Theories and Models of Human Errors Occurrence. Simulation of Aircraft Maintenance Processes

Abstract

General issues of the errors occurrence by technical personnel were considered, their causes and consequences. Classifications of errors based on an ergonomic understanding of their nature, as well as on the results of an engineering-psychological analysis of operators’ activity are given. Much attention is paid to the methods used by ICAO to classify errors and violations. Details considered models SHELL and J. Reason. Their adaptation is presented for analysis cases of the impact of the technical maintenance quality on the flight safety of aircraft. A special place is occupied by the disclosure of assessing issues impact of technical personnel errors on flight safety. A wide range of existing methods and models is presented, allowing obtaining qualitative and quantitative assessment of this effect in order for the prevention of errors by technical personnel and mitigating their consequences.

1. Introduction

The problem of human error is by no means new. World literature is replete with reports of accidents and disasters, where people are recognized as the main cause. However, the actualization of this problem, its isolation into a separate science, “the human factor,” occurred not so long ago, only 30–40 years ago.

In the aviation industry, the term “human factor” began to be widely used in the second half of the 80s of the XIX century, due to the recognition of this problem by the ICAO Assembly, which adopted resolution A26-9 in 1986 in which, in particular, the importance of recognizing the role of human factor in aircraft operations, as well as the need to develop for them practical material and activities related to the human factor. It was the awareness of the breadth of the problem and its consequences for flight safety that made it possible to move from studying the influence of individual errors on the safety of the aviation system to studying the causes of their occurrence, which is the essence and subject of the study of the “human factor.”

Considering the issues of the “human factor” and its impact on flight safety, the main emphasis is made by the majority of experts on the analysis of its manifestation in the practice of the flight crews and personnel performing maintenance and air traffic control. At the same time, in our opinion, little attention is paid to the problem of the manifestation of the human factor during maintenance and inspection of aircraft. Nevertheless, this problem becomes more and more significant every year, which is confirmed, for example, by the materials of [1, 2, 3] and a number of other official sources, including official documents adopted by FAA, EASA, ICAO in recent years [4, 5], materials of relevant seminars on the human factor, etc.

The rapid development of the global aviation market in the future will only aggravate the human factor problem. Thus, according to forecasts of the leaders of the global aviation market, the companies Airbus and the Boeing [6, 7], world park of commercial aircraft by 2038 will amount to more than 48,000 aircraft, which will require putting into operation according to various forecasts from 39,200 to 42,700 units of new aircraft with a capacity of 100 seats. In this case, the maximum growth rate of the park, according to the agency “Oliver Wyman” [8], will be observed in the first decade from 2020 to 2029. These will be fundamentally new aircraft, which will require about 620–640 thousand of well-trained technical personnel for their service. Therefore, the contradiction between the needs of the market and the readiness of the aviation personnel training system to provide the market with so many technical specialists without loss of training quality seems to be tidy. In addition, it should be taken into account that even with the most optimistic forecasts, a significant market share is about 8.5 thousand according to [7] will still consist of aircraft of outdated structures with operating lives exceeding 25 years. The level of reliability of such equipment and safety, as shown in [9], is significantly lower than that of the entire park, which imposes additional requirements on the level of training of technical specialists.

Of course, it is only predictions, the validity of which we will be able to evaluate only after some time. However, regardless of the results forecasts, now become quite clear that the role of human factors in maintenance will only increase, providing more and more critical impact on the safety of civil aviation. Therefore, it is extremely important to develop analytical tools to identify problematic issues arising from aircraft maintenance and inspection, to predict possible consequences and to develop mechanisms to avoid, reduce or isolate manifestations of the human factor during the work of technical personnel.

2. Maintenance errors, statistics, causes, and consequences for the flights safety

2.1 Maintenance error statistics

The key concept in the study of the human factor and the subject of research in studying the problem are human errors, conditions and mechanisms of their occurrence, features of manifestation, and, of course, the consequences for the functioning of the system (technical, environmental, social, etc.).

It should be noted that according to the official statistics of the ICAO and other influential organizations that study the problem of flight safety, human errors in aviation account for 60–80% of all aviation accidents. Of course, the main carrier of these errors is flight crews. According to various sources, they account for between 40 and 75% of all accidents and incidents that occur. Clear generalized data on technical personnel are not available. However, quite complete, although somewhat contradictory information about the magnitude of the problem has been published and is contained in documents [10, 11, 12].

So, in [10], the results of several studies are presented at once concerning the effect of human errors during maintenance and inspection of aircraft on the accident state in civil aviation. The most voluminous of them is the study conducted by Sears R.L. It contains the results of an analysis of 93 major aircraft accidents that occurred between 1959 and 1983. In accordance with it, the problem of maintenance and inspection takes the fourth place among the factors directly affecting the accident rate in civil aviation, and is the main reason for about 12% of the incidents studied. At the same time, the results of the National Transportation Safety Board (NTSB) studies published in 2000 at (for updated results see [11]) indicate that out of 14 accidents that were investigated by the Council, 7 had the main reason is maintenance, which is 50% of all incidents. This allowed NTSB experts to conclude that service problems are growing as the design of the aircraft improves, as flight crews, personnel and air traffic control equipment are trained. A proportion of incidents related to these factors will decline, and the impact, technical service on the contrary will increase. Partially their predictions confirmed by data presented in [12], as well as by the annual safety reports of the International Air Transport Association (IATA).

In particular, in [12] states that the activities of an aircraft maintenance averaged 10% of the threats that led to the 432 aircraft’s accidents in the period from 2009 to 2013 year. Maintenance operations, including standard operating procedures and training systems, were recognized by latent conditions for 8% of the 338 non-fatal accidents that occurred during the same time period in world aviation.

A subsequent analysis of the statistical material available to us indicates a positive trend in the number of accidents, fatal accidents and non-fatal accidents. During the period from 2013 to 2018 the average number of accidents, for which the technical service, including standard operating procedures and training were considered latent conditions ranged from 3.2% for fatal accidents, to 16.2% for the non-fatal accidents. Maintenance Events are recognized as threats on average for 6% of registered fatal accidents and 12% of non-fatal accidents. The highest values of these indicators registered for period 2014–2018, and amounted to respectively (latent conditions/Threats):

1. for accidents – 19/13%;

2. for fatal accidents – 8/7%;

3. for non-fatal accidents – 20/14%.

2.2 Causes of technical maintenance errors

The data presented above characterize the problem as a whole, without specifying the reasons for its generation. However, it is not surprising, because speaking of the reasons we are faced with a conceptual and purely technical problem.

The concept of “cause” is part of a broader concept – “factor,” which, being the driving force of any process, phenomenon, contains individual causes and their combinations, which, in turn, determine its influence on these processes and phenomena. In this regard, we have a technical problem, which, speaking about errors in the maintenance and inspection of aircraft, does not allow us to clearly identify all the specific causes of their occurrence, since there are usually a lot of them, and many of them are latent in nature. Therefore, researchers often prefer to study the problem either by focusing on the consequences of the manifestation of causes, or by grouping them for separate study, or for other purposes [13, 14]. Only a few studies attempt to analyze the entire path “from cause to effect.” An example of such a study is to survey more 1300 licensed Engineers held in 1998 by Australian Transport Safety Bureau [10, 15]. An analysis of the results made it possible to identify the nine most common direct causes of errors of technical personnel (Table 1) for cases related to and not related to airlines.

Occurrence causes and contributory factors	Airline	Non-airline
Pressure	21%	23%
Fatigue	13%	14%
Coordination	10%	11%
Training	10%	16%
Supervision	9%	10%
Lack of equipment	8%	3%
Environment	5%	1%
Poor documentation	5%	4%
Poor procedure	4%	4%

Table 1.

Causes of technical personnel errors [15].

Below is the ranked information about typical errors made by technical personnel in the process of aircraft maintenance (Table 2), as well as the results of studies of the frequency of occurrence of these errors [10, 13]. For completeness, the results of several studies are immediately demonstrated (Tables 3 and 4).

1. Incorrect installation of components

2. Fitting of wrong parts

3. Electrical wiring discrepancies (including cross-connections)

4. Loose objects (tools, etc.) left in aircraft

5. Inadequate lubrication

6. Cowling, access panels and fairings not secured

7. Landing gear ground lock pins not removed before departure

Table 2.

Errors in frequency [13].

Errors	Frequency of occurrence
Omissions	56%
Incorrect installation	30%
Wrong parts	8%
Other	8%

Table 3.

The results of the analysis of 122 cases of engineering errors in the period 1989–1991 [16].

Errors	Frequency of occurrence
Fastenings undone/incomplete	22%
Items left locked/pins not removed	13%
Caps loose or missing	11%
Other items left loose or disconnected	10%
Items missing	10%
Tools/spare fastenings not removed	10%
Lack of lubrication	7%
Panels left off	3%

Table 4.

Research results by professor James Reason [17].

2.3 Consequences of errors

Technical maintenance and inspection of air vessels are important components of the system to ensure the safety of flights of civil aviation. Moreover, when we talk about maintenance, we should not understand this term too narrowly and focus only on the mistakes made during its implementation. After all, mistakes can be made directly in the project, and in technical documentation, and in the organization of work, etc. Speaking about maintenance errors, you should understand them as errors that are related to maintenance personnel.

In the Cir. ICAO 253-AN/151, technical maintenance personnel (hereinafter referred to as technical personnel) are defined as personnel who are at the forefront of resolving technical problems that arise during daily flights. Its activities are carried out under the influence of various conditions, which, aggregating into larger factors, directly affect the quality of work and operations. As a result of these influences, there are additional opportunities for errors of technical personnel, which, as a result, cause breaks in the safety chain of the aviation system. This is how the consequences are determined in a number of documents of ICAO and other authoritative organizations.

Speaking about the consequences that are possible as a result of errors made by the technical personnel of airlines and other organizations providing technical maintenance of modern aircraft, we should refer to the experience of research in this area, which has been brought up in a number of educational publications and practical experience on flight safety.

In accordance with the theory of safety, there are two large groups of consequences of errors of technical personnel:

1. failures of aviation engineering in flight. Here, by aviation engineering, we mean the aircraft, its engines, as well as removable and permanently installed equipment on board the aircraft.

1. b. events, leading to the immediate threat of flights safety. This division has a number of drawbacks, but plays an important role in the selection of methods for assessing the impact of the reliability of technical personnel on the state of flight safety and will be rather fully discussed below. However, there is another idea of the consequences of errors, which is more understandable and consists in dividing all the events associated with them by:

• active failures – associated with errors or irregularities that immediately cause an adverse effect They are usually considered (retroactively) hazardous activities. The operator of the “front line”, performing direct maintenance and inspection of aircraft, usually makes such errors.

• hidden faults – are the result of decisions or actions that were committed long before the event and the consequences of which may not occur for a long time. Such failures are usually generated at the decision-making and rule-setting levels or at the level of linear leadership, that is, people far removed from what happened, both in time and location. Hidden failures resulting from dubious decisions or incorrect actions, although they do not cause harm if they are detected in isolation, can interact with each other, creating a “window of opportunity” for them to develop into active failures, which are destructive in essence to all types of system protection.

Here are a few examples, which demonstrate entered above classification of the consequences, and give brief explanations to them.

2.3.1 Active failures

2.3.1.1 Example 1

The crash of the aircraft Embraer EMB-120RT 11.09.1991 year near Eagle Lake (Texas, USA) [18].

Fatal accident circumstances: Continental Express’s Embraer EMB-120RT Brasilia airliner (operated by Britt Airwaysruen) operated a scheduled BTA 2574 flight on the Laredo – Houston route, but lost control while approaching Houston Airport and crashed to the ground near Eagle Lake, Texas, killing all 14 people on board – 11 passengers and 3 crew members.

Information about the aircraft: Embraer the EMB-120RT Brasilia – released in 1987 year (the first flight 17 November 1987 year). April 15, 1988 was acquired by Continental Express airline. On the day of the disaster has made 10,009 cycles “takeoff-landing” and flown 7229 hours. On the eve of the flight, work was done to replace the anti-icing pads on the horizontal tail of the aircraft.

Reasons leading to fatal accident: This case is a vivid example of the occurrence of an active failure due to erroneous actions, violations of the company’s technical personnel when performing dismantling and installation work on the elements of the horizontal tail of the aircraft, immediately before the flight.

The incident was investigated by the NTSB.

According to its results, the following was indicated: “The failure of Continental Express maintenance and inspection personnel to adhere to proper maintenance and quality assurance procedures for the airplane’s horizontal stabilizer deice boots that led to the sudden in-flight loss of the partially secured left horizontal stabilizer leading edge and the immediate severe nose-down pitchover and breakup of the airplane. Contributing to the cause of the accident was the failure of the Continental Express management to ensure compliance with the approved maintenance procedures, and the failure of FAA surveillance to detect and verify compliance with approved procedures.”

NTSB board member John K. Lauber filed a dissenting statement on the investigation report, believing the probable cause should read as follows:

1. The failure of Continental Express management to establish a corporate culture which encouraged and enforced adherence to approved maintenance and quality assurance procedures, and

2. the consequent string of failures by Continental Express maintenance and inspection personnel to follow approved procedures for the replacement of the horizontal stabilizer deice boots. Contributing to the accident was the inadequate surveillance by the FAA of the Continental Express maintenance and quality assurance programs.

2.3.1.2 Example 2

The crash of the Boeing 727-264 on March 31, 1986, near Maravatio (Mexico).

Fatal accident circumstances: The Mexicana Boeing 727-264 Advanced airliner made a MX940 flight on the route Mexico City – Puerto Vallarta – Mazatlan – Los Angeles, but 15 minutes after departure from Mexico City it caught fire, fell into two parts and crashed into Mount El Carbon, resulting in killing 167 people.

Information about the aircraft: Boeing 727-264 Advanced was manufactured by Boeing Corporation in 1981 (first flight May 4, 1981). In May and June of the same year was sold to airline Mexicana, which awarded him the name of Veracruz.

Reasons leading to fatal accident: According to the “Aviation Safety Network” resource, the accident with the Boeing 727-264 Advanced was the result of a number of errors and violations that were made in preparing the aircraft for flight by technical personnel directly to the Mexico City airport. The main reasons are indicated:

1. brake failure of the left main landing gear;

2. violation of the technology of charging pneumatics of wheels, as a result of which air was inside them instead of neutral gas;

The low level of inspection for this important element of security did not allow us to identify these shortcomings in time and, therefore, did not allow us to prevent subsequent adverse events.

Due to these errors and violations, events developed as follows: “The left main gear brake was overheated during the takeoff run. When the aircraft had reached FL310 the heat caused a tire on the left hand main gear to explode. Fuel and hydraulic lines were ruptured and electrical cables severed resulting in a cabin decompression. An emergency was declared, but spilt fuel ignited and caused a massive fire on board. Control was lost and the aircraft crashed into a mountain in the Sierra Madre, at an elevation of 9000 feet. It was found that the tire had been serviced with air rather than nitrogen. The air, under high temperature and pressure, resulted in a chemical reaction with the tire itself. This led to a chemical explosion of the tire” (Aviation Safety Network).

This is another example of active failures of aviation equipment in consequence of the action of human error during maintenance and inspection of aircraft. Their distinctive feature is the absence of long time intervals between the error and its consequence. Speaking about the hidden failures, we have a somewhat different picture. They are also caused by errors of technical personnel, but the consequences here are removed in time directly from the moment of the error. Let us illustrate this with examples.

2.3.2 Hidden failures

Examples of hidden failures are a series of incidents that have occurred over the past 50 years of civil aviation. Probably the most resonant of them are (events are given in chronological order):

1. The crash of the aircraft McDonnell Douglas DC-10-10 of American Airlines in O’Hare International Airport Chicago (Illinois, USA) 05/25/1979.

2. The crash of a Boeing 737-222 aircraft of Far Eastern Air Transport airline 151 km south of Taipei (CHINA) on 08/22/1981.

3. The crash of a Boeing 747SR-100 aircraft airline Japan Air Lines 08/12/1985, which was one of the most massive in the number of dead passengers.

4. The crash of a Boeing 737-200 aircraft by Aloha Airlines over Kahului (HAWAII, USA) on April 28, 1988.

5. The crash of a McDonnell Douglas McDonnell Douglas DC-10-10 plane of United Airlines airline at the airport of Sioux City (Iowa, USA) on 07/19/1989.

6. The crash of a Boeing 747-200 aircraft of China Airlines over the Gulf of Taiwan on May 25, 2002.

There are many other examples where poor maintenance and manufacturing errors have caused the most recent military accidents in military aircraft.

Examples here are:

1. The accident of the F-15C aircraft, 110 aviation squadron, 131 fighter wings, Missouri National Guard during a training flight at the Lambert Field Air Base (St. Louis) 11/7/2007.

2. The crash of the Mi-24 helicopter 18 km from the airfield of Pugachev, Saratov Region, 10/03/2009.

3. The crash of the aircraft KS-130 over Liflor 07/10/2017.

However, the undisputed leader here is China Airlines Boeing 747-200 crash that occurred on May 25, 2002 over the Gulf of Taiwan [19].

Fatal accident circumstances: The China Airlines Boeing 747-200 airliner made a scheduled flight on the Taipei-Hong Kong route, but 25 minutes after take-off it suddenly fell apart in the air and crashed into Taiwan, killing all 225 people on board – 206 passengers and 19 crew members.

Information about the aircraft: Boeing 747-209B was produced in 1979 (the first flight on July 16, 1979). On July 31 of the same year, it was transferred to China Airlines with tail number B-1866; on January 1, 1999 it was re-registered and received tail number B-18255.

At the time of the crash, the aircraft had 64,810 flight hours (21,398 take-off cycles).

Reasons leading to fatal accident: The Aviation Safety Council (ASC) Investigation Report (China) notes that on February 7, 1980, 22 years before the crash, while landing at a Hong Kong airport, the aircraft touched the runway with its tail. Subsequently, the tail was repaired, and the aircraft continued to fly. It was at this moment, according to ASC experts, that the conditions of the 2002 incident were laid.

During the investigation, a number of organizational and technical flaws were identified, but the immediate causes that led to the disaster were:

1. poor-quality repair;

2. low efficiency of quality control during repair;

3. deficiencies in performing an aircraft inspection by a structural inspector;

4. flaws in the documentation defining the technology for the repair, maintenance and inspection of the aircraft, and others.

By the way, this is not the only disaster of this kind. A very similar accident occurred on 08/12/1985 with the Boeing 747SR-100 of Japan Air Lines [20].

Fatal accident circumstances:

The Japan Air Lines (JAL) airliner Boeing 747SR-46 made an internal flight JAL 123 on the Tokyo – Osaka route, but 12 minutes after takeoff, the elements of the aircraft critical for control were destroyed (the vertical tail and the hydraulic pipelines of the aircraft were destroyed). Despite the selfless struggle of the crew for the survivability of the aircraft, an almost uncontrolled aircraft collided with Otsutaka Mountain 112 km from Tokyo 32 minutes after takeoff. Of the 524 people on board (509 passengers and 15 crew members) only 4 survived.

Aircraft Information: The Boeing 747SR-46 was released by “Boeing” in 1974 (first flight on 28 January 1974 ode) on request for use on domestic flights in Japan. On February 19 of the same year, it was transferred to Japan Air Lines (JAL). On the day of the disaster, he made 18,835 takeoff and landing cycles and flew 25,030 hours.

Reasons leading to fatal accident: In the course of the fatal accident investigation, Aircraft Accidents Investigation Commission specialists found that on June 2, 1978, the JA8119, completing the JAL 115 flight on the Tokyo-Osaka route, hit its tail on the runway of Osaka Airport. As a result, the pressure bulkhead was damaged, separating the tail passenger compartment of the liner, which maintains approximately constant air pressure, from the leaky tail section of the aircraft.

During the repair process, the technical conditions stipulated by the Boeing company were not fulfilled, according to which it was prescribed to strengthen the damaged parts of the bulkhead using an integral amplifier plate fixed by three rows of rivets. Instead of installing a single amplifier with three rows of rivets, the repairing technicians used two separate reinforcing elements, one of which was fixed with a double row of rivets, and the second with only one row of rivets. Under the influence of variable loads during takeoff and landing cycles 7 hours after the impact, the bulkhead at the place of repair was destroyed.

Analyzing these two incidents, it should be noted once again the importance of ensuring high technological discipline in the maintenance, repair and inspection of aircraft. It should become an element of corporate culture of airlines. Very often, this is the only effective tool (protective mechanism) for preventing aircraft accidents.

3. Classifications of technical personnel errors

Having examined the issues of causes and consequences, we intentionally did not address issues relating to directly dangerous actions. They are characterized as personnel errors, when performing maintenance and inspection of aircraft, and which are identified by modern regulatory documents as actions or inaction, leading to deviations from the intentions or expectations of the organization or specific individuals (Doc.9859, 2018 edition). This was partly because the fact of error alone does not carry the necessary useful information to effectively prevent their occurrence in the future. At the same time, a clear understanding of the causes of personnel errors allows the development of various preventive strategies to prevent their occurrence in the future. On the other hand, understanding the consequences allows us to assess the risks from the corresponding errors and to rank them according to the degree of criticality for flight safety or in terms of financial and material losses for the airline. The result of this approach is a tool that allows you to set clear s sequence and implementation of preventive measures for the prevention of technical staff errors and optimizing, thus, possible losses of companies.

The presence of relationships such as “cause – dangerous action,” “dangerous action – consequence,” “cause – consequence” allows to classify errors of technical personnel, thereby reducing the degree of uncertainty that the relevant managers almost always encounter in the decision-making process.

There are a large number of different classifications of human errors, if we consider this issue from the point of view of the human factor, as a global problem. However, we will focus only on some of them, which, in our opinion, are of practical interest from the point of view of their applicability in the field under study.

One of the main systems of descriptions of human error, which is already more than 50 years and is used by various researchers in the field of analysis of human reliability is a diagram referred to in A. D. Swain [21], according to which, human errors occur:

1. when a man fails to perform a task or a part of a task;

2. when he performs the task or step incorrectly;

3. when he introduces some task or step which should not have been performed;

4. when he not performs some task or step out of sequence, or

5. when he fails to perform the task or step within the allotted time period.

A somewhat different way of human operator error classification proposed D.A. Norman in [22], which is based on a psychological approach to the problem. He links groups of “working breakdowns” with alleged sources, which are modeled and analyzed using the activation-trigger-schema system (ATS) model.

Model ATS is composed of a set and schemes representing a sensorimotor cognitive structure. Each subsequent task in the model is considered as a hierarchy of schemes, changing the characteristics and activation modes of which it becomes possible to simulate the action of various sources that cause operator errors. Assuming the presence of these sources, Norman identified the following three main types of disruptions [22]:

1. errors in the formation of the intention (which includes the subcategories of mode and description errors);

2. faulty activation of schemas (which includes the subcategories of capture errors, data-driven and associative activations, loss of intention, and misordering of action components); and

3. faulty triggering (which includes the subcategories of spoonerisms, blends, intrusions of thoughts, and premature triggering).

As indicated in [23], the classification according to Norman is perfectly suitable for the theoretical analysis of the causes of human operator errors, but this classification is not suitable for analyzing its reliability. The reasons are as follows:

1. the use of the Norman classification is based on activation-trigger schemes, without which it and the analysis method itself lose its meaning;

2. the practical use of the ATS model is problematic:

   • due to the contradictory views of psychologists on human behavior;

   • due to excessively high requirements for the level of professional training of performers (experience in cognitive psychology);

3. individual errors operator can be interpreted in various ways, which entails the destruction of the whole system is empirically obtained data.

Classifications and models presented by Swain and Guttmann [24] are of great practical importance. They are a further development of the classification given in the work [21] and the most adapted for solving a task analysis of human reliability.

The scientific work clarifies the concept of external and internal factors affecting productivity, gives a clear interpretation of intentional and not intentional errors, corrected (errors without consequences) and not corrected errors.

In the framework of the developed model for solving problems associated with the analysis of the reliability of the human operator, the wrong actions of the latter are considered by them in the framework of the following classification:

1. Errors of omission:

   1. omits entire task;

   2. omits a step in a task.

2. Errors of commission:

   1. selection error:

      • selects wrong control

      • mispositions control (includes reversal errors, loose connections, etc.);

      • issues wrong command or information (via voice or writing);

   2. error of sequence;

   3. time error:

      • too early;

      • too late;

   4. qualitative error:

      • too little;

      • too much.

This classification partly echoes the classification of operator errors, which was developed, in particular, by Professor B. F. Lomov. The work of M. A. Kotik (“The Course of Engineering Psychologists”, 1978) provides a fairly extensive classification of errors by the authors G. M. Zarakovsky and V. I. Medvedev, developed and presented by them in the work “Classification of Operator Errors” in 1971. It is proposed to analyze human errors using the following criteria:

1. places of error in the structure of the functioning of the “man–machine” system;

2. the outward manifestation of the error;

3. the consequences of the error;

4. the nature of the error display in the operator’s consciousness;

5. causes of error.

An interesting approach is the authors to analyze errors for the reasons for their occurrence. The following categories of error causes are highlighted here:

1. Immediate causes – differ from two points of view:

   1. by place in the structure of activities:

      • errors of perception (visual, auditory, kinesthetic, etc.);

      • memory errors (storage, reproduction, short-term, long-term);

      • decision-making errors (when acting according to the rules, in logical operations, when calculating, when thinking creatively);

      • errors in the response (movement, speech response, memorization), etc.;

   2. the following error types are distinguished by the form of violated laws:

      • mismatch of the information processing process (excessive flow of information, lack of information, lack of input data, etc.);

      • mismatch of the skill (transfer of the skill to the conditions where it is unacceptable, error switching skills, lack of skill, etc.);

      • lack of attention (improper distribution of attention or switching attention, lack of concentration, excessive concentration).

2. The main causes of operator error are associated with the following factors:

   1. operator’s workplace;

   2. organization of work and rest;

   3. preparing the operator and the system for a specific operation;

   4. the physical and mental state of the operator;

   5. motivation of the operator to perform the operation.

3. Causes contributing to the error.

Flow from the more fundamental properties of the operator. They are associated with the general attitudes of the operator’s personality, his general state of health, his training system, life organization, relationships in the team and in the family, etc.

Despite a fairly detailed study, the classification of G.M.Zarakovsky and V.I. Medvedev for objective reasons described in the work of M.A. Kotik, did not receive wide recognition in solving psychological and ergonomic problems operator error analysis. However, the idea of dividing the causes into main, immediate and contributing, is actively used now in the analysis of errors of aviation personnel, as well as in the investigation of the causes of incidents and aircraft accidents.

Thus, all the above classifications are intended exclusively for solving ergonomic problems and performing engineering and psychological analysis of operators in the human-machine system and are practically not used for solving practical problems of assessing the reliability of aviation personnel of airlines. Nevertheless, their ideas, in particular the ideas laid down in [24], were continued when developing the classification of errors of aviation personnel into personal errors and human errors. In this classification:

1. Personal error (personal factor) – is errors that occur due to mismatch conditions of work with individual properties of experts: level of professional training, physical and psychophysiological state, level of personal discipline and others. This often includes the reaction of technical personnel to changing external working conditions.

2. Human errors (human factor) – these are errors that arise in connection with the occurrence of conditions exceeding the capabilities of the personnel according to the boundary standards of their psychophysiological capabilities, which are inherent in all people with the training necessary for professional activity, manifested in the interaction of specialists and technology.

The above classification is useful in that it establishes clear markers that allow, according to the results of the analysis of errors of technical personnel, to relate them to a particular group and, subsequently, apply corrective actions specific to a particular group of reasons.

On the other hand, the above classifications do not solve the problem of establishing the depth of responsibility of technical personnel for making mistakes, which is crucial when deciding on the development of preventive and corrective actions aimed at reducing the human factor influence on the flight safety state of airlines. At the same time, the effective implementation of proactive flight safety management systems for suppliers of products or services and the effective supervision of their functioning by the state require a clear understanding of the differences between the concepts of error and violation. This difference is the basis of the classification recommended for implementation in the practice of airlines of the ICAO member countries by document Doc.9859 “Safety Management Manual” (2013 edition).

In accordance with the ICAO classification, all dangerous actions associated with the human factor, including during maintenance and inspection of aircraft, are divided into two types: errors and violations.

An error is defined as an action or inaction by an operational person that leads to deviations from organizational or the operational person’s intentions or expectations.

A violation is defined as a deliberate act of willful misconduct or omission resulting in a deviation from established regulations, procedures, norms or practices.

As you can see, the difference between errors and violations is the intention of the performer. And if mistakes are an unintentional act, then the violation is a deliberate act or inaction in order to move away from established procedures, protocols, norms and practices. This is where the focus of Doc. 9859 is.

Errors of aviation personnel are divided into the following types:

1. Slips and lapses are failures in the execution of the intended action.

   1. slips are actions that do not go as planned;

   2. lapses are memory failures.

2. Mistakes are failures in the plan of action

Unfortunately, the mechanisms of these errors regarding the activities of technical personnel are poorly understood today. As for the flight crew, the error data of the pilots and their mechanisms are well disclosed in the works of N. A. Nosov, the founder of a fundamentally new scientific approach to the study of “virtual realities” of a person, his followers Pronin, Yuryev and others [25, 26].

ICAO is not categorical in matters of maliciousness of violations, which allows a balanced and fair approach to the issue of impact on personnel, allowing them out of the belief that this will simplify the tasks and will not lead to negative consequences. ICAO proposes to identify such violations as judgments, and classifies them into types:

1. Situational violations are committed in response to factors experienced in a specific context, such as time pressure or high workload.

2. Routine violations become the normal way of doing business within a work group.

This type of violation arises as a response to difficulties with the implementation of the established rules of work, shortcomings in the organization of the man-machine interface, etc. As a result, the performers, maintenance teams establish their own, as it seems to them, “best” rules, which eventually become mundane. As a result, we are dealing with a practical shift, the consequences of which may be most serious over time. Sometimes these personnel actions are justified and can be taken as an official’s procedures after carrying out the necessary examination and evaluation of safety risks.

1. Organizationally induced violations may be considered as an extension of routine violations.

This type of violation occurs when security requirements are sacrificed for immediate financial gain. Thus, as a rule, is disturbed balance between the desired level of productivity/profitability airlines and necessary layer eat protection (Doc.9859, 2018).

The value of the ICAO approach to the classification of human errors and violations consists, firstly, in its universality and adaptability. It can be applied with equal success both to the analysis of errors of flight crews and to the analysis of errors of technical personnel made by them during the flight operation, as well as in the process of maintenance and inspection of aircraft. Secondly, a clear division of the dangerous actions related to the human factor into errors, non-malicious violations (judgment errors) and intentional violations allows us to develop clear triggers that are used in the algorithms for analyzing errors/violations of airline personnel. An example of such an algorithm is presented in Figure 1.

Figure 1.

Airline personnel error/violation analysis algorithm.

Such algorithms are essential elements of the Safety Management Manual. They are developed by each individual airline as part of documentary support for the creation of safety management systems for organizations. In addition, the presence of such algorithms with a well-defined and clear triggers (action rules) stimulates the creation within the fair airline safety culture, and their integration in the adopters a airline models and operation allows to identify the causes of errors in a timely manner they eliminate or reduce the severity of consequences.

4. Models and theories of human factor. Modeling the aircraft maintenance process

The usefulness of error classifications is obvious and has been shown above. However, using only the classifications previously developed to study human errors, we significantly limit our ability to study their influence on the efficiency of the aviation system, which is largely determined by its flight safety status. Indeed, using only the information that is supplied to us by the existing classification of human errors, only one “static” state of the problem becomes available to us. At the same time, for a full study of the problem of the human factor, in particular, during maintenance and inspection of aircraft, consideration of the problem should be carried out taking into account its “dynamics”. Only in this case we can count on the maximum result in solving problems:

1. minimizing the risk of accidents due to human factors;

2. obtaining the most adequate assessment of the effectiveness of protective mechanisms even before their practical implementation;

3. the formation of a common vision of the problem by all participants in the aviation community.

Today, various approaches and models of the human factor are used in aviation. Their synthesis was possible due to many years of work such eminent scientists like J. Rasmussen, G. Heinrich, E. Adams, S. Shappell, J. Reason, D. Wiegmann and many others. Under their leadership and with their active participation, several directions and approaches to the study of the human factor, including in aviation, have been developed. These include [27]: cognitive, systemic, behavioral, psychosocial, medical (psychophysiological) and organizational approaches. There are many publications on each of them, and each publication deserves close attention and analysis. However, due to objective reasons, we confine ourselves to a brief consideration of some of them in terms of applicability in practice of aircraft maintenance. Probably one of the most famous models, which represent a modern systematic approach to the consideration of the human factor, is the SHELL model. Proposed by Professor E. Edwards 1972 year, this model has received wide popularity and in 1993 was recommended by ICAO as the basis for the analysis of human factors in accident investigation (Doc. ICAO 9859).

The model describes the four main components necessary for the successful integration of a person and his functioning as part of man–machine systems, the first letters of the name of which make up its name. These components include:

1. Software (S) – procedures (procedures, training, tools, and software, etc.).

2. Hardware (H) – object (machines, systems and equipment).

3. Liveware (L) – subject (people in the workplace).

4. Environment (E) – environment (operating conditions in which all other components of the L-H-S system must function).

The SHELL model is based on the model of a person who, as a central element, interacts with its other elements. According to E. Edwards, it is precisely at the borders of these elements that problems arise that lead to erroneous human actions. Although this model is designed primarily to take into account all possible contextual and task-related factors that affect the performance of the pilot, including the design of cockpit equipment, etc., it can also be adapted to the working conditions of technical personnel, which in principle and confirmed in Cir. ICAO 253-AN/151.

The model allows, when studying the features of the work of aircraft maintenance specialists, to take them precisely as the central link, since they also operate in a specific environment specific to them (possibly even more complex than that of the flight crew), they use complex equipment H, and numerous instructions and apply the software S. In this case, the lower block L displays both the flight crew and other specialists (for example, line management), with whom maintenance specialists come into contact with the production necessity. However, most often under the central unit still understand aircrew.

Since the global goal of the work of all aviation personnel is to ensure flight safety, it is therefore of interest to specify the initial SHELL model in relation to ensuring flight safety of aircraft. It is precisely this concretization that is presented in Figure 2.

Figure 2.

Specification of the SHELL model.

In the figure, in addition to the notation already known to us, there are new ones:

Lf – flight (in the original diagram, the central block L is a subject, a person).

The lower block L of the circuit can be rationally represented as a “stack” of four blocks: Lm – maintainer, service, operator personnel; Lt – air traveler; Lp – producer, manufacturer; Ld – designer.

Specification of the model allows us to more clearly understand the complexity of the relationship between the elements of the aviation system. In the future, by performing a spatial convolution of this model, it is possible to obtain a certain hypercube where the faces will be the corresponding new and known elements, and the edges will be the relationships between them. In addition, the logic suggests that depending on the situation (flight mode, stage of technical operation, etc.), the subordination of the model elements will be different.

So, when performing aircraft maintenance, the central place of the model should be given to technical personnel. At the same time, cabin and cabin crews will take a subordinate position, providing technical personnel with the necessary information about the state of the aircraft, problems noticed during the flight, etc. The nature of the relationship between the elements will change accordingly.

The described transformation is useful in the analysis of incidents and aircraft accidents caused by faults in maintenance and allow you to take into account many contextual and analysis-related factors, including equipment design. Moreover, avoids the need to focus on technical staff. However, it should also be remembered that the complete exclusion of a person from analysis, which is resorted to by many experts using this model, can cause incorrect conclusions, which is unacceptable when it comes to flight safety. An interesting and quite informative is the D. Peterson behavioral model [27] (Figure 3), which describes personnel performance as a characteristic that depends on innate abilities and motivation, which, in turn, depends on a number of other factors. For example, staff selection and training play an important role. At the same time, the decisive role in this model is assigned to motivation, regardless of where this motivation comes from – from work, colleagues, unions, or from the person himself.

Figure 3.

Peterson’s motivation, reward, and satisfaction model.

This model has wide practical application in the aviation industry. It and other similar models underlie the formation of the aviation personnel’s collective responsibility for ensuring flight safety in airlines: voluntary safety data reporting systems; incentives for safe and high-quality maintenance operations, etc.

Based on the principles of the modern approach, modern Maintenance Resource Management (MRM) systems are built [28]. The essence of the approach is to focus on the psychological and social interaction of personnel within, in particular, maintenance teams, as well as between specialists belonging to different professional groups. These thin, but the complex interactions found in the heart model, a bid R.L. Helmreich and H. C. Foushee in [29].

Interesting and very useful, in particular, for understanding the functioning and spread of hazardous factors within an aviation organization, is the J. Reason model [30].

The model uses an analogy with the physiological concept of the human immune system. According to the model, all organizational systems carry within themselves the “embryos of their own demise” in the form of some analogues of “pathogens” that violate the normal functions of the systems. Such organizational “pathogens” give rise to latent errors or, in other words, latent malfunctions in the functioning of the system. Latent errors can accumulate over time and interact with each other. Finally, this leads to the appearance of qualitatively new errors – no longer hidden, but obvious failures (active errors) in the system.

Investigating the paths of error, J. Reason made an important conclusion that the most important “pathogens” arise at high levels of leadership, since strategic decisions are made there. Strategic decisions are designed to provide maximum performance and at the same time – the greatest security of the system as a whole. This thesis by J. Reason was welcomed by safety experts and international organizations.

The following model deserves to be examined in more detail – this is the J. Reason accident causality model [17, 31], which can be found in various manuals and circulars, both international and regional civil aviation organizations, as well as in various departmental documents.

This model, known as the Swiss Cheese model (Figure 4), explains how people cause dysfunctions of complex, interacting and well-protected systems (such as a commercial transportation system), resulting in an accident. If a strategic, conceptual decision is made incorrectly, and this is not compensated by the common sense of linear management (“getting into” the second “window”), and preconditions (organization of labor, availability of equipment) do not allow revealing a potentially dangerous defect and, moreover, when in the event of an emergency there is no means to prevent its transition into a catastrophic one – the windows in all the barriers coincided and the accident leads to dire consequences.

Figure 4.

Model causation accident J. Reason.

One can imagine that these obstacles (like in a good shooting range) swing under the influence of specific conditions (personal experiences of the leader, delayed maintenance of the aircraft and reduced time for maintenance, equipment breakdown, fatigue, illness of technical personnel), as a result of which “through lumbago” remains possible and even more difficult to predict.

Strictly speaking, all the components of the human factor discussed above must be included in the J. Reason model, preconditions, and also (zero barrier) environmental conditions. In fact, this model has incorporated all the best of the theories and models considered above.

The model interprets the incident as a coincidence in time during the flight of imperfection at the same time in several levels of protection against an accident. In addition, for the implementation of an accident during a flight, conditions must arise that are critical when there is a coincidence of the “windows” in the protection levels.

For the efficient and productive work of the maintenance technical staff, certain preconditions must be met: the equipment must be available and reliable; employees – qualified and interested; working conditions – safe, contributing to high quality; various precautions, usually designed to prevent foreseeable bodily harm, damage or costly interruptions.

If one or more of these conditions is not met, the work of the maintenance personnel does not guarantee the prevention of an accident (for example, the specialist will not be able to detect a hidden defect if the necessary equipment is not available). Let us turn to an example that may give a clearer understanding of all of the above.

4.1 Example

The crash of DC-10-10 of American Airlines on May 25, 1979 [32].

The crash occurred from– for failure flight control system after termination of the left engine at the end of the takeoff roll (node had 19,871 hour operating time) killed 271 people on board and 2 people on the ground. The root cause of the disaster was not enough quality securing the left engine pylon after his regular replacement. After replacing the engine, maintenance specialists improperly tightened the pylon mount bolts, which caused bending stresses in the nodes and, ultimately, their fatigue failure. The immediate cause of the disaster was the spontaneous cleaning of six sections of the slats of the outer part of the left console and the failure of two alarm systems in the cockpit caused by damage to the hydraulic systems and control system when the engine with the pylon was separated from the wing. From – for a fault in the alarm system of the discrepancy between the position of the slats and their control knobs, as well as failure in the device control column pilots were unable to correctly identify the arisen emergency situation and prevent its transition to a catastrophic, although in principle it was possible. The low altitude and, as a result, the small time available for decision-making played a role. To confirm the validity of the approach, we analyze this incident from the point of view of the J. Reason model, a variant of which is shown in Figure 5.

Figure 5.

A model of causation of an accident built on the basis of the model of Professor J. Reason.

In the diagram, the first condition from the incident is a flight situation, environmental conditions. The aircraft was at a low altitude and had not yet gained cruising speed, as a result of which there was a short available time for the crew to evaluate the situation and make a decision, as well as low efficiency of the controls and fast dumping of the aircraft in a tailspin. Further, qualified and conscientious specialists usually carry out the replacement of the engine. It is hard to imagine that there was a “criminal negligence.” Most likely, they did not have a calibrated key for tightening the bolt with the necessary effort. Although it is possible that the mounting bolts were counterfeit (the problem was noticed after the crash of the Partvair Convair 580 aircraft on September 8, 1989). But someone decided to purchase such “cheap” bolts. It was unlikely that this was a personal initiative of someone from the line management. Most likely, the “strategy” of using such components was given the leadership of the company, which constantly has to resolve the contradiction between the cost of operating the aircraft price (competitiveness) on the ticket s and profit. Although it cannot be that the line management did not know about such a policy, they did not oppose this and did not conduct sufficient explanatory work with service specialists. Thus, the incident considered is quite consistent with the J. Reason model.

5. Conclusion

Unfortunately, the material presented above is only an excerpt from the accumulated over more than 30 years of activity in the field of safety research and the human factor. Nevertheless, we hope that we were able to state the very essence of the problem and clearly define the relationship between the causes of dangerous actions of personnel, the dangerous actions themselves and their consequences in the key to solving the human factor problems in aircraft maintenance.

In considering the issues of modeling were considered only the most commonly used in aircraft conceptual model of human. They do not imply a mathematical formalization of the problem, however, as shown by the authors’ studies in the field of military aviation, some of them, for example, the J. Reason model (Figure 4), can be successfully formalized to obtain quantitative characteristics of personnel reliability. Naturally, there are other approaches to modeling staff activities. In particular, probability-theoretical analysis models are known. They are widely used in engineering research on safety issues and have their own characteristics.

In conclusion, I would like to focus on the fact that absolute models do not exist, especially when it comes to studying human errors. The researcher himself has to answer, how useful it a particular model. In any case, we hope that the material presented in this chapter will be useful from the point of view of expanding and structuring information about this most relevant area of research.