MORT and Organisational Failures

Transcription

1 MORT and Organisational Failures Prof. Chris Johnson, School of Computing Science, University of Glasgow.

2 Introduction Organisational Failure. Are safety culture & standards sufficient? Need high level management support. MORT: Management Oversight & Risk Tree; maps generic concerns for safety management. NASA Crompton Case Study: Complacency in systems engineering.

3 Importance of Management Standards supported by Safety Management Systems. Safety culture defended by Safety Management Systems. Without managerial support: safety culture will die; standards will be abused. Limits financial not engineering background

4 Organisational Failure Increasing focus on management. Standards can be miss-applied? Incidents can be ignored? Management controls context of failure?

5 MORT Management Oversight and Risk Tree. Draws on management and safety. Based on fault-tree notation: AND, OR gates; Basic and intermediate events. Novel use of LogicWorks 8(

6 Fault Tree Components (More Later)

7 Simple Fault Tree

8 MORT Lets suppose we have an incident. Usually easy to spot direct causes? Operator error, system failure. How to identify managerial causes? MORT uses fault tree notation to provide a graphical checklist.

9

10 NASA S Compton Telescope Balloon High Visibility Mishap Alice Springs International Airport in Australia. Balloon lifts gamma-ray telescope, astrophysical sources of nuclear line emission. Weather conditions favorable 10 pilot balloons successfully launched. Site Director (SD) cleared by Melbourne ATC.

11 Compton Telescope Balloon Scientific instruments protected by crane. Release payload when balloon lifts; Balloon has to be directly over crane; Risk of dangerous oscillations damaging kit. Balloon moves ahead of the crane: LD tells driver to turn left and gain ground; LD pulls lanyard but balloon fails to release. Accelerate for a second release attempt: reach airport perimeter fence; forced to terminate the launch..

12

13

14 Compton Telescope Balloon LD concerned spectators might be injured Tries to move crane, payload & balloon to safe area; payload breaks free, balloon dragged in wind; breaks through airport fence and hit a vehicle. Command to abort mission by separating payload. Balloon ends up quarter of a mile downwind Physical damage was compounded by Television broadcasts/internet footage in hours.

15

16

17

18

19 Human Factors In Space Mishaps Human error endangered spectators? LD used radio to get crowd moved moved. SD asks deputy to relocate crowds. Off-duty contractor also heard radio; Some had just been moved to danger area Specific direction regarding safe locations was not provided to the individuals who relocated spectators, and the resulting actions actually relocated spectators into the eventual path of the balloon and launch vehicle

20 Complacency and a Failure of Imagination Contractor had many successful launches even after initial attempts had failed. No expectation of possible failure so: No guidelines on repeated launch. Decision to abort left to LD s judgment LD felt he could still chase the balloon. Launch teams not trained in contingency Why bother given previous successes?

21 Complacency: The Opium of Success A problematic historical mindset and an ineffective organizational structure that failed to aggressively look for potential risks : NASA 50+ successful releases in Alice Springs. Other organisations had been launching from the area many years before this.

22 Complacency: The Opium of Success Spring 2010: NCT one of 3 missions. Tracking & Imaging Gamma Ray Experiment ; Launched, worked and recovered as planned. Reliance on past success has become a substitute for good engineering and safety practices. Interviews have indicated a consistent theme that the balloon program success rate has been sufficiently high, so therefore there have not been problems to correct or additional scrutiny required

23 Complacency in the Response Lack of imagination Finite design resources focused on few hazards. Attention on mitigating risks to other aviation. Detracted from hazards to ground personnel? Mishaps more likely, response less prepared: Campaign Manager saw vehicle being hit; Used 911 but Australian emergency services use 000; Luckily, Tower notified airport emergency personnel.

24 Complacency in the Response Response to mishaps less prepared Investigators arrive in Alice Springs: Parts of the payload in local scrap yard; Senior management ignorant of investigation. Because of the actions of the personnel in the recovery and removal of the wreckage from the mishap site to a holding location within the area, the physical evidence had to be declared as contaminated by the field investigator

25 Complacency in Oversight Need for Safety Oversight but Senior personnel in Balloon Office not in close contact with contractors management did not ensure contractor followed procedures/policies. Balloon office good overview of documentation: ground safety plan & risk assessments; did not monitor what actually happened on the site Out of sight, out of mind. Lessons for commercial space flight???

26 Managerial Complacency Funding concerns; successes justify funding cuts for safety; Additional costs would kill balloon programme. Safety management: Lack resources & motivation; Why revisit the risks without a mishap? Complacency institutionalised in procedures No hazards if we just follow the SOP? Dangers if procedures undocumented.

27 Complacency: Reliance on Documentation Complacency relies on documentation: Waste finite resources on tick box exercises; little relationship to operational practices. Safety plan ignore hazards to spectators: Violates RSM 2002, NASA NPR , NPR Contractor violated contract NAS ; requires written procedures for hazardous acts. Again lessons for commercial space flight

28 Complacency: Reliance on Documentation Many guidance documents poorly written, Senior management did not review documentation. there is much ambiguous language in the documentation, hazards are not covered completely, there is no provision to protect the public except in the over flight phase, and it does not completely cover all phases of balloon operations. NASA Agency Range Safety Program audit of balloon launches in 2002; actions still open, without corrective actions.

29 Alternatives to Paranoia Only way of avoiding accident is paranoia? Risk factors might have been spotted: Through sufficiently aggressive risk assessment? ALL Senior executives should: read at least one mishap report every year; better understand risks and hazards; Challenge complacency in complex missions.

30 Conclusions Organisational Failure. Are safety culture & standards sufficient? Need high level management support. MORT: Management Oversight & Risk Tree; maps generic concerns for safety management. NASA Crompton Case Study: Complacency in systems engineering.

31 Any Questions