Post on 06-Apr-2018
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 1/50
U N C L A S S I F I E D
U N C L A S S I F I E D
Operated by the Los Alamos National Security, LLC for the DOE/NNSA
A NonA Non--Newtonian* Model of AccidentsNewtonian* Model of Accidents
andand
Accident InvestigationAccident InvestigationRoger Kruse, CSP
Los Alamos National Laboratory
Los Alamos, New Mexico
* Isaac Newton¶s 3rd Law of Motion ± for every
action there is an equal and opposite reaction
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 2/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 2
Credit where credit is due «
Many of the concepts in this presentation are derived from
publications by Erik Hollnagel, University of Linköping,
Sweden and Sydney Dekker , Department of Aeronautical
Engineering, Lund University, Sweden.
Books I would recommend are:
The Field Guide to Understanding Human Error , 2006, Dekker
Just Culture, 2007, Dekker
Barriers and Accident Prevention, 2004, Hollnagel
The ETTO Principle: Efficiency-Thoroughness Trade-Off, 2009,
Hollnagel
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 3/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 3
What is an Accident Model?
A frame of reference, or stereotypical way of
thinking about an accident
An unspoken, but commonly held belief abouthow accidents happen
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 4/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 4
Why should I Care?
WYLFIWYF*
*What You Look For Is What You Find
What you find when you investigate an event isinfluenced by the accident model you use
How you try to prevent accidents is influenced
by how you think they happen
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 5/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 5
Evolution of Accident Models
Sequence of Events
(1930s Present)
Epidemiological(1970s Present)
Systemic (Non-Newtonian)
(Emerging)
Based on cause
and effect
Not based on
cause and effect
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 6/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 6
Sequence of Events Model
A simple, linear cause and effect model
Accidents are seen as a series of events which occur
in a specific and recognizable order
Caused by unsafe acts or conditions
Prevented by fixing or eliminating the weak link or
inserting a barrier to interrupt the series of events
Domino Theory of
Accident Causation
- H. W. Heinrich 1931
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 7/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 7
Sequence of Events, continued
Sequential models can be intricate, including
hierarchies such as: Event trees
Fault trees
They are attractive because: Easy to think in a linear series
Easy to represent graphically
And therefore, easier to understand
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 8/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 8
Epidemiological Model
A complex, linear cause and effect model
Accidents result from a series of active failures (unsafe
acts) and latent conditions (hazards)
Caused by degradation of defenses (organizational,
human, technical)
Prevented by strengthening barriers and defenses
Based on Accident Causation
Model (Swiss Cheese)
- James Reason 1990
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 9/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 9
Epidemiological, continued
Accidents result from deficiencies that lay dormant untiltriggered by active failures
Focuses attention on the organizational issues and
views human error more as an effect, than a cause
More complex, but still linear with a clear path through
ordered defenses
Because it is linear, it oversimplifies the complex
interactions between the multitude of active failuresand latent conditions
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 10/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 10
Systemic Model
A complex, non-linear model
Both accidents (and success) emerge from
subtle, unexpected interactions between
relatively simple parts of a complex system
Non-Newtonian because cause and effect
relationships generally do not exist
Difficult to represent graphically because it isnon-linear
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 11/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 11
Functional Resonance Accident Model (FRAM)- Erik Hollnagel
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 12/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 12
Another way to think about it «
Accidents are unexpected combinations of
normal variability within the system
Because the variability is within expected
norms, the accidents are triggered by normalactions, rather than action failures
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 13/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 13
Accidents are unexpected combinations
of normal variability
Time
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 14/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 14
Swedish Airlines MD-8
2Overran End of Runway
June 23, 1999
Case Study
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 15/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 15
Ground Spoilers
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 16/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 16
How the spoilers and ABS work
Pilot arms spoilers before landing
When the aircraft touches down, spoilers are
deployed: when main gear wheels spin up, or
front landing gear is compressed
Deployment of the spoilers activates the ABS
system
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 17/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 17
MD-82 Forward Pedestal
Spoiler Lever
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 18/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 18
Spoiler Lever
Unarmed Armed
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 19/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 19
Facts
Brake disks cold after landing
Per the flight recorders, spoilers did not deployand the ABS did not activate
No technical fault with braking system
Arming spoilers is a pre-landing checklist item Co-pilot reads the checklist
Pilot arms the spoilers after lowering landing gear
Co-pilot confirms spoilers deployed after landing
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 20/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 20
Accident Board Conclusion
The cause was inadequate Crew ResourceManagement (i.e. pilot error) because
The pilot did not arm spoilers before landing,
The co-pilot did not report lack of spoiler deployment after landing
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 21/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 21
Old vs. New View of Human Error*
Human error is a cause of accidents
To explain failure,investigations must seekfailure
They must find people¶sinaccurate assessments,wrong decisions and bad
judgments
Human error is a symptom of trouble inside the system
To explain failure, do not tryto find where people wentwrong.
Instead, find how people¶sassessments and actionsmade sense at the time,given the circumstances that
surrounded them.
* Dekker, Sydney (2002)T he Field Guide to Human Error Investigations
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 22/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 22
Flight Crew Information
Pilot 49 years old
6,775 total flight hours
3,500 flight hours in type
Co-pilot 57 years old
17,000 total flight hours
7,000 flight hours in type
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 23/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 23
Flight Crew Issues
The assigned co-pilot became ill and areplacement pilot was called out on short notice.
If substitution is made during flight planning, the
one with seniority serves as pilot
Per policy for short notice, the replacement pilotassumed the duties of person (co-pilot) hereplaced
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 24/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 24
Effects of Scheduling Problem
Although fully qualified to perform the co-pilotduties, the replacement pilot had not actually
flown as co-pilot for 6 months
After landing, the co-pilot forgot to confirmspoiler deployment
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 25/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 25
ILS Approach Procedure
Lower Landing Gear (when glide slope active)
Spoilers armed (when gear down and locked)
Flaps FULL (when glide slope captured)
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 26/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 26
ILS Approach Procedure
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 27/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 27
ILS Approach Procedure with Timeline
At t = 0
At t = 10
At t = 16
Lower Landing Gear (when glideslope active)
Spoilers armed (when gear down
and locked)
Flaps FULL (when glide slope
captured)
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 28/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 28
The problem is «.
It normally takes ~ 10 seconds for gear to go
down and lock
Flight simulators allow 10 seconds for gear
down and locked
But on older aircraft, with worn hydraulics, gear
down and locked can take over 30 seconds to
complete
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 29/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 29
Timeline on Older Aircraft
At t = 0 Lower Landing Gear
At t = 30 Spoilers armed (when gear down and locked)
At t = 16 Flaps FULL
Wind forces (180 knots) can compress landing gear as it
is lowered
Landing gear must be down and locked before spoilersarmed
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 30/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 30
Result
Checklist cannot be executed as written
pilot forced to skip step to arm spoiler
pilot has to remember to arm spoiler later,when gear is actually down and locked
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 31/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 31
Why not just use the brakes?
Excerpt from DC-9 (M
D-82) OperatingM
anual
On extremely slippery runways at high speeds,
the pilot is confronted with a rather gradual
deceleration and may interpret the lack of an
abrupt sensation of deceleration as a total anti-
skid failure.
The natural response might be to pump the
brakes or turn off the anti-skid. Either action
will degrade braking effectiveness.´
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 32/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 32
Taken Together:
Assigned co-pilot sick
Replacement pilot called out on short notice
Replacement pilot assigned as CP, per policy
Replacement pilot had not flown recently as CP
Pilot chose ILS approach Aircraft had slow landing gear hydraulics
Spoilers cannot be armed before gear down
ILS approach checklist can not be executed as written
Flight simulator allows 10 sec to lower landing gear
Wet runway
Manual braking discouraged on slippery runways
Anything Abnormal?
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 33/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 33
Accidents as unexpected combinations of
normal variability
Time
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 34/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 34
Seem ominous?
Accidents can happen when everything
appears normal
Modeling is difficult and time consuming
Impact of subtle interactions is only apparentafter the event
Failure is not always predictable
The A/I conclusion might be ³the accident wasnot avoidable´ (except in hindsight)
What can you do?
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 35/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 35
How do you feel about this?
Work as Imagined
Work as Done
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 36/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 36
Things go right because:
Systems are well designed and maintained
Work planners can anticipate and compensate
for abnormal conditions
Procedures are complete, correct and current
People behave as they are expected to ² as
they are taught
Therefore, humans are a liability and performancevariability is a threat.
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 37/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 37
Things go right because people:
Learn to overcome design flaws and functionalglitches
Adapt their performance to meet the demands
of a dynamic work environment
Interpret and apply procedures to match
changing conditions
Can detect and correct when things go wrong
Therefore, humans are an asset without which
the work could not be successfully completed.
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 38/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 38
How most work happens «
S
U
CC
E
S
S
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 39/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 39
The traditional focus is pre-job
Work as Imagined
Work as Done
Work
planning
Hazard
AnalysisProcedures
Pre-Jobs
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 40/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 40
More focus on post-job
Work as Imagined
Work as Done
Post-JobReview Normally
Successful!
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 41/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 41
Six Simple Questions
What happened the way it should have?
What didn't happen the way it was supposed to?
What hazards did we miss?
Which steps did we have to interpret?
Where did we detect and correct?
Where did we have to ³make do´ to get the job done?
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 42/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 42
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 43/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 43
A question to ponder «.
The basis for the Sequence of Events and
Epidemiological models is the assumption of cause
and effect relationships
In the Systemic model, accidents are seen to emerge
from unexpected interactions of normal variability in the
system rather than cause and effect relationships
So, does causality exist?
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 44/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 44
Cause and Effect in the Real World
Cause is inferred from observation, but is not alwayssomething that can be observed directly
Normally, we repeatedly observe Action A followed by
Effect B and conclude that B was caused by A
Action A Effect B
Observable ObservableNot Observable
(concluded)
Source: Hollnagel, Erik (2004) Barriers and Accident Prevention
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 45/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 45
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 46/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 46
Cause and Effect in Investigations
Investigations involve the notion of backward causality,
i.e., reasoning backward from Effect to Action
We observe Effect B, assume that it was caused by
something and then try to find out which preceding
Action was the cause of it
Effect B
Observable Observable
Not
Observable
(constructed)
Source: Hollnagel, Erik (2004) Barriers and Accident Prevention
Action ?
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 47/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 47
Common problems working backwards
Human tendency to draw conclusions that are not
logically valid
We tend to use educated guesses, intuitive judgment,
or ³common sense´ rather than rules of logic Event timelines create sequential relationships that
seem to infer a causal relationship
Because lots of actions are taking place, there is
usually one that seems plausible
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 48/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 48
Requirements for a cause ± effect
relationship
1. The cause must precede the effect (in time)
2. The cause and effect must be contiguous in
time and space
3. The cause and effect must have a necessary
and constant connection between them, such
that the same cause always has the same
effect
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 49/50
UNCLASSIFIED
Operated by Los Alamos National Security, LLC for NNSA 49
Any ³causes´ on this list?
Assigned co-pilot sick
Replacement pilot called out on short notice
Replacement pilot assigned as CP, per policy
Replacement pilot had not flown as CP for 6 months
Pilot chose ILS approach
Aircraft had slow landing gear hydraulics
Spoilers cannot be armed before gear down
ILS approach checklist not doable as written
Flight simulator allows 10 sec to lower landing gear Wet runway
Manual braking discouraged on slippery runways
Assigned co-pilot sick
Replacement pilot called out on short notice
Replacement pilot assigned as CP, per policy
Replacement pilot had not flown as CP for 6 months
Pilot chose ILS approach
Aircraft had slow landing gear hydraulics
Spoilers cannot be armed before gear down
ILS approach checklist can not be executed as written
Flight simulator allows 10 sec to lower landing gear Wet runway
Manual braking discouraged on slippery runways
8/3/2019 Non Newtonian View of Accidents
http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 50/50
UNCLASSIFIED
Operated by Los Alamos National Security LLC for NNSA 50
³The identification, after the fact, of a limited setof aspects of the situation that are seen as
necessary and sufficient conditions for the
observed effects to have occurred.
The cause, in other words, is constructed rather
than found´.- Hollnagel, Erik (2004) Barriers and Accident Prevention
What is a ³cause´?
³The cause of an accident is not found in the rubble, it isconstructed in the mind of the investigator.´
- Dekker, Sydney (2002)The Field Guide to Human Error Investigations