There is no better example of how Organizational deficiencies can precipitate Human Error than the crash of Air Ontario Flight 1363 at Dryden on 10 March 1989.
Ice and snow on the wings of a Fokker F-28 Fellowship commuter plane
caused the crash of this aircraft minutes after take-off near Dryden
Ontario, Canada
Flight 1363 departed from Thunder Bay, Ontario at 11:55 am on March
10th, 1989 and landed in Dryden an hour later for refueling and
passenger discharge/boarding before heading on to its final destination
of Winnipeg, Manitoba.
As a rule, Dryden is not a normal refueling site but the small plane
was restricted on the amount of fuel it could take on due to having a
full passenger load. Having a full fuel tank meant the aircraft would
have exceeded the maximum weight allowance. Dryden airport was not a
full-service facility and this caused a problem for the pilot, Captain
George C. Morwood.
Stopover at Dryden Airport
There were no ground start facilities at the Dryden airport;
therefore, Captain Morwood could not re-start the main engines if they
were turned off. The Auxiliary Power Unit (APU) located at the rear of
the plane, could have been used to re-start the engines but the APU was
not working on this particular aircraft.
As a result, Captain Morwood was forced to keep the main engines
running while refueling the plane. A thin layer of ice and snow had
accumulated on the wings of the plane but de-icing fluid could not be
used when the main engines were running due to the chance of toxic fumes
leaking into the cabin.
Approximately 40 minutes later, Air Ontario Flight 1363 departed the
Dryden airport with 65 passengers and 4 crew members on board. The plane
did not gain altitude and it flew through the trees. It crashed and
caught fire less than one mile from the runway resulting in the death of
24 people and severe injuries to most of the 45 survivors.
Cause of the Crash of Air Ontario Flight 1363.
A judicial inquiry was held under the supervision of Honorable Virgil
P. Moshansky. The cause of the crash was attributed to the recent
airline deregulation, which exercised less stringent safety procedures,
equipment maintenance in addition to insufficient pilot training.
The aircraft was
operating with an excessive number of un-rectified defects, the aircraft
should not have been scheduled to refuel at an airport which did not
have proper equipment and that neither training nor manuals had
sufficiently warned the pilot of the dangers of ice on the wings.
Learning from the Tragedy.
While
there is no denying that the flight crew of Air Ontario 1363 failed in
its role as the last line of defense against system deficiencies,
however, not all unsafe acts surrounding the crash of Flight 1363 were
committed by the flight crew. Other operational personnel, including
ground handlers, dispatchers and even the cabin crew, contributed by
their actions or in actions to deny Capt. George Marwood and First
Officer Keith Mills feedback which could eventually have contained the
consequences of their own unsafe acts. Arguably, many unsafe acts were
none other than the behaviors fostered by the system and therefore the
behaviors different personnel perceived the system expected from them.
Let us analyze the cause factors one by one.
No ground de-icing by the flight crew.
The failure to de-ice was clearly the most obvious unsafe act committed
by the crew of Flight 1363. That Capt. Marwood was of a conservative
nature and conscious about de-icing is a matter of record. Earlier on
the very day of the accident, for example, he had de-iced C-FONF before
departing Winnipeg because of a layer of frost over its wings. He had
walked to the terminal in his shirtsleeves; it is impossible that he was
not aware of the weather conditions. His decision not to de-ice at
Dryden demands more than the simplistic observation that "with his
experience, he should have known better." Capt. Marwood did not choose
to make a bad decision. His error on 10 March 1989 must be understood
within the context and the constraints in which it was made.
No walk-around by the flight crew.
Neither flight crew member per formed an exterior walk-around
inspection. It remains, however, a matter of argument whether such a
walk-around would have accomplished anything, given the inaccurate and
incomplete knowledge regarding wing contamination that existed among Air
Ontario's crews at the time of the accident.
Dispatch with unserviceable APU by SOC.
Had he followed the operational restrictions contained in a company's
memorandum issued by the director of maintenance, the Air Ontario
Systems Operations Control (SOC) dispatcher should have advised the
pilots of Flight 1363 to overfly Dryden on the day in question because
of the potential necessity for de-icing with an unserviceable auxiliary
power unit (APU) at a station without ground-start facilities.
Inaccurate flight release from SOC.
The flight release provided to Flight 1363 contained numerous errors,
including an erroneous maximum take-off weight from Winnipeg, incorrect
fuel figures for the revised alternate (Sault Ste. Marie) and an
incorrect, greater than allowable payload. Similar errors were found in
the flight release for the Thunder Bay to Dryden leg. Inaccuracies in
flight releases occurred often and pilots would telephone SOC to notify
staff of the discrepancies. Because Capt. Marwood did not communicate
any problem to SOC, the Dryden Report concludes that throughout 10 March
he relied on erroneous information.
Revised forecast not disseminated by SOC. An amended Dryden
terminal weather forecast as well as the Dryden terminal weather
forecast issued at 16:30 GMT (11 :30 a.m. EST) called for freezing rain
at Dryden during the time span of the operation of Flight 1363. Both
were available to Air Ontario SOC while Flight 1363 was still on the
ground at Thunder Bay. Such information, which could have induced Capt.
Marwood to overfly Dryden, was never transmitted to the pilots of Flight
1363.
Failure to follow-up by the ground handler. There was no
follow-up by the ground handler to Capt. Marwood's inquiry about the
availability of de-icing, even when evidence suggests that the ground
handler knew that the wings were covered in snow.
The cabin crew failure to communicate.
Both flight attendants were aware of the snow covering the wings,
although they never attempted to bring this fact to the attention of the
pilots.
As
later discussed, serious flaws in organizational processes underlie
this unsafe act, including an industry culture which did not (and to a
large extent does not) encourage cabin crew to discuss operational
matters with flight crews. In all unsafe acts it is possible to identify
numerous contributory situational and task factors such as poor
communications, time pressure, inadequate tools and equipment, poor
procedures and instructions, and inadequate training. Personal factors
such as preoccupation, distraction, false perceptions, incomplete or
inaccurate knowledge, and mis-perception of hazards, are also readily
identifiable. However, flawed organizational processes and latent
organizational failures are the source of most unsafe acts committed by
operational personnel.
Error-producing conditions.
Numerous error-producing conditions led the pilots of Flight 1363 to
make the decision to take off without de-icing the wings, and led other
operational personnel to commit their unsafe acts. These conditions are
the by-product of latent organizational failures. The Commission
demonstrated that latent organizational failures generate not only
error-producing conditions, but also have the potential to create a
working environment where violations are inevitable if operational
personnel are to accomplish their assigned tasks.
Ambiguous operating procedures. These ambiguities not only
include flight deck procedures, but also maintenance and dispatch
procedures. Ambiguities include incomplete information regarding
take-off with contamination on the wings and cold weather operations in
general, lack of corporate policy regarding hot refueling and de-icing,
and the informal "blessing" by management of unapproved procedures
carried over from the propeller-driven fleet, including a disregard
spread among Convair 580 pilots on the effects of wing contamination.
These ambiguities are strictly relevant to the events of 10 March. In
the larger picture, however, the Commission's overall appraisal of the
F28 operation reflected operational procedures which are not recommended
in jet operations.
Lack of standardized operations manuals.
Some Air Ontario F28 pilots used the Piedmont F28 Operations Manual
while others used the USAir F28 Pilot's Handbook, since Air Ontario did
not have its own F28 operations manual. Although both manuals are
comprehensive and both obviously deal with the same type of aircraft,
there were sufficient differences in the operating procedures of these
two carriers to create potential problems on the flight deck. Air
Ontario F28 pilots were often left to learn and to discover for
themselves what were the best operational flight procedures for the F-28
... an additional and unnecessary burden on the pilots.
Training deficiencies.
Aircraft wing contamination, the cold-soaking phenomenon and runway
contamination were subjects in which the Commission verified diverging
depths of awareness and understanding among Air Ontario pilots. Lack of
CRM training was another shortcoming identified, although CRM or
equivalent training cannot alleviate operational problems associated
with lack of management stability and consistent direction. Deficiencies
in cabin attendant training, ground handling training and aircraft
refueling training were also discussed.
Pairing of inexperienced crew members. Although both pilots of
Flight 1363 had considerable experience, they were "newcomers" to the
F28. Capt Marwood had only 62 hours in the type, and had received his
line check on 25 January 1989, after 27.5 hours of line indoctrination.
First Officer Mills had 66 hours, having accumulated 29.5 hours of line
indoctrination before receiving his line check on 17 February 1989.
Although both were legally certificated to operate the F28, evidence
both from accident investigations and research has alerted us to the
dangers in pairing crew members that are "new" to the type.
Crew frustration. It had not been a good day for the crew of
Flight 1363. The unserviceable APU and other deferred maintenance items,
the confusion over de-fuelling versus deplaning passengers at Thunder
Bay, an inexperienced SOC dispatcher, the absence of ground support
facilities, concern over passenger connections and the ground hold for
the Cessna 150 are some of the local conditions which fostered crew
frustration. The Dryden Report leaves no room for doubt that Capt.
Marwood was exhibiting distinct symptoms of stress when he landed in
Dryden on the return trip. Stress degrades the ability of humans to
process information.
Corporate merger and corporate cultures. Air Ontario is the
product of a merger between Austin Airways Ltd. - a northern or "bush"
operation- and Air Ontario Ltd. - a scheduled service operation in the
region of the Great Lakes. Austin Airways was the "winning" party or
buyer; Air Ontario Ltd. the "loser," or acquired company. The two
companies were different in almost every respect: their fleets, their
operating environments, their employee groups and their management
styles. The harsher demands of flying in the Canadian north are
qualitatively different than those of flying in the south, demands which
were reflected in the experiences of each pilot group. Furthermore, in
the non-unionized, northern environment, employee responsibilities were
rather unstructured, while in the southern unionized environment,
employee tasks were clearly delineated. It was not a happy marriage. The
two very different corporate cultures were incompatible; yet, their
effects were enduring and difficult to change. Among other conflicts,
the negotiations to merge the two pilot groups under the representation
of the Canadian Airline Pilots Association (CALPA) ended in a prolonged
labor strike, between March and May 1988. As with any corporate
rationalization, resources were greatly taxed. The efficiency with which
the various organizational processes were managed is worth examining;
of immediate relevance to the events of 10 March is the fact that while
Capt. Morwood came from Air Ontario Ltd., First Officer Mills came from
Austin Airways. The Dryden Report includes the contention that the
working relationship between the pilots over the previous two days had
probably not been cordial, with the subsequent impact on crew
coordination.
Latent organizational failures.
Three distinct groups of high-level management "contributed" in
harboring the latent organizational failures which eventually led to the
crash of Flight 1363: the operator itself, the regulatory agency and
the parent company.
Corporate
reorganizations generate anxieties among employee groups. In this case,
there is evidence of high management turn over, low employee morale and
poor job performance, all with potential effects on flight safety. The
period following the merger was turbulent. The basic issue examined by
the Commission was " ... whether Air Ontario management was able to
support the flight safety imperative during this period of
distraction."
In
the two years previous to the accident, there had been significant
changes in the management of flight operations. There was instability
within the flight operations organization, and individuals who had been
expected to play a major role in the introduction and management of the
F28 programme had left the company. The Dryden Report reveals a
situation where effective coordination of efforts had been essential,
and which had in stead been characterized by a troubling lack of it as
well as of effective management.
Management turnover and selection.
There were changes in two critical areas in operational management
during the period from June 1987 until 10 March 1989: Vice President of
Flight Operations and Director of Flight Operations. The instability and
problems of supervision created by the lack of management continuity
were an obstacle to the implementation of the changes required by the
introduction of a new aircraft type. The Dryden Report introduces
evidence that the President and Chief Executive Officer of the company
would personally select all senior management personnel, not always
based on the merit principle, but rather in what the report describes as
" ... the entrepreneurial management style of a man who has built his
company from a small family business."
Some
of the appointments, such as those of the President's close relatives
to key managerial positions, were " ... the subject of considerable
discussion at the Air Ontario committee meetings." The outcome of this
process was that the operational management of Air Ontario was dominated
by individuals whose experience had been mostly in charter operations
in the northern, economically regulated environment, while the new
company operated in the southern, deregulated environment as a scheduled
carrier. Air Ontario managers were thus confronted by demands for
which their experience may not have been adequate.
Operational control.
Canadian legislation grants operational control departments the
functions of flight dispatch and flight following, including the
authority to initiate, continue, divert or terminate a flight.
Operational control personnel provide a crucial support to flight crews
by providing updated information to enable them to make safe and
efficient decisions. Such control is indeed intended to prevent
circumstances like those presented to Capt. Morwood at Dryden. However,
the report pointed out," ... it was stated by all of the operational
control personnel who testified that the training and qualification of
the Air Ontario dispatchers was inadequate."
The inquiry revealed that when weather was poor, when aircraft had
unserviceable equipment or when irregular circumstances were present -
situations in which operational control is an asset - SOC performance
usually deteriorated. The Commission concluded that this was a
consequence " . . . of poor planning and organization within SOC, a lack
of training and qualification of Air Ontario SOC personnel, and the
failure of SOC personnel to appreciate the importance of their
function."
The F28 programme.
The introduction of the F28 was the first exposure of Air Ontario's
management to the operation of a transport category jet aircraft in
commercial scheduled service. The management problems discussed revealed
themselves in the various flaws and safety shortcomings within the F28
operation, and can be grouped into two general areas: lack of standard
operating procedures, manuals and documentation for the F28, and
inconsistencies and deficiencies in training the F28 flight crews, cabin
crews and ground support personnel.
Programme management. The F28 project manager had the
responsibility to ensure that the implementation and operation of the
F28 programme was properly monitored and supervised. The appointed
manager- a relative of the president of the company - lacked experience
in the F28. On the other hand, he was overburdened beyond reason, since
he also had responsibilities as F28 chief pilot, F28 training pilot, F28
company check pilot, Convair 580 chief pilot and F28 line pilot. These
combined responsibilities led to an ineffective management of the
programme, allowing deterioration of the operational standards below
acceptable levels. The report describes the project manager as "a well
intentioned individual." It nevertheless must always be remembered that
the best intentions, if failed to be carried into deed, are as good as
no intentions at all.
Maintenance management. Senior maintenance management was
stable during the period June 1987 to 10 March 1989. Nevertheless,
numerous maintenance problems were evident in the F28 operation,
including lack of familiarity with the aircraft and an aircraft purchase
decision which did not include an adequate supply of spare parts. This,
combined with the enthusiasm and subsequent organizational
over-commitment to the F28, pressured maintenance personnel and pilots
alike to defer and carry maintenance snags for long periods of time.
Safety management. Although mission statements included flight
safety as part of Air Ontario's objectives, compelling evidence
presented in the Dryden Report suggests a rather haphazard approach,
ala "safety is everybody's responsibility" (if employees do their jobs
correctly, then safety will be optimized). Such a simplistic view denies
the technological and sociological realities of contemporary aviation -
realities which impose the imperative of professional safety
management. Air Ontario's flight safety officer had resigned in late
1987 because of lack of management support, including the lack of access
to the CEO. He was not replaced, and the position remained vacant until
February 1989, although Air Ontario suffered a fatal accident which
involved a Douglas DC-3 in November 1988.
The
lack of continuity in the position of a /light safety officer, the lack
of adequate support of the FSO position by senior management, and the
lack of a flight safety organization over the material time span was a
managerial omission. The management assigned a low priority to the
importance of filling the vacant position of FSO. This period of
instability, carried over into the introduction of the F28 programme,
had an impact on flight safety. Air Ontario was not ready in June 1988
to put the F28 aircraft into service as public carrier.
The regulatory authority
Transport
Canada is the federal agency that is responsible to the people of
Canada for ensuring that aviation is carried out effectively at an
acceptable level of safety. The 1980s had not been a sympathetic decade
to Transport Canada. Economic deregulation- a policy of the federal
government - had brought a considerable increase in workload, while at the same
time measures aimed at federal deficit reduction had led to downsizing
of the workforce. This produced a situation where the agency saw its
ability for surveillance, inspection and monitoring greatly reduced.
Numerous warning flags were raised by different sectors within the
Canadian aviation industry, with little or no effect. The decrease in
personnel, inadequate training policies and supporting programmes, and
mismanagement of human resources led to a state of affairs where
Transport Canada was in a very precarious position to discharge its
responsibilities in a timely and effective manner.
Regulatory audit of Air Ontario.
An audit of Air Ontario by Transport Canada was scheduled for February
1988. While the airworthiness, passenger safety, and dangerous goods
portions of the audit were completed as scheduled, the operations part
of it was postponed because Air Ontario did not have an approved flight
manual in place. The operations portion was re-scheduled for June 1988
and eventually conducted between October and November 1988. Because the
audit team leader had no jet experience, the audit did not cover the F28
programme. The Dryden Report considers this " . . . a serious omission.
Had the F28 been audited, it is reasonable to assume that a number of
deficiencies relating to Air Ontario's F28 operation would have been discovered prior to the Dryden crash."
Notwithstanding federal policy to release audit reports within 10
working days of the completion of the audit, Air Ontario was not
presented with a report until after the crash, more than five months
after the audit had been completed. The Dryden Report characterized the
Transport Canada audit of Air Ontario as " ...poorly organized,
incomplete and ineffective."
The operating rules. The inquiry accumulated evidence that
existing regulations applicable to Canadian air carriers were " . . .
deficient, outdated and in need of overhaul and outright replacement."
Areas in which deficiencies were identified, or in which there existed
no regulations at all, included flight dispatch requirements, minimum
equipment lists, shoulder harnesses for flight attendants, approval of
aircraft operating manuals, and qualifications for air carrier
managerial personnel. The hearings also disclosed ambiguity of aviation
regulations and air navigation orders. In the case of the minimum equipment list (MEL), none of the witnesses
could define with reasonable precision one of its most critical terms:
essential airworthiness item.
As another case in point, the pilots of C-FONF carried two aircraft
operating manuals, different in form and contents, and without amendment
service (Capt. Marwood had the Piedmont manual and F /0 Mills had the
USAir manual). Neither manual was approved by Transport Canada, since no
regulatory requirement existed to this effect. Transport Canada
operational staff who testified at the inquiry were unanimous in their
views about the inadequacy of existing regulations and " ... the chronic
inaction on the part of Transport Canada senior management in many
areas of urgent concern... ".
Safety management. The inquiry revealed that because of
resource constraints, an inadequate regulatory framework and
organizational deficiencies, Transport Canada was not ideally able to
ensure an efficient and uniform level of safety. Deficiencies uncovered
included distinctly separated lines of reporting to the top of the
organization and the apparent inability of different internal groups to
work together in identifying and addressing safety issues. The
Commission also expressed concern that Transport Canada was " ...
spending too much energy on minor violations that were of little safety
consequence, while not enough effort was being put into overall
education and safety promotion."
The Dryden Report concluded that Transport Canada:
• did not provide clear guidance for carriers and crews regarding the need for deicing;
• did not enforce the provision of performance data on contaminated runways;
• did not closely monitor Air Ontario for regulatory compliance
following the merger and during the initiation of the jet service;
• did not require licensing or effective training of flight dispatchers;
• did not provide clear requirements for the qualification of
candidates to management positions, including director of flight
operations, chief pilot and company check pilot;
• did not develop a policy for the training and operational priorities of air carrier inspectors;
• delayed the audit of Air Ontario and did not include the F-28 programme in it;
• followed an excessively complex MEL approval process; and
• did not have a clear definition of what constitutes an essential airworthiness item.
The
report stated that these oversights and flaws nurtured the trajectory
of opportunity and, combined with local triggers at Dryden on 10 March
1989, led to a break in the system defenses, safeguards and barriers,
permitting the accident.
Air
Ontario, as a commercial air carrier, was not operating in a vacuum.
Transport Canada, as the regulator, had a duty to prevent the serious
operational deficiencies in the F28 programme. Had the regulator been
more diligent in scrutinizing the F28 implementation at Air Ontario,
many of the operational deficiencies that had a bearing on the crash of
flight 1363 could have been avoided.
The parent company.
The
controlling interest in Air Ontario was owned by Air Canada. Air
Ontario was marketed as part of Air Canada's network, and a public
perception of an integrated company had been fostered. Air Canada
dedicated a significant effort to present a close integration in the
marketing functions. These marketing efforts had been rewarded by a
measure of success; many of the passengers of Flight 1363 believed that
they were in fact flying with Air Canada. In specific relation to the
crash of Flight 1363, the Commission raised the issue of the lack of
application of Air Canada's expertise in scheduled jet operations to the
Air Ontario F28 programme. The evidence in the report reveals that "
...these initiatives were not in any way directed towards verifying and
monitoring the operational procedures and flight safety standards of its
new subsidiary. On the contrary, Air Canada deliberately maintained its corporate distance from the operational end of Air Ontario."
The regulatory standards defined by Transport Canada- and by any other
civil aviation administration - represent minimum standards, referred to
in the Dryden Report as "the threshold level of operational safety."
The evidence demonstrates that Air Canada operated at a greater level of
safety than that required by Transport Canada. The evidence also
demonstrates that Air Canada management" ... while imposing on Air
Ontario its own high marketing standards, required Air Ontario only to
comply with Transport Canada's threshold operational safety standards."
The
report discusses Air Canada's lack of support to Air Ontario during the
introduction of the jet service, and compares standards in specific
areas such as operational policies for dispatch with an unserviceable
APU; minimum equipment lists; manuals; aircraft defects; hot refueling
policies; de-icing policies; operational control and flight planning and
dispatcher training.
The evidence reveals the existence of a double safety standard. The report also reviews Air Canada's flight safety organization and its involvement with Air Ontario. In
spite of the fact that Air Canada had significant experience in
introducing jet service (on several types), this experience was not made
available to Air Ontario when it introduced F28 service. The assistance
Air Canada planned to provide its connector was limited to the
provision of information relating to flight safety and playback
facilities for flight data recorders. In practice, this intention was
further reduced to a post-accident response seminar in 1985 and another
in May 1989, three months after Dryden. The report also describes with
detail Air Canada's flight safety organization, leaving no room for
doubt about its importance and the corporate commitment which supported
it. The double standards again become obvious when reviewing Air
Ontario's flight safety organization. The director of flight safety for
Air Canada testified that he was under the impression that Air Ontario
had a flight safety officer. It did not. He also assumed that computer
recording and trend analysis was being carried out by Air Ontario. It
was not. When asked about the degree of integration between the flight
safety organizations of the parent company and the subsidiary, he
conceded that there was none. Lastly, the representative of Air Canada
on the board of directors of Air Ontario appeared to be unaware that for
more than one year and during the crucial time frame of the F28
introduction, there was no flight safety officer or flight safety
organization in Air Ontario.
In conclusion.
The Dryden Report found: "... The corporate mission
statements of Air Canada and Air Ontario both contain words to the
effect of the primacy of safety considerations. The evidence disclosed
that other corporate concerns, important in their own right, were
allowed to intervene and subordinate safety. The difference between the
attention and resources expended by Air Canada and Air Ontario on
marketing, as compared with safety of operations, must, when held up to
their respective mission statements, be described as inadequate and
short-sighted."
When
the moment arrived to close the file, the evidence obtained and
discussed over 20 grueling months Jed Justice Moshansky to conclude:
"Capt. Marwood, as the pilot-in-command, must bear responsibility for
the decision to land and take off in Dryden on the day in question.
However, it is equally clear that the air transportation system failed
him by allowing him to be placed in a situation where he did not have
all the necessary tools that should have supported him in making the
proper decision."
This
statement holds the key to securing and advancing safety and
effectiveness in modern, complex socio-technical systems. The captain,
first officer, cabin crew, SOC dispatchers, ground handler and other
personnel involved in the operational events surrounding Flight 1363
fail ed in their role as the last line of defense and thereby
precipitated the accident. For this, they must be held accountable. If
we are looking for scapegoats, we need go no further. But if what we
seek is to avoid future tragedies like Dryden, we must examine the
organizational processes which generate gaps in the system defenses and
induce properly qualified, healthy and well-intentioned individuals to
make such damaging mistakes.
The
message from the Dryden Report is two-fold. On the one hand, there
should be no doubt: there is still no substitute for a properly trained,
professional flight crew; they are the goalkeepers of aviation safety.
On the other hand, no matter how hard they try and no matter how
professional they might be, humans can never be expected to outperform
the system which bounds and constrains them. System flaws will, sooner
or later, defeat individual human performance.
So,
are we absolving the humans of their mistakes by blaming the
Organizations? Are we trying to escape responsibilities? Are we looking
for ways to save humans from culpability? We will discuss these
questions in the next post.
Until then,
The Erring Human.
