Free Article: Translating incidents into safety lessons
Safety in aviation and maritime domains has greatly improved over the years, but there is no room for complacency. This is especially the case as we approach systems with ever more automation and use of remote control in both industries.
The three ages of safety
01 – 60s to 70s
The first age of safety consisted of an almost exclusive focus on technical failures, for example structural defects in ships or aeroplane design, or succumbing to bad weather. Such accidents led to intense efforts towards safer design, including building in both defence in depth and redundancy so that single component or structural failures would not be catastrophic.
02 – 80s to 90s
The second age of safety logically followed the first, in that human error, as it was seen then, became the focus, as highlighted in the findings of notable accidents including Three Mile Island (nuclear), Herald of Free Enterprise (maritime), Space Shuttle Challenger (space) and Kegworth (aviation), to name a few. Human factors came to the fore, whether in selection, procedures and training, or design, or Crew Resource Management (CRM) in aviation. The focus on Human factors added a new layer of safety across many domains.
03 – 90s to now
The third, and perhaps fourth ages of safety concentrated on underlying issues. Professor James Reason introduced the 'Swiss cheese' model, and the notion that organisational factors, decisions and constraints can create vulnerabilities in the system design, leading to more chances for things to go wrong. Hollnagel, and others via Safety II, have focused on 'work as done' in contrast to work as imagined (by designers). SHIELD‘s uniqueness is that it focuses more on these latter two 'layers' of accident causality than traditional taxonomies do.
SAFEMODE project
Safety in aviation and maritime domains has greatly improved over the years, but there is no room for complacency. This is especially the case as we approach systems with ever more automation and use of remote control in both industries. It is also more complicated because ‘human error’ is often seen as the root cause, when usually it is the system that leads people into mistakes, and seafarers and flight crew alike so often save the day. Accidents, incidents and near misses all offer us valuable lessons from which to improve safety, to do better next time. Yet in the aftermath of adverse events, the wish to blame someone, which makes sense of something that was never intended to happen, might make us lose sight of the real causes of accidents, leading to more tragedy and loss.
The key to learning is using the right tool with which to understand what happened and why. This means going beyond the surface ‘facts’ and suppositions, seeing beneath the ‘usual suspects’ of factors that yield little in terms of how to prevent the next one. The SHIELD (Safety Human Incident & Error Learning Database) taxonomy has been developed by reviewing a number of existing taxonomies - in this case, a set of related terms for describing human performance and error - to derive a means of objectively classifying events in a way that helps us develop safety countermeasures afterwards. Whilst it can analyse single events it is particularly insightful when looking - and learning - across related events.
SHIELD has been developed by Aviation and Maritime partners in the SAFEMODE project, as a means to improve Safety Learning, and to prevent incidents repeating and turning into accidents. To do this, a taxonomy has been developed. A taxonomy is a set of terms that are precise, unambiguous and meaningful. Without a taxonomy, different people talk about the same event using different terms, leading to a ‘Tower of Babel’ effect, which makes learning lessons very hard. A taxonomy helps in the following ways:
- A taxonomy helps understanding: How could this have happened?
- A taxonomy enables learning: How can we prevent this from happening again?
- A database supports safety management: What are similar cases? How often does it happen? What are the key contributory factors? What are effective mitigating measures?
- A database supports safe design What designs have led to problems? What are effective improvements?
The figure opposite shows the main elements of the SHIELD taxonomy, which has built upon notable taxonomies such as HFACS and HERA. It goes beyond the ‘surface factors, to also consider ‘work as done’ and organisational influences on human performance and safety.
The SHIELD taxonomy has been tried and tested on hundreds of aviation and maritime incidents and accident reports, to ensure it is usable and helpful in understanding the event and all its contributory factors. Even in aviation, where taxonomies have been in use for some time, its application has led to new insights, particularly at the ‘lower’ levels.
Capturing the surface layer
SHIELD allows the user to enter data on the occurrence along the following categories:
- General: Headline, confidentiality, reported by, etc.
- Occurrence: Location, date, time of occurrence, fatalities, injuries, damage, narrative, etc.
- Vehicle and Operation: Vehicle category, year of build, vehicle specs, vehicle systems, operator (company), operation number, operation type (e.g. mooring), phase, etc.
- Actors:Type of actor (e.g. flight crew), role (e.g. captain), qualification, experience, time on shift, age, etc.
- Contextual factors: Precipitation, visibility, wind, light condition, terrain, sea condition, traffic density, etc.
- Occurrence information: Class (e.g. accident, serious incident), category (e.g. collision, grounding, runway incursion)
- Accident prevention, mitigation and learning: Actions that prevented an accident or mitigated consequences. Recommendations arising from incident or accident report
Capturing the actions
What the people involved in the event did (or did not do) is key to understanding the event. Sometimes there is only one ‘Act’, but usually the more complicated the event, particularly if it resulted in an accident, the more actions need to be recorded, in the sequence in which they occurred, whether by one or more actors. Shield classifies the ‘Acts’ into five categories:
| PERCEPTION | PLANNING & DECISION MAKING |
INTENTIONAL DEVIATION |
RESPONSE EXECUTION |
COMMUNICATING |
Missed, detected late, wrong thing detected |
Plan or decision incorrect, late, or no plan/decision |
Workaround in normal conditions, routine workaround, workaround in exceptional conditions, sabotage |
Wrong timing, wrong sequence, right action on wrong object, wrong action on right object, lack of physical coordination, no action performed |
Wrong / No information transmitted |
Diving deeper
LEVEL 2 - PRECONDITIONS
The next level of investigation looks at the preconditions for the accident. These include:
Editor’s note: The taxonomy for each of these points is extensive; please see safemodeproject.eu for further details.
LEVEL 3 – OPERATIONAL LEADERSHIP
LEVEL 4: ORGANISATION
The two sides of SHIELD
SHIELD is both a taxonomy and a database. The taxonomy is the language that enables safety related events to be analysed consistently and unambiguously, so that learning can take place. It can be used simply as a taxonomy to analyse a single event or multiple events by an investigator, a company, a safety organisation or a Human Factors/Safety expert, to gain more insight into what happened and why. The SHIELD database gives more power to such analysis, because it can go beyond single events, or even a company’s own fleet experience, to consider a broader range of maritime events from which learning can be extracted. The SHIELD database allows designers to see what went right and what went wrong with similar or related designs, and allows other operational companies and safety organisations to be more strategic about safety and human factors priorities.
An official accident investigation is conducted for each serious maritime accident, however, the level of detail changes from accident to accident, hence, the details about human contributors and organisational issues are not systematically analysed and reported in a way that makes future extraction of trends and comparisons possible. This is avoided by using a consistent taxonomy and database.
Furthermore, the findings obtained by applying the SHIELD HF taxonomy can be very beneficial for maritime stakeholders, especially ship owners and shipping companies, since they can allocate more efforts to addressing the major accident contributors identified. Moreover, it can unveil contributory factors that are not identified as contributing factors in an accident analysis report. This might help marine safety experts and professionals to draft better safety policies by including barriers or come up with optimum processes. In addition, these results can be utilized to develop the design and operational measures to prevent accidents re-occurrence.
Benefits of SHIELD
There are various benefits of using the SHIELD HF taxonomy. Firstly, the granularity level, as SHIELD HF taxonomy is not only generic enough to minimize the risk of inconsistent interpretations of the same terms but also sufficiently detailed to allow for an adequate understanding of the human and organizational factors contributing to an unsafe human actions. Secondly, SHIELD is well connected with HF concepts, as SHIELD HF taxonomy directly refers to state of the art HF models, assumes an adequate HF competence and training for its use, and minimizes the risk of blaming individuals when trying to understand how the human performance contributed to an accident. Thirdly, SHIELD also addressess domain specific factors. The SHIELD HF taxonomy not only uses transversal terms that are applicable to both the aviation and maritime domain, but it also utilizes domain specific terms when required to understand the role of organizational and contextual factors in contributing to unsafe human actions.
SHIELD in a near miss scenario
A recent near miss incident experienced by one of SAFEMODE project’s end-user partners gave the opportunity to compare the SHIELD taxonomy to the existing procedure which used a standard HFACS approach . Because of the significance of the near miss incident, the company conducted an investigation by following their own investigation process without any involvement from SAFEMODE partners. A separate workshop was organised by Strathclyde University to apply SHIELD based investigation into the same near miss incident.
The scenario selected was a late alteration of course where the Officer of the Watch (OOW) did not alter course when required. Without corrective action, grounding would have occurred.
The following observations were made from this comparative assessment:
SHIELD supported the investigators in capturing more factors than the traditional investigation process. SHIELD was able to capture 23 factors, while the investigation report only included information about 7 factors.
Most of the factors were categorised under the “Act” or “Precondition” layers.
There were few factors categorised under “Operational Leadership”.
In order to visualise the captured factors from these investigations in a comparative manner, identified factors were mapped on the SHIELD Taxonomy Structure. It was clear that the SHIELD-based approach enabled investigators to capture not only more factors but also helped identifying factors that belong to categories not usually captured in standard accident investigation.
At the end of the SHIELD-based workshop, the accident investigator of the company commented that the SHIELD Taxonomy and tool supported them to consider factors that they would not take into account otherwise. They also found the SHIELD tool very intuitive, with practical descriptions for the taxonomy items, which supports decision making of the investigators, leading to more accurate findings.
Conclusions
Safety performance has improved in the maritime industry, but there is no room for complacency. Accidents, whether large or small, can have tragic consequences, and it is imperative that we learn from them to prevent their recurrence, and to protect seafarers and passengers, and to safeguard the industry itself. The maritime domain has been using taxonomies for some time now, but the state-of-the-art SAFEMODE taxonomy, based on the best taxonomies available and adapted to the sea-going context, allows a range of users from investigators to designers to learn and distil more accurate and deeper Human Factors lessons from safety-related events. Early applications of SHIELD have shown that it is relatively straightforward to use, and does indeed lead to new insights that can better inform safety.
The SHIELD taxonomy is intuitive and, thanks to its easy to apply structure, guides users through the different layers of underlying Human Factors issues in a systematic manner. This enables even investigators with limited Human Factors background to be able to capture factors they would not be considering otherwise. Furthermore, the SHIELD taxonomy, when implemented across the maritime sector, has a great potential to generate currently missing Human Factors data from accidents, and will facilitate safety learning from safety-related events. It is therefore hoped that SHIELD can become a major tool in safety management in the maritime domain, protecting the future of passengers, seafarers, and the industry as a whole.
This article was based on a publication produced by the Safemode project, and appears here with permission.
For further information, including a full list of the factors identidied under ‘Diving deeper’ please see safemodeproject.eu or contact the University of Strathclyde (o.turan@strath.ac.uk).