Organizational Accidentsin Aviation

Jim Reason

University of Manchester

Two kinds of accidents

Individual accidents

Organizational accidents

FrequentLimited consequences

Few or no defencesLimited causes

Slips, trips and lapsesShort ‘history’

RareWidespread consequences

Many defencesMultiple causes

Product of new technologyLong ‘history’

Two ways of looking at accidents

• The person approach: Focuses on the errors and violations of individuals. Remedial efforts directed at people at the ‘sharp end’.

• The system approach: Traces the causal factors back into the system as a whole. Remedial efforts directed at situations and organisations.

The person approach

• Since human actions are implicated in 80-90 per cent of accidents

• And human actions are perceived as under voluntary control

• And behaviour is viewed as being the least constrained factor in the prior events

• Then accidents must be due to carelessness, negligence, incompetence, recklessness, etc.

Although . . .

• Blaming individuals is emotionally satisfying and legally convenient

• It gets us nowhere

• Fallibility is part of the human condition

• You can’t change the human condition

• But you can change the conditions in which humans work

The system approach

• Accidents arise from a (usually rare) linked sequence of failures in the many defences, safeguards, barriers and controls established to protect against known hazards

• The important questions are: – How and why did the defences fail?

– What can we do to reduce the chances of a recurrence?

Hazards, losses & defences

LossesHazards

Defences

‘Hard’ defences‘Soft’ defences

The Swiss cheese model ofaccident causation

Some holes dueto active failures

Other holes due tolatent conditions

(resident ‘pathogens’)

Successive layers of defences, barriers, & safeguards

Hazards

Losses

How and why defences fail

Unsafe acts

Local workplace factors

Organisational factors

LossesHazards

Defences

Latentconditionpathways

Causes

Investigation

Types of unsafe act

• Errors– Slips, lapses and fumbles– Mistakes

• Rule-based mistakes• Knowledge-based mistakes

• Violations– Routine violations– Violations for kicks– Situational violations

Two influential accidents

• Mount Erebus, 1979: one accident, two inquiries:– Chippindale Report (‘pilot error’)

– Mahon Report (‘orchestrated litany of lies’)

• Dryden, 1989: Moshansky Report, an indictment of the entire Canadian air transport system.

Three aviation applications of the ‘Swiss cheese’ model

• Bureau of Air Safety Investigation (BASI), Canberra.

• International Civil Aviation Organization (ICAO): Amendment to Annex 13, the guide to accident investigators.

• As applied by an airline to a recent air accident in North America.

BASI

• 1n the early 1990s, BASI resolved to apply the model to all accident investigations.

• In June 1993, a small commuter aircraft crashed at Young, NSW. All died.

• The BASI report focused on the deficiencies of the regulator, the Oz CAA.

• Following a similar accident in 1994, the Oz CAA was disbanded. Replaced by CASA.

ICAO Accident Investigation Divisional Meeting (2/92)

Traditionally, investigations have been limited tothe persons directly involved. Current accidentprevention views supported the notion that additionalpreventive measures could be derived frominvestigations if management policies and organisational factors were also investigated.(excerpt from minutes)

Implemented in 8th Edition Annex 13 (1994)

The ‘Harrytown’ accident

• A modern 50-passenger glass cockpit jet aircraft hit the runway wing down on landing. Slid off and ended up in trees 2000ft away. Nine people injured.

• F/O flying. Temp -8oC. Visibility 1/8 mile. Fog, snowy, no wind. 23.47 hrs.

• Both pilots were seriously surprised.

Wing hitsground

Stall

Too low

Aircrafthandlingfeatures

Too slow

Prone to inducing ‘ground shyness’

Prone to stall wing down?

Stick pusher problems?

Poor visibility (white hole)

Inexperienced copilot (jet)assigned landing (SOPs?)

Inappropriate aircraftattitude at 100ft and below

Inadequate monitoring by Captain (SOPs)?

Delayed go-around order

= AND gates (each necessary, none sufficient)

Nose-up response to power increase?

= Causal pathways

+

+

+

+

+

Sufficient?

Leading edge contamination?

No leading edge flaps?

HARRYTOWN:SPECULATIVEEVENT TREE

Implications of event tree - 1

• Two main clusters of contributing factors:– those relating to the aircraft

– those relating to handling and flight operations

• Two main pathways for back-tracking:– to the manufacturer (not our immediate

concern)

– to flight operations and the system as a whole (the priority pathway)

Implications of event tree - 2

• The Harrytown accident involved the combination of several contributing factors that were very hard to anticipate.

• The local circumstances were such that it took very little in the way of less-than-adequate pilot performance to push the system over the edge.

• This was an ‘organizational accident’.

Pruned event tree

Prone to inducing ‘ground shyness’

Nose-up response to power increase

Poor visibility

Inexperienced co-pilot (jet)assigned landing

Problems with aircraftattitude at 100ft and below

Monitoring and cross-checking problems

Delayed go-around order

+

+

+

Aircraftfactors

Operationalfactors

TRAINING

TRAINING

TRAINING, SOPs

SOPs, HIRING, etc.

TRAINING, CHECKING

TRAINING, HIRING, SOPs

ORGANIZATIONAL ISSUES

TRAINING, SOPs

Defences that failed inHarrytown accident

Stall protectionsystem

Airmanship

Training, checking,SOPs

Hiring, placement, contracts,exposure to safe culture

Key issues for review

• Operating procedures

• Training

• Checking

• Hiring and placement of pilots

• Assimilation of new hires into airline culture

Comments on the culture

• A strong culture: Embodied in a few widely known and well understood beliefs and values.

• A safe culture: Values solidity, reliability, accuracy; proud to be ‘dull’ in the pursuit of quality and safety.

• A collective culture: No one person is indispensable, interchangeable units.

The moral

• No point replacing ‘pilot error’ attribution with ‘management error’.

• All top level decisions, even sound commercial ones, have a downside for someone, somewhere in the system at some time. All create resident pathogens.

• Challenge: to identify and rectify latent conditions before they combine to cause accidents.

Accident/incident questions

• What defences failed?• How did they fail?• Why did they fail?

– Unsafe acts?– Team factors?– Workplace factors– Technical factors?– Organizational factors?