Causal risk models of air transport - NLR-ATSI

that, while a causal risk model can be used in a TLS approach, the model can fully come to
justice in an ALARP approach which strives for continuous improvement.
2.5. Theories about accident causation
Risk from air transport is almost exclusively related to accidents 9 . In a desire to understand
and prevent the occurrence of accidents, many researchers have tried to develop a concept
or framework for describing accident causation. Some of these theories have been very
influential on the way we think about accidents and the representation of accidents in
mathematical models. For that reason this section provides a brief overview of some of the
most important accident causation theories and concludes with what this means for risk
model requirements.
For the purpose of accident investigation, it is often assumed that accidents involve the
occurrence of a set of successive events that produce unintentional harm. The start of this
sequence is a deviation or perturbation that disturbs the existing equilibrium or state of
homeostasis. Benner [1975] pointed out that events during accidents occur both in series
and in parallel and proposed flow charting methods to represent this. Accident investigation
tools like Event and Causal Factors Analysis (ECFA) [Buys & Clark 1995] and
Management Oversight and Risk Tree (MORT) [Johnson 1975] use this concept to provide
a structure for integrating and subsequently communicating investigation findings. Already
in 1935, Heinrich developed a theory that introduces an additional dimension to such
accident chain model. He compared the occurrence of an accident to a set of lined-up
dominoes [Heinrich et al 1980]. The five dominoes were a) ancestry and social
environment, b) worker fault, c) unsafe act or unsafe condition, d) accident and e) damage
or injury. Central to Heinrich’s original statement of the model is the assertion that the
immediate causes of accidents are of two different types; unsafe acts and unsafe conditions.
Heinrich’s domino model was also useful to explain how by removing one of the
intermediate dominoes, the remaining ones would not fall and the injury would not occur.
Reason [1990] took Heinrich’s unsafe acts and unsafe conditions a step further by refining
the distinction between different types of failures that line up to create an accident. Building
upon work by Rasmussen [1983], Reason describes an accident as a situation in which
latent failures, arising mainly in the managerial and organisational spheres, combine
adversely with local trigger events (weather, location etc) and with active failures of
individuals at the operational level. Latent failures are failures that are created a long time
before the accident, but lie dormant until an active failure triggers their operation. Their
defining feature is that they were present within the system well before the onset of an
accident sequence. Like many other high-hazard, low-risk systems, the aviation system has
developed such a high degree of technical and procedural protection that it is largely proof
against single failures, either human or mechanical. The aviation system is more likely to
suffer ‘organizational accidents’ [Reason 1990]. That is, a situation in which latent failures,
arising mainly at the managerial and organizational level, combine adversely with local
triggering events and with the active failures of individuals at the execution level [Reason
1997]. This concept is often graphically illustrated as slices of holed cheese, each slice
representing a barrier at a different organisational level. The holes in the cheese are barrier
failures and an accident occurs when the holes line up. The ‘Swiss cheese’ model has been
useful to underline the importance of organisational factors in accidents. Perrow [1984] also
describes accidents as occurrences where apparently trivial events cascade through the
system to cause a large event with severe consequences. He uses the term ‘normal
9
Examples of non-accident risk in air transport are deep vein thrombosis and possible
health effects of exposure to higher levels of electromagnetic radiation.
19