A Presentation to the International System Safety Society August 11, 2016 by Gary D. Braman Senior System Safety Engineer Sikorsky Aircraft Corporation Huntsville, AL
Agenda Introduction to Human Factors Accident Investigation (Reactive) Accident Investigation Basics Phases of the Investigation Areas of the Investigation 3W Approach Human Performance Failures and Lessons Learned System Safety (Proactive) Definition of System Safety What System Safety Engineers Do System Safety Design Order of Precedence Summary/Questions
Definition of Human Factors What are Human Factors? (HFES) Human Factors is concerned with the application of what we know about people, their abilities, characteristics, and limitations to the design of equipment they use, environments in which they function, and jobs they perform.
Definition of Human Factors Human Factors (GEIA-STD-0010) A disciplined, unified, and interactive approach used to integrate human considerations into system design, improve total system performance, and reduce costs of ownership. The major considerations of Human Factors include: human factors ergonomics, manpower and personnel, training, and occupational safety and health.
Definition of Human Factors Human Systems Integration (HSI) (MIL-STD-882E) The integrated and comprehensive analysis, design, assessment of requirements, concepts, and resources for system manpower, personnel, training, safety, and occupational health, habitability, personnel survivability, and human factors engineering.
Human Factors - Goals Goals of Human Factors Enhance performance Increase safety Increase user satisfaction How are goals accomplished Diagnose (identify problem) Implement solutions
Goal Accomplishment Equipment design Task Design Environmental Design Training Selection
Human Factors Types Physical Factors Sex, Age, Strength, Sensory limitations Psychological Factors Nutritional Factors, Health, Lifestyle, Fatigue, Chemical dependency Physiological Factors Workload, Experience, Knowledge, Training, Attitude, Mental or Emotional State Psychosocial Interpersonal conflicts
Types of Errors Omission Random Commission Systematic Substitution Sporadic Reversible Operator Induced Irreversible Design Induced
Types of Errors Omission failing to do something which ought to be done Commission doing something which not ought to be done Substitution Taking action when it is required, but the wrong action.
Types of Errors Random error no discernable pattern to errors being made Systematic error characterized by a consistent offset from the desired point Sporadic error An isolated error occuring after a routinely good performance
Types of Errors Reversible error which can be rectified before a mishap can occur Irreversible error which cannot be rectified and mishap may occur Operator Induced and design induced errors an error which occurs at the L-H or L-S interface may result from a failure to design the hardware or the software properly taking into account the normal characteristics of the operator.
Error Mitigation/Elimination Two Pronged Approached Minimize the occurrence of the errors Reduce the consequences of remaining errors Equipment Design Task Design Environmental Design Training Selection
Accident Investigation The investigation of the accident is the gathering of the information to determine how and why the accident occurred in order to prevent it from happening again.
Accident Investigation Process of elimination! Look at everything! Don t assume anything! Accident Investigators Worst Enemy Preconceived Notions!
Phases of the Investigation Phase 1 Organization and Preliminary Examination Phase 2 Data Collection Phase 3 Data Analysis Phase 4 Technical Report Completion
Areas of the Investigation Human Factors Materiel Factors Environmental Factors
3W Process What happened? Why did it happen? What can we do to prevent it from happening again?
What Happened? Identify key factors (human, material, environmental) which caused or contributed to the accident. In the case of injuries, explain how they happened.
Why Did it Happen? Identify the system inadequacy that permitted the accident to occur. Explain how and under what conditions these errors/failures occurred. Leader failure Training failure Standards/Procedures failure Support failure Individual failure
UH-60 Mid-Air Accident -AIRCRAFT: 2 UH-60L BLACK HAWKS -MISSION: Down pilot pickup/ FRIES/live-fire - DATE: 18 June 1996 - LOCATION: Fort Campbell, KY - SOB: 30 - FATALITIES: 6 - INJURIES: 33 (2 observers injured) - DAMAGE COSTS: $13,200,000.00 - ACCIDENT CAUSE: Human Error
UH-60 Mid-Air Accident
UH-60 Mid-Air Accident
Leader Failure AIRCRAFT: B-52H Stratofortress MISSION: Air Show Demonstration Practice DATE: 24 June 1994 LOCATION: Fairchild Air Force Base, Spokane, Washington CREW: 4 FATALITIES: 4 ACCIDENT CAUSE: Human Error/Leader Failure
Leader Failure B-52H Stratofortress
Leader Failure Aircraft Dimensions Length 159 4 Wingspan 185 Height (top of tail) 40 8 Empty Weight 185,000 pounds Maximum Takeoff Weight 488,000 Ceiling 50,000 feet Fuel Capacity 48,000 gallons Engines 8 Pratt & Whitney TF-33-P-3/1-3 Cost - $74,000,000.00
Leader Failure Previous Flight Violations: 19 May 1991, Fairchild Air Force Air Show Practice 12 July 1991, Change of Command Flyover 17 May 1992, Fairchild AFB Air Show 14-15 April 1993, Global Power Mission (formation flying) 8 August 1993, Fairchild AFB Air Show 10 March 1994, Yakima Bombing Range 17 June 1994, Fairchild Air Force Air Show Practice
Individual Failure AIRCRAFT: AH-64 Apache MISSION: Training DATE: 14 January 1997 LOCATION: Fort Campbell, KY SOB: 2 FATALITIES: None INJURIES: None DAMAGE COSTS: $1,194,482.00 ACCIDENT CAUSE: Human Error
Individual Failure AH-64D Apache
Individual Failure AIRCRAFT: AH-64 Apache MISSION: Training DATE: 14 January 1997 LOCATION: Fort Campbell, KY CREW: 2 FATALITIES: None INJURIES: None DAMAGE COSTS: $1,194,482.00 ACCIDENT CAUSE: Human Error
Individual Failure
What Can We Do To Prevent It From Happening Again? Identify the corrective actions that will prevent this type of accident from happening again. All recommended corrective actions be addressed to appropriate agency or level of management that can implement the corrective action with focus on the why.
System Safety System Safety is defined as the application of engineering and management principles, criteria, and techniques to achieve acceptable mishap risks within the constraints of operational effectiveness, time, and cost throughout all phases of the system life cycle.
History of System Safety 1940s 2000s (Facility System Safety) Trial and Error Fly-Fix-Fly 1950s 1990s (Risk-Based Process System Safety) Software System Safety Nuclear Weapons Trial and Error Fly-Fix-Fly 1960s (NASA, DOD, 882) 1980s (Facility System Safety) OSHA Process Safety Human Factors Jet Aircraft Aircraft Accidents Jet Aircraft (HA Flight) Nuclear Power Aircraft Accidents MIL-S-38130 MIL-S-380130 MIL-STD-882 (DOD) Space Systems 1970s (MORT) NASA NHB 1700.1 AEC Pub/Tn MORT NAVFAC SS Training USACE SS Workshop MIL-STD-882B (DOD) QA interface MIL-STD-882C (DOD) Air/Spacecraft Accidents MIL-STD- 882D/E (DOD) Air/Spacecraft Accidents Aircraft Accidents MIL-STD-882A (DOD) Air/Spacecraft Accidents Aircraft Accidents
What We Do! Influence design selection through a structured hazard identification and risk mitigation process Integrate safety lessons learned
Lessons Learned Those who do not remember the past are George Santayana US (Spanish-born) Philosopher 1863-1952 condemned to repeat it.
Risk Management Process Identify Hazards Monitor Assess Hazards Implement Controls Develop Controls
Identify Hazards Legacy systems Review documented hazard databases Similar systems Review documented hazard databases Review system/subsystem functions Review design documents
Hazard Assessment Frequent (A) Probable (B) Occasional (C) Remote (D) Improbable (E) 1 2 4 8 12 3 5 6 10 15 7 9 11 14 17 13 16 18 19 20
Hazard Assessment Level Description 1 2 3 4 Catastrophic: Could result in death, permanent total disability, loss exceeding $10M, or irreversible severe environmental damage that violates the law Critical: Could result in permanent partial disability, injuries or occupational illness that may result in hospitalization of at least three personnel, loss exceeding $1M but less than $10M, or reversible environmental damage causing a violation of law or regulation Marginal: Could result in injury or occupational illness resulting in one or more lost work days, loss exceeding $500K but less than $1M, or mitigatible environmental damage without violation of law or regulation where restoration activities can be accomplished Negligible: Could result in injury or illness not resulting in a lost work day, loss exceeding $2K but less than $500K, or minimal environmental damage not violating law or regulation
Hazard Assessment Level Description Probability (Occurrences per 100K Flight Hours) A Frequent p > 100 B Probable 100 p > 10 C Occasional 10 p > 1 D Remote 1 p > 0.1 E Improbable 0.1 p 0.01
Develop Controls System Safety Design Order of Precedence Eliminate hazard through design selection select design or material that removes hazard Reduce risk through design alteration consider a design change that reduces mishap severity or probability Incorporate engineered features or devices reduce severity or probability using engineered features or devices Provide warning devices install devices that alert personnel to hazard Incorporate signage, procedures training, PPE use this control when all others are not feasible
Develop Controls System Safety Design Order of Precedence Eliminate hazard through design selection Critical controls location (easiest to reach by operators) Reduce risk through design alteration Control knobs designed based on function Incorporate engineered features or devices Interlocks and latches, overtemp/overspeed protection; power limiting system Provide warning devices Warning and caution lights within view of the operator Incorporate signage, procedures training, PPE Train operators and maintainers on system operation and maintenance
Implement Controls Design Selection / Design Alternatives/ Engineered Features and Devices 1) Balistically tolerant rotor and drive system 2) High mass components retained in 20/20/18g crash conditions 3) Anti-plow keel beams 4) Reduced rollover potential with CEFS installed 5) Energy absorbing landing gear (30 fps limits) 6) Crashworthy fuel cells (65 feet drop) 7) Jettisonable cockpit doors and pop-out windows 8) Wire strike protection
Monitor Monitor system failures identify hazards NOTE reporting systems, processes, and procedures are established for reporting failures
Summary Conduct thorough accident and incident investigations Fix the why an accident happened Incorporate lessons learned into new and modified system designs
You Can t Fix Stupid
1) Who was the first fatality in an Army aviation accident? 2) When and where was the accident? 3) Who was flying at the time of the accident? 48
1) First Lieutenant Thomas E. Selfridge 2) September 17, 1908, Fort Myer, Virginia 3) Orville Wright 49
50
51
Gary D. Braman, CSP Senior System Safety Engineer Sikorsky Aircraft Corporation Huntsville, AL gary.d.braman@lmco.com 256-327-5356 52