Tag Archives: Aviation

Root Cause Analysis - Incident Investigation

The Deadliest Airship Crash in History Wasn’t the Hindenburg

By Kim Smiley

Many people have heard of the Hindenburg, but have you heard of the USS Akron?  The Hindenburg crashed in 1937, killing 35 people. The USS Akron crash four years earlier killed 73, making it the deadliest airship crash in history.

The crash of the USS Akron can be investigated by building a Cause Map, a visual format for performing a root cause analysis.  A Cause Map is built by asking “why” questions to determine what causes contributed to an issue.  The causes are organized on the Cause Map to illustrate the cause-and-effect relationships between them.  Why were 73 people killed?  This occurred because they were onboard the USS Akron, the airship struck the ocean surface, the crew had little time to brace for impact and there were insufficient flotation devices onboard.

The crew was onboard the USS Akron because the airship was operated by the US Navy and was performing a routine mission at the time of the crash.  The airship hit the ocean because it was operating over the ocean and lost altitude in a severe storm.  Why was the airship operating in a storm?  There was no severe weather predicted at the time and a low pressure system unexpectedly developed.  The crew had little time to brace for the impact because they weren’t aware that an impact was imminent.  There was low visibility at the time because it was a stormy, dark night. The barometric altimeter was also showing that the airship was higher than it actually was.  Barometric altimeters are affected by pressure and the low pressure in the storm impacted more than the crew realized.   The lack of life jackets and other floatation devices also contributed to the high number of deaths.  There were no life jackets onboard the airship at the time of the crash and only one rubber raft.  The safety equipment had been given to another airship and had never been replaced.

While few of us plan to operate or build an airship anytime in the near future, the important of keeping sufficient safety gear onboard any vehicle of any kind is an important lesson.  Lack of safety gear is a reoccurring theme in many historical disasters.  For example, the sinking of the Titanic would be a very different story if there had been sufficient lifeboats onboard.  This example might be very different if the crew had been wearing life jackets.  The airship would still have been lost, but there would likely have been fewer casualties.

To view a high level Cause Map of this example, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

The Dreamliner’s Battery Nightmare

By Kim Smiley

On January 16, 2013, the Federal Aviation Administration issued an emergency directive grounding all Boeing 787 Dreamliners operated by United States carriers during the investigation into two recent battery fires.  This emergency grounding is an unusually extreme step, especially given that the Dreamliner is a new plane with only six operated by US carriers at this time.

This issue can be analyzed by building a Cause Map, an intuitive, visual format for performing a root cause analysis.  A Cause Map is built by determining how the issue affects the goals of an organization and then asking “why” questions to find the causes that contributed to the problem.  In this example, the schedule goal is impacted because the Dreamliners have been grounded.  Why?  The Dreamliners were grounded because there is a known fire risk because there were two battery fires onboard these airplanes nine days apart.  The fact that the Dreamliner is the first major airliner to extensively use lithium-ion batteries and that fires in these batteries are particularly dangerous also contribute to the problem.   Lithium-ion batteries were used because they are lighter than other batteries and lighter planes use less fuel.  Fires in lithium-ion batteries are dangerous because they are difficult to extinguish because oxygen is released as they burn, which feeds the fire.

Several other goals are also worth considering like the customer service goal which is impacted by the negative publicity generated by this issue and the safety goal because there is a potential for injuries.   The economic impact of this issue could also be very significant since each Dreamliner costs $200 million and there are 800 planes on order in addition to about 50 that were already in service that may need to be repaired.

The battery fires are still being investigated but the cause isn’t known yet.  It may be an issue with manufacturing or the design itself.  What is known is that the Dreamliner is a brand new design that incorporates many new elements such as mostly electrical flight systems, an airframe that uses composite materials and the use of the lithium-ion batteries themselves.  The design process was also different from previous Boeing designs with much of the work outsourced to a network of global suppliers and very tight deadlines.

As more information becomes available, the Cause Map can easily be expanded to incorporate it.  To view a high level Cause Map of this issue, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

The Comet That Couldn’t Fly

By ThinkReliability Staff

“… the most exhaustively tested airplane in history.”

-Expert opinion on the DeHavilland Comet

Today, commercial jet air travel is standard fare. Estimates for the amount of air traffic over the United States in a given day have been in the range of 87,000 flights. With clever planning, clear skies and smooth service, a citizen almost anywhere in the world can get anywhere else by plane in less than 24 hours. But looking back at the history of aviation show us how far safety has come. Consider the DeHavilland Comet, the first commercial jet to reach production. British aviation specialists finalized the Comet’s design with much excitement in 1945 in hopes it would position their industry to establish a revolutionary service in commercial jet flight. Unfortunately, the Comet crashed on January 10th and April 8th in 1954.

What happened? We can identify some of the causes in a Cause Map, or visual root cause analysis.

CAUSE #1: POOR TESTING When you test an extremely heavy object carrying hundreds of people at high speeds thousands of feet above the ground, you would think planning for the worst case scenario would make the most sense. Unfortunately, the Comet tests were performed in tainted conditions on the strongest part of the plane.

Add in the fact that there was no prototype for the plane and you’ve got a test not worth having… and a plane not worth flying.

CAUSE #2: UNEXPECTED PRESSURE Altitude leads to pressure, and pressure puts stress on planes. But this stress wasn’t evenly distributed, and certain parts of the planes’ bodies were unevenly affected. So rather than the expected amount of pressure on the planes, the Comets faced an unforeseen squeeze.  

CAUSE #3: FLYING ABOVE AND BEYOND The Comet flew at twice the speed, height and cabin pressure of any previous aircraft, displaying a rather dangerous amount of ambition.

Combine all of this, Cause Map it, and you’ve got a plane flying under incredible conditions it couldn’t withstand, facing high pressure where it was most vulnerable.

In other words, an airborne recipe for disaster.

FALLOUT #1) SAFETY As expected, the pressure cycle in the planes’ cabins cracked the bodies of the planes. When the planes broke up, the lives of 56 passengers and crew members were lost.

#2) CUSTOMER SERVICE Some British industry institutions have a highly prestigious reputation (the Royal Navy’s impact on British sea travel comes to mind). The loss of the aircraft, though, was a black eye on British Aviation. Aviation historian George Bibel called the Comet an “adventurous step forward and a supreme tragedy.”

#3) MATERIALS/LABOR Effective airplanes have never been cheap, and this was no different. Not only would it cost money to investigate the cause of the accidents, but to replace the airplanes.   

FUTURE SOLUTION The Comet’s tragic crash had one silver lining: the post-crash analysis performed by its designers (including Sir Geoffrey de Havilland) set the precedent for future air accident investigations. In fact, the Comet was redesigned to solve the issues that caused the crashes and would later fly successfully. But by then, Boeing had already taken over most of the commercial jet market.

In the end, the Comet was first in flight but last in the market.

See more aviation cause maps:

Want us to cause map a specific plane crash for you? Tell us in the comments and we’ll pilot our way through it.

Root Cause Analysis - Incident Investigation

Planes Nearly Collide Over DC

By ThinkReliability Staff

Two planes came within seconds of a collision on  July 31, 2012 when both were directed to the same airspace by controllers.  Although no incident occurred, such near misses should be investigated thoroughly to prevent incidents in the future.

We can perform a root cause analysis of this incident in visual Cause Mapping form.  We begin with the impacts to the goals.  In the case of a near-miss like this one, some of the impacts to the goals will be hypothetical, based on the potential of the incident actually occurring.  For example, the safety goal is impacted because of the potential of death or injury to the passengers and crew on the planes.  The property goal is also impacted due to the potential of damage to the planes.  Even though this incident was considered a near-miss, there were some actual impacts to the goals, such as the delay in landing of the inbound plane, which can be considered an impact to the customer service, schedule, and  labor goal.

Once we have determined the impacts to the goals, we can begin the analysis by asking “why” questions.  In this case, the safety and property goals were impacted due to the potential collision of two planes.  These planes could have collided because they were on a collision course.   One plane was taking off directly towards another  plane that was trying to land.  The landing plane was landing in the opposite direction as usual (from the South instead of from the North) in order to avoid high winds from an incoming storm.  The plane taking off was cleared to take off towards the incoming plane (towards the South) by a different controller who was unaware that incoming planes were coming in from a different direction.  Communication of the change in incoming flights was not made to all controllers in the area and, although no details are available, it appears that the procedure used by the controllers when changing the flow towards the airport was inadequate.

There are thousands of recorded errors by air traffic controllers every year, and Reagan National (where this incident occurred) has had some particularly high-profile incidents, such as when a controller fell asleep (see   previous blog), involving air traffic controllers.  On August 10, 2012, two aircraft clipped each other at another Washington, DC area airport, although it is unclear if controllers were involved.  (See the article here.)  A congressional and FAA investigation is underway, and will hopefully address some needed improvements in air safety.

To view the Outline and Cause Map, please click “Download PDF” above.

Root Cause Analysis - Incident Investigation

11 Year Old Flies to Rome from England without Ticket or Passport

By Kim Smiley

On July 25, 2012, an 11 year old boy managed to sneak aboard a flight to Rome from Manchester England without a ticket or a passport.  No one noted the presence of the extra passenger until other passengers informed airline staff that the boy had told them he was running away from home and seemed suspicious.  The timing of this incident was unfortunate since it occurred a few days before the start of the Olympics and raised more questions about British security.

How did a boy manage to depart on an aircraft without any of the proper documentation?  This incident can be analyzed by building a Cause Map, a visual root cause analysis which intuitively shows the relationships between the causes that contributed to the issue.

In this example, the boy was able to sneak onto the flight because the extra passenger wasn’t noted in the head count and he got through five separate security checks.  The boy did not circumvent any of the normal security checks, he just walked through them without showing a shred of paper or anybody questioning him or stopping him.

The boy was able to get into the secure departure area without showing a ticket, get through the passport check without a passport, get through security screening without showing a ticket or boarding pass (he did go through the x-ray), get through the gate passport and boarding pass check without any paperwork and finally board the plane without a boarding pass.  Add in the final failure of the head count to notice an extra body and an English 11 year without any paperwork was on his way to Rome.

Apparently the boy was able to pull off this feat by sticking close to families with children and took advantage of situations where one family member was showing the documentation for a large group.   Video surveillance from the airport shows him acting very confident and his behavior gave no one reason to be suspicious.  The airport was also very busy due to the summer holiday season. Throw in an ineffective head count and the end result was a significant, if not particularly dangerous, security breach days before a huge international event.

Several members of the airline staff were suspended as a result of this incident.  A full investigation is underway to understand the incident and work to ensure something similar never happens again.

To view a high level Cause Map of this incident, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

Navy Jet Crashes into Apartment Building

By Kim Smiley

On April 6, 2012, a Navy F-18 jet crashed into an apartment building in Virginia Beach, Virginia. Significant damage was done to the apartment building and the jet was destroyed, but amazingly no one was seriously injured or killed.

This incident can be analyzed by building a Cause Map, an intuitive, visual format for performing a root cause analysis.  The first step when building a Cause Map is to determine how the incident affected the organizational goals.  The impacts to the organizational goals are recorded in the Outline which also documents the background information of the incident.  In this example, the safety goal was obviously impacted since there was potential for serious injuries.  The property goal was also impacted because the jet was destroyed and the apartment building suffered extensive damage.

Once the Outline is complete, “why” questions are asked to determine what factors contributed to the incident.  In this example, there was potential for injuries because a jet hit an apartment building.  This occurred because the jet was flying near the residential area and the jet was unable to complete its attempted take off.  The pilots could have been injured had they not been able to safety eject before the crash and there was potential for people on the ground to be injured since the jet crashed into a residential area. The jet crashed because it experienced a dual engine failure.  The investigation into this crash determined that that both engines failed for two separate, unrelated reasons.

The right engine failed because of a catastrophic failure of the engine compressor when it ingested flammable liquid that was ignited.  The left engine afterburner failed to light. Investigators believe that an electrical component failed, but the damage to the left engine was too severe for a conclusive determination of what exactly occurred.   According to the Navy, this is the first unrelated dual engine failure of a F-18.

The Navy plans to update procedures to incorporate the possibilities of this type of incident.

To view a high level Cause Map of this issue, click on “Download PDF” above.

Root Cause Analysis - Incident Investigation

Loss of Firefighting Plane Affects Firefighting Efforts

By ThinkReliability Staff

Wildfires in the Rocky Mountain region have been plaguing the nation for weeks.  The firefighting mission took a severe hit when a C-130 that was dropping flame retardant on the fire crashed on the evening of July 1, 2012, killing four of six crewmembers and injuring the other two.  As a result of the crash, the Air Force grounded other C-130s for two days, increasing the work for firefighters on the ground.

Although the Air Force has not released details of what exactly resulted in the plane crash, we can look at the information we do have available in a visual root cause analysis or Cause Map.  We begin by determining which of the organization’s goals were impacted in the Outline.  First, because of the deaths of the crewmembers, the safety goal was impacted.  The environmental and customer service goals were impacted because of the decreased ability to fight wildfires.  The schedule goal was impacted because other C-130s were grounded for two days.  The property goal was impacted because of the damage to the plane, and the labor goal was impacted due to the increased difficulty for remaining firefighters in fighting the fire.

Once we have determined these impacts to the goals, we can begin asking “Why” questions to draw out the cause-and-effect relationships that led to the impacted goals.  The safety, and other goals, were impacted due to the plane crash.  Again, although the Air Force has not released details of its ongoing investigation, it is believed that  downdraft (caused by the same high winds in the area that are helping to keep the wildfires travel) may have contributed to the crash.  An additional contributor is the fact that the plane was likely traveling at extremely low altitude, which allowed the plane to perform its task to help fight wildfires.  Lastly, it is possible that the heavy demands placed on the plane due to the extent of the fires may have contributed to the incident.  If, during the course of the investigation, it is determined that one of these causes was not related to the plane crash, the causes can be crossed out, but left on the map.  Evidence that shows that this cause did not result in the incident should be placed under the box.  This allows us to keep a complete record of which causes were considered.

Once the causes related to the incident have been placed on the map, solutions to mitigate the risk of this type of incident from happening again can be brainstormed and implemented.

To view the Outline and Cause Map, please click “Download PDF” above

Root Cause Analysis - Incident Investigation

Deadly Plane Crash in Lagos, Nigeria

by ThinkReliability Staff

A devastating air crash in Lagos, Nigeria killed all on board and at least 10 on the ground.  This was the first major commercial air disaster since 2006.  Safety efforts since that disaster resulted in the US Federal Aviation Administration ( FAA) granting Nigerian    airlines its top air-safety rating.  Now concerns about air safety in Nigeria have resurfaced.  As a result of the crash, according to Harold Demuren, head of Nigerian civil aviation body: “We have suspended the entire Dana fleet.  They will be grounded as long as it takes to carry out the necessary investigations into whether they are airworthy.”

We can examine this incident in a Cause Map, or a visual root cause analysis.  We begin with the goals that were impacted.  In this case, the safety goal was impacted due to the deaths of people on the plane and on the ground.  We begin by asking “Why” questions to put together a very simple cause-and-effect relationship.  In this case, after losing both engines, Dana Air flight 992 crashed into a residential building in a highly populated suburb of Lagos, Nigeria, killing all 153 people on board and at least 10 on the ground.

The investigation of the plane crash is still ongoing.  However, it is known that both engines of the plane lost power, causing the plane to rapidly lose altitude and crash into a highly populated area.  Some of the areas being investigated that may have contributed to the crash are:

1) a bird strike (bird remains were found in one engine),

2) poor maintenance (although the plane was regularly inspected, there were also reports of leaking hydraulics and a history of poor airline safety in Nigeria, which appeared to have been remedied in recent years as indicated by the US FAA’s granting of its top air-safety rating,

3) overworked planes, likely due to financial considerations (the plane that crashed was on its fourth trip of the day), and/or

4) the age of the airplane (at 22 years old, it was technically not permitted to fly in Nigeria, which bans the use of planes over 20 years old).

As more information is revealed during the investigation it can be added to the Cause Map.  As the investigation is concluded, there will likely be more changes to Nigerian requirements and oversight for air safety.

To view the Outline and Cause Map, please click “Download PDF” above.

Root Cause Analysis - Incident Investigation

$3 Bolt Causes $2.2 million in Damages to US Submarine

By ThinkReliability Staff

A $3 bolt was left in the main reduction gear of the USS Georgia after a routine inspection.  The extensive damage caused by the bolt resulted in 3 months in the shipyard for the submarine, causing it to miss deployment.  The propulsion shaft was left to operate for two days after sounds indicated that there was something wrong.  This may have increased the damage to the main reduction gear – damage which cost $2.2 million.

How did the bolt end up in the main reduction gear? Why was the propulsion shaft operated for 2 days after damage was suspected?

We can look at the causes that led to this incident in a Cause Map, a visual root cause analysis that clearly outlines cause-and-effect relationships that result in impacts to an organization’s goal.  The first step to building a Cause Map is to determine how the issue impacts the organization’s overall goals.  Here we can consider the US Navy as the organization.  The customer service goal (with the rest of the country as the “customers”) was impacted because the submarine was unavailable for deployment.  The production/schedule goal was impacted because the submarine was in the shipyard for  three months.  The damage to the main reduction gear is an impact to the property goal, and the repairs are an impact to the labor/time goal.  The total cost resulting from this issue was estimated to be $2.2 million.  Once the impacts to the goals have been determined, we can ask why questions to put together the cause-and-effect relationships that led to these impacts.

The bolt was left behind after a routine, annual inspection.  Because of the great potential for damage when foreign objects remain within equipment, detailed procedures are used for these inspections and include a log of all equipment brought into the area and a protective tent to keep objects from falling in.  Details of what went wrong that resulted in the bolt falling into the main reduction gear were not released, but the inspection was reported to have “inadequate prep and oversight” which likely contributed to the issue.

After the propulsion shaft was turned back on, noise indicated that there was a problem.  However, the shaft was operated for two days in a failed attempt at troubleshooting.  It’s likely that this increased the damage to the main reduction gear.  It is unknown what procedures were – or should have been – in place for troubleshooting, but the actions taken as a result of this incident suggest that proper procedures were not followed once the damage was suspected.

In this case, members of the crew who were found to not have performed their job – possibly by not following proper procedure – were punished in varying ways.  It is likely that the investigation went into great detail about whether procedures were adequate, what steps were not followed, and why, and the results also used to improve procedures for the next inspection.

To view the Outline and Cause Map, please click “Download PDF” above.

Root Cause Analysis - Incident Investigation

113 Killed When a Plane Hit a Hill in Guadeloupe

By ThinkReliability Staff

Flying into a small airport surrounded by mountains at night, in a thunderstorm, with virtually no support from ground equipment proved to be too difficult for even an experienced pilot.

All 113 passengers and crew on Air France Flight 117 were killed when the plane crashed into a hill near the airport in Point-à-Pitre, Guadeloupe on June 22, 1962. The crash occurred in the early morning hours, during a severe thunderstorm.   We can examine the causes of this tragedy in a Cause Map, a visual form of root cause analysis that shows the cause-and-effect relationships that led to an incident  such as this one.  The VHF (very high frequency) omnidirectional range (VOR) indicator, which helps aircraft determine position and stay on course, at the airport in Guadeloupe was not functional.  (It’s not clear if the crew of the Air France flight was aware of this, or how long the equipment had been broken.)  The plane in question was a Boeing 707.

The safety goal was impacted because all people onboard the plane – passengers and crew – were killed.  The plane (valued at $5.5 million) was completely destroyed.  The lack of a working VOR, and the incorrect information provided by the  Automatic direction finder (ADF) can be considered impacts to the customer service goal.  Beginning with the impacted safety goal, we can ask “Why” questions to begin mapping cause-and-effect relationships.   The passengers and crew were killed (and the plane destroyed) when the plane crashed into a hill.

The plane crashed into a hill because the airport was surrounded by mountains, and the plane strayed off the let down track, which it should have used for its approach to the airport.  The pilot went off track because he was using a visual approach, probably due to the fact that the VOR was not providing data since it was not working.   The pilot was unable to see the track due to low (10 km) visibility and since it was early morning (~4 a.m.).  In addition, the plane received incorrect position indication from the ADF, which appeared to malfunction as a result of the severe thunderstorm in the area.

This incident resulted in concern from pilots of substandard landing conditions at certain airports.  More care is now taken with take-off and landing during inclement weather, poor visibility, or conditions that result in landing with decreased equipment support.

To view the Outline and Cause Map, please click “Download PDF” above.