1

Prof. Maurizio Catino Prof. Maurizio Catino

University of Milan - Bicocca (Italy)University of Milan - Bicocca (Italy)

maurizio.catino@unimib.itmaurizio.catino@unimib.it

Air disasters as organizational Air disasters as organizational errors: the case of Linateerrors: the case of Linate

 ALIAS Conference 14-15 June 2012, EUI - Florence (Italy)

2

8.10.2001: The second most serious 8.10.2001: The second most serious

aircrash aircrash

ground accidentground accident

SAS MD87

Cessna

3

The accident dynamicThe accident dynamic

Cessna

MD87TWR

R5 R6••••••••

R5 R6••••••••

4

5

6

Cessna

MD87

The sierra four …The sierra four …

(8.08.23)

(8.08.28)

(8.08.32)

(8.08.36)

• Roger, … hold position

(8.08.40)

D-VXD-VX

7

Cessna

MD87

(8.09.19)

(8.09.28)

(8.09.37)

(8.09.38)

The accident dynamicThe accident dynamic

8

Accident DynamicAccident Dynamic

9

10

Why? Who is to blame?

Cessna pilots mistake

Ground controller error

Inadequate signals condition

Absence of a ground radar

Airport management negligence

Tragic fatality

…

11

The Error of Human Error…The Error of Human Error…

““... ‘human error’ is not a well defined category of... ‘human error’ is not a well defined category ofhuman performance. Attributing error to the actionshuman performance. Attributing error to the actionsof some person, team, or organisation isof some person, team, or organisation isfundamentally a social and psychological process fundamentally a social and psychological process and not an objective, technical one.”and not an objective, technical one.”(Woods et al., 1994)(Woods et al., 1994)

Assume that thesource of failure is“human error”

Analyse events tofind where aperson is involved

Stop analysiswhen one is found

12

A multilevel model for the A multilevel model for the

analysis of accidentsanalysis of accidents

AccidentAccident

Individual-levelIndividual-level(errors, violations,(errors, violations,

mistakes, decisions)mistakes, decisions)

Organizational levelOrganizational level

Inter-organizational Inter-organizational levellevel

DefencesDefences

- DefencesDefences- Managerial decisionsManagerial decisions- Error-inducing conditionsError-inducing conditions-……

- IntegrationIntegration- CoordinationCoordination- … …

(Catino 2010)(Catino 2010)

13

• The Cessna and two pilots were not qualified The Cessna and two pilots were not qualified and certified to operate in low visibility and certified to operate in low visibility conditions (land and take off) such as that day conditions (land and take off) such as that day (violation)(violation)

• The Cessna crew took the wrong taxiway The Cessna crew took the wrong taxiway (error)(error) and entered the runway without and entered the runway without specific clearance (violation)specific clearance (violation)

• There were communication failures between There were communication failures between the tower and the Cessna pilots: the ground the tower and the Cessna pilots: the ground controller did not realize that the Cessna was controller did not realize that the Cessna was on taxiway R6 (error), and he issued a on taxiway R6 (error), and he issued a clearance to taxi towards the main apron clearance to taxi towards the main apron although he could not make sense of the although he could not make sense of the report position S4report position S4

1. Individual Level1. Individual Level

14

2. Organizational Failures2. Organizational Failures

No Surface Movement Radar (out of service since November 1999)

Installed equipment for prevention r.i. at R6 intersection deactivated

TWY Lights Stop Bars

Failures defences

The ground markigs were not clearly visible (RWY Holding Position Markings)

Signs, signals and lights were inadequate and misleading (out standard ICAO)

Official documention failed to report the presence of unpublished marking (S4, S5, etc)

Error-inducing conditions

Latent failures

No learning from near miss Best practices not applied No functional Safety Management System

15

ENAC ENAC (airport authority)(airport authority)

ENAV ENAV (air traffic regulator)(air traffic regulator)

SEA SEA (Service Provider)(Service Provider)

3.The bigger picture—Linate 3.The bigger picture—Linate

16

Individual FailuresIndividual Failures Organizational andOrganizational andInter-organizational FailuresInter-organizational Failures

The Cessna crew took the wrong taxiway (error) and entered the

runway without specific clearance (violation)

Markings and signs were not in accordance with ICAO standards; Red bars and TWY lights non controllable by ATC; Deficiency in the state of implementation and maintenance of airport standard signage; Official documentation failed to report the presence of unpublished markings (S4); No equipment to prevent runway incursions

There were communication failures between the tower and

the Cessna pilots

No surface movement radar; Installed equipment for prevention r.i. at R6 intersection deactivated; Markings and signs were not in accordance with ICAO standards; Deficiency in the state of implementation and maintenance of airport standard signage; Non-compliance with international standards on markings, lights and signs; High traffic volume; lack of visual aidsThe Cessna and two pilots were not

qualified and certified to operate in low visibility conditions (land and

take off) such as that day (violation)

Lack of coordination among the airport authorities; weaknesses in the control system

17

Failure LevelsFailure Levels

Individual-Individual-levellevel• ErrorsErrors

• ViolationsViolations• Communications Communications

misunderstandingsmisunderstandings

Organizational - levelOrganizational - level

• No ground radarNo ground radar• No international safety No international safety

standardstandard• Weak defensesWeak defenses• Lack of visual aidsLack of visual aids• No learning from near No learning from near

missmiss• ……

Inter-organizational levelInter-organizational level

• Cost/safety trade-offsCost/safety trade-offs• Failures of integration and coordinationFailures of integration and coordination• Bureaucratic safety cultureBureaucratic safety culture• No Safety Management systemNo Safety Management system• ……

18

Latent ConditionsLatent Conditions Coordination neglectCoordination neglect

Inadequate safety policiesInadequate safety policies

Latent ConditionsLatent Conditions No ground radar; no international standardNo ground radar; no international standard

No learning from near miss; …No learning from near miss; …

Latent ConditionsLatent Conditions Poor visibility of R5/R6 signs; Mental Fatigue; Poor visibility of R5/R6 signs; Mental Fatigue;

S4 marking unknown to the controller; …S4 marking unknown to the controller; …

Active ConditionsActive Conditions• The Cessna crew took the wrong The Cessna crew took the wrong

taxiway and entered the runwaytaxiway and entered the runway

• Communication failuresCommunication failuresFailed orFailed orAbsent DefensesAbsent Defenses

Inter-Inter-OrganizationalOrganizational

FactorsFactors

OrganizationalOrganizationalFactorsFactors

PreconditionsPreconditionsforfor

Unsafe ActsUnsafe Acts

UnsafeUnsafeActsActs

Accident & Accident & InjuryInjury

Active versus Latent FailuresActive versus Latent Failures

(Adapted from Reason, 1997)(Adapted from Reason, 1997)

19

ConclusionsConclusions

• If we focus too closely upon the unsafe acts If we focus too closely upon the unsafe acts at the sharp end, we are in danger of at the sharp end, we are in danger of missing the fact that this was the result of missing the fact that this was the result of an organizational erroran organizational error

• It’s important to take a system perspectiveIt’s important to take a system perspective

• Communication and organization problems of many kinds were crucial factors in this and other disasters

20

Individual Blame Logic

Errors and Accidents

Two ways of looking at accidents

Organizational Function Logic

21

Vicious CircleVicious Circle

Organizational inertia Organizational inertia Defensive behaviorDefensive behavior

Individual Individual Blame LogicBlame Logic

Search for the guiltySearch for the guilty Hidden errorsHidden errors

Blame cultureBlame culture

22

• Defensive medicine takes place when healthcare

personnel prescribe unnecessary treatments, or avoid

high-risk procedures, with the goal of reducing their

exposure to malpractice litigation

• Doctors in particular may:

• prescribe unnecessary tests, procedures or

specialist visits (positive defensive medicine),

• or, alternatively, avoid high-risk patients or

procedures (negative defensive medicine).

Defensive Medicine?

23

Defensive MedicineStudy Year Country Result

(% of defensive behaviours)

Tancredi 1978 US 70%

Studdert et al. 1995 US 93%

Summerton 2000 UK 90%

Hymaia 2006 Japan 98%

Jackson Healthcare 2008 US 72%

Massachusetts Medical Society

2009 US 83%

24

Positive Defensive Medicine

Negative Defensive Medicine

25

26

• The threat of legal investigation does not make the The threat of legal investigation does not make the medical system more careful and attentive toward medical system more careful and attentive toward the patientthe patient

• Individual blame logic does not improve patient Individual blame logic does not improve patient safety safety

• Develop the capacity to learn from errors and system Develop the capacity to learn from errors and system failures to become more resilient and reliable failures to become more resilient and reliable

• To achieve this, a profound cultural and juridical To achieve this, a profound cultural and juridical transformation is requiredtransformation is required

• Promote a different culture to reduce defensive Promote a different culture to reduce defensive medicine and to promote a process of learning from medicine and to promote a process of learning from errorerror

The side effects of defensive medicineThe side effects of defensive medicine

27

Virtuous CircleVirtuous Circle

Organizational Organizational Function LogicFunction Logic

Search for Search for organizational criticalityorganizational criticality

Reporting close calls, Reporting close calls, errorserrors

Removing latent factorsRemoving latent factorsOrganizational learningOrganizational learning

Just cultureJust culture

28

Person model

System model

Both extremes have their pitfalls(Reason, 1997)

Getting the balance Getting the balance rightright

Proximal factors

Remotefactors

Individualresponsibility

Collectiveresponsibility

29

Just Just cultureculture

Blame free Punitive culture

Individuals are blamed for all

mistakes

All errors to system failureNo individual is to be held

accountable

30

Just cultureJust culture

10%10%BlameBlame

90%90%No BlameNo Blame

31

Reassure

Malicious Malicious behaviorbehavior

ViolationsViolationsGross Gross

negligencnegligencee

Criminal Criminal offencesoffences

Human Human errorerror

Inadvertent Inadvertent action: action: slips, slips,

lapses, lapses, mistakesmistakes

At-risk At-risk behaviorbehavior

A choice: A choice: risk not risk not

recognized recognized or believed or believed

justifiedjustified

Reckless Reckless behaviorbehavior

Conscious Conscious disregard of disregard of unreasonablunreasonabl

e riske risk

PunishCoach

Establishing a Just CultureEstablishing a Just Culture

Unintentional

No blame

Deliberate

Culpable

32

• 20 flight divisions; 1000 pilots

• 1990: The accident of “Casalecchio di Reno”: 12 people died

• New organization, new culture

The Case of the The Case of the

Italian Air ForceItalian Air Force

33

• The promotion of a new vision of risk management and safety

• The promotion of methods for the identification, analysis and prevention of risks (critical latent factors)

• Database for incident reporting (voluntary and anonymous for the centre)

• Ongoing training and education about safety and perception of errors in order to learn from them

• The implementation of a just culture

New risk and safety policy

34

A deterrent strategy (blame culture) is backward-looking, implemented after the accident happens punitive, sanctions directed towards the

individuals or organizations responsible for an error or accident

A compliance strategy (ITAF - just culture) is forward-looking and preventive early identification of errors and latent factors

Two different strategies Two different strategies

compliance vs. deterrentcompliance vs. deterrent

35

For each event we look for the reason why it happens. For each event we look for the reason why it happens. We do not talk about blame and responsibility. We do We do not talk about blame and responsibility. We do not want to know who the guilty person was but why the not want to know who the guilty person was but why the event happened and what we can do to avoid it in the event happened and what we can do to avoid it in the future.future.

Error is a mechanism for learning (…) there are some Error is a mechanism for learning (…) there are some errors that if analyzed can help prevent future errors. errors that if analyzed can help prevent future errors.

The more people I inform about my error, the less The more people I inform about my error, the less they risk repeating the errorthey risk repeating the error

The organization does not put pressure on people The organization does not put pressure on people committing an error. Nobody is afraid of being punished. committing an error. Nobody is afraid of being punished. The debriefings are a training activity to talk and improve The debriefings are a training activity to talk and improve our work. The exchange among experts and newcomers our work. The exchange among experts and newcomers is a good occasion for both people as it helps to see is a good occasion for both people as it helps to see things from different points of view.things from different points of view.

Just culture at ITAF Just culture at ITAF (extracts from interviews)(extracts from interviews)

36Human Factors Total

Reporting of Incident and Flight Safety OccurrencesReporting of Incident and Flight Safety Occurrences 1991-2009 (rate for 10,000 hours of flying)1991-2009 (rate for 10,000 hours of flying)

0

20

40

60

80

100

120

140

160

180

200

1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006

1073

729 681645

1745

92198910641180

1143

865

434410

1514

1130

1539

340266

245274272240

2922

694600572

391

1472

1773 1732

143

2007

1650

574

2008

1575

550

2009

1922

650

220

(Source: ITAF Flight Safety Inspectorate)

37

Major accidentsMajor accidents1990 - 20101990 - 2010

1920

21

24

16

20

8 8

65

34

65

6 6

43

89 8

0

2

4

6

8

10

12

14

16

18

20

22

24

26

90 91 92 93 94 95 96 97 98 99 00 01 02 03 04 05 06 07 08 09 10

(Source: ITAF Flight Safety Inspectorate)

38

220,32332000 - 10

430,38511990 - 99

610,59871980 – 89

DEADS RATEONUMBER 

Number of accidents 1980-2010Number of accidents 1980-2010

(Source: ITAF Flight Safety Inspectorate)

39

Either organizations manage human Either organizations manage human errors, by learning from them errors, by learning from them

Or… Or… human errors will manage human errors will manage

organizationsorganizations

To achieve the first one, is fundamental To achieve the first one, is fundamental to develop a just cultureto develop a just culture

ConclusionConclusion