to determine the common latent failures which contribute to typicalground damage incidents. In this study, 130 ground damage incidents from a major airline were reviewed to determinethe active and latent failures. Twelve distinct hazard patterns (representing the active failures) were identi"ed, with threehazard patterns accounting for 81% of all ground damage incidents. Nine major latent failures were identi"ed, and therelationships between the hazard patterns and latent failures were examined in depth. This type of analysis allows thelatent failures common to di!erent hazard patterns to be identi"ed, and provides a means for developing focusedintervention strategies to prevent future ground damage.

Relevance to industry

Airlines have generally had a di$cult time analyzing reports of human error to make improvements in theirmaintenance systems. This study provides a methodology that allows reports of human error to be analyzed, andinterventions developed based on the results of the analysis. The methodology would also be applicable to, and useful in,other industries. ( 2000 Elsevier Science B.V. All rights reserved.

Keywords: Aircraft ground damage; Human error analysis

1. Introduction

Since the Aloha Airlines accident in 1988,in which the failure of airline inspectors to de-tect cracks in the fuselage resulted in the aircraftsplitting apart in #ight, the aviation communityhas recognized that there are other departments,

besides #ight operations, that have a serious impacton aviation safety. Errors in maintenance opera-tions, especially, have the potential to result inserious safety problems, and/or cause an accident.However, most e!ort (by airline personnel, industryconsultants, and human factors researchers) on re-ducing errors was concentrated on improvementsto the #ight deck, and on pilot training. McDonaldand Fuller (1996a) point out that human factorse!orts on the #ight deck has been a recognizedresearch "eld for 25 yr, while e!orts on aviation

0169-8141/00/$ - see front matter ( 2000 Elsevier Science B.V. All rights reserved.PII: S 0 1 6 9 - 8 1 4 1 ( 9 9 ) 0 0 0 6 5 - 7

maintenance have only just begun. Recognizingthis shortcoming, the FAA's O$ce of AviationMedicine established a program in 1988 to funda broad range of human factors research in theairline maintenance domain.

Many projects within this program have focusedon human errors in the maintenance environment,and on how to prevent similar errors from reoccur-ring. It is widely recognized that although a largenumber of errors may occur on a regular basis, it isvery rare that a situation is elevated into a seriousincident a!ecting #ight safety. In most situations,an error is either caught immediately or the de-fenses of the maintenance system act to prevent theerror from becoming an incident. Thus, the error isprevented from propagating through the system.Mechanics are especially conscious of the impor-tance and seriousness of their work, and typicallyexpend considerable e!ort to prevent, or at leastrecognize and correct, errors that could leadto safety concerns for personnel, passengers, andequipment.

Fortunately, airlines report few maintenance-induced incidents that a!ect the safety of personneland passengers. However, ground damage, or dam-age to an aircraft caused by airline personnel whilethe aircraft is on the ground, remains a seriousproblem for most airlines, with costs in the tens ofmillions of dollars per year. Ground damage canoccur while ramp personnel are servicing an air-craft, and/or while maintenance personnel are per-forming maintenance work. In fact, ground damageincidents (GDIs) can occur at any time personnelare working on, or around, an aircraft that is on theground. This category of incident only includesdamage that is inherently preventable by airlinepersonnel on the ground: damage caused by hail,bird strikes, part failures, or even by foreign objectdamage is not considered to be ground damage,and some of these categories even have their ownseparate prevention programs.

1.1. Why is ground damage important to airlines?

Ground damage incidents are extremely costly toan airline; the total cost of an incident includes thecost of repairing the damage, as well as the lesstangible costs of keeping an aircraft out of service.

One example, documented in Airline EquipmentMaintenance (Chandler, 1995), describes a typicalAmerican Airlines ground damage incident inwhich the cost of repairing a damaged aircraft was$39,300. However, the total cost of the incident wascalculated to be $367,500 due to passenger andcargo revenue lost. In addition, there are non-tangible costs to the airline including: passengerinconvenience, a!ected #ight schedules throughoutthe entire airline system, and increased mainten-ance workload. A typical airline may have 100}200reportable GDIs each year, resulting in signi"cant"nancial losses that could be prevented.

Thus, it is obvious that airlines have a signi"cant"nancial incentive to reduce the number of GDIsthat occur. However, due to the di$culty that oftenaccompanies the calculation of the total cost ofeach GDI, airlines have not been able to quantifythe magnitude of the losses with any accuracy.In addition, airlines have had a di$cult time con-trolling these costs, since they have beenunable to pinpoint the causes of recurrent incidents(McDonald and Fuller, 1996b).

1.2. Error reporting systems

Problems in identifying causes of recurrent inci-dents are at least partially the result of inadequatemethods of collecting information about errors. Ina typical airline, errors (above a certain threshold ofseverity) are strictly monitored and recorded. Forexample, airline management may maintain strin-gent records of on-time #ight departures/arrivals,turnaround time for aircraft requiring mainten-ance, injuries to personnel, damage to aircraft andother ground equipment, and other measures thatdocument the airline's overall performance. In ad-dition, many errors (below the threshold of severityfor reporting) may be detected and correctedroutinely as part of the system with no recordskept.

Most of the error-reporting systems in use ata typical airline are maintained and utilized bydi!erent departments, and are rarely used togetherto analyze the system as a whole. But, there aremany inherent problems that may a!ect more thanone of these performance measures, and similarerrors may lead to an incident to be recorded in

178 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

di!erent error reporting systems. For example, ifa mechanic drops a wrench on his foot, the incidentwould be recorded as an OJI (on-the-job injury). Ifa mechanic drops a wrench on an aircraft, damag-ing it severely, the incident would be recorded asTechnical Operations Ground Damage. If thewrench were dropped on the aircraft, causing nodamage, the incident would not be recorded at all!Finally, if a ground operations employee dropsa wrench on an aircraft, the incident would berecorded as Ground Operations Ground Damage.In each of these scenarios, the error was exactly thesame, only the "nal consequences di!ered, in turna!ecting the way in which each of these incidents isrecorded. Without compiling information from allof these error-reporting systems, it is quite di$cultto get a full picture of the types, and frequencies, ofrecurrent errors.

The current project, as is typical of FAA O$ceof Aviation Medicine projects, was a joint e!ortbetween researchers and a partner airline. Inour partner airline, ground damage incidents arerecorded in narrative reports. In these reports, aninvestigative team produces a detailed written re-port, including: a problem statement describing theincident, a detailed description of the incident, a listof process, equipment and personnel factors thatcontributed to the incident, as well as recommen-dations for preventing this type of incident fromhappening again. The report generally includesphotographs of the damage to the aircraft as well asthe equipment that may have been involved. Also,written descriptions from all of the personnel in-volved are obtained and are included in the report.The recommendations from each GDI are sup-posed to be disseminated to all of the stations(airports where the airline has personnel) to allowother personnel to learn from the incident.

At other airlines, GDIs may be recorded using aninvestigative tool based on a checklist, or another&form' based tool. Using such a reporting method,much of the factual data of an incident is recorded(including the type of accident, the type of injury,the type of equipment being utilized, etc.), althoughthere is little (if any) opportunity to provide a de-tailed narrative description of the incident. There islittle encouragement inherent in this type of report-ing system to glean speci"c information concerning

the factors leading up to the incident, or the othersystem factors that may have contributed to theincident. However, these type of reporting systemsdo provide for quantitative tracking of error data,including such information as the number of inci-dents per month at each station, number of inci-dents occurring on each type of aircraft, etc. Theyalso allow the particular individuals responsible forthe incident to be identi"ed, and for blame to beassigned. Generally, these reporting systems areuseful to monitor trends in performance, butlittle use is made of this information to redesign thesystems that generated the errors in the "rst place.

In recent years, other error reporting systemswith explicit human factors components have beenintroduced which provide investigators with toolsto help identify latent failures that may have con-tributed to an error. Boeing's Maintenance ErrorDecision Aid (MEDA) system, and Aurora Safetyand Information Systems Inc.'s Aurora MishapManagement System are examples of current errorreporting systems which are being used by airlinesto investigate GDIs. However, airline personnel arestill having di$culty applying the information col-lected by such systems, since the information gener-ated from such systems often does not point tospeci"c interventions.

1.3. Errors vs. violations

The purpose of error reporting systems is tocollect information about an error so that the fac-tors that caused the error can be identi"ed andeliminated from the system to prevent reoccur-rence. However, it is not always easy to identifythese error-producing factors.

When an error occurs in the maintenance systemof an airline, the mechanic(s) who last worked onthe aircraft is usually considered to be at fault. Themechanic may be reprimanded, sent for furthertraining, or simply told not to make the samemistake again. However, to blame the mechanicsfor all of the errors that are committed is perhapsgiving them too much credit for their role in theairline's maintenance system. Many errors result, infact, from a combination of other failures inherentin the system and the mechanic involved is merelythe source of one of such failures, often the "nal

C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199 179

failure in a sequence (Maurino et al., 1995). In thesecases, it may not matter which mechanic is involvedat the time of the actual incident, since the systemitself encourages particular errors or violations tobe committed.

Errors, as de"ned in Maurino et al. (1995), arefailures of planned actions to achieve desired conse-quences. Errors in formulating a plan of action orin executing the plan are possible. On the otherhand, violations are willful deviations from safeoperating procedures, practices, standards, or rules.The distinction between errors and violations isespecially important in the airline maintenance en-vironment, in which mechanics are often given con-#icting goals and priorities to achieve. Mechanicsare told to be safety conscious and to followdocumented procedures, but are also pressured tokeep on schedule, and to prevent delays that are sovisible to passengers. The heavy workload at mostmaintenance stations, coupled with a limited num-ber of personnel and sub-optimal equipment, makeit di$cult for all of the e$ciency and safety goalsto be achieved simultaneously. Mechanics oftenmake a choice as to which goal is perceived by thesupervisors to be currently most important: attimes the mechanics choose e$ciency, mostwork completed in the least amount of time, oversafety considerations [essentially a speed}accuracytrade-o! (Drury, 1994)].

Mechanics must also operate under a large num-ber of rules and procedures, and it is often di$cultfor the mechanics to keep track of them all. Some ofthe procedures can describe a more di$cult way toperform a task, or may require more personnelthan is typically available. Thus, over time, certainprocedures have become routinely violated. Forexample, a towing procedure may specify that sixpeople are necessary whenever an aircraft is moved(a tug driver, a brakeman, a nose walker, a tailwalker, and two wingwalkers). However, in actual-ity, it is very di$cult to "nd six people who are nototherwise occupied every time an aircraft is moved.Thus, the tug driver may decide to move the air-craft using only a brake man and two wingwalkers,in order to prevent operational delays.

In fact, some of the newer personnel may noteven know that they are violating documented pro-cedures, since they have received only on-the-job

training for how tasks are typically performed.Over time, the routine violations may be passeddown as correct procedures to new personnel.Management and supervisors may not enforce theprocedures, since the violations are often per-formed to prevent delays and promote e$ciency.Generally, the violations do not lead to any furtherproblems, the bene"ts greatly outweigh the costs ofcommitting the violations, and management canlook the other way. Only when an incident occursdue to the violation (e.g., ground damage when anaircraft contacts a parked object due to insu$cientnumber of spotters), are the employees involvedreprimanded for their behavior and everyone isreminded to follow the procedures. Thus, althoughviolations are o$cially highly discouraged by man-agement, they are often tolerated as part of normaloperating practices.

1.4. Active and latent failures

The failures caused by those in direct contactwith the system, i.e. the mechanics that are workingon the aircraft, are considered to be active failures.Thus, active failures are errors or violations thathave a direct and immediate e!ect on the system.Generally, the mechanic himself catches the conse-quences of these active failures; or the defenses,barriers and safeguards built into the maintenancesystem act to prevent the failure from causing anincident. Thus, the system must rarely deal with theconsequences of active failures. However, when anactive failure occurs in conjunction with a breachin the defenses, a more serious incident will result(Maurino et al., 1995).

Latent failures are those failures that derive fromdecisions made by supervisors and managers whoare separated in both time and space from thephysical system. For example, technical writersmay write procedures for a task with which they arenot totally familiar; if the procedure has even onemistake in it, the mechanic using the procedure willbe encouraged to commit an error. The latent fail-ures can often be attributed to the absence or weak-nesses of defenses, barriers, and safeguards in thesystem. Latent failures may lie dormant in the sys-tem for long periods before they become apparent(Maurino et al., 1995). Fox (1992) de"nes latent


failures as those decisions made in the organizationwhich may create poor conditions, result in lessthan adequate training, poor supervision, etc.which may lie dormant for some time, but whichhave the potential to predispose active failures.

For an incident to occur, latent failures mustcombine with active failures and local triggeringevents, such as unusual system states, local environ-mental conditions, or adverse weather. There mustbe a precise &alignment' of all of the &holes' in all ofthe defensive layers in a system (Maurino et al.,1995). For example, rain may cause a mechanics'foot to be wet, allowing his foot to easily slip o!the worn brake pedal in a pushback tug when themechanic becomes distracted. The tug may thenlunge forward contacting a parked aircraft. Thelatent failure in the system is that the brake pedalhas no anti-slip surface in place, but the problemdoes not become an issue until the rainy conditions(a local trigger) cause an incident. If any one ofthese failures had not occurred (mechanic did notbecome distracted, the tarmac was not wet, or thebrake pedal was in better condition), the incidentwould have been avoided.

Traditionally, the mechanic would be blamed forthis incident, since he allowed his foot to slip o! thepedal. Clearly, the mechanic did commit this error.However, it must be noticed that mechanics arerequired to drive pushback tugs daily, and cannotcontrol the weather conditions, or even the condi-tion of the equipment. They are required to workunder strict time guidelines, and they are highlymotivated, by management and personally, to keepon schedule. Mechanics therefore, should not facesole responsibility for such incidents when theyoccur. It is important to consider all of the otherfactors that a!ect their performance, and all of theother system-wide problems that may contributeto failures.

In any system that has been operating for longenough to experience su$cient incidents, examina-tion of past occurrences makes it is possible todetermine the types of errors, violations, and latentfailures that typically have caused problems in thepast. However, in order to prevent future incidents,it is necessary to predict, identify, and remedy latentfailures that still may be lying dormant in the sys-tem. Addressing the latent problems in the system

can eliminate many of the errors and violations.Violations can be discouraged by ensuring that thecorrect way for the mechanics to perform theirtasks is also the easiest and most e$cient. Errors(which can never be totally eliminated) can be re-duced to as low a level as possible by improving orstrengthening the various defenses, barriers, andsafeguards which prevent propagation through thesystem.

2. Methodology

To prevent recurring incidents, it is necessary toidentify factors in the system which can cause er-rors. This study provides a means of identifyingsuch error-producing factors in a typical mainten-ance domain.

In this analysis, 130 Technical Operations GDIreports were analyzed, covering ground damagefrom January 1992 through April 1995. These re-ports were obtained from our partner airline. Eachreport described one GDI, and was prepared by aninvestigative team (usually at a middle manage-ment level) from the airline. Incidents analyzedin this study were based on data readily available inTechnical Operations and included all reportscompleted in 1995 up until the date the data wasobtained from the partner airline.

Initially, each GDI report was reviewed to deter-mine the speci"c action that caused the grounddamage. The reports could be sorted into twelvedistinct patterns covering almost all of the GDIreports, termed here as a Hazard Pattern afterDrury and Brill (1978).

Next, each GDI report was analyzed to deter-mine the speci"c active failures, latent failures, andlocal triggers that contributed to the incident.A scenario was then developed for each hazardpattern, illustrating the common factors betweenall of the incidents. Each of these was also sum-marized as an event tree illustrating how each of thelatent failures contributes to the "nal damageevent. This form of analysis, which has much incommon with Fault Tree Analysis, was originallydeveloped by CNRS in France (Monteau, 1977).The scenarios developed for each hazard patternare included in the next section.


2.1. GDI scenarios

2.1.1. Tools or materials contact aircraft (1.1.1)In these incidents, a piece of equipment (tools,

parts) falls onto the aircraft (or mechanic). Gener-ally, gravity is the ultimate cause of these incidents.By examining the environment in which the inci-dent occurred, and the steps in the process proceed-ing the incident, it is possible to see how othernon-obvious factors contributed to the incident.One such example is presented below.

During an engine change, a mechanic pulledout a forklift supporting an A-frame, causing theframe to fall on the aircraft. However, on furtherreview of the steps leading up to the incident, it ispossible to see how this incident came to happen.First, it was not obvious to the mechanics thatthe A-frame was top heavy and could not sup-port itself. Second, the forklift was removed inorder to facilitate disassembly of the A-frame andnose cowl sling, two pieces of equipment neces-sary for the engine change. The disassembly wasrequired because the engine change kit was miss-ing parts, requiring the mechanics to changetheir procedure while in the middle of the enginechange. Unfortunately, the missing parts werenot detected prior to beginning the procedure,since the engine change kit does not containeither an inventory or packing list for the parts tobe checked against.

Thus, although this incident was eventually blamedon the mechanic who moved the forklift, the prob-lem had its antecedents far earlier, when the enginechange kit was prepared.

Other latent failures contributing to these typesof incidents include poor communication betweenco-workers, and between shifts; inappropriatenessof available equipment for the task; inadequatespace in which to perform the task; and poor mech-anical condition of the equipment. Many of theselatent failures can all be considered to be failures ofthe workforce to become aware of the possibility ofrisks and hazards. This lack of awareness may bea failure of management to properly emphasizesafety as the "rst priority (as opposed to emphasison speed of task completion), and/or may be a

result of the mechanics' repeated performance ofsimilar tasks.

Other errors result because the equipment doesnot &behave' as the mechanics expect. For example,the engine sling does not hang level from the hoist;the overhead crane has only one speed in theEast}West direction and this speed is perceived tobe too fast; and the work platform has sagged overtime, creating a decline towards the front end. Themechanics' misperceptions of the equipment causethem to perform as they otherwise might not if theywere aware of the correct state of the equipment.For instance, a mechanic may have chosen not toplace a wheeled dolly on the work platform if hehad known it was so slanted towards the front end.

2.1.2. Workstand contacts aircraft (1.1.2)In these incidents, a workstand that is being used

to service or repair the aircraft comes in contactwith the aircraft. There are various scenarios inwhich this type of incident can occur. The mechan-ics working on the aircraft may misperceive theposition of the workstand while maneuvering inclose proximity to the aircraft. In other situations,the mechanic accidentally causes the workstand tomove in a direction that is not intended. Mechanicsmay also fail to properly con"gure (e.g., raise/lowerplatform) the workstand before moving it. Finally,in almost all of these incidents, no ground spotterwas used while moving workstands around theaircraft.

This last scenario, in which no ground spotter isused, is a routine violation of company policy. Theground equipment policy requires a spotter to beused at all times when moving equipment aroundthe aircraft. However, the unavailability of excesspersonnel, and high workloads for ground person-nel has made this requirement di$cult to follow.Since this policy is rarely enforced (except followinga ground damage incident) mechanics often feelthan they can properly maneuver the equipmentand can properly judge distances from the aircraft.

There are, however, many latent failures that canbe identi"ed as contributors to these incidents. Forexample, in some situations, the workstand hasunused metal brackets attached that cannot be seenby the workstand operator. In other situations, theequipment su!ers from a mechanical problem that


contributes to the incident (e.g., the stand jerksforward when placed in stop position, wheels donot swivel properly, design of dead man switchallows the foot to easily slip out). Furthermore,pressures to ensure on-time departures encouragethe mechanics to quickly move their workstandsinto position, without properly checking for ad-equate clearance with the aircraft.

Another contributor to this category of incidentsis the use of improper, or ill-suited, workstands toperform assigned tasks. In these situations, themechanic uses workstands (or other ground equip-ment as workstands) for purposes for which theywere not designed. The mechanic may choose touse an improper workstand because either: themaintenance station does not own the correctequipment, the correct equipment is unavailable(e.g., the correct equipment is in the shop for repairsor is being used elsewhere), or the correct equip-ment is less accessible than the incorrect equipment(e.g., the correct equipment is parked in a remotelocation). An improper workstand may o!er themechanic quicker access to the work, but maycause additional problems. Since the workstandsare not designed for the work they are doing, theyare often di$cult to correctly position without con-tacting the aircraft, and may require excessive relo-cation throughout the task is duration. Theincreased di$culty of moving the equipmentaround the aircraft, as well as the increased numberof times the position of the workstand must beadjusted increases the chances for the workstand tocontact the aircraft.

2.1.3. Ground equipment is driven into aircraft(1.1.3)

In these incidents, equipment (trucks, beltloaders, etc.) is driven by airline maintenance per-sonnel into the aircraft. The drivers either misjudgethe amount of space available, misjudge the size ofthe equipment, or in some cases, accidentally con-tinue moving forward when they know they areabout to contact the aircraft. This last type ofincident occurs when the mechanic is attempting tostop the vehicle by depressing the brake pedal, butfails to do so. All of these incidents are often at-tributed to the driver allowing his foot to slip o! thepedal. However, on closer examination, it can be

seen that this is simply an accident type waiting tohappen. Often, the ground on which the mechanicmust work is slippery, due to a combination of oil,cleaning #uids, and rain. This makes the mechanic'sfootwear slippery, and may cause his foot to slip o!the pedals while driving a vehicle. Although theseconditions are often present at many stations, thepedals in the vehicles do not all have anti-skidsurfaces. In some situations, the anti-skid surfacehas simply worn o!, and has not been replaced.Therefore, these types of incidents can be tracedback to poor vehicle maintenance.

As in the previous category of incidents (seeHazard Pattern 1.1.2), some of these incidents(ground equipment is driven into the aircraft) arefurther aided by the use of ill-suited ground equip-ment for the particular task to be performed. Forexample, in one incident, mechanics using a push-back tug as a work platform backed the tug into thed1 engine thrust reverser. Speci"cally, the highwindshield on the tug contacted the aircraft. In thissituation, the station did not have a lift that wassuitable for work in tight locations, and the workplatforms that the station does own are di$cult tolocate when needed. Additionally, in many of theseincidents, no ground spotter was used when mov-ing equipment in close proximity to the aircraft.This is a violation of a company policy that is rarelyenforced.

Many of these incidents occurred in congestedareas, where the mechanic was forced to maneuverhis vehicle through other parked ground equip-ment. Pressure to ensure on-time departures oftencauses the mechanics to take &short-cuts', instead ofwaiting for other vehicles to be moved out of thesafer path. For example, in one incident, a mech-anic drove a tug with an airstart unit attachedunder the right wing of a parked aircraft, contact-ing the aircraft. The mechanic was attempting toleave a refueling station, and all of the other exitpoints were blocked with equipment and othervehicles. The mechanic decided to take the openpath under the aircraft in order to facilitate on-timedeparture of his next #ight. Although this wasa conscious choice by the mechanic to violate thecompany policy against driving under the aircraft,the decision was made in what the mechanic con-sidered to be the best interest of the company.


2.1.4. Unmanned equipment rolls into aircraft (1.1.4)In these incidents, equipment (tugs, etc.) which is

left unattended by airline personnel, rolls into theaircraft. These incidents can be divided into twocategories, those in which an unmanned parked ve-hicle rolls into an aircraft, and those in which a pieceof equipment rolls into the aircraft. In most of theincidents in the "rst category, the vehicle was leftunattended, with the engine running and the parkingbrake set. This is in violation of company policy thatrequires all vehicles to be turned o! when left unat-tended. However, in many of the northern stations,it has become standard practice to leave thevehicles running at all times during the wintermonths, to prevent any problems restarting thevehicles when they are needed. Ground damage inci-dents occur when the vehicle's parking brake fails,allowing the vehicle to roll into a parked aircraft.

In some situations, the mechanics are aware thatthe parking brake on the vehicle is not workingproperly, but are reluctant to pull the vehicle outof service for repair. This reluctance is driven bythe shortage of suitable equipment, and the feelingthat the maintenance department will not be ableto "x the problem satisfactorily within a reasonableamount of time. In other situations, the mechanic isnot aware of the limitations of the parking brakeand/or the supplemental braking systems installedby the airline. The lack of awareness of potentialhazards causes the mechanics to leave the vehicleunattended with complete con"dence that it willremain where it was parked. The limitations of thebraking system can be considered a latent failure inthe system.

The second category of incidents, those in whichequipment rolls into an aircraft, occur when theequipment is not properly fastened into place (hitchpin engaged, or brakes set). For example, in oneincident, a cart that was being towed came looseand rolled into a parked aircraft. During the sub-sequent investigation, it was found that the hitch onthe tug had been modi"ed. The modi"ed hitch wasnot as safe as the standard hitch, since it did nothave a positive lock feature to ensure that the hitchpin did not come loose. However, the standardhitch required more time to install, and morestrength (usually more than one person) to useas compared to the modi"ed hitch. Since usually

only one person was assigned to a tow, the hitchhad been modi"ed to allow easier connections/disconnections. Plant maintenance, the departmentresponsible for the condition of the ground equip-ment, was unaware of the modi"cations to the hitchon this vehicle. A worn hitch pin that had wornsmall enough to come out of the hitch body duringthe tow exacerbated this particular incident.

2.1.5. Hangar doors closed onto aircraft (1.1.5)In these incidents, airline personnel close the

hangar doors onto the aircraft. Misjudging theposition of the aircraft within the hangar usuallycauses this type of incident. In most situations, themechanics who close the hangar doors have simplyassumed that the aircraft is correctly parked in thehangar, and have closed the hangar doors withoutchecking for clearance. However, in most caseswhen this type of incident has occurred, the aircrafthad been parked incorrectly in the hangar. Thus, itis useful to consider why the aircraft could beparked incorrectly.

Since aircraft hangars are often quite congested,and are "lled with other aircraft and equipment,there is often only one correct place in which theaircraft can be parked. To correctly park an aircraftin a hangar it is necessary for the aircraft to betowed into the hangar on the proper towline forthat type of aircraft, and the tow stopped on theproper block. The tow line and stop block arepainted lines on the #oor of the hangar. Ideallythere is one line for each type of aircraft using thathangar. Problems arise when the painted lines donot match the type of aircraft, and the mechanicshave to choose a di!erent set of guidelines to fol-low. For example, in one incident, a DC-9 waspulled into a hangar on a 727 towline. The only twopainted lines in this hangar were for the 727 and757 aircraft. Additionally, it is necessary to proper-ly align the aircraft on the guidelines before it is toofar into the hangar, since it is di$cult to adjust itsposition once the aircraft is in the hangar. There-fore, it is desirable to have the guidelines extendoutside of the hangar, to allow the tug driver andspotters to properly align the aircraft as they enterthe hangar. In places where the guidelines do notextend outside of the hangar, it is much more di$-cult to properly position the aircraft in the hangar.


Proper positioning also assumes that it is possibleto correctly position the aircraft in the hangar. Ifequipment/workstands are in the path of the air-craft, or a tug that is too large is used, it may not bepossible for the mechanics to properly park theaircraft.

In other situations, an aircraft may be parkedtemporarily in a hangar that is not suited to thattype of aircraft. The hangar may not be big enoughfor the aircraft to "t completely inside. However, ifmechanics are not aware of this, they may routinelyclose the hangar doors without checking for clear-ance. It is proper procedure for the door controls tobe &red-tagged' to indicate to everyone else that thecontrols should not be used. This should be doneby the mechanics that tow the aircraft into thehangar. These mechanics should recognize thatthe aircraft is too long for the hangar. However, inincidents where the doors were closed on an air-craft, the door controls were not red-tagged.

2.1.6. Position of aircraft components changes(1.2.1)

In these incidents, the position of aircraft compo-nents (e.g., stabilizer, #aps, rudder, etc.) is changed,either manually or through the activation of a hy-draulic system, causing the components to contactobstacles in their path. The "rst category of inci-dents, those in which an aircraft component wasmanually adjusted, generally occurred becausea workstand was left in the path of the component.The mechanic failed to perform a walk-aroundcheck to ensure that the area was clear beforeadjusting the component. In addition, no groundspotters were utilized to ensure that the componentdid not contact anything during its move. It is thecrew chief 's responsibility to ensure that the properpersonnel are assigned to perform a given task. Inmany situations, the crew chief failed to assignenough personnel and/or failed to ensure that theground spotters were in place. Since the policy ofusing ground spotters is rarely followed, manymechanics fail to even ask for assistance when theyhave to adjust the position of an aircraft compon-ent. In addition, the time pressure to ensure on-timedepartures encourages mechanics to complete theirtasks as quickly as possible. The time used to ar-range for ground spotters might have been seen as

time that can be used more e!ectively on actuallyperforming the task.

In the second category of incidents, the hydraulicsystem is activated (or deactivated), causing aircraftcomponents to return automatically to a neutralposition. Often, the movement of these componentsis unintended by the mechanic, who simply acti-vates the hydraulic system for a di!erent purpose.However, the lack of awareness of the implicationsof hydraulic system activation has caused manyincidents. Since the mechanics do not considerwhat will happen all around the aircraft when thehydraulic system is activated, they often fail toperform a complete walk-around to check forproper clearance. Thus, the aircraft componentsmay contact equipment that is being used by an-other mechanic, performing an unrelated task.There are many other latent failures that can beshown to contribute to this type of incident.

Most importantly, there seems to be no standardmethod of communicating the impending activa-tion of the hydraulic system to all of the mechanicsworking on the aircraft. Some mechanics simplyyell their intentions to all within earshot, but thenoise in the hangar environment makes it verydi$cult to hear and understand. In addition, asrequired by the company policy manual, the con-trols for the hydraulic system should be &red-tagged' (with a Do Not Operate tag) if a mechanicis working in the path of any of the componentsthat may be a!ected by the hydraulic system. Thisis often not performed.

These incidents are likely to occur because mech-anics are often unaware of other work that is beingperformed on the aircraft. Poor communicationbetween the crew chiefs and the mechanics at thebeginning of the shift leaves each mechanic onlywith an understanding of his task assignment, notthe larger picture. Better communication will helpmechanics become more aware of the hazards andrisks associated with their assigned tasks.

2.1.7. Center of gravity shifts (1.2.2)In these incidents, the center of gravity of the

aircraft shifts unexpectedly, causing the aircraft tocontact the ground with either its nose (center ofgravity shifts forward) or its tail (center of gravityshifts backwards). In most of these incidents, the


mechanics left a workstand or other piece of equip-ment under the aircraft while they were working.When the center of gravity shifted, the aircraftsettled onto this equipment, causing damage to theaircraft.

In some situations, the passengers were allowedon board while the mechanic was working on theaircraft. The mechanics were unaware that theloading had begun until the aircraft's center ofgravity began to shift. The poor communicationamong all of the airline personnel connected toa single aircraft (mechanics, gate agents, groundcrew, #ight crew) is a latent failure behind many ofthese incidents. Similarly, the work of other mech-anics on the aircraft may cause the center of gravityto shift as well. For example, if other maintenancework requires the aircraft to be jacked up, thecenter of gravity shift will a!ect all other mechanicsworking on this aircraft. Lack of awareness of otherwork on the aircraft, as well as poor communica-tion between the di!erent mechanics contributes tothese incidents.

In other incidents, improper procedures orequipment that is being used to complete an as-signed task causes the center of gravity shift. Forexample, one mechanic did not follow the DC-9manual for supporting and jacking the aircraft, andchose to jack the aircraft improperly. This causedthe aircraft to be unstable, and the aircraft's centerof gravity shifted. In other situations, the mechanicsuse improper tools that cause the landing gear tocollapse during functional tests, causing damageto the nose of the aircraft. The mechanics may noteven know that they are using the wrong tools,since it is a common practice at this airline. Thislack of awareness prevents the mechanics from tak-ing the correct precautions to avoid damaging theaircraft.

2.1.8. Aircraft rolls forward/backwards (1.2.3)In these incidents, the aircraft rolls either for-

ward or backward under its own power. This unex-pected movement causes the aircraft to contactobstacles in its path. In many of these incidents, theaircraft is parked, and the wheels are not chocked(or are improperly chocked). In these cases, themechanics parked the aircraft in a remote parkingarea, and forgot to bring chocks with them. They

returned to the hangar, but were distracted beforethey could return to the aircraft with the chocks.

In other incidents, the mechanics request thecockpit crew to release the aircraft brakes while theaircraft is connected to the pushback tractor. Then,the towbar is detached before the brakes are reset.These incidents can also be attributed to the poorcommunication between the airline personnelworking on this aircraft. In some instances, themechanics asked the cockpit crew to releasethe brakes, without informing the pushback crew.The pushback crew then continued to prepare theaircraft for pushback, without being aware of themaintenance problem that the mechanics wereworking on. In other instances, one member of thepushback (wingwalker) was struggling to discon-nect the towbar, when the tug driver requested thatthe brakes be released to allow the towbar to berepositioned. The wingwalker then successfully pul-led the hitch pin, without knowing that the brakeshad been released, and the aircraft rolled forwardinto the tug.

2.1.9. Towing vehicle strikes aircraft (2.1)In these incidents, the pushback tug being used

to tow the aircraft, or the towbar connecting thetug and the aircraft, comes in contact with theaircraft. In some of these incidents, the tug beingused to tow the aircraft slips on the ramp surface,causing it to jackknife and contact the aircraft. Inthese incidents, snow and ice usually cover theramp. Other latent factors contributing to this typeof incident include: the lack of traction augmenta-tion for the tugs (e.g., chains for the tires); the use oftowbars which are too short (which allow the tug tocontact the aircraft); the use of light tow tractorsthat are subject to sliding; and poor ramp mainten-ance in snow/ice conditions. In fact, the snow policyat one station even discourages the mechanics fromcalling to have the ramp sanded. At this particularstation, because of the high cost, sanding overnightcan only be arranged by "rst calling the manager athome. Since mechanics are reluctant to call theirmanager at home in the middle of the night, theyoften choose to forgo sanding.

Other incidents occur when the mechanic isworking alone to connect the aircraft to the towtractor. Generally, it is preferable to have two


people connecting the towbar: one to drive thetug, the other to connect the towbar. When onlyone mechanic is assigned to this task, he mustrepeatedly climb in and out of the tug in order toensure that the tug is properly aligned with theaircraft. Combined with equipment problems, thismay increase the potential for a problem to occurduring the towbar hookup. For example, in oneincident, the mechanic's foot accidentally slippedfrom the brake to the accelerator pedal whilehe was connecting the towbar. The brake pedalsurface was worn completely smooth, but themechanic's footing may have been slippery fromthe conditions on the ramp. This particular inci-dent was compounded by additional problems withthe gear selector on the tug, which allowed the gearselector to slip into Drive from Neutral. This typeof incident emphasizes the need to keep all groundequipment in good operating condition at all times.

The need to maintain ground equipment in goodcondition is also illustrated by the followingexample. In one incident, the mechanic used a tugwith a known problem with the door latch. Thedoor latch had been broken for a few days, but ithad not been red-tagged and the tug was allowed toremain in service. In addition, no safety restrainthad been installed on the tug's door to prevent itfrom swinging open. During a routine tow, thedoor of the tug swung open, contacting the aircraftand causing damage. This incident was obviouslypreventable, had the defective equipment been re-moved from service when the problem was initiallydetected.

2.1.10. Aircraft is not properly conxgured for towing(2.2)

In these incidents, the towing operation was in-itiated before the aircraft was ready to be moved.The movement of the aircraft caused damage tooccur. These incidents are characterized by poorcommunication between various members of thepushback crew. For example, in one incident, theairstairs were left down when the pushback wasinitiated. The cockpit crew did not inform the tugdriver as to the status of the door light annunciator.This would have alerted the tug driver that thedoor was open, and the aircraft was not ready tobe towed. Although this is not required by the

company's general practices manual, the rampstandards practice manual suggests it. The com-munication from the cockpit that the door wasopen would have prevented costly damage to theaircraft. Another factor contributing to this inci-dent is that the mechanic in charge of the aircrafttow (the tug driver) was interrupted during his/herwalk around, and failed to complete the walkaround before beginning the tow. Finally, since thisaircraft was parked in a wide open parking area,the tug driver decided that no wingwalkers wouldbe necessary (as per usual ramp practice). Thisprevented one last preventive measure from work-ing as designed.

In another incident, the pushback tug driver in-itiated the pushback while a lavatory truck was stillservicing the aircraft. The wingwalkers knew thatthe lavatory truck was still connected to the air-craft, but failed to communicate this information tothe tug driver. In addition, the wingwalker was notusing his wands to indicate the obstruction to thetug driver. The tug driver initiated the pushbackbefore the wingwalkers were in their proper posi-tions, and before the &all-clear' signal was given bythe wingwalker. Apparently, there was some con-fusion as to whether the wingwalker must give theall-clear signal before the pushback can begin, orwhether the pushback should begin when the tugdriver sees all of the wingwalkers in their properpositions. The wingwalker mistakenly assumedthat the tug driver would wait for the all-clearsignal before beginning pushback, so he did notindicate the obstruction to the tug driver. The tugdriver had been instructed to clear the gate to allowanother incoming aircraft to enter the gate, and wasfeeling pressure to maintain his departure schedule.The latent failures of poor communication andconfusion concerning the pushback procedure con-tribute to this type of incident.

2.1.11. Aircraft contacts xxed object/equipment(2.3.1)

In these incidents, the aircraft contacts a perma-nent, unmovable "xture (e.g., the doors/walls of thehangar) while being towed. Semi-permanent "x-tures, such as snowbanks that exist for relativelylong periods of time, are included in this type ofincident. Many incidents of this type are caused by


problems with the guidelines that are used to towaircraft into maintenance hangars. The aircraftmight contact a "xed object when it is towed intothe hangar o!-center, i.e. when the aircraft is im-properly aligned on the guidelines. In some situ-ations, the guidelines are incorrectly painted or arequite confusing. In fact, in some hangars it is stan-dard practice to park the aircraft in the hangaro!-center. In other situations, the guidelines do notextend outside of the hangar, making it quite di$-cult to properly align the aircraft before enteringthe hangar. Congestion both inside and outside ofthe hangar increases the di$culty of properly align-ing the aircraft, by making it harder to maneuverthe aircraft into the correct position.

Another factor that contributes to this type ofincident is the failure of the tug driver to stop thetow when the wingwalkers leave the "eld of view.Although this violates company policy, line man-agers regularly permit this behavior to occur. Inaddition, in some cases the proper number of guide-people is not even used during the tow. Also, insome situations the tug driver consciously decidesto turn attention away from one or more of theguidepeople in order to concentrate on other re-lated matters (e.g., locating the guideline, checkingclearance on one particular point on the aircraft,etc.). In these situations, the tug driver is not at-tending to signals that the other guidepeople maybe giving, and thus will not be able to avoid con-tacting an obstacle in the path of the aircraft.

Incidents of this type are also caused when anaircraft is being pushed out of a hangar, and thehangar doors are not completely open. This situ-ation has occurred when a company aircraft isbeing repaired in a hangar belonging to anothercompany, or when another company's aircraft isbeing repaired in this company's hangar. The dam-age to the aircraft is often caused by the visitingmechanics' unfamiliarity with the hangar, as wellas poor communication between the two sets ofmechanics.

2.1.12. Aircraft contacts moveable object/equipment(2.3.2)

In these incidents, the aircraft contacts moveableobjects/equipment while being towed. The ob-jects/equipment are not necessarily in the same

location each time an aircraft is moved. Thus, it isnecessary for the mechanics to detect the objectsbefore beginning the aircraft tow, and make thenecessary e!orts during the tow to prevent contactwith the aircraft. Many of these incidents involvethe aircraft contacting objects/equipment parkedwithin the aircraft safety zone. The aircraft safetyzone is supposed to be indicated by painted lines ateach aircraft parking area, and indicate where itis safe to leave equipment. Objects left withinthe safety zone are at risk to be contacted by theaircraft during the tow. It is company policy forthe tug driver (who is in charge of the tow) to ensurethat the parking area for the aircraft is clear beforebeginning the tow. In many of these incidents,the safety zone is not cleared before the aircraft istowed into the area. Generally, the tug driver, orother guidepeople, assumes that the aircraft willclear the objects/equipment that are left within thesafety zone. In other situations, malfunctions of theequipment parked in the safety zone prevent it frombeing moved to a safer area. For example, in oneincident, a loader was parked within the safetyzone. However, the right wheel of the loader wasbroken o!, so it could not easily be moved from itsposition. In a second example, a tail dock in onehangar was inoperative, and the tail dock could notbe lowered to the correct position. In this situation,the mechanic had not been informed of the problemwith the tail dock, although it had been red-taggedthe previous day. There are also situations where itis considered normal for equipment to be parkedinside the safety zone. For example, at one particu-lar gate it is normal for the catering truck to beparked nearly eleven feet into the safety zone forthe adjacent gate. Such situations make it evenmore di$cult for tug drivers to ensure that the areais clear before the tow is initiated.

Another factor contributing to this type of inci-dent is that the correct number of guidepeople isnot always used during aircraft tows. Although thisis a violation of company policy, the policy is rarelyenforced, and the mechanics have become accus-tomed to moving aircraft with a limited number ofpersonnel. The reduced number of personnel makesit more di$cult for the tug driver to ensure clear-ance around the aircraft. In fact, some mechanicsreport that there are many more instances of minor


Table 1GDI hazard patterns

Hazard pattern Number of incidents % of Total

1. Aircraft is Parked at the Hangar/Gate/Tarmac 81 621.1. Equipment Strikes Aircraft 51 39

1.1.1. Tools/Materials Contact Aircraft 4 31.1.2. Workstand Contacts Aircraft 23 181.1.3. Ground Equipment is Driven into Aircraft 13 101.1.4. Unmanned Equipment Rolls into Aircraft 6 41.1.5. Hangar Doors Closed Onto Aircraft 5 4

1.2. Aircraft (or Aircraft Part) Moves to Contact Object 30 231.2.1. Position of Aircraft Components Changes 15 121.2.2. Center of Gravity Shifts 9 71.2.3. Aircraft Rolls Forward/Backward 6 4

2. Aircraft is Being Towed/Taxied 49 382.1. Towing Vehicle Strikes Aircraft 5 42.2. Aircraft is Not Properly Con"gured for Towing 2 22.3. Aircraft Contacts Fixed Object/Equipment 42 32

2.3.1. Aircraft Contacts Fixed Object/Equipment 13 102.3.2. Aircraft Contacts Moveable Object/Equipment 29 22

Total 130 130 130 100%

aircraft damage that goes unreported. In addition,the congestion that surrounds the ramp and hangarareas increases the di$culty of safely towing theaircraft.

There are also problems of communication thatcontribute to this type of incident. One of the com-mon problems is miscommunication between thetug driver and the guidepeople. In some situations,the tug driver failed to recognize the hand signalsgiven by the wingwalkers. In other situations, thetug driver initiated the tow before the guidepeoplewere ready. Another latent communication prob-lem is that tug drivers do not routinely give verbalresponses to commands from the guidepeople. Thisbecomes a problem when a guideperson givesa command to the tug driver, and assumes that thetug driver sees and understands the command. Thisproblem also manifests in situations when verbalcommunication between the towing crew is di$-cult. Since the tug driver must simultaneously at-tend to many areas of the aircraft, it is very di$cultto ensure that the tug driver will see the handsignals given by any one guideperson. However, theguidepeople are usually not in radio contact withthe tug driver, so verbal communication is alsodi$cult, due to the excessive noise inherent tothe airport environment. When communication

between the members of the tug crew is di$cult, itis likely that the tug driver will not be able torespond in time to any obstacle that may lie in thepath of the aircraft.

3. Results

The number of incidents in each of the GDIhazard patterns is summarized in Table 1. To deter-mine the validity of these classi"cation schemes, thehazard patterns were re-coded by two independentresearchers using the de"nitions developed. Neitherresearcher was familiar with airline ground opera-tions. Percent agreement on how to categorize theincidents was 70%. The inconsistencies were foundto result from misinterpretations of the variousterms used in the hazard patterns. The hazard pat-terns have been reworded to be more explicit, and itis expected that percent agreement will be muchhigher for categorization of future incidents.

3.1. Latent failures in ground damage incidents

From the highly detailed GDI reports it has beenpossible to identify consistent hazard patterns, andwithin these to derive the latent failures in addition


to the more usual active failures. Latent failureswere tabulated for each GDI using an iterativeprocedure to produce a workable taxonomy speci-"c to ground damage. Other taxonomies exist forerror in general (Reason, 1990; Senders and Moray,1991) and some are implied by current error classi-"cation schemes in aircraft maintenance (Marx,1992). The taxonomy developed here used elementsof all of these. After consistent latent failures wereidenti"ed, a logical structure was imposed usingICAO's SHELL Model (ICAO, 1989). For thetasks leading to ground damage, no softwarefailures (e.g. documentation design) were found.Hence, the remaining categories have been usedas follows to classify the latent failures: hardware,environment, liveware (individual) and liveware}liveware (interpersonal). Each of the latent failureshas been described in detail in the hazard patternscenarios. However, a short description of eachlatent failure is provided in Table 2.

Latent failures are considered to be problemsthat exist in the system independently (distinct intime and space) of active failures that cause anincident. However, it is important to note thatproblems such as complacency, bad attitudes ofmechanics, etc. were not considered to be latentfailures. The concentration here was on latent fail-ures that could be addressed through changes tothe maintenance system, rather than characteristicsof individual maintenance personnel.

Table 3 summarizes the incidence of latent fail-ures in the 130 GDIs analyzed. From Table 3, it canbe seen that the most frequently occurring latentfailures are problems with the equipment, use of animproper number of personnel, and a lack ofawareness of risks and hazards. This last latentfailure is a broad category, including such failuresas inadequate training and the assumption thatadequate clearance exists without checking. How-ever, it is not possible to fully eliminate any of theselatent failures using only the traditional techniqueof reprimand, motivate and train.

3.2. Relationship between hazard patterns and latentfailures

While it is possible to intervene across all groundoperations in an attempt to eliminate both active

and latent failures, a more focused strategy may bemore e!ective. If the contribution of each latentfailure to each hazard pattern can be found, thentypical scenarios and sequences can be developedto address particular losses. This means under-standing the sequence(s) of each hazard pattern,and "nding common latent failures that contributeto that sequence. As a "rst step, event trees wereconstructed for each hazard pattern. One exampleis shown in Fig. 1.

We can, however, go further than this and teststatistically for any associations between latent fail-ures and hazard patterns. Tables 4}7 show a com-plete cross-classi"cation of the hazard patternsfrom Table 1 with the latent failures from Table 3.Note that Tables 4}7 provide intermediate totals,e.g., for Hazard Pattern 2 and for Hazard Pattern2.3, as well as individual counts at the lowest level(Hazard Patterns 2.3.1 and 2.3.2). Table 4 addressesthe hardware latent failures, Table 5 addresses theenvironment latent failures, Table 6 addresses theliveware latent failures, and Table 7 shows the totalnumber of latent failures for each hazard pattern. Itis important to remember that each latent failuredoes not contribute to each incident within a haz-ard pattern, but is simply a latent failure that hasresulted in an incident of this type in the past.

Chi-square tests of independence of frequenciesare appropriate for such analyses. The data fromTables 4}7 can be examined by chi-square tests atany level of aggregation of either hazard pattern orlatent failures. However, many of the cells in Tables4}7 contain very low numbers of latent failures,which give low expected frequencies, invalidatingthe assumptions of the Chi-square test even witha relatively high total of 265 latent failures.

For this reason, the analysis was performed attwo levels of aggregated hazard patterns and twolevels of aggregation of latent failures. The higheraggregation of hazard pattern was at two levels,HP1 and HP2, while for latent failures it was at thefour levels H, E, LI and LL. This analysis gave theresults in Table 8, with a highly signi"cant associ-ation between hazard pattern and latent failure(s2

(3)"15.2, p(0.001). In Table 8, cells which are

over-represented, i.e. cells with a large contributionto Chi-square and greater than the expected fre-quency, are indicated using!.


Table 2Latent failure descriptions

SHELL category Latent failure Latent failure description

Hardware Poor Equipment Equipment was not suitable for the task being performed,and this contributed to an incident

Poor Equipment: Inappropriate for Task Equipment used to perform a task was not the correct type ofequipment for that task, and the use of improper equipmentcontributed to the incident

Poor Equipment: Mechanical Problem Equipment used to perform a task had a mechanical prob-lem that caused it to behave erratically, contributing to theincident

Environment Inadequate Space Space in which a task was performed was not su$cient, andthe lack of space contributed to the incident

Inadequate Space: Congested Area Space in which a task was performed was crowded withother equipment/aircraft/etc., causing special attention tomaneuvering within this space to be required. The crowdednature of the space contributed to the incident.

Inadequate Space: Ill suited for Task Task was performed in a space that was known to be inap-propriate for the work to be performed, and this lack ofspace contributed to the incident.

Problems with Painted Guidelines Guidelines used to position aircraft contribute to the inci-dent

Guidelines: Do Not Exist Guidelines are not painted at a particular location, requiringmaintenance personnel to use their &best guess' in positioningaircraft.

Guidelines: Do Not Extend Out of Hangar Guidelines for positioning aircraft in a hangar begin at theGhangar door, requiring maintenance personnel to use their&best guess' to position aircraft to begin the tow into thehangar.

Guidelines: Not Suitable for Aircraft Guidelines for a di!erent type of aircraft than the one beingmoved are painted on the ground, and the lack of suitableguidelines contributes to the incident.

Liveware (Individual) Lack of Awareness of Risks/Hazards Maintenance personnel are unaware of the possible risksassociated with their actions, and the lack of awarenesscontributes to the incident.

Liveware}Liveware Poor Communication Problems with the transfer of information between mainten-ance personnel, and this lack of information contributed toan incident

Poor Communication: Between Crew Problems with the transfer of information between mainten-ance personnel working together on one shift

Poor Communication: Between Shift Problems with the transfer of information between mainten-ance personnel on di!erent shifts

Personnel Unaware of Concurrent Work Maintenance personnel working on one area of the aircraftare unaware of work being performed by other personnel(who may be from other departments or other agencies) onother areas of the aircraft. This lack of awareness contributesto the incident

Pressures to Maintain On-Time Departures Maintenance personnel are subjected to subtle and not sosubtle pressures to remain on schedule at &any cost'. Thesepressures a!ect the decisions made by the maintenance per-sonnel, and these decisions contribute to the incident

Pushback Policies Not Enforced Pushback policies, as written in the operating procedures ofthe airline, are not enforced on a regular basis, leading tocompany norms on how a pushback should be conducted.These norms are followed by all personnel, without beingquestioned (and perhaps even encouraged) by management,until an incident occurs, when the personnel involved arereprimanded for not following the operating procedure. Thewillingness of management to accept a company norm forday-to-day operation contributes to the incident


Table 3Incidence of latent failures!

SHELL model category Latent failure Number of incidents % of total

Hardware 72 27H1 Poor Equipment 72 27

H1.1. Poor Equipment: Inappropriate for Task 39 15H1.2. Poor Equipment: Mechanical Problem 33 12

Environment 51 19E1 Inadequate Space 30 11

E1.1. Inadequate Space: Congested Area 22 8E1.2. Inadequate Space: Ill-suited for Task 8 3

E2 Problems with Painted Guidelines 21 8E2.1. Guidelines: Do Not Exist 7 3E2.2. Guidelines: Do Not Extend Out of Hangar 4 1E2.3. Guidelines: Not Suitable for Aircraft 10 4

Liveware (Individual) 34 13L1 Lack of Awareness of Risks/Hazards 34 13

Liveware}Liveware 108 41LL1 Poor Communication 29 11

LL1.1. Poor Communication: Between Crew 24 9LL1.2. Poor Communication: Between Shifts 5 2

LL2 Personnel Unaware of Concurrent Work 8 3LL3 Correct Number of People Not Used 36 14LL4 Pressures to Maintain On-Time Departures 19 7LL5 Pushback Policies Not Enforced 16 6

Total 265 100%

!Note: Totals exceed the number of incidents due to multiple latent failures per incident.

Fig. 1. Example of hazard pattern event tree.


Table 4Summary of hardware latent failures by hazard patterns

Hazard patterns Hardware latent failures

PE: Inappropriate for task PE: Mechanical problem Poor equipment (PE)

Aircraft Parked 33 20 53Equipment Strikes Aircraft 30 17 47

Tools/Materials Contact Aircraft 1 2 3Workstand Contacts Aircraft 25 4 29Ground Equipment Driven into Aircraft 4 3 7Unmanned Equipment Rolls into Aircraft 0 8 8Hangar Doors Closed onto Aircraft 0 0 0

Aircraft (or Aircraft Part) Moves to ContactObject

3 3 6

Position of Aircraft Component Changes 1 0 1Center of Gravity Shifts 2 1 3Aircraft Rolls Forward/Backward 0 2 2

Aircraft is Being Towed/Taxied 6 13 19Towing Vehicle Strikes Aircraft 3 5 8Aircraft Not Properly Con"gured for Towing 0 0 0Aircraft Contacts Object/Equipment 3 8 11

Aircraft Contacts Fixed Object or Equip-ment

1 3 4

Aircraft Contacts Moveable Object or Equip-ment

2 5 7

Total 39 33 72

It appears from Table 8 that two latent failures(LI and LL) are equally associated with both haz-ard patterns, while the other two (H and E) areassociated with speci"c hazard patterns. Thus,hardware failures are over-represented for parkedaircraft and environmental failures are over-repre-sented for towed aircraft.

Going to the next level of aggregation, there aretoo few entries in cells representing Hazard Pat-terns 2.1 and 2.2 for Chi-square assumptions, sothat only Hazard Patterns 1.1, 1.2 and 2.3 wereanalyzed. New patterns begin to emerge at thislevel. No latent failure is generally applicable acrossall hazard patterns. Hardware is still associatedwith parked aircraft, now speci"cally 1.1 Equip-ment Strikes Aircraft. Environment is still asso-ciated with aircraft under tow, now speci"cally with2.3 Aircraft Contacts Fixed Object/Equipment.However, both liveware latent failures are nowassociated with parked aircraft, speci"cally 1.2 Air-craft Part Moves to Contact Object.

Moving to the lower level of aggregation oflatent failures, we again have two analyses, eachnow involving the nine lower level latent failures.

At the highest level of aggregation of hazardpatterns there are two hazard patterns (1 and 2)and nine latent failures. Overall, the Chi-squaretest showed a signi"cant association betweenhazard patterns and latent failures (s2(8)"28.4, p(0.001). The following latent failures wereover-represented in the two hazard patterns, asshown in Table 9.

For the next level of aggregation, hazard pat-terns were counted at the secondary level (1.1, 1.2,and 2.3), again with Hazard Patterns 2.1 and 2.2eliminated. A Chi-square analysis of Hazard Pat-terns 1.1, 1.2 and 2.3 for the Latent Failures againgave signi"cant results (s2(16)"90.6, p(0.001).The same pattern of individual cell s2 contributionswas seen for Hazard Pattern 2.3 as had been foundfor Hazard Pattern 2 above. However, when Haz-ard Pattern 1 was split into 1.1 and 1.2, this split thelatent failures found above, and added a new one,as shown in Table 9.

We can summarize the "ndings of all of theseanalyzes by classifying each latent failure as to itsassociation with speci"c hazard patterns, as shownin Table 10.


Tab

le5

Sum

mar

yofen

viro

nm

entla

tent

failur

esby

haz

ard

pat

tern

Haz

ard

Pat

tern

sEnvi

ronm

ent

late

ntfa

ilure

s

IS:c

onge

sted

area

IS:I

ll-su

ited

for

task

Inad

equat

esp

ace

(IS)

PG

:do

not

exist

PG

:do

not

exte

ndou

tof

hang

ar

PG

:not

suitab

lefo

rai

rcra

ft

Pro

ble

ms

with

pain

ted

guid

elin

ess

(PG

)

Aircr

aftP

arke

d8

412

21

58

Equip

men

tStr

ikes

Aircr

aft

83

111

15

7Tools/M

ater

ials

Conta

ctA

ircr

aft

01

10

00

0W

orks

tand

Con

tact

sA

ircr

aft

00

00

01

1G

round

Equip

men

tD

rive

nin

toA

ircr

aft

70

70

01

1

Unm

anne

dEquip

men

tR

olls

into

Aircr

aft

00

00

00

0

Han

gar

Doors

Clo

sed

ont

oA

ircr

aft

12

31

13

5

Aircr

aft(o

rA

/CPar

t)M

oves

toC

onta

ctO

bj.

01

11

00

1

Position

ofA

ircr

aft

Com

pone

ntC

hang

es0

00

00

00

Cen

ter

ofG

ravi

tySh

ifts

00

01

00

1A

ircr

aftR

olls

For

war

d/B

ackw

ard

01

10

00

0A

ircr

aftis

Bei

ngTow

ed/T

axie

d14

418

53

513

Tow

ing

Veh

icle

Str

ikes

Aircr

aft

00

00

00

0A

ircr

aftN

ot

Pro

per

lyC

on"

gure

dfo

rT

owin

g0

00

00

00

Aircr

aftC

onta

ctsO

bje

ct/E

quip

men

t14

418

53

513

Aircr

aftC

onta

cts

Fix

edO

bje

ct/E

quip

.4

48

11

35

Aircr

aftC

onta

cts

Mov

eabl

eO

bj./

Equip

.10

010

42

28

Tota

l22

830

74

1021


Tab

le6

Sum

mar

yof

livew

are

(ind

ivid

ualan

dliv

ewar

e-liv

ewar

e)la

tent

failur

esby

haz

ard

pat

tern

Haz

ard

Pat

tern

sLiv

ewar

ela

tentfa

ilure

s

Lac

kof

Aw

aren

ess

ofR

isks

and

Haz

ards

PC

:Bet

wee

nC

rew

sPC

:Bet

wee

nSh

ifts

Poor

Com

m.

(PC

)Per

sonn

elU

naw

are

ofC

oncu

rren

tW

ork

Corr

ect

Num

ber

Peo

ple

Not

Use

d

Pre

ssure

sto

Mai

nta

inO

n-T

ime

Dep

artu

res

Push

back

Polic

ies

Not

Enfo

rced

Aircr

aftPar

ked

2213

417

822

114

Equi

pm

ent

Str

ikes

Aircr

aft

102

35

117

62

Too

ls/M

ater

ials

Cont

actA

ircr

aft

21

23

00

00

Wor

ksta

ndC

ont

acts

Aircr

aft

21

01

16

41

Gro

und

Equi

pm

ent

Drive

nin

toA

ircr

aft

00

00

09

21

Unm

anne

dEqui

pm

ent

Rolls

into

A/C

40

00

02

00

Han

gar

Door

sC

lose

don

toA

ircr

aft

20

11

00

00

Aircr

aft(o

rA

/CP

art)

Mov

esto

Con

tact

Obj.

1211

112

75

52

Pos

itio

nof

A/C

Com

pon

entC

han

ges

57

18

25

30

Cen

ter

ofG

ravi

tySh

ifts

52

02

50

11

Aircr

aftR

olls

Forw

ard/

Bac

kw

ard

22

02

00

11

Aircr

aftis

Bei

ngTow

ed/T

axie

d12

111

120

148

12Tow

ing

Veh

icle

Str

ikes

Aircr

aft

30

00

02

00

Aircr

aftN

otP

rope

rly

Con"

gure

dfo

rTow

ing

02

02

00

11

Aircr

aftC

ont

acts

Obj

ect/

Equ

ipm

ent

99

110

012

711

Aircr

aftC

ont

acts

Fix

edO

bjec

t/E

quip

.3

11

20

21

4A

ircr

aftC

ont

acts

Mov

eabl

eO

bj./

Equi

p.

68

08

010

67

Tota

l34

245

298

3619

16


Table 7Summary of total latent failures by hazard pattern

Hazard Patterns Total Latent Failures

Aircraft Parked 157Equipment Strikes Aircraft 106

Tools/Materials Contact Aircraft 9Workstand Contacts Aircraft 45Ground Equipment Driven into

Aircraft27

Unmanned Equipment Rolls intoAircraft

14

Hangar Doors Closed ontoAircraft

11

Aircraft (or Aircraft Part) Moves toContact Object

51

Position of Aircraft ComponentChanges

24

Center of Gravity Shifts 18Aircraft Rolls Forward/Back-

ward9

Aircraft is Being Towed/Taxied 108Towing Vehicle Strikes Aircraft 13Aircraft Not Properly Con"gured

for Towing4

Aircraft Contacts Object/Equip-ment

91

Aircraft Contacts Fixed Objector Equipment

29

Aircraft Contacts Moveable Ob-ject or Equipment

62

Total 265

Table 8Chi-square analysis of the hazard patterns/latent failure relationship

HP 1: AircraftParked

HP 1.1:EquipmentStrikes Aircraft

HP 1.2: Aircraft (orComponent) Movesto Contact Object

HP 2: Aircraft BeingTowed/Taxied

HP 2.3: AircraftContacts Equipment

Hardware 53! 47! 6 19 11Environment 20 18 2 31! 31!

Liveware(Individual)

22 10 12! 12 9

Liveware}Liveware 62 4 31! 46 40

!Indicates a frequency larger than expected

These analyses show that di!erent latent failuresare over-represented in di!erent hazard patterns,i.e., their occurrence is non-random. These over-represented latent failures are not the only anteced-ents of the incidents within a hazard pattern, but

rather the &causes' unique to that hazard pattern.For example, Latent Failure LL3: Not EnoughPersonnel contributed to all hazard patterns inproportion to their relative frequencies, and thuswas an underlying &cause' of many incidents acrossall hazard patterns. However, when equipmentstruck an aircraft (Hazard Patterns 1.1.1}1.1.5),a unique &cause' was de"ciencies in the equipment.Thus appropriate interventions for this class ofincidents would be to ensure that correct equip-ment was always available, that it was properlymaintained, and that personnel knew not to substi-tute inappropriate equipment.

Conversely, appropriate interventions for Haz-ard Pattern 1.2, where an aircraft or aircraft partmoves to contact an object, should concentrate oncoordination between individuals as the uniquelyassociated latent failures were Latent Failure LL1:Poor Communication and Latent Failure LL2:Unaware of Concurrent Work. Thus, splitting Haz-ard Pattern 1.1 from Hazard Pattern 1.2 in theChi-square analysis can focus management atten-tion onto quite di!erent strategies of intervention.

For Hazard Pattern 2, where the aircraft is beingtowed, the associated latent failures directly ad-dress aircraft movements. Towing often takes placein a small, crowded, or di$cult. The area mayalso have inadequate, misleading, or missingpainted guidelines. Appropriate unique interven-tions would be to address the physical issues ofaircraft movement, and how the operators controlthe direction and speed of these movements.Finally, lack of enforcement of pushback policies isa latent failure that contributes to aircraft move-ment incidents. Managerial issues of why the


Table 9Latent failures over-represented in speci"c hazard patterns

Hazard patterns

HP 1 Aircraft Parked HP 1.1 EquipmentStrikes Aircraft

HP 1.2 Aircraft (or Component)Moves

HP 2 Aircraft is Being Towed

Latent Failures H: Poor Equipment H1: Poor Equipment LL1: Poor Communication E1: Inadequate SpaceLL2: Unaware ofConcurrent Work

LL2: Unaware of ConcurrentWork

E2: Painted GuidelineProblemsLL5: Pushback Policies notEnforced

Table 10Summary of associations between HPs and LFs from chi-squared analyses

Latent Failures Associated Hazard Patterns

HardwareH1. Poor Equipment 1.1. Equipment strikes parked aircraft

H1.1. Poor Equipment: Inappropriate for TaskH1.2. Poor Equipment: Mechanical Problem

EnvironmentE1. Inadequate Space 2.3. Aircraft under tow

E1.1. Inadequate Space: Congested AreaE1.2. Inadequate Space: Ill-suited for Task

E2. Problems with Painted Guidelines 2.3. Aircraft under towE2.1. Guidelines: Do Not ExistE2.2. Guidelines: Do Not Extend Out of HangarE2.3. Guidelines: Not Suitable for Aircraft

Liveware (Individual)LI. Lack of Awareness of Risks/Hazards 1.2. Aircraft or part moves to contact object

Liveware-LivewareLL1. Poor Communication 1.2. Aircraft or part moves to contact object

LL1.1. Poor Communication: Between CrewLL1.2. Poor Communication: Between Shifts

LL2. Personnel Unaware of Concurrent Work 1.2. Aircraft or part moves to contact objectLL3. Correct Number of People Not Used (General)LL4. Pressures to Maintain On-Time Departures (General)LL5. Pushback Policies Not Enforced 2.3. Aircraft under tow

operators violate the policy should be addressed. Isthe policy good but inadequately enforced? Doesthe policy con#ict with others, such as #exibility ofworkforce assignment or departure processes? Forthis hazard pattern, unique interventions need tocover both the physical and managerial aspects ofthe task.

It is not suggested that managers discount theactive failures that occur in the system, since

clearly, if the active failures are eliminated the inci-dent will be prevented. However, working beneaththe surface to expose latent failures can:

(a) identify many di!erent problems that havecommon interventions (e.g., better mainten-ance of equipment can eliminate many typicalhazard patterns, and thus prevent future inci-dents),


(b) allow proposed interventions to go beyond thetraditional personnel actions of reprimand/motivate/train, which heretofore have provento be ine!ective.

3.3. Summary of the GDI analysis

1. There are only 2 major hazard patterns, eachwith some sub-structure.

1. 1.1. There are 3 relatively large hazard patterns,which account for 94% of all GDIs.

1. 1.1. } Hazard Pattern 1.1: Aircraft Parked andEquipment Strikes the Aircraft (39%)

1. 1.1. } Hazard Pattern 1.2: Aircraft Parked andan Aircraft Part Moves to Contact anObject (23%)

1. 1.1. } Hazard Pattern 2.3: Aircraft Under Towand Contacts a Fixed or Moveable Ob-ject (32%)

2. There are only 9 major latent failures, some withsub-structure.

1. 2.1. Some of the latent failures are general, whileothers are more associated with speci"chazard patterns.

1. 2.2. General latent failures across all hazard pat-terns account for 21% of all latent failures.

1. 1.1. } LL3: Correct Number of Personnel NotUsed (14%),

1. 1.1. } LL4: Pressures for On-Time Departure(7%).

1. 2.3. Latent failures associated with speci"c haz-ard patterns account for 66% of all latentfailures.

1. 1.1. } H1: Poor Equipment is associated withHazard Pattern 1.1: Equipment StrikesAircraft (27%)

1. 1.1. } LL1: Poor Communication is associatedwith Hazard Pattern 1.2: Aircraft (or Air-craft Part) Moves to Contact Object isassociated with Latent Failures (11%)

1. 1.1. } LL2: Personnel Unaware of ConcurrentWork is associated with Hazard Pattern1.2: Aircraft (or Aircraft Part) Moves toContact Object is associated with LatentFailures (3%)

1. 1.1. } E1: Inadequate Space is associated withHazard Pattern 2: Aircraft is BeingTowed/Taxied (11%)

1. 1.1. } E2: Problems with Painted Guidelines isassociated with Hazard Pattern 2: Air-craft is Being Towed/Taxied (8%)

1. 1.1. } LL5: Pushback Policies Not Enforced isassociated with Hazard Pattern 2: Air-craft is Being Towed/Taxied (6%)

4. Addressing ground damage

The analysis of ground damage incidents in thisstudy showed that there are relatively few causeswhich contribute to most ground damage incidents,which suggests that by introducing a small numberof interventions, a large number of ground damageincidents can be prevented. Results also indicatethat simply using the `blame-and-traina approachto preventing ground damage is ine!ective, sinceground damage incidents are often caused, at leastpartly, by latent failures in the system. These latentfailures cannot be eliminated without making chan-ges in the system further upstream than the mech-anics, or even the "rst line supervisors. Changesmust be initiated by upper levels of management,and must become integrated into the existing main-tenance system.

Recently, airlines and other groups have begundeveloping programs to speci"cally address grounddamage. The Aerospace Psychology ResearchGroup at Trinity College Dublin developed theSafety Courses for Airport Ramp Functions(SCARF) program in conjunction with other uni-versity and airline partners. SCARF was developedto address the ramp safety concerns at airlines, andis described as `an integrated set of four trainingprograms for the promotion of best demonstratedpractice in the safe and cost e!ective operation ofairport ground handling services (Fuller et al.,1994).a These training programs are aimed at ramppersonnel, "rst line supervisors, managers, andtrainers, recognizing that all members of an organ-ization must recognize how their job contributesto ramp safety. The SCARF program has beenimplemented at airport sites in Europe, and itse!ectiveness is currently being evaluated.

Various airlines have implemented maintenanceresource management (MRM) and situational aware-ness (SA) training programs in their maintenance


departments to help foster the safety culture. DeltaAirlines has been developing a ground crew humanfactors training program, to reinforce the import-ance of human factors in ramp operations (Trans-port Canada, 1997), and a research group fromPurdue University is currently working with an-other major air carrier on the problem of grounddamage. In addition, Transport Canada has re-leased the Ground Crew Dirty Dozen poster series,to parallel their Maintenance Dirty Dozen series,to make ground crew personnel aware of potentiallatent failures and local triggers in their environ-ment.

Although all of these programs clearly addressthe possibility of failures relating to personnel re-lated factors (e.g., using an inadequate number ofspotters, or using the wrong piece of equipment),they may only tangentially address other latentfailures in the system. Other interventions may stillbe necessary to eliminate, or reduce, these latentfailures. For example, technological changes (e.g.,redesigning the tug hitch, or adding mirrors tofacilitate ensuring proper clearance) may be neces-sary to simplify tasks and reduce the possibility oferrors. Further, procedural changes (e.g., improvingthe equipment maintenance policies) may be neces-sary to align the procedures with how the mainten-ance personnel actually work.

References

Chandler, J.G., 1995. Putting a dent in ground damage. AviationEquipment Maintenance 14 (6), 22}25.

Drury, C.G., 1994. The speed-accuracy trade-o! in industry.Ergonomics 37 (4), 747}763.

Drury, C.G., Brill, M., l978. New methods of consumer productaccident investigation. Human Factors and Industrial De-sign in Consumer Products l96}229.

Fox, J.G., 1992. The ergonomics audit as an everyday factor insafe and e$cient working. Progress in Coal, Steel and Re-lated Social Research 10}14.

Fuller, R., McDonald, N., White, G., Walsh, W., 1994. Strategiesto improve human performance safety in ground handlingoperations. Presented at the Airports Council InternationalApron Safety Seminar, Caracas, Venezuela.

ICAO, 1989. Human Factors Digest No. 1 Fundamental Hu-man Factors Concepts, Circular 216-AN/131, InternationalCivil Aviation Organization, Canada.

Marx, D., 1992. Looking toward 2000: the evolution of humanfactors in maintenance. Meeting Proceedings Sixth FederalAviation Administration Meeting on Human FactorsIssues in Aircraft Maintenance and Inspection `Mainten-ance 2000a, 22}23 January 1992, Alexandria, Virginia,pp. 64}76.

Maurino, D., Reason, J., Johnston, N., Lee, R., 1995. BeyondAviation Human Factors. Avebury Aviation, Hants,U.K.

McDonald, N., Fuller, R., 1996a. Safety in airport ground opera-tions. A proposal to the Scarf International Group to estab-lish a company, Trinity College, Dublin.

McDonald, N., Fuller, R., 1996b. Human Factors and AirsideSafety Management. Trinity College, Dublin.

Monteau, M., 1977. A practical method of investigating accidentfactors. Commission of the European Communities, Luxen-bourg.

Reason, J., 1990. Human Error. Cambridge University Press,Cambridge, UK.

Senders, J.W., Moray, N.P., 1991. Human Error: Cause, Predic-tion and Reduction. Lawrence Erlbaum Associates, Inc.,Hillsdale, NJ.

Transport Canada, 1997. The Third Conference on Mainten-ance/Ground Crew Errors and Their Prevention: Confer-ence Notes. Toronto, Canada.


Analyzing human error in aircraft ground damage … human error in aircraft ground damage incidents...

Documents

Transcript of Analyzing human error in aircraft ground damage … human error in aircraft ground damage incidents...