When Asiana flight 214 crashed on the runway of San Francisco airport on July 6 2013 it was up to the National Transportation Safety Board of the US to investigate the cause of the accident and in their report they focused heavily on human performance on part of the pilots They ended their report with 30 conclusions about why the crash had happened. Drwing on the Rasmussian school of safety though I will highlight some of these conclusions and present three common traps in accident investigation. The first trap we’re going to look at is counterfactual reasoning.
Counterfactual reasoning is when the investigator is discussing a case that never happened, like a parallel universe. Let’s have a look at the report: Quotes like “did not initiate” and “did not have” are clear indications that the investigators have fallen into the counterfactual trap. Another kind of counterfactual reasoning is when investigators hypothesise different scenarios, like in the following two quotes: And the next quote: The problem with counterfactual reasoning is that it prioritises an analysis of what the system did not do and as a consequence it ignores an analysis of why it made sense for the system to act the way that it did when it did - because it did make sense to act the way it did, it must have, right?
If the action had not made sense at the moment it would not have happened. The analysis becomes one of an imagined system in a parallel universe, rather than an analysis of the system as it actually worked at the time of the accident. The second trap is normative language.
In accident analysis normative language is when the investigator puts his or her values into the analysis of other people’s performance. We can read in the report Normative language measures people’s performance based on some norm or idea of what is appropriate behaviour, as if the pilots chose to fly a mismanaged vertical profile. Normative language can also include speculations as to why the crew behaved in an “inappropriate” manner.
Like in the following quote. When falling into the trap of normative language the investigator sounds more like a judge than like a curious investigator. And this goes for judging both poor and good behaviour.
Here is an example of the latter: These norms, on which the normative language is built, are typically defined in hindsight and make sense from an argument that the norm was not adhered to in the event - It cannot have been if it was it would never have happened, right? Often this norm is very vaguely defined, using highly subjective notions, in this case mismanaged, insufficient monitoring and appropriately to suggest the causal link between poor behaviour and the accident. The third trap is mechanistic reasoning.
Mechanistic reasoning suggests that accidents are caused by malfunctioning components in a basically well functioning, reliable and safe machine. If only all components are in place and working as they should the system will be safe. In the report we can read This passage is interesting because it essentially lists all the system components that were working reliably at the time of the event.
From the view of mechanistic reasoning this makes sense. If accidents are caused by malfunctioning system components identifying all the functioning system components, excluding them one by one as contributing factors, will eventually lead to the malfunctioning component or components. Here is another conclusions listing several broken system components related to human behaviour And Eureka!
The malfunctioning component has been identified. To no big surprise it was, once again the human that was constructed as the malfunctioning component in a system of reliably functioning technological components. To contemporary safety science this mechanistic reasoning does not make sense.
Instead we need to understand that accidents are the results of well functioning components interacting in unexpected ways. What we then need to understand is why it made sense for the Asiana pilots to do exactly what they did given their expectations, knowledge and focus of attention. They did not intervene until the system was beyond a point at which it could be saved and that was because they experienced a system that was behaving as they expected.
To understand why this was the case we can look into the research describing automation surprises; situations where operators are surprised by the behavior of the automation and asking questions like, what is it doing now, why did it do that, or what is it going to do next? Those are the three main traps of accident analysis. But I will leave you with a fourth bonus trap and that is cherry picking of data, to only reveal the data which fits the point that you are trying to make.
A little bit like I have just done with showing only 8 out of the 30 points of the NTSB’s list of causal factors.
