Accident Investigation FRAM_AA
description
Transcript of Accident Investigation FRAM_AA
-
Erik Hollnagel, 2010
The use of FRAM for accident investigation
Erik HollnagelMINES ParisTech, Crisis and Risk Research Centre
Sophia Antipolis, (F)[email protected]
-
Erik Hollnagel, 2010
FRAM analysis steps
Propose ways to monitor and dampen performance variability (indicators, barriers, design / modification, etc.)4
Define functional resonance based on potential / actual dependencies (couplings) among functions.3
Characterise the actual / potential variability of 'foreground' functions and 'background' functions (context). Consider both normal and worst case variability.
2
Identify the essential functions in the event ('foreground' functions when things go right); characterise each by six basic aspects. 1
Define the purpose of modelling and describe the situation being analysed. An event that has occurred (incident/accident) or a possible future scenario (risk).
0
-
Erik Hollnagel, 2010
FRAM analysis steps
Propose ways to monitor and dampen performance variability (indicators, barriers, design / modification, etc.)4
Define functional resonance based on potential / actual dependencies (couplings) among functions.3
Characterise the actual / potential variability of 'foreground' functions and 'background' functions (context). Consider both normal and worst case variability.
2
Identify the essential functions in the event ('foreground' functions when things go right); characterise each by six basic aspects. 1
Define the purpose of modelling and describe the situation being analysed. An event that has occurred (incident/accident) or a possible future scenario (risk).
0
-
Erik Hollnagel, 2010
The event: Comair Flight 5191Objective: Apply FRAM to the Comair flight 5191 accident in Lexington, KY, and compare to a traditionally performed investigation.
At 06:06 of August 27th, 2006, Comair flight 5191 en route to Atlanta, GA, crashed after an attempted take-off from Lexington Blue Grass Airport in Lexington, KY. The aircraft taxied out uneventfully and then inadvertently proceeded to depart from the shorter general aviation runway (runway 26) as opposed to the longer air carrier runway (runway 22). The aircraft became momentarily airborne after it struck an earthen berm, then collided with trees, and crashed. There was a significant post-crash fire consuming most of the aircraft, and 49 of the 50 passengers and crew perished.
-
Erik Hollnagel, 2010
Intended taxi/takeoff path
Actual taxi/takeoff path
-
Erik Hollnagel, 2010
NTSB analysis and conclusions... the probable cause of this accident was the flight crewmembers failure to use available cues and aids to identify the airplanes location on the airport surface during taxi and their failure to cross-check and verify that the airplane was on the correct runway before takeoff. Contributing to the accident were the flight crews nonpertinent conversation during taxi, which resulted in a loss of positional awareness, and the Federal Aviation Administrations (FAA) failure to require that all runway crossings be authorized only by specific air traffic control (ATC) clearances.
NTSB. (2007). Attempted takeoff from wrong runway, Comair Flight 5191, Bombardier CL-600-2B19, N431CA, Lexington, Kentucky, August 27, 2006 (Aircraft Accident Report NTSB/AAR-07/05).
Washington, DC: National Transportation Safety Board.
Formal accident investigations usually start with an assumption that the operator must have failed, and if this attribution can be made, that is the end of serious inquiry. (Perrow (1984). Normal Accidents)
-
Erik Hollnagel, 2010
FRAM analysis steps
Propose ways to monitor and dampen performance variability (indicators, barriers, design / modification, etc.)4
Define functional resonance based on potential / actual dependencies (couplings) among functions.3
Characterise the actual / potential variability of 'foreground' functions and 'background' functions (context). Consider both normal and worst case variability.
2
Identify the essential functions in the event ('foreground' functions when things go right); characterise each by six basic aspects. 1
Define the purpose of modelling and describe the situation being analysed. An event that has occurred (incident/accident) or a possible future scenario (risk).
0
-
Erik Hollnagel, 2010
Identifying Functions: General
An accident investigation typically starts from the observed (adverse) outcome, and traces the developments backwards in order to find out what went wrong or malfunctioned.
PURPOSE: The purpose of a FRAM analysis is to identify how the system should have functioned for everything to succeed (i.e., normal performance), and then understand the variability which alone or in combination prevented that from happening.
MODEL: A FRAM model describes a systems functions and the potential couplings among functions. But the model does not describe or depict a sequence of events, i.e., the accident scenario.
INSTANTIATION: An accident scenario can be the result of an instantiation of the model. The instantiation is a map of how functions are coupled under given favourable or unfavourable - conditions.
-
Erik Hollnagel, 2010
Identifying Functions: Details
There is no single, correct level of description. A FRAM model will typically comprise functions described on different levels. If there can be significant variability in a function, then it is possible to go deeper into the analysis of that function, and possibly break it down into subfunctions..
The analysis may go beyond the boundaries of the system as initially defined. If some function outside the system can vary and thereby affect other functions inside the system, then it should be included in the analysis.
A FRAM analysis can in principle begin with any function. The analysis will show the need for other functions to be included, i.e., functions that are coupled or linked through various relations. FRAM defines six types of relations.
Where to begin
Level of description
Level of detail
System boundary (stop rule)
-
Erik Hollnagel, 2010
FRAM analysis steps
Propose ways to monitor and dampen performance variability (indicators, barriers, design / modification, etc.)4
Define functional resonance based on potential / actual dependencies (couplings) among functions.3
Characterise the actual / potential variability of 'foreground' functions and 'background' functions (context). Consider both normal and worst case variability.
2
Identify the essential functions in the event ('foreground' functions when things go right); characterise each by six basic aspects. 1
Define the purpose of modelling and describe the situation being analysed. An event that has occurred (incident/accident) or a possible future scenario (risk).
0
-
Erik Hollnagel, 2010
Output
Resource
Control
Input
Precondition
Time
FRAM functional unit (module)
That which is used or transformed to
produce the output. Constitutes the link to
previous functions.
That which is produced by function. Constitute links to subsequent functions.
That which is needed or consumed by function to process input (e.g., matter, energy, hardware, software, manpower).
That which supervises or adjusts a function. Can be plans, procedures, guidelines or other functions.
System conditions that must be fulfilled before a
function can be carried out.
Time available: This can be a constraint but can also
be considered as a special kind of resource.
-
Erik Hollnagel, 2010
Normal taxi & takeoff sequence
Review of weather and airport dataTaxi briefingTakeoff briefingEngine startATC clearance(s)Taxi ChecklistTaxi to runwayBefore takeoff checklistWait at the hold short lineTurn onto runwayTakeoff
-
Erik Hollnagel, 2010
Review of weather and airport data
Dispatcher
prepares flight
information
RP
I
T
O
C
Review of
weather and
airport data
RP
I
T
O
C
KLEX NOTAM
generation
RP
I
T
O
C
NOTAM describing a portion of a taxiway closed due to construction (taxiway Alpha North of runway 26) missing from flight release, not included in the ATIS broadcast on the morning of the accident as required.
-
Erik Hollnagel, 2010
FRAM analysis steps
Propose ways to monitor and dampen performance variability (indicators, barriers, design / modification, etc.)4
Define functional resonance based on potential / actual dependencies (couplings) among functions.3
Characterise the actual / potential variability of 'foreground' functions and 'background' functions (context). Consider both normal and worst case variability.
2
Identify the essential functions in the event ('foreground' functions when things go right); characterise each by six basic aspects. 1
Define the purpose of modelling and describe the situation being analysed. An event that has occurred (incident/accident) or a possible future scenario (risk).
0
-
Erik Hollnagel, 2010
.. failure to use available cues and aids ..
Dispatcher
prepares flight info
RP
I
T
O
CReview
of weather
and airport data
RP
I
T
O
C
KLEX NOTAM
generation
RP
I
T
O
C
KLEX ATIS
Service
RP
I
T
O
CAt the time of the accident, the flight crew had the most recent Jeppesen chart for LEX, dated January 2006. This chart showed taxiway A5 and taxiway A north of runway 8/26. However, at the time of the accident, taxiway A5 had been redesignated as taxiway A, and taxiway A north of runway 8/26 had been closed.
The local NOTAM that indicated that taxiway A north of runway 8/26 was closed, was not
included in the Comair flight planning system or the flight release paperwork for the flight because the company determined that the
information in the local NOTAM did not affect safety of flight.
-
Erik Hollnagel, 2010
Beginning to build the larger picture
Perform taxi
checklist
RP
I
T
O
C
KLEX ATC
clearance
RP
I
T
O
C
KLEX taxi
briefing
RP
I
T
O
C
Perform before take-off checklist
RP
I
T
O
C
Taxi to runway
RP
I
T
O
C
Taxi onto runway
RP
I
T
O
C
-
Erik Hollnagel, 2010
... the probable cause of this
accident was the flight crewmembers
failure to use available cues and
aids ...
NTSB conclusion:
-
Erik Hollnagel, 2010
FRAM analysis steps
Propose ways to monitor and dampen performance variability (indicators, barriers, design / modification, etc.)4
Define functional resonance based on potential / actual dependencies (couplings) among functions.3
Characterise the actual / potential variability of 'foreground' functions and 'background' functions (context). Consider both normal and worst case variability.
2
Identify the essential functions in the event ('foreground' functions when things go right); characterise each by six basic aspects. 1
Define the purpose of modelling and describe the situation being analysed. An event that has occurred (incident/accident) or a possible future scenario (risk).
0
-
Erik Hollnagel, 2010
ConclusionsThe outcome of an accident investigation depends on how it is carried out:What You Look For Is What You Find (WYLFIWYF)
The common (structural) approach is to work backwards from the outcome, and to look for an acceptable cause or set of causes. This is supported by institutionalised methods, models, and/or regulations. The result is a set of failures or malfunctions, that become the target of remedial action.
An alternative (functional) approach is to account for the normal operations (successes) and to explain how and why they varied under the conditions
This produces an understanding of how functions (tasks) may depend on each other, and how performance variability can unexpectedly combine and propagate, hence how normally successful actions may sometimes fail. Recommendations are about how and when to dampen or block variability and how and when to foster it.