Investigation Analysis Frame Work

Capt. Nurcahyo Utomo

 Course overview
• This course is intended to provide
understanding of the KNKT investigation
analysis;
• The course material was developed by the
assistance of Australia Transport Safety Bureau
(ATSB) under Indonesia Transport Safety
Assistance Package (ITSAP).

 Course overview
• The analysis is based on James Reason ‘Swiss
Cheese’ model which modified by ATSB.
• This model intended to be used in all KNKT
investigations.

 Learning Outcomes
At the end of the course participants are expected to be
able to construct an investigation analysis report of an
transport accident and to explain and present the result
and process in an investigation report.

1. Participants can construct the logic in an aircraft accident

investigation analysis,
2. Participants are able to prepare a written report and present
the investigation analysis based on the relevant factual data.

 Course Contents
❑ Investigation Analysis Framework
❑ Sequence of Events
❑ Reasoning Concept
❑ Evidence Analysis Overview
❑ Contributing Factor Analysis
❑ Developing Safety Recommendations

 Accident causation models development

• First model was developed by Heinrich (1930), the
model was known as “Domino Theory” which
described that an event may lead to another that
caused to an accident.
• 1970 Bird and Loftus develop applied linear casualty.
• 1990 James Reason develop a model known as “Swiss
Cheese”
• 1997 Rasmussen
• 2008 Hollnagel identified the system as the full
context in which errors and accidents occurs.

Heinrich model
 Rasmussen (1997)
Rasmussen (1997): task analysis
focused on action sequences and
occasional deviation in term of human
error, should be replaced by a model
behaviour shaping mechanism in
terms of work system constraints,
boundaries and acceptable
performance and subjective criteria
guiding adaptation to change. Model
task sequences and error is considered
not effective for understanding
behaviour
 Human Factors modelling
Gradual development of accident models shows
three generations of human error modelling, from a
sequential accident model, human information
processing models toward systemic accident model.

Some focus on Human Factors

– Chain of error
– SHELL concept

 Six M model
a. The man-machine interface. This area takes
into account any organizational actions
which combine a piece of equipment with
an individual who is in some way
incompatible with that equipment
b. The man-medium interface. The activity
that surrounds the accident sequence
should be considered in light how the
individual had to cope with the
environment.
c. The Machine-Medium interface.
Compatibility of the equipment to
effectively operate within the medium is
central on organization decision to use the
equipment

 Six M Model - Management

• Organization management administer the element that make
up the basic factors. This should include all levels of supervision
from the most senior management officials to the supervision
of individuals directly involve.
• Management issue should also be considered externally to
include industry or government oversight organization which
issue control and/or monitor operating certificates.
• Organisation responsible to establish procedure and oversight
the implementation up to the individuals directly involve. (in
the form of checklist or task card)
• Money also means resources. It includes
– Availability of human resources;
– Quality of human resources;
– Acquisition of parts and other commodities

 Reason Model
• ….such accident modelling based on the Reason Model proved
difficult to apply, resulting in an increasing amount of varieties
and simplification (Sklet, 2004).
Accident causation based on Reason Model
 Uses of Models
• Some analysis methods have no models, some have
nothing but the model
• Models are not the analysis methods, but are useful
for:
– Identifying potential safety factors
– Maintaining awareness of progress during an
investigation
– Communicating the result of investigation
– Providing a taxonomy for classifying factors in database

 ICAO Recommendation
• ICAO recommend to use Reason Model or Six
M model for the organization investigation
(ICAO Doc 9756 Part III Chapter 3)
• ICAO recommend to use SHELL concept for
Human Factors. (ICAO Doc 9683)

 Objectives
Provide the understanding of define
analysis terms and concepts and
investigation analysis.
 Safety Investigation
Peraturan Pemerintah nomer 62 tahun 2013,
tentang Investigasi Kecelakaan Transportasi: BAB
1 Ketentuan umum:
Investigasi kecelakaan transportasi adalah
kegiatan penelitian terhadap penyebab
kecelakaan transportasi dengan cara
pengumpulan, pengolahan, analisis dan
penyajian data secara sistematis dan objektif agar
tidak terjadi kecelakaan transportasi dengan
penyebab yang sama.

 Objective of investigation
IMO Resolution MSC.255(84) 1.1
• The objective of this Code is to provide a common
approach for States to adopt in the conduct of
marine safety investigations into marine casualties
and marine incidents. Marine safety investigations
do not seek to apportion blame or determine
liability. Instead a marine safety investigation, as
defined in this Code, is an investigation conducted
with the objective of preventing marine casualties
and marine incidents in the future.

 Objective of investigation
ICAO Annex 13
• 3.1 The sole objective of the investigation of
an accident or incident shall be the
prevention of accidents and incidents. It is
not the purpose of this activity to apportion
blame or liability.

 Transport accidents

• Involves many factors;

• How factors combine can be complex, dynamic;
• Individual action are commonly involved – but
most have reasons;
• Involves aspects of how organisation manages
safety;

 Analysis
• Occurs throughout the investigation
• The heart of the safety investigation
• Involves asking questions
• Needs longer time
• Team based approach

 Analysis
Process where available data is evaluated and
converted into a series of arguments, which
produce a series of relevant findings.
 Analysis Overview
• How’s findings can be developed?
ANALYSIS
• Analysis convert data to findings
• Uses arguments, which involves:
– Reviewing evidence DATA
– Organizing evidence
– Interpreting evidence
ANALYSI
– Identifying hypotheses
S
– Defining hypotheses
– Testing hypotheses
FINDINGS

 Reason Model
MAIIF Manual Chapter 4.2.3. and ICAO Doc 9859.
KNKT Policy and Procedure Manual

 The Accident Causation

Risk Controls
(Recovery)

Incident

Individual
Actions
Organizational Risk Controls Local Production
Influences (Preventive) Conditions Goals
Technical
Failure
Mechanisms

Risk Controls
(Recovery) Accident

 Organizational Influences
What could have been in place to minimize
Level of Analysis problems with the risk controls?
Risk Controls
What could have been in place to reduce the
likelihood or severity of problems at the

INVESTIGATION LINE
operational level?
Local Conditions
What aspects of the local environment influenced
the individual actions/technical problems?
Individual Actions
What individual actions increased safety risk?
Technical Failure Mechanisms
How did the equipment fail?
Occurrence Events
What events best describe the occurrence?
(including technical problems)

 O
hazard identification change management organizational design

Internal auditing Organizational Influences regulations

training needs analysis regulatory surveillance

management skills
experience recurrent training

R
rosters crew pairing
normal procedures
emergency procedures CRM program
Risk Controls displays/controls
detection/warning systems
initial training facilities/infrastructures supervision

health lighting experience

L
visual ability alcohol/drugs
workload stress
noise
fatigue
Local Conditions interpersonal conflict
knowledge peer pressure
distraction weather

violation corrosion wear fracture

I
information problem
Technical Failure
Individual Actions
action problem
Mechanisms
decision problem discontinuity deformation

breakdown of separation Vessel grounding

O
track irregularity
unstable approach
fire/explosion
Occurrence Events
engine failure derailment tailstrike collision

 Occurrence Events
• Key events that describe what happened.
• Event that ultimately need to be explained.
• Provide platform to start analysis of safety
factors.

breakdown of separation track irregularity Vessel grounding

unstable approach Occurrence Events fire/explosion

engine failure derailment tailstrike collision

 Individual Actions
violation
information problem
Individual Actions
decision problem

• Observable behaviors performed by operational personnel.

- Flight crew, drivers, masters, cabin crew, controller,
maintenance personnel,…..
• If increase safety risk, often termed ‘unsafe act’ or ‘active
failures’ – such terms are problematic.
• Learning opportunities – events that should not be reproduced
under similar situations in the future.
• Describe how occurrence events happen.

 Technical Failure Mechanism

corrosion wear fracture
Technical Failure
Mechanisms
discontinuity deformation

• Described how technical problem / failure

occurred.
• Useful for determining the reason why the
technical problem occurred.

 Local Condition
health lighting
visual ability alcohol/drugs
workload stress
noise
fatigue
Local Conditions interpersonal conflict
knowledge peer pressure
distraction weather

• Conditions associated with the immediate context or

environment in which individual actions and technical
problem occur.
• Often termed ‘task and environmental conditions’,
‘antecedents’, ‘precondition’.
• If increase safety risk, could be term ‘local hazard’ or
‘local threats’
• Part of the why

 Local Condition
Use SHELL to help the determination of local
condition
• Software (procedures, symbology etc.)
• Hardware (machine)
• Environment
• Liveware (human)

 Risk Controls
rosters crew pairing recurrent training
normal procedures
emergency procedures CRM program
Risk Controls displays/controls
detection/warning systems
initial training facilities/infrastructures supervision

• Measures put in place by an organization to facilitate

and assure safe performance of the operational
components
• Prevent hazards resulting in losses
• Outputs of a management system
• Often termed ‘defenses’, ‘barriers’, ‘safeguards’
• Part of the why

 Risk Controls
• Preventive: reduce likelihood of undesirable local
conditions, individual actions, occurrence events
- Procedures, training, equipment, rosters, supervision,…
• Recovery: detects, corrects or minimize effects of
adverse local conditions, individual actions,
occurrence events
- Detection/warning (stall warning, TCAS, EGPWS,)
- Restore system (ATP, emergency procedure,…)
- Containment/protection (PPE, crashworthiness, safety
helmet, seat belt, ….)
- Escape/rescue (exits, emergency lighting, lifejackets,…)

 Organizational Influences
hazard identification change management organizational design

Internal auditing Organizational Influences regulations

training needs analysis regulatory surveillance

management skills

• Conditions that establish, maintain or

otherwise influence the effectiveness of an
organization's risk control
• Management processes rather than
management outputs
• Part of the why

Analysis Model (simple example)

Company make shift
roster

Risk control Ship master fatigue

Local Condition Late turning

Individual Action

Vessel grounding

Occurrence
 Analysis model (complex example)Regulatory oversight Boeing assessment

Internal audit Training need analysis

O
R
Oversight of No MCAS information Hazard report /SMS (Transition, CRM)
SMS Training
procedure / FRM in the manual management training

Inadequate report of Pilot workload

problem from previous

L
crew / FRM Multiple failure
indication – SPD, ALT, Pilot understanding to
FEEL DIFF MCAS
MCAS active
Crew coordination:
Non standard crew

I
communication ATC vector
phraseology instruction
High AOA (technical
failure)
Pilot handling the Difficulty to complete
problems QRH Transfer control w/o Inadequate trim
inform of handling
difficulty

Accimap JT610 OPS Aircraft impact to the

sea
Loss control O

 Regulatory oversight

Training need analysis Internal audit

O
R
Oversight of procedure /
Transition training
Number of engineers? FRM
Workload issue?

Several problems of IAS Inadequate report of

AOA condition Changed problem problem from
and ALT FLAG (repaired at Xtra) (IAS & ALT

L
previous crew / FRM
disagree, stick Multiple malfunction
shaker and FEEL
DIFF PRESS

Handling of repetitive
problem
AOA replacement Flushing
(Maintenance action)
High AOA (technical
failure)
I
Accimap JT610 ENG
Aircraft impact to the
sea Loss control
O

Accimap JT610 ATS

ATC assumption of
aircraft was not in
emergency condition

Pilot workload Several potential traffic

ATC did not heard the Pilot didn’t have
incoming
pilot holding request objection with ATC
instruction

Pilot request to some Pilot didn’t declare

holding point urgency or emergency
ATC vector
instruction
Pilot request to
maintain 5,000 ft
Accimap of Adam Air Accident
O Management
skill
Regulatory
oversight

R Pilot training
Spare part
management
Defect report
action

L Pilot understanding
to navigation
system & skill /
knowledge
Autopilot
disengaged
Cloudy
weather

I Navigation failed
/ Technical
failure
Resetting
navigation /
decision error
Recovery high
bank angle/
action error

O Loss control
Aircraft crash
to the sea
 Safety issue
The condition that:
• Can reasonably be regarded as having the
potential to adversely affect the safety of
future operation and
• Is a characteristic of an organization or
a system, rather than a characteristic of a
specific individual, or characteristic of an
operation environment at a specific point in
time.

Safety issue

Safety issue
 Terminology of causation
• Legal proceedings ‘cause’.
• Safety investigation:
Cause, causal factors, direct cause, proximate
cause, root cause, primary cause, contributing
safety factors, contributing factors, active failure,
etc.

 IMO Resolution MSC 255 (84) 2.2

Causal factors:
• A causal factor means action, omission, events or
conditions without, which:
1. The marine casualty or marine incident would not have
occurred, or;
2. Adverse consequences associated with the marine
casualty or marine incident would probably not have
occurred or have been as serious
3. Another action, omission, event or condition, associated
with an outcome in 1 or 2 would probably not have
occurred.

 ICAO Annex 13 (Aviation)

• Cause
– Action, omissions, events, conditions, or
combination thereof, which led to the accident
or incident.
• Contributing factors
– Actions, omissions, events, conditions, or
combination thereof, which, if eliminated or
avoided, would have reduced the probability of
the accident or incident occurring or mitigated
the severity of the consequences of the
accident or incident.

 Contributing factor
KNKT uses the terminology of ‘contributing
factor’ which define as:
Event or condition that, if had not present
or existed at the relevant time, then:
• The occurrence would probably not have
occurred, or
• The consequences would probably not
have been as serious.

 Case Study
A bus with 50 seats capacity travelled on the 5 meters wide road. The
bus driver had 10 years of experience in driving the bus. The road was
narrow for the size of the bus, steep downhill and winding. Along this
road, the driver applied brake often to manage passing the turns and
traffics. On the last turn, the bus collided with a house.
The investigation found that the brake line leaked. The leak of the brake
line caused the brake fluid discharged during overuse the brake. The
driver did not find the leak during the walk around inspection before
departure because of the checklist did not contain procedure to inspect
brake line.
The operator maintenance inspection did not detect the leak on the
brake line.
The bus operator has not established Safety Management System
(Sistem Manajemen Keselamatan).

 THANK YOU
KOMITE NASIONAL KESELAMATAN TRANSPORTASI
NATIONAL TRANSPORTATION SAFETY COMMITTEE

Transportation Building 3rd floor

Jl. Medan Merdeka Timur No. 5, Jakarta - 10110 INDONESIA
Telp. (021) 384 7601, 3517606 ; Fax (021) 351 7606
Website : http://www.dephub.go.id/knkt
E-mail : knkt@dephub.go.id