Air Safety Through Investigation APRIL–JUNE 2015 Apr Jun 2015... · 2015-04-08 · Air Safety...

Air Safety Through InvestigationJournal of the International Society of Air Safety Investigators

APRIL– JUNE 2015

Touchdown Too Long; SMS Comes Up ShortPage 4

Fuel Contamination Can Still Pose a Risk2

Safety Cultures and Accident Investigation Lessons LearnedPage 25

‘Just Culture’Page 8

The Influence, Measurement, and Development of Organizational Safety CulturePage 16

Investigation Challenges Created by Organizational IssuesPage 20

2 • April-June 2015 ISASI Forum

CONTENTS

Publisher Frank Del Gandio Editorial Advisor Richard B. Stone

Editor Esperison Martinez Design Editor Jesica Ferry

Associate Editor Susan Fager

Volume 48, Number 2

ISASI Forum (ISSN 1088-8128) is published quarterly by the International Society of Air Safety Investigators. Opinions expressed by authors do not necessarily represent official ISASI position or policy.Editorial Of fices: Park Center, 107 East Holly Avenue, Suite 11, Sterl ing, VA 20164-5405. Telephone 703-430-9668. Fax 703-430-4970. E-mail address [email protected]; for editor, [email protected]. Internet website: www.isasi.org. ISASI Forum is not responsible for unsolicited manuscripts, photographs, or other materials. Unsolicited materials will be returned only i f submitted with a self-addressed, stamped envelope. ISASI Forum reserves the right to reject, delete, summarize, or edit for space con- siderations any submitted article. To facil i-tate editorial production processes, Ameri-can English spell ing of words will be used.

Copyright © 2015—International Society of Air Safety Investigators, all r ights reserved. Publication in any form is prohibited without permission. ISASI Forum reg is-tered U.S. Patent and T.M. Off ice. Opinions expressed by authors do not necessarily represent of f icial ISASI position or policy. Permission to reprint is available upon ap-plication to the editorial of f ices.Publisher’s Editorial Profile: ISASI Forum is printed in the United States and published for professional air safety investigators who are members of the International Society of Air Safety Investigators. Editorial content emphasizes accident investigation f indings, investigative techniques and experiences, regulatory issues, industry accident preven-tion developments, and ISASI and member involvement and information.Subscriptions: A subscription to members is provided as a portion of dues. Rate for non-members (domestic and Canada) is US$28; Rate for nonmember international is US$30. Rate for all l ibraries and schools is US$24. For subscription information, call 703-430-9668. Additional or replacement ISASI Forum issues: Domestic and Canada US$4; international member US$4; domes-tic and Canada nonmember US$6; interna-tional nonmember US$8.

INCORPORATED AUGUST 31, 1964

Air Safety Through InvestigationJournal of the International Society of Air Safety InvestigatorsFEATURES

DEPARTMENTS

ABOUT THE COVER

4 Touchdown Too Long; SMS Comes Up ShortBy Philippe Mauviot and Romain Bevillard, Bureau d’Enquêtes et d’Analyses (BEA) pour la sécurité de l’aviation civile—The authors show in what ways SMS helps refine the investigators’ questioning, and how investigations and SMS can pro-vide each other with feedback.

8 ‘Just Culture’ By Kevin Humphreys, Director, Safety Regulation, Irish Aviation Authority—Examining the question Can There Be a Just Culture in Aviation Safety Occurrence Reporting Systems?

16 The Influence, Measurement, and Development of Organizational Safety CultureBy Rick Sellers, Managing Director, Convergent Safety, and Vice President, Aus-tralian Society of Air Safety Investigators—Discussion of how safety culture can be assessed and a number of processes that can be used to drive improvements in organiza-tional safety culture and therefore organizational safety performance.

12 Fuel Contamination Can Still Pose a RiskPresented by Capt. Victor Liu, Hong Kong Civil Aviation Department (HKCAD)—A complex investigation of a “Mayday”-type accident reminds that fuel contamination remains a hazard that can pose serious risk in aviation.

20 Investigation Challenges Created by Organizational Issues By Koji Fukuda, Aircraft Safety Investigator, Japan Transportation Safety Board (JTSB)—Presented is a case study of a flight school’s fatal accident that revealed deep organizational problems, which hampered the investigation throughout the case.

2 Contents3 President’s View—ISASI Makes Its Official ICAO Approved Observer Presence30 ISASI Information32 Who’s Who—Plane Sciences

On the night of Oct. 16, 2012, the crewmember, of a Bombardier CRJ700 was fly-ing between Paris Orly and Lorient Lann Bihoué, their fifth and last flight of the day. They landed about 1,100 meters past the threshold of Runway 25 and did not manage to stop the airplane, overrunning the runway. At the time of the land-ing, a crosswind of about 15 knots was blowing in gusts and a heavy squall was sweeping across the aerodrome. The visibility was reduced to between 2,000 and 3,000 meters, and the runway was described as being wet with puddles of water.Photo: Bureau d’Enquêtes et d’Analyses (BEA)

25 Safety Cultures and Accident Investigation Lessons LearnedBy Barbara A. Czech, Loren Groff, Ph.D., and Barry Strauch, Ph.D., the U.S. National Transportation Safety Board—The authors describe lessons learned from a recent National Transportation Safety Board safety culture forum, and their impli-cations for investigating organizational safety issues during an accident or incident investigation.

April-June 2015 ISASI Forum • 3

PRESIDENT’S VIEW

ISASI Makes Its Official ICAO Approved Observer Presence

Our long-term effort to become a voice in appropriate Interna-tional Civil Aviation Organization (ICAO) matters has become a

reality. It began with achieving observer status at ICAO proceedings in February 2013. Most recently, we were invited to attend ICAO’s Second High-Level Safety Conference (HLSC 2015) as an approved international observer or-ganization. The ISASI delegation at the February 2–5 conference included Ron Schleede as chief observer and Robert MacIntosh and Nick Stoss as observers.

The importance and size of the HLSC may be gleaned from the 720 repre-sentatives from 120 countries and 35 international organizations who at-tended the meeting. Two agenda items were of particular interest to ISASI and to our mission. The first dealt with “Global Tracking of Aircraft and Opera-tions Near Conflict Zones.” Regarding this topic, our delegation made its first comment saying that the Society “…fully supports the concepts of performance-based solutions to worldwide aircraft tracking as presented [in working pa-pers]. Our membership’s mission of ac-cident investigation must have evidence. Without hard evidence, we find our-selves unable to identify causal factors and complete the full spectrum of safety recommendations to preclude recur-rence of similar accidents and serious incidents. We encourage the concepts proposed here today to further enhance global flight tracking of aircraft and look forward to continuing ICAO action with appropriate urgency.”

The second matter that elicited an ISASI response was a plenary discus-sion on the subject of “Safety Informa-tion Protection and Safety Information Sharing.” Our delegation noted that we support “…the general concept regard-ing sharing of safety data as a proactive means of preventing accidents and incidents, as long as the proper protec-tions are in place, as discussed in other working papers. However, as many of the members of ISASI are aware, includ-

ing many air safety investigators in this room today, sometimes the proactive prevention measures fail and an acci-dent occurs. One of the most important products of our investigations is safety recommendations developed to prevent future accidents. Sharing of such recom-mendations and any safety actions taken is very important. ISASI supports the development of an ICAO global database of safety recommendations and also sup-ports the proposals…that the conference support the establishment of a global safety recommendations database and recommends ICAO to take appropriate actions for the development and man-agement of such a database.”

Ron’s final report on this conference, from which this material was drawn and which goes into more detail, is posted on the ISASI website (www.isasi.org). It is well worth reading to gain a sense of the full participation and impact we may have made at the conference.

Another significant ICAO endeavor is the establishment of an Accident Inves-tigation Panel (AIGP) under the aus-pices of the Air Navigation Commission. In establishing the panel, ICAO said, “This action stems from developments requiring that accident and incident investigation methodologies, techniques, and procedures progress more efficiently and expeditiously. The work of the AIGP will advance strategies, policies, and provisions relevant to states’ accident investigation authorities, enabling devel-opment of investigations in a timely and cost-effective manner.”

In addition to the participation invita-tion extended to ISASI, the following states and international organizations were invited to participate on the AIGP: Australia, Brazil, Canada, Costa Rica, France, Ireland, Nigeria, Singapore, the United Arab Emirates, the United King-dom, the United States, the Interna-tional Air Transport Association (IATA), the International Federation of Air Line Pilots’ Associations (IFALPA), and the Interstate Aviation Committee (IAC).

The first meeting of the AIGP is

By Frank Del Gandio,President

proposed to take place at ICAO headquarters in Montréal, Canada, in April 2015. Ron Schleede, Robert MacIntosh, and Nick Stoss will again represent us at this meaningful meeting.

The AIGP will research and develop provisions for accident and incident in-vestigations to allow for timely and effec-tive investigations as set forth in Annex 13, and in support of the Global Aviation Safety Plan (GASP). The objectives cited in the State Letter Terms of Reference are as follows:

• Develop and maintain provisions for accident/incident investigations in support of the GASP.

• Consider new procedures, tech-niques, and methodologies for investigations, proposing amend-ments to provisions and guidance as necessary.

• Review Attachment E to Annex 13, along with other relevant provisions, and determine measures to enhance the protection of safety information gathered during investigations, in particular of certain accident and incident records.

• Identify the category of serious incidents that could be precursors to, or associated with, the types of accidents having the ighest rate of fatalities (e.g., LOC-I, CFIT, runway incursion/excursion) and discuss strategies for investigating those incidents.

• Consider methodologies to assist states with limited resources to conduct large-scale investigations, including regional accident and incident investigation organizations (RAIOs).

ISASI looks forward to working with these states and other international organizations to help develop provisions so that accident and incident investiga-tions progress more efficiently and expeditiously.


exposed in its daily operations and had grouped risks together on a map. Follow-ing this approach, the airline identified the runway excursion as an “ultimate event.” The long landing was designated as an “undesirable event.” The operator then identified the safety barriers to pre-vent the occurrence of a long landing.

This list of barriers (see Table 1) constituted a guide for the safety inves-tigation. It allowed us to ask ourselves precise questions about the operator’s organizational aspects:

• Was the list of identified barriers complete?

• Were these barriers really in place?

• How did the operator ensure the ef-fectiveness of these barriers?

The answers to these questions can be tricky to find, but they make it possible to identify and understand the organiza-tion’s latent failings.

Another operator, another world—The use of Lorient Lann Bihoué aerodrome is mixed: military and civil. The PSNA is military. European regulation does not require certification in such cases.

Touchdown Too Long; SMS Comes Up ShortThe authors show in what ways SMS helps refine the investigators’ questioning, and how investigations and SMS can provide each other with feedback. By Philippe Mauviot and Romain Bevillard, Bureau d’Enquêtes et d’Analyses (BEA) pour la sécurité de l’aviation civile

On the night of Oct. 16, 2012, the crewmembers of a Bombardier CRJ700 were flying between Paris Orly and Lorient Lann

Bihoué, their fifth and last flight of the day. They landed about 1,100 meters past the threshold of Runway 25 and did not manage to stop the airplane, over-running the runway. At the time of the landing, a crosswind of about 15 knots was blowing in gusts, and a heavy squall was sweeping across the aerodrome. The visibility was reduced to between 2,000 and 3,000 meters, and the runway was described as being wet with puddles of water. The crewmembers of the previous flight had reported difficulties during their landing because of aquaplaning.

The initial findings brought to light active errors by the flight crew—

• excessive speed on short final,

• a long landing,

• underestimating the meteorological conditions,

• underestimating the runway con-tamination.

These errors were amplified by a non-sterile cockpit.

These initial findings raised two ques-tions whose answers constituted real levers to improve safety:

1. How could such an accident hap-pen to a competent and correctly trained crew, given that other crews could be confronted with the same difficulties? 2. How can the aviation system be improved to better detect a crew’s fail-ings in public transport?Following an approach based on

identifying systemic failures, the safety investigation then turned to organiza-tional factors. These provided plenty of possible answers and led to an analysis of the safety management system (SMS) of the various actors in this complex event.

Investigations and SMSThe method applied by the BEA was consistent with its usual practices. Some working groups (Operations, Systems/Performance, and Aircraft) were set up and mandated to cover all aspects of the investigation. The Operations Group was responsible for the examination and analysis of the organizational and systemic factors. This led the group to study the SMS of the airline, the ATC service provider (PSNA), and the aero-drome operator.

The first challenge for the investiga-tion team was to understand how the SMS of each operator worked. The de-clared aim of an SMS is, through a gen-eralized proactive approach within the organization, to identify the risks and establish risk prevention measures. The temptation could thus be great, in the context of an investigation, to conclude that the SMS failed. This would be fall-ing into the trap of an easy retrospective bias without helping the organizations involved to progress in their mastery of safety.

The airline’s SMS—The airline had determined a list of risks to which it was

Table 1: Example of facts established based on the airline’s risk map.

Barrier Fact

The flight crew carried out the standard ap-proach procedures.

Flight analysis showed the existence of many long landings.

The flight crew configured the airplane for the landing.

The airline’s opera-tions manual included a noncompliant configura-tion in the airplane’s flight manual.

The flight crew applied flare techniques.

The flare techniques were not described in a uniform manner in the airline’s documentation.

(Adapted with permission from the authors’ technical paper entitled Touchdown Too Long; SMS Comes Up Short presented at ISASI 2014 held in Adelaide, Australia, Oct. 13–16, 2014, which carried the theme “Investigations and Safety Management Systems.” The full presentation, including cited refer-ences to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2014 Technical Papers.”—Editor)


France nevertheless decided to certify all of the PSNA’s involved in commercial aviation operations. These have an SMS like that required by the European regulation.

In the context of this accident, the PSNA was thus certified, but no SMS dedicated to airport activity and its associated risks was in place.

Consideration of SMS in the investigation was then oriented toward simple fact gathering in relation to the benefits of an SMS:

• establishing good practices as defined by the Direction Générale de l’Aviation Civile (DGAC, the French civil aviation authority) in rela-tion to airport operations, by the military operator,

• the military operator taking into account ASRs concerning infra-structure, and

• reducing the time required to correct any problems identified.

Investigative actions linked to SMS remained traditional. The investi-gation’s approach (organizational and systemic) remained the same for the BEA, but a privileged correspondent was identified: the SMS man-ager. In fact, the discussions with the various operators were facilitated by the existence of SMS and by sharing the common objective—risk management.

Touchdown too long; SMS comes up shortThe examples that follow illustrate the use of SMS during the inves-tigation. They show the difficulty of measuring the overall impact of SMS in improving safety today.

Long landing: Overall measurement V specific risk—The airline had launched a study on long landings (beyond 600 meters past the threshold) within its operations. Based on the first results, a significant number had been identified. The factors that could contribute to these long landings were many and led to defining an overall policy to prevent these long landings:

• Zero tolerance for landings outside of the area specified in the operations manual during training and check activities.

Figure 1

Philippe Mauviot joined the French Air Force in 1973 as an engineer and pilot, flying fighter aircraft, including 1,000 hours on the MIRAGE III, then the TRANSALL C160 tactical transport and later did 2,000 hours on PUMA helicop-ters. He became a helicopter test pilot and also commanded various

air units and participated in military operations in foreign countries. He was awarded the Aeronautical Medal, the Légion d’Honneur, and the l’Ordre Nationale du Mérite. He is an officer graduate of the Staff Technical College. After a 30-year military career and more than 5,000 flying hours, he left the French Air Force with the rank of colonel. Philippe joined the BEA Investigation Department in 2002 and has participated in and managed national and international investigations in both general aviation and public transport.

Romain Bevillard joined the BEA in 2002, after obtaining his MSc in engineering. He served as a flight recorder specialist for six years, then became an investigator-in-charge/accredited rep for the Investigation Department in 2009. He was involved in several major investiga-tions in France and abroad, and

led the Operations Group in the AF447 investigation. He currently serves as an investigation team leader, accredited rep, and investigator-in-charge. He has a university degree in human factors.


• Distribution of information to pilots on long landings and their conse-quences (not completed at the time of the accident).

This overall policy nevertheless came up against technical and operational dif-ficulties. Specifically, the flight simulator did not make it possible for the operator to check the landing area during train-ing and checks.

In addition, an overall measurement of landings did not make it possible for the specific features of each aerodrome to be taken into account. Thus, in the overall statistic (see Figure 1, page 5), long landings with CRJ700s at Lorient Runway 25 only represented a rate of 6%.

A targeted analysis of the shortest aerodromes (see Figure 2) would have made it possible to identify the higher exposure to the risk of runway excur-sions for Runway 25 at Lorient. Further, 12 landings beyond 1,000 meters on this runway appeared in this analysis.

Despite the relevant identification of the risk and of the means implemented, an overall analysis can be inadequate, and overall measures can be ill adapted to handle a specific case.

SGS-RF: Regulatory requirements V safety performance—The airline had developed a specific risk management system linked to crew fatigue (SGS-RF) over several years. This system incorpo-rated the requirements of the oversight authority for reduced rest management practiced by the airline. The SGS-RF thus contained provisions relating to fatigue in general, for example,

• recommendations to benefit from restorative sleep,

• consideration of the importance of feedback, and

• management of the controlled sleep during flight.

These provisions did not, however, specifically address the risk of fatigue that could occur while undertaking daily five-leg rotations, though they are rec-ognized by the airline as being the most demanding.

Thus, fatigue, which was identified by the BEA as a contributing factor in the accident, had not been taken into ac-count by the airline and did not thus en-

able risks to be diminished in a specific context (five legs). This example once again showed the difficulty of imple-menting risk management operationally, even though it was studied and analyzed precisely.

State of the runway: SMS, a boost to safety—As previously explained, the mili-tary aerodrome operator was not certi-fied. More than two years before the ac-cident, following two runway excursions by military aircraft, large areas of water retention had been identified where Runways 07/25 and 02/20 crossed.

As of the date of the accident, the treatment of these water retention areas by grooving the runway had been ap-

Water retention areas on the runway at Lorient Lann Bihoué.

Figure 2


proved, but the work had not yet been undertaken.

In addition, the French civil aviation authorities had notified the military aerodrome operator of many devia-tions relating to the runway markings. A corrective action plan had been issued by this operator to remedy these devia-tions approximately one year after the notification.

The investigation showed that the characteristics of Runway 25 had con-tributed to the accident. In the absence of any SMS, the aerodrome operator did not formalize any risk analysis that might have led to faster corrective meas-ures or to a restriction of operations. The investigation found that this type of aerodrome operator, with no SMS, could not guarantee the same level of safety as a certified civil aerodrome.

Recommendations: SMS, an effective new relayThe report published following the investigation includes many recommen-dations. Beyond the simple demand for regulatory compliance for some recom-mendations, the BEA considered that, for those that were directly linked to the operators’ safety performance, it would be more effective to relay them through the SMS.

Management of threats and errors—The specific features of aerodromes served by this airline were not systematically known to the crews, nor were they con-sultable. Although this is in compliance with the regulations, this situation had an operational impact that the investiga-tion recognized in the causes of the run-

way excur-sion. That is why the BEA recommend-ed, through oversight actions by the authority, that aircraft opera-tors identify the threats specific to their opera-tions in order to integrate them in their SMS. This verification by the author-

ity took place in February 2014 for the airline.

Management of fatigue risk—Fatigue, in particular that associated with the crew’s five flights on the day of the ac-cident, was identified as a contributing factor to the accident. The airline had developed an SGS-RF to best manage fatigue risk in general. This SGS-RF did not, however, specifically address the issue of five-leg flights and thus did not plan specific measures. Their set up was the subject of a recommendation. The regulatory changes linked to SMS and SGS-RF also led the BEA to recommend an evolution in SMS as such, and not of the SGS-RF.

Certification of mixed aerodromes—The safety performance of the whole of the aviation system has been made more robust thanks to the adoption of a com-mon tool, SMS. Its absence in a struc-ture can weaken the whole and thus does not offer the same level of safety.

The BEA therefore recommended that the French authorities extend to military aerodromes receiving commercial civil traffic the certification and SMS require-ments applicable to civil aerodromes with equivalent traffic.

Lessons from the symposiums and the European Action Plan for the Prevention of Runway Excursions (EAPPRE)—The lessons learned and recommended prac-tices, issued at the time of the DGAC symposium on Nov. 25, 2010, were not subject to real development in the con-text of SMS, which was recently put in place at that time.

During the investigation, the Euro-pean Commercial Aviation Safety Team (ECAST) published recommendations

to prevent runway excursions (EAPPRE) that answered many of the problems identified during the investigation.

Although not obligatory and/or regu-latory, it is significant that operators evaluate the relevance of these lessons and integrate them into their operations. The BEA therefore considered that this voluntary approach in the whole of the aviation system should be solidified through the SMS.

That was why the BEA recommended, through the authorities’ oversight actions, that SMS take into account recommendations from this work.

ConclusionThe investigation into this accident showed the legitimacy of SMS and its interest for identifying risks. The exam-ples studied brought to light all of the benefits of the SMS concept, but also all the difficulties encountered making it a reality. More than ever before, the proven concepts of feedback, continuous improvement, and the further develop-ment of flight analysis will contribute to the rise in significance of SMS, and thus to a better level of safety.

From a methodological perspective, SMS and safety investigations operate hand in hand and symbiotically. Iden-tifying risks makes it possible to track the work of the investigation, making it more diligent and effective. In return, the safety investigation can lean on the SMS to carry out its recommendations and thus contribute to their maturity. For the investigation authorities, this represents a new and alternative vector for improving safety compared to clas-sic, and indeed fastidious, regulatory changes.

As an investigation organization, the conditions of its use need to be refined to optimize our investigations and avoid falling into the trap of exposing failures in the SMS through retrospective bias. Must investigators be SMS specialists? Must all investigation groups be as-signed, in addition to their standard in-vestigation tasks, to analyzing SMS? Do investigation organizations have to par-ticipate in supporting operators in their implementation of SMS, in particular to help them to identify and classify risks? Like operators and oversight authori-ties, investigation authorities will have to hone and test their methods.

A whole new era in perspective!

This CRJ700 overran the wet and puddled runway while landing in a crosswind of about 15 knots blowing in gusts amidst a heavy squall with visibility between 2,000 and 3,000 meters.


Kevin Humphreys, a native of Dublin, Ireland, serves as the director of safety regulation in the Irish Aviation Authority (IAA). He joined the Irish Defense Forces (Air Corps) and was

commissioned a pilot officer in 1971. Qualifying as a flying instructor, he flew nine fixed-wing aircraft types and instructed on six types. He retired in 1987 and joined the Department of Transport’s Air Navigation Services as an aeronautical officer for flight operations. His duties included flight examining, airline oversight, lease fleet oversight, and flying school approval and accident investigation. During this time, he qualified on the ATR 42 and B-737-200. Upon the establishment of the IAA, he was appointed chief inspec-tor of aircraft accidents and founded the Air Accident Investigation Unit of the Department of Transport where he served until 2006. During this period, he qualified on the Airbus A320/321. He is a member of the Management Board of the European Aviation Safety Agency (EASA) and the EASA Safety Advisory Committee. He is a fellow of the International Society of Air Safety Investigators, holds a masters in eth-ics for professionals from Dublin City University, and has 8,000 flying hours.

This adapted article will examine some philosophi-cal and ethical aspects of establishing a “just culture”

in aviation safety occurrence report-ing systems. Both the International Civil Aviation Organization (ICAO) and the European Union (EU) con-sider that the accident investigation process for civil aviation has been crucial in increasing aviation safety as a result of lessons learned. This is a reactive process and is carried out after the accident has occurred and is the crudest and most expen-sive method of accident prevention. To avoid future accidents, analyses of occurrences—other than acci-dents—that may affect safety are es-sential. To capture this information, aviation professionals are required by law to report these events with the understanding that no punitive action, either professional or legal, will be initiated against them. The protection offered is referred to as just culture and is defined by the EU as “a culture in which front line operators or others are not punished for actions, omissions, or decisions taken by them that are commensurate with their experi-ence and training, but where gross negligence, willful violations, and destructive acts are not tolerated.”

Both ICAO and the EU require states to establish mandatory and voluntary confidential reporting sys-tems. This is based on the premise that incidents and occurrences are

(Adapted with permission from the author’s technical paper entitled ‘Just Culture’: Can There Be a Just Culture in Aviation Safety Occurrence Reporting Systems? presented at ISASI 2014 held in Adelaide, Australia, Oct. 13–16, 2014, which carried the theme “Investigations and Safety Management Systems.” The full presentation, including cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2014 Technical Papers.”

The paper from which this article is adapted was condensed from a minor thesis by Kevin Humphreys for the award of a master’s degree in ethics for professionals. The full paper is available from the author upon request.—Editor)

very often the precursor to accidents and that accidents could have been avoided if near accidents, of like or similar type, had been reported, investigated, and preventative or mitigating action taken. The difficulty in getting aviation pro-fessionals, whether they are pilots, air traffic controllers, engineers, mechanics, or airport staff, to report incidents or oc-currences is the fear of being dismissed, penalized, ridiculed or, indeed, causing such effects to be experienced by others.

In endeavoring to establish the concept of just culture, various safety protagonists and organizations, including the European Organization for the Safety of Air Navigation (EUROCONTROL), have tried to define what is meant by just culture. Whether this has yet reached an agreed-to definition will be discussed, and it will be shown that information provided to the accident investigation process, though specifically gathered for safety purposes only, has been used in ju-dicial processes, both civil and criminal. Thus, the protections offered to prevent such misuse have proved inadequate, and the criminalization of aviation professionals for error, while it may have always existed, is increasing as a result of the success of the accident investiga-tion process in establishing the causes of accidents and incidents.

Historical backgroundCivil aviation is the safest form of mass transportation. Since World War II, im-provements in aviation safety have made the system asymptotic—a rate that is so low it is almost zero and on a linear scale

The author examines the question: Can There Be a Just Culture in Aviation Safety Occurrence Reporting Systems?

‘Just Culture’

By Kevin Humphreys, Director, Safety Regulation, Irish Aviation Authority


would equal zero at infinity. This contin-ued successful reduction in the accident rate over a 60-year period was no doubt due to the accident investigation process created by ICAO. This process, in ac-cordance with Annex 13, states that the sole objective of the investigation of an accident or an incident is the preven-tion of accidents and incidents. It is not the purpose of this activity to apportion blame or liability. This approach is mir-rored in EU legislation that lays down the principles governing the investiga-tion of civil aviation accidents in the EU. The dilemma posed by the complicated relationship between the administra-tion of justice and a safety investigation is described by Roderick Van Dam, the head of EUROCONTROL’s legal service and chairman of EUROCONTROL’s Just Culture Task Force, as a classical drama where two antagonists are involved—one with the aim of preserving justice by investigation and prosecuting possible perpetrators and the other with the aim of enhancing aviation safety through independent investigation and reporting.

Van Dam states that “this dilemma has led to the concept of ‘just culture,’ which is based on the support and understanding of both groups of profes-sionals.” However, civil aviation is a total system composed of airlines, air traffic managers, manufactures of both aircraft and engines (as aircraft can be purchased with several makes of engine available), engineers, pilots, airport per-sonnel, and regulators, i.e., civil aviation authorities and government depart-ments, but above all, the fare-paying passenger.

Several aviation accident investigation reports and indeed incident investiga-tion reports, particularly the listed caus-es for the accident, have become the basis for criminal action against aviation professionals. This intermingling of the safety and judicial processes may lead to a detrimental effect on aviation safety, jeopardize the independence of accident investigation, and lead to injustice. The intermingling of the judicial and safety process leading to injustice further prompts the examination of just culture. However, as Sofia Michaelides-Mateou and Andreas Mateou state, the dilemma experienced by aviation professionals is that of having to choose between not incriminating themselves and enhanc-ing the safety of aviation issues of self-interest. Thus the possibility/probability

of potential litigation and accountability is accentuated.

Mateou and Mateou discuss the no-tion of trust, but they avoid the moral and philosophical questions this di-lemma creates. They deal only with the practical implications. Here we endeavor to offer a different insight. Earlier it was noted that aviation safety is now asymp-totic—that is, an accident rate so close to zero as to parallel a zero rate. How has such a level of safety been achieved? Doubtless, one factor is the realization among governments, aircraft manufac-turers, and operators that if a particular type of aircraft or airline practices were unsafe then trust would be lost in the system and it would fail.

Charles Perrow in his work on normal accidents presented what is known as “normal accident theory.” This theory proposed that many sociotechnical systems, such as nuclear plants, oil refineries, and space missions, by the late 1970s and 1980s had become so complex that unanticipated interaction of multiple small failures were bound to lead to unwanted outcomes accidents and disasters. On the face of it, given the loss of the space shuttles Challenger and Columbia and the Air France Concorde crash, this theory would seem to be correct. This led to a school of thought known as the “study of high-reliability organizations.” James Reason also discusses high-reliability organizations based on the summary of Karl Weick. Reliability is invisible in the sense that reliable outcomes are constant if nothing happens except the expected outcome, i.e., the safe landing of a flight or a suc-cessful medical procedure. Despite the fact that errors and mistakes may have occurred during the process, operators will continue to act the way they have been acting—they presume nothing has happened.

The point is that safety is a dynamic nonevent. Reason states that if inter-nal vigilance is the price of liberty then chronic unease is the price of safety. Studies of high-reliability organizations indicate that people who operate and manage them assume that each day will be a bad day and act accordingly. This “Cassandra”-like attitude is unlikely to be well received within certain organiza-tional cultures, and this will be exam-ined when discussing cultures, organiza-tional, or otherwise.

Erik Hollnagel, not dissimilar to Rea-

son with his production versus protec-tion principle, advances the “efficiency thoroughness tradeoff” principle. Both theories speak of the requirements of any sociotechnical system to evaluate risk in assessing the mitigation needed to prevent unwanted outcomes such as accidents and incidents.

Mateou and Mateou broaden the simple statement of ICAO Annex 13’s “purpose of an accident or incident investigation” that says the sole objec-tive of the investigation of an accident or incident shall be the prevention of ac-cidents and incidents. It is not the pur-pose of this activity to apportion blame or liability. Mateou and Mateou broaden the purposes of an accident or incident investigation to include the following:

• to identify and then describe the course of the events (what, where, and when).

• to identify the direct causes and contributing factors that led to the accident (why).

• to identify measures to reduce risk to prevent future similar accidents from occurring (learning).

• to evaluate the basis for potential prosecution and blame.

• to evaluate the question of guilt to avoid the liability for compensation.

It can be seen clearly that ICAO’s purpose is purely a safety one. Under its convention, it requires states to estab-lish an accident investigation body that has independence in the conduct of the investigation and unrestricted author-ity over its conduct. Any investigation carried out in accordance with the provi-sion of the annex shall be separate from any judicial or administrative proceed-ings to apportion blame or liability.

Therefore, it is evident that the re-sponsibility for investigating an accident rests with different people depending on the kind of investigation and its pur-pose. For safety purposes, it is a body in accordance with ICAO. However, in an investigation to evaluate the potential for criminal prosecution, the police and the prosecution authorities and the courts have the ultimate responsibility for pass-ing the appropriate sentence once liabil-ity and blame have been established.

ICAO recommends that states should institute an investigation into the cir-cumstances of a serious incident. This has been the case in Ireland at least


since the introduction of a separate accident and incident investigation body under EU Directive 94/56, which states that the safety investigation of accidents and incidents should be conducted under the con-trol of an independent safety investigation authority to avoid any conflict of interest and any possible interference in the determination of the causes of the occurrences being investi-gated.

The EU regulation requires that each member state shall ensure that safety investiga-tions are conducted and supervised without external interference by a permanent national civil aviation safety investigation authority capable of independently conducting a full safety investigation either on its own or through agreements with other safety investigation authorities. This author-ity shall be functionally independent of aviation authorities responsible for airworthiness, certification, flight opera-tions, maintenance, licensing, air traffic control, or any entity that could conflict with the EU Regulation 996/2010.

Mateou and Mateou cite many cases in which aviation professionals have been criminally prosecuted following an aviation accident or serious incident. In examining the intermingling of the judicial and technical investigations and how use was made of evidence from the technical investigation by a court of law, they found cases that involved the prosecution of pilots, air traffic con-trollers, and aviation regulators. ICAO Annex 13 and the EU regulation specify the records that should not be disclosed following an investigation, and Section 5.12 of the annex states that the inves-tigating authorities of an accident or incident shall not disclose the following records for purposes other than accident on incident investigation: “…unless the appropriate authority for the administration of justice determines that this disclosure outweighs the adverse do-mestic or international impact such impact may have on any future investigation.” (italic added)

The above-italicized caveat may be identified as the fundamental problem with the criminalization of error and the difficulty in achieving justice when professionals give their testimony to

a body on the understanding that the information will not be used for any purpose other than safety enhancement. The particular records are listed both in the annex and Regulation EU 996/2010 as follows:

• statements from witnesses; commu-nications between persons having been involved in the operation of the aircraft.

• medical or private information of persons involved in the accident; cockpit voice recordings and their transcript.

• air traffic control recordings; cockpit airborne image recordings and opin-ions expressed in the analysis of in-formation, including flight recorder information.

It further states that such records shall be included in the final report or its appendices only when pertinent to the analysis of the accident or incident.

The rationale for trying to protect such information is reasonable and understandable to those involved in an accident or incident. The information contained in such witness statements or records given voluntarily by persons interviewed during an investigation could be utilized inappropriately for subsequent disciplinary civil administra-tive and criminal proceedings. If such information were to be distributed, it may no longer be openly disclosed. ICAO further states that lack of access to such information would impede the investiga-tion process and seriously affect flight safety.

Countries where code Napoleon law exists (as distinct from common law countries) do not consider the require-

ments of 5.12 of ICAO requir-ing judicial authorities to con-sider the benefits and dangers of using such information. In both EU and ICAO guidelines to states, cognizance is taken of the probability of a judicial investigation into an aircraft accident or incident.

Reason’s production versus protection tradeoff introduces the concept of defenses against the drift of an organization from normal standard op-erations to system failure. He refers to this as the accident trajectory. However, before discussing this concept Reason

argues that in modern technologies individual accidents are rare and that the biggest danger comes from rare but disastrous organizational accidents in-volving causal contributions from many different people distributed widely both throughout the system and over time.

Defenses are “hard” and “soft.” Hard defenses are technical devices such as automated engineered safety features, physical barriers, and alarms. These defenses are designed to eliminate the possibility of the human selecting a function or feature at an inappropriate time, e.g., raising the undercarriage of an aircraft while it is still on the ground. Soft defenses refer to a combination of paper and people, legislation, rules and procedures, licensing, and certification. However, all of these defenses can be overcome by either ignoring them or forgetting to carry them out.

High-tech systems and cheap comput-ing power have brought about dramatic changes in the nature of human involve-ment, particularly in what are referred to as “glass cockpits” in aircraft and in nu-clear power plants. Pilots become man-agers and monitors of what the auto-mated aircraft is doing. A crucial part of this role involves the defensive function of restoring the system to a safe state in the event of an emergency. Reason argues that soft and hard defenses have lacunae and that these can be likened to a slice of Swiss cheese. If there are, say, four defenses in line, and if the holes in the cheese for some reason are aligned, then the defenses in depth are breached and the system fails, with a resulting catastrophe. In deciding how the holes in the Swiss cheese are created, Reason considers the distinction between “ac-

Criminalization of ErrorIn their study of the criminalization of aviation professionals, authors Sofia Michaelides-Mateou and Andreas Mateou outline several cases that, as a result of both the advancement in the investigation of aviation accidents as well as the demand by modern society for accountability, the judicial authority has an increasing effect on the events subsequent to an aviation accident.(Cited in Sofia Michaelides-Mateou and Andreas Mateou’s Flying In the Face of Criminalisation, The Safety Implications of Prosecuting Aviation Professionals for Accidents, Surrey, England: Ashgate Publishing Limited 2010. p. 3)


tive failures” and “latent conditions.”Interestingly, Reason originally

referred to “latent errors.” This then changed to “latent failures” and has now changed to “‘latent conditions.” When humans design, manufacture, operate, maintain, and manage complex technological systems, human decisions and actions are implicated. Errors and violations committed by front line staff contribute to the breakdown of a system; such unsafe acts that impinge directly on safety are termed active failures. Tra-ditionally these active failures satisfied investigators and organizations and so-ciety in general. Despite the rethinking of the accident and incident investiga-tion process, such failures are still cited and the term “pilot error” is normally replaced by “human error.”

However, in the last decades authori-ties and organizations are unlikely to accept sharp-end human failures as the cause of an organizational acci-dent. Reason likens latent conditions in a technical organization to resident pathogens in the human body that may be present for many years before they combine with local circumstances and active failures to penetrate the system’s many layers of defenses. Active failures are committed by those at the human-system interface (HMI). Latent condi-tions belong to the upper echelons of an organization and within related manu-facturing, contracting, and regulatory and governmental agencies.

Having set out the genesis and devel-opment of aviation safety, it is appar-ent that ICAO and the EU realize that accident investigation is a post-fact, rearward-looking process that is the crudest form of accident prevention and safety enhancement. At any stage of an accident or incident investigation, an investigating authority may make a recommendation before releasing its final report, specifying any preventive action it considers necessary to be taken promptly to enhance aviation safety. Reason’s organizational accident theory has been fully embraced by ICAO and is part of ICAO’s guidance material to states in the form of ICAO’s Safety Management Manual. The allied concept of Safety Management Systems (SMS) forms part of ICAO’s requirement for states to have a state safety program as part of a state’s accident prevention measures.

Apart from mandating states to have

an independent accident investigation process, ICAO and the EU mandate states to establish a mandatory incident reporting system to facilitate collection of information on actual or potential safety deficiencies. States are also man-dated to establish a voluntary incident reporting system to facilitate collection of information on actual or potential safety deficiencies that may not be captured by the mandatory incident re-porting system. ICAO further states that a voluntary incident report system shall be nonpunitive and afford protection to the source of information.

States are encouraged to facilitate and promote the voluntary reporting of events that could affect aviation safety by adjusting their applicable laws, regulations, and policies as necessary. As part of its accident prevention measures, ICAO mandates that states establish and maintain an accident and incident data-base to facilitate the effective analysis of actual or potential safety deficiencies ob-tained, including those from its incident reporting system, and to determine any preventive action required.

It has been established from the work of Mateou and Mateou that some states have not prevented the intermingling of the safety technical investigation and that the criminalization of accidents and incidents has increased due to the suc-cess of modern accident investigation techniques in establishing the cause of an accident. They further indicate that protection by ICAO by issuing standards cannot be applied universally due to the differing legal system in each country.

Having embraced Reason’s model of active errors and latent conditions, ICAO and the EU require incidents and occurrences to be reported to facilitate the operation of SMS. ICAO lays down its requirements and legal information in ICAO Annex 13. The EU’s require-ments are in Directive 2003/42/EC of the European Parliament and Council. The European Commission (EU) has laid down implementing rules for the integration of civil aviation occurrences information into a central repository in accordance with Directive 2003/42/EC.

The EU has a further regulation, EC1330/2007 from Sept. 24, 2007, laying down the implementing rules for the dissemination of information on civil aviation occurrences to interested parties, referred to in Article 7(2) of Directive 2003/42/EC of the European

Parliament and Council. Despite having failed to protect information given in ac-cident investigations, all safety thinking believes that from a reporting culture a learning culture will develop and this can all be accomplished in a just culture.

ConclusionThe purpose of this adapted article was to establish if there could be a just culture in aviation safety occurrence reporting. The background to aviation safety by way of the establishment of a United Nations body called ICAO was recounted. This emphasized the efforts by the United Nations during and imme-diately after the war to put structures on the development of international civil aviation. The importance of properly investigating accidents in order to pre-vent further accidents was examined as was how this process was standardized in Annex 13 to the Chicago Conven-tion. ICAO, the EU, and safety profes-sionals mandating the establishment of safety databases that contain reports of accidents, near misses, and occurrences is seen as a prerequisite for the improve-ment of aviation safety.

In the examination of the accident process, history has shown that the protection offered to people who give information to the investigation body or inquiry has not withstood the judi-cial process and that such information included flight data recorder and cockpit voice recorder data.

The function of culture was examined in the context of safety. Also emerg-ing was the lack of a safety culture in high-reliability organizations that had suffered major disasters. However, there

“Few phrases occur more frequently in discussion about hazardous technologies than safety culture; few things are so sought after and yet so little understood.”(Cited in Reason’s Managing the Risk of Organisational Accidents, Surrey, England: Ashgate Publishing Limited 1997 p. 191)

(Continued on page 29)


On April, 13, 2010, the flight crew of an Airbus A330 from Juanda Interna-tional Airport (WARR), Surabaya, In-donesia, to Hong Kong International

Airport (VHHH) declared “Mayday” when approaching VHHH. The aircraft experi-enced control problems with both engines. The aircraft landed at a groundspeed of 231 knots, with the No. 1 engine stuck at about 70% N1 and the No. 2 engine stuck at about 17% N1. Five main tires were deflated after the aircraft came to a complete stop on the runway. After being advised by the rescue leader that there were fire and smoke on the wheels, the aircraft commander initiated an

emergency evacuation of the passengers. Some passengers and cabin crewmembers were injured during the evacuation.

The Accident Investigation Division of the Hong Kong Civil Aviation Department (HKCAD) conducted an investigation into the accident in accordance with the Hong Kong Civil Aviation (investigation of ac-cidents) regulations and Annex 13 to the convention on international civil aviation. The investigation identified that the air-craft had uplifted 24,400 kilograms of fuel at WARR. The fuel, which was contami-nated, had initially caused stiction in the fuel metering units (FMU) of both engines

Figure 1. Event details of the flight from WARR to VHHH.

Fuel ContaminationCan Still Pose a RiskA complex investigation of a “Mayday”-type accident reminds that fuel contamination remains a hazard that can pose serious risk in aviation.

(Adapted with permission from the technical paper entitled Fuel Contamination Can Still Pose a Risk presented at ISASI 2014 held in Adelaide, Australia, Oct. 13–16, 2014, which carried the theme “Investigations and Safety Management Systems.” The full presentation, including cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2014 Technical Papers.”—Editor)

Presented by Capt. Victor Liu,Hong Kong Civil Aviation Department (HKCAD)

Victor Liu is currently the assistant direc-tor general responsible for safety man-agement. He is also an

appointed inspector of accidents in Hong Kong. He completed the air accidents investigation course at Cranfield University, UK, in 1998 and has participated in a number of accident and seri-ous incident investigations. He is the investigator-in-charge of this case. Victor graduated from the University of Hong Kong with a degree in social sciences. He also received a specialized master degree in aviation safety (aircraft airworthiness) at Ecole Nationale de l’ Aviation Civile in France. He is a pilot quali-fied in the Airbus A330 and the Gulfstream 450 and 200, with experience in scheduled airlines, business charter, and search-and-rescue operations.


control on both engines of the aircraft. Laboratory analy-sis indicated that the SAP spheres contained elements that were consistent with the SAP material used in the filter monitors of the ground refueling dispenser. Crystal-line sodium chloride (i.e., salt) was also present on the surface of some SAP spheres. Most of the SAP spheres found were 5 to 30 microm-eters in size with a majority being 5 to 15 micrometers. Further analysis showed that these SAP spheres contained elements of carbon, oxy-gen, sodium, chlorine, and sulphur and that they were mainly sodium polyacrylate, which is the SAP material used in a filter monitor of refueling dispensers.

While the exact mecha-nism of SAP sphere genera-tion from the filter monitors during the refueling could not be established, a mimick-ing test conducted at a labo-ratory during the investiga-tion generated SAP spheres.

and eventually caused total seizure of those components, leading to the loss of thrust control of both engines dur-ing the aircraft’s approach to VHHH. A series of events and contributing factors had in fact led to the uplift of the contaminated fuel to the aircraft.

With the collaborative ef-forts of all members, includ-ing experts from the aviation fuel industry, this rather complex investigation was successfully completed. The event has reminded us that fuel contamination remains a hazard that can pose seri-ous risk in aviation. HKCAD is currently the president of AsiaSASI and would like to share with ISASI members the valuable experiences gained from this investiga-tion.

The contaminantsThe contaminated fuel, which contained super absor-bent polymer (SAP) spheres, caused the loss of thrust

Figure 2. The cutaway view of one of the main metering valves of the engine fuel component shows the presence of SAP spheres.

It demonstrated that the presence of salt water in the fuel and under an operating profile of low-flow-rate refueling, as practiced in WARR, could have generated SAP spheres.

A “perfect storm”There were a series of events and contributing factors lead-ing to penetration of all the safety layers and the formation of such a “perfect storm,” i.e., the uplifting of contaminated fuel to the aircraft.

WARR had an apron extension project that was started in 2009 that involved extension work of the hydrant refueling circuit that supplied fuel to stand No. 8, where the accident aircraft was parked and refueled before departure. A fuel sample collected from the reworked hydrant after the acci-dent contained salt. WARR is located close to the seashore and has three regulating ponds. The water of the regulating pond closest to the apron extension worksite was found to contain salt. The tie-in process of the extended hydrant re-fueling circuit required open cutting of the existing under-ground piping. Records show that during the tie-in process-ing period, there were heavy rains and water puddles at the worksite. It’s likely that the water puddles at the worksite contained salt. It’s likely that the required tie-in procedures had not been strictly followed and that salt water might have therefore entered the hydrant refueling circuit during the hydrant extension work.

The fuel industry has a set of robust requirements and procedures regarding aviation fuel supply, including recom-missioning procedures required on any hydrant system. The recommissioning process of the reworked hydrant refueling circuit involved flushing the affected circuit. The flushing procedures after the hydrant rework had not adequately addressed all the essential elements stated in the Energy Institute’s (EI) Document 1585, which is a set of guidelines accepted as international practice when cleaning aviation fuel hydrant systems at airports. It’s likely that the flushing

Figure 3. Microscopic view of spheres and their composition under scanning electronic microscope analysis.


did not completely remove the salt water in the hydrant refueling circuit.

In addition, the investigation noted that the recommissioning process of the re-worked hydrant circuit was not properly coordinated by the parties concerned and hence led to prematurely resuming opera-tion of the reworked hydrant system while the hydrant system still contained salt.

After prematurely resuming operation of the hydrant, there were several unsched-uled filter monitor replacements for the refueling dispensers at WARR. These events

indicated the possible fuel contamination in the hydrant system as the filter monitors had been activated by salt water. However, such abnormal events were not investigated by the fuel supplier and hydrant operator. In addition, it was noted that the refueling op-eration at WARR, in particular the low-flow-rate refueling and dispenser differential pressure (DP) recording and monitoring, did not fully comply with the international fuel industry’s latest guidelines.

The filter monitors of the dispenser used for refueling the accident aircraft had in

fact been in contact with salt water. The SAP media in the filter monitors of the dispenser came into contact with salt water, turn-ing into a gel state and causing an increase in DP and vibration of the refueling hose during the refueling of the accident aircraft. However, the unusual vibration was not immediately stopped and properly investigated. The contin-ued refueling had eventually led to the uplift of fuel contaminated with SAP spheres to the aircraft!

Lessons learnedThe aviation industry and com-munity have been promoting the safety management system (SMS), which is a system to en-sure the safe operation of aircraft through effective management of safety risk. The quality of aviation fuel is no doubt paramount to the safe operation of aircraft. Any risk related to fuel contamination, al-beit a very remote risk, could lead to very serious consequences.

The fuel industry has stringent specifications, requirements, and guidance material to ensure the high quality of aviation fuel supplied to aircraft. The fuel industry follows the published specifications, requirements, and guidance to establish operating procedures and performs audits to ensure compliance. While aircraft operators develop audit program based on their opera-tional experiences, they still have to rely on fuel suppliers at airports to provide high-quality fuel to aircraft. Nevertheless, there was no overarching international civil aviation requirement regarding the control of aviation fuel qual-ity and the training of personnel who carry out fuel supply or those responsible for the oversight of fuel quality at airports. Manually monitoring DP changes in a fuel-ling dispenser during refueling is also considered ineffective.

Apart from making recommen-dations to the relevant parties at WARR to ensure that the recommissioning procedures of the hydrant system are properly completed before resuming the hydrant refueling operation at

Figure 4. The Swiss cheese model in the safety management system.

Figure 5. A photo taken during the tie-in process.


the affected parking stands, the investiga-tion team has also recommended that the International Civil Aviation Organization (ICAO) establish civil aviation requirements for oversight and quality control of the avia-tion fuel supply at airports and to require installing a device in the equipment used in refueling aircraft. This device should be able to automatically alert the equipment opera-tor and stop the refueling process when the DP across the equipment filtration system is outside of the equipment-designed value or range.

Under the leadership of ICAO and with the collaborative efforts of many parties, particularly the International Air Transport Association’s Technical Fuel Group, the Manual on Civil Aviation Jet Fuel Supply was published. The document acts as a “sign-post” regarding relevant industry practices, covering all matters related to aviation fuel quality control, operations, and training

across the entire supply and distribution system, from refinery to aircraft.

While the investigation has been complet-ed, the fruitful investigation process has re-minded us of the noble objective of accident investigation, i.e., the prevention of accident and incidents. Although the subject aircraft landed safely on the ground with the earnest efforts of the professional crew, members of the aviation community shall not forget the important lesson learned. It also reminds us that whenever there is a change of circum-stances, such as the recommissioning of the reworked hydrant system in this case, all parties involved should be more vigilant in making a more robust assessment and audit.

Hopefully the aviation community can make the best use of the ICAO document and all the useful information to further enhance safety by mitigating, if not eliminat-ing, the risk of fuel contamination so that the layers of protection are not penetrated.

Figure 6. A typical filter monitor.

Figure 7. ICAO Doc. 9977.


In any work environment, there are multiple drivers for individual behavior. And whether we realize it or not, our behaviors are the result of a complex interaction among factors such as our own built in (human) limitations; the

work environment, including organizational culture; the systems and processes within that work environment; and the limitations of other personnel we work with. A number of previous accident investigations have outlined a lack of appropriate safety culture as a significant safety factor in the development of an accident.

Analysis of incident and accident data from a wide range of industries also reveals that organizational safety culture is a very powerful driver for safety behaviors, both good and bad. These organizational and individual safety behaviors have a direct effect on organizational safety outcomes or safety per-formance. The importance of a positive organizational safety culture is recognized within a typical safety management sys-tem that normally outlines a requirement to achieve a healthy or positive safety culture as part of the safety management system.

This adapted article will explore the question of what defines organizational safety culture as well as reviewing the evidence for safety culture as a driver for safety behavior. The review will also outline a number of sub-elements that combine to define a “professional culture of safety,” including the following:

• a fair but accountable culture,

• an open and honest reporting and learning culture,

• a culture of integrated hazard awareness and risk manage-ment, and

• an informed, adaptable culture.

Is safety culture really important? There are innumerable safety and accident investigation reports that have identified organizational safety culture or the lack of it as a significant antecedent in the development of an accident. The reader is referred to the reports on the Piper Alpha oil production platform explosion (Cullen, 1990), the 1987 Kings Cross underground station fire (Fennel, 1988), and the sinking of the Herald of Free Enterprise passenger ferry (Sheen, 1987).

Many previous accident investigations have tended to focus only on the technical issues and direct human influences on the outcome. Organizational issues, including such things as management decisions and cultural aspects, have begun to take on more importance in investigations, as the search for the underlying drivers for individual (and group) behavior has

taken on greater importance. In his report on the Piper Alpha disaster, Lord Cullen stated, “It is essential to create a corpo-rate atmosphere or culture in which safety is understood to be and is accepted as the number one priority.” (Cullen, 1990, p. 300)

Organizational safety culture a factor in previous accidents?Is organizational safety culture a real factor in driving safe or unsafe outcomes? A number of relatively recent examples serve to illustrate that organizational safety culture continues to play a significant role in the development of accidents and incidents.

• Texas, February 2002—Seven crewmembers were killed when the space shuttle Columbia disintegrated as it re-turned to Earth for landing. The subsequent investigation (Columbia investigation report, August 2003) found that “NASA’s organizational culture and structure has as much to do with this accident as the external tank foam.”

• Near Waterfall Station, Sydney, Australia, January 2003—Seven people died in the derailment of a train near Water-fall Station in January 2003. The “official findings into the accident (Special commission of enquiry into the Water-fall rail accident, Vol. 1, January 2005) found that “the organization exhibited an underdeveloped safety culture.”

• Gulf of Mexico, April 2010—On the deepwater horizon oil rig, 11 persons were killed and the largest oil spill in his-tory was released when the oil exploded and caught fire. As reported in The Australian, August 9, 2010, “A previ-ous safety audit had expressed concern about the safety culture on the rig.”

What is safety culture?Westrum (1993) defined three stages of safety culture com-mencing at “pathological,” where personnel don’t really care about safety issues, through “calculative,” where the organiza-tion does the minimum required for compliance with safety regulations, to “generative,” where safety behavior is fully integrated into all organizational processes.

Hudson (2001) also described safety culture and based his work on the earlier work of Westrum (1993). Hudson’s new model described the evolution of safety culture, from the path-ological first stage through to the generative final stage but incorporated two additional stages of cultural development—originally proposed by Reason (1997). The two additional stages were labeled “reactive” and “proactive.” In Hudson’s model, he replaced “bureaucratic” with “calculative.” The five stages in Hudson’s model of cultural development are briefly

The Influence, Measurement, and Development Of Organizational Safety Culture

The author discusses how safety culture can be assessed and a number of processes that can be used to drive improvements in organizational safety culture and therefore organizational safety performance.

(Adapted with permission from the author’s technical paper entitled A Professional Culture of Safety—The Influence, Measurement, and Development of Organizational Safety Culture presented at ISASI 2014 held in Adelaide, Australia, Oct. 13–16, 2014, which carried the theme “Investigations and Safety Management Systems.” The full presentation, including cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2014 Technical Papers.”—Editor)

By Rick Sellers, Managing Director, Convergent Safety, and Vice President, Australian Society of Air Safety Investigators


described below.• Pathological—Safety is seen as a

problem caused by workers. The main drivers are the business performance and a desire not to get caught by the regulator.

• Reactive—Organizations start to take safety seriously, but there is usually only action after incidents or accidents.

• Calculative—Safety is driven by management systems, with a great deal of data collection. Safety is seen as an impost rather than some-thing that is actively sought by the workforce.

• Proactive—Unexpected change is a challenge. Workforce involvement starts to move the initiative away from a purely top-down approach. The organization uses safety data to inform safety programs.

• Generative—There is active par-ticipation at all levels. Safety is perceived to be an inherent part of the business. There is a healthy wariness that things can still go wrong. Safety is fully integrated into all organizational processes.

The various descriptors for safety culture work well from an academic perspective in delineating the various degrees of safety culture, but do they actually assist an organization in achiev-ing the aim of continuous improvement in its safety culture? Do they help to embed those values and concepts to become an expected part of professional behavior?

It could be argued that without a pro-fessional adherence to those values and behaviors, which are at the core of what Hudson describes as a generative safety culture, an organization will never be in a position to achieve it.

A new paradigm—The professional culture of safetyThe professional culture of safety places a higher priority on the development of hazard awareness and the integration of risk management as cultural norms. It describes an embedded organizational culture in which the understanding, assessment, and management of risk are a natural, essential, and expected component. Additionally, it is a cul-ture in which it is accepted as normal professional behavior to support open

and honest safety reporting and where the differences between errors and violations are understood and treated appropriately.

In a professional culture of safety, safety performance is seen as a key organizational and individual output. All personnel understand what is expected of them and share a responsibility for professional safety behavior. Broadly, this includes concepts such as personal re-sponsibility and accountability for safety, high standards of leadership by exam-ple, the personal desire for excellence, and understanding that safety is not an add on but should be fully integrated into all organizational processes.

When hazard awareness and risk management are fully internalized as the way all personnel think and act, personnel will naturally look for hazards and risks in their work environment and will adapt safety processes to new and challenging situations. From the organizational perspective, this will allow for changes in process and the evolution of the safety management system with changed operating envi-ronments. Organizations that have a professional culture of safety will often have an agreed-to and understood priority for safety among all personnel. Moreover, they will have developed and implemented an emergency stop (or “time-out”) procedure to be used when personnel feel that safety is about to be or could be compromised.

Achieving a professional culture of safetyFor an organization to achieve a profes-sional culture of safety, personnel need to first understand its sub-elements, and the organization’s management team needs to actively reinforce and embed them as expected professional behavior. The following four cultural sub-elements are required as part of the professional culture of safety: a fair and accountable culture, an open and honest reporting and learning culture, a culture of integrated hazard awareness and risk management, and an informed and adaptable culture.

Let’s now briefly explore what is meant by these sub-elements by discuss-ing them in more detail:

• The fair and accountable culture—The fair and accountable culture refers to the way that personnel view both errors and violations in

Rick Sellers’ flying career exceeds 30 years. Qualifying as a Navy pilot, he also specialized in human factors and safety management sys-tems. He is a qualified flying instructor (QFI) on both fixed- and rota-

ry-wing aircraft and has flight operations experience in both military and airline transport operations. Sellers has oper-ated a mix of aircraft from multi-engine jet transport aircraft through turboprops to piston engine trainers, as well as a mix of rotary-wing types from the Bell (UH1B/H) Iroquois to the Sea King. He has qualifications in safety systems management and air accident investiga-tion from the U.S. Navy postgraduate school in Monterey, California, and from Cranfield University in the United Kingdom. Sellers holds a master’s degree in aviation management and is a gradu-ate of the Singapore Aviation Academy course on integrated safety management systems. He is a long-term member of ISASI and is the current vice president of the Australian Society of Air Safety Investigators.

“Culture has a very real influence on the attitudes and performance of the people within an organization.”—John Lauber, U.S. National Transportation Safety Board


the professional sense. For a fair and accountable culture to exist, the organization needs a collectively agreed-to and clearly understood distinction between what is accept-able and unacceptable behavior in the workplace. Many high-hazard or-ganizations are highly reliant on per-sonnel following a specified process as a risk mitigator. In such a context, all personnel must understand the difference between intentional departures from the rules such as violations and honest unintentional departures such as errors.

In a fair and accountable culture, members of an organization under-stand that they have a professional responsibility for their own behav-ior and are accountable for their actions. In this culture, managers understand that there are normally systemic drivers for both error and violation. In the fair and account-able culture, personnel are not punished for true, unintentional error. But in the case of willful disre-gard for regulations and procedures or intentional violation, personnel will be expected to account for their actions.

• An open and honest reporting and learning culture—In an open and honest reporting and learning cul-ture, the organization is looking for causes, not culprits. In this culture, all personnel should feel free to report safety issues without fear of reprisal. To achieve this, the report-ing system must be actively support-ed at all organizational levels. With an effective safety reporting system, safety data can be utilized as part of a closed-loop process to ensure that reported hazards are mitigated. Without effective near-hit (miss) hazard and occurrence reporting systems, an organization cannot be risk and hazard aware. One of the underpinning requirements in estab-lishing an open and honest reporting culture is the prior establishment of a fair and accountable culture as previously described. In a learning culture, the organization proactively learns from risk management and hazard and incident reports and applies the lessons learned from these to (hopefully) prevent future accidents and incidents and to miti-gate risk.

• A culture of integrated hazard awareness and risk management—Hazard awareness and risk man-agement are both vital parts of any organization’s safety management system. It is vital that all personnel have an understanding of context, hazard, and risk within their work-ing environment. It is fundamental to the continuous improvement of an organization’s safety systems and operational effectiveness that all personnel share an understanding of these key concepts and that they become embedded as the way all personnel go about their business. In reality, it is rare to find that these processes are truly integrated across an organization.

For this culture to develop, all personnel need to understand the nature of hazard and risk and the dif-ferences between the two. Risk man-agement must become so ingrained as part of normal (professional) behavior that personnel will actively look for threats to safety within their environment, continuously asking what have we missed? What will catch us out? This sub-element is closely linked to the open and honest reporting and learning culture as previously described.

While it is vital that risk man-agement is embedded across the organization, it is also important that personnel don’t assume that all the hazards in their work environment have been identified and mitigated, as this is almost certainly not the case. While it is important that an organization’s personnel trust the un-derlying safety management system, it is just as important for them to understand that no system is infal-lible. Even with the best personnel and systems, things can (and do) still go wrong.

• An informed and adaptable culture—A safety-adaptable or-ganization requires an informed and safety-committed management team. The management team can only remain informed where timely and accurate information is readily available through the safety report-ing and risk management database. Many organizations are data rich but information poor. Although organizations may have access to a massive amount of data in the form

of safety and hazard reports, they may not actually be able to “mine” or use the data to inform them of real trends, lead/lag indicators, and current risks.

The informed and adaptable cul-ture involves actively searching both externally and internally for safety lead/lag indicators and proactively applying safety lessons learned from the data. This culture ensures that from an individual and an organizational per-spective, lead/lag indicators are evalu-ated and lessons learned to achieve a process of continuous, systemic safety improvement. When an organization combines well-understood and inte-grated risk management processes with effective data mining and lead/lag indicators for safety, it should be able to effectively adapt to new safety chal-lenges.

Can safety culture be accurately measured?Climate vs. culture—Before we discuss the measurement of safety culture, it is important to understand the concept of “safety climate.” In the author’s view, safety climate and safety culture are two very different things. Safety climate is a subset of safety culture and is a measure of the safety beliefs, values, and behav-iors at a given point in time.

It is possible for safety climate to change on almost a daily basis, whereas the underlying culture will not have changed over the same period. Typically, an organization will carry out a safety survey to assess the safety climate on a given day or over a given time period. Although a safety climate survey may reveal a number of indicators of safety culture, it does not in itself give a de-finitive assessment of an organization’s safety culture.

The reality is that the climate survey is just a “snapshot” of that particular day (or time period), and the views expressed by personnel may have been affected by events (for better or worse) close in time to the survey. For example, taking a survey the day after a major acci-dent may give a very different result to that obtained if the survey had been conducted the day before the accident.

Assessment of underlying safety cultureAny accurate assessment of organizational


safety culture is a relatively complex proce-dure, not limited to the simple analysis of a safety climate survey. It can be difficult to accurately assess a culture from within an organization, as you may be part of the culture you are attempting to assess. For this reason, it is recommended that organizational safety culture be assessed (where possible) by an appropriately quali-fied external organization. Any assessment of organizational safety culture should in-clude a number of cultural indicators; and although not exhaustive, it is recommend-ed that at least the indicators listed below are reviewed as part of the assessment process. Some of the indicators that can be used in combination to give an indication of organizational safety culture are

• review of safety climate surveys.

• review of previous safety audits and safety surveys.

• response to focused questionnaires.

• inspections and observation of existing attitudes and behaviors, including management, maintenance, engineer-ing, operations, planning, and support.

• review of the training for and treat-ment of hazard and risk and evidence of the hazard awareness and risk management processes in action.

• organizational and individual respons-es to safety reporting/safety corrective actions taken.

• evidence of the priority placed on safety by management and other key personnel.

• evidence of the flexibility of the organization in response to new safety threats.

• personnel interviews at multiple organizational levels.

Reinforcing the drive toward a professional culture of safetyApart from the proactive development of the cultural sub-elements previously described as part of the professional cul-ture of safety, it is possible for individual managers to make a substantial and posi-tive improvement to organizational safety culture by simply adopting the following practices:

Mentoring professional and safe behavior—Managers and supervisors need to take a mentoring/developing role in regard to expected/desired safety behavior in the workplace. One way of achieving this is

to reward good safety behaviors by mak-ing positive examples of personnel who demonstrate a commitment to safety. This can be achieved by actively supporting personnel who raise safety concerns. Many organizations also have a regular employee safety award, which gives public (and often financial) recognition to an individual (or team) for exemplary safety behaviors.

Safety communication and feedback—En-sure that all personnel receive feedback from their safety reports. (How often does management ensure that personnel are briefed on the outcome of organizational safety reviews and surveys?) Management also needs to effectively communicate its expectations so that everyone in the organization knows what is expected of them—what standard is acceptable and unacceptable in the workplace. Addition-ally, it should be a normal and expected part of the safety communication process for managers and supervisors to receive open and frank comments/discussion on safety matters from the organizational “coal face.” Managers and supervisors need to be prepared for these comments/discussions and openly promote them.

Fair and appropriate treatment—Manag-ers and supervisors need to ensure that all personnel share an accurate understand-ing of the differences between error and violation. Managers in particular need to demonstrate their support for the fair treatment of personnel who admit to mak-ing errors. The appropriate investigation of incidents should reveal the systemic driv-ers behind both errors and violations and allow management to frame appropriate responses. Provided that the organizational response is always both fair and appropri-ate, personnel will remain engaged with the safety reporting and management systems. What managers and supervisors say and what they do are both important. Managers and supervisors need to “walk the talk” of safety.

The process of cultural changeCultural change can be a slow process. Even after a major event has effected an organization, such as a major acci-dent, the underlying culture within the organization may not have substantially changed. Organizations, particularly larg-er organizations, have a certain amount of inertia and are generally resistant to change. Once a successful change process has been put into place, however, the change can begin to gather momen-tum. For successful culture change to

occur within an organi-zation, the desire for change needs to be internalized at all or-ganizational levels so that all personnel see and feel the need for change, have the desire for change, and have the capability for the change. The role of management in this process is to com-municate the requirement for change and to lead and facilitate the change process. This can be a frustrating period for organizational management, as the cultural change process in large organi-zations is usually measured in years. All major organizational change needs to be proactively managed utilizing an ap-propriate change management process; this is no different for culture change management. The five steps of change management are

• Measurement—Where are we now, and where do we need (or want) to go?

• Planning—How do we make the change, and how do we measure our success?

• “Driving” the change—Implementa-tion of an appropriate action plan. The implementation must include some key performance indicators or goalposts to assess the progress of the change.

• Reviewing the change—Measure-ment that group values and beliefs align with those required/defined to complete the change.

• Reinforcement—Implementation of ongoing management processes to maintain the new paradigm.

ConclusionOrganizational safety culture is a significant driver for individual safety behaviors. By actively promoting and developing those elements required to achieve a professional culture of safety, an organization can make a significant and positive difference to the safety behaviors of its personnel and therefore the safety performance of the organization as a whole.

“Assessing safety culture as part of the investigation process may help to determine some of the systemic underlying drivers for individual (and organizational) safety behaviors.”


On July 28, 2011, a Beechcraft A36 operated by a flight school took off for a training flight from its base airport at 9:11 a.m.

During basic instrument flight in nearby training and testing airspace, the plane crashed into a mountain slope at 9:22. The accident site was north Japan, an east-end mountain of a mountain range in the south of Hokkaido.

Four persons were aboard the air-plane: Instructor A serving as captain was in the front right seat; two stu-dents—Student 1 was in the front left seat, and Student 2 was in the rear right seat; and Instructor B was in the rear left seat for educational and research purposes. Three suffered fatal injuries: two instructors and Student 2; Student 1 sustained serious injury. The airplane was destroyed, and a post-crash fire oc-curred. The site was at about a 40-de-gree slope in a forest with trees about 10 meters tall. In “basic instrument flight training” (BIF), a trainee wears a hood to restrict his field of vision from outside ground reference; control of the air-plane is directed by an instructor. Three people died in this tragic accident, but it remains just a small plane accident.

A look at the probable cause findings helps understand why and how this case relates to the safety management system processes. First, the plane flew into clouds or close to clouds and crashed into a mountain slope. Second, the captain’s death denied us the clarifica-tion of his intention. Third, it is some-what likely that the basic safety policy of the school was not instilled in the field instructors and that there was a gap in safety awareness between management and field instructors. It is also some-what likely that behind the accident

Presented is a case study of a flight school’s fatal accident that revealed deep organizational problems, which hampered the investigation throughout the case.

Investigation Challenges Created by Organizational Issues

Beechcraft wing snagged in a tree.

By Koji Fukuda, Aircraft Safety Investigator, Japan Transportation Safety Board (JTSB)

(Adapted with permission from the author’s technical paper enti-tled Challenges for Organizational Investigation presented at ISASI 2014 held in Adelaide, Australia, Oct. 13–16, 2014, which carried the theme “Investigations and Safety Management Systems.” The full presentation, includ-ing cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2014 Technical Papers.”—Editor)


was a problem that involved the entire organization of the school—a work environment/organizational culture that consequently allowed unsafe behaviors.

Fact findingAfter the accident, two of us were ap-pointed to conduct the accident investi-gation. Also participating in the inves-tigation were the state of design and manufacture representatives. On the day of the accident, we moved to Hokkaido and started the initial investigation. Because wild brown bears inhabit the region, we climbed the mountain with hunter guides. On the flight path, we found a wing caught in the tree branch-es and other debris. We used the same type of aircraft to confirm visibility. The sole survivor, Student 1, was injured and suffered severe burns. He was in the in-tensive care unit for treatment, and we could see him for only a very short time to get his testimony.

After determining that all the pos-sible field investigation that could be done at this time was almost finished, we returned to Tokyo to give an initial report to the aviation subcommittee. In September, we returned to the scene and climbed the mountain again. We conducted another investigation of the site and the aircraft while cutting down trees that hampered the search. In November, we finally could arrange for a warehouse and a helicopter to move the accident aircraft. We conducted a detailed investigation in the warehouse. It took three and a half months, but we finished most of the fact-finding phase, which for the purpose of this adapted article is called Phase 1.

AnalysisWe analyzed the information collected during fact-finding Phase 1 and pro-vided a skeleton report in December. This period is Phase 2. The following explanation of the analyzed contents is based on the description in the actual published investigation report.

The first is an analysis of the weather. We analyzed the weather conditions at the time of the accident from collected weather information, images from a sur-veillance camera placed in an office, and photographs from a climber. It is highly probable that the airplane could conduct

training as planned without clouds being present over the mountainous area to the west of the airport. It is also highly probable that the clouds that were near the mountain until 09:00 dissipated quickly by about 10:00. At around the time when the accident occurred, it is somewhat likely that the mountain and the vicinity were covered with clouds, whose bottom was at an altitude of nearly 720 meters.

Next is the analysis of the estimated flight route. The accident plane did not have installed recorders such as GPS or DFDR that help us identify the aircraft’s position. But we could estimate the lim-ited flight route from the airport and the crash position from the ATC radar track and from the testimony of Student 1 and the witness. It is somewhat likely that the airplane flew toward the accident site, heading 270 degrees while climbing and that the accident occurred at about 09:22.

It is highly probable that Instructor A selected the training area in the vicin-ity of the cloud base where the above-ground distance was getting small at the edge of the moun-tainous area, not the airspace east of Mt. Shin-arashi, which was usually used. It is highly probable that above Ridge 3, the airplane came so close to obstacles on the ground that it almost touched them. It is somewhat likely that the reason Instruc-tor A shouted “ah!” and pulled the control wheel was that he no-ticed the proximity to the obstacles, took the controls from Student 1, and attempted to evade Ridge 3. It is probable that Instruc-tor A attempted to evade the mountains while changing the course of the airplane to the right to climb along the slope of the

Koji Fukuda is an air-craft safety investigator at the Japan Transport Safety Board. He was a pilot for the Japan Coast Guard and flew about 4,000 hours, mainly on rotor craft. He has been involved

in 25 accident and serious incident investigations.


mountain. It is highly probable the last climb was attempted to get a temporary altitude increase by raising the aircraft’s nose substantially.

The analyzed situation at the time of the collision follows: It is highly probable that the airplane had flown normally un-til it collided with trees. It is also highly probable that due to its collision with several trees, the wings were destroyed and the engine stopped. The fuselage continued to move forward with inertial force while scattering fuel and violently crashed into the base of Tree 7 after colliding with Trees 5 and 6. It is highly probable that the fire broke out after the crash.

It is highly probable that the airplane intermittently flew into or close to clouds along the northbound route and final leg to the accident site. It is also highly probable that Instructor A uttered “clear” without being able to confirm the safety of the area up ahead because he could not see the mountain due to the clouds. The airplane was about to be placed in an in-cloud condition or was already in cloud cover. There was no obstacle on the plane’s left-hand side, while mountains were approach-ing on its right-hand side and in front with Ridge 4 blocking its course. Despite these geographic features, it is highly probable that the airplane changed its course to the right and flew toward the steep slope of Ridge 4. A possible reason for this maneuver is that Instruc-tor A could not see anything ahead or on his left-hand side due to clouds, which forced him to resort to flying along the mountainside on the right over-looking trees. But his death denied clarifying the reason for this maneuver.

Needless to say, the airplane,

which was conducting VFR training, was not permitted to fly into or close to clouds. In-cloud flight or close to clouds under VFR flight is extremely dangerous because the pilot cannot keep a safe dis-tance from other airplanes or obstacles.

Why did he approach or enter clouds? It is somewhat likely that Instructor A flew close to or into the clouds with the intention of having the students experi-ence in-cloud conditions or to be able to continue training; however, his death denied us the clarification of his inten-tion. Why did the airplane crash into a mountain slope? It is highly probable that Instructor A became disoriented and unaware that he was closer to the mountains than he thought as the air-plane became very close to or in cloud cover and he lost outside reference.

In addition to Instructor A and Stu-dent 1 being in the front seats, Instruc-tor B and Student 2 had boarded in the rear seats. Despite the airplane flying close to or in the clouds in a mountain-ous area, no advice was given from Instructor B or Student 2. Why? As to Instructor B, it is somewhat likely that he refrained from objecting to the train-ing presided over by Instructor A. As to Student 2, it is highly probable that there was clearly an “authority gradient” between him and Instructor A.

I thought the mechanism of this ac-

cident had been almost clarified by what has been described so far, and I gave a skeleton report to the aviation subcom-mittee in December to decide the direc-tion of the investigation. In this flight school, several unsafe behaviors were found to have occurred before this ac-cident. In addition, the flight school had smaller accidents in the two previous years; subsequently the school had this fatal accident in the third year. There-fore, the decision was made to carry out a detailed organizational investigation.

Organizational investigationPhase 3—In International Civil Aviation Organization (ICAO) Document 9756 or AN965, the Manual of Aircraft Accident and Incident Investigation, there is a de-scription of organizational investigation in Chapter 3, Part 3, Investigation. The importance of organizational investi-gation is described using the Reason model and the six M model, which everyone is familiar with. Manage-ment problems, funding problems, and potential problems are described. Each problem is important when conducting an organizational investigation. It is con-cretely mentioned in the manual in 3.5, Methodology, about how to carry out the organizational investigation. For exam-ple, 3.5.2.1, Corporate Goal, describes how to seek the answer. The same is

true for organiza-tional structure, communications, planning, control and monitoring, design of systems and com-ponents, corporate memory, procedures, resources, regulation, adaptation to new technology, corporate culture, and safety management. Each item is described in detail. We modified questions pertaining to these items to suit the circumstances of this flight school and created an inquiry list. Based on the list, we conducted an interview with the general safety man-Trees cut to enhance onsite investigation.


ager in February 2012.Using the accident report, let’s

examine the contents of the analysis of organizational problems related to SMS. The number of accidents at the school grew sharply after it became an independent administrative agency; the increase in fatal accidents was particu-larly troubling. It was necessary for the minister of land, infrastructure, trans-port, and tourism and the school to fo-cus on these facts and identify problems in the school’s business administration system, which functions as an independ-ent administrative institution, and to solve them appropriately.

The school, at its own initiative, introduced a safety management system. The general safety manager has made the importance of safety management known to not only all of the employees but also all of its students. If the head instructor or the deputy head instruc-tor had known of Instructor A’s unsafe behaviors in advance, it is likely that the accident could have been prevented. The reporting system, including the potential incident report, did not work sufficiently, and alternative reporting means were limited. School authori-ties need to consider and implement effective methods that meet the actual situation of the school.

At the school, the investigation revealed at least five unsafe acts. It is possible that in at least four of them their performer underestimated the

danger from the viewpoint of human factors. This occurred because the basic safety policy of the school may not have been instilled in the field instructors and that a gap in safety awareness existed between management and field instructors. It is also pos-sible that behind the accident was a problem that involved the entire organization of

the school—a work environment/or-ganizational culture that allowed unsafe behaviors.

Next we analyzed why such problems were not corrected, including audits of how the safety management system of the school functions. While the school’s main and branch schools conduct cross safety audits annually and the Civil Avia-tion Bureau (CAB) conducted extraordi-nary audits of the school after each of its accidents, there was no external audit aimed at examining the status of the school’s daily operations. Judging from this analysis, it is highly probable that the system of objectively checking the mechanism for the safety management system at all levels of the organization was not fully utilized.

The school was evaluated harshly for its lack of attention to safety measures that could have prevented the accidents, but it received high ratings for all other items. Therefore, it is highly probable that this was because the school worked on its business under the business administration system for independ-ent administrative agencies. It is highly probable that the plan-do-check-act (PDCA) cycle was at work among the school, the minister, and the Evaluation Committee under the business admin-istration system for the school as an independent administrative agency (see Figure 1). Inasmuch as the Beechcraft accident occurred in the year following the period during which the school had

experienced accidents for two consecu-tive years, it is highly probable that there was still room for improvements in the safety measures at the school.

We analyzed the safety measures un-der the business administration system for the school, which operates as an independent administrative agency. At first, in their evaluations for the medi-um-term-goal period, members of the Evaluation Committee pointed out the necessity of creating an organizational culture that urges all instructors and students to be aware of potential dangers at all times and to eliminate danger fac-tors before accidents occur. An organiza-tional climate cannot be built in a day—it is brewed by daily ongoing activity. The minister needs to consider how the college’s medium-term goals should be achieved. The minister needs to perform periodic audits in the field.

Final report draftIn Phase 4, we review the probable cause and recommendations as listed in the draft report. The final report draft prepared by the investigator-in-charge was submitted to the aviation subcom-mittee following deliberations in a team meeting, a mode meeting, and a secretariat meeting—which marked an unusual number of deliberations.

The probable cause cited the involve-ment of organizational problems, as noted earlier. The school resumed flight training after receiving the Civil Aviation Bureau’s audit and instituted “direct dialogues between the president and students,” “reviews of video cameras and IC recorders,” and “using a GPS log-ger.” Two recommendations were made for the minister of land, infrastructure, transport and tourism: “Review of the medium-term plans” and “periodic audits.” Three recommendations were made for the flight school: “Review of the training procedures,” “strengthen the SMS,” and “review of the medium-term plans.”

Relevant parties and state comments Phase 5 pertains to comments. We invited comments twice from a relevant party. Based on the comments, we continued to modify the draft report and obtain the consent of the relevant party. We held aviation subcommittee meet-

Figure 1


ings five times, and it took nine months from the first comment invitation to the initiation of the final report. A great deal of discussion was held before arriving at the cause and feasible recommenda-tion. We published the final report last December. Two and a half years after the accident occurred, we completed our report. Why did it take so long? It was a deep organizational investigation.

Follow-upWe followed up on the response of the minister and the school to the recom-mendations. The CAB reviewed current medium-term plans and carried out field audits on a quarterly basis. In order to build an open educational environ-ment, the school adopted “assertions,” which encourage a subordinate to offer safety advice. Also, the school adopted an after-flight questionnaire program for the students as a measure to help understand and verify, on an objective basis, real training situations. Further, GPS logger and IC recorder reviews were adopted. In addition, a new PDCA cycle by risk management was enhanced.

What effect have these changes had on the students, instructors, and the general safety manager? The students’ awareness and knowledge have in-creased, and the attitude to tackle situ-ations aggressively has intensified. They

began to actively make comments about safety, and potential incident reports increased. Assertions came to be actively conducted. The opportunity between instructors and students together to recheck the rules and restrictions also increased. The safety awareness of in-structors has increased. And the atmos-phere to actively create safety has spread among the instructors. The effects on the general safety manager are just as pronounced. The manager began to ac-tively work toward safety by conducting self-initiated safety checks. Moreover, he began to observe management staff, conduct hearings from students, and actively guide instructors.

ChallengesAccording to the ICAO manual, “to be effective, investigations must consider the role of organizational factors, yet the investigation of such factors is likely to be heavily reliant on subjective judg-ment.” As might be obvious, we need to consider the degree of necessity for an organizational investigation, depending on the nature of the organization and the accident or incident. In Japan, air transport services have SMS specified in the Civil Aeronautics Act. In aerial services, there is no provision of law or regulation, but most companies have SMS voluntarily. In flight schools, SMS

is a requirement for certification, and they have it. In private schools, there is no provision of law or regulation for SMS. But in some cases, we should consider the role of the organization, such as a flying club. In the case of the A36 accident, the flight school did have an SMS program.

In the process of an investigation, organizational problems involved in the occurrence of the accident or incident will be revealed. We should consider the necessity of an organizational investiga-tion dependent upon revealed organiza-tional problems. In the case of structural defects being found in the SMS, such as the manual or number of staff, you need an organizational investigation.

Next, when no manual problems or structural defects are found, but the SMS is not functioning, suspicion leans toward functional defects, such as mem-ber understanding, lack of leadership, or shortage of safety reports. In such cases, one should consider the need for an organizational investigation. Moreo-ver, if there is no apparent problem in structure or function, but a problem in the output is found, an organizational investigation should be considered. If you find the existence of an intentional unsafe act or gap of safety awareness between management staff and field staff, you should check again for defects in the SMS. In the case of the A36 ac-cident, on the surface no problem in structure and function existed, but there were unsafe acts and a gap between management staff and field staff.

In this article, we have tried to sum-marize the points to check when doing an organizational investigation. By using as a checklist each item in ICAO manual 3.5.2, we should be able to ensure that nothing has been omitted in an organi-zational investigation. In the investiga-tion process, it is important to deter-mine the chain of events leading to the accident and where within the chain the fault events could have been stopped. If we find them, we should carry out the investigation with an emphasis on these points. Items disadvantageous to the organization are likely to be con-cealed. Here are some recommended techniques: 1. Interviews with the lower interest members are helpful. 2. A

Preparing for the helicopter lift.

(Continued on page 30)


A safety culture, as part of safety promotion, is recognized as one of the four pillars in the common model of a safety management system (SMS) and must exist in state aviation organizations and product and service provider organizations for safety management to

be effective. Given the perceived importance of developing and implement-ing a “good” safety culture to safe operational practices, and thus to SMS, the International Civil Aviation Organization (ICAO) Safety Management Manual characterizes a “healthy” safety culture as one that actively seeks improvements; remains vigilantly aware of hazards; and uses systems and tools for continuous monitoring, analysis, and investigation—all integral to effective SMS programs.

Despite the widespread acceptance of the need to develop an effective safety culture and implement safety management frameworks in transporta-tion, accident investigations, including those by the U.S. National Transpor-tation Safety Board (NTSB), continue to reveal safety culture deficiencies in the practices of companies whose accidents the NTSB has investigated.

The NTSB generally conducts public forums to focus attention or to open a dialogue on safety issues of considerable importance. In September 2013, the NTSB convened a two-day public forum on safety culture efforts in transportation, a forum that included presentations from 24 researchers, operators, and government agencies with expertise in the development and assessment of safety cultures across all modes of transportation, and other industries in which safety culture is an accepted concept. Although there is no universally accepted definition of safety culture, one researcher, S. Antonsen, quoting from an earlier work in his “Safety Culture and the Issue of Power” (2009), defined it as “the product of individual and group values, attitudes, perceptions, competencies, and patterns of behavior that deter-mine the commitment to, and the style and proficiency of, an organization’s health and safety management.”

Forum participants gave firsthand accounts of their experience imple-menting SMS programs, and their involvement in associated activities like operations monitoring and voluntary reporting systems. They also discussed the role of operators and regulators in promoting safety culture. The overall forum topics that were addressed included

• Research and practitioner findings regarding safety culture state of the art and suggested future steps needed to advance safety culture.

• Attributes and characteristics associated with effective safety culture development programs and their integration and measurement within organizations (in both transportation and nontransportation industries).

• Current and suggested future goals for government agencies and or-ganizations to develop, maintain, and enhance safety culture within the transportation industry.

Additionally, the NTSB sought insight on how to fully investigate safety culture and whether current investigative techniques are adequate.

BackgroundLike other accident investigation organizations, the NTSB and its predeces-sor, the U.S. Civil Aeronautics Board (CAB), have been investigating the role of organizations’ contributions to transportation accidents and incidents

By Barbara A. Czech, Loren Groff, Ph.D., and Barry Strauch, Ph.D., the U.S. National Transportation Safety Board(Adapted with permission from the authors’ tech-nical paper entitled Safety Cultures and Accident Investigation: Lessons Learned from a National Transportation Safety Board Forum presented at ISASI 2014 held in Adelaide, Australia, Oct. 13–16, 2014, that carried the theme “Investigations and Safety Management Systems.” The full pres-entation, including cited references to support the points made, can be found on the ISASI website at www.isasi.org under the tag “ISASI 2014 Technical Papers.”—Editor)

Safety Cultures and Accident Investigation Lessons Learned

Barbara A. Czech is associate director for program manage-ment in the NTSB’s Office of Research and Engineering. She is responsible for manag-ing engineering programs and engineering staff activities that provide technical and labora-

tory support to the NTSB’s accident investiga-tions. Czech received her B.S. from the University of Maryland in mechanical engineering.

Loren Groff, Ph.D., is a national resource specialist for safety data analysis in the NTSB’s Office of Research and Engineering, Safety Research Division. He assists accident in-vestigations and conducts safety data analyses, and regularly

represents the NTSB in efforts involving safety data sharing and analysis. He co-managed an NTSB public forum on safety culture in trans-portation in September 2013. Groff received his M.A. and Ph.D. from Wichita State University in human factors psychology.

Barry Strauch, Ph.D., is a national resource specialist for human factors in the NTSB’s Office of Marine Safety. He co-managed an NTSB public forum on safety culture in transportation in September 2013. Strauch received his M.S.

and Ph.D. from Pennsylvania State University in educational psychology.


programs like Aviation Safety Action Programs (ASAP) allow individuals to report safety concerns without fear of discipli-nary or enforcement action.

These programs are in turn integral to the development of SMS by transportation operators and service providers. Safety culture and SMS are interdependent, with a positive safety culture helping ensure that an SMS works in practice, and an effective SMS enables a positive safety culture. Further, variations of these practices have been implemented in other transportation industries as well. NTSB’s 2013 forum revealed that some marine companies have implemented Boat Opera-tional Quality Assurance (BOQA) to enhance the safety of their operations by reading and analyzing data from onboard vessel data recorders.

International transportation authorities have promoted safety management efforts and/or have taken an active role in providing safety culture guidance and oversight. For example, in an attempt to enhance the application of safety cultures in maritime organizations after the Herald of Free Enterprise acci-dent, the International Maritime Organization (IMO) required internationally operating vessels to implement SMS. As noted, ICAO produced the Safety Management Manual to describe, in detail, the elements of an effective safety culture and pro-vide guidance for implementing effective safety management frameworks. Before 2013, Annexes 1, 6, 8, 13, and 14 to the Chicago Convention included standards and recommended practices for all states to establish regulations requiring SMS for aviation operators and service providers, and since Novem-ber 2013 the new Annex 19 consolidates those standards and recommended practices for safety management by the states.

Safety culture and investigationsAs accident investigators, we are charged with determining the facts and circumstances of accidents and incidents, and the factors that caused and contributed to them. Once deter-mined, we must identify recommendations to prevent those accidents and incidents from reoccurring. Since safety culture has grown in prominence, it has become more of an issue dur-ing our investigations. However, investigating safety culture is not as entirely straightforward as investigating mechanical or regulatory issues.

Despite being a common term, safety culture can be hard to define and even harder to measure. This can be seen in Rea-son’s opening presentation to the NTSB symposium on cor-porate culture in 1997, where he observed that “few phrases are so widely used yet so hard to define as ‘safety culture.’” Reason’s observation is as true today as it was then.

Many operators have avoided these academic concerns about defining or measuring safety culture and have taken a more pragmatic approach by implementing specific tech-niques that they believed, or others have demonstrated, can enhance operational safety. Consequently, rather than focus-ing on defining safety culture or the difficulties of measuring it, organizations that participated in the 2013 NTSB safety culture forum provided examples of safety benefits gained from implementing techniques to enhance safety. Company representatives cited measures they implemented, often in the absence of a requirement in their industry to implement an SMS, related to organizational communication and manage-ment structure, personnel selection and training, reporting and monitoring systems, risk management systems, and exter-nal reviews and audits —all of which are elements of an SMS

for more than 50 years. For example, a CAB investigation of a fatal accident involving a Douglas DC-3 in April 1962 cited both the pilot’s failure to maintain airspeed on takeoff and his poor judgment as causal to the crash. The investigation also addressed the actions of a company supervisor in knowingly dispatching an aircraft with an unqualified crew in order to complete a post-maintenance test flight.

The concepts of organizational culture and climate became topics of safety research in the 1970s and 1980s—although most research into safety culture was conducted in settings that were not specific to transportation. For example, research conducted by the then newly formed National Institute for Occupational Safety and Health (NIOSH) demonstrated the link between an organization’s safety programs and its acci-dent rate, while other research attempted to define and meas-ure elements of an organization’s safety climate. The British judicial inquest into the March 6, 1987, accident involving the ferry Herald of Free Enterprise, which sank off the coast of Bel-gium with a loss of 193 passengers and crew, highlighted the role of organizations in the cause of transportation accidents. The 1990 publication of Dr. James Reason’s book Human Er-ror increased attention to the role that organizations can play in errors of operators that result in accidents in safety-critical systems.

In April 1997, following a series of accident investigations that identified organizational failures, the NTSB convened the Corporate Culture and Transportation Safety Symposium. The symposium addressed all major modes of transportation and included presentations by academic researchers, opera-tors, and industry representatives. The symposium attracted numerous participants from the aviation, railroad, marine, highway, pipeline, and hazardous material industries and led to increased knowledge within the transportation industry on the role of companies in the safety of the operations they conduct. In addition, NTSB investigators used information gathered during this symposium to refine the analysis of data they collected during an accident investigation to describe the organization’s culture preceding an accident.

In the 15 years since the NTSB conducted its symposium on corporate culture, there have been notable advances in the recognition and understanding of the value of safety culture to the safety of operations in numerous high-risk industries. The importance of safety culture in operational safety is now routinely discussed across all modes of transportation. In ad-dition, many of the operating agencies of the U.S. Department of Transportation and modal industry groups publish resourc-es describing the role of safety culture in preventing accidents and injuries and suggesting ways to enhance safety culture. In aviation, safety culture has been recognized as an integral part of safety management in an organization. As noted, ICAO has endorsed the concept of safety culture, and within the four areas in its SMS model (policy, risk management, safety assur-ance, and promotion) specifically identifies safety culture as part of promotion.

In accordance with Reason’s model equating safety culture to an informed culture, a variety of safety analysis and report-ing systems and initiatives have been implemented in the aviation industry as a way to enhance operational safety. For example, hazard detection and analysis programs like Flight Operational Quality Assurance (FOQA) use data from onboard aircraft recorders to monitor trends in operations and iden-tify possible safety concerns, and nonpunitive self-reporting


and techniques that are typically cited as indicative of an effective safety culture.

In addition to discussing vari-ous efforts to improve organiza-tional safety, several participants in the NTSB safety culture forum were asked about techniques to investigate safety culture and or-ganizational safety issues as part of an accident investigation. They were quick to acknowledge the difficulties of assessing safety cul-ture in an accident investigation. The researchers acknowledged the challenges presented by an absence of both a universally accepted definition of safety cul-ture and a commonly accepted measure of the effectiveness of an organization’s safety culture.

Safety attitudes and beliefs are typically assessed using questionnaires. But after an accident, attitudes and opinions will no doubt be affected by the experience of the accident itself, and the results of any such attempts to measure safety culture could therefore easily be misleading. As Dr. John Car-roll, professor of organization studies and engineering systems at the Massachusetts Institute of Technology’s Sloan School of Management, said in the NTSB forum, “There are difficulties with measuring the things that are easy to measure but may be of uncertain meaning.”

Investigators should be particularly cautious about attempt-ing to assess safety culture after an organization has experi-enced an accident or incident. For example, Reason in his Managing the Risks of Organizational Accidents warns of biases that will lead to overly negative assessments when investigat-ing organizational factors after an accident, such as hindsight bias that can lead investigators to emphasize facts that an operator should have known or understood before an accident, but based on information that investigators learned after the event. Outcome bias may lead investigators to interpret pre-ac-cident decisions as being inappropriate or unsafe. Finally, we may incorrectly conclude that deficiencies in organizational policies and procedures were causal to an accident when in fact they may just have been examples of imperfections that could be present in any similar operator. In the wake of an ac-cident, an organization that was previously considered to have a good safety record could be considered to have a deficient safety culture, due to the evidence identified in an investiga-tion.

Further, even if the safety culture of an organization that was in place before an accident can be accurately measured after that organization has experienced an accident, other dif-ficulties emerge. Dr. Andrew Hopkins, author of several books on the organizational and cultural causes of major accidents, has argued that focusing on the way employees think and feel about safety is not very effective in any event. At worst, he warns that this may lead to a new version of a blame-the-worker mentality, where we are led to believe that if only the persons or organization involved in the accident had thought differently or cared more about safety, the accident would not have happened. Hopkins suggests that a more effective ap-proach to enhance safety would be to focus on a basic defini-

tion of safety culture that is often used, “the way we do things around here.” In other words, the focus should be on what people in organizations do rather than what they think.

Thus, as investigators, efforts to directly assess the quality of a company’s safety culture may not provide an objective understanding of the actions a company took or decisions it made that led up to an accident. Following up on Hopkins, we suggest that investigators document what people and organi-zations did or did not do before an accident, and then make recommendations about what they should or should not do to prevent future accidents. Organizational leaders can establish policies and procedures and set an example for their employ-ees to follow. From this perspective of focusing on actions rather than thoughts, an effective safety culture does not need to be precisely defined or accurately measured as part of an accident investigation protocol.

Regulators can require operators to establish procedures and take certain actions and then enforce those require-ments. However, the role of the regulators in enhancing safety culture may be limited. NTSB forum participants were asked what an investigative authority or regulator can do to encour-age an effective safety culture when problems are identified in the operations they oversee. Researchers and company representatives suggested that culture cannot be effectively regulated. For example, Dr. Gudela Grote, professor of work and organizational psychology at the Swiss Federal Institute of Technology in Zurich, Switzerland, acknowledged that within any regulatory regime there will be elements of prescriptive regulation, but she urged that the focus of regulation and over-sight should be on safety management rather than culture: “Hopefully, whatever we all do in any role that we have is to help people to control operations, to know what the right thing to do is and then to do it. And I would say regulators should guide companies in achieving that by working on safety management, and within those decisions on what does it actu-ally take for good safety management…. That would be much more of a contribution overall to safety than trying to define, monitor, and enhance an organization’s safety culture.”

Carroll offered a similar concern, stating that “[safety culture] shouldn’t be considered as kind of a gross generaliza-tion of something but rather that there are particular specif-ics involved that are important. And I think the focus of your reports rightly start off with what are the behaviors? What’s the chain of events and what are some of the organizational precursors that led up to that?” Thus investigations need to

On April 2, 2011, at 0934 MDT in Roswell, New Mexico, a Gulfstream G650 crashed during takeoff.

Investigative example: history of flight

Phot

o: U

.S. N

TSB


start with as clear an understanding of the behaviors and who and what created those behaviors as we can have.

By focusing on company actions rather than employee “hearts and minds,” the elements of an SMS can serve as a guide for investigators to examine the organizational fac-tors that may have contributed to an accident or incident by documenting company policies, procedures, oversight, and management of safety hazards.

By comparing actual company performance with docu-mented policy, and reviewing the programs and procedures for safety risk management and safety assurance functions, a thorough investigation would document how well the organization managed the safety of its operations. Further, by examining employee selection and training records, and interviewing employees at various levels of the organization as appropriate, investigators can document the organizational actions that may have affected employee behaviors regard-ing safety. In this way, an investigation can collect objective evidence of otherwise subjective issues like social pressure or just culture concerns.

Investigation exampleTo illustrate this approach, consider the example of an ex-perimental Gulfstream G650 that crashed during takeoff from Runway 21 at Roswell International Air Center Airport, in Roswell, New Mexico, on April 2, 2011. All four crew, includ-ing two pilots and two flight test engineers, were fatally in-jured. The accident occurred during a one-engine inoperative continued takeoff test. During the attempted takeoff, a stall occurred. The right wingtip contacted the ground, and the airplane departed the side of the runway where it impacted a concrete structure and experienced a post-crash fire. During the investigation, the NTSB identified several deficiencies in Gulfstream’s management of its flight test program.

In the area of technical planning and oversight, Gulfstream did not effectively separate and distribute the workload of the flight test engineers during the field performance flight test program. As a result, data from previous tests were not used to refine speeds before testing progressed. Additionally, program managers did not establish adequate controls to ensure that prerequisite tasks were completed before testing progressed, nor did they ensure that effective validation processes such

as dynamic simulations were used to ensure the accuracy of takeoff speed calculations.

Gulfstream had established an ambitious schedule for the flight test program, but the program experienced frequent delays resulting in unachievable deadlines. The company also lacked an organizational process for technical and safety oversight that could mitigate the effects of schedule pressure, reduce the likelihood of errors, and identify and correct errors. Gulfstream admitted that the schedule might have contribut-ed to “a reluctance to challenge key assumptions and highlight anomalous airplane behavior during tests.”

Gulfstream had established an FAA-accepted flight test risk assessment program for evaluating and minimizing risk during certification testing. However, this program had not identified low-altitude stall or uncommanded roll as potential hazards for continued takeoff testing. Additionally, the company’s safety program was lacking in the area of safety assurance. This deficiency played a significant role in the inadequate investigation and reporting of two previous takeoff stall events. Gulfstream did not have adequate policies and procedures in place to ensure that these and other anomalous events be formally reported and analyzed.

In its investigation, the NTSB determined that the probable cause of the accident was an aerodynamic stall and subse-quent uncommanded roll during a one-engine inoperative takeoff test, which were the result of (1) Gulfstream’s failure to properly develop and validate takeoff speeds for the flight test, and recognize and correct the takeoff safety speed, or V2, error during previous G650 flight tests; (2) the G650 flight test team’s persistent and increasingly aggressive attempts to achieve V2 speeds that were erroneously low; and (3) Gulf-stream’s inadequate investigation of previous G650 uncom-manded roll events, which indicated that the company’s estimated stall angle of attack was too high while the airplane was in ground effect.

Contributing to the accident was Gulfstream’s failure to ef-fectively manage the G650 flight test program by pursuing an aggressive program schedule without ensuring that the roles and responsibilities of team members had been appropriately defined and implemented, engineering processes had received sufficient technical planning and oversight, potential hazards

“The focus on safety culture is not without risks. All of these analyses may gener-ate some good conversations and even regulations, but there’s also a risk of increas-ing cynicism if all this comes to nothing on the ground.” —Dr. John Carroll


seems to be a considerable dispute between experts as to what safety culture is; the theory of a just culture being a sub-culture of safety culture emerged. In the context of justice being part of just culture, the influence of philosophical principles was seen to affect whatever legal system was discussed—common law or Napoleonic code. What is clear from this discussion is that the protagonists of just culture decry the involvement of the justice system in matters of aviation or medical safety. In advocating just culture, an aviation court or tribunal being attached to EASA would actually intermingle the regulatory and judicial process that the same protagonists so highly criticize.

Reference was made to the Air Ontario accident in Dryden, Ontario, and to Judge Virgil Moshansky’s report. The most significant part of this discussion is the judge’s ruling that the standards and recommended practices of ICAO Annex 13 are not legally binding and states that find this requirement im-practical or impossible to comply with can notify a difference to ICAO. The difference filed by Canada simply states, “Present Canadian legislation precludes the possibility to guarantee that the documents outlined could be afforded any protection from disclosure or discovery.”

Therefore, it must be concluded that just culture as under-stood by its protagonists is unachievable in accident investiga-tion. It is equally plausible that the same concept of just culture is unachievable in incident reporting. William R. Voss, president and CEO of the Flight Safety Foundation, stated, “On the topic of the criminalization of human error, flight safety has been vocal. The focus of our efforts has been on the legal protection of safety information. Increasingly, voluntarily provided safety information is being used in court cases, sometimes even trivial cases. We are not talking about the usual states with lax protec-tion but advanced aviation nations like Canada and the UK. It is one thing to see confidential information disclosed in the emo-tional turmoil of a major accident; it is another to see it casually offered up by the courts in the normal course of business. The judges rightly point out that there is no protection for this in-formation under common law or legislation. Even though your regulator may have agreed to protect information and promised not to use it against the person who made the report, that prom-ise has no bearing on anybody else who might want to use it.”

This then is the real politick of occurrence reporting. And after examination of the proposals for a just culture, perhaps for the common good, this is no harm. According to Dame Helena Kennedy, “[Justice] is a process, not a result; and truth is not the only goal of a trial. We want privacy, fairness, equality, and final-ity. Every time we play with the rules to make it easier to convict the guilty, we make it easier to convict the innocent.”

Quoting Seamus Heaney, “that before any process of renova-tion, we should take stock and shore up the vital foundations.” Kennedy says that law is the supreme regulator, a civilizing force. And as it is put in Hurst, “air law is part of general law.” Therefore, in answer to the question of whether there can be a just culture in civil aviation reporting systems, at this point of time, even though the EU has accepted it, there is no confirma-tion that ICAO has. Therefore it must be considered to be an immature concept and merits further investigation.

‘Just Culture’(Continued from page 11)

had been fully identified, and appropriate risk controls had been implemented and were func-tioning as intended.

As a result of this investigation, the NTSB is-sued two recommendations to Gulfstream. The first recommendation asked Gulfstream to com-mission an audit by independent safety experts to evaluate the status of the company’s safety management program and address any areas of concern. The second recommendation asked Gulfstream to share the lessons learned from the audit with aircraft manufacturers and flight test industry groups. In response to the accident report, Gulfstream stated that it accepted “full responsibility” for the accident and implemented corrective actions to preclude such an accident from reoccurring. One of these actions was to integrate SMS principles and practices into the company’s flight test operations.

The safety outcome of this investigation could have been different. An alternative approach could have been to simply label the operator, Gulf-stream, as being subpar and having a defective safety culture. This method would have left the operator without a clear road map of what actions to take in order to safely improve their operations.

As Grote observed during the forum, it is “possible to identify everything that needs to be changed in the organization without ever using the words culture or safety culture, and I think without making any attempt to try to measure it. I think that is perfectly fine because obviously you can point to the weaknesses without actually pointing to culture.”

Summary These are not new issues; accident investigators have been examining organizational factors in accidents and incidents for many years. But our investigations must keep pace as the international aviation community continues to integrate the SMS of operators and service providers into state safety programs and a global safety plan. With regard to safety culture, our investigations must document organizational conditions and influences while avoiding potential biases and counterfactual fal-lacies that may lead to evaluating any accident or incident as evidence of a deficient safety culture.

Consistent with accident investigation methodol-ogy, the approach to investigating safety culture issues must be structured, repeatable, and focused on the objective indications of what are otherwise subjective issues. By thoroughly examining an organization’s performance on measurable safety management functions, accident and incident investigations can document safety culture con-cerns while avoiding difficulties of definitions or measurement. Further, this approach can provide support for concrete recommended actions to mitigate any safety issues without attempting to regulate thoughts and attitudes.


Investigation Challenges Created by Organizational Issues

(Continued from page 24)

MOVING?Please Let Us KnowMember Number _____________________________________________________________________________________Fax this form to 703-430-4970 or mail toISASI, Park Center107 E. Holly Avenue, Suite 11Sterling, VA USA 20164-5405

Old Address (or attach label)

Name __________________________________________________________________

Address ________________________________________________________________

City ____________________________________________________________________

State/Prov. ______________________________________________________________

Zip ____________________________________________________________________

Country ________________________________________________________________

New Address*

Name __________________________________________________________________

Address ________________________________________________________________

City ____________________________________________________________________

State/Prov. _____________________________________________________________

Zip ____________________________________________________________________

Country ________________________________________________________________

E-mail _________________________________________________________________

*Do not forget to change employment and e-mail address.

ISASI Information

OFFICERS President, Frank Del Gandio ([email protected])Executive Advisor, Richard Stone ([email protected])Vice President, Ron Schleede ([email protected])Secretary, Chad Balentine ([email protected])Treasurer, Robert MacIntosh, Jr. ([email protected])

COUNCILLORSAustralian, Lindsay Naylor ([email protected])Canadian, Barbara Dunn ([email protected])European, Olivier Ferrante ([email protected])International, Caj Frostell ([email protected])New Zealand, Alister Buckingham ([email protected])Pakistan, Wg. Cdr. (Ret.) Naseem Syed Ahmed ([email protected])United States, Toby Carroll ([email protected])

NATIONAL AND REGIONALSOCIETY PRESIDENTSAsiaSASI, Chan Wing Keong ([email protected])Australian, Lindsay Naylor ([email protected])Canadian, Barbara Dunn ([email protected])European, Keith Conradi ([email protected])Korean, Dr. Tachwan Cho (contact: Dr. Jenny Yoo—[email protected])Latin American, Guillermo J. Palacia (Mexico)Middle East North Africa, Ismaeil Mohammed Abdul (contact: Mohammed Aziz— [email protected])New Zealand, Alister Buckingham ([email protected])Pakistan, Wg. Cdr. (Ret.) Naseem Syed Ahmed ([email protected])Russian, Vsvolod E. Overharov ([email protected])SESA-France Chapter, Vincent Fave ([email protected])United States, Toby Carroll ([email protected])

UNITED STATES REGIONALCHAPTER PRESIDENTSAlaska, Craig Bledsoe ([email protected])Arizona, Bill Waldock ([email protected])Dallas-Ft. Worth, Tim Logan ([email protected])Great Lakes, Matthew Kenner ([email protected])Mid-Atlantic, Ron Schleede ([email protected])

relationship built on trust is important. 3. To accomplish this, make sure the purpose of the investigation is under-stood. In the case of the A36 accident, the head instructor or the deputy head instructor could have stopped the ac-cident. The students helped us by sug-gesting the existence of unsafe acts that were committed.

There is a limit to the organizational investigation in the ICAO manual. It notes, “A useful rule is that when the organizational investigator begins to ar-rive at circumstances which are beyond the control of managers, the investiga-tion has exceeded reasonable bounds.” In the case of the A36 accident, members of the JTSB carried out the interview with the general safety man-

ager, a top figure of the organization. We did not extend the investigation to the other incidents. Our investigative aim was toward safety challenges in the future.

ConclusionIn summary these important points are repeated: 1. Consider the need of the organizational investigation. 2. Organi-zational investigation is important to prevent recurrence. 3. Improve organi-zational investigation techniques. 4. Build relationships on trust.

(For more details about the investigation, see the original investigation report of this case at www.mlit.go.jp/jtsb/eng-air_re-port/JA4215.pdf.)


Northeast, Luke Schiada ([email protected])Northern California, Kevin Darcy ([email protected])Pacific Northwest, Kevin Darcy ([email protected])Rocky Mountain, David Harper ([email protected])Southeastern, Robert Rendzio ([email protected])Southern California, Thomas Anthony ([email protected])

COMMITTEE CHAIRMENAudit, Dr. Michael K. Hynes ([email protected])Award, Gale E. Braden ([email protected])Ballot Certification, Tom McCarthy ([email protected])Board of Fellows, Curt Lewis ([email protected])Bylaws, Darren T. Gaines ([email protected])Code of Ethics, Jeff Edwards ([email protected])Membership, Tom McCarthy ([email protected])Mentoring Program, Anthony Brickhouse ([email protected])Nominating, Troy Jackson ([email protected])Reachout, John Guselli ([email protected])Seminar, Barbara Dunn ([email protected])

WORKING GROUP CHAIRMENAir Traffic Services, Scott Dunham (Chair) ([email protected]) Ladislav Mika (Co-Chair) ([email protected])Cabin Safety, Joann E. Matley ([email protected])Corporate Affairs, Erin Carroll ([email protected])Flight Recorder, Michael R. Poole ([email protected])General Aviation, James A. Viola ([email protected])Government Air Safety Facilitator, Marcus Costa ([email protected])Human Factors, Richard Stone ([email protected])Investigators Training & Education, Graham R. Braithwaite ([email protected])Military Air Safety Investigator, Bret Tesson ([email protected])Unmanned Aerial Systems, Tom Farrier ([email protected])

CORPORATE MEMBERSAAIU, Ministry of TransportAccident Investigation Board NorwayAccident Investigation Bureau NigeriaAdministration des Enquêtes TechniquesAero RepublicaAerovias De Mexico, S.A. De C.V.Air Accident Investigation Bureau of MongoliaAir Accident Investigation Bureau of SingaporeAir Accident Investigation Unit-IrelandAir Accidents Investigation Branch-UKAir Astana JSC

Air CanadaAir Canada Pilots AssociationAir Line Pilots AssociationAirbusAirclaims LimitedAirways New ZealandAlitalia SpAAll Nippon Airways Co., Ltd. (ANA)AllianzAllied Pilots AssociationAloft Aviation ConsultingAramco Associated CompanyASPA de MexicoASSET Aviation International Pty. Ltd.Association of Professional Flight AttendantsAustralian and International Pilots’ Association (AIPA)Australian Transport Safety BureauAviation Investigation Bureau, Jeddah, Kingdom of Saudi ArabiaAviation Safety CouncilAvisureBecker Helicopters Pty. Ltd.Bundesstelle fur Flugunfalluntersuchung (BFU)Bureau d’Enquêtes et d’Analyses (BEA)CAE FlightscapeCathay Pacific Airways LimitedCharles Taylor AviationChina AirlinesCivil Aviation Authority, Macao, ChinaCivil Aviation Department HeadquartersCivil Aviation Safety Authority AustraliaColegio Oficial de Pilotos de la Aviación Comercial (COPAC)Cranfield Safety & Accident Investigation CentreCurt Lewis & Associates, LLCDassault AviationDDAAFSDefence Science and Technology Organisation (DSTO)Defense Conseil International (DCI/IFSA)Delta Air Lines, Inc.Directorate of Flight Safety (Canadian Forces)Dombroff Gilmore Jaques & French P.C.DRS C3 & Aviation Company, Avionics Line of BusinessDutch Airline Pilots AssociationDutch Safety BoardEclipse Group, Inc.Education and Training Center for Aviation SafetyEL AL Israel AirlinesEmbraer-Empresa Brasileira de Aeronautica S.A.Embry-Riddle Aeronautical UniversityEtihad AirwaysEuropean Aviation Safety Agency (EASA)EVA Airways CorporationExecutive Development & Management AdvisorFinnair PlcFinnish Military Aviation AuthorityFlight Data Services Ltd.Flight Data Systems Pty. Ltd.Flight Safety FoundationGE AviationGeneral Aviation Manufacturers AssociationGlobal Aerospace, Inc.

Grup Air Med S.A.Gulfstream Aerospace CorporationHall & Associates LLCHNZ New Zealand LimitedHoneywell AerospaceHong Kong Airline Pilots AssociationHuman Factors Training Solutions Pty. LtdIndependent Pilots AssociationInterstate Aviation CommitteeIrish Air CorpsIrish Aviation AuthorityJapan Transport Safety BoardJones DayKLM Royal Dutch AirlinesKorea Aviation & Railway Accident Investigation BoardL-3 Aviation RecordersLearjet/Bombardier AerospaceLion Mentari Airlines, PTLockheed Martin Aeronautics CompanyMiddle East AirlinesMilitary Air Accident Investigation BranchNational Aerospace Laboratory, NLRNational Institute of Aviation Safety and ServicesNational Transportation Safety BoardNational Transportation Safety Committee-Indonesia (KNKT)NAV CANADAPakistan Air Force-Institute of Air SafetyPakistan Airline Pilots’ Association (PALPA)Pakistan International Airlines Corporation (PIA)Papua New Guinea Accident Investigation Commission (PNG AIC)Parker AerospacePhoenix International Inc.Plane Sciences, Inc., Ottawa, CanadaPratt & WhitneyPT Merpati Nusantara AirlinesQatar AirwaysRepublic of Singapore Air Force (RSAF)Rolls-Royce PLCRoyal Danish Air Force, Tactical Air CommandRoyal Netherlands Air ForceRoyal New Zealand Air ForceRTI Group, LLCSaudia Airlines-SafetyScandinavian Airlines SystemSikorsky Aircraft CorporationSingapore Airlines LimitedSkyTrac Systems LtdSouthwest Airlines CompanySouthwest Airlines Pilots’ AssociationSpanish Airline Pilots’ Association (SEPLA)State of IsraelStatens haverikommissionSwiss Accident Investigation Board (SAIB)The Air GroupThe Boeing CompanyThe Japanese Aviation Insurance Pool (JAIP)TurbomecaTransportation Safety Board of CanadaUND AerospaceUnited AirlinesUnited States Aircraft Insurance GroupUniversity of Southern CaliforniaWestJet

ISASI Information


ISASI

WHO’S WHO

INCORPORATED AUGUST 31, 1964

Plane Sciences, based in Ottawa, Canada, specializes in helping governments, military services, and airlines use the best technol-

ogies and techniques available today to advance safety and improve operational efficiency. CEO Mike Poole has been an ISASI member since the mid-1980s and is a pioneer in flight recorder analysis and flight animation, receiving the prestigious ISASI Jerome F. Lederer Award in 2010 in Sapporo, Japan.

While Plane Sciences is a relatively new company, its principles have 50-plus years of experience in accident investigation, aviation safety programs, flight data analysis programs, and flight simulation/animation. The company is well known for building flight recorder analysis laboratories for governments and military services worldwide as well as for using innovative techniques for analyzing flight data. As flight recorders become increasingly pivotal in accident investigation, more and more countries, regardless of size, are recognizing the need to establish a core competency in flight recorder analysis to meet their primary investigative mandate as an ICAO Annex 13 signatory.

In the old days, there were few flight

Plane Sciences: Pioneer and Innovator In Flight Reconstruction and Animation

107 E. Holly Ave., Suite 11Sterling, VA 20164-5405 USACHANGE SERVICE REQUESTED

recorders with few parameters. The speciality, which only a few existing facilities in the world could do, was recovering the data from the box. Today, virtually every commercial aircraft has an advanced flight recording system. In most cases, it is relatively easy to recov-er the data due to solid-state recorders. The specialty has changed to the ability to sift through literally hundreds, if not thousands, of parameters to develop a detailed sequence of events. Flight ani-mation has come a long way and is an invaluable tool used to develop, under-stand, and communicate the sequence of events.

The process of retrieving the raw ARINC binary flight data from the multitude of recorders on the market

(Who’s Who is a brief profile prepared by the represented ISASI corporate member organization to provide a more thorough understanding of the organization’s role and function.—Editor)

to a highly intuitive and accurate flight reconstruction optimized to facilitate the investigation process and to com-municate the results is Plane Sciences’ focus and expertise. The more eyes looking at data the better, hence the increasing trend for even the smallest of authorities wishing to develop an internal core capability to be able to analyze flight data.

We are not limited to reactive acci-dent investigation. Plane Sciences also offers a flight data monitoring service with the key differentiator being that it uses experienced accident investigators with flight data expertise to augment the airline’s safety office, which goes a long way toward maximizing the benefit of FDM/FOQA/FDA programs.

Air Safety Through Investigation APRIL–JUNE 2015 Apr Jun 2015... · 2015-04-08 · Air Safety...

Documents

Transcript of Air Safety Through Investigation APRIL–JUNE 2015 Apr Jun 2015... · 2015-04-08 · Air Safety...