Using Reason’s Model of Organisational Accidents in Formalising Accident Reports

This paper proposes a method for analysing what are called organisational accidents. The first step of the method involves using Reason’s model of organisational failures. This provides heuristic guidance in identifying both the active and latent conditions that lead to major failures. The second step involves applying formal methods to support a detailed analysis of each latent and active condition. The method is demonstrated on a case study: the railway accident at Watford Junction in the United Kingdom. Analysis of the formal model helps to identify organisational factors that might have prevented the accident. It also helps to identify weaknesses in the report itself. In particular we argue that a signalling standard was misunderstood, the consequences of which could lead to another serious accident.     

Cognitive failure analysis for aircraft accident investigation

Abstract

The present studies were undertaken to investigate the applicability of an information processing approach to human failure in the aircraft cockpit. Using data obtained from official aircraft accident investigation reports, a database of accidents and incidents involving New Zealand civil aircraft between 1982 and 1991 was compiled. In the first study, reports were coded into one of three error stages proposed by Nagel (1988) and for the presence of any of 61 specific errors noted by Gerbert and Kemmler (1986). The importance of decisional factors in fatal crashes was noted. Principal components analysis suggested the presence of five different varieties of human failure. In the second study, a more detailed error taxonomy derived from the work of Rasmussen (1982) was applied to the data. Goal selection errors emerged as the most frequent kind of cognitive error in fatal accidents. Aircraft accident reports can be a useful source of information about cognitive failures if probed with an appropriate, theoretically-based, analysis of information processing errors. Such an approach could provide the accident investigators with a useful tool, and lead to a more complete understanding of human error in aviation.     

Errors and violations on the roads: a real distinction?

In considering the human contribution to accidents, it seems necessary to make a distinction between errors and violations; two forms of aberration which may have different psychological origins and demand different modes of remediation. The present study investigated whether this distinction was justified for self-reported driver behaviour. Five hundred and twenty drivers completed a driver behaviour questionnaire (DBQ) which asked them to judge the frequency with which they committed various types of errors and violations when driving. Three fairly robust factors were identified: violations, dangerous errors, and relatively harmless lapses, respectively. Violations declined with age, errors did not. Men of all ages reported more violations than women. Women, however, were significantly more prone to harmless lapses (or more honest) than men. These findings were consistent with the view that errors and violations are indeed mediated by different psychological mechanisms. Violations require explanation in terms of social and motivational factors, whereas errors (slips, lapses, and mistakes) may be accounted for by reference to the information-processing characteristics of the individual.     

A systems-theoretic approach to safety in software-intensive systems

Traditional accident models were devised to explain losses caused by failures of physical devices in relatively simple systems. They are less useful for explaining accidents in software-intensive systems and for nontechnical aspects of safety such as organizational culture and human decision-making. This paper describes how systems theory can be used to form new accident models that better explain system accidents (accidents arising from the interactions among components rather than individual component failure), software-related accidents, and the role of human decision-making. Such models consider the social and technical aspects of systems as one integrated process and may be useful for other emergent system properties such as security. The loss of a Milstar satellite being launched by a Titan/Centaur launch vehicle is used as an illustration of the approach.     

Unsafe acts and unsafe outcomes in aircraft maintenance

Road safety studies using the Driver Behaviour Questionnaire (DBQ) have provided support for a three-way distinction between violations, skill-based errors and mistakes, and have indicated that a tendency to commit driving violations is associated with an increased risk of accident involvement. The aims of this study were to examine whether the three-way distinction of unsafe acts is applicable in the context of aircraft maintenance, and whether involvement in maintenance safety occurrences can be predicted on the basis of self-reported unsafe acts. A Maintenance Behaviour Questionnaire (MBQ) was developed to explore patterns of unsafe acts committed by aircraft maintenance mechanics. The MBQ was completed anonymously by over 1300 Australian aviation mechanics, who also provided information on their involvement in workplace accidents and incidents. Four factors were identified: routine violations, skill-based errors, mistakes and exceptional violations. Violations and mistakes were related significantly to the occurrence of incidents that jeopardized the quality of aircraft maintenance, but were not related to workplace injuries. Skill-based errors, while not related to work quality incidents, were related to workplace injuries. The results are consistent with the three-way typology of unsafe acts described by Reason et al. (1990) and with the DBQ research indicating an association between self-reported violations and accidents. The current findings suggest that interventions addressed at maintenance quality incidents should take into account the role of violations and mistakes, and the factors that promote them. In contrast, interventions directed at reducing workplace injury are likely to require a focus on skill-based errors.     

Types and tokens in road accident causation

Accidents are preceded by long histories containing multitudes of events that constitute promising targets for preventive action. These antecedent events can be classified into at least four groups that occur in this order: failure types; psychological precursors; unsafe acts; and breakdown of defences. It is argued that events directly preceding an accident, such as breakdown of defences and unsafe acts, are only haphazard tokens of the more permanent weaknesses within a system, called failure types. Elimination of a type will therefore have much more impact than the elimination of one or a few tokens. It is also argued that there exist only a limited number of failure types, which are responsible for all accidents. However, in the specific area of road accidents, it is not known which types cause most of the problems. Therefore, their relative importance can only be guessed. We guessed that hardware problems and maintenance are unimportant types; that education and regulations are of moderate importance; and that incompatible goals, conditions promoting unsafe behaviour, and organizational inadequacy are the types that cause most of the accidents. The latter therefore constitute the most promising targets for accident prevention.     

Unsafe acts and unsafe outcomes in aircraft maintenance

Road safety studies using the Driver Behaviour Questionnaire (DBQ) have provided support for a three-way distinction between violations, skill-based errors and mistakes, and have indicated that a tendency to commit driving violations is associated with an increased risk of accident involvement. The aims of this study were to examine whether the three-way distinction of unsafe acts is applicable in the context of aircraft maintenance, and whether involvement in maintenance safety occurrences can be predicted on the basis of self-reported unsafe acts. A Maintenance Behaviour Questionnaire (MBQ) was developed to explore patterns of unsafe acts committed by aircraft maintenance mechanics. The MBQ was completed anonymously by over 1300 Australian aviation mechanics, who also provided information on their involvement in workplace accidents and incidents. Four factors were identified: routine violations, skill-based errors, mistakes and exceptional violations. Violations and mistakes were related significantly to the occurrence of incidents that jeopardized the quality of aircraft maintenance, but were not related to workplace injuries. Skill-based errors, while not related to work quality incidents, were related to workplace injuries. The results are consistent with the three-way typology of unsafe acts described by Reason et al. (1990) and with the DBQ research indicating an association between self-reported violations and accidents. The current findings suggest that interventions addressed at maintenance quality incidents should take into account the role of violations and mistakes, and the factors that promote them. In contrast, interventions directed at reducing workplace injury are likely to require a focus on skill-based errors.     

Software reliability models with time-dependent hazard functionbased on Bayesian approach

In this paper, two models predicting mean time until next failure based on Bayesian approach are presented. Times between failures follow Weibull distributions with stochastically decreasing ordering on the hazard functions of successive failure time intervals, reflecting the tester's intent to improve the software quality with each corrective action. We apply the proposed models to actual software failure data and show they give better results under sum of square errors criteria as compared to previous Bayesian models and other existing times between failures models. Finally, we utilize likelihood ratios criterion to compare new model's predictive performance     

Human Factor Analysis of JCO Criticality Accident

The criticality accident that occurred on September 30, 1999 at a uranium processing plant in Tokai-mura was an unprecedented nuclear accident in Japan, not only because it caused deaths of two workers due to radiation casualty but also because it called for evacuation and sheltering indoors to nearby residents. The accident was not directly caused by failures or malfunctions of hardware but by workers’ unsafe action deviated from the approved procedure. It was a typical organizational accident in that several organizational factors worked behind. This article is to analyze various causal factors that lead to the accident, including situational factors of workers’ unsafe action that triggered the accident, operational and business management of the company, and nuclear safety regulation by the government. It also discusses problems of emergency response after the accident.     

Associations between errors and contributing factors in aircraft maintenance

In recent years cognitive error models have provided insights into the unsafe acts that lead to many accidents in safety-critical environments. Most models of accident causation are based on the notion that human errors occur in the context of contributing factors. However, there is a lack of published information on possible links between specific errors and contributing factors. A total of 619 safety occurrences involving aircraft maintenance were reported using a self-completed questionnaire. Of these occurrences, 96% were related to the actions of maintenance personnel. The types of errors that were involved, and the contributing factors associated with those actions, were determined. Each type of error was associated with a particular set of contributing factors and with specific occurrence outcomes. Among the associations were links between memory lapses and fatigue and between rule violations and time pressure. Potential applications of this research include assisting with the design of accident prevention strategies, the estimation of human error probabilities, and the monitoring of organizational safety performance.     

Was Three Mile Island a ‘Normal Accident’?

Perrow’s normal accident theory suggests that some major accidents are inevitable for technological reasons. An alternative approach explains major accidents as resulting from management failures, particularly in relation to the communication of information. This latter theory has been shown to be applicable to a wide variety of disasters. By contrast, Perrow’s theory seems to be applicable to relatively few accidents, the exemplar case being the Three Mile Island nuclear power station accident in the U.S. in 1979. This article re‐examines Three Mile Island. It shows that this was not a normal accident in Perrow’s sense and is readily explicable in terms of management failures. The article also notes that Perrow’s theory is motivated by a desire to shift blame away from front line operators and that the alternative approach does this equally well.     

A new approach to analysing human-related accidents by combined use of HFACS and activity theory-based method

This study proposes a new method for modelling and analysing human-related accidents. It integrates Human Factors Analysis and Classification System (HFACS), which addresses most of the socio-technical system levels and offers a comprehensive failure taxonomy for analysing human errors, and activity theory (AT)-based approach, which provides an effective way for considering various contextual factors systematically in accident investigation. By combining them, the proposed method makes it more efficient to use the concepts and principles of AT. Additionally, it can help analysts use HFACS taxonomy more coherently to identify meaningful causal factors with a sound theoretical basis of human activities. Therefore, the proposed method can be effectively used to mitigate the limitations of traditional approaches to accident analysis, such as over-relying on a causality model and sticking to a root cause, by making analysts look at an accident from a range of perspectives. To demonstrate the usefulness of the proposed method, we conducted a case study in nuclear power plants. Through the case study, we could confirm that it would be a useful method for modelling and analysing human-related accidents, enabling analysts to identify a plausible set of causal factors efficiently in a methodical consideration of contextual backgrounds surrounding human activities.     

Limited Information Estimation in Binary Factor Analysis: A Review and Extension

Based on the Bayes modal estimate of factor scores in binary latent variable models, this paper proposes two new limited information estimators for the factor analysis model with a logistic link function for binary data based on Bernoulli distributions up to the second and the third order with maximum likelihood estimation and Laplace approximations to required integrals. These estimators and two existing limited information weighted least squares estimators are studied empirically. The limited information estimators compare favorably to full information estimators based on marginal maximum likelihood, MCMC, and multinomial distribution with a Laplace approximation methodology. Among the various estimators, Maydeu-Olivares and Joe's (2005) weighted least squares limited information estimators implemented with Laplace approximations for probabilities are shown in a simulation to have the best root mean square errors.     

Helicopter maintenance error analysis: Beyond the third order of the HFACS-ME

In this paper a statistical analysis of a sample of 58 helicopter maintenance-induced safety occurrences is conducted to study helicopter accidents and incidents’ survivability and the severity distribution of such occurrences. Analysis is also carried out to identify helicopter main and sub-systems mostly exposed to maintenance errors and to determine various types of such errors. Expected inherent relations between rotorcraft components affected and types of associated maintenance errors are investigated. Human factors-based triggers of these accidents and severe incidents are explored. The concept of Specific Failures (SFs) that immediately precede each of such occurrences is introduced for more detailed representation of the last breached individual and organizational safety barriers. Root causes of these safety occurrences were then sought utilizing the Human Factors Analysis and Classification System-Maintenance Extension (HFACS-ME) taxonomy with a refined focus on its third order categories’ list. The rotorcraft characteristics influencing individuals and organizational behaviours within Maintenance, Repair and Overhaul organizations (MROs) are discussed in the light of the root cause investigation results.

Relevance to industry

The study of human reliability within helicopter maintenance industry is waited to emphasise the understanding of causes and propagation mechanisms of maintainers' errors and their consequences on the overall aviation safety. Previous works often investigated maintenance errors and their roles in promoting aviation accidents of fixed-wing aircraft; this research is investigating the case of rotorcraft.     

A Review of Literature: Individual Blame vs. Organizational Function Logics in Accident Analysis

When an accident happens in an organization, two different approaches are possible to explain its origin and dynamics. The first approach, called individual blame logic aims at finding the guilty individuals. The second approach, called organizational function logic aims to identify the organizational factors that favoured the occurrence of the event. This article compares the two different logics of inquiry, the consequences that they produce, in particular in the case of accidents caused by unintentional actions. Though favoured by the scientists, the organizational function logic approach is in real life usually beaten by the individual blame logic. Reviewing the literature, this article brings together the arguments for using the organizational function logic from the perspective that learning from accidents is necessary to prevent them from happening again.     

Diagnosing resource usage failures in multi-agent systems

In the not-so-far future, autonomous vehicles will be ubiquitous and, consequently, need to be coordinated to avoid traffic jams and car accidents. A failure in one or more autonomous vehicles may break this coordination, resulting in reduced efficiency (due to traffic load) or even bodily harm (due to accidents). The challenge we address in this paper is to identify the root cause of such failures. Identifying the faulty vehicles in such cases is crucial in order to know which vehicles to repair to avoid future failures as well as for determining accountability (e.g., for legal purposes). More generally, this paper discusses multi-agent systems (MAS) in which the agents use a shared pool of resources and they coordinate to avoid resource contention by agreeing on a temporal resource allocation. The problem we address, called the Temporal Multi-Agent Resource Allocation (TMARA) diagnosis problem (TMARA-Diag), is to find the root cause of failures in such MAS that are caused by malfunctioning agents that use resources not allocated to them. As in the autonomous vehicles example, such failures may cause the MAS to perform suboptimally or even fail, potentially causing a chain reaction of failures, and we aim to identify the root cause of such failures, i.e., which agents did not follow the planned resource allocation. We show how to formalize TMARA-Diag as a model-based diagnosis problem and how to compile it to a set of logical constraints that can be compiled to Boolean satisfiability (SAT) and solved efficiently with modern SAT solvers. Importantly, the proposed solution does not require the agents to share their actual plans, only the agreed upon temporal resource allocation and the resources used at the time of failure. Such solutions are key in the development and success of intelligent, large, and security-aware MAS.     

面向化工企业事故的根原因关联分析

化工事故发生的根原因多是由人的不安全行为、机械或物的不安全状态等引发,其本质是企业管理上的缺陷。挖掘根原因间、根原因与事故间的关联关系是预防事故、提升企业安全管理水平的关键。由于事故调研根原因分析与安全管理指标体系存在稀疏关联现象,难以挖掘管理缺陷与事故演化间的关联关系。为此,本文通过协同过滤算法填补事故调研中缺失的评分数据;基于加权支持度计数的关联规则算法挖掘事故根原因间、根原因与事故属性间的强关联规则。实验结果表明,基于加权支持度的关联分析算法相比于现有的算法,能推荐更多危险程度高的企业潜在安全隐患及安全隐患与事故间的演化关联,从而能科学指导企业安全生产,实现面向生产过程的风险预警和事故预防。     

Workplace and organizational accident causation factors in the manufacturing industry

Labor inspectors investigate accidents to identify possible accident causes, initiate prosecution, and plan future accident prevention. The Method of Investigation for Labor Inspectors (MILI) was designed to help them to identify workplace and organizational factors in addition to immediate factors and legal breaches. The present study analyzes the impact of workplace (work design and provision of unsafe equipment) and organizational factors (training and employee involvement) on accident causation and validates MILI on real accident cases. Accident data from the manufacturing sector are analyzed with LISREL structural equation modeling. Results confirm the relationship between work design and training as well as between provision of unsafe equipment and employee involvement. The present study provides evidence that MILI is a structured accident investigation method allowing multiple accident causation factors to be revealed and that it could help all interested parts (not only labor inspectors, but companies as well) to thoroughly investigate occupational accidents. © 2009 Wiley Periodicals, Inc.     

Hazard analysis in chemical complexes in Japan—especially those caused by human errors

Accidents al Japanese chemical industrial complexes are examined from the past to the present at the Chiba, Mizushima, Sakai-Senpoku, Yokkaichi, Kashima and Tokushima-Ohtake areas. Comparisons with the number of accidents caused by hard errors and soft errors were made; where the hard errors are defined as the faults of the machines and facilities and the soft errors as the human errors and the faults of the systems. The results may be summarized as follows: the ratio of the number of accidents caused by the hard errors to the soft errors was approximately 2:3 at all areas. Using the data obtained through a questionnaire on the potential accidents from about 200 workers engaged in the chemical industry, comparisons with the causes of the potential accidents and the actual accidents caused by human error were made and the results agreed approximately with the causes of the actual accidents.     

Understanding Business Failure: Learning and Un-Learning From Industrial Crises

Crisis management theory, developed through the study of industrial disasters and socio-technical failures, is applied to three cases of business failure. The principle objective of the research reported in this paper was to identify whether or not successive failures could have been avoided through organizational learning from similar prior events and what factors might have contributed to or prevented learning. The research also aimed to establish whether or not theoretical frameworks for analyzing and understanding industrial disasters and socio-technical failures are applicable to business failures. Using detailed case analyses of the failures of Johnson Matthey Bank, the Bank of Credit and Commerce International and Barings, the paper illustrates a series of remarkable similarities in these business failures. It also demonstrates an apparent inability of the management involved in the later failures to learn from what had happened before. Organizational culture is singled out as the main contributing factor in these failures. This paper, in part, proves the case for applying industrial crisis management theory to business failure.