James Reason’s 12 Principles of Error Management
James Reason’s 12 Principles of Error Management James Reason, Professor Emeritus, University of Manchester, set out 12 systemic human factors centric principles of error management in his book Managing Maintenance Error: A Practical Guide (co-written with Alan Hobbs and published in 2003). These principles are valid beyond aviation maintenance and are well worth re-visiting: Human error is both universal & inevitable: Human error is not a moral issue. Human fallibility can be moderated but it can never be eliminated. Errors are not intrinsically bad: Success and failure spring from the same psychological roots. Without them we could neither learn nor acquire the skills that are essential to safe and efficient work. You cannot change the human condition, but you can change the conditions in which humans work: Situations vary enormously in their capacity for provoking unwanted actions. Identifying these error traps and recognising their characteristics are essential preliminaries to effective error management. The best people can make the worst mistakes: No one is immune! The best people often occupy the most responsible positions so that their errors can have the greatest impact… People cannot easily avoid those actions they did not intend to commit: Blaming people for their errors is emotionally satisfying but remedially useless. We should not, however, confuse blame with accountability. Everyone ought to be accountable for his or her errors [and] acknowledge the errors and strive to be mindful to avoid recurrence. Errors are consequences not causes: …errors have a history. Discovering an error is the beginning of a search for causes, not the end. Only be understanding the circumstances…can we hope to limit the chances of their recurrence. Many errors fall into recurrent patterns: Targeting those recurrent error types is the most effective way of deploying limited Error Management resources. Safety significant errors can occur at all levels of the system: Making errors is not the monopoly of those who get their hands dirty. …the higher up an organisation an individual is, the more dangerous are his or her errors. Error management techniques need to be applied across the whole system. Error management is about managing the manageable: Situations and even systems are manageable if we are mindful. Human nature – in the broadest sense – is not. Most of the enduring solutions…involve technical, procedural and organisational measures rather than purely psychological ones. Error management is about making good people excellent: Excellent performers routinely prepare themselves for potentially challenging activities by mentally rehearsing their responses to a variety of imagined situations. Improving the skills of error detection is at least as important as making people aware of how errors arise in the first place. There is no one best way: Different types of human factors problem occur at different levels of the organisation and require different management techniques. Different organisational cultures require different ‘mixing and matching’….of techniques. People are more likely to buy-in to home grown measures… Effective error management aims as continuous reform not local fixes: There is always a strong temptation to focus upon the last few errors …but trying to prevent individual errors is like swatting mosquitoes…the only way to solve the mosquito problem is drain the swamps in which they breed. Reform of the system as a whole must be a continuous process whose aim is to contain whole groups of errors rather than single blunders. Error management...
read morePsychology of Responsibility
Psychology of Responsibility Aerossurance recently discussed research cited in Yes! 50 secrets from the Science of Persuasion, written by Goldstein, Martin and Cialdini, on whether organisations are considered more or less responsible for incidents depending on whether the cause was technical or human failure. In the same book they also discuss research on the reaction to how adverse events are described by organisations. Fiona Lee, Christopher Peterson, and Larissa Tiedens’ 2004 paper Mea Culpa: Predicting Stock Prices from Organizational Attrubutions, first gave research subjects one of two versions of an annual report for a fictitious company. In Version A the management took responsibility for being unprepared for deteriorating market conditions. In Version B, the company blamed legislative changes outside their control for the poor performance. The researchers found that participants who saw the Version A, viewed the company more positively than those who saw the version that blamed outside factors. Aerossurance recently highlighted that blaming suppliers or others is a flawed form of crisis management (e.g. Firestone and Ford or BP and Transocean), partly because you pick your suppliers, they work to meet your requirements and you are expected to monitor their performance. The researchers went on to study annual reports from 14 companies during a 21-year period. They found that companies that attributed poor performance to internal factors (i.e. admitted they could have done better) had higher stock prices a year later than companies who attributed the performance to external factors. Lee and her colleagues argue that taking responsibility for negative events made the organisations appear more in control, leading to more positive impressions. Perhaps it also means internally that taking responsibility also gives ‘permission’ for lessons to be learnt and improvements to be made. UPDATE 21 July 2015: The BBC published an article that discusses the value of saying sorry and come cases were that took some time. To discuss how the issues raised here are relevant to your business, contact: enquiries@aerossurance.com Follow us on LinkedIn for our latest updates and on Twitter...
read moreOperational Suitability Data
Operational Suitability Data The European Aviation Safety Agency (EASA) has published a useful summary on the concept of OSD: The principle of Operational Suitability Data (OSD) is that the aircraft manufacturers are required to establish certain data that is considered important for safe operation of the aircraft type. This data will be approved by the Agency under the type certificate and is then used by operators and training organisations. The data consists of 5 elements: 1- the master minimum equipment list (MMEL); 2- data for training of pilots; 3- data for cabin crew; 4- data for training of maintenance crew; and 5- data for qualification of simulators. The OSD concept is not entirely new; it succeeds the Operational Evaluation Board (OEB) that already existed in the Joint Aviation Authorities (JAA). The OEB was applied on a voluntary basis and resulted in recommendations to the national Aviation Authorities for the approval of pilot type rating training courses and minimum equipment lists (MEL). The novelty with OSD is that it is mandatory for the aircraft designers, ensuring that the data is available to the operators when needed. The OSD is the reference point for the customised training courses and MEL as developed by operators and training organisations. The OSD is expected to contribute to closing the gap between airworthiness and operations. This will be the case not only for new types, but also for changed designs. OSD will also be subject to continuous improvements. Furthermore it will set a level playing field in the EU for type training and MEL. The rule package necessary to implement OSD was developed in a long and heavy rulemaking process that started already in 2007. It includes amendments to several implementing rules and a series of new Certification Specifications (CS). The amendments to Part-21 and the OPS and Licensing implementing rules were published by the European Commission on 27 January 2014. The CSs for Flight Crew Data, Cabin Crew Data and MMEL as well as new guidance material to Part-21 were published shortly after that. The CS for simulator data will be published within the next weeks and the CS for maintenance certifying staff data is still under development. Transition from the OEB to OSD is taking place in several steps. As a starting point all existing OEB reports were grandfathered. For the remaining types that are still in production a catch up is needed before end of 2015. The relevant Design Organisation Approvals have to be updated to include OSD also before end of 2015. Operators and training organisations will have to implement OSD in their training and they have two years after the OSD becomes available from the aircraft designer. The OSD is a proportionate rule. It mainly applies to large aircraft and where it affects small aircraft the Agency has developed detailed guidance to facilitate compliance. For advice on OSD and how it affects your business, contact us at enquiries@aerossurance.com Follow us on LinkedIn for our latest...
read moreUK OHSAG Oct 2014 Minutes
UK Offshore Helicopter Safety Action Group (OHSAG) Oct 2014 Minutes The UK Civil Aviation Authority (CAA) has published the minutes of the latest, 28 Oct 2014, meeting of the Offshore Helicopter Safety Action Group (OHSAG). The OHSAG was formed as a result of the ‘Civil Aviation Authority Safety Review of Offshore Public Transport Helicopter Operations in Support of the Exploitation of Oil and Gas’ (CAP1145). Items to note: The Irish Aviation Authority are said to have signed up to the CAP1145 actions and are to be invited to the next meeting. The IAA have recently issued an Aeronautical Notice on offshore helicopter safety. UK CAA are to ‘investigate further operations of foreign operators in the UK who may not comply with CAP1145’. A review of progress on CAP1145 implementation is due in January 2015. The ‘Challenge Team’ that was part of the original review reconvened last month (though sharp eyed readers will note that one of the original team now works for UK CAA). That team has requested more detail and for the progress review to be more forward looking. The OHSAG asked for emphasis on ‘stabilising’ survivability matters and putting an emphasis on actions that minimise such survivability circumstances (a point made by some at this year’s Oil and Gas UK Aviation Seminar). Studies are underway on the issue of smaller helidecks and (using Cranfield University) on fire fighting on Normally Unattended Installations (NUIs). Further work is to be done on communication (confidence building was the key theme of this years Oil & Gas UK Aviation Seminar) The next meeting is January 2015. Aerossurance covered the issue of the previous minutes (with links to all prior meeting minutes) and a recent Oil & Gas UK briefing session here (which now includes video of the CAA presentation and panel sessions). Aerossurance is an Aberdeen based aviation consultancy. For expert advice on offshore helicopter safety and contracting matters, contact us at enquiries@aerossurance.com Follow us on LinkedIn for our latest updates. ...
read moreAccident Report: Fatal Police Helicopter Double Engine Flameout Over City Centre
Accident Report: Fatal Police Helicopter Double Engine Flameout Over City Centre (A109K2 JA11PC) While returning from a routine patrol over a crowded city both engines flamed out on a police helicopter. Due to the helicopter’s low altitude and the congested environment the aircraft crashed into buildings with multiple fatalities. We examine at the accident investigator’s final report and highlight the value of studying accidents internationally. The Helicopter Accident You might have assumed was the tragic accident in Glasgow, UK, 29 November 2013 (UPDATE 23 October 2015: discussed here). In fact it was an AgustaWestland A109K2 JA11PC of the Shizuoka Prefectural Police in Shizuoka City on 3 May 2005. During a routine traffic congestion patrol at around 16:28 Local Time on a National Holiday (Constitution Memorial Day), the helicopter, call sign ‘Fuji 1’, crashed into a residential area in Kusanagi, Shimizu-ku, Shizuoka City. The aircraft was destroyed and a post-crash fire broke out. All five police officers on board were fatally injured. The Japanese Aircraft and Railway Accidents Investigation Commission (ARAIC) issued their final report 28 March 2007. Note that on 1 October 2008, ARAIC merged with the Japan Marine Accident Inquiry Agency (JMAIA) to form the Japan Transport Safety Board (JTSB). History of the Flight A routine afternoon road congestion survey flight was to be conducted using the ‘Fuji 2’, Eurocopter AS365N3 JA22PC, by the local Prefecture’s police aviation unit (one of many across Japan), which the investigators refer to as ‘the flying squad’. The flight had been planned to cover the eastern area of the prefecture, but when the team of observers from the Traffic Regulation Division arrived, 40 minutes before the planned take-off, they asked to include a congestion survey on the Tomei Expressway in the west of the prefecture too and the Pilot In Command (PIC) agreed. Following a technical fault shortly after take-off at 14:00, Fuji 2 returned to base and five of the seven people on-board transferred to the slightly smaller Fuji 1, an AgustaWestland A109K2. The flight was expected to last 2 hours and the pilot filed a flight plan that estimated 2 hours 20 minutes of fuel on-board. The change to the smaller aircraft resulted in one other significant change, namely the PIC choose to leave the co-pilot behind. The replacement aircraft took off from Shizuhama Aerodrome at 14:42. Investigators concluded the aircraft took off 58kg over maximum gross weight, perhaps symptomatic of the rushed change in plans. After taking off the aircraft flew an approximately 195nm route with a ground speed of about 110kt. The early aerial photos recovered were taken from a 1,000 – 1,500ft above ground level, but those photos taken later were from 1,000ft or below. The last photo was taken at 16:23:26, approximately five minutes before the crash. At 16:25 the PIC made a radio call “Over Shimizu. Landing soon.” It was usual to make a call to warn ground crew of their arrival and there was no indication of any abnormality. In these final few minutes, witnesses remarked on the aircraft’s particularly low altitude. The accident investigators report that: a. At the point approximately 500m away from the crash site, flying altitude was approximately 300ft. b. In the area mentioned in a. above, sound of the aircraft changed and went silent. c. At the point approximately 150m away from the crash site, something fell away from the aircraft. d. In the area mentioned in c. above, the aircraft was silent with the MR blades almost stationary....
read moreGlobal 6000 Crosswind Landing Accident – UK AAIB Report
Global 6000 Crosswind Landing Accident – UK AAIB Report (TAG Aviation, EC-LTF) The UK Air Accidents Investigation Branch (AAIB) have recently issued a 15 page report on a accident involving Bombardier Global 6000 EC-LTF of TAG Aviation España during a night crosswind landing. During the landing at Prestwick Airport on 6 March 2014, the right wing touched the runway. The aircraft landed without injury to anyone on-board. Prior to glideslope capture for Runway 12 at Prestwick the wind calculated by the onboard systems was 90º from the right at 35 kt. When cleared to land, the aircraft was notified by ATC that the wind was from 190º at 12 kt, a crosswind component of approximately 11 kt. Passing 1,000 ft agl, the indicated crosswind had reduced to 25 kt and the pilots then had visual contact with the runway. The AAIB comment in the summary of their report: The technique employed during the landing was different from that recommended in training material published by the manufacturer. Furthermore, the information in the training material about crosswind landings, and data on reduced wingtip clearance with increasing pitch attitude, had not been incorporated into the Airplane Flight Manual (AFM) or the Flight Crew Operating Manual (FCOM). The pilot flying (PF) was looking through a Head-Up Display (HUD) and his view of the runway may have been impeded because the symbols on the HUD screen were set too bright. On 17 April 2014 a similar event occurred to Global 6000 CS-GLB from another operator during a night crosswind landing at Luton Airport, resulting in left hand wing tip damage. That approach was made with a modest crosswind component from the right of about 9 kt and the aircraft was configured at flap 30 and flown at a target speed of VREF (112 kt). The AAIB report that following these two accidents several actions were taken. In particular Bombardier amended the Global 6000 FCOM to include their recommended crosswind technique (the wings level crab technique, where the aircraft is pointed into the wind to control direction) aligning with the Global Express and Global 500o FCOMs that already contained that material. Further Detail – HUD In relation to the HUD, Bombardier’s senior engineering test pilot commented, according to AAIB, that: …pilots who were new to HUDs must learn not to fixate on the screen but to “look through” it, otherwise their peripheral view of the outside world could be affected. He said that during this learning process, pilots must find the level of screen brightness with which they were most comfortable and it could take them a few landings to establish this. In his experience, new pilots initially tended to set the brightness level too high and this could cause the HUD symbology to become distracting. Consequently, during a landing with a significant crosswind, for example, a pilot who has set the brightness too high, may fixate on the screen and not discern all the relevant external cues. To reduce fixation on the screen, pilots should aim to use a HUD all the time when available. Further Detail – FDM EC-LTF was one of 30 aircraft monitored by the operator’s Flight Data Monitoring programme. Downloads were nominally monthly and a base-specific report was produced that included an aggregate of the 20 most frequently triggered events for both the month and previous year, plus the...
read morePsychology of Blame
Psychology of Blame In their 2007 book Yes! 50 secrets from the Science of Persuasion, the authors Goldstein, Martin and Cialdini, discuss 2004 research by social scientists Charles Naquin and Terri Kurtzberg. Naquin and Kurtzberg tested the reaction when technical failures and human error were separately identified as the cause of an incident. The Research In one case they showed research subjects a fake newspaper article (based on a real incident). It reported on a train collision that injured scores of people. Some participants were told a technical failure was the cause and others a driver error. They repeated this approach during a real internet outage at their university. This time they used questionnaires about the university IT department that either stated the failure was believed to be due to a computer fault or a human error. In each case, the organisation involved (the train operator and the IT department) were considered more responsible if human error was thought to be the cause. The researchers suggest that the perception of a human error provokes more thoughts of how a failure could be / should have been avoided than for technical fault, and so the failure seems worse. Discussion In one sense this is bad news for contentious safety professionals. It suggests that human nature means we are more aggrieved and less forgiving when a human makes an error than when a technical failure occurs. However, technical failures are mostly linked to the specification, design or maintenance of the system and the associated human decisions and actions. So it also reinforces the perception that it is easier to blame frontline operators rather than the managers or designers. Their interpretation also suggests it is difficult to expect society to accept the concept of a just culture after a major accident. It may help explain, for example, the extreme charges and rapid trial in South Korea after the Sewol ferry disaster. However, one positive could be that it shows that swift public blaming of your own employees (as occurred after Costa Concordia or in a recent Spanish rail disaster) can only make things worse for the organisation (and not just because of the harm to your own safety culture). A reason to avoid reliance on so called ‘just culpability tools’ and internal processes focused in judging frontline personnel rather than generating insight on necessary safety improvements. Safety Resources You may also find these Aerossurance articles of interest: How To Develop Your Organisation’s Safety Culture James Reason’s 12 Principles of Error Management What Lies Beneath: The Scope of Safety Investigations Airworthiness Matters: Next Generation Maintenance Human Factors Aircraft Maintenance: Going for Gold? B1900D Emergency Landing: Maintenance Standards & Practices Meeting Your Waterloo: Competence Assessment and Remembering the Lessons of Past Accidents Also: Safety Performance Listening and Learning – AEROSPACE March 2017 Learning from Adverse Events: Includes nine principles for incorporating human factors into learning investigations. Aerossurance has extensive air safety, operations, SAR, airworthiness, human factors, aviation regulation and safety analysis experience. For practical aviation advice you can trust, contact us at: enquiries@aerossurance.com Follow us on LinkedIn for our latest...
read moreDisasters and Crises – 10 Lessons on Early Warning
Disasters and Crises – 10 Lessons on Early Warning Aerossurance has recently looked at how conventional responses can fail in the face of a crisis. Dr Ian Mitroff, Professor Emeritus at the USC Marshall School of Business at the University of Southern California, has identified 10 lessons on early warning, which are also highly relevant to how accidents evolve: All disasters and crises are preceded by early warning signs of impeding failure: Barry Turner’s ground breaking research Man Made Disasters, published in 1978, highlights the prevalence of such warnings and how they are often overlooked during the ‘incubation period’. UPDATE 16 January 2017: see this review of Man Made Disasters. Signals are not self-amplifying or self-blocking: Mitroff observes that it is organisations that can either amplify or block these early warning signs, the very reason for a culture that seeks out potential early warning signs. Margaret Heffernan has written about Wilful Blindness, and how organisations can block out these warnings, which Mitroff comes to in his third lesson: Signals are part of the organisation: Signals don’t exist on their own. Organisations get the news they encourage. An organisation that discourages or downplays certain types news will discourage that news from being reported in future. Signal detection is a reflection of our priorities: Organisations are swamped with information, so unless we give priority to the warning signs for crises or accidents, they are unlikely to be noticed. In turn, if we only search for certain types of crises or for certain threats we may well miss the signs for other types. Signal detection needs detectors: It is important to have mechanisms that detect early warning signals. Within an organisation, free and open safety reporting, a vigorous audit programme that looks at the effectiveness of controls not just compliance and a robust, even paranoid, process of management review that seeks out indications of problems (and sees early warning as ‘good news’ not ‘bad news’) can all help. Different signals require different detectors: So while the mechanisms mentioned above are relevant to safety threats, other mechanisms are required to detect the early warning signs of financial fraud, civil disturbances or industrial unrest. Not all signals are alike: Mitroff proposes that signals are differentiated by their source (internal or external to the organisation) and type (technical or human). Signal detectors need to be monitored: Mitroff uses the example of a 1991 power outage in New York. The AT&T back-up generator failed and the tertiary battery system came into operation. Activating the 6 hour battery system triggered an alarm, but the alarm was not spotted and when the battery expired air traffic controllers lost essential communications. The reason the alarm was not heard: both operators on the same shift had been rostered onto a training course. Ironically the course was on alarm systems! Signals have to be transmitted to the right people: As sadly illustrated in Hawaii in 1941. Individual signal detection is not enough: Often multiple weak signals from multiple sources need to be collated an analysed. See also: How to Lead During a Crisis: Lessons From the Rescue of the Chilean Miners Aerossurance has extensive safety management, emergency response, safety leadership, organisational culture, operations, and safety analysis experience. For practical safety advice you can trust, contact us at: enquiries@aerossurance.com Follow us on LinkedIn and on Twitter @Aerossurance for our latest...
read moreBAe 146 & Avro RJ85 Fire Bombers
BAe 146 & Avro RJ85 Fire Bombers Fire bombing, as show in this video of training, was unlikely to have been something envisaged in the early 1970s as the then HS146, was on the drawing board. Neptune Aviation Services, whose name neatly indicates their initial operation of ex-US Navy Lockheed P-2 Neptunes, is one of four companies in North America that have selected the BAe 146/Avro RJ for conversion. BAE, who are providing design support, described the four companies as follows in 2013: Conair Group Inc of Abbotsford, British Columbia, Canada, the largest air tanker operator in the world with a fleet of around 50 fixed-wing special mission aircraft, including Convair 580 Conair Firecats, Douglas DC-6 and Lockheed Electra Airtankers. Operating for over 40 years, Conair has selected the Avro RJ85 for its conversion programme and a number of aircraft have been delivered so far from regional aircraft lessor, Falko Regional Aircraft. Tronos Plc/Neptune Aviation Services – Tronos Plc, a UK-based BAe 146 aircraft lessor with a MRO facility in Prince Edward Island, Canada, has developed a BAe 146 Airtanker and the first two have been delivered to Neptune Aviation Services of Missoula, Montana, with a further two under conversion in Canada. Apart from the BAe 146 Airtankers Neptune operates a fleet of eight Neptunes in this role. Minden Air of Minden, Nevada which has recently completed the conversion of its first BAe 146 Fireliner and which is now undergoing extensive flight testing. A second aircraft is under conversion and eventually these aircraft will replace the venerable Neptunes currently in service with Minden Air. Air Spray who operate from Red Deer Regional Airport, Alberta, Canada and Chico Airport, California, has been flying as an airtanker operator for over 45 years and currently has a fleet 35 aircraft including Lockheed L188 Electras, AT802s and the largest fleet of Twin Commander 690 aircraft in the world. It has two BAe 146-200 that will be available for the 2015 fire season. They are 3,000 gallon US Forest Service Type 1 Airtankers, which forms the bulk of the fire-fighting fleet in North America. Mark Taylor, Business Director Engineering for BAE Systems Regional Aircraft commented: We estimate that the extreme nature of this wildfire flying means that for every BAe 146/Avro RJ flight cycle on a typical mission, the impact for structural and fatigue life is estimated to be the equivalent of between four and seven flight cycles of normal flight. This figure will be validated during the initial years of operation and might vary due to the nature of the Airtanker design. This type of specialist service is one which we can provide to these operators and the authorities are pleased that we, as the Original Equipment Manufacturer, are taking such a close interest in these programmes. The specialist design and engineering services provided by BAE Systems Regional Aircraft to these operators/conversions in support of their individual tanker designs include aerodynamic/computational fluid dynamics analysis; dynamic loads assessment; structural analysis; technical data packs; flight test planning and analysis; and flight test engineers and pilots. UPDATE 28 December 2014 In December 2013 Aero Flite’s Avro RJ85 Tanker 160 undertook a retardant drop demonstration at Fox Field, California. Typically 20 to 25 drops are conducted over a two or three day period. The process involves dropping retardant over a test grid of thousands of cups, to measure the dispersion pattern. Further Reading...
read moreEU Offshore Safety Directive – Oil & Gas UK Briefing
EU Offshore Safety Directive – Oil & Gas UK Briefing The consultation period on the Department of Energy & Climate Change (DECC) / Health and Safety Executive (HSE) consultation document on draft UK regulations to implement the new EU Offshore Safety Directive has ended. Trade body Oil & Gas UK say: These changes are some of the most significant for safety and environmental regulation for many years. While there is much in the new regulatory framework that is familiar, there are also a number of important amendments. Oil & Gas UK held an evening briefing on the topic in London on October 21 which included presentations from: Sam Boileau, Partner Environment & Safety at Dentons: The Legal Perspective Liz Hoskin, HSE Regulatory Liaison at Shell UK Limited: An Operator’s Perspective There is more on the timeline on the HSE website. The papers from a February 2014 Oil & Gas UK seminar can be found here. For advice on aviation safety & contracting for the oil and gas industry, contact: enquiries@aerossurance.com Follow us on LinkedIn for our latest...
read more
Recent Comments