^*Rutgers Undergraduate Research Fellow

Keywords: Aviation safety, risk modeling, expert systems

Introduction

The Reason model of accident causation is becoming an industry standard and has been recommended by various organizations, such as the Federal Aviation Administration (FAA), Civil Aviation Authority, Australian Bureau of Air Safety Investigation, for use in investigating the role of management policies and procedures in aircraft accidents and incidents. The Reason model is a general model that traces the root causes of different accidents to organizational errors (latent failures) arising in the upper levels of any organization (Reason, 1995).  Reason (1990) and other researchers contend that explanations of accidents based solely upon individual operator performance are now accepted to be inadequate as models of the accident generating process. Such processes in modern large-scale technological systems involve a complex of multiple interacting factors that are distant in time and proximity within the organization from the immediate circumstance of an accident as in Figure 1. The Reason model develops a schematic interaction between individual error and latent factors such as faulty top level management decisions. It describes two interrelated causal sequences: (a) an active failure pathway that originates in top level decisions and proceeds through error producing situational factors at the workplace to unsafe acts committed by the individuals at the human-system interface and (b) a latent failure pathway that directly breaches the defenses in a system (Reason, 1995). However, the Reason model does not fully account for the detailed role of the organizational system within which design and management decisions are taken and through which the consequences of such decisions are taken forward. That is, the Reason model, in its current form, fails to provide the detailed linkages from individual to task/environment to organization beyond a general framework of line management deficiencies and psychological precursors of unsafe acts. A review of the safety literature reveals that there is a gap between bottom-up approaches which start with the analysis of errors and safety events and top-down approaches that address the system from the level of the organization. Pidgeon and O’Leary (1994) note that if safety analysts do not understand the link between practical safety management initiatives and an organization’s safety culture it is impossible to begin to design initiatives to improve safety management practice except on a purely ad hoc and pragmatic basis. Also, these authors contend that the idea of “best practice?in safety management becomes too vague to be of practical use.

Figure 1. An Accident Causal Chain

In this research task, an attempt will be made to incorporate inputs from the elements of the FAA’s new system safety model of surveillance and oversight (Improved Surveillance Planning Process Final Report, 1998) within the overarching framework of the Reason model. The central idea of this project is to map the National Transportation Safety Board (NTSB) accident database into the Reason model to develop causal relationships between various risk factors based on the findings and historical data provided by the NTSB. While FAA accident investigators may assist the NTSB personnel in investigating an aircraft accident, the NTSB database is considered as the “official?source of aircraft accident information in the United States. Thus, the general Reason model will be made more specific to aviation accidents by fully developing the framework with causal factors related to an historical analysis of aircraft accidents. The Reason model is based on the underlying systems structure, and is intended to discover the errors and deficiencies that led to the operators being placed in a situation causing an accident (Zotov, 1996). The Reason model contends that one cannot simply focus on an individual’s behavior; to eliminate problems, one has to look into the indirect underlying factors and causes which may be the root of a problem. Reason noted that human error was implicated in the causes of most accidents. However, unsafe acts, just as much as their occasional bad outcomes, are consequences rather than causes. Reason’s model has been advocated by the International Civil Aviation Organization (ICAO). The Australian Bureau of Air Safety Investigation (BASI) has successfully employed the Reason model since 1993 (BASI, 1994). Reason developed this model after he studied a number of major disasters from around the world such as the Bhopal Gas tragedy, the Challenger, Chernobyl, etc. According to him an accident sequence begins with improper organizational processes (i.e. decisions concerned with planning, scheduling, designing, and maintaining, etc.) The latent failures so created become precursors for the active failures (high workload, faulty equipment, time pressure, fatigue, low morale, etc.) (Reason, 1995, 1997). Van Vuren (1999) also notes the important role that organizational factors play in accidents in the medical and steel production industries.

Description of the Aviation System Risk Model (ASRM)

The proposed outcome of this research project will be a systems level computer model for identifying and tracing causal factors in an aircraft accident. Integrating the ideas from Bayesian networks will further develop this systems level model. One of the most important factors to consider when conducting an accident investigation or studying accident prevention is “uncertainty? Bayesian Belief Networks (BBNs) are mechanisms for representing probabilistic causal reasoning. BBNs may be defined as directed acyclic graphs formed by a set of variables and directed links between variables (Jensen, 1993, 1996). Each variable represents an event and has countable or continuous states. Causal reasoning is an integral part of any general diagnostic approach, and this approach is being considered for industrial and aviation safety applications. Bayesian Belief Networks use Bayesian Probability Theory to explore causal relationships (Andersen, et al. (1989)). Since the introduction of automation, aircraft operations are becoming increasingly complex leading to domain and information uncertainty. The operational product from this research task will be a computer tool for the Aviation System Risk Model (ASRM). An early systems level model of general organizational factors for aviation is reported in Luxhøj, et al. (1997). As conceptualized and initially described in Luxhøj, et al. (1998, 1999), the ASRM will incorporate concepts of the Reason model and Bayesian Belief Network algorithms to identify causal relationships between various accident factors. Using a combination of accident/incident data along with expert judgments or “beliefs? this new semi-quantitative model will be developed in consultation with aviation safety experts to assist in the subjective probabilistic assessment of the various individual, task/environment, and organizational risk factors. The ASRM has been evaluated using actual NTSB accident reports and case studies have been used as the means to gain more understanding of aviation risk factors. Luxhøj, et al. (1998) report on an analysis of the ACA 6291 accident, an operations-related accident. In a second case study, Luxhøj, et al. (1999) report on the analysis of Eagle 3379, another operations-related accident that involved poor Crew Resource Management (CRM). More recently, Choopavang (2000), under the guidance of Professor Luxhøj, completed a Master Thesis that fully describes the current version of the ASRM and includes a third case study on the Continental 2574 accident, a maintenance-related accident. The computerized ASRM will enable safety program managers to evaluate the impact of newly proposed risk mitigation strategies by performing sensitivity analyses or “what-if?analyses. For example, the possible effects of changes in safety regulations or standards, the integration of new hardware or software into an aircraft, changes in maintenance policies, etc. could be assessed by changing the conditional probabilities in the model and then tracing the propagating effects from the organization to the task/environment to the individual factors to determine the extent that the probability of a certain type of accident may be reduced. Knowledge gained from the case studies will be used to develop the Risk Analysis and the Risk Management Concept Documents for the FAA’s Risk Management Decision Support (RMDS) Project.

Air Ontario 1363 Case Study

This particular accident occurred on March 10, 1989. Air Ontario Flight 1362/1363 was scheduled to fly round trip from Winnipeg to Thunder Bay, Canada with intermediate stops at Dryden, Canada. Then, Air Ontario Flight 1364/1365 was scheduled to fly round trip from Winnipeg to Thunder Bay with no stops. The crew members were Captain George C. Morwood, First Officer Keith Mills, and two flight attendants. This accident is well documented in Maurino, et al. (1995) and Helmreich (1995). At Dryden, there was a longer than normal take-off roll. The aircraft rotated, lifted off, and shuddered onto the runway. The aircraft then rotated a second time, and then lifted off at the 5700 foot point of the 6000 foot runway. The plane flew briefly without gaining altitude, striking trees. The aircraft eventually burned after falling into a wooded area. Casualties included 21 passengers, Captain Morwood, First Officer Mills, and Flight Attendant Katherine Say. The obvious causes for this accident were that the wings were covered in snow, with depths varying from 1/8 to 1/4 inches. The runway was covered in slush with depths from ?to ?inches. The conventional knowledge attributed the accident to the pilot’s fault. In the aftermath of the accident, a Commission of Inquiry was formed on March 29, 1989 and Justice Moshansky was appointed as the Commissioner. After a 22 month investigation, 191 recommendations were made for the Canadian Aviation System. This accident was studied as a fourth ASRM case study, since numerous “organizational factors?were cited as contributing to the accident, as illustrated in Figure 2.

Figure 2. "Organizational factors" in the Air Ontario 1363 accident. Disparate allocation of resources to safety and production activities (AO/AC) Deficient handling of information (AO) Inadequate management of change (AO) Deficient inspection and control (TC/AC) Deficiencies in operations and maintenance (AO) Inadequate purchasing of spares (AO) Deficient management of the F28 programme (AO) Low motivation (merger) (AO) Deficient lines of communication between management and pesonnel (AO) Inadequate policy-making (TC/AO) Deficient scheduling (overcommitment of the F28) (AO) Deficient planning in the introduction of the F28 (AO) Deficient monitoring and auditing (TC/AC) Goal-setting (failure to carry properly states' goals into deed) (AO)   Deficient checking (TC

A mapping of the causal factors for the Air Ontario 1363 accident is depicted in Figure 3.

Figure 3. Mapping of Air Ontario 1363 Accident on to Reason Model

A portion of the ASRM highlighting the “interactions?of the organizational and task/environmental factors is shown in Figure 4. The “interactions?of the task/enviromental factors with the individual factors are displayed in Figure 5. Recall that the HUGIN Bayesian Belief Network software is used to create the ASRM.

Figure 4. Portion of the ASRM Depicting Interaction of Organizational and Task/Environmental Factors for Air Ontario 1363 Case Study Figure 5. Portion of the ASRM Depicting Interaction of Task/Environmental Factors with Individual Factors for Air Ontario 1363 Case Study

Further Remarks The Air Ontario 1363 case study further illustrates how the Aviation System Risk Model (ASRM) may be used to understand the complex interactions among causal factors in aircraft accidents. This case study was especially useful for modeling and understanding the interactions among organizational factors with task/environmental and individual factors. Additional research to be completed includes the development of the states for each node in the HUGIN model as well as the estimation of the conditional probabilities or “beliefs?from subject matter experts and or the safety literature for these states.

Acknowledgments

The authors acknowledge the support of the Federal Aviation Administration through grant number 00-G-006. This paper is based on research performed at Rutgers University. The contents of the paper reflect the views of the authors who are solely responsible for the accuracy of the facts, analyses, conclusions, and recommendations presented herein, and do not necessarily reflect the official view or policy of the Federal Aviation Administration. Mr. Rishi Hinduja, a Rutgers University Undergraduate Research Fellow, also assisted with this project.

References

Andersen, S.K., Olesen, K.G., Jensen, F.V., and Jensen, F. (1989). “HUGIN - A Shell for Building Bayesian Belief Universes for Expert Systems,?in Proceedings of the Eleventh International Joint Conference on Artificial Intelligence, Detroit, Michigan, 1080-1085, August 20-25. Bureau of Air Safety Investigation (BASI) (1994). Piper PA 31-350 Chieftan VH-NDU, Young, NSW, 11 June (Investigation Report 9301743), Canberra, Australia. Choopavang, A. (2000). “A Bayesian Approach to Causal Modeling of Organizational Factors in Aircraft Accidents,?M.S. Thesis, Department of Industrial and Systems Engineering, Rutgers University, August. Helmreich, R.L. (1995). “Commission of Inquiry into the Air Ontario Crash at Dryden, Ontario,?The CRM Advocate, Issue 95.1, January (http://www.crm-devel.org/resources/crmadvocate/95_1/95_1.htm). Improved Surveillance Planning Process Final Report (1998). Federal Aviation Administration, U.S. Department of Transportation, January 30, Washington, DC. Jensen, F. V. (1993). Introduction to Bayesian Networks: HUGIN, Aalborg University Press, Aalborg, Denmark. Jensen, F.V. (1996). An Introduction to Bayesian Networks. New York: Springer-Verlag. Luxhøj, J., D. Arendt, A. Choopavang, K. Bansal, and T. Horton (1999). “An Aviation System Safety Model for Improved Risk Management? Proceedings of the 10th European Safety and Reliability Conference, Munich, Germany, September 13-17, 1999, pp. 1285-1290. Luxhøj, J.T., D.N. Arendt, and T.G. Horton (1998), “An Intelligent Computer-Based Tool for Evaluating Aircraft Accident Causation? Proceedings of European Safety and Reliability International Conference ESREL ?8, Trondheim, Norway, June 17-19, pp. 839-846. Luxhøj, J.T., D.N. Arendt, T.P. Williams, and T.G. Horton (1997). “An Application of Advanced Information Technology for Assessing Aircraft Accident Causation? Proceedings of International Society of Air Safety Investigators, Anchorage, Alaska, September 29 - October 3. Maurino, D.E., J. Reason, N. Johnston, and R.B. Lee (1995). Beyond Aviation Human Factors: Safety in High Technology Systems, Ashgate Publishing Limited, United Kingdom. Pidgeon, N. and O’Leary, M. (1994). “Organizational Safety Culture: Implications for Aviation Practice,?in Aviation Psychology in Practice (N. Johnston, N. McDonald, and R. Fuller, eds.), Lawrence Erlbaum, Hove. Reason, J. (1990). Human Error, Cambridge University Press, Cambridge, United Kingdom. Reason, J. (1995). “A System Approach to Organizational Error? Ergonomics 38(8), 1708-1721. Reason, J. (1997). Managing the Risks of Organizational Accidents. Ashgate Publishing Limited, England. van Vuren, W. (1999). “Organizational Failure: The Development of a Taxonomy? Proceedings of the 10th European Conference on Safety and Reliability, Munich, Germany, September 13-17, 1999, pp. 1273-1278. Zotov, D.V. (1996). “Reporting Human Factor Accidents? ISASI Forum, 29(3), 4-20.

Copyright 2001 by James T. Luxhøj Current URL: http://rutgersscholar.rutgers.edu/volume03/mauluxh/mauluxh.htm