Non Newtonian View of Accidents

8/3/2019 Non Newtonian View of Accidents

http://slidepdf.com/reader/full/non-newtonian-view-of-accidents 1/50

U N C L A S S I F I E D

U N C L A S S I F I E D

Operated by the Los Alamos National Security, LLC for the DOE/NNSA

A NonA Non--Newtonian* Model of AccidentsNewtonian* Model of Accidents

andand

Accident InvestigationAccident InvestigationRoger Kruse, CSP

Los Alamos National Laboratory

Los Alamos, New Mexico

* Isaac Newton¶s 3rd Law of Motion ± for every

action there is an equal and opposite reaction



UNCLASSIFIED

Operated by Los Alamos National Security, LLC for NNSA 2

Credit where credit is due «

Many of the concepts in this presentation are derived from

publications by Erik Hollnagel, University of Linköping,

Sweden and Sydney Dekker , Department of Aeronautical

Engineering, Lund University, Sweden.

Books I would recommend are:

The Field Guide to Understanding Human Error , 2006, Dekker

Just Culture, 2007, Dekker

Barriers and Accident Prevention, 2004, Hollnagel

The ETTO Principle: Efficiency-Thoroughness Trade-Off, 2009,

Hollnagel



UNCLASSIFIED


What is an Accident Model?

A frame of reference, or stereotypical way of

thinking about an accident

An unspoken, but commonly held belief abouthow accidents happen



UNCLASSIFIED


Why should I Care?

WYLFIWYF*

*What You Look For Is What You Find

What you find when you investigate an event isinfluenced by the accident model you use

How you try to prevent accidents is influenced

by how you think they happen



UNCLASSIFIED


Evolution of Accident Models

Sequence of Events

(1930s Present)

Epidemiological(1970s Present)

Systemic (Non-Newtonian)

(Emerging)

Based on cause

and effect

Not based on

cause and effect



UNCLASSIFIED


Sequence of Events Model

A simple, linear cause and effect model

Accidents are seen as a series of events which occur

in a specific and recognizable order

Caused by unsafe acts or conditions

Prevented by fixing or eliminating the weak link or

inserting a barrier to interrupt the series of events

Domino Theory of

Accident Causation

- H. W. Heinrich 1931



UNCLASSIFIED


Sequence of Events, continued

Sequential models can be intricate, including

hierarchies such as: Event trees

Fault trees

They are attractive because: Easy to think in a linear series

Easy to represent graphically

And therefore, easier to understand



UNCLASSIFIED


Epidemiological Model

A complex, linear cause and effect model

Accidents result from a series of active failures (unsafe

acts) and latent conditions (hazards)

Caused by degradation of defenses (organizational,

human, technical)

Prevented by strengthening barriers and defenses

Based on Accident Causation

Model (Swiss Cheese)

- James Reason 1990



UNCLASSIFIED


Epidemiological, continued

Accidents result from deficiencies that lay dormant untiltriggered by active failures

Focuses attention on the organizational issues and

views human error more as an effect, than a cause

More complex, but still linear with a clear path through

ordered defenses

Because it is linear, it oversimplifies the complex

interactions between the multitude of active failuresand latent conditions



UNCLASSIFIED


Systemic Model

A complex, non-linear model

Both accidents (and success) emerge from

subtle, unexpected interactions between

relatively simple parts of a complex system

Non-Newtonian because cause and effect

relationships generally do not exist

Difficult to represent graphically because it isnon-linear



UNCLASSIFIED


Functional Resonance Accident Model (FRAM)- Erik Hollnagel



UNCLASSIFIED


Another way to think about it «

Accidents are unexpected combinations of

normal variability within the system

Because the variability is within expected

norms, the accidents are triggered by normalactions, rather than action failures



UNCLASSIFIED


Accidents are unexpected combinations

of normal variability

Time



UNCLASSIFIED


Swedish Airlines MD-8

2Overran End of Runway

June 23, 1999

Case Study



UNCLASSIFIED


Ground Spoilers



UNCLASSIFIED


How the spoilers and ABS work

Pilot arms spoilers before landing

When the aircraft touches down, spoilers are

deployed: when main gear wheels spin up, or

front landing gear is compressed

Deployment of the spoilers activates the ABS

system



UNCLASSIFIED


MD-82 Forward Pedestal

Spoiler Lever



UNCLASSIFIED


Spoiler Lever

Unarmed Armed



UNCLASSIFIED


Facts

Brake disks cold after landing

Per the flight recorders, spoilers did not deployand the ABS did not activate

No technical fault with braking system

Arming spoilers is a pre-landing checklist item Co-pilot reads the checklist

Pilot arms the spoilers after lowering landing gear

Co-pilot confirms spoilers deployed after landing



UNCLASSIFIED


Accident Board Conclusion

The cause was inadequate Crew ResourceManagement (i.e. pilot error) because

The pilot did not arm spoilers before landing,

The co-pilot did not report lack of spoiler deployment after landing



UNCLASSIFIED


Old vs. New View of Human Error*

Human error is a cause of accidents

To explain failure,investigations must seekfailure

They must find people¶sinaccurate assessments,wrong decisions and bad

judgments

Human error is a symptom of trouble inside the system

To explain failure, do not tryto find where people wentwrong.

Instead, find how people¶sassessments and actionsmade sense at the time,given the circumstances that

surrounded them.

* Dekker, Sydney (2002)T he Field Guide to Human Error Investigations



UNCLASSIFIED


Flight Crew Information

Pilot 49 years old

6,775 total flight hours

3,500 flight hours in type

Co-pilot 57 years old

17,000 total flight hours

7,000 flight hours in type



UNCLASSIFIED


Flight Crew Issues

The assigned co-pilot became ill and areplacement pilot was called out on short notice.

If substitution is made during flight planning, the

one with seniority serves as pilot

Per policy for short notice, the replacement pilotassumed the duties of person (co-pilot) hereplaced



UNCLASSIFIED


Effects of Scheduling Problem

Although fully qualified to perform the co-pilotduties, the replacement pilot had not actually

flown as co-pilot for 6 months

After landing, the co-pilot forgot to confirmspoiler deployment



UNCLASSIFIED


ILS Approach Procedure

Lower Landing Gear (when glide slope active)

Spoilers armed (when gear down and locked)

Flaps FULL (when glide slope captured)



UNCLASSIFIED


ILS Approach Procedure



UNCLASSIFIED


ILS Approach Procedure with Timeline

At t = 0

At t = 10

At t = 16

Lower Landing Gear (when glideslope active)

Spoilers armed (when gear down

and locked)

Flaps FULL (when glide slope

captured)



UNCLASSIFIED


The problem is «.

It normally takes ~ 10 seconds for gear to go

down and lock

Flight simulators allow 10 seconds for gear

down and locked

But on older aircraft, with worn hydraulics, gear

down and locked can take over 30 seconds to

complete



UNCLASSIFIED


Timeline on Older Aircraft

At t = 0 Lower Landing Gear

At t = 30 Spoilers armed (when gear down and locked)

At t = 16 Flaps FULL

Wind forces (180 knots) can compress landing gear as it

is lowered

Landing gear must be down and locked before spoilersarmed



UNCLASSIFIED


Result

Checklist cannot be executed as written

pilot forced to skip step to arm spoiler

pilot has to remember to arm spoiler later,when gear is actually down and locked



UNCLASSIFIED


Why not just use the brakes?

Excerpt from DC-9 (M

D-82) OperatingM

anual

On extremely slippery runways at high speeds,

the pilot is confronted with a rather gradual

deceleration and may interpret the lack of an

abrupt sensation of deceleration as a total anti-

skid failure.

The natural response might be to pump the

brakes or turn off the anti-skid. Either action

will degrade braking effectiveness.´



UNCLASSIFIED


Taken Together:

Assigned co-pilot sick

Replacement pilot called out on short notice

Replacement pilot assigned as CP, per policy

Replacement pilot had not flown recently as CP

Pilot chose ILS approach Aircraft had slow landing gear hydraulics

Spoilers cannot be armed before gear down

ILS approach checklist can not be executed as written

Flight simulator allows 10 sec to lower landing gear

Wet runway

Manual braking discouraged on slippery runways

Anything Abnormal?



UNCLASSIFIED


Accidents as unexpected combinations of

normal variability

Time



UNCLASSIFIED


Seem ominous?

Accidents can happen when everything

appears normal

Modeling is difficult and time consuming

Impact of subtle interactions is only apparentafter the event

Failure is not always predictable

The A/I conclusion might be ³the accident wasnot avoidable´ (except in hindsight)

What can you do?



UNCLASSIFIED


How do you feel about this?

Work as Imagined

Work as Done



UNCLASSIFIED


Things go right because:

Systems are well designed and maintained

Work planners can anticipate and compensate

for abnormal conditions

Procedures are complete, correct and current

People behave as they are expected to ² as

they are taught

Therefore, humans are a liability and performancevariability is a threat.



UNCLASSIFIED


Things go right because people:

Learn to overcome design flaws and functionalglitches

Adapt their performance to meet the demands

of a dynamic work environment

Interpret and apply procedures to match

changing conditions

Can detect and correct when things go wrong

Therefore, humans are an asset without which

the work could not be successfully completed.



UNCLASSIFIED


How most work happens «

S

U

CC

E

S

S



UNCLASSIFIED


The traditional focus is pre-job

Work as Imagined

Work as Done

Work

planning

Hazard

AnalysisProcedures

Pre-Jobs



UNCLASSIFIED


More focus on post-job

Work as Imagined

Work as Done

Post-JobReview Normally

Successful!



UNCLASSIFIED


Six Simple Questions

What happened the way it should have?

What didn't happen the way it was supposed to?

What hazards did we miss?

Which steps did we have to interpret?

Where did we detect and correct?

Where did we have to ³make do´ to get the job done?



UNCLASSIFIED




UNCLASSIFIED


A question to ponder «.

The basis for the Sequence of Events and

Epidemiological models is the assumption of cause

and effect relationships

In the Systemic model, accidents are seen to emerge

from unexpected interactions of normal variability in the

system rather than cause and effect relationships

So, does causality exist?



UNCLASSIFIED


Cause and Effect in the Real World

Cause is inferred from observation, but is not alwayssomething that can be observed directly

Normally, we repeatedly observe Action A followed by

Effect B and conclude that B was caused by A

Action A Effect B

Observable ObservableNot Observable

(concluded)

Source: Hollnagel, Erik (2004) Barriers and Accident Prevention



UNCLASSIFIED




UNCLASSIFIED


Cause and Effect in Investigations

Investigations involve the notion of backward causality,

i.e., reasoning backward from Effect to Action

We observe Effect B, assume that it was caused by

something and then try to find out which preceding

Action was the cause of it

Effect B

Observable Observable

Not

Observable

(constructed)

Source: Hollnagel, Erik (2004) Barriers and Accident Prevention

Action ?



UNCLASSIFIED


Common problems working backwards

Human tendency to draw conclusions that are not

logically valid

We tend to use educated guesses, intuitive judgment,

or ³common sense´ rather than rules of logic Event timelines create sequential relationships that

seem to infer a causal relationship

Because lots of actions are taking place, there is

usually one that seems plausible



UNCLASSIFIED


Requirements for a cause ± effect

relationship

1. The cause must precede the effect (in time)

2. The cause and effect must be contiguous in

time and space

3. The cause and effect must have a necessary

and constant connection between them, such

that the same cause always has the same

effect



UNCLASSIFIED


Any ³causes´ on this list?




Replacement pilot had not flown as CP for 6 months

Pilot chose ILS approach

Aircraft had slow landing gear hydraulics


ILS approach checklist not doable as written

Flight simulator allows 10 sec to lower landing gear Wet runway





Replacement pilot had not flown as CP for 6 months

Pilot chose ILS approach

Aircraft had slow landing gear hydraulics


ILS approach checklist can not be executed as written

Flight simulator allows 10 sec to lower landing gear Wet runway




UNCLASSIFIED

Operated by Los Alamos National Security LLC for NNSA 50

³The identification, after the fact, of a limited setof aspects of the situation that are seen as

necessary and sufficient conditions for the

observed effects to have occurred.

The cause, in other words, is constructed rather

than found´.- Hollnagel, Erik (2004) Barriers and Accident Prevention

What is a ³cause´?

³The cause of an accident is not found in the rubble, it isconstructed in the mind of the investigator.´

- Dekker, Sydney (2002)The Field Guide to Human Error Investigations

Non Newtonian View of Accidents

Documents

Transcript of Non Newtonian View of Accidents