air disasters as organisational errors: the case of linate by m. catino
DESCRIPTION
If you are interested in the topic please register to the ALIAS network: http://network.aliasnetwork.eu/ to download other materials and get information about the ALIAS project (www.aliasnetwork.eu).TRANSCRIPT
1
Prof. Maurizio Catino Prof. Maurizio Catino
University of Milan - Bicocca (Italy)University of Milan - Bicocca (Italy)
[email protected]@unimib.it
Air disasters as organizational Air disasters as organizational errors: the case of Linateerrors: the case of Linate
ALIAS Conference 14-15 June 2012, EUI - Florence (Italy)
2
8.10.2001: The second most serious 8.10.2001: The second most serious
aircrash aircrash
ground accidentground accident
SAS MD87
Cessna
3
The accident dynamicThe accident dynamic
Cessna
MD87TWR
R5 R6••••••••
R5 R6••••••••
4
5
6
Cessna
MD87
The sierra four …The sierra four …
(8.08.23)
(8.08.28)
(8.08.32)
(8.08.36)
• Roger, … hold position
(8.08.40)
D-VXD-VX
7
Cessna
MD87
(8.09.19)
(8.09.28)
(8.09.37)
(8.09.38)
The accident dynamicThe accident dynamic
8
Accident DynamicAccident Dynamic
9
10
Why? Who is to blame?
Cessna pilots mistake
Ground controller error
Inadequate signals condition
Absence of a ground radar
Airport management negligence
Tragic fatality
…
11
The Error of Human Error…The Error of Human Error…
““... ‘human error’ is not a well defined category of... ‘human error’ is not a well defined category ofhuman performance. Attributing error to the actionshuman performance. Attributing error to the actionsof some person, team, or organisation isof some person, team, or organisation isfundamentally a social and psychological process fundamentally a social and psychological process and not an objective, technical one.”and not an objective, technical one.”(Woods et al., 1994)(Woods et al., 1994)
Assume that thesource of failure is“human error”
Analyse events tofind where aperson is involved
Stop analysiswhen one is found
12
A multilevel model for the A multilevel model for the
analysis of accidentsanalysis of accidents
AccidentAccident
Individual-levelIndividual-level(errors, violations,(errors, violations,
mistakes, decisions)mistakes, decisions)
Organizational levelOrganizational level
Inter-organizational Inter-organizational levellevel
DefencesDefences
- DefencesDefences- Managerial decisionsManagerial decisions- Error-inducing conditionsError-inducing conditions-……
- IntegrationIntegration- CoordinationCoordination- … …
(Catino 2010)(Catino 2010)
13
• The Cessna and two pilots were not qualified The Cessna and two pilots were not qualified and certified to operate in low visibility and certified to operate in low visibility conditions (land and take off) such as that day conditions (land and take off) such as that day (violation)(violation)
• The Cessna crew took the wrong taxiway The Cessna crew took the wrong taxiway (error)(error) and entered the runway without and entered the runway without specific clearance (violation)specific clearance (violation)
• There were communication failures between There were communication failures between the tower and the Cessna pilots: the ground the tower and the Cessna pilots: the ground controller did not realize that the Cessna was controller did not realize that the Cessna was on taxiway R6 (error), and he issued a on taxiway R6 (error), and he issued a clearance to taxi towards the main apron clearance to taxi towards the main apron although he could not make sense of the although he could not make sense of the report position S4report position S4
1. Individual Level1. Individual Level
14
2. Organizational Failures2. Organizational Failures
No Surface Movement Radar (out of service since November 1999)
Installed equipment for prevention r.i. at R6 intersection deactivated
TWY Lights Stop Bars
Failures defences
The ground markigs were not clearly visible (RWY Holding Position Markings)
Signs, signals and lights were inadequate and misleading (out standard ICAO)
Official documention failed to report the presence of unpublished marking (S4, S5, etc)
Error-inducing conditions
Latent failures
No learning from near miss Best practices not applied No functional Safety Management System
15
ENAC ENAC (airport authority)(airport authority)
ENAV ENAV (air traffic regulator)(air traffic regulator)
SEA SEA (Service Provider)(Service Provider)
3.The bigger picture—Linate 3.The bigger picture—Linate
16
Individual FailuresIndividual Failures Organizational andOrganizational andInter-organizational FailuresInter-organizational Failures
The Cessna crew took the wrong taxiway (error) and entered the
runway without specific clearance (violation)
Markings and signs were not in accordance with ICAO standards; Red bars and TWY lights non controllable by ATC; Deficiency in the state of implementation and maintenance of airport standard signage; Official documentation failed to report the presence of unpublished markings (S4); No equipment to prevent runway incursions
There were communication failures between the tower and
the Cessna pilots
No surface movement radar; Installed equipment for prevention r.i. at R6 intersection deactivated; Markings and signs were not in accordance with ICAO standards; Deficiency in the state of implementation and maintenance of airport standard signage; Non-compliance with international standards on markings, lights and signs; High traffic volume; lack of visual aidsThe Cessna and two pilots were not
qualified and certified to operate in low visibility conditions (land and
take off) such as that day (violation)
Lack of coordination among the airport authorities; weaknesses in the control system
17
Failure LevelsFailure Levels
Individual-Individual-levellevel• ErrorsErrors
• ViolationsViolations• Communications Communications
misunderstandingsmisunderstandings
Organizational - levelOrganizational - level
• No ground radarNo ground radar• No international safety No international safety
standardstandard• Weak defensesWeak defenses• Lack of visual aidsLack of visual aids• No learning from near No learning from near
missmiss• ……
Inter-organizational levelInter-organizational level
• Cost/safety trade-offsCost/safety trade-offs• Failures of integration and coordinationFailures of integration and coordination• Bureaucratic safety cultureBureaucratic safety culture• No Safety Management systemNo Safety Management system• ……
18
Latent ConditionsLatent Conditions Coordination neglectCoordination neglect
Inadequate safety policiesInadequate safety policies
Latent ConditionsLatent Conditions No ground radar; no international standardNo ground radar; no international standard
No learning from near miss; …No learning from near miss; …
Latent ConditionsLatent Conditions Poor visibility of R5/R6 signs; Mental Fatigue; Poor visibility of R5/R6 signs; Mental Fatigue;
S4 marking unknown to the controller; …S4 marking unknown to the controller; …
Active ConditionsActive Conditions• The Cessna crew took the wrong The Cessna crew took the wrong
taxiway and entered the runwaytaxiway and entered the runway
• Communication failuresCommunication failuresFailed orFailed orAbsent DefensesAbsent Defenses
Inter-Inter-OrganizationalOrganizational
FactorsFactors
OrganizationalOrganizationalFactorsFactors
PreconditionsPreconditionsforfor
Unsafe ActsUnsafe Acts
UnsafeUnsafeActsActs
Accident & Accident & InjuryInjury
Active versus Latent FailuresActive versus Latent Failures
(Adapted from Reason, 1997)(Adapted from Reason, 1997)
19
ConclusionsConclusions
• If we focus too closely upon the unsafe acts If we focus too closely upon the unsafe acts at the sharp end, we are in danger of at the sharp end, we are in danger of missing the fact that this was the result of missing the fact that this was the result of an organizational erroran organizational error
• It’s important to take a system perspectiveIt’s important to take a system perspective
• Communication and organization problems of many kinds were crucial factors in this and other disasters
20
Individual Blame Logic
Errors and Accidents
Two ways of looking at accidents
Organizational Function Logic
21
Vicious CircleVicious Circle
Organizational inertia Organizational inertia Defensive behaviorDefensive behavior
Individual Individual Blame LogicBlame Logic
Search for the guiltySearch for the guilty Hidden errorsHidden errors
Blame cultureBlame culture
22
• Defensive medicine takes place when healthcare
personnel prescribe unnecessary treatments, or avoid
high-risk procedures, with the goal of reducing their
exposure to malpractice litigation
• Doctors in particular may:
• prescribe unnecessary tests, procedures or
specialist visits (positive defensive medicine),
• or, alternatively, avoid high-risk patients or
procedures (negative defensive medicine).
Defensive Medicine?
23
Defensive MedicineStudy Year Country Result
(% of defensive behaviours)
Tancredi 1978 US 70%
Studdert et al. 1995 US 93%
Summerton 2000 UK 90%
Hymaia 2006 Japan 98%
Jackson Healthcare 2008 US 72%
Massachusetts Medical Society
2009 US 83%
24
Positive Defensive Medicine
Negative Defensive Medicine
25
26
• The threat of legal investigation does not make the The threat of legal investigation does not make the medical system more careful and attentive toward medical system more careful and attentive toward the patientthe patient
• Individual blame logic does not improve patient Individual blame logic does not improve patient safety safety
• Develop the capacity to learn from errors and system Develop the capacity to learn from errors and system failures to become more resilient and reliable failures to become more resilient and reliable
• To achieve this, a profound cultural and juridical To achieve this, a profound cultural and juridical transformation is requiredtransformation is required
• Promote a different culture to reduce defensive Promote a different culture to reduce defensive medicine and to promote a process of learning from medicine and to promote a process of learning from errorerror
The side effects of defensive medicineThe side effects of defensive medicine
27
Virtuous CircleVirtuous Circle
Organizational Organizational Function LogicFunction Logic
Search for Search for organizational criticalityorganizational criticality
Reporting close calls, Reporting close calls, errorserrors
Removing latent factorsRemoving latent factorsOrganizational learningOrganizational learning
Just cultureJust culture
28
Person model
System model
Both extremes have their pitfalls(Reason, 1997)
Getting the balance Getting the balance rightright
Proximal factors
Remotefactors
Individualresponsibility
Collectiveresponsibility
29
Just Just cultureculture
Blame free Punitive culture
Individuals are blamed for all
mistakes
All errors to system failureNo individual is to be held
accountable
30
Just cultureJust culture
10%10%BlameBlame
90%90%No BlameNo Blame
31
Reassure
Malicious Malicious behaviorbehavior
ViolationsViolationsGross Gross
negligencnegligencee
Criminal Criminal offencesoffences
Human Human errorerror
Inadvertent Inadvertent action: action: slips, slips,
lapses, lapses, mistakesmistakes
At-risk At-risk behaviorbehavior
A choice: A choice: risk not risk not
recognized recognized or believed or believed
justifiedjustified
Reckless Reckless behaviorbehavior
Conscious Conscious disregard of disregard of unreasonablunreasonabl
e riske risk
PunishCoach
Establishing a Just CultureEstablishing a Just Culture
Unintentional
No blame
Deliberate
Culpable
32
• 20 flight divisions; 1000 pilots
• 1990: The accident of “Casalecchio di Reno”: 12 people died
• New organization, new culture
The Case of the The Case of the
Italian Air ForceItalian Air Force
33
• The promotion of a new vision of risk management and safety
• The promotion of methods for the identification, analysis and prevention of risks (critical latent factors)
• Database for incident reporting (voluntary and anonymous for the centre)
• Ongoing training and education about safety and perception of errors in order to learn from them
• The implementation of a just culture
New risk and safety policy
34
A deterrent strategy (blame culture) is backward-looking, implemented after the accident happens punitive, sanctions directed towards the
individuals or organizations responsible for an error or accident
A compliance strategy (ITAF - just culture) is forward-looking and preventive early identification of errors and latent factors
Two different strategies Two different strategies
compliance vs. deterrentcompliance vs. deterrent
35
For each event we look for the reason why it happens. For each event we look for the reason why it happens. We do not talk about blame and responsibility. We do We do not talk about blame and responsibility. We do not want to know who the guilty person was but why the not want to know who the guilty person was but why the event happened and what we can do to avoid it in the event happened and what we can do to avoid it in the future.future.
Error is a mechanism for learning (…) there are some Error is a mechanism for learning (…) there are some errors that if analyzed can help prevent future errors. errors that if analyzed can help prevent future errors.
The more people I inform about my error, the less The more people I inform about my error, the less they risk repeating the errorthey risk repeating the error
The organization does not put pressure on people The organization does not put pressure on people committing an error. Nobody is afraid of being punished. committing an error. Nobody is afraid of being punished. The debriefings are a training activity to talk and improve The debriefings are a training activity to talk and improve our work. The exchange among experts and newcomers our work. The exchange among experts and newcomers is a good occasion for both people as it helps to see is a good occasion for both people as it helps to see things from different points of view.things from different points of view.
Just culture at ITAF Just culture at ITAF (extracts from interviews)(extracts from interviews)
36Human Factors Total
Reporting of Incident and Flight Safety OccurrencesReporting of Incident and Flight Safety Occurrences 1991-2009 (rate for 10,000 hours of flying)1991-2009 (rate for 10,000 hours of flying)
0
20
40
60
80
100
120
140
160
180
200
1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006
1073
729 681645
1745
92198910641180
1143
865
434410
1514
1130
1539
340266
245274272240
2922
694600572
391
1472
1773 1732
143
2007
1650
574
2008
1575
550
2009
1922
650
220
(Source: ITAF Flight Safety Inspectorate)
37
Major accidentsMajor accidents1990 - 20101990 - 2010
1920
21
24
16
20
8 8
65
34
65
6 6
43
89 8
0
2
4
6
8
10
12
14
16
18
20
22
24
26
90 91 92 93 94 95 96 97 98 99 00 01 02 03 04 05 06 07 08 09 10
(Source: ITAF Flight Safety Inspectorate)
38
220,32332000 - 10
430,38511990 - 99
610,59871980 – 89
DEADS RATEONUMBER
Number of accidents 1980-2010Number of accidents 1980-2010
(Source: ITAF Flight Safety Inspectorate)
39
Either organizations manage human Either organizations manage human errors, by learning from them errors, by learning from them
Or… Or… human errors will manage human errors will manage
organizationsorganizations
To achieve the first one, is fundamental To achieve the first one, is fundamental to develop a just cultureto develop a just culture
ConclusionConclusion