Accident Investigation FRAM_AA

Erik Hollnagel, 2010

The use of FRAM for accident investigation

Erik HollnagelMINES ParisTech, Crisis and Risk Research Centre

Sophia Antipolis, (F)[email protected]


FRAM analysis steps

Propose ways to monitor and dampen performance variability (indicators, barriers, design / modification, etc.)4

Define functional resonance based on potential / actual dependencies (couplings) among functions.3

Characterise the actual / potential variability of 'foreground' functions and 'background' functions (context). Consider both normal and worst case variability.

2

Identify the essential functions in the event ('foreground' functions when things go right); characterise each by six basic aspects. 1

Define the purpose of modelling and describe the situation being analysed. An event that has occurred (incident/accident) or a possible future scenario (risk).

0


The event: Comair Flight 5191Objective: Apply FRAM to the Comair flight 5191 accident in Lexington, KY, and compare to a traditionally performed investigation.

At 06:06 of August 27th, 2006, Comair flight 5191 en route to Atlanta, GA, crashed after an attempted take-off from Lexington Blue Grass Airport in Lexington, KY. The aircraft taxied out uneventfully and then inadvertently proceeded to depart from the shorter general aviation runway (runway 26) as opposed to the longer air carrier runway (runway 22). The aircraft became momentarily airborne after it struck an earthen berm, then collided with trees, and crashed. There was a significant post-crash fire consuming most of the aircraft, and 49 of the 50 passengers and crew perished.


Intended taxi/takeoff path

Actual taxi/takeoff path


NTSB analysis and conclusions... the probable cause of this accident was the flight crewmembers failure to use available cues and aids to identify the airplanes location on the airport surface during taxi and their failure to cross-check and verify that the airplane was on the correct runway before takeoff. Contributing to the accident were the flight crews nonpertinent conversation during taxi, which resulted in a loss of positional awareness, and the Federal Aviation Administrations (FAA) failure to require that all runway crossings be authorized only by specific air traffic control (ATC) clearances.

NTSB. (2007). Attempted takeoff from wrong runway, Comair Flight 5191, Bombardier CL-600-2B19, N431CA, Lexington, Kentucky, August 27, 2006 (Aircraft Accident Report NTSB/AAR-07/05).

Washington, DC: National Transportation Safety Board.

Formal accident investigations usually start with an assumption that the operator must have failed, and if this attribution can be made, that is the end of serious inquiry. (Perrow (1984). Normal Accidents)


FRAM analysis steps




2



0


Identifying Functions: General

An accident investigation typically starts from the observed (adverse) outcome, and traces the developments backwards in order to find out what went wrong or malfunctioned.

PURPOSE: The purpose of a FRAM analysis is to identify how the system should have functioned for everything to succeed (i.e., normal performance), and then understand the variability which alone or in combination prevented that from happening.

MODEL: A FRAM model describes a systems functions and the potential couplings among functions. But the model does not describe or depict a sequence of events, i.e., the accident scenario.

INSTANTIATION: An accident scenario can be the result of an instantiation of the model. The instantiation is a map of how functions are coupled under given favourable or unfavourable - conditions.


Identifying Functions: Details

There is no single, correct level of description. A FRAM model will typically comprise functions described on different levels. If there can be significant variability in a function, then it is possible to go deeper into the analysis of that function, and possibly break it down into subfunctions..

The analysis may go beyond the boundaries of the system as initially defined. If some function outside the system can vary and thereby affect other functions inside the system, then it should be included in the analysis.

A FRAM analysis can in principle begin with any function. The analysis will show the need for other functions to be included, i.e., functions that are coupled or linked through various relations. FRAM defines six types of relations.

Where to begin

Level of description

Level of detail

System boundary (stop rule)


FRAM analysis steps




2



0


Output

Resource

Control

Input

Precondition

Time

FRAM functional unit (module)

That which is used or transformed to

produce the output. Constitutes the link to

previous functions.

That which is produced by function. Constitute links to subsequent functions.

That which is needed or consumed by function to process input (e.g., matter, energy, hardware, software, manpower).

That which supervises or adjusts a function. Can be plans, procedures, guidelines or other functions.

System conditions that must be fulfilled before a

function can be carried out.

Time available: This can be a constraint but can also

be considered as a special kind of resource.


Normal taxi & takeoff sequence

Review of weather and airport dataTaxi briefingTakeoff briefingEngine startATC clearance(s)Taxi ChecklistTaxi to runwayBefore takeoff checklistWait at the hold short lineTurn onto runwayTakeoff


Review of weather and airport data

Dispatcher

prepares flight

information

RP

I

T

O

C

Review of

weather and

airport data

RP

I

T

O

C

KLEX NOTAM

generation

RP

I

T

O

C

NOTAM describing a portion of a taxiway closed due to construction (taxiway Alpha North of runway 26) missing from flight release, not included in the ATIS broadcast on the morning of the accident as required.


FRAM analysis steps




2



0


.. failure to use available cues and aids ..

Dispatcher

prepares flight info

RP

I

T

O

CReview

of weather

and airport data

RP

I

T

O

C

KLEX NOTAM

generation

RP

I

T

O

C

KLEX ATIS

Service

RP

I

T

O

CAt the time of the accident, the flight crew had the most recent Jeppesen chart for LEX, dated January 2006. This chart showed taxiway A5 and taxiway A north of runway 8/26. However, at the time of the accident, taxiway A5 had been redesignated as taxiway A, and taxiway A north of runway 8/26 had been closed.

The local NOTAM that indicated that taxiway A north of runway 8/26 was closed, was not

included in the Comair flight planning system or the flight release paperwork for the flight because the company determined that the

information in the local NOTAM did not affect safety of flight.


Beginning to build the larger picture

Perform taxi

checklist

RP

I

T

O

C

KLEX ATC

clearance

RP

I

T

O

C

KLEX taxi

briefing

RP

I

T

O

C

Perform before take-off checklist

RP

I

T

O

C

Taxi to runway

RP

I

T

O

C

Taxi onto runway

RP

I

T

O

C


... the probable cause of this

accident was the flight crewmembers

failure to use available cues and

aids ...

NTSB conclusion:


FRAM analysis steps




2



0


ConclusionsThe outcome of an accident investigation depends on how it is carried out:What You Look For Is What You Find (WYLFIWYF)

The common (structural) approach is to work backwards from the outcome, and to look for an acceptable cause or set of causes. This is supported by institutionalised methods, models, and/or regulations. The result is a set of failures or malfunctions, that become the target of remedial action.

An alternative (functional) approach is to account for the normal operations (successes) and to explain how and why they varied under the conditions

This produces an understanding of how functions (tasks) may depend on each other, and how performance variability can unexpectedly combine and propagate, hence how normally successful actions may sometimes fail. Recommendations are about how and when to dampen or block variability and how and when to foster it.

Documents

Accident Investigation FRAM_AA