ML19312C979

Some Principles of Aviation Accident Prevention. Presented at Fourth Flight Safety Seminar,Kuala Lumpur,Malaysia

ML19312C979
Person / Time
Site:	Crane
Issue date:	01/31/1976
From:	Chris Miller SYSTEM SAFETY, INC.
To:
References
TASK-TF, TASK-TMR NUDOCS 8001170606
Download: ML19312C979 (5)

Text

.

1 SOME PRINCIPLRS OF Aviation Accident Prevention 1

By C,0, Miller 1

President & Pnncipal Consultant people do not appreciate its infimte tigative proot that the particular nat ure One hears, "Is it safe or isn't hazard in and ot itself was significant.

System Safety, inc-t?" as if a simple yes or no answ er Similarly. meaningless attempts are e x isted. Really, the only was to made to treat accidents statistically.

//> resented at the Ith Flight Safcty answer that type of question 'is to not recogniimg that the number of Scmmar condricted tw the Orient <lir-paraphrase the old burlesque joke accidents is small compared to the lin es

<1 s so ciation, Kuala 1.u mpu r, w here the stran man savs to the spectrum of hazards that can produce

.tf;/JJJidl comedian " flow'chts your witei" and the them; or compared to other exposure reply is. " Compared' to u hat?"

mdices, hke h ou rs, passenger-miles.

Introduction Nevertheless. safett continues to be etc. It remains the combination of prmciples in saf ety are difficult to defined literally as le condition li.e.

otherwise acceptable hazards that pro-estabhsh itecause of the infimte vari-freedom from danger). 51odern think-duce accidents. liaiards need the ables that seem to be present, one can-ing extends this to potential harm not emphasis, not acadents per se.

not readdy use the scientific approach; only to people but also to property.

4. A safety-oriented description of that it hypothesire, test and prose a lleyond that it becomes necessary to accident causation will necessanly in-truth us-a-m seek an opinion. Of par-speak in relative terms, use other terms sohe multiple esents - This follows ticular trustratico is the difficulty of hke risk management, or pielerab!>

trom the preceedmg discussion of the trying to infuse human behauor into concen tra te on what is needed to basie complex nature of any accident.

sush Jehberationt llecause lack of achieve safety.

If the objectise of insestigation is to saf ety, by dehnition, is a danger to 1 An accident is an unplanned but estabhsh remedial actions to prevent someone or somethmg someone has c on trollable combination of esents recurrence of the same or similar acci-deused, man is always invoked - but which causes mjury or Sarm to same-dents, it follows logically that all his performance is indeed difficult to one or something - It is not just a cause-effect relationships - all hazards predict, measure or even describe.

matter of luck or, perhaps more accu-

- that can be corrected in a practical Accordingly, this paper must be pre-rately, a matter of misfortune. Proba-manner should be highlighted. It can faced with the fact that the principles bility can become insolved w hen one be argued, in fact, that probable cause presented herein have been derived realizes the multiplicity of conditions need not be shown in safety-oriented e m pi rically.

~l he only experiments or actions that combine in virtually accident reports.

hase been the bitter tragedies called every case. Ilowever, individual por-This principle encounters two actidents Correcthe actions that have tions of the whole are subject to pre-forms of opposition. First, to the been taken complete the sociallabora-event control and in some cases con-lawyers who have had proximate cause tory from which the principles have trol during the event.

(usually singular) ingrained since their been learned.

The problem exists when people law school days, the precept of multi-Fortunately in aviation, there has tend to feel the one item that involves pie factors or multiple people to blame always been a g g r e s sive thinking them is the only causative factor or is foreign to their thought processes.

towards accident msestigation and pre-express the view "When my time is up, indeed, it makes their legal procedures vention. A c c ordmgly, the overall there's nothing I can do about it." Or more complicated. They like to equate i

record is good and seems to be improv-they do not appreciate the finite time probable cause and proximate cause.

ing with time. Someone must be doing sequence over which the total esent Second, the public and their something right. Still, lack.'f under-occurs and the preventise measures governmental derivatives tend to seek a standing of safet) prmeiples, by tlc hat can be taken to at least allesiate sim ple solution to everything. It is lay public, their representatives, the injury or death;like wearing a seat belt easier to blame, and thus presumably news media - to mention just a few before the accident sequence starts or eerrect, one person or one organiza-grou ps - tends to inhibit further taking appropriate steps towards sursi-tion; and, above all, find someone else advances in accident prevention.

val after the crash.

at which to point the finger. Then the 3.

Accidents are rare events; responsibility cannot come home to The Principles harards are not - A hazard is simply roost!

l. Safety is an abstraction - one an accident element that has not yet

5. A total systems orientation to cannot see it, taste it, feel it. Like elee-happened. Except for the damage in-accident causation / prevention is enen-tricity, it is thfficult to define and curred, the only real dif ference be-tial to assure consideration of all fac-of ten the best one can dois express its tween an accident and a hazard is that tors - !!istorically, an examination of charactenstics with regard to other the latter is usually a single cause-accident causation!presention has used things or perhaps desenbe what effect relationship ensisioned before.

descriptors such as " Unsafe Acts -

happens without it. Some even argue the-accident fact it can be treated Unsate conditions" or "Engineenng.

there is no such thmg as safety since individually and of ten it I: d uca tion and I nforcement ? The there really no tabsolutet freedom The ditticulty arises w hen hazards former suffers a shortcoming in that from danger.

are confused with total accident cauw emphasis tends to be placed on the un-Natet) as an abstraction becomes tion. ". hey are degraded because there safe act of the persons phy sically close u gmticant when it is reahze? most is not operational expenence or ina-to the accident esent w hereas the un.

H AZARD PREVENTION

- - -17g

)

800;I70 g 6 january / february 1976

safe acts w hhh precipitated the unsafe G

E sondo ws may go u n noti ced. The b

k three I s are somew hat hetter. but the) pr,,ume an understanding of the vari-I abies that must be encineered. used m enf orce'. Identification p

eJ u ca t.

or d

of such variables is not self-evident from that protocol.

MAN An a p p roach pretened by the A

author is illustrated and explained in Figure 1 It speaks to man, machme.

[

medium tenvironment L management and mission factors which individually M

anJ collect:vely must be considered in l

analy sis of any s fety problem. Other S

9 stems dlustrations are undoubtedly e

possible and perhaps preferable for a G

gnen situation.

l The importart consideration is that Q

some encompassmg approach be taken to assess all reaso' table variables, lest MACHINE N

MEDIUM all feas&le presentive measures not be deseloped. This is, of course, closely related to Pnneiple 4. pertaining to accident causation multiple events.

6. Safety is an integral part of misuon accomphshment and not an end in itself - Also. as illustrated schemancally in Figure 1. mission con-siderations are intimately entwined with safety. whether that mission m-cludes delivenng passengers from point A to point II. dropping bombs on a Figure i SYSTEM SAFETY FACTORS target. or simply enjoying the scenery on a pleasure fhght. Niodern applica-The SM System Safety Factors Safety Division of the University of tion of safe!> ettort enhances mission Illustration Southern California. Later, David accom phshm en t at least on a long-term baus:it does not restnet it. To be Holladay,.in a simdar position, used sure, short-term gams can be made by Experience has demonstrated that the 3M terminology (Man-Machine-being less safe. It is postulated that the Man Machine-Medium-Manage-Medium) and literally conveyed this ef fectise safety work provides the in-ment Mission factors represent a valu-precept to people from all over the formation such that risk management able model for examining either acci-world; those who attended the USC can be pursued intelhgently. There are dent causation or accident prevention. courses and others he met during times when safety compromises can That is, when one seeks causal factors lectures in foreign countries.

or pr ev entive/ remedial action, the The author first provided an illus-t a s; tat on sit ta ion it s b

come or remain siable.

Illu s t r ation becomes a meaningful tration and the fourth M, Manage-Should this pnneiple not be recog-checklist or approach for analysis that ment, in 1965 when developing system nited and accepted, an air of nega-tends to ensure all factors are consider-safety and advanced safety manage-tivism regarding safety effort will ed.

ment cou rses at USC This was pervade and progress in aviation acci-The five factors are closely interre-eventually published in the text "The dent presention will cease.

lated, albeit it can be argued that Man. Role of System Safety in Aerospace 7.

There are identifiable, safety agement plays the predominant role. Management" (1966), in 1972, tasks withm management s division of The defined Mission is shown centrally Vernon L. Grose, who also taught the pre ention eff ti eness n a ain as the. target or objective to emphasize system safety course at USC, intro-there are many ways to detail this that effective mission accomplishment duced the excellent Venn diagram pnneiple in practical terms (the one is im plicit in professional system approach to emphasize the interrela-used by the author being shown in safety work.

tionships between the man-machine-Figure h These are the techniques As is best known at this time, the medium factors and their subset rela-which have evolved d uring the concept evolved as follows: T.P.

tion to management, d es elopment of professional safety Wright of Cornell University first in.

Recently, Jerry Jerome, aviation work. The only question that usually troduced the man-machine-environ-consultant, writer and former staff anses is whether or not these tasks ment (medium) triad into the aviation member of FSF, contributed the fif th

P i

V Ctivities safety language during the late 1940s, M, Mission. Indeed, even a sixth M, r th - ho id b Jinto mc jo's as just part of good manage-when he was, influential in the develop-Money, has been suggested, perhaps b

m'e n t.

ment of the Cornell Guggenheim Avia-not too facetiously, by the current lhe answ er to that question rests in tion Safety Center and the Flight managing director of FSF, Jack the site, complesity and mores of the Safety Foundation (FSF). It was then Carroll.

o r g a n iz ation insohed. Should the found in the 1950s,in the teachings of And so we see a classic example of operation be large enough to warrant the late and renowned Jerry Andrews, safety ideas being perceived, reviewed, j

the first accident investigation and pre-modified, amplified, hopefully improv.

l, v ention instructor at the Aviation ed; but in any event, communicated.

18 HAZARD PREVENTION january / february 1976

Figure 2 System Safety Tasks

1. Develop and coordinate imple.

It is emphasized that separately de fine problems which have been mentation of safety plans; fur 5" Mi.f;;/ ele s fety functions in an delineated clearly earher, with result-example, program accident prevention, orgamzation do not in any way de-ant minimal effort towards establish-grade responsibility of others for their ing where action failure has occurred system safety engineering, accident /m-role in accident prevention. They are a in effecting remedies. Or to put it cident investigation, disaster control manifestation of additional accounta-another way, repeat accidents occur and security plans.

bility and special emphasis that be-not because the causes of the earlier

2. Assist in establishment of speci-comes required in our complex society ones have not been identified, but fic accident prevention requirements.

with its complex systems.

rader the reasons for failure toimple-

3. Conduct or participate in hazard

8. Accident / incident inveuigation is ment corrective action have not been analyses, including the control process part of accident, prevention, but acci-studied and documented.

related thereto.

dent prevention includes far more than

10. The human operat% is a highl>

4. Determine and/or review emer.

investigation - The validity of this adaptive safety device - In every principle is evident, assuming agree-known transportation system, man gency procedures, ment with Principle 7 and the scope of plays a role such that in the event of

5. Participate in program reviews safety tasks shown in Figure 2. liow-an impending accident, he is usually at and similar milestone events during e v er, accident / incident investigation a cuntrol pohtt near the end of the product development and use, plays a unique role - a feedback role sequence of events. Therefore, he can 6.

Maintain an accident / safety

- in a total accident prevention become a hero (usually unreported known precedent center.

system.

and thus unsung) or he can become

7. Effect liaison with other safety Every other safety task can and the scapegoat (particularly when the organizations.

should be done in the normal course investigation does not examme other of development, test or operation of a factors sufficiently). The precept also

8. Provide recommendations for system. Only when the unplanned explains why an increased level of and/or conduct safety research, study, event occurs does the investigation hazard is not always accompani:d by a and testing.

task come into play. It uniquely re-linearly decreasing level of safety.

9.

Im plement safety education, quires a high level of objectivity since, (Figure 3 ). The human operator is training, indoctrination, and motiva-by simple logic, it will always be criti-highly adaptive in preventing accidents tion programs.

cal of some action or decision of some-under nominally hazardous conditions,

10. Conduct or otherwise coordi.

one in an earlier part of the process.

albeit his capability for continuously nate safety surveys, audits and inspec-If. accident investigation's unique compensating for other shortcomings tions~

role is not appreciated as just one in the system is limited.

11. Participate in group safety segment of the prevention spectrum, if this phenomenon is not recog-undue attention will be paid to assess-nized, oversimplified blame occurs fol-efforts such as councils and standard" ing blame and examination of actions lowing accident investigations. Undue zation boards.

only after-the-fact (tombstone count-emphasis is placed upon trying to cor-

12. Direct or otherwise part,cipate ing!). Also, unless those doing the in-rect the performance of the human i,

in accident / incident investigations.

vestigation are relatively outside the variable which may or may not be

13. Develop and follow up recom-normal development, test or opera-practical. At the very least, even with mendations resulting from investiga.

tional structure, bias can be expected normal, qualified people, there is a dis-in the results. Such bias may well en-tribution of human performance limi-tions'. Provide objective response to 14 tail bemg supercritical as well as not tations which simply cannot be ex-being entical enough. Man is hke that.

pected to be overcome with education, safety inquiry as a staff advisor,in the 9, Known precedent is the funda-training or motivation programs. Thus, confidential sense when appropriate.

mental ingredient in any accident pre-at least equal emphasis should be given vention program - This has been said to correction of upstream factors,such many ways:

as aircraft design, m anagement, "Those who do not learn from his-t ory are bound to repeat it."

- mission factors, etc.

11. Rule enforcement and punish-Santayana ment are among the least effective some one or more persons conducting

" Learn from the mistakes of others, accident prevention measures in those tasks on a full-time basis, serious you will never live long enough to today's aviation system - An over-consideration shou:d be given to a make them all yourself."- Lederer whelming majority of people partici-specialized safety function organiza.

' Thus, the truth of this principle is pating in today's aviation system in tionally. This approach also has the usually not challenged. Unfortunately, control or decision-making positions benefit of usually insuring better quali-however, known precedent exists for are well qualified and reasonably fications of the personnel so assigned.

virtually every accident cause in avia-safety motivated - probably more so Should the principle of separately tion, yet understanding of effective than in any similar transportation or identifiable safety tasks not be recog-remedial actions is relatively nil. This other technology based endeavor.

nized, the competence with which the is exemplified by countless data banks (Quite often,it is the person's own life accident prevention measures are which store factual and cause deter-that is at stake.) Still, these personnel taken is usually less than optimum, mination information, yet the scope have human weaknesses common to since no one can be expected to be

• and efficacy of recommended actions all; that is, they can and will make mis-proficient in safety tasks as a simple are difficult to identify.

takes.

[

corollary to other work. Safety work To not appreciate this shortcoming it follows. then, that to enforce today requires its own bag of tricks, as in use of known precedent is to con-rules to the letter of the law (which do other professional endeavors, tinue to expend scarce resources to re-cannot possibly be written to cover HAZARD PREVENTION tg

. january / february 1976 L

N N

N NORMAL HIGH

-[

VARIATION h

A LEVEL B

OF SAFETY i

i i

A HYPER AWARENESS ULTRA V

OF HAZARD HAZARDOUS LOW C

i

\\

\\

\\

DEGREE LOW 4 0F

> MH HAZARD Figure 3 l

20 HAZARD PREVENTION january / february 1976

every situation) or inflict severe or de-similarly to have been in control posi-approach as did the accident aircraft.

grading punishment to a person who tions years earlier.

Similar siories were heard from mili-genuinely has committed an honest

3. Accidents are rare everits - U.S.

tary and international sources.

mistake is not going to produce much carriers flew over sis million hour < in

10. The human operator as an adap-reahstic corrective action. This does 1974 and carried over two hundred tive safety device - On another air-not mean the rules should not be com-million passengers. They experienced craft a half hour before the subject prehensive, nor that the mdividual nine fatal accidents with only five of accident, the crew questioned their who callously disregards them should those fitting into the catastrophe cate-clearance to the point they did not not be eliminated from the system if gory.1974 was described by the media descend as early as did the accident he crmot be made to conform. It does as having one of the worst records in aircraft, although they were cleared mean that the emphasis should be U.S. history, because the 467 fatalities for the same approacti.

placed on the origin of the improper were the hignest number since 1960.

I1. Rule enforcement and punish-action. such as inadequate trainirig,

4. Accident causation as multipla ment effectiveness in safety - Testi-ambiguous regulations and the like; events - The sequence of events start-mony at the hearing suggested that and the corrective action should be ed with vectoring procedures shortly many peers of the hu nan operators just that, corrective not punitive.

after the aircraft left Columbus, Ohio, might have taken the same actions This precept is at the heart of the the details of which being too compli-under the given circ u m st ances.

problem deahng with hazardous inej-cated to note here. Or it could be Throughout the aviation community it dent reporting. People cannot be ex-argued that the sequence began four was argued strongly that the rules were pected to report events in which they years earlier when the possibility of ambiguous and that the human per-may be held liable for disciplinary precisely this kind of accident was formance was normal. Thus,if punish-action. Accordingly, unless the short-noted by airline personnel. The ment were meted out to the con-comings of rule enforcement and sequence ended a few seconds after trollers or pilots who spoke of similar p u nishment as accident prevention altitude alerting signals went u n-incidents, it probably would have a techniques are recognized, before-the-noticed or unheeded, negative safety reactior fact safety efforts will continue to be

5. Total systems orientation - The

12. 51anagement accountability -

inhibited because of the lack of effee-crew and air traffic controller's actions Management of the FAA, the airline, tive communications.

(man); the lack of ground proximity pilot groups and the controller organi-

12. Management accountability for warning system (machine); the pre-zation all performed probably as much safety cannot be denied relative to sence of severe wind and turbulence soul-searching on this cas-e as during accident presention - Man is ultimate-(medium); the failure to act or pre-any single catastrophe in recent U.S.

ly responsible for his own survival. But viously known hazards (managementh history. Changes have been and will be when groups are formed to better con-and the motivation to get the passen-made in their operating system.

duct a given activity, safety becomes gets into Wasbington (mission)are but I

more than protection effected through a few of the systems elements that can E'"p*f"g",9 an individual; and group leaders must be described in this case.

3 3 afety work involving then assume responsibility and be held

6. Safety as part of mission accom-aviation accident prevention has had a plishment - The aircraft did not sue-significant history. It can be shown otl erwise would be en-

1. '** fully c mplete its mission; that s that for well over two decades special-cou rage unplanned, uncoordinated brious. Ilowever, the airline con -

ized and well-defined aviation safety hapharard attention to control of re; tinues to operate; the route continues pohcies, procedures, organizations and sources (personnel and funds) which wn e approach procedure tasks have,been applied to assist air by any definition, is a principal funcI (w.ith some modification) continues to transportation m achieving a justifi-tion o7 management.

be used. The short-term effect was ably proud record. Many of such A Case m Point negligible on the mission of the airline actions have been supplemental to the On December 1,1974, an airhner industry. The effect on the mission of regulatory forces that have been in crashed into a hillside a few miles west others (e.g. the FAA) remains to be effect for nearly a half-century in the of Dulles airport near Washington, seen. There has been discussion about U.S.

D.C.

It was on a n onprecision changing the role of the federal During that time, certain principles approach during which a premature government with regard to the air have evolved. Tl;ose of aviation safety letdown occurred, based on a mis-traffic control system.

significance to the author are describ-understood clearance. Ninety two

7. Identifiable safety tasks - Re-ed in this paper. There may well be people were killed. A major public assessment of the methods by which others. There undoubtedly are many furor deseloped regarding the case as their safety efforts will be conducted derivat" es which have not been chron-i typified by events at the longest dura-in the future has been underway by icted here.

tion public hearing ever held by the several parties to the accident since What continues to be the challenge National Transportation Safety Board December 1,1974 is the communication and application or its predecessor Civil Aeronautics

8. Accident investigation as part of of these principles to accident preven-Board. provided below are examples of prevention - This case promises to tion on a continuing and expanded how this case illustrates the principles rival the mid-air collision over the scale; particularly to those groups who previously described.

Grand Canyon in the 1950s, among are early in their learning curve with I. Safety as an abstraction - People others, as a landmark critical event sophisticated equipment and to those were heard to ask at the hearing, "Do which will trigger new and improved outside the basic aviation community you consider a nonprecision approach approaches to safety; for example, the who do not understand modern safety safe?" Replies were affirmative, yet use of the ARTS-Ill sistem to auto-precepts. Ilowever, as was exemplified the accident happened!

matically alert controllers that an air-by the Dulles accident, even those

2. An accident as an unplanned but craft is below a pre-programmed alti-operators or countries who are experi-controllable sequence of events -

tude.

enced might well pause periodically to Flight crew and air traffic control per-

9. Known precedent is fundamental assess their programs in light of.

sonnel were shown to be m positions

- One specific case occurring months accumulated knowledge. They, too, of possible presentive actions with '

earlier surfaced during the crash inves-might realize the collective knowledge appropriate information being avail-tigation wherein another carrier's air-gained from the world's aviation ed able but not used. Operations and craft just missed the et.nh site after

' perience might be better than their regulatory personnel - were shown performing essenti.",- the same own.

HAZARD PREVENTION g

january / february 1976