Question

Introduction:

Explain the major concepts that underpin accident theory and Expose why models are used to learn about complex phenomena, such as aviation accidents. (500 words)

Main body (1000 words)

• Discuss the SHELL Model of accident causation and its implications.
• Explain the five causal factors in examining the nature of accidents: man, machine, medium, mission, and management.

Conclusion (300 words)

Answer 1

Answer 1 The investigation and modelling of aviation accident causation is dominated by linear models. Aviation is, however, a complex system and as such suffers from being artificially manipulated into non-complex models and methods. This book addresses this issue by developing a new approach to investigating aviation accident causation through information networks. These networks centralise communication and the flow of information as key indicators of a system's health and risk. This holistic approach focuses on the system environment, the activity that takes place within it, the strategies used to conduct this activity, the way in which the constituent parts of the system (both human and non-human) interact and the behaviour required. Each stage of this book identifies and expands upon the potential of the information network approach, maintaining firm focus on the overall health of a system. The book's new model offers many potential developments and some key areas are studied in this research. Through the centralisation of barriers and information nodes the method can be applied to almost any situation. The application of Bayesian mathematics to historical data populations provides scope for studying error migration and barrier manipulation. The book also provides application of these predictions to a flight simulator study for the purposes of validation. Beyond this it also discusses the applicability of the approach to industry.

Answer 2 Aviation is a relatively young industry – considering it is only in its second century of life. The evolution of safety went through some stages which reflect this gradual maturity of the mentality inside the industry. As aircraft are complex machines and are considered technological marvels, the first idea of solving an accident was to find the technical factor. The Technical Era as it is referred to focus solely on the equipment failure. But as the technology progressed and the aircraft became more advanced and reliable the focus shifted towards the human factor. The Human Factors Era brought upfront the concept of Crew Resource Management (CRM) and focused on the individual, still isolating the person from the organisation. Deeper research and analysis of findings led to the classification of the organisation factors – which includes the organisational culture and the operational context of a complex environment. The Organisational Era views safety in a systemic perspective and the proactive trend of data gathering prior the investigation of an accident formulated the rational of the safety management system. Below flowchart will help to elaborate this cause very comprehensively.

                     

Answer 3 .& 4 SHELL

Another conceptual tool, widely used in aviation, which analyses the interaction between multiple system components, is SHELL, which stands for:

S = Software (any procedures, checklists, training, computer)
H = Hardware (machines and equipment- including the controls, instruments and interfaces)
E = Environment (conditions – oxygen, pressure, temperature, socioeconomic considerations)
L = Liveware (any people involved in the workplace – pilots, cabin crew, ATC, engineers etc )

The Human to human interface is in the middle of the model as it is considered the important element and it is the main contributor and factor in aviation safety. Our goal is to understand the interaction with the other components and identify the way this interaction results in mistakes and errors. However, the inconsistency in the human element brings up the following 4 P-factors which need to be considered: Physical, Physiological, Psychological and Psycho-social factors.

The constant interaction of the elements with liveware is what sets-up the conditions and the basis for an event.

The advancement of SHELL produced the SCHELL, which has the addition of Culture in the components, a factor that can greatly influence the interactions.

5M

Another similar model for examining and valuing accidents, the 5M model, illustrates the interactions in the complex environment of aviation by intertwined circles. The three circles are Man, Machine and Medium, which together create the area of Mission and all these together are bound by the management circle.

Man circle refers to all the front-line personnel involved in the operation of the flight, but some safety experts even include people involved in design and management. This way aids in removing the concept of “pilot error” who for many years was considered the only element of the Man circle. But in this model pilot is simply viewed as the last line of defence in a chain of mishaps. Being a user-centred model, the human is considered the forcing function of the system.

Machine in this model is any equipment and technological advancement, which disregarding the high efficiency and reliability they still pose a hazard and a threat to the operation of a flight. Redundancy in critical components is major step towards achieving safety but the new designs must take further note of the human interaction, mainly the physiological limitations. Failures can be classified as early failure (in regards to life of the component), a random failure and a wear-out failure (towards the end of component’s life). Engineering design as well as maintenance come in play with this circle.

From the accident prevention viewpoint, medium is considered to be both the natural environment of the flight as well as the artificial one. Natural refers to weather, topography, temperature etc. Artificial is divided into physical, which includes ATC, airport, aids and infrastructure, whilst and non-physical is the legislation and procedures under which the flight takes place.

The mission is nothing more than the actual flight, which changes according to the actual operations, the type of flights, type of aircraft, destination etc.

The responsibility of safety in any organisation rests with the management, thus the management circle encloses all the others in a sense of control and protection, as it is the integrating link. Management’s responsibilities include the correct allocation of resources, appointment of qualified personnel, selection of fleet and routes and most importantly the fostering of the organisational culture. The attitude and behaviour of management has a profound effect on the people and it is important to realise that responsibility does not end with financial support and regulatory compliance, but also with acts such as support of the safety programme, avoiding overpressure, pushing the limits etc.

Domino (Heinrich)

Accidents are the result of a chain of interactions, sequential events, with each event triggering the next one. Removing one of the key factors (event-domino) can break the link-sequence.

Accident Evolution Barrier (Svenson)

AEB models accidents in a sequential interaction of human and technical systems. It is based on the principle that setting barrier functions between two successive errors it is possible to stop the sequence. AEB emphasises on technical errors and forces integration of human and technical systems simultaneously during the analysis.

Swiss Cheese Model (Reason)

One of the most famous accident causation model is the Swiss Cheese Model, published in 1990 by professor James Reason. It illustrates how the organisational factors at the various organisational levels (including the management level) can lead to an accident. The Swiss Cheese model identifies the existence of both active and latent conditions in an organisation, which under the right combination and circumstances trigger a breach in the system defences. Active conditions (failures) are actions or inactions, errors or violations, associated with the front-line personnel (pilots, engineers, ATC), which have an immediate adverse effect. Latent conditions on the other hand exist in the system well before the failure and can be dormant for a long time. They are created by actions, decisions or conditions that are far removed from the actual timeline and space of the event and without interaction with other conditions they are not harmful or even visible.

The swiss cheese model (named after the look of the illustration) illustrates how the barriers at the various levels (layers) prevent the interaction and combination of active and latent conditions. It further shows how breaches and weak points in these barriers, when aligned under the right conditions, time and space, can escalate an event into an accident. It is interesting to note that the breaches (gaps) are not stationary and move around the barrier (slice) randomly according to the pre-existing conditions. The innovation of the swiss cheese model was that the human error was only the manifestation of the latent conditions and is the end result of root causes which are traced back to the management or initial system design. The focus is therefore on the influences created by the high-level decision makers like rapid expansion, lack of regulation, culture towards safety, policies, communication and resources allocation. The target is therefore to reinforce each defence layer as much as possible and to block the existing holes.

FRAM

Functional Resonance Accident Model (FRAM) (Hollangel 2004 & 2012) is a model/ method describing the outcomes through a 4-step process analysis. The concept is based on the idea that the variability of daily performance creates resonance. Resonance is the phenomenon where a function vibrating forces another function in the system to vibrate at greater amplitudes than usual often leading to a break of the system. FRAM aims at damping (reducing the amplitude) of this resonance, which is a result of the unwanted variability.

The steps are to identify, describe and characterise (6 basic characteristics as per figure) the system functions, check the model completeness and consistency, then characterise the variability and identify the resonance of the functions and eventually monitor and control the development.

The basic principle of FRAM is that the same underlying process can lead to either success or failure, therefore the outcome is not mutually connected to the process. The performance variability which determines the outcome, is a result of the variable and different conditions, group interactions, resources allocation etc, existing during the actual process in relation to the prescribed or specified one. The combination of performance variability in a group of functions (system) can cause the accident, but no function on its own could constitute a malfunction of the system. In other words, in the absence of the system, each individual function is functioning properly. Resonance of a function means that its variability is unusually high with consequences spreading dynamically to the other functions of the system through not necessarily identifiable couplings.

FRAM enables an overall understanding of a socio-technical system, by avoiding to decompose the system into smaller components and characteristics. Emphasis is given on the comprehensive view. The process itself forces questioning rather than finding straight clear answers, as it does not include the typical cause-effect models.

The biggest weakness of the method is the time-consuming process, which is mainly attributed to the young age of the method. As it differs fundamentally from the traditional methods, it will require time for adaptation and efficient use. The method requires imagination and it does not allow room for automation.