Thursday, March 1, 2012
Organisational Factors in Human Error Accidents - A case study
There is no better example of how Organizational deficiencies can precipitate Human Error than the crash of Air Ontario Flight 1363 at Dryden on 10 March 1989.
Ice and snow on the wings of a Fokker F-28 Fellowship commuter plane caused the crash of this aircraft minutes after take-off near Dryden Ontario, Canada
Flight 1363 departed from Thunder Bay, Ontario at 11:55 am on March 10th, 1989 and landed in Dryden an hour later for refueling and passenger discharge/boarding before heading on to its final destination of Winnipeg, Manitoba.
As a rule, Dryden is not a normal refueling site but the small plane was restricted on the amount of fuel it could take on due to having a full passenger load. Having a full fuel tank meant the aircraft would have exceeded the maximum weight allowance. Dryden airport was not a full-service facility and this caused a problem for the pilot, Captain George C. Morwood.
There were no ground start facilities at the Dryden airport; therefore, Captain Morwood could not re-start the main engines if they were turned off. The Auxiliary Power Unit (APU) located at the rear of the plane, could have been used to re-start the engines but the APU was not working on this particular aircraft.
As a result, Captain Morwood was forced to keep the main engines running while refueling the plane. A thin layer of ice and snow had accumulated on the wings of the plane but de-icing fluid could not be used when the main engines were running due to the chance of toxic fumes leaking into the cabin.
Approximately 40 minutes later, Air Ontario Flight 1363 departed the Dryden airport with 65 passengers and 4 crew members on board. The plane did not gain altitude and it flew through the trees. It crashed and caught fire less than one mile from the runway resulting in the death of 24 people and severe injuries to most of the 45 survivors.
Cause of the Crash of Air Ontario Flight 1363.
A judicial inquiry was held under the supervision of Honorable Virgil P. Moshansky. The cause of the crash was attributed to the recent airline deregulation, which exercised less stringent safety procedures, equipment maintenance in addition to insufficient pilot training.
The aircraft was operating with an excessive number of un-rectified defects, the aircraft should not have been scheduled to refuel at an airport which did not have proper equipment and that neither training nor manuals had sufficiently warned the pilot of the dangers of ice on the wings.
Learning from the Tragedy.
While there is no denying that the flight crew of Air Ontario 1363 failed in its role as the last line of defense against system deficiencies, however, not all unsafe acts surrounding the crash of Flight 1363 were committed by the flight crew. Other operational personnel, including ground handlers, dispatchers and even the cabin crew, contributed by their actions or in actions to deny Capt. George Marwood and First Officer Keith Mills feedback which could eventually have contained the consequences of their own unsafe acts. Arguably, many unsafe acts were none other than the behaviors fostered by the system and therefore the behaviors different personnel perceived the system expected from them. Let us analyze the cause factors one by one.
No ground de-icing by the flight crew. The failure to de-ice was clearly the most obvious unsafe act committed by the crew of Flight 1363. That Capt. Marwood was of a conservative nature and conscious about de-icing is a matter of record. Earlier on the very day of the accident, for example, he had de-iced C-FONF before departing Winnipeg because of a layer of frost over its wings. He had walked to the terminal in his shirtsleeves; it is impossible that he was not aware of the weather conditions. His decision not to de-ice at Dryden demands more than the simplistic observation that "with his experience, he should have known better." Capt. Marwood did not choose to make a bad decision. His error on 10 March 1989 must be understood within the context and the constraints in which it was made.
No walk-around by the flight crew. Neither flight crew member per formed an exterior walk-around inspection. It remains, however, a matter of argument whether such a walk-around would have accomplished anything, given the inaccurate and incomplete knowledge regarding wing contamination that existed among Air Ontario's crews at the time of the accident.
Dispatch with unserviceable APU by SOC. Had he followed the operational restrictions contained in a company's memorandum issued by the director of maintenance, the Air Ontario Systems Operations Control (SOC) dispatcher should have advised the pilots of Flight 1363 to overfly Dryden on the day in question because of the potential necessity for de-icing with an unserviceable auxiliary power unit (APU) at a station without ground-start facilities.
Inaccurate flight release from SOC. The flight release provided to Flight 1363 contained numerous errors, including an erroneous maximum take-off weight from Winnipeg, incorrect fuel figures for the revised alternate (Sault Ste. Marie) and an incorrect, greater than allowable payload. Similar errors were found in the flight release for the Thunder Bay to Dryden leg. Inaccuracies in flight releases occurred often and pilots would telephone SOC to notify staff of the discrepancies. Because Capt. Marwood did not communicate any problem to SOC, the Dryden Report concludes that throughout 10 March he relied on erroneous information.
Revised forecast not disseminated by SOC. An amended Dryden terminal weather forecast as well as the Dryden terminal weather forecast issued at 16:30 GMT (11 :30 a.m. EST) called for freezing rain at Dryden during the time span of the operation of Flight 1363. Both were available to Air Ontario SOC while Flight 1363 was still on the ground at Thunder Bay. Such information, which could have induced Capt. Marwood to overfly Dryden, was never transmitted to the pilots of Flight 1363.
Failure to follow-up by the ground handler. There was no follow-up by the ground handler to Capt. Marwood's inquiry about the availability of de-icing, even when evidence suggests that the ground handler knew that the wings were covered in snow.
The cabin crew failure to communicate. Both flight attendants were aware of the snow covering the wings, although they never attempted to bring this fact to the attention of the pilots.
As later discussed, serious flaws in organizational processes underlie this unsafe act, including an industry culture which did not (and to a large extent does not) encourage cabin crew to discuss operational matters with flight crews. In all unsafe acts it is possible to identify numerous contributory situational and task factors such as poor communications, time pressure, inadequate tools and equipment, poor procedures and instructions, and inadequate training. Personal factors such as preoccupation, distraction, false perceptions, incomplete or inaccurate knowledge, and mis-perception of hazards, are also readily identifiable. However, flawed organizational processes and latent organizational failures are the source of most unsafe acts committed by operational personnel.
Numerous error-producing conditions led the pilots of Flight 1363 to make the decision to take off without de-icing the wings, and led other operational personnel to commit their unsafe acts. These conditions are the by-product of latent organizational failures. The Commission demonstrated that latent organizational failures generate not only error-producing conditions, but also have the potential to create a working environment where violations are inevitable if operational personnel are to accomplish their assigned tasks.
Ambiguous operating procedures. These ambiguities not only include flight deck procedures, but also maintenance and dispatch procedures. Ambiguities include incomplete information regarding take-off with contamination on the wings and cold weather operations in general, lack of corporate policy regarding hot refueling and de-icing, and the informal "blessing" by management of unapproved procedures carried over from the propeller-driven fleet, including a disregard spread among Convair 580 pilots on the effects of wing contamination. These ambiguities are strictly relevant to the events of 10 March. In the larger picture, however, the Commission's overall appraisal of the F28 operation reflected operational procedures which are not recommended in jet operations.
Lack of standardized operations manuals. Some Air Ontario F28 pilots used the Piedmont F28 Operations Manual while others used the USAir F28 Pilot's Handbook, since Air Ontario did not have its own F28 operations manual. Although both manuals are comprehensive and both obviously deal with the same type of aircraft, there were sufficient differences in the operating procedures of these two carriers to create potential problems on the flight deck. Air Ontario F28 pilots were often left to learn and to discover for themselves what were the best operational flight procedures for the F-28 ... an additional and unnecessary burden on the pilots.
Training deficiencies. Aircraft wing contamination, the cold-soaking phenomenon and runway contamination were subjects in which the Commission verified diverging depths of awareness and understanding among Air Ontario pilots. Lack of CRM training was another shortcoming identified, although CRM or equivalent training cannot alleviate operational problems associated with lack of management stability and consistent direction. Deficiencies in cabin attendant training, ground handling training and aircraft refueling training were also discussed.
Pairing of inexperienced crew members. Although both pilots of Flight 1363 had considerable experience, they were "newcomers" to the F28. Capt Marwood had only 62 hours in the type, and had received his line check on 25 January 1989, after 27.5 hours of line indoctrination. First Officer Mills had 66 hours, having accumulated 29.5 hours of line indoctrination before receiving his line check on 17 February 1989. Although both were legally certificated to operate the F28, evidence both from accident investigations and research has alerted us to the dangers in pairing crew members that are "new" to the type.
Crew frustration. It had not been a good day for the crew of Flight 1363. The unserviceable APU and other deferred maintenance items, the confusion over de-fuelling versus deplaning passengers at Thunder Bay, an inexperienced SOC dispatcher, the absence of ground support facilities, concern over passenger connections and the ground hold for the Cessna 150 are some of the local conditions which fostered crew frustration. The Dryden Report leaves no room for doubt that Capt. Marwood was exhibiting distinct symptoms of stress when he landed in Dryden on the return trip. Stress degrades the ability of humans to process information.
Corporate merger and corporate cultures. Air Ontario is the product of a merger between Austin Airways Ltd. - a northern or "bush" operation- and Air Ontario Ltd. - a scheduled service operation in the region of the Great Lakes. Austin Airways was the "winning" party or buyer; Air Ontario Ltd. the "loser," or acquired company. The two companies were different in almost every respect: their fleets, their operating environments, their employee groups and their management styles. The harsher demands of flying in the Canadian north are qualitatively different than those of flying in the south, demands which were reflected in the experiences of each pilot group. Furthermore, in the non-unionized, northern environment, employee responsibilities were rather unstructured, while in the southern unionized environment, employee tasks were clearly delineated. It was not a happy marriage. The two very different corporate cultures were incompatible; yet, their effects were enduring and difficult to change. Among other conflicts, the negotiations to merge the two pilot groups under the representation of the Canadian Airline Pilots Association (CALPA) ended in a prolonged labor strike, between March and May 1988. As with any corporate rationalization, resources were greatly taxed. The efficiency with which the various organizational processes were managed is worth examining; of immediate relevance to the events of 10 March is the fact that while Capt. Morwood came from Air Ontario Ltd., First Officer Mills came from Austin Airways. The Dryden Report includes the contention that the working relationship between the pilots over the previous two days had probably not been cordial, with the subsequent impact on crew coordination.
Latent organizational failures.
Three distinct groups of high-level management "contributed" in harboring the latent organizational failures which eventually led to the crash of Flight 1363: the operator itself, the regulatory agency and the parent company.
Corporate reorganizations generate anxieties among employee groups. In this case, there is evidence of high management turn over, low employee morale and poor job performance, all with potential effects on flight safety. The period following the merger was turbulent. The basic issue examined by the Commission was " ... whether Air Ontario management was able to support the flight safety imperative during this period of distraction."
In the two years previous to the accident, there had been significant changes in the management of flight operations. There was instability within the flight operations organization, and individuals who had been expected to play a major role in the introduction and management of the F28 programme had left the company. The Dryden Report reveals a situation where effective coordination of efforts had been essential, and which had in stead been characterized by a troubling lack of it as well as of effective management.
Management turnover and selection. There were changes in two critical areas in operational management during the period from June 1987 until 10 March 1989: Vice President of Flight Operations and Director of Flight Operations. The instability and problems of supervision created by the lack of management continuity were an obstacle to the implementation of the changes required by the introduction of a new aircraft type. The Dryden Report introduces evidence that the President and Chief Executive Officer of the company would personally select all senior management personnel, not always based on the merit principle, but rather in what the report describes as " ... the entrepreneurial management style of a man who has built his company from a small family business."
Some of the appointments, such as those of the President's close relatives to key managerial positions, were " ... the subject of considerable discussion at the Air Ontario committee meetings." The outcome of this process was that the operational management of Air Ontario was dominated by individuals whose experience had been mostly in charter operations in the northern, economically regulated environment, while the new company operated in the southern, deregulated environment as a scheduled carrier. Air Ontario managers were thus confronted by demands for which their experience may not have been adequate.
Operational control. Canadian legislation grants operational control departments the functions of flight dispatch and flight following, including the authority to initiate, continue, divert or terminate a flight. Operational control personnel provide a crucial support to flight crews by providing updated information to enable them to make safe and efficient decisions. Such control is indeed intended to prevent circumstances like those presented to Capt. Morwood at Dryden. However, the report pointed out," ... it was stated by all of the operational control personnel who testified that the training and qualification of the Air Ontario dispatchers was inadequate."
The inquiry revealed that when weather was poor, when aircraft had unserviceable equipment or when irregular circumstances were present - situations in which operational control is an asset - SOC performance usually deteriorated. The Commission concluded that this was a consequence " . . . of poor planning and organization within SOC, a lack of training and qualification of Air Ontario SOC personnel, and the failure of SOC personnel to appreciate the importance of their function."
The F28 programme. The introduction of the F28 was the first exposure of Air Ontario's management to the operation of a transport category jet aircraft in commercial scheduled service. The management problems discussed revealed themselves in the various flaws and safety shortcomings within the F28 operation, and can be grouped into two general areas: lack of standard operating procedures, manuals and documentation for the F28, and inconsistencies and deficiencies in training the F28 flight crews, cabin crews and ground support personnel.
Programme management. The F28 project manager had the responsibility to ensure that the implementation and operation of the F28 programme was properly monitored and supervised. The appointed manager- a relative of the president of the company - lacked experience in the F28. On the other hand, he was overburdened beyond reason, since he also had responsibilities as F28 chief pilot, F28 training pilot, F28 company check pilot, Convair 580 chief pilot and F28 line pilot. These combined responsibilities led to an ineffective management of the programme, allowing deterioration of the operational standards below acceptable levels. The report describes the project manager as "a well intentioned individual." It nevertheless must always be remembered that the best intentions, if failed to be carried into deed, are as good as no intentions at all.
Maintenance management. Senior maintenance management was stable during the period June 1987 to 10 March 1989. Nevertheless, numerous maintenance problems were evident in the F28 operation, including lack of familiarity with the aircraft and an aircraft purchase decision which did not include an adequate supply of spare parts. This, combined with the enthusiasm and subsequent organizational over-commitment to the F28, pressured maintenance personnel and pilots alike to defer and carry maintenance snags for long periods of time.
Safety management. Although mission statements included flight safety as part of Air Ontario's objectives, compelling evidence presented in the Dryden Report suggests a rather haphazard approach, ala "safety is everybody's responsibility" (if employees do their jobs correctly, then safety will be optimized). Such a simplistic view denies the technological and sociological realities of contemporary aviation - realities which impose the imperative of professional safety management. Air Ontario's flight safety officer had resigned in late 1987 because of lack of management support, including the lack of access to the CEO. He was not replaced, and the position remained vacant until February 1989, although Air Ontario suffered a fatal accident which involved a Douglas DC-3 in November 1988.
The lack of continuity in the position of a /light safety officer, the lack of adequate support of the FSO position by senior management, and the lack of a flight safety organization over the material time span was a managerial omission. The management assigned a low priority to the importance of filling the vacant position of FSO. This period of instability, carried over into the introduction of the F28 programme, had an impact on flight safety. Air Ontario was not ready in June 1988 to put the F28 aircraft into service as public carrier.
The regulatory authority
Transport Canada is the federal agency that is responsible to the people of Canada for ensuring that aviation is carried out effectively at an acceptable level of safety. The 1980s had not been a sympathetic decade to Transport Canada. Economic deregulation- a policy of the federal government - had brought a considerable increase in workload, while at the same time measures aimed at federal deficit reduction had led to downsizing of the workforce. This produced a situation where the agency saw its ability for surveillance, inspection and monitoring greatly reduced. Numerous warning flags were raised by different sectors within the Canadian aviation industry, with little or no effect. The decrease in personnel, inadequate training policies and supporting programmes, and mismanagement of human resources led to a state of affairs where Transport Canada was in a very precarious position to discharge its responsibilities in a timely and effective manner.
Regulatory audit of Air Ontario. An audit of Air Ontario by Transport Canada was scheduled for February 1988. While the airworthiness, passenger safety, and dangerous goods portions of the audit were completed as scheduled, the operations part of it was postponed because Air Ontario did not have an approved flight manual in place. The operations portion was re-scheduled for June 1988 and eventually conducted between October and November 1988. Because the audit team leader had no jet experience, the audit did not cover the F28 programme. The Dryden Report considers this " . . . a serious omission. Had the F28 been audited, it is reasonable to assume that a number of deficiencies relating to Air Ontario's F28 operation would have been discovered prior to the Dryden crash."
Notwithstanding federal policy to release audit reports within 10 working days of the completion of the audit, Air Ontario was not presented with a report until after the crash, more than five months after the audit had been completed. The Dryden Report characterized the Transport Canada audit of Air Ontario as " ...poorly organized, incomplete and ineffective."
The operating rules. The inquiry accumulated evidence that existing regulations applicable to Canadian air carriers were " . . . deficient, outdated and in need of overhaul and outright replacement." Areas in which deficiencies were identified, or in which there existed no regulations at all, included flight dispatch requirements, minimum equipment lists, shoulder harnesses for flight attendants, approval of aircraft operating manuals, and qualifications for air carrier managerial personnel. The hearings also disclosed ambiguity of aviation regulations and air navigation orders. In the case of the minimum equipment list (MEL), none of the witnesses could define with reasonable precision one of its most critical terms: essential airworthiness item.
As another case in point, the pilots of C-FONF carried two aircraft operating manuals, different in form and contents, and without amendment service (Capt. Marwood had the Piedmont manual and F /0 Mills had the USAir manual). Neither manual was approved by Transport Canada, since no regulatory requirement existed to this effect. Transport Canada operational staff who testified at the inquiry were unanimous in their views about the inadequacy of existing regulations and " ... the chronic inaction on the part of Transport Canada senior management in many areas of urgent concern... ".
Safety management. The inquiry revealed that because of resource constraints, an inadequate regulatory framework and organizational deficiencies, Transport Canada was not ideally able to ensure an efficient and uniform level of safety. Deficiencies uncovered included distinctly separated lines of reporting to the top of the organization and the apparent inability of different internal groups to work together in identifying and addressing safety issues. The Commission also expressed concern that Transport Canada was " ... spending too much energy on minor violations that were of little safety consequence, while not enough effort was being put into overall education and safety promotion."
The Dryden Report concluded that Transport Canada:
• did not provide clear guidance for carriers and crews regarding the need for deicing;
• did not enforce the provision of performance data on contaminated runways;
• did not closely monitor Air Ontario for regulatory compliance following the merger and during the initiation of the jet service;
• did not require licensing or effective training of flight dispatchers;
• did not provide clear requirements for the qualification of candidates to management positions, including director of flight operations, chief pilot and company check pilot;
• did not develop a policy for the training and operational priorities of air carrier inspectors;
• delayed the audit of Air Ontario and did not include the F-28 programme in it;
• followed an excessively complex MEL approval process; and
• did not have a clear definition of what constitutes an essential airworthiness item.
The report stated that these oversights and flaws nurtured the trajectory of opportunity and, combined with local triggers at Dryden on 10 March 1989, led to a break in the system defenses, safeguards and barriers, permitting the accident.
Air Ontario, as a commercial air carrier, was not operating in a vacuum. Transport Canada, as the regulator, had a duty to prevent the serious operational deficiencies in the F28 programme. Had the regulator been more diligent in scrutinizing the F28 implementation at Air Ontario, many of the operational deficiencies that had a bearing on the crash of flight 1363 could have been avoided.
The parent company.
The controlling interest in Air Ontario was owned by Air Canada. Air Ontario was marketed as part of Air Canada's network, and a public perception of an integrated company had been fostered. Air Canada dedicated a significant effort to present a close integration in the marketing functions. These marketing efforts had been rewarded by a measure of success; many of the passengers of Flight 1363 believed that they were in fact flying with Air Canada. In specific relation to the crash of Flight 1363, the Commission raised the issue of the lack of application of Air Canada's expertise in scheduled jet operations to the Air Ontario F28 programme. The evidence in the report reveals that " ...these initiatives were not in any way directed towards verifying and monitoring the operational procedures and flight safety standards of its new subsidiary. On the contrary, Air Canada deliberately maintained its corporate distance from the operational end of Air Ontario."
The regulatory standards defined by Transport Canada- and by any other civil aviation administration - represent minimum standards, referred to in the Dryden Report as "the threshold level of operational safety." The evidence demonstrates that Air Canada operated at a greater level of safety than that required by Transport Canada. The evidence also demonstrates that Air Canada management" ... while imposing on Air Ontario its own high marketing standards, required Air Ontario only to comply with Transport Canada's threshold operational safety standards."
The report discusses Air Canada's lack of support to Air Ontario during the introduction of the jet service, and compares standards in specific areas such as operational policies for dispatch with an unserviceable APU; minimum equipment lists; manuals; aircraft defects; hot refueling policies; de-icing policies; operational control and flight planning and dispatcher training.
The evidence reveals the existence of a double safety standard. The report also reviews Air Canada's flight safety organization and its involvement with Air Ontario. In spite of the fact that Air Canada had significant experience in introducing jet service (on several types), this experience was not made available to Air Ontario when it introduced F28 service. The assistance Air Canada planned to provide its connector was limited to the provision of information relating to flight safety and playback facilities for flight data recorders. In practice, this intention was further reduced to a post-accident response seminar in 1985 and another in May 1989, three months after Dryden. The report also describes with detail Air Canada's flight safety organization, leaving no room for doubt about its importance and the corporate commitment which supported it. The double standards again become obvious when reviewing Air Ontario's flight safety organization. The director of flight safety for Air Canada testified that he was under the impression that Air Ontario had a flight safety officer. It did not. He also assumed that computer recording and trend analysis was being carried out by Air Ontario. It was not. When asked about the degree of integration between the flight safety organizations of the parent company and the subsidiary, he conceded that there was none. Lastly, the representative of Air Canada on the board of directors of Air Ontario appeared to be unaware that for more than one year and during the crucial time frame of the F28 introduction, there was no flight safety officer or flight safety organization in Air Ontario.
The Dryden Report found: "... The corporate mission statements of Air Canada and Air Ontario both contain words to the effect of the primacy of safety considerations. The evidence disclosed that other corporate concerns, important in their own right, were allowed to intervene and subordinate safety. The difference between the attention and resources expended by Air Canada and Air Ontario on marketing, as compared with safety of operations, must, when held up to their respective mission statements, be described as inadequate and short-sighted."
When the moment arrived to close the file, the evidence obtained and discussed over 20 grueling months Jed Justice Moshansky to conclude: "Capt. Marwood, as the pilot-in-command, must bear responsibility for the decision to land and take off in Dryden on the day in question. However, it is equally clear that the air transportation system failed him by allowing him to be placed in a situation where he did not have all the necessary tools that should have supported him in making the proper decision."
This statement holds the key to securing and advancing safety and effectiveness in modern, complex socio-technical systems. The captain, first officer, cabin crew, SOC dispatchers, ground handler and other personnel involved in the operational events surrounding Flight 1363 fail ed in their role as the last line of defense and thereby precipitated the accident. For this, they must be held accountable. If we are looking for scapegoats, we need go no further. But if what we seek is to avoid future tragedies like Dryden, we must examine the organizational processes which generate gaps in the system defenses and induce properly qualified, healthy and well-intentioned individuals to make such damaging mistakes.
The message from the Dryden Report is two-fold. On the one hand, there should be no doubt: there is still no substitute for a properly trained, professional flight crew; they are the goalkeepers of aviation safety. On the other hand, no matter how hard they try and no matter how professional they might be, humans can never be expected to outperform the system which bounds and constrains them. System flaws will, sooner or later, defeat individual human performance.
So, are we absolving the humans of their mistakes by blaming the Organizations? Are we trying to escape responsibilities? Are we looking for ways to save humans from culpability? We will discuss these questions in the next post.
The Erring Human.