Rockets Sleds, Steamships and Human Factors: Murphy’s Law or Holt’s Law?
Rockets Sleds, Steamships and Human Factors: Murphy’s Law or Holt’s Law? Murphy’s Law: Whatever can go wrong, will go wrong. To some a pessimistic inevitability, to others a call to arms for defensive design to prevent opportunities for failure. We look at how that ‘law’ was named and how the origins of the ‘law’ actually stretch back to a Liverpool ship-owner and engineer in 1877. That Man Murphy ‘Murphy’s Law’ was not reference to a generic accident prone Irishman as some believe, but to Major Edward Aloysius Murphy Jr. USAF (b 11 Jan 1918 d 17 Jul 1990). As described Nick Spark, author of A History of Murphy’s Law, Murphy was a USAF engineer working on instrumentation for an aerospace medical research programme, MX981. The programme used high-speed rocket sleds at Muroc Army Air Field (later renamed Edwards Air Force Base) to examine human tolerance to acceleration and deceleration. The human in question was frequently researcher Colonel John Paul Stapp, MD PhD (b 11 Jul 1910 d 13 Nov 1999). Stapp’s work using the rocket sled had a profound influence in the field of crashworthiness, human survivability and motor vehicle safety. However, it was hazardous work that on a good day left the subject with black eyes (from their eye-balls ‘punching’ their eye-lids) and sometimes worse (Stapp broke several bones), with the greatest deceleration experience by Stapp being 46.2g. https://www.youtube.com/watch?feature=player_detailpage&v=s4tuvOer_GI Murphy had designed a strain-gauge device to more accurately measure the deceleration. When it was first tested, there was massive disappointment as it had not recorded data. When examined it was discovered that it had been mis-wired and in particular there were two ways to wire the unit (only one of which would result in success). Although who said what remains disputed, according to Stapp, at a subsequent press conference on the trials, that was where ‘Murphy’s Law’ was born. https://youtu.be/SRZ4deJsndM Error tolerance of designs had already been recognised in the early days of civil aviation though. In 1925 Major General Sir Sefton Brancker, the UK’s Director of Civil Aviation has said in a presentation to the Royal Aeronautical Society (discussed in Flight): Error of judgement had been the basic cause of 8 out of 12 dangerous accidents. These could be divided into categories, five of which were the fault of the pilot in that he took the wrong action, and three of which were caused by failure to handle the aircraft correctly. The second category did affect the designer. From the beginning the designer had always been prone to assume that his aircraft would be flown by an absolutely first-class pilot. In air transport we want a really foolproof machine… Perhaps ironically Brancker perished in the R101 airship disaster in 1930. However, it appears that the concept named at a Californian dry lake actually has nautical origins… Alfred Holt Liverpool ship-owner and engineer Alfred Holt had formed the Alfred Holt and Company on 11 January 1865. Its main operating subsidiary was the Ocean Steam Ship Company, trading as Blue Funnel Line. Holt, an accomplished marine engineer, formed the company at the height of the great sail-powered clipper ships, to exploit developments in steamship technology. It has been said that Holt “had no romantic feelings for the clippers…and had an unshakeable belief in steam propulsion”. Francis Hyde in his 1957 book Blue Funnel, quotes Holt that “the main problems…centred around the screw propeller, the building of a ship in iron, and the compound engine”. Holt was among the first to combine the three features successfully. The subsequent opening of the Suez...
read moreFuel System Maintenance Error: Tuniter ATR72 TS-LBB Ditching 6 August 2005
Fuel System Maintenance Error: Tuniter ATR72 TS-LBB Ditching 6 August 2005 On the 6 August 2005 a Tuninter ATR72 turboprop aircraft, TS-LBB, flying from Bari, Italy to Tunis, Tunisia, ran out of fuel and ditched off the northern coast of Sicily. Of the 39 people on board, 16 died. The aircraft had been erroneously fitted during maintenance with the Fuel Quantity Indicator (FQI) for the smaller ATR42. The ATR72 FQI was not found in the stores because its part number had been entered into the stores database without the integral ‘dashes’ and the database mistakenly indicated that the ATR42 part, which was found in the database, was compatible with both aircraft types. With the wrong FQI, the quantity displayed exceeded the actual fuel. When fuelled, the difference between the expected fuel and that indicated was not initially noticed. When it was, it was incorrectly believed that a further fuelling had taken place and the records misplaced. When the engines flamed out the crew did not feather the propellers to reduce drag as they were attempting to restart the engines, believing fuel remained (as indicated by the FQI). Consequently they did not fly the aircraft at the optimum speed to extend the gliding distance. This was a classic ‘organisational accident’ unfortunately the a number of individuals were prosecuted. There was also considerable condemnation over the use of the CVR by the prosecutors. The full Agenzia Nazionale per la Sicurezza del Volo (ANSV) report is here and an separate academic paper here. An Airworthiness Directive was issued: F-2005-160 In 2009 the Flight Safety Foundation (FSF) published this useful summary: False Positive The FAA Lessons Learnt Database contains three fuel exhaustion case studies: Title Description Date UAL Flight 173 near Portland On December 28, 1978 a McDonnell Douglas DC-8-61 turbofan powered airplane operated by United Airlines and registered as N8082U, crashed into a wooded suburban area while on approach to Portland International Airport, Portland, Oregon. …more December 28, 1978 Avianca Airlines B707 Flight 52 at Long Island, NY Avianca Airlines Flight 052, a Boeing 707-321B, was a scheduled international flight from Bogota, Colombia, to John F. Kennedy (JFK) International Airport, New York. Poor weather conditions in the Northeast of the US led to the flight being put in …more January 25,1990 Air Transat A330 Flight TSC236 at Terceira Airport, Azores On August 24, 2001, Air Transat Flight TSC236, an Airbus Model 330-243 aircraft, was on a scheduled flight from Toronto, Canada to Lisbon, Portugal. A fuel leak in the Number 2 (right) engine began three hours 46 minutes into the flight that was …more August 24, 2001 Safety Resources See also: B1900D Emergency Landing: Maintenance Standards & Practices Airworthiness Matters: Next Generation Maintenance Human Factors Rockets Sleds, Steamships and Human Factors: Murphy’s Law or Holt’s Law? Professor James Reason’s 12 Principles of Error Management Back to the Future: Error Management Aerossurance has previously examined: Fuel Exhaustion Causes EMB-110 Emergency Landing Canadian KA100 Fuel Exhaustion Accident UPDATE 12 October 2019: ATR72 VH-FVR Missed Damage: Maintenance Lessons Unclear communications, shift handover & roles and responsibilities, complacency about fatigue and failure to use access equipment all feature in this serious incident. UPDATE 25 June 2020: Japanese Jetstar Boeing 787 GEnx-1B Engine Biocide Serious Incident Aerossurance worked with the Flight Safety Foundation (FSF) to create a Maintenance Observation Program (MOP) requirement for their contractible BARSOHO offshore helicopter Safety Performance Requirements to help learning about routine...
read moreLoose B-Nut: Accident During Helicopter Maintenance Check Flight
Loose B-Nut: Accident During Helicopter Maintenance Check Flight Another investigation by the US National Transportation Safety Board (NTSB), published on 13 July 2015, has highlighted poor maintenance standards and continuing airworthiness management in a US helicopter operator. The NTSB report that on 1 January 2014, Airbus Helicopters EC130B4, N133GC, operated by Papillon Airways Inc (PAI), was being flown on a post-maintenance check flight. When on short finals to Boulder City Municipal Airport, Nevada, at about 200 feet above the ground and an airspeed of 40 to 50 knots, the engine flamed-out. The pilot lowered the collective to initiate an autorotation, but was not able to successfully complete the landing. The tail boom touched the ground first and a hard landing ensued. The pilot, the sole occupant, was uninjured but the helicopter, which came to rest on its right side, sustained substantial damage. The NTSB state that during: …examination of the wreckage, a main fuel supply line B-nut fitting was found without the safety wire, and the nut was loose when turned by hand. ‘B-nut’ is a common term for a nut used to connect fluid lines and hoses. They are a regular cause of engine loss of power events, especially on light helicopters. The NTSB go on: Before the accident flight, the line had been disconnected during a task to replace the bidirectional suspension cross-bar assembly, and the accident flight was the first flight since the task was performed. According to the non-certificated maintenance technician who performed the task, the line was removed to defuel the fuel tank, which was contrary to manufacturer’s maintenance manual instructions. Based on the evidence, it is likely that the B-nut fitting was not properly tightened and safety-wired during reassembly, which allowed it to back off due to normal engine vibration and resulted in the interruption of the fuel flow during flight. The Maintenance Manual technique to access the bi-directional suspension cross bar assembly is to remove the main gear box not the fuel tank. Additionally: The maintenance records showed no entry regarding the removal or disconnection of the main fuel supply line. The NTSB determined the probable cause to be: A loss of engine power due to fuel starvation as a result of the non-certificated maintenance technician’s failure to properly tighten and safety wire a B-nut fitting. Contributing to the accident was the maintenance technician’s failure to follow the manufacturer’s maintenance manual instructions. Although the NTSB identifies failures by a mechanic, this accidents highlights issues with how operator’s maintenance organisation planned and supervised maintenance. The NTSB go on to say: Following the accident, PAI implemented a 16-step independent control check to their Safety Control System which will be conducted by only experienced maintenance inspectors. This system is complemented by the addition of the inclusion of exclusively assigned Maintenance Ops Check Pilots who provide an additional level of oversight. An internal maintenance training system was created with heavy focus on FAA CFR 39, 43, 91, to include onsite manufacturer’s training programs that encompass airframe and engine systems. Further details of 13 actions being taken by Papillon can be found in their action plan submission in the NTSB Public Docket (dated 22 April 2015), including a two week safety-standown at their Nevada operations. Despite a range of actions to improve their maintenance organisation, procedures and training Papillion still felt it appropriate to “immediately terminate” 3 employees (the first action listed in the action plan). The...
read more‘Procedural Drift’: Lynx CFIT in Afghanistan
‘Procedural Drift’: Lynx CFIT in Afghanistan (Lynx AH9A ZF540 near Kandahar) ‘Procedural drift’ in the operating detachment was noted by the Service Inquiry into a British military helicopter accident in Afghanistan that killed 5 service personnel. This drift is said to have allowed standards to dilute during sustained operations in theatre. The Military Aviation Authority (MAA) released the Service Inquiry (SI) report on 16 July 2015, into loss of the British Army Air Corp AgustaWestland Lynx AH9A helicopter ZF540 in a Controlled Flight Into Terrain (CFIT) accident in Afghanistan on 26 April 2014. This was the first fatal loss of a British helicopter in 13 years of operations in Afghanistan (although a third party fatality had been caused by a Chinook in 2010). It is also the first Lynx AH9A accident since the first flight of the re-engined variant in 2009 (we provide background on the AH9A below). The Accident The accident occurred during a two-ship vehicle interdiction training mission in the ‘Bowling Alley’ valley on the ‘Texas Helo Range’ range 20 km south of Kandahar Airfield, at a density altitude of 5400ft. The helicopter made a rapid descent, assessed at between 2000ft/min and 2500ft/min, from 400ft above ground level on its final pass. It impacted the ground ‘wings-level’, ~5º nose up, with minimal yaw and “significant forward speed”, leaving a 75m debris trail. The main fuel tanks were compromised and a post-crash fire ensued. The Investigation The SI notes that during the flight (including the last two passes), the military passengers, who were gaining experience of the AH9As operational role, were allowed to fire a General Purpose Machine Gun (GPMG) door gun. The SI Panel comment that this had not been discussed in sufficient depth at the pre-flight briefing and that this part of the sortie appeared more ‘ad hoc’. They also comment on that due to a shortage of Suitable Qualified and Experienced Personnel (SQEP) the commanders authorised each others flights rather than an independent flight supervisor conducting the authorisation. The SI postulates, based on some limited Cockpit Voice Recorder (CVR) data, that a rapid descent may have been deliberate to “provide a thrill for the passengers”, though it is important to note they do also comment positively on the general airmanship and professionalism of the flying. They also note a possible self induced time pressure. The report notes that the entry point on the final pass was different, giving the crew different visual clues. The SI Panel comments that the crew may also have been distracted trying to establish visual contact with the second Lynx. Additionally they note that the radar altimeter (RADALT) was not being used effectively as the ‘bugged’ setting was too low to initiate a recovery in a descent (and was being routinely set lower that required by the standard operating procedures without challenge). The report highlights the pilot got limited sleep (less than 6 hours) the night before and was possibly fatigued. The SI Panel highlighted that issues identified by a standards inspection 10 months earlier (such as under-manning, individual ‘overstretch’ from repeated tours and the quality of training supervision and delivery) were still evident. They also identified lower than expected occurrence reporting from the detachment compared to the rest of the Lynx AH9A fleet and other helicopters detached to Kandahar. A previous Service Inquiry on a loss of control incident involving a Royal Air Force Airbus A330 Voyager made a similar comment about the lack of reporting of lost articles in the RAF transport fleet. Procedural Drift /...
read morePerformance Based Regulation and Detecting the Pathogens
Performance Based Regulation (PBR) and Detecting the Pathogens At a time when Performance Based Regulation (PBR) is a hot topic in the aviation industry, a series of rail accidents in North America help demonstrate the type of poor performance that PBR must successfully detect. These accidents were what James Reason, Professor Emeritus, University of Manchester described as ‘organisational accidents’ in his classic 1997 book Managing the Risks of Organizational Accidents. Reason explained that: Organizational accidents have multiple causes involving many people operating at different levels of their respective companies. Such accidents result from ‘latent organisational failures’ that are, according to Reason, like pathogens that have infected the organisation. A key challenge for an organisation’s Safety Management System (SMS) is detect latent pathogens before they cause harm. PBR needs to give the regulator assurance that the organisation’s SMS is vigilant and effective at doing that. Metro-North, US As we recently discussed, the US National Transportation Safety Board (NTSB) published a special investigation report into the organisational factors that emerged after five accidents at Metro-North (discussed at a special hearing). Metro-North is the second largest commuter railroad, and one of the busiest, in the United States. Between May 2013 and March 2014 Metro-North had five significant accidents resulting in 6 fatalities, 126 injuries and more than $28 million in damages. In 2012 the Federal Rail Road Administration (FRA) issued a Notice of Proposed Rule Making (NPRM) that would require a ‘system safety program’, which the NTSB likens to an SMS in other industries. The NPRM states: Since most of these are procedures, processes, and programs railroads should already have in place, the railroads would most likely only have to identify and describe such procedures, processes, and programs to comply with the regulation. Similar statements have been made in other similar rule-making initiatives in other industries. They help defuse potential complaints about extra red-tape but do raise the question: ‘so is there a real benefit to the proposed regulation’? The prime benefit is of course ensuring that organisations that would not operate an effective SMS voluntarily, at least have to justify their SMS performance to an independent regulator. NTSB observe that: Metro-North has for many years had an SSPP [System Safety Program Plan] that presumably will fulfill the proposed regulatory requirement for such a program. However, while the NTSB investigations found Metro-North had a written SSPP, its implementation was very limited and represented little more than a paperwork exercise. Few Metro-North employees even knew the program existed. The identified deficiencies in the Metro-North SSPP implementation provide a cautionary example to FRA as it finalizes the proposed regulation. They also note that: A management systems approach will require cultural change at the [regulator] as well as in the industry. The US Federal Aviation Administration (FAA) is has introduced their own Part 5 Safety Management System (SMS) requirement Part 121 carriers (as we discussed in June 2015) so the NTSB have issued a timely reminder. We have however previously expressed concerns that the FAA’s fondest for fines may undermine that implementation. Lac-Megantic, Canada The Transportation Safety Board of Canada (TSB), in its final report on the crude oil train derailment and fire that killed 47 people on 6 July 2013 at Lac-Megantic, Quebec expressed concerns about how the regulator, Transport Canada (TC) dealt with SMS regulation (emphasis added): …the first SMS audit to assess the effectiveness of the company’s safety management processes took...
read moreSouthwest Unstabilised Approach Accident
Southwest Unstabilised Approach Accident An unstabilised approach and a late change of control were critical in an accident that resulted in a nose gear collapse at La Guardia say NTSB. The US National Transportation Safety Board (NTSB) has published their report (DCA13FA131) on a Southwest Airlines (SWA) Flight 34, a Boeing 737-700, N753SW, that had a nose gear collapse during a very hard landing (16 ft/s) on 22 July 2013 at LaGuardia Airport (LGA), New York. The aircraft was substantially damaged (and later scrapped) and 8 occupants were injured. On the approach they say: …on final approach, the captain, who was the pilot monitoring (PM), realized that the flaps were not configured as had been briefed, with a setting of 40 degrees for the landing. …the captain set the flaps to 40 degrees as the airplane was descending through about 500 ft altitude, which was about 51 seconds from touchdown. When the airplane was between 100 to 200 ft altitude, it was above the glideslope. Concerned that the airplane was too high, the captain exclaimed repeatedly “get down” to the first officer about 9 seconds from touchdown. About 3 seconds from touchdown when the airplane was about 27 ft altitude, the captain announced “I got it,”… the control column was relaxed to a neutral position and the throttles were not advanced until about 1 second before touchdown. The airplane touched down at a descent rate of 960 ft per minute and a nose-down pitch attitude of -3.1 degrees, resulting in the nose gear contacting the runway first and a hard landing. The airplane came to a stop on the right side of the runway centerline about 2,500 ft from its initial touchdown. The Captain, who it has been reported was fired by the airline after the accident, had joined the airline as a First Officer in 2000 (becoming a Captain in 2007) and had around 12,522 hours total flight time, including about 7,909 hours in 737s, of which about 2,659 hours were as Captain. The First Officer joined the airline at the start of 2012 from the USAF and had about 5,200 hours total flight time, including about 1,100 hours in 737s. The NTSB note that: The operator’s stabilized approach criteria require an immediate go-around if the airplane flaps or landing gear were not in the final landing configuration by 1,000 ft above the touchdown zone… Further, the airplane’s deviation about the glideslope at 100 to 200 ft would have been another opportunity for the captain, as the PM at this point during the flight, to call for a go-around… Accident data suggest that pilots often fail to perform a go-around or missed approach when stabilized approach criteria are not met. A review of NTSB-investigated accidents by human factors researchers found that about 75% of accidents were the result of plan continuation errors in which the crew continued an approach despite cues that suggested it should not be continued. Additionally, line operations safety audit data presented at the International Air Safety Summit in 2011 suggested that 97% of unstabilized approaches were continued to landing even though doing so was in violation of companies’ standard operating procedures (SOPs). The Southwest FOM also states that the captain can take control of the airplane for safety reasons; however, the captain’s decision to take control of the airplane at 27 ft above the ground did not allow her...
read moreWhat the HEC?! – Human External Cargo
What the HEC?! – Human External Cargo Winching (or hoisting), used for Search & Rescue (SAR) or for personnel transfer to and from otherwise difficult to access locations, is the most widely known form of what is known as Human External Cargo. Some operators however transfer personnel by harnesses on long-lines. Here Southern California Edison (SCE), a subsidiary of Edison International, a public utility based in Rosemead, California, use a twin engine Airbus Helicopters EC135 (H135) to transfer power transmission linesman to pylons in remote locations. https://www.youtube.com/watch?v=Wm4vPZvHS68&feature=player_embedded The company say that: … linemen recently attached GoPro cameras to their helmets and took flight to replace aging insulators on a transmission line near Corona, California. The towers traverse the Santa Ana Mountains and help carry electricity from Menifee to Anaheim. Before taking flight, the entire crew and helicopter pilots met for a tailboard, or safety discussion, to go over specifics of the day’s work. They discuss potential hazards, the weather forecast and the nearest hospital in case of an emergency. After the tailboard, each crew member checks their own harness to make sure it’s ready for flight. They then do a buddy check on another lineman to be extra safe. Eight linemen were assigned to the job and paired up for the two-minute flight. The crew was flown up to the tower, followed by their equipment and new insulators. SCE took delivery of the EC135 in 2008 and has a fleet of six helicopters of various types based at the utility’s Chino Airport location. An article published in 2012 describes the history of the HEC operation, the equipment and training. They have recently added their first medium helicopter, a Bell 205 for under slung cargo work. The company also construct pylons with chartered helicopters using under slung load techniques similar to ones Aerossurance has discussed recently. They also contract for wire slinging operations. Also see our articles: Keep Your Eyes on the Hook! Underslung External Load Safety, Helicopter Underslung Load: TV Transmitter and French Skyscraper: Helicopter Underslung Load UPDATE 9 December 2015: Aerossurance’s friends in South Africa have shared with us this video, which we suspect is from the 1990s, of power line work for ESKOM in SA. UPDATE 5 February 2017: Our new article Fatal Low Altitude Hover Power Loss: Power Line Maintenance Project looks at how an engine compressor failure while installing power line markers resulted in an unsurvivable impact and fire. See our article The Tender Trap on procuring aviation services UPDATE 22 March 2017: RTE-STH, the helicopter division of French public utility company RTE, has commissioned Airbus Helicopters’ UK to deliver a power line maintenance customisation kit for its H135s. The EASA-certified kit, comprising aircraft modifications and the development of seven baskets and bespoke attachment devices, will allow RTE engineers direct access to carry out essential maintenance work on live power line cables. Initial flight testing is now under way and delivery is expected in 2018. UPDATE 27 December 2019: Fatal Powerline Human External Cargo Flight Aerossurance has extensive helicopter operations, safety, regulation and contracting experience. For practical aviation advice you can trust, contact us at: enquiries@aerossurance.com Follow us on LinkedIn and on Twitter @Aerossurance for our latest...
read moreCrashworthiness and a Fiery Frisco US HEMS Accident
Crashworthiness and a Fiery Frisco US HEMS Accident (Airbus Helicopters AS350B3e, N390LG of Air Methods) Shortly after take-off from a hospital in Frisco, Colorado, on 2 July 2015, Airbus Helicopters AS350B3e helicopter, N390LG, operated by Air Methods as ‘Flight for Life’, crashed in a parking lot 120m away. This was a daytime, Visual Meteorological Condition (VMC), Part 135 flight. The US National Transportation Safety Board (NTSB) preliminary report stated: Multiple witnesses observed the helicopter lift off from the ground-based helipad, rotate counterclockwise, and climb simultaneously. One witness estimated that the helicopter reached an altitude of 100 feet before it started to descend. The helicopter continued to spin counterclockwise several times before it impacted a parking lot and an RV to the southwest of the Flight for Life hangar and helipad. The helicopter came to rest on its right side, was damaged by impact forces, and was charred, melted, and partially consumed by fire. UPDATE: Ultimately the NTSB Final Report was issued 27 March 2017. Below are a sequence of screen shots from security CCTV video shown by 9News who in an excellent piece of journalism have devoted much research to this topic: A small fire starts, but fuel pours out an soon ignites. 28 seconds after impact one of the medical personnel is seen to kick out a door and jumps clear, on fire and suffering from 90% burns. He is still in hospital after over 30 operations. Amazingly, the other manages to egress without significant injury. A member of staff bravely approaches the helicopter with a hand held extinguisher. Shortly after the pilot egresses the wreckage. He died later in hospital. The fire was brought under control by local fire departments. The aircraft was positioning for display at a Boy Scouts of America event. This was Air Methods’ second fatal air accident with a post crash fire in 4 months. That accident also involved a positioning flight. Air Methods, a large player in the HEMS business founded in 1980, has had 7 air accidents in the last 5 years according to the Aviation Safety Network (looking at their HEMS business only). Five were fatal accidents with 12 fatalities. Crash Resistant Fuel Systems Although this particular As350 was only about a year old, as a type the AS350 was certified prior to enhance certification requirements for a crash resistant fuel system (CRFS) introduced in 1994. When those were introduced, the Federal Aviation Administration (FAA) stated: A post-crash fire (PCF) is the number one cause of fatalities and injuries in an otherwise survivable impact resulting from a rotorcraft accident. It is estimated that annually 5 percent of the occupants in survivable rotorcraft accidents are killed or injured by a PCF. These types of fatalities and traumatic injuries would be substantially reduced by adopting the design and test criteria proposed in this notice. Nearly all PCF’s are caused by crash-induced fuel leaks that quickly come in contact with ignition sources during or after impact. Current FAA rotorcraft airworthiness standards do not comprehensively address minimizing fuel leaks and potential fuel ignition sources in order to maximize occupant escape time in a survivable crash. The fuel containment and hazard elimination provisions contained in these proposals would, in the majority of cases, give occupants the time necessary to escape a survivable crash before a PCF could become critical. A crash resistant fuel system, CRFS, would...
read moreMetro-North: Organisational Accidents and Shelfware
Metro-North: Organisational Accidents and Shelfware An NTSB study into five accidents on US railway (‘railroad’) Metro-North gives a unique perspective on organisational accidents. Metro-North was described as having an “invisible safety department”, that kept its SMS on the shelf until external audits and assumed on-time performance would give them safe operations. Organisational Accidents James Reason, Professor Emeritus, University of Manchester popularised the expression ‘organisational accident’ in his 1997 book Managing the Risks of Organizational Accidents. He used the term to differentiate simple ‘individual accidents’ involving just one person to complex accidents involving more people, organisations, technology and systems. Reason explained that: Organizational accidents have multiple causes involving many people operating at different levels of their respective companies. Such accidents result from ‘latent organisational failures’ that are like pathogens that have infected the organisation. In the earlier, 1995 book, Beyond Aviation Human Factors, Maurino, Reason, et al give examples: Lack of top-level management safety commitment or focus Conflicts between production and safety goals Poor planning, communications, monitoring, control or supervision Organizational deficiencies leading to blurred safety and administrative responsibilities Deficiencies in training Poor maintenance management or control Monitoring failures by regulatory or safety agencies This case study covers a host of these pathogens. We have also written previously on: James Reason’s 12 Principles of Error Management The Metro-North Accidents Metro-North is the second largest commuter railroad, and one of the busiest, in the United States. Between May 2013 and March 2014 Metro-North had five significant accidents resulting in 6 fatalities, 126 injuries and more than $28 million in damages. In November 2014 the US National Transportation Safety Board (NTSB) published a special investigation report into the organisational factors that emerged (discussed at a special hearing). This series of accidents is also covered in an excellent DisasterCast podcast by Drew Rae. Metro-North Safety Management Although not a regulatory requirement, the New York State Public Transportation Safety Board (PTSB), who conduct ‘safety oversight’ of organisations who receive State transportation grants, requires rail operators to maintain a and update it every 2 years. The American Public Transportation Association (APTA) have issued a manual on the creation of SSPPs. An SSPP is expected from participants in APTA’s voluntary safety management audit program. The NTSB report describes the SSPP as analogous to an SMS Manual in other industries. The Metro-North SSPP stated that it was created to: …coordinate a safety system for prevention, identification and management of hazards in an effort to minimize safety risks to both customers and employees. The SSPP also includes the statement that: Metro-North’s commitment to the SSPP will permeate every aspect of railroad operations. It is concerning that the commitment is to the plan, rather than to safety (i.e. to the means rather than to the ends). However, far worse the NTSB say: NTSB investigators found little evidence that Metro-North systematically followed…procedures as described in the SSPP. Moreover, the NTSB investigators found no evidence that Metro-North actually used the SSPP as part of is operational guidance. Aside from senior management personnel, most of the Metro-North employees interviewed by NTSB investigators stated that they had never heard of or seen copies of the SSPP. Even the organisation’s Chief Safety Officer candidly admitted: I don’t think it’s effective at all. …my whole 28 years here it was something that we reviewed when APTA and the FRA [the federal regulator the Federal Railroad Administration] came in to do their triennial...
read moreInadequately Secured Cargo Caused B747F Crash at Bagram, Afghanistan
Inadequately Secured Cargo Caused B747F Crash at Bagram, Afghanistan The US National Transportation Safety Board (NTSB) has determined that a National Airlines Boeing 747 Freighter N949CA that crashed on take-off on 29 April 2013 did so because the five armoured military vehicles (2x12t and 3x18t) on-board were inadequately restrained. As the NTSB explain: These vehicles were considered a special cargo load because they could not be placed in unit load devices (ULDs) and restrained…using the…main deck cargo handling system. Instead, the vehicles were secured to centerline-loaded floating pallets and restrained to the airplane’s main deck using tie-down straps. The rearmost vehicle moved rearward into the rear pressure bulkhead, crippling two hydraulic systems and damaging horizontal stabilizer components. This rendered the airplane uncontrollable. All seven crewmembers were killed in the accident on 29 April 2013 at Bagram, Kabul, Afghanistan. The aircraft was on charter to the US Air Mobility Command. As they describe in their press release, NTSB Finds Damage From Inadequately Secured Cargo Caused Boeing 747 Crash in Bagram, Afghanistan: Contributing to the accident was the Federal Aviation Administration’s inadequate oversight of National Airlines’ (NAL’s) handling of special cargo loads, such as that being carried on the accident flight. The Boeing 747-400 freighter was carrying five mine-resistant ambush-protected (MRAP) vehicles. There was no evidence found to suggest that the airplane was brought down by an explosive device or hostile acts. The investigation found that National Airlines’ cargo operations manual not only omitted critical information from Boeing and from the cargo handling system manufacturer about properly securing cargo, but it also contained incorrect restraining methods for special cargo loads. The Board recommended that the FAA create a certification process for personnel responsible for the loading, restraint, and documentation of special cargo loads on transport-category airplanes. Other recommendations call on the FAA to improve its ability to inspect cargo aircraft operations, specifically those involving special cargo loads. Three points that we thought noticeable during the Board Meeting and the staff presentations were: Boeing’s analysis was that loading of only one vehicle was permissible (and then one of the smaller vehicles) because of the space needed to fit longitudinal securing straps (see illustration below), and they would have used 60 straps not the 24 used by National. The loadmaster had been on duty for 21 hours at the time of the accident. The load had been found to have shifted during the short flight from Camp Bastion in Helmand province to Kabul for fuel. However, apart from retightening and adding just two more straps, it appears little was done before the next sector. To view the findings, and recommendations, click on the following link: http://go.usa.gov/3fHTS or by looking in the public docket. The National Transportation Safety Board determines that the probable cause of this accident was National Airlines’ inadequate procedures for restraining special cargo loads, which resulted in the loadmaster’s improper restraint of the cargo, which moved aft and damaged hydraulic systems Nos. 1 and 2 and horizontal stabilizer drive mechanism components, rendering the airplane uncontrollable. Contributing to the accident was the Federal Aviation Administration’s inadequate oversight of National Airlines’ handling of special cargo loads. The NTSB have now made the presentations and opening / closing remarks available: Opening Statement – Chairman Christopher A. Hart Opening Statement– Investigator in Charge Aircraft Structures Operational Issues Closing Statement – Chairman Christopher A. Hart UPDATE 22 July...
read more
Recent Comments