E L SENDERO SE BIFURCA : LOS DOS CAMINOS POSIBLES DE LA IGUALDAD

Benner (1975) described five possible perceptions of accident causation: the 'single event', the 'chain of events' or 'domino', 'branched events' or 'tree', 'stochastic events', and 'multilinear events sequence' or 'process'. These are shown in Fig. 3.

Figure 3. Perceptions of the accident phenomenon. (Source: Benner, L. (1975). Accident investigations: Multilinear event sequencing methods. Journal of Safety Research, 7(2)(June), 67-73.).

The Single Causative Event.

The single event conception of an accident was instanced by Benner (1975) as that typically adopted by the news media, and the Police. It focuses on 'the cause'. The limitation of this concept is that contributory factors are not pursued because the 'real' cause is obvious and visible. Benner (1975) considers that this older usage of ‘the cause' of an accident - a single or dominant cause without which the accident would not have happened - is what led to investigators seeking a 'probable cause'. This is unhelpful, because much effort is dissipated in trying to identify which of many factors is the 'probable cause', when in reality all might be important (Miller, 1991). 'Probable cause', specified as the aim of the investigation in the authorising statutes of a number of investigating bodies, is nowhere properly defined (ibid.).

The Chain of Events.

A first step beyond the single cause concept is the chain of events (or

'Domino') theory. An accident is considered to result from a sequence of events, each event leading to the next until the accident happens. A caused B, which in turn caused C, and this in turn caused the accident. Intervention at any point could halt the process and so avert the accident. This concept cannot deal with interactions between events, or contributory factors.

This theory is consistent with the legal concepts of 'proximate cause', and also 'remoteness of damage'. The 'proximate cause' is the event which led to the accident, without intervening events, and so the last opportunity to avert disaster. 'Remoteness of damage' indicates that the earlier action was too remote from the harmful

occurrence, for that action to be considered accountable for the occurrence:

intervening events, "in the favoured legal vernacular...snapped the chain of causation" (Fleming, 1992, p. 216). In terms of aircraft accidents, at least, these legal concepts are unhelpful. The proximate cause, in about 80% of fixed wing aircraft accidents, is some error on the part of the pilot (see, for example, O'Hare, Wiggins, Batt and Morrison, 1994). But all that this says is that the pilot is the penultimate line of defence (Reason, 1991) (the final defences being warning systems). Blaming the pilot for the accident will do nothing to explain the real reasons why the pilot was placed in an unenviable situation in the first place. The concept of 'remoteness of damage'

Reason has described as being analogous to pathogens in the body, waiting for a suitable set of circumstances to arise, to cause harm. Latent failures are, by definition, remote in time and place from the direct harmful occurrence, but they have been shown to be at the root of many accidents (see, for example, Maurino, Reason, Johnston, and Lee, 1995; Reason, 1990). If the accident rate is to be improved, latent failures must be eliminated, or their effects mitigated.

Logic Trees.

The next stage beyond the 'chain of events' in the development of theories of causation was to seek to link the individual elements by a logic tree, as exemplified by the Management Oversight Risk Tree (MORT) (Johnson, 1975), discussed later. The tree starts from a broad base, factors coming together at each level to cause a further factor at the next level, and so on until the top of the tree - the accident - is reached. The method is intended to provide a structure to reduce overlooked factors and to identify general causal areas. One limitation is that it can only show fusion of events over time, but the reality may be that logic chains divide, so that there are interactions between various parts of the tree. These interactions are difficult to depict. Also, time is not explicitly available in the presentation, but it is needed for understanding of the accident sequence. Logic trees are discussed further in

Analytical Methods, later.

The Stochastic Approach.

The stochastic approach is to gather facts and data in order to isolate factors not due to chance. A search is made for common variables over a number of

accidents. This approach, by its nature, cannot derive results from a single accident. However, it may be useful where individual investigations have not succeeded in preventing repeated accidents, as in TAIC (1992), discussed below.

A serious limitation of the stochastic approach is that reporting of facts may be biased by assumptions about causes, made by the investigators of the individual accidents. An apparently 'obvious' cause may result in facts unrelated to that cause being overlooked or discarded as irrelevant. Thus, in a series of accidents involving

Pterodactyl microlight aircraft, the investigators thought, in each case, that the accident cause was unrelated to the aircraft design (OAAI, 1983; 1984; 1985b; 1988; TAIC, 1992). Apparently valid causes, different in each case, were found. Little attention was paid to the structural failures, and documentation of these failures was inadequate (TAIC, 1992). Subsequent analysis showed that all the accidents were due to design deficiencies (ibid.).

Multilinear Event Sequencing.

Unlike logic trees, Multilinear Event Sequencing (MES) incorporates time, and recognises multiple events involving multiple actors. Interactions can readily be shown. MES provides chronological validation (discussed later) and the opportunity to discover possible unknown linking events. It defines an accident as beginning with a perturbing event, and ending with the final damaging event. This definition does not allow for consideration of latent failures and precursor events. Nor does it allow consideration of the aftermath, where events subsequent to the accident may be worthy of attention. For example, the omission to replace an air traffic controller after an airmiss could have the potential for that controller, under the stress of the

occurrence, to set up a further possible collision. The reason for that omission should therefore be examined.

The MES concept will be examined in more detail, later.

The Concept of Causation

Benner (1994), Rimson (1998) and Ladkin (1999) all used 'cause' as meaning the link between one event or condition, and its successor to which it is logically related. If all the Event Building Blocks (EBBs) (to use Benner's nomenclature) are necessary and sufficient, it follows that all the causal links are equally important. To single out any one, or even a group of them, may be counterproductive, in that it diverts attention from the rest, and from the overall picture. This view is not in accordance with the concept of a 'core problem' (Dettmer, 1997), in which a single unsatisfactory situation gives rise to later problems. Core problems will be discussed later, when Why-Because Analysis (Ladkin, 1998) and Theory of Constraints

itself, is generally accepted, and will be used in this sense throughout this thesis.

Systemic Causes

Helmreich's Environmental Concept.

In investigating a human factors accident, Helmreich (1990) sought to depict the various factors which could put the crew under pressure. He envisaged the crew working within a series of environments, each of which might put pressure on the crew members, and degrade their performance. This series of environments was envisaged as concentric spheres of influence, each affecting those inside (Figure 4). The innermost environment concerns matters among the crew, such as

communications, personality and Crew Resource Management. The crew is affected by the physical environment: the aircraft with its idiosyncrasies, defects and

performance characteristics; the weather, both local and general; and the aerodrome environment. Outside these is the organisation of the airline, which purchased and maintained the aircraft, trained the crews, and should support their actions.

Surrounding all these is the regulatory environment, in which regulatory action should ensure safe standards of operation.

Helmreich, (1990) considered each of these environments in turn, to discover the deficiencies in them and how they affected the other environments within. To take just one example of many, "Several aspects of the Regulations provided an indirect, deleterious influence on the crew's operational environment" (p. 6). These included

Failure to provide clear guidance for organisations and crews regarding the need for de-icing. "There are no… approved guidelines which dispatchers or flight and ground crews may use to assist them in making a reasoned judgement…" (See (a) in Figure 4).

This is not strictly a model of the accident structure, since it shows what has happened, but does not deal with how the various factors came about. However, in conjunction with other concepts, it provides an effective means of presenting the human factors aspects of an accident (ATSB, 2001; Zotov, 1996).

Figure 4. Flight crew: factors affecting performance: Helmreich's 'spheres of influence' (Source: Zotov, D. V. (1996). Reporting human factors accidents. Paper presented at the 27th International Seminar of the International Society of Air Safety Investigators, Auckland.)

Key

(a) Failure to provide clear guidance about the need for de-icing

(b) Lack of rigour in regulating and monitoring operations - no Minimum Equipment List; no accepted Aircraft Operations Manual

(c) Delayed and incomplete audit of operations

(d) Lack of operational support from Air Canada for financial reasons

(e) Disruptive effect of mergers and strikes - not conducive to team performance (f) High turnover of management personnel following the merger

(g) Lack of organisational experience in jet operations

(h) Deficiencies in the dispatching system - untrained dispatchers and pilot self-dispatch (i) Lack of standard operating procedures and manuals for the F28

(j) Inconsistencies in training F28 crew members - various contractors, and internal training by newly qualified pilots

(k) Deficient leadership for the F28 programme - chief pilot also responsible for the Convair 580 fleet, with little experience on either type

(l) Informal culture at Air Ontario - indulging in practices in violation of Transport Canada regulations

(m) Maintenance problems with the F28 exacerbated by groundcrew unfamiliarity with the aircraft, and shortage of spare parts

(n) Flight Attendant training permitting no questioning of the pilots (o) Mechanical problems especially the inoperative APU

(p) Weather at Winnipeg (original departure point) which had caused earlier delay for de-icing (q) Weather at Thunder Bay (previous stop) which had caused an earlier weather hold

(r) Weather pattern: unsettled weather had increased dispatch fuel requirements, necessitating refuelling stop at Dryden

(s) Weather at Dryden Snow started to fall during the stop

(t) Unfamiliarity with the aircraft: each pilot had less than 100 hours on type

(u) Difficulties in working together: Both pilots accustomed to flying as Pilot in Command; pilots came from different airlines which had merged

(v) Personal factors: Captain acted as an instructor, which could irritate experienced pilots; both pilots had scheduled personal trips immediately after the final sector

Latent Failures.

In the field of aircraft accident investigation, Mahon (1981) appears to have been the first to adopt the concept of remote managerial actions setting up an

accident. Mahon conducted a Royal Commission of Inquiry into the Erebus disaster:

In 1979 an Air New Zealand DC10 aircraft, on a sightseeing trip to Antarctica, while flying in clear air, collided with the side of Mount Erebus. It was demonstrated that the direct cause of the accident was whiteout, which deprived the crew of visual reference while the aircraft was flying in apparently unlimited visibility. The Report of the subsequent Royal Commission of Inquiry absolved the crew of any blame. Instead, it cited failures within the Company, and in particular the action of changing the computer flight plan immediately before the flight without notifying the crew, so programming the aircraft to fly straight at the side of the mountain.

The accident had already been investigated by the New Zealand Office of Air Accidents Investigation (OAAI, 1980). While some new evidence came to light in the course of the Inquiry, and other evidence was sometimes accorded different weight, there was little material difference between the findings of fact of the two investigations. However, the determinations as to cause were very different: the OAAI Report had found that the probable cause was the pilots' action of descending towards an area of poor horizon definition.

How could two investigations proceed from essentially the same facts, and come to such different conclusions? The OAAI Report used the (then) standard 'Domino theory', and the investigators were directed by the Crown Law Office that in the New Zealand legislation, 'probable cause' was synonymous with proximate cause (R. Chippindale, personal communication, 1989). Within that framework, the finding of probable cause could not be faulted. By contrast, Mahon took the view that earlier actions by the company had set up the accident, and the crew were the victims of these actions: the crew acted properly, in the light of what they knew of the situation. Mahon, therefore, had adopted the concept of 'latent failure' propounded by Johnson

(1980), although Mahon (1981) gave no indication that he was familiar with Johnson's work.

Consideration of the effectiveness of corrective action which could result from each report points to Mahon's view as being more likely to help avert future accidents. From the OAAI report, the possible corrective action would have been to advise crews not to fly in whiteout conditions. Little could be gained by advising crews not to fly in whiteout conditions, when the crews (and the airline) had a defective

understanding of whiteout. Conversely, addressing the underlying problem identified by Mahon (1981), of defective communications within the airline, would not only have averted the direct cause of failure to advise the crews of a change. It would also have rectified the defective briefing which contributed to all of the airline's crews' lack of understanding, both of the hazards of Antarctic flying, and of the intended safeguards.

Reason's Model of Systems Failure.

Reason's depiction of the structure of a systems accident is shown in Figure 5.

Figure 5. The structure of an organisational accident. (Source: Reason, J. (1991). Identifying the latent causes of aircraft accidents before and after the event. Paper presented at the 22nd International seminar of the International Society of Air Safety Investigators.)

Reason (1990; 1991) popularised Johnson's (1980) concept of latent failure. In Reason's terms, the changed flight path towards Mount Erebus, of which the crew had

Mahon (1981) - poor communications within the Company - would be described as a General Failure Type. The various errors by those at the 'sharp end' are seen as mere token failures.

The Reason model is based on the underlying systems structure, and is intended to discover the deficiencies that led to the crew being put in the sort of situation that Helmreich (1990) examined. Reason (1991) takes the view that correcting individual failings is unlikely to prevent future accidents: we must seek out and remedy the underlying causes, which he terms General Failure Types.

He developed the model after studying reports of a number of major disasters. These included the Kings Cross Underground fire in London, the Clapham Junction rail collision, the Piper Alpha oil rig disaster, the sinking of the Herald of Free Enterprise off the Belgian coast, and accidents at nuclear power plants (Reason, 1990).

Reason's model of an organisational accident postulates three basic elements: 1. Organisational processes

2. Task and environmental conditions

3. Individuals performing a variety of unsafe acts

Causality commences with organisational processes, and leads through the task and environmental conditions that promote unsafe acts, to the errors and violations of individuals at the 'sharp end', whether on the flight deck or on the hangar floor. Finally, the defences built into the aircraft such as stall warning and recovery either fail, or are disabled, and the accident occurs. While unsafe acts are performed by individuals, the conditions that encourage or provoke those acts, such as shortage of time allotted to a task, are the province of management.

One limitation of the applicability of Reason's concept of a systems accident to aviation accidents lies in the sorts of cases he examined. Reason (1991) considered that any technical organisation was continuously involved in four related processes:

contextual frames, the Goal Statement, and an Organisational framework in which a company is organised to achieve its goals.

Reason treated the "organisation", that is, the company involved in the accident, as being monolithic, and this may very well be true of railways, and nearly true of ferry companies. Such companies may well design and build, or control the building of, their equipment. For example, the former New Zealand Railways Department had workshops in which its locomotives and rolling stock were built, and ships may be built to the specification of the shipping line. However, it is certainly not true of airlines. Airlines generally operate and maintain their equipment, but they are entirely separate from manufacturers who design and build it, with virtually no opportunity to affect the design and construction of their aircraft. Also, as we have already seen in the Helmreich model, they operate within the influence of other organisations - ICAO, the regulatory authority, and air traffic service providers. This difference gives rise to some difficulties in trying to apply the Reason model to the specifics of an aircraft accident, as will be discussed later.

Having identified these organisational and operating processes, Reason (1991) then identified General Failure Types associated with each, as shown in Table 1. While these are not the only possible General Failure Types, they are ones that feature in many aircraft accidents.

Table 1. General Failure Types. (Source: Reason, J. (1991). Identifying the latent causes of aircraft accidents before and after the event. Paper presented at the 22nd International seminar of the International Society of Air Safety Investigators.)

Reason (1991) advocated that the underlying latent failures should be identified step by step. The investigators should backtrack from the accident, via the failed

defences, to the unsafe acts, the conditions which gave rise to those acts, and ending with the fallible top-level decisions that set the accident sequence in motion.

The main steps in the analysis using the Reason model would then be:

Defences What aspects of the aircraft's defensive system were absent, failed, or circumvented?

Unsafe Acts What types of actions were involved in breaching or bypassing the defences? Were these individual or group failures?

Preconditions What task, situational or environmental factors promoted these unsafe acts?

General Failure Types Which of the General Failure Types were implicated in creating these preconditions? What factors shaped the underlying conditions? What shortcomings are revealed in the organisation's safety culture?

At each level it may be possible to make detailed connections between the identified accident facts, and their precursors at the preceding level. However, this process will become more problematic at the higher levels, where there may be interactions between a number of top-level decisions and General Failure Types.

The Reason model poses some difficulties for investigators who seek to use it as