1. Tony LICU EUROCONTROL Glasgow – Aug 2005
Systemic Occurrence Analysis Methodology
© Dédale & EUROCONTROL
Tony LICU
EUROCONTROL
Glasgow – Aug 2005

2. SOAM A Reason-Based Organisational Methodology
A tool for the analysis of safety occurrences (accidents & Incidents)

3. SOAM Antecedents The Reason Model ~ circa 1990
Developed from Professor James Reason’s work on human error and “organisational accidents”
Tripod Delta ~ circa 1994
Developed for Shell Petroleum, based on Reason Model
ICAM ~ circa 2000
Developed for BHP Billiton, based on Reason Model and Tripod Delta
EUROCONTROL SOAM

4. “Recent” fatal accidents in Europe with ATM contribution
Two tragic accidents have occurred in the recent past in the heart of Europe. The Linate and Überlingen Accidents
The Linate accident occurred at 06:10 (UTC) on the 8th October A Cessna 525-A carrying two pilots and two passengers collided with an MD-87 carrying two pilots, four cabin attendants and one hundred and eight passengers at Linate airport near Milan. There were no survivors from the collision. The immediate cause was a runway incursion by the Cessna at a time when ATM personnel were operating under a relatively heavy workload given the adverse meteorological conditions. The longer-term causes included the failure of runway signs and markings to meet international standards and problems in the delivery of surface movement guidance and control systems, following the decommissioning of the Aerodrome Surface Movement Indicator. There were also problems in the training procedures in operation for ATM personnel at the time of the accident..
The Überlingen accident occurred at 21:35:32 hrs (UTC) on the 1st July A Tupolev TU154M was involved in a mid-air collision with a Boeing B north of the city of Überlingen, near Lake Constance. There were nine crewmembers and sixty passengers on-board the Tupolev. The B757 had a crew of two to support its cargo operations. Again, there were no survivors from this accident. The immediate causes of the accident included the failure of ATM personnel to identify and resolve the separation infringement in a timely manner. The TU154M crew also followed the ATM instruction to descend even after TCAS advised them to climb. The latent causes included problems in the safety management procedures that left ATM personnel with inadequate systems support. There were also problems in the staffing procedures in operation at the time of the accident.
Linate, 8 October 2001
Überlingen, 1 July 2002
EUROCONTROL SOAM

5. Call for Action Wake up call for action Wake up call for action
Aviation Safety is still at a good level
Traffic however is increasing
Two major accidents involving Air Traffic Management in 2001 and 2002 …..
In well developed countries in the heart of Europe …
From which many lessons can be learnt
As I mentioned previously aviation accidents are rare events. It was therefore, important that we learn as much as possible from those accidents that do occur. In consequence, EUROCONTROL created a number of international initiatives following the loss of life at Linate and Überlingen.
It was time for a WAKE UP CALL
(Briefly go through the slide and read the bullet points.)
Wake up call for action
Wake up call for action
EUROCONTROL SOAM

6. AGAS/ SSAP Priority Areas
An Action Group of European aviation safety experts identified the following areas as needing immediate focus:
Safety related human resources in ATM
Incident reporting and data sharing
ACAS/TCAS
Ground-based safety nets
Runway safety
Enforcement of ESARRs and implementation monitoring
Awareness of safety matters
Safety and human factors research & development
Safety related human resources in ATM
Incident reporting and data sharing
ACAS/TCAS
Ground-based safety nets
Runway safety
Enforcement of ESARRs and implementation monitoring
Awareness of safety matters
Safety and human factors research & development
EUROCONTROL answered the “wake-up” call and set up an Action Group of senior safety experts to look at what needed to be done to improve ATM safety after the 2 fatal accidents.
Here are the 8 High Priority Areas identified by the Group. It was considered that these were the areas where the greatest safety benefits could be achieved in the shortest timescale.
(Briefly go through the slide and read the bullet points.)
EUROCONTROL SOAM

7. Why another investigation tool?
Support ESARR 2 implementation and Strategic Safety Action Plan
Higher quality reports and AST returns ~ a need to:
clearly identify causes and report them concisely
go beyond the human errors, to find systemic causes
use a simple, consistent approach for events of all severity levels
ensure recommendations are relevant and effective
EUROCONTROL SOAM

8. Current investigation methods
What can we improve about the way we conduct safety occurrence investigations?
EUROCONTROL SOAM

9. How SOAM can help A methodology that includes structured processes to:
identify and classify a range of contributing factors
sort out irrelevant, non-contributing facts
move from a focus on human error/s to identify systemic causes ~ support for ‘Just Culture’
analyse simple events through to high severity incidents and accidents
clearly link recommendations to the facts of the analysis
EUROCONTROL SOAM

10. Elements of Organisational Occurrences
Organisational Factors:
Latent system failures that produce or allow conditions under which accidents are possible
Contextual Conditions:
Situational factors involving characteristics of the task, the environment or human limitations
Human Involvement:
Errors and/or violations which have an immediate adverse affect (“active failures”)
Inadequate or absent barriers/defences:
Failure to identify and protect the system against human errors or violations, local conditions
EUROCONTROL SOAM

11. Organisational Error Chain
The Reason Model
Organisational Error Chain
Contextual
Conditions
Human Involvement
Organisational and System Factors
Absent or Failed
Barriers
“Unsafe
Acts”
People, Task, Environment
ACCIDENT
Limited window/s
of opportunity
Active
Failures
Latent Conditions
(adapted from Reason, 1990)
EUROCONTROL SOAM

12. Stages in development & investigation of an organisational accident
Barriers
Losses
DANGER
Hazards
Latent
condition
pathways
Investigation process
Human Involvement
Causes
Contextual Conditions
(Adapted from Reason, 1997)
Organisational & System Factors

13. Accident “Causes” What is the cause of the accident?
A man has a bad argument with his wife.
He storms out of the house to the nearest bar and drinks four whiskies.
He then decides to go for a drive.
It is night-time, there is a skim of snow on the ground, and the tyres on our victim’s car are smooth.
In rounding a poorly banked curve at excessive speed, the right front tyre blows out, the car leaves the road and is demolished.
What is the cause of the accident?
(Johnston, 1996)
EUROCONTROL SOAM 

14. Runway Overrun, Bangkok September 1999
SOAM Worked Example
Runway Overrun, Bangkok September 1999
EUROCONTROL SOAM

15. Accident Summary
On 23 September 1999, at about 2247 local time, a Boeing aircraft overran runway 21 Left (21L) while landing at Bangkok International Airport, Thailand.
EUROCONTROL SOAM

16. Accident Summary
The overrun occurred after the aircraft landed long and aquaplaned on a runway which was affected by water following very heavy rain.
The aircraft sustained substantial damage during the overrun. None of the three flight crew, 16 cabin crew or 391 passengers reported any serious injuries.
EUROCONTROL SOAM

17. SOAM analysis key steps
Review the Facts
Identify the Absent or Failed Barriers
“CHECK QUESTIONS” HELP TO SORT AND CLASSIFY FACTS
Identify the Human Involvement
Identify the Contextual Conditions
Identify the Organisational Factors
Validate the OFs against the Occurrence
EUROCONTROL SOAM

18. LIVEWARE
Operators L
HARDWARE
Equipment, vehicles, tools, controls, switches, levers, workplace design, seating etc H
L L
LIVEWARE/LIVEWARE
Interface between people.
Operators, controllers, managers, etc E
ENVIRONMENT
Site, terrain, weather, roads, traffic, remoteness etc S
SOFTWARE
Procedures,
checklists,
manuals,
training materials,
charts etc
The SHEL Model
(after Edwards, 1972)
EUROCONTROL SOAM

19. Raw Data Collection PEOPLE HARDWARE SOFTWARE ENVIRONMENT ORGANISATION
AC1 overruns runway at Bangkok after landing long, recent heavy rainfall, and water on runway.
PEOPLE
HARDWARE
SOFTWARE
ENVIRONMENT
ORGANISATION
Crew employed flaps 25/ idle reverse landing configuration
Normal practice to use flaps 25/idle reverse
Revised approach/ landing procedure introduced in 1996: flaps 25, idle reverse thrust
Very heavy rainfall, runway surface affected by water
Introduction of new landing procedure poor
Captain
First Officer
FO did not fly the aircraft accurately during final approach
Importance of reverse thrust as stopping force on water-affected runways not known
Reduced visibility & distraction: rain and windscreen wipers
No formal risk assessment conducted when changed landing procedure researched
No appropriately documented info, procedures regarding operations on water-affected runways
Captain cancelled go-around decision by retarding thrust levers
Other pilots
Qantas B747s generally operated in good weather & to aerodromes with long, good quality runways
Cost-benefit analysis of new landing procedure was biased
Most pilots not fully aware about 'aquaplaning'
FO awake for 19 hours at the time of the accident
No policies, procedures on duty or work limits for pilots with flying & non-flying duties
Contaminated runway issues not covered in recent years during crew endorsement, promotional or recurrent training
Confusion after thrust levers retarded, in high workload situation
Captain did not order a go-around earlier
Bangkok runway was resurfaced in 1991
Recent crew experience using full reverse thrust lacking
Documents unclear (eg., key terms not well defined)
High workload situation, distraction or inexperience
Boeing advised that if idle reverse technique is adopted, it should be the exception rather than the rule
“Landing on Slippery Runways” (Boeing doc) not distributed in Qantas since 1977
Crew did not use an adequate risk mgt strategy for approach and landing
Most pilots disagreed they had adequate training on landing on contaminated runways
Partial loss of external visual reference due to heavy rain
No formal review of new procedures after 'trial' period
Absence of reverse thrust during landing roll not noticed, not used
Captain awake 21 hours at time of accident
No policies or procedures for maintenance of recency for management pilots
Captain & FO quite low levels of flying prior 30 days
Gather data relevant to the occurrence

20. Raw Data Refinement
AC1 overruns runway at Bangkok after landing long, recent heavy rainfall, and water on runway.
PEOPLE
HARDWARE
SOFTWARE
ENVIRONMENT
ORGANISATION
Crew employed flaps 25/ idle reverse landing configuration
Normal practice to use flaps 25/idle reverse
Revised approach/ landing procedure introduced in 1996: flaps 25, idle reverse thrust
Very heavy rainfall, runway surface affected by water
Introduction of new landing procedure poor
Captain
First Officer
FO did not fly the aircraft accurately during final approach
Importance of reverse thrust as stopping force on water-affected runways not known
Reduced visibility & distraction: rain and windscreen wipers
No formal risk assessment conducted when changed landing procedure researched
No appropriately documented info, procedures regarding operations on water-affected runways
Captain cancelled go-around decision by retarding thrust levers
Other pilots
Qantas B747s generally operated in good weather & to aerodromes with long, good quality runways
Cost-benefit analysis of new landing procedure was biased
Most pilots not fully aware about 'aquaplaning'
FO awake for 19 hours at the time of the accident
No policies, procedures on duty or work limits for pilots with flying & non-flying duties
Contaminated runway issues not covered in recent years during crew endorsement, promotional or recurrent training
Confusion after thrust levers retarded, in high workload situation
Captain did not order a go-around earlier
Bangkok runway was resurfaced in 1991
Bangkok runway was resurfaced in 1991
Recent crew experience using full reverse thrust lacking
Documents unclear (eg., key terms not well defined)
High workload situation, distraction or inexperience
Boeing advised that if idle reverse technique is adopted, it should be the exception rather than the rule
Boeing advised that if idle reverse technique is adopted, it should be the exception rather than the rule
“Landing on Slippery Runways” (Boeing doc) not distributed in Qantas since 1977
Crew did not use an adequate risk mgt strategy for approach and landing
Most pilots disagreed they had adequate training on landing on contaminated runways
Partial loss of external visual reference due to heavy rain
No formal review of new procedures after 'trial' period
Absence of reverse thrust during landing roll not noticed, not used
Captain awake 21 hours at time of accident
No policies or procedures for maintenance of recency for management pilots
Sort out the non-contributing facts of the investigation
Captain & FO quite low levels of flying prior 30 days

21. Raw Data Refinement
AC1 overruns runway at Bangkok after landing long, recent heavy rainfall, and water on runway.
PEOPLE
HARDWARE
SOFTWARE
ENVIRONMENT
ORGANISATION
Crew employed flaps 25/ idle reverse landing configuration
Normal practice to use flaps 25/idle reverse
Revised approach/ landing procedure introduced in 1996: flaps 25, idle reverse thrust
Very heavy rainfall, runway surface affected by water
Introduction of new landing procedure poor
Captain
FO did not fly the aircraft accurately during final approach
First Officer
Importance of reverse thrust as stopping force on water-affected runways not known
Reduced visibility & distraction: rain and windscreen wipers
No formal risk assessment conducted when changed landing procedure researched
No appropriately documented info, procedures regarding operations on water-affected runways
Captain cancelled go-around decision by retarding thrust levers
Other pilots
Qantas B747s generally operated in good weather & to aerodromes with long, good quality runways
Cost-benefit analysis of new landing procedure was biased
Most pilots not fully aware about 'aquaplaning'
FO awake for 19 hours at the time of the accident
No policies, procedures on duty or work limits for pilots with flying & non-flying duties
Contaminated runway issues not covered in recent years during crew endorsement, promotional or recurrent training
Confusion after thrust levers retarded, in high workload situation
Captain did not order a go-around earlier
Recent crew experience using full reverse thrust lacking
Documents unclear (eg., key terms not well defined)
High workload situation, distraction or inexperience
“Landing on Slippery Runways” (Boeing doc) not distributed in Qantas since 1977
Crew did not use an adequate risk mgt strategy for approach and landing
Most pilots disagreed they had adequate training on landing on contaminated runways
Partial loss of external visual reference due to heavy rain
No formal review of new procedures after 'trial' period
Absence of reverse thrust during landing roll not noticed, not used
Captain awake 21 hours at time of accident
No policies or procedures for maintenance of recency for management pilots
Use the remaining factors to build the Analysis chart
Captain & FO quite low levels of flying prior 30 days

22. ? ? Building the Analysis Chart
ORGANISATIONAL FACTORS
CONTEXTUAL CONDITIONS
HUMAN INVOLVEMENT
ABSENT OR FAILED BARRIERS
ACCIDENT
Very heavy rainfall, runway surface affected by water
Very heavy rainfall, runway surface affected by water ?
Very heavy rainfall, runway surface affected by water ?
Very heavy rainfall, runway surface affected by water

23. Absent or Failed Barriers
Describe the “last minute” measures which failed or were missing, and therefore did not prevent the accident
Check Question: “Does the item describe a work procedure, aspect of human awareness, physical obstacle, warning or control system, or protection measure designed to prevent an occurrence or lessen its consequences?”
The next five slides describe the process for determining
Absent or failed defences
Individual and Team actions
Task and Environmental conditions (situational factors)
Organisational and System factors
Recommendations to address the identified deficiencies.
The above relates to defences which were present but were inadequate (SOPs, checklists, training, regulations, TCAS, GPWS, etc.)
EUROCONTROL SOAM

24. Human Involvement
Describe the errors or violations (actions or omissions) by operators at the scene which “triggered” the accident
Check Question: “Does the item describe an action or non-action (error or violation) that immediately contributed to the occurrence?”
As above
EUROCONTROL SOAM

25. ? Building the Analysis Chart
ORGANISATIONAL FACTORS
CONTEXTUAL CONDITIONS
HUMAN INVOLVEMENT
ABSENT OR FAILED BARRIERS
ACCIDENT
Very heavy rainfall, runway surface affected by water
Crew employed flaps 25/ idle reverse landing configuration
Crew employed flaps 25/ idle reverse landing configuration ?
Crew employed flaps 25/ idle reverse landing configuration

26. Contextual Conditions
Describe the context of the event ~ the conditions existing immediately prior to, or at the time of the accident
Check Question: “Does the item describe an aspect of the workplace, local organisational climate, or a person’s attitudes, personality, performance limitations, physiological or emotional state that helps explain their actions?”
As above.
Identify the situational characteristics.
EUROCONTROL SOAM

27. Organisational Factors
Describe the organisational and system factors (failures) which created, or allowed, the prevailing contextual conditions
Check Question: “Does the item describe an aspect of an organisation’s culture, systems, processes or decision-making that existed before the occurrence and which resulted in the contextual conditions or allowed those conditions to continue?”
As above
EUROCONTROL SOAM

28. ORGANISATIONAL FACTORS CONTEXTUAL CONDITIONS ABSENT OR FAILED BARRIERS
OTHER SYSTEM FACTORS
ORGANISATIONAL FACTORS
CONTEXTUAL CONDITIONS
HUMAN INVOLVEMENT
ABSENT OR FAILED BARRIERS
ACCIDENT
PP No appropriately documented info, procedures re operations on water-affected runways
Very heavy rainfall, runway surface affected by water
SOAM Chart Aircraft Accident Boeing Bangkok, Thailand September 1999
Crew not aware of critical importance of reverse thrust as stopping force on water-affected runways
PP Regulations covering contaminated runway operations deficient
CO “Landing on Slippery Runways” (Boeing doc) not distributed in Qantas since 1977
Flight crew did not use an adequate risk management strategy for approach and landing
Most pilots not fully aware about 'aquaplaning'
TR Contaminated runway issues not covered during crew endorsement, promotional or recurrent training in recent years
Qantas B747s generally operated in good weather & to aerodromes with long, good quality runways
AC CASA surveillance of airline flight operations deficient
CO Documents unclear (eg., key terms not well defined)
Landing procedure inappropriate
Aircraft overran runway after landing long
No serious injuries (391 pax, 19 crew)
Potential for more serious outcome
Aircraft repair cost: $100,000,000 (?)
Damage to company reputation
New 1996 approach/ landing procedure inappropriate
Crew employed flaps 25/idle reverse landing configuration
OC Mgt decisions informal, “intuitive”, “personality-driven”
RM No formal risk assessment conducted when changed landing procedure researched
Normal practice to use flaps 25/idle reverse
Absence of reverse thrust during landing roll not noticed, reverse thrust not used
Recent crew experience using full reverse thrust lacking
Accident summary from AirDisaster.Com:
“The aircraft landed long in a driving rainstorm after confusion between the Captain and First Officer on whether to go-around. The aircraft overran the runway coming to rest on the fairway of an adjacent golf course. Pilot error.”
From Avweb news wire:
Qantas Decision Par For The Course
Australian airline Qantas has apparently decided to repair a Boeing 747 that took a short golfing vacation. Pilots bringing the birdie in for a landing at the Bangkok International Airport during a tropical storm made a long hook shot as the plane overran the runway and slid onto a golf course just beyond. You can see in pictures that the plane won't be an eagle anytime soon -- there was major damage to the nose, landing gear, engines, and fuselage undercarriage. Qantas insurers are facing a repair bill of nearly $100 million, so why not just write it off? Qantas, established in 1920, has never lost an aircraft and it isn't about to let this bogey be the first.
See below also. James strong confirms cost at $100 million
CM Introduction of new landing procedure poor
First Officer did not fly the aircraft accurately during the final approach
Reduced visibility & distraction: rain and windscreen wipers
PP Regulations covering emergency procedures & EP training were deficient
CM No formal review of new procedures after 'trial' period
Crew Resource Management deficient
CG Cost-benefit analysis of new landing procedure was biased
Captain & FO quite low levels of flying prior 30 days
Captain did not order a go- around earlier
FO awake for 19 hours at the time of the accident
WM No policies or procedures
for maintenance of recency
for management pilots
Captain cancelled go-around decision by retarding the thrust levers
Captain awake 21 hours at time of accident
WM No policies, procedures on duty or work limits for pilots with flying & non-flying duties
High workload situation

29. Recommendations
Provide recommendations that will prevent recurrence of this scenario
Recommendations should be directed to the responsible position, and must address all identified:
Absent or Failed Barriers
Organisational Factors
As above.
Recommendations must address the identified systemic deficiencies.
EUROCONTROL SOAM

30. ORGANISATIONAL FACTORS CONTEXTUAL CONDITIONS ABSENT OR FAILED BARRIERS
OTHER SYSTEM FACTORS
ORGANISATIONAL FACTORS
CONTEXTUAL CONDITIONS
HUMAN INVOLVEMENT
ABSENT OR FAILED BARRIERS
ACCIDENT
CM No formal review of new procedures after 'trial' period
PP No appropriately documented info, procedures re operations on water-affected runways
WM No policies, procedures on duty or work limits for pilots with flying & non-flying duties
PP Regulations covering emergency procedures & EP training were deficient
AC CASA surveillance of airline flight operations deficient
RM No formal risk assessment conducted when changed landing procedure researched
CO Documents unclear (eg., key terms not well defined)
CO “Landing on Slippery Runways” (Boeing doc) not distributed in Qantas since 1977
TR Contaminated runway issues not covered during crew endorsement, promotional or recurrent training in recent years
WM No policies or procedures
for maintenance of recency
for management pilots
CM Introduction of new landing procedure poor
CG Cost-benefit analysis of new landing procedure was biased
PP Regulations covering contaminated runway operations deficient
OC Mgt decisions informal, “intuitive”, “personality-driven”
PP No appropriately documented info, procedures re operations on water-affected runways
Very heavy rainfall, runway surface affected by water
SOAM Chart Aircraft Accident Boeing Bangkok, Thailand September 1999
Crew not aware of critical importance of reverse thrust as stopping force on water-affected runways
PP Regulations covering contaminated runway operations deficient
CO “Landing on Slippery Runways” (Boeing doc) not distributed in Qantas since 1977
Flight crew did not use an adequate risk management strategy for approach and landing
Most pilots not fully aware about 'aquaplaning'
TR Contaminated runway issues not covered during crew endorsement, promotional or recurrent training in recent years
Qantas B747s generally operated in good weather & to aerodromes with long, good quality runways
AC CASA surveillance of airline flight operations deficient
CO Documents unclear (eg., key terms not well defined)
Absence of reverse thrust during landing roll not noticed, reverse thrust not used
Landing procedure inappropriate
Crew Resource Management deficient
Landing procedure inappropriate
Aircraft overran runway after landing long
No serious injuries (391 pax, 19 crew)
Potential for more serious outcome
Aircraft repair cost: $100,000,000 (?)
Damage to company reputation
New 1996 approach/ landing procedure inappropriate
Crew employed flaps 25/idle reverse landing configuration
OC Mgt decisions informal, “intuitive”, “personality-driven”
RM No formal risk assessment conducted when changed landing procedure researched
Normal practice to use flaps 25/idle reverse
Absence of reverse thrust during landing roll not noticed, reverse thrust not used
Recent crew experience using full reverse thrust lacking
Accident summary from AirDisaster.Com:
“The aircraft landed long in a driving rainstorm after confusion between the Captain and First Officer on whether to go-around. The aircraft overran the runway coming to rest on the fairway of an adjacent golf course. Pilot error.”
From Avweb news wire:
Qantas Decision Par For The Course
Australian airline Qantas has apparently decided to repair a Boeing 747 that took a short golfing vacation. Pilots bringing the birdie in for a landing at the Bangkok International Airport during a tropical storm made a long hook shot as the plane overran the runway and slid onto a golf course just beyond. You can see in pictures that the plane won't be an eagle anytime soon -- there was major damage to the nose, landing gear, engines, and fuselage undercarriage. Qantas insurers are facing a repair bill of nearly $100 million, so why not just write it off? Qantas, established in 1920, has never lost an aircraft and it isn't about to let this bogey be the first.
See below also. James strong confirms cost at $100 million
CM Introduction of new landing procedure poor
First Officer did not fly the aircraft accurately during the final approach
Reduced visibility & distraction: rain and windscreen wipers
PP Regulations covering emergency procedures & EP training were deficient
CM No formal review of new procedures after 'trial' period
Crew Resource Management deficient
CG Cost-benefit analysis of new landing procedure was biased
Captain & FO quite low levels of flying prior 30 days
Captain did not order a go- around earlier
FO awake for 19 hours at the time of the accident
WM No policies or procedures
for maintenance of recency
for management pilots
Captain cancelled go-around decision by retarding the thrust levers
Captain awake 21 hours at time of accident
WM No policies, procedures on duty or work limits for pilots with flying & non-flying duties
High workload situation

31. Questions?
EUROCONTROL SOAM

32. EUROCONTROL SOAM