International Journal of Industrial Ergonomics 26 (2000) 177}199

Analyzing human error in aircraft ground damage incidents

Caren A. Wenner, Colin G. Drury*
State University of New York at Buwalo, Department of Industrial Engineering, 342 Bell Hall, PO Box 606050, Buwalo, NY 14260, USA
Received 10 June 1997; accepted 18 February 1998

Abstract

Ground damage incidents (incidents in which airline personnel cause damage to an aircraft on the ground) occur as
airline personnel are working on, or around, an aircraft on the ground, either on the ramp or at a maintenance facility.
Each incident can be quite costly to the airline, with costs both tangible (repair costs and lost revenue) and intangible
(passenger inconvenience, increased maintenance workload). Thus, airlines have a "nancial incentive to reduce the
number of ground damage incidents that occur. One of the airline's most di$cult tasks has been to utilize the information
collected in their existing error reporting systems to determine the common latent failures which contribute to typical
ground damage incidents. In this study, 130 ground damage incidents from a major airline were reviewed to determine
the active and latent failures. Twelve distinct hazard patterns (representing the active failures) were identi"ed, with three
hazard patterns accounting for 81% of all ground damage incidents. Nine major latent failures were identi"ed, and the
relationships between the hazard patterns and latent failures were examined in depth. This type of analysis allows the
latent failures common to di!erent hazard patterns to be identi"ed, and provides a means for developing focused
intervention strategies to prevent future ground damage.
Relevance to industry
Airlines have generally had a di$cult time analyzing reports of human error to make improvements in their
maintenance systems. This study provides a methodology that allows reports of human error to be analyzed, and
interventions developed based on the results of the analysis. The methodology would also be applicable to, and useful in,
other industries.  2000 Elsevier Science B.V. All rights reserved.

Keywords: Aircraft ground damage; Human error analysis

1. Introduction besides #ight operations, that have a serious impact

on aviation safety. Errors in maintenance opera-
Since the Aloha Airlines accident in 1988, tions, especially, have the potential to result in
in which the failure of airline inspectors to de- serious safety problems, and/or cause an accident.
tect cracks in the fuselage resulted in the aircraft However, most e!ort (by airline personnel, industry
splitting apart in #ight, the aviation community consultants, and human factors researchers) on re-
has recognized that there are other departments, ducing errors was concentrated on improvements
to the #ight deck, and on pilot training. McDonald
and Fuller (1996a) point out that human factors
* Corresponding author. Fax: #1-716-645-3302. e!orts on the #ight deck has been a recognized
E-mail address: drury@bu!alo.edu (C.G. Drury). research "eld for 25 yr, while e!orts on aviation

0169-8141/00/$ - see front matter  2000 Elsevier Science B.V. All rights reserved.
PII: S 0 1 6 9 - 8 1 4 1 ( 9 9 ) 0 0 0 6 5 - 7
178 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

maintenance have only just begun. Recognizing One example, documented in Airline Equipment
this shortcoming, the FAA's O$ce of Aviation Maintenance (Chandler, 1995), describes a typical
Medicine established a program in 1988 to fund American Airlines ground damage incident in
a broad range of human factors research in the which the cost of repairing a damaged aircraft was
airline maintenance domain. $39,300. However, the total cost of the incident was
Many projects within this program have focused calculated to be $367,500 due to passenger and
on human errors in the maintenance environment, cargo revenue lost. In addition, there are non-
and on how to prevent similar errors from reoccur- tangible costs to the airline including: passenger
ring. It is widely recognized that although a large inconvenience, a!ected #ight schedules throughout
number of errors may occur on a regular basis, it is the entire airline system, and increased mainten-
very rare that a situation is elevated into a serious ance workload. A typical airline may have 100}200
incident a!ecting #ight safety. In most situations, reportable GDIs each year, resulting in signi"cant
an error is either caught immediately or the de- "nancial losses that could be prevented.
fenses of the maintenance system act to prevent the Thus, it is obvious that airlines have a signi"cant
error from becoming an incident. Thus, the error is "nancial incentive to reduce the number of GDIs
prevented from propagating through the system. that occur. However, due to the di$culty that often
Mechanics are especially conscious of the impor- accompanies the calculation of the total cost of
tance and seriousness of their work, and typically each GDI, airlines have not been able to quantify
expend considerable e!ort to prevent, or at least the magnitude of the losses with any accuracy.
recognize and correct, errors that could lead In addition, airlines have had a di$cult time con-
to safety concerns for personnel, passengers, and trolling these costs, since they have been
equipment. unable to pinpoint the causes of recurrent incidents
Fortunately, airlines report few maintenance- (McDonald and Fuller, 1996b).
induced incidents that a!ect the safety of personnel
and passengers. However, ground damage, or dam- 1.2. Error reporting systems
age to an aircraft caused by airline personnel while
the aircraft is on the ground, remains a serious Problems in identifying causes of recurrent inci-
problem for most airlines, with costs in the tens of dents are at least partially the result of inadequate
millions of dollars per year. Ground damage can methods of collecting information about errors. In
occur while ramp personnel are servicing an air- a typical airline, errors (above a certain threshold of
craft, and/or while maintenance personnel are per- severity) are strictly monitored and recorded. For
forming maintenance work. In fact, ground damage example, airline management may maintain strin-
incidents (GDIs) can occur at any time personnel gent records of on-time #ight departures/arrivals,
are working on, or around, an aircraft that is on the turnaround time for aircraft requiring mainten-
ground. This category of incident only includes ance, injuries to personnel, damage to aircraft and
damage that is inherently preventable by airline other ground equipment, and other measures that
personnel on the ground: damage caused by hail, document the airline's overall performance. In ad-
bird strikes, part failures, or even by foreign object dition, many errors (below the threshold of severity
damage is not considered to be ground damage, for reporting) may be detected and corrected
and some of these categories even have their own routinely as part of the system with no records
separate prevention programs. kept.
Most of the error-reporting systems in use at
1.1. Why is ground damage important to airlines? a typical airline are maintained and utilized by
di!erent departments, and are rarely used together
Ground damage incidents are extremely costly to to analyze the system as a whole. But, there are
an airline; the total cost of an incident includes the many inherent problems that may a!ect more than
cost of repairing the damage, as well as the less one of these performance measures, and similar
tangible costs of keeping an aircraft out of service. errors may lead to an incident to be recorded in
 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199 179

di!erent error reporting systems. For example, if the factors leading up to the incident, or the other
a mechanic drops a wrench on his foot, the incident system factors that may have contributed to the
would be recorded as an OJI (on-the-job injury). If incident. However, these type of reporting systems
a mechanic drops a wrench on an aircraft, damag- do provide for quantitative tracking of error data,
ing it severely, the incident would be recorded as including such information as the number of inci-
Technical Operations Ground Damage. If the dents per month at each station, number of inci-
wrench were dropped on the aircraft, causing no dents occurring on each type of aircraft, etc. They
damage, the incident would not be recorded at all! also allow the particular individuals responsible for
Finally, if a ground operations employee drops the incident to be identi"ed, and for blame to be
a wrench on an aircraft, the incident would be assigned. Generally, these reporting systems are
recorded as Ground Operations Ground Damage. useful to monitor trends in performance, but
In each of these scenarios, the error was exactly the little use is made of this information to redesign the
same, only the "nal consequences di!ered, in turn systems that generated the errors in the "rst place.
a!ecting the way in which each of these incidents is In recent years, other error reporting systems
recorded. Without compiling information from all with explicit human factors components have been
of these error-reporting systems, it is quite di$cult introduced which provide investigators with tools
to get a full picture of the types, and frequencies, of to help identify latent failures that may have con-
recurrent errors. tributed to an error. Boeing's Maintenance Error
The current project, as is typical of FAA O$ce Decision Aid (MEDA) system, and Aurora Safety
of Aviation Medicine projects, was a joint e!ort and Information Systems Inc.'s Aurora Mishap
between researchers and a partner airline. In Management System are examples of current error
our partner airline, ground damage incidents are reporting systems which are being used by airlines
recorded in narrative reports. In these reports, an to investigate GDIs. However, airline personnel are
investigative team produces a detailed written re- still having di$culty applying the information col-
port, including: a problem statement describing the lected by such systems, since the information gener-
incident, a detailed description of the incident, a list ated from such systems often does not point to
of process, equipment and personnel factors that speci"c interventions.
contributed to the incident, as well as recommen-
dations for preventing this type of incident from 1.3. Errors vs. violations
happening again. The report generally includes
photographs of the damage to the aircraft as well as The purpose of error reporting systems is to
the equipment that may have been involved. Also, collect information about an error so that the fac-
written descriptions from all of the personnel in- tors that caused the error can be identi"ed and
volved are obtained and are included in the report. eliminated from the system to prevent reoccur-
The recommendations from each GDI are sup- rence. However, it is not always easy to identify
posed to be disseminated to all of the stations these error-producing factors.
(airports where the airline has personnel) to allow When an error occurs in the maintenance system
other personnel to learn from the incident. of an airline, the mechanic(s) who last worked on
At other airlines, GDIs may be recorded using an the aircraft is usually considered to be at fault. The
investigative tool based on a checklist, or another mechanic may be reprimanded, sent for further
&form' based tool. Using such a reporting method, training, or simply told not to make the same
much of the factual data of an incident is recorded mistake again. However, to blame the mechanics
(including the type of accident, the type of injury, for all of the errors that are committed is perhaps
the type of equipment being utilized, etc.), although giving them too much credit for their role in the
there is little (if any) opportunity to provide a de- airline's maintenance system. Many errors result, in
tailed narrative description of the incident. There is fact, from a combination of other failures inherent
little encouragement inherent in this type of report- in the system and the mechanic involved is merely
ing system to glean speci"c information concerning the source of one of such failures, often the "nal
180 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

failure in a sequence (Maurino et al., 1995). In these training for how tasks are typically performed.
cases, it may not matter which mechanic is involved Over time, the routine violations may be passed
at the time of the actual incident, since the system down as correct procedures to new personnel.
itself encourages particular errors or violations to Management and supervisors may not enforce the
be committed. procedures, since the violations are often per-
Errors, as de"ned in Maurino et al. (1995), are formed to prevent delays and promote e$ciency.
failures of planned actions to achieve desired conse- Generally, the violations do not lead to any further
quences. Errors in formulating a plan of action or problems, the bene"ts greatly outweigh the costs of
in executing the plan are possible. On the other committing the violations, and management can
hand, violations are willful deviations from safe look the other way. Only when an incident occurs
operating procedures, practices, standards, or rules. due to the violation (e.g., ground damage when an
The distinction between errors and violations is aircraft contacts a parked object due to insu$cient
especially important in the airline maintenance en- number of spotters), are the employees involved
vironment, in which mechanics are often given con- reprimanded for their behavior and everyone is
#icting goals and priorities to achieve. Mechanics reminded to follow the procedures. Thus, although
are told to be safety conscious and to follow violations are o$cially highly discouraged by man-
documented procedures, but are also pressured to agement, they are often tolerated as part of normal
keep on schedule, and to prevent delays that are so operating practices.
visible to passengers. The heavy workload at most
maintenance stations, coupled with a limited num- 1.4. Active and latent failures
ber of personnel and sub-optimal equipment, make
it di$cult for all of the e$ciency and safety goals The failures caused by those in direct contact
to be achieved simultaneously. Mechanics often with the system, i.e. the mechanics that are working
make a choice as to which goal is perceived by the on the aircraft, are considered to be active failures.
supervisors to be currently most important: at Thus, active failures are errors or violations that
times the mechanics choose e$ciency, most have a direct and immediate e!ect on the system.
work completed in the least amount of time, over Generally, the mechanic himself catches the conse-
safety considerations [essentially a speed}accuracy quences of these active failures; or the defenses,
trade-o! (Drury, 1994)]. barriers and safeguards built into the maintenance
Mechanics must also operate under a large num- system act to prevent the failure from causing an
ber of rules and procedures, and it is often di$cult incident. Thus, the system must rarely deal with the
for the mechanics to keep track of them all. Some of consequences of active failures. However, when an
the procedures can describe a more di$cult way to active failure occurs in conjunction with a breach
perform a task, or may require more personnel in the defenses, a more serious incident will result
than is typically available. Thus, over time, certain (Maurino et al., 1995).
procedures have become routinely violated. For Latent failures are those failures that derive from
example, a towing procedure may specify that six decisions made by supervisors and managers who
people are necessary whenever an aircraft is moved are separated in both time and space from the
(a tug driver, a brakeman, a nose walker, a tail physical system. For example, technical writers
walker, and two wingwalkers). However, in actual- may write procedures for a task with which they are
ity, it is very di$cult to "nd six people who are not not totally familiar; if the procedure has even one
otherwise occupied every time an aircraft is moved. mistake in it, the mechanic using the procedure will
Thus, the tug driver may decide to move the air- be encouraged to commit an error. The latent fail-
craft using only a brake man and two wingwalkers, ures can often be attributed to the absence or weak-
in order to prevent operational delays. nesses of defenses, barriers, and safeguards in the
In fact, some of the newer personnel may not system. Latent failures may lie dormant in the sys-
even know that they are violating documented pro- tem for long periods before they become apparent
cedures, since they have received only on-the-job (Maurino et al., 1995). Fox (1992) de"nes latent
 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199 181

failures as those decisions made in the organization can eliminate many of the errors and violations.
which may create poor conditions, result in less Violations can be discouraged by ensuring that the
than adequate training, poor supervision, etc. correct way for the mechanics to perform their
which may lie dormant for some time, but which tasks is also the easiest and most e$cient. Errors
have the potential to predispose active failures. (which can never be totally eliminated) can be re-
For an incident to occur, latent failures must duced to as low a level as possible by improving or
combine with active failures and local triggering strengthening the various defenses, barriers, and
events, such as unusual system states, local environ- safeguards which prevent propagation through the
mental conditions, or adverse weather. There must system.
be a precise &alignment' of all of the &holes' in all of
the defensive layers in a system (Maurino et al.,
1995). For example, rain may cause a mechanics' 2. Methodology
foot to be wet, allowing his foot to easily slip o!
the worn brake pedal in a pushback tug when the To prevent recurring incidents, it is necessary to
mechanic becomes distracted. The tug may then identify factors in the system which can cause er-
lunge forward contacting a parked aircraft. The rors. This study provides a means of identifying
latent failure in the system is that the brake pedal such error-producing factors in a typical mainten-
has no anti-slip surface in place, but the problem ance domain.
does not become an issue until the rainy conditions In this analysis, 130 Technical Operations GDI
(a local trigger) cause an incident. If any one of reports were analyzed, covering ground damage
these failures had not occurred (mechanic did not from January 1992 through April 1995. These re-
become distracted, the tarmac was not wet, or the ports were obtained from our partner airline. Each
brake pedal was in better condition), the incident report described one GDI, and was prepared by an
would have been avoided. investigative team (usually at a middle manage-
Traditionally, the mechanic would be blamed for ment level) from the airline. Incidents analyzed
this incident, since he allowed his foot to slip o! the in this study were based on data readily available in
pedal. Clearly, the mechanic did commit this error. Technical Operations and included all reports
However, it must be noticed that mechanics are completed in 1995 up until the date the data was
required to drive pushback tugs daily, and cannot obtained from the partner airline.
control the weather conditions, or even the condi- Initially, each GDI report was reviewed to deter-
tion of the equipment. They are required to work mine the speci"c action that caused the ground
under strict time guidelines, and they are highly damage. The reports could be sorted into twelve
motivated, by management and personally, to keep distinct patterns covering almost all of the GDI
on schedule. Mechanics therefore, should not face reports, termed here as a Hazard Pattern after
sole responsibility for such incidents when they Drury and Brill (1978).
occur. It is important to consider all of the other Next, each GDI report was analyzed to deter-
factors that a!ect their performance, and all of the mine the speci"c active failures, latent failures, and
other system-wide problems that may contribute local triggers that contributed to the incident.
to failures. A scenario was then developed for each hazard
In any system that has been operating for long pattern, illustrating the common factors between
enough to experience su$cient incidents, examina- all of the incidents. Each of these was also sum-
tion of past occurrences makes it is possible to marized as an event tree illustrating how each of the
determine the types of errors, violations, and latent latent failures contributes to the "nal damage
failures that typically have caused problems in the event. This form of analysis, which has much in
past. However, in order to prevent future incidents, common with Fault Tree Analysis, was originally
it is necessary to predict, identify, and remedy latent developed by CNRS in France (Monteau, 1977).
failures that still may be lying dormant in the sys- The scenarios developed for each hazard pattern
tem. Addressing the latent problems in the system are included in the next section.
182 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

2.1. GDI scenarios result of the mechanics' repeated performance of

similar tasks.
2.1.1. Tools or materials contact aircraft (1.1.1) Other errors result because the equipment does
In these incidents, a piece of equipment (tools, not &behave' as the mechanics expect. For example,
parts) falls onto the aircraft (or mechanic). Gener- the engine sling does not hang level from the hoist;
ally, gravity is the ultimate cause of these incidents. the overhead crane has only one speed in the
By examining the environment in which the inci- East}West direction and this speed is perceived to
dent occurred, and the steps in the process proceed- be too fast; and the work platform has sagged over
ing the incident, it is possible to see how other time, creating a decline towards the front end. The
non-obvious factors contributed to the incident. mechanics' misperceptions of the equipment cause
One such example is presented below. them to perform as they otherwise might not if they
were aware of the correct state of the equipment.
During an engine change, a mechanic pulled For instance, a mechanic may have chosen not to
out a forklift supporting an A-frame, causing the place a wheeled dolly on the work platform if he
frame to fall on the aircraft. However, on further had known it was so slanted towards the front end.
review of the steps leading up to the incident, it is
possible to see how this incident came to happen. 2.1.2. Workstand contacts aircraft (1.1.2)
First, it was not obvious to the mechanics that In these incidents, a workstand that is being used
the A-frame was top heavy and could not sup- to service or repair the aircraft comes in contact
port itself. Second, the forklift was removed in with the aircraft. There are various scenarios in
order to facilitate disassembly of the A-frame and which this type of incident can occur. The mechan-
nose cowl sling, two pieces of equipment neces- ics working on the aircraft may misperceive the
sary for the engine change. The disassembly was position of the workstand while maneuvering in
required because the engine change kit was miss- close proximity to the aircraft. In other situations,
ing parts, requiring the mechanics to change the mechanic accidentally causes the workstand to
their procedure while in the middle of the engine move in a direction that is not intended. Mechanics
change. Unfortunately, the missing parts were may also fail to properly con"gure (e.g., raise/lower
not detected prior to beginning the procedure, platform) the workstand before moving it. Finally,
since the engine change kit does not contain in almost all of these incidents, no ground spotter
either an inventory or packing list for the parts to was used while moving workstands around the
be checked against. aircraft.
This last scenario, in which no ground spotter is
Thus, although this incident was eventually blamed used, is a routine violation of company policy. The
on the mechanic who moved the forklift, the prob- ground equipment policy requires a spotter to be
lem had its antecedents far earlier, when the engine used at all times when moving equipment around
change kit was prepared. the aircraft. However, the unavailability of excess
Other latent failures contributing to these types personnel, and high workloads for ground person-
of incidents include poor communication between nel has made this requirement di$cult to follow.
co-workers, and between shifts; inappropriateness Since this policy is rarely enforced (except following
of available equipment for the task; inadequate a ground damage incident) mechanics often feel
space in which to perform the task; and poor mech- than they can properly maneuver the equipment
anical condition of the equipment. Many of these and can properly judge distances from the aircraft.
latent failures can all be considered to be failures of There are, however, many latent failures that can
the workforce to become aware of the possibility of be identi"ed as contributors to these incidents. For
risks and hazards. This lack of awareness may be example, in some situations, the workstand has
a failure of management to properly emphasize unused metal brackets attached that cannot be seen
safety as the "rst priority (as opposed to emphasis by the workstand operator. In other situations, the
on speed of task completion), and/or may be a equipment su!ers from a mechanical problem that
 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199 183

contributes to the incident (e.g., the stand jerks seen that this is simply an accident type waiting to
forward when placed in stop position, wheels do happen. Often, the ground on which the mechanic
not swivel properly, design of dead man switch must work is slippery, due to a combination of oil,
allows the foot to easily slip out). Furthermore, cleaning #uids, and rain. This makes the mechanic's
pressures to ensure on-time departures encourage footwear slippery, and may cause his foot to slip o!
the mechanics to quickly move their workstands the pedals while driving a vehicle. Although these
into position, without properly checking for ad- conditions are often present at many stations, the
equate clearance with the aircraft. pedals in the vehicles do not all have anti-skid
Another contributor to this category of incidents surfaces. In some situations, the anti-skid surface
is the use of improper, or ill-suited, workstands to has simply worn o!, and has not been replaced.
perform assigned tasks. In these situations, the Therefore, these types of incidents can be traced
mechanic uses workstands (or other ground equip- back to poor vehicle maintenance.
ment as workstands) for purposes for which they As in the previous category of incidents (see
were not designed. The mechanic may choose to Hazard Pattern 1.1.2), some of these incidents
use an improper workstand because either: the (ground equipment is driven into the aircraft) are
maintenance station does not own the correct further aided by the use of ill-suited ground equip-
equipment, the correct equipment is unavailable ment for the particular task to be performed. For
(e.g., the correct equipment is in the shop for repairs example, in one incident, mechanics using a push-
or is being used elsewhere), or the correct equip- back tug as a work platform backed the tug into the
ment is less accessible than the incorrect equipment C1 engine thrust reverser. Speci"cally, the high
(e.g., the correct equipment is parked in a remote windshield on the tug contacted the aircraft. In this
location). An improper workstand may o!er the situation, the station did not have a lift that was
mechanic quicker access to the work, but may suitable for work in tight locations, and the work
cause additional problems. Since the workstands platforms that the station does own are di$cult to
are not designed for the work they are doing, they locate when needed. Additionally, in many of these
are often di$cult to correctly position without con- incidents, no ground spotter was used when mov-
tacting the aircraft, and may require excessive relo- ing equipment in close proximity to the aircraft.
cation throughout the task is duration. The This is a violation of a company policy that is rarely
increased di$culty of moving the equipment enforced.
around the aircraft, as well as the increased number Many of these incidents occurred in congested
of times the position of the workstand must be areas, where the mechanic was forced to maneuver
adjusted increases the chances for the workstand to his vehicle through other parked ground equip-
contact the aircraft. ment. Pressure to ensure on-time departures often
causes the mechanics to take &short-cuts', instead of
2.1.3. Ground equipment is driven into aircraft waiting for other vehicles to be moved out of the
(1.1.3) safer path. For example, in one incident, a mech-
In these incidents, equipment (trucks, belt anic drove a tug with an airstart unit attached
loaders, etc.) is driven by airline maintenance per- under the right wing of a parked aircraft, contact-
sonnel into the aircraft. The drivers either misjudge ing the aircraft. The mechanic was attempting to
the amount of space available, misjudge the size of leave a refueling station, and all of the other exit
the equipment, or in some cases, accidentally con- points were blocked with equipment and other
tinue moving forward when they know they are vehicles. The mechanic decided to take the open
about to contact the aircraft. This last type of path under the aircraft in order to facilitate on-time
incident occurs when the mechanic is attempting to departure of his next #ight. Although this was
stop the vehicle by depressing the brake pedal, but a conscious choice by the mechanic to violate the
fails to do so. All of these incidents are often at- company policy against driving under the aircraft,
tributed to the driver allowing his foot to slip o! the the decision was made in what the mechanic con-
pedal. However, on closer examination, it can be sidered to be the best interest of the company.
184 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

2.1.4. Unmanned equipment rolls into aircraft (1.1.4) only one person was assigned to a tow, the hitch
In these incidents, equipment (tugs, etc.) which is had been modi"ed to allow easier connections/
left unattended by airline personnel, rolls into the disconnections. Plant maintenance, the department
aircraft. These incidents can be divided into two responsible for the condition of the ground equip-
categories, those in which an unmanned parked ve- ment, was unaware of the modi"cations to the hitch
hicle rolls into an aircraft, and those in which a piece on this vehicle. A worn hitch pin that had worn
of equipment rolls into the aircraft. In most of the small enough to come out of the hitch body during
incidents in the "rst category, the vehicle was left the tow exacerbated this particular incident.
unattended, with the engine running and the parking
brake set. This is in violation of company policy that 2.1.5. Hangar doors closed onto aircraft (1.1.5)
requires all vehicles to be turned o! when left unat- In these incidents, airline personnel close the
tended. However, in many of the northern stations, hangar doors onto the aircraft. Misjudging the
it has become standard practice to leave the position of the aircraft within the hangar usually
vehicles running at all times during the winter causes this type of incident. In most situations, the
months, to prevent any problems restarting the mechanics who close the hangar doors have simply
vehicles when they are needed. Ground damage inci- assumed that the aircraft is correctly parked in the
dents occur when the vehicle's parking brake fails, hangar, and have closed the hangar doors without
allowing the vehicle to roll into a parked aircraft. checking for clearance. However, in most cases
In some situations, the mechanics are aware that when this type of incident has occurred, the aircraft
the parking brake on the vehicle is not working had been parked incorrectly in the hangar. Thus, it
properly, but are reluctant to pull the vehicle out is useful to consider why the aircraft could be
of service for repair. This reluctance is driven by parked incorrectly.
the shortage of suitable equipment, and the feeling Since aircraft hangars are often quite congested,
that the maintenance department will not be able and are "lled with other aircraft and equipment,
to "x the problem satisfactorily within a reasonable there is often only one correct place in which the
amount of time. In other situations, the mechanic is aircraft can be parked. To correctly park an aircraft
not aware of the limitations of the parking brake in a hangar it is necessary for the aircraft to be
and/or the supplemental braking systems installed towed into the hangar on the proper towline for
by the airline. The lack of awareness of potential that type of aircraft, and the tow stopped on the
hazards causes the mechanics to leave the vehicle proper block. The tow line and stop block are
unattended with complete con"dence that it will painted lines on the #oor of the hangar. Ideally
remain where it was parked. The limitations of the there is one line for each type of aircraft using that
braking system can be considered a latent failure in hangar. Problems arise when the painted lines do
the system. not match the type of aircraft, and the mechanics
The second category of incidents, those in which have to choose a di!erent set of guidelines to fol-
equipment rolls into an aircraft, occur when the low. For example, in one incident, a DC-9 was
equipment is not properly fastened into place (hitch pulled into a hangar on a 727 towline. The only two
pin engaged, or brakes set). For example, in one painted lines in this hangar were for the 727 and
incident, a cart that was being towed came loose 757 aircraft. Additionally, it is necessary to proper-
and rolled into a parked aircraft. During the sub- ly align the aircraft on the guidelines before it is too
sequent investigation, it was found that the hitch on far into the hangar, since it is di$cult to adjust its
the tug had been modi"ed. The modi"ed hitch was position once the aircraft is in the hangar. There-
not as safe as the standard hitch, since it did not fore, it is desirable to have the guidelines extend
have a positive lock feature to ensure that the hitch outside of the hangar, to allow the tug driver and
pin did not come loose. However, the standard spotters to properly align the aircraft as they enter
hitch required more time to install, and more the hangar. In places where the guidelines do not
strength (usually more than one person) to use extend outside of the hangar, it is much more di$-
as compared to the modi"ed hitch. Since usually cult to properly position the aircraft in the hangar.
 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199 185

Proper positioning also assumes that it is possible time that can be used more e!ectively on actually
to correctly position the aircraft in the hangar. If performing the task.
equipment/workstands are in the path of the air- In the second category of incidents, the hydraulic
craft, or a tug that is too large is used, it may not be system is activated (or deactivated), causing aircraft
possible for the mechanics to properly park the components to return automatically to a neutral
aircraft. position. Often, the movement of these components
In other situations, an aircraft may be parked is unintended by the mechanic, who simply acti-
temporarily in a hangar that is not suited to that vates the hydraulic system for a di!erent purpose.
type of aircraft. The hangar may not be big enough However, the lack of awareness of the implications
for the aircraft to "t completely inside. However, if of hydraulic system activation has caused many
mechanics are not aware of this, they may routinely incidents. Since the mechanics do not consider
close the hangar doors without checking for clear- what will happen all around the aircraft when the
ance. It is proper procedure for the door controls to hydraulic system is activated, they often fail to
be &red-tagged' to indicate to everyone else that the perform a complete walk-around to check for
controls should not be used. This should be done proper clearance. Thus, the aircraft components
by the mechanics that tow the aircraft into the may contact equipment that is being used by an-
hangar. These mechanics should recognize that other mechanic, performing an unrelated task.
the aircraft is too long for the hangar. However, in There are many other latent failures that can be
incidents where the doors were closed on an air- shown to contribute to this type of incident.
craft, the door controls were not red-tagged. Most importantly, there seems to be no standard
method of communicating the impending activa-
2.1.6. Position of aircraft components changes tion of the hydraulic system to all of the mechanics
(1.2.1) working on the aircraft. Some mechanics simply
In these incidents, the position of aircraft compo- yell their intentions to all within earshot, but the
nents (e.g., stabilizer, #aps, rudder, etc.) is changed, noise in the hangar environment makes it very
either manually or through the activation of a hy- di$cult to hear and understand. In addition, as
draulic system, causing the components to contact required by the company policy manual, the con-
obstacles in their path. The "rst category of inci- trols for the hydraulic system should be &red-
dents, those in which an aircraft component was tagged' (with a Do Not Operate tag) if a mechanic
manually adjusted, generally occurred because is working in the path of any of the components
a workstand was left in the path of the component. that may be a!ected by the hydraulic system. This
The mechanic failed to perform a walk-around is often not performed.
check to ensure that the area was clear before These incidents are likely to occur because mech-
adjusting the component. In addition, no ground anics are often unaware of other work that is being
spotters were utilized to ensure that the component performed on the aircraft. Poor communication
did not contact anything during its move. It is the between the crew chiefs and the mechanics at the
crew chief's responsibility to ensure that the proper beginning of the shift leaves each mechanic only
personnel are assigned to perform a given task. In with an understanding of his task assignment, not
many situations, the crew chief failed to assign the larger picture. Better communication will help
enough personnel and/or failed to ensure that the mechanics become more aware of the hazards and
ground spotters were in place. Since the policy of risks associated with their assigned tasks.
using ground spotters is rarely followed, many
mechanics fail to even ask for assistance when they 2.1.7. Center of gravity shifts (1.2.2)
have to adjust the position of an aircraft compon- In these incidents, the center of gravity of the
ent. In addition, the time pressure to ensure on-time aircraft shifts unexpectedly, causing the aircraft to
departures encourages mechanics to complete their contact the ground with either its nose (center of
tasks as quickly as possible. The time used to ar- gravity shifts forward) or its tail (center of gravity
range for ground spotters might have been seen as shifts backwards). In most of these incidents, the
186 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

mechanics left a workstand or other piece of equip- returned to the hangar, but were distracted before
ment under the aircraft while they were working. they could return to the aircraft with the chocks.
When the center of gravity shifted, the aircraft In other incidents, the mechanics request the
settled onto this equipment, causing damage to the cockpit crew to release the aircraft brakes while the
aircraft. aircraft is connected to the pushback tractor. Then,
In some situations, the passengers were allowed the towbar is detached before the brakes are reset.
on board while the mechanic was working on the These incidents can also be attributed to the poor
aircraft. The mechanics were unaware that the communication between the airline personnel
loading had begun until the aircraft's center of working on this aircraft. In some instances, the
gravity began to shift. The poor communication mechanics asked the cockpit crew to release
among all of the airline personnel connected to the brakes, without informing the pushback crew.
a single aircraft (mechanics, gate agents, ground The pushback crew then continued to prepare the
crew, #ight crew) is a latent failure behind many of aircraft for pushback, without being aware of the
these incidents. Similarly, the work of other mech- maintenance problem that the mechanics were
anics on the aircraft may cause the center of gravity working on. In other instances, one member of the
to shift as well. For example, if other maintenance pushback (wingwalker) was struggling to discon-
work requires the aircraft to be jacked up, the nect the towbar, when the tug driver requested that
center of gravity shift will a!ect all other mechanics the brakes be released to allow the towbar to be
working on this aircraft. Lack of awareness of other repositioned. The wingwalker then successfully pul-
work on the aircraft, as well as poor communica- led the hitch pin, without knowing that the brakes
tion between the di!erent mechanics contributes to had been released, and the aircraft rolled forward
these incidents. into the tug.
In other incidents, improper procedures or
equipment that is being used to complete an as- 2.1.9. Towing vehicle strikes aircraft (2.1)
signed task causes the center of gravity shift. For In these incidents, the pushback tug being used
example, one mechanic did not follow the DC-9 to tow the aircraft, or the towbar connecting the
manual for supporting and jacking the aircraft, and tug and the aircraft, comes in contact with the
chose to jack the aircraft improperly. This caused aircraft. In some of these incidents, the tug being
the aircraft to be unstable, and the aircraft's center used to tow the aircraft slips on the ramp surface,
of gravity shifted. In other situations, the mechanics causing it to jackknife and contact the aircraft. In
use improper tools that cause the landing gear to these incidents, snow and ice usually cover the
collapse during functional tests, causing damage ramp. Other latent factors contributing to this type
to the nose of the aircraft. The mechanics may not of incident include: the lack of traction augmenta-
even know that they are using the wrong tools, tion for the tugs (e.g., chains for the tires); the use of
since it is a common practice at this airline. This towbars which are too short (which allow the tug to
lack of awareness prevents the mechanics from tak- contact the aircraft); the use of light tow tractors
ing the correct precautions to avoid damaging the that are subject to sliding; and poor ramp mainten-
aircraft. ance in snow/ice conditions. In fact, the snow policy
at one station even discourages the mechanics from
2.1.8. Aircraft rolls forward/backwards (1.2.3) calling to have the ramp sanded. At this particular
In these incidents, the aircraft rolls either for- station, because of the high cost, sanding overnight
ward or backward under its own power. This unex- can only be arranged by "rst calling the manager at
pected movement causes the aircraft to contact home. Since mechanics are reluctant to call their
obstacles in its path. In many of these incidents, the manager at home in the middle of the night, they
aircraft is parked, and the wheels are not chocked often choose to forgo sanding.
(or are improperly chocked). In these cases, the Other incidents occur when the mechanic is
mechanics parked the aircraft in a remote parking working alone to connect the aircraft to the tow
area, and forgot to bring chocks with them. They tractor. Generally, it is preferable to have two
 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199 187

people connecting the towbar: one to drive the company's general practices manual, the ramp
tug, the other to connect the towbar. When only standards practice manual suggests it. The com-
one mechanic is assigned to this task, he must munication from the cockpit that the door was
repeatedly climb in and out of the tug in order to open would have prevented costly damage to the
ensure that the tug is properly aligned with the aircraft. Another factor contributing to this inci-
aircraft. Combined with equipment problems, this dent is that the mechanic in charge of the aircraft
may increase the potential for a problem to occur tow (the tug driver) was interrupted during his/her
during the towbar hookup. For example, in one walk around, and failed to complete the walk
incident, the mechanic's foot accidentally slipped around before beginning the tow. Finally, since this
from the brake to the accelerator pedal while aircraft was parked in a wide open parking area,
he was connecting the towbar. The brake pedal the tug driver decided that no wingwalkers would
surface was worn completely smooth, but the be necessary (as per usual ramp practice). This
mechanic's footing may have been slippery from prevented one last preventive measure from work-
the conditions on the ramp. This particular inci- ing as designed.
dent was compounded by additional problems with In another incident, the pushback tug driver in-
the gear selector on the tug, which allowed the gear itiated the pushback while a lavatory truck was still
selector to slip into Drive from Neutral. This type servicing the aircraft. The wingwalkers knew that
of incident emphasizes the need to keep all ground the lavatory truck was still connected to the air-
equipment in good operating condition at all times. craft, but failed to communicate this information to
The need to maintain ground equipment in good the tug driver. In addition, the wingwalker was not
condition is also illustrated by the following using his wands to indicate the obstruction to the
example. In one incident, the mechanic used a tug tug driver. The tug driver initiated the pushback
with a known problem with the door latch. The before the wingwalkers were in their proper posi-
door latch had been broken for a few days, but it tions, and before the &all-clear' signal was given by
had not been red-tagged and the tug was allowed to the wingwalker. Apparently, there was some con-
remain in service. In addition, no safety restraint fusion as to whether the wingwalker must give the
had been installed on the tug's door to prevent it all-clear signal before the pushback can begin, or
from swinging open. During a routine tow, the whether the pushback should begin when the tug
door of the tug swung open, contacting the aircraft driver sees all of the wingwalkers in their proper
and causing damage. This incident was obviously positions. The wingwalker mistakenly assumed
preventable, had the defective equipment been re- that the tug driver would wait for the all-clear
moved from service when the problem was initially signal before beginning pushback, so he did not
detected. indicate the obstruction to the tug driver. The tug
driver had been instructed to clear the gate to allow
2.1.10. Aircraft is not properly conxgured for towing another incoming aircraft to enter the gate, and was
(2.2) feeling pressure to maintain his departure schedule.
In these incidents, the towing operation was in- The latent failures of poor communication and
itiated before the aircraft was ready to be moved. confusion concerning the pushback procedure con-
The movement of the aircraft caused damage to tribute to this type of incident.
occur. These incidents are characterized by poor
communication between various members of the 2.1.11. Aircraft contacts xxed object/equipment
pushback crew. For example, in one incident, the (2.3.1)
airstairs were left down when the pushback was In these incidents, the aircraft contacts a perma-
initiated. The cockpit crew did not inform the tug nent, unmovable "xture (e.g., the doors/walls of the
driver as to the status of the door light annunciator. hangar) while being towed. Semi-permanent "x-
This would have alerted the tug driver that the tures, such as snowbanks that exist for relatively
door was open, and the aircraft was not ready to long periods of time, are included in this type of
be towed. Although this is not required by the incident. Many incidents of this type are caused by
188 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

problems with the guidelines that are used to tow location each time an aircraft is moved. Thus, it is
aircraft into maintenance hangars. The aircraft necessary for the mechanics to detect the objects
might contact a "xed object when it is towed into before beginning the aircraft tow, and make the
the hangar o!-center, i.e. when the aircraft is im- necessary e!orts during the tow to prevent contact
properly aligned on the guidelines. In some situ- with the aircraft. Many of these incidents involve
ations, the guidelines are incorrectly painted or are the aircraft contacting objects/equipment parked
quite confusing. In fact, in some hangars it is stan- within the aircraft safety zone. The aircraft safety
dard practice to park the aircraft in the hangar zone is supposed to be indicated by painted lines at
o!-center. In other situations, the guidelines do not each aircraft parking area, and indicate where it
extend outside of the hangar, making it quite di$- is safe to leave equipment. Objects left within
cult to properly align the aircraft before entering the safety zone are at risk to be contacted by the
the hangar. Congestion both inside and outside of aircraft during the tow. It is company policy for
the hangar increases the di$culty of properly align- the tug driver (who is in charge of the tow) to ensure
ing the aircraft, by making it harder to maneuver that the parking area for the aircraft is clear before
the aircraft into the correct position. beginning the tow. In many of these incidents,
Another factor that contributes to this type of the safety zone is not cleared before the aircraft is
incident is the failure of the tug driver to stop the towed into the area. Generally, the tug driver, or
tow when the wingwalkers leave the "eld of view. other guidepeople, assumes that the aircraft will
Although this violates company policy, line man- clear the objects/equipment that are left within the
agers regularly permit this behavior to occur. In safety zone. In other situations, malfunctions of the
addition, in some cases the proper number of guide- equipment parked in the safety zone prevent it from
people is not even used during the tow. Also, in being moved to a safer area. For example, in one
some situations the tug driver consciously decides incident, a loader was parked within the safety
to turn attention away from one or more of the zone. However, the right wheel of the loader was
guidepeople in order to concentrate on other re- broken o!, so it could not easily be moved from its
lated matters (e.g., locating the guideline, checking position. In a second example, a tail dock in one
clearance on one particular point on the aircraft, hangar was inoperative, and the tail dock could not
etc.). In these situations, the tug driver is not at- be lowered to the correct position. In this situation,
tending to signals that the other guidepeople may the mechanic had not been informed of the problem
be giving, and thus will not be able to avoid con- with the tail dock, although it had been red-tagged
tacting an obstacle in the path of the aircraft. the previous day. There are also situations where it
Incidents of this type are also caused when an is considered normal for equipment to be parked
aircraft is being pushed out of a hangar, and the inside the safety zone. For example, at one particu-
hangar doors are not completely open. This situ- lar gate it is normal for the catering truck to be
ation has occurred when a company aircraft is parked nearly eleven feet into the safety zone for
being repaired in a hangar belonging to another the adjacent gate. Such situations make it even
company, or when another company's aircraft is more di$cult for tug drivers to ensure that the area
being repaired in this company's hangar. The dam- is clear before the tow is initiated.
age to the aircraft is often caused by the visiting Another factor contributing to this type of inci-
mechanics' unfamiliarity with the hangar, as well dent is that the correct number of guidepeople is
as poor communication between the two sets of not always used during aircraft tows. Although this
mechanics. is a violation of company policy, the policy is rarely
enforced, and the mechanics have become accus-
2.1.12. Aircraft contacts moveable object/equipment tomed to moving aircraft with a limited number of
(2.3.2) personnel. The reduced number of personnel makes
In these incidents, the aircraft contacts moveable it more di$cult for the tug driver to ensure clear-
objects/equipment while being towed. The ob- ance around the aircraft. In fact, some mechanics
jects/equipment are not necessarily in the same report that there are many more instances of minor
 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199 189

aircraft damage that goes unreported. In addition, between the members of the tug crew is di$cult, it
the congestion that surrounds the ramp and hangar is likely that the tug driver will not be able to
areas increases the di$culty of safely towing the respond in time to any obstacle that may lie in the
aircraft. path of the aircraft.
There are also problems of communication that
contribute to this type of incident. One of the com-
mon problems is miscommunication between the 3. Results
tug driver and the guidepeople. In some situations,
the tug driver failed to recognize the hand signals The number of incidents in each of the GDI
given by the wingwalkers. In other situations, the hazard patterns is summarized in Table 1. To deter-
tug driver initiated the tow before the guidepeople mine the validity of these classi"cation schemes, the
were ready. Another latent communication prob- hazard patterns were re-coded by two independent
lem is that tug drivers do not routinely give verbal researchers using the de"nitions developed. Neither
responses to commands from the guidepeople. This researcher was familiar with airline ground opera-
becomes a problem when a guideperson gives tions. Percent agreement on how to categorize the
a command to the tug driver, and assumes that the incidents was 70%. The inconsistencies were found
tug driver sees and understands the command. This to result from misinterpretations of the various
problem also manifests in situations when verbal terms used in the hazard patterns. The hazard pat-
communication between the towing crew is di$- terns have been reworded to be more explicit, and it
cult. Since the tug driver must simultaneously at- is expected that percent agreement will be much
tend to many areas of the aircraft, it is very di$cult higher for categorization of future incidents.
to ensure that the tug driver will see the hand
signals given by any one guideperson. However, the 3.1. Latent failures in ground damage incidents
guidepeople are usually not in radio contact with
the tug driver, so verbal communication is also From the highly detailed GDI reports it has been
di$cult, due to the excessive noise inherent to possible to identify consistent hazard patterns, and
the airport environment. When communication within these to derive the latent failures in addition

Table 1
GDI hazard patterns

Hazard pattern Number of incidents % of Total

1. Aircraft is Parked at the Hangar/Gate/Tarmac 81 62

1.1. Equipment Strikes Aircraft 51 39
1.1.1. Tools/Materials Contact Aircraft 4 3
1.1.2. Workstand Contacts Aircraft 23 18
1.1.3. Ground Equipment is Driven into Aircraft 13 10
1.1.4. Unmanned Equipment Rolls into Aircraft 6 4
1.1.5. Hangar Doors Closed Onto Aircraft 5 4
1.2. Aircraft (or Aircraft Part) Moves to Contact Object 30 23
1.2.1. Position of Aircraft Components Changes 15 12
1.2.2. Center of Gravity Shifts 9 7
1.2.3. Aircraft Rolls Forward/Backward 6 4
2. Aircraft is Being Towed/Taxied 49 38
2.1. Towing Vehicle Strikes Aircraft 5 4
2.2. Aircraft is Not Properly Con"gured for Towing 2 2
2.3. Aircraft Contacts Fixed Object/Equipment 42 32
2.3.1. Aircraft Contacts Fixed Object/Equipment 13 10
2.3.2. Aircraft Contacts Moveable Object/Equipment 29 22
Total 130 130 130 100%
190 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

to the more usual active failures. Latent failures and latent failures, a more focused strategy may be
were tabulated for each GDI using an iterative more e!ective. If the contribution of each latent
procedure to produce a workable taxonomy speci- failure to each hazard pattern can be found, then
"c to ground damage. Other taxonomies exist for typical scenarios and sequences can be developed
error in general (Reason, 1990; Senders and Moray, to address particular losses. This means under-
1991) and some are implied by current error classi- standing the sequence(s) of each hazard pattern,
"cation schemes in aircraft maintenance (Marx, and "nding common latent failures that contribute
1992). The taxonomy developed here used elements to that sequence. As a "rst step, event trees were
of all of these. After consistent latent failures were constructed for each hazard pattern. One example
identi"ed, a logical structure was imposed using is shown in Fig. 1.
ICAO's SHELL Model (ICAO, 1989). For the We can, however, go further than this and test
tasks leading to ground damage, no software statistically for any associations between latent fail-
failures (e.g. documentation design) were found. ures and hazard patterns. Tables 4}7 show a com-
Hence, the remaining categories have been used plete cross-classi"cation of the hazard patterns
as follows to classify the latent failures: hardware, from Table 1 with the latent failures from Table 3.
environment, liveware (individual) and liveware} Note that Tables 4}7 provide intermediate totals,
liveware (interpersonal). Each of the latent failures e.g., for Hazard Pattern 2 and for Hazard Pattern
has been described in detail in the hazard pattern 2.3, as well as individual counts at the lowest level
scenarios. However, a short description of each (Hazard Patterns 2.3.1 and 2.3.2). Table 4 addresses
latent failure is provided in Table 2. the hardware latent failures, Table 5 addresses the
Latent failures are considered to be problems environment latent failures, Table 6 addresses the
that exist in the system independently (distinct in liveware latent failures, and Table 7 shows the total
time and space) of active failures that cause an number of latent failures for each hazard pattern. It
incident. However, it is important to note that is important to remember that each latent failure
problems such as complacency, bad attitudes of does not contribute to each incident within a haz-
mechanics, etc. were not considered to be latent ard pattern, but is simply a latent failure that has
failures. The concentration here was on latent fail- resulted in an incident of this type in the past.
ures that could be addressed through changes to Chi-square tests of independence of frequencies
the maintenance system, rather than characteristics are appropriate for such analyses. The data from
of individual maintenance personnel. Tables 4}7 can be examined by chi-square tests at
Table 3 summarizes the incidence of latent fail- any level of aggregation of either hazard pattern or
ures in the 130 GDIs analyzed. From Table 3, it can latent failures. However, many of the cells in Tables
be seen that the most frequently occurring latent 4}7 contain very low numbers of latent failures,
failures are problems with the equipment, use of an which give low expected frequencies, invalidating
improper number of personnel, and a lack of the assumptions of the Chi-square test even with
awareness of risks and hazards. This last latent a relatively high total of 265 latent failures.
failure is a broad category, including such failures For this reason, the analysis was performed at
as inadequate training and the assumption that two levels of aggregated hazard patterns and two
adequate clearance exists without checking. How- levels of aggregation of latent failures. The higher
ever, it is not possible to fully eliminate any of these aggregation of hazard pattern was at two levels,
latent failures using only the traditional technique HP1 and HP2, while for latent failures it was at the
of reprimand, motivate and train. four levels H, E, LI and LL. This analysis gave the
results in Table 8, with a highly signi"cant associ-
3.2. Relationship between hazard patterns and latent ation between hazard pattern and latent failure
failures (s "15.2, p(0.001). In Table 8, cells which are

over-represented, i.e. cells with a large contribution
While it is possible to intervene across all ground to Chi-square and greater than the expected fre-
operations in an attempt to eliminate both active quency, are indicated using .
 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199 191

Table 2
Latent failure descriptions
SHELL category Latent failure Latent failure description

Hardware Poor Equipment Equipment was not suitable for the task being performed,
and this contributed to an incident
Poor Equipment: Inappropriate for Task Equipment used to perform a task was not the correct type of
equipment for that task, and the use of improper equipment
contributed to the incident
Poor Equipment: Mechanical Problem Equipment used to perform a task had a mechanical prob-
lem that caused it to behave erratically, contributing to the
incident
Environment Inadequate Space Space in which a task was performed was not su$cient, and
the lack of space contributed to the incident
Inadequate Space: Congested Area Space in which a task was performed was crowded with
other equipment/aircraft/etc., causing special attention to
maneuvering within this space to be required. The crowded
nature of the space contributed to the incident.
Inadequate Space: Ill suited for Task Task was performed in a space that was known to be inap-
propriate for the work to be performed, and this lack of
space contributed to the incident.
Problems with Painted Guidelines Guidelines used to position aircraft contribute to the inci-
dent
Guidelines: Do Not Exist Guidelines are not painted at a particular location, requiring
maintenance personnel to use their &best guess' in positioning
aircraft.
Guidelines: Do Not Extend Out of Hangar Guidelines for positioning aircraft in a hangar begin at the
Ghangar door, requiring maintenance personnel to use their
&best guess' to position aircraft to begin the tow into the
hangar.
Guidelines: Not Suitable for Aircraft Guidelines for a di!erent type of aircraft than the one being
moved are painted on the ground, and the lack of suitable
guidelines contributes to the incident.
Liveware (Individual) Lack of Awareness of Risks/Hazards Maintenance personnel are unaware of the possible risks
associated with their actions, and the lack of awareness
contributes to the incident.
Liveware}Liveware Poor Communication Problems with the transfer of information between mainten-
ance personnel, and this lack of information contributed to
an incident
Poor Communication: Between Crew Problems with the transfer of information between mainten-
ance personnel working together on one shift
Poor Communication: Between Shift Problems with the transfer of information between mainten-
ance personnel on di!erent shifts
Personnel Unaware of Concurrent Work Maintenance personnel working on one area of the aircraft
are unaware of work being performed by other personnel
(who may be from other departments or other agencies) on
other areas of the aircraft. This lack of awareness contributes
to the incident
Pressures to Maintain On-Time Departures Maintenance personnel are subjected to subtle and not so
subtle pressures to remain on schedule at &any cost'. These
pressures a!ect the decisions made by the maintenance per-
sonnel, and these decisions contribute to the incident
Pushback Policies Not Enforced Pushback policies, as written in the operating procedures of
the airline, are not enforced on a regular basis, leading to
company norms on how a pushback should be conducted.
These norms are followed by all personnel, without being
questioned (and perhaps even encouraged) by management,
until an incident occurs, when the personnel involved are
reprimanded for not following the operating procedure. The
willingness of management to accept a company norm for
day-to-day operation contributes to the incident
192 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

Table 3
Incidence of latent failures

SHELL model category Latent failure Number of incidents % of total

Hardware 72 27
H1 Poor Equipment 72 27
H1.1. Poor Equipment: Inappropriate for Task 39 15
H1.2. Poor Equipment: Mechanical Problem 33 12
Environment 51 19
E1 Inadequate Space 30 11
E1.1. Inadequate Space: Congested Area 22 8
E1.2. Inadequate Space: Ill-suited for Task 8 3
E2 Problems with Painted Guidelines 21 8
E2.1. Guidelines: Do Not Exist 7 3
E2.2. Guidelines: Do Not Extend Out of Hangar 4 1
E2.3. Guidelines: Not Suitable for Aircraft 10 4
Liveware (Individual) 34 13
L1 Lack of Awareness of Risks/Hazards 34 13
Liveware}Liveware 108 41
LL1 Poor Communication 29 11
LL1.1. Poor Communication: Between Crew 24 9
LL1.2. Poor Communication: Between Shifts 5 2
LL2 Personnel Unaware of Concurrent Work 8 3
LL3 Correct Number of People Not Used 36 14
LL4 Pressures to Maintain On-Time Departures 19 7
LL5 Pushback Policies Not Enforced 16 6
Total 265 100%

Note: Totals exceed the number of incidents due to multiple latent failures per incident.

Fig. 1. Example of hazard pattern event tree.

 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199 193

Table 4
Summary of hardware latent failures by hazard patterns

Hazard patterns Hardware latent failures

PE: Inappropriate for task PE: Mechanical problem Poor equipment (PE)

Aircraft Parked 33 20 53
Equipment Strikes Aircraft 30 17 47
Tools/Materials Contact Aircraft 1 2 3
Workstand Contacts Aircraft 25 4 29
Ground Equipment Driven into Aircraft 4 3 7
Unmanned Equipment Rolls into Aircraft 0 8 8
Hangar Doors Closed onto Aircraft 0 0 0
Aircraft (or Aircraft Part) Moves to Contact 3 3 6
Object
Position of Aircraft Component Changes 1 0 1
Center of Gravity Shifts 2 1 3
Aircraft Rolls Forward/Backward 0 2 2
Aircraft is Being Towed/Taxied 6 13 19
Towing Vehicle Strikes Aircraft 3 5 8
Aircraft Not Properly Con"gured for Towing 0 0 0
Aircraft Contacts Object/Equipment 3 8 11
Aircraft Contacts Fixed Object or Equip- 1 3 4
ment
Aircraft Contacts Moveable Object or Equip- 2 5 7
ment
Total 39 33 72

It appears from Table 8 that two latent failures At the highest level of aggregation of hazard
(LI and LL) are equally associated with both haz- patterns there are two hazard patterns (1 and 2)
ard patterns, while the other two (H and E) are and nine latent failures. Overall, the Chi-square
associated with speci"c hazard patterns. Thus, test showed a signi"cant association between
hardware failures are over-represented for parked hazard patterns and latent failures (s(8)"
aircraft and environmental failures are over-repre- 28.4, p(0.001). The following latent failures were
sented for towed aircraft. over-represented in the two hazard patterns, as
Going to the next level of aggregation, there are shown in Table 9.
too few entries in cells representing Hazard Pat- For the next level of aggregation, hazard pat-
terns 2.1 and 2.2 for Chi-square assumptions, so terns were counted at the secondary level (1.1, 1.2,
that only Hazard Patterns 1.1, 1.2 and 2.3 were and 2.3), again with Hazard Patterns 2.1 and 2.2
analyzed. New patterns begin to emerge at this eliminated. A Chi-square analysis of Hazard Pat-
level. No latent failure is generally applicable across terns 1.1, 1.2 and 2.3 for the Latent Failures again
all hazard patterns. Hardware is still associated gave signi"cant results (s(16)"90.6, p(0.001).
with parked aircraft, now speci"cally 1.1 Equip- The same pattern of individual cell s contributions
ment Strikes Aircraft. Environment is still asso- was seen for Hazard Pattern 2.3 as had been found
ciated with aircraft under tow, now speci"cally with for Hazard Pattern 2 above. However, when Haz-
2.3 Aircraft Contacts Fixed Object/Equipment. ard Pattern 1 was split into 1.1 and 1.2, this split the
However, both liveware latent failures are now latent failures found above, and added a new one,
associated with parked aircraft, speci"cally 1.2 Air- as shown in Table 9.
craft Part Moves to Contact Object. We can summarize the "ndings of all of these
Moving to the lower level of aggregation of analyzes by classifying each latent failure as to its
latent failures, we again have two analyses, each association with speci"c hazard patterns, as shown
now involving the nine lower level latent failures. in Table 10.
 194

Table 5
Summary of environment latent failures by hazard pattern

Hazard Patterns Environment latent failures

IS: congested IS: Ill-suited Inadequate space PG: do not PG: do not PG: not Problems with
area for task (IS) exist extend out suitable for painted
of hangar aircraft guideliness (PG)

Aircraft Parked 8 4 12 2 1 5 8
Equipment Strikes Aircraft 8 3 11 1 1 5 7
Tools/Materials Contact Aircraft 0 1 1 0 0 0 0
Workstand Contacts Aircraft 0 0 0 0 0 1 1
Ground Equipment Driven into 7 0 7 0 0 1 1
Aircraft
Unmanned Equipment Rolls into 0 0 0 0 0 0 0
Aircraft
Hangar Doors Closed onto 1 2 3 1 1 3 5
Aircraft
Aircraft (or A/C Part) Moves to 0 1 1 1 0 0 1
Contact Obj.
Position of Aircraft Component 0 0 0 0 0 0 0
Changes
Center of Gravity Shifts 0 0 0 1 0 0 1
Aircraft Rolls Forward/Backward 0 1 1 0 0 0 0
Aircraft is Being Towed/Taxied 14 4 18 5 3 5 13
Towing Vehicle Strikes Aircraft 0 0 0 0 0 0 0
Aircraft Not Properly Con"gured 0 0 0 0 0 0 0
for Towing
Aircraft Contacts Object/Equipment 14 4 18 5 3 5 13
Aircraft Contacts Fixed 4 4 8 1 1 3 5
Object/Equip.
Aircraft Contacts Moveable 10 0 10 4 2 2 8
Obj./Equip.
C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

Total 22 8 30 7 4 10 21
Table 6
Summary of liveware (individual and liveware-liveware) latent failures by hazard pattern

Hazard Patterns Liveware latent failures

Lack of PC: Between PC: Between Poor Comm. Personnel Correct Pressures to Pushback
Awareness Crews Shifts (PC) Unaware of Number Maintain Policies Not
of Risks and Concurrent People Not On-Time Enforced
Hazards Work Used Departures

Aircraft Parked 22 13 4 17 8 22 11 4
Equipment Strikes Aircraft 10 2 3 5 1 17 6 2
Tools/Materials Contact Aircraft 2 1 2 3 0 0 0 0
Workstand Contacts Aircraft 2 1 0 1 1 6 4 1
Ground Equipment Driven into Aircraft 0 0 0 0 0 9 2 1
Unmanned Equipment Rolls into A/C 4 0 0 0 0 2 0 0
Hangar Doors Closed onto Aircraft 2 0 1 1 0 0 0 0
Aircraft (or A/C Part) Moves to Contact Obj. 12 11 1 12 7 5 5 2
Position of A/C Component Changes 5 7 1 8 2 5 3 0
Center of Gravity Shifts 5 2 0 2 5 0 1 1
Aircraft Rolls Forward/Backward 2 2 0 2 0 0 1 1
Aircraft is Being Towed/Taxied 12 11 1 12 0 14 8 12
Towing Vehicle Strikes Aircraft 3 0 0 0 0 2 0 0
Aircraft Not Properly Con"gured for Towing 0 2 0 2 0 0 1 1
Aircraft Contacts Object/Equipment 9 9 1 10 0 12 7 11
Aircraft Contacts Fixed Object/Equip. 3 1 1 2 0 2 1 4
Aircraft Contacts Moveable Obj./Equip. 6 8 0 8 0 10 6 7
Total 34 24 5 29 8 36 19 16
C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199
195
196 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

These analyses show that di!erent latent failures rather the &causes' unique to that hazard pattern.
are over-represented in di!erent hazard patterns, For example, Latent Failure LL3: Not Enough
i.e., their occurrence is non-random. These over- Personnel contributed to all hazard patterns in
represented latent failures are not the only anteced- proportion to their relative frequencies, and thus
ents of the incidents within a hazard pattern, but was an underlying &cause' of many incidents across
all hazard patterns. However, when equipment
struck an aircraft (Hazard Patterns 1.1.1}1.1.5),
Table 7 a unique &cause' was de"ciencies in the equipment.
Summary of total latent failures by hazard pattern
Thus appropriate interventions for this class of
Hazard Patterns Total Latent Failures incidents would be to ensure that correct equip-
ment was always available, that it was properly
Aircraft Parked 157 maintained, and that personnel knew not to substi-
Equipment Strikes Aircraft 106 tute inappropriate equipment.
Tools/Materials Contact Aircraft 9
Workstand Contacts Aircraft 45 Conversely, appropriate interventions for Haz-
Ground Equipment Driven into 27 ard Pattern 1.2, where an aircraft or aircraft part
Aircraft moves to contact an object, should concentrate on
Unmanned Equipment Rolls into 14 coordination between individuals as the uniquely
Aircraft associated latent failures were Latent Failure LL1:
Hangar Doors Closed onto 11
Aircraft Poor Communication and Latent Failure LL2:
Aircraft (or Aircraft Part) Moves to 51 Unaware of Concurrent Work. Thus, splitting Haz-
Contact Object ard Pattern 1.1 from Hazard Pattern 1.2 in the
Position of Aircraft Component 24 Chi-square analysis can focus management atten-
Changes tion onto quite di!erent strategies of intervention.
Center of Gravity Shifts 18
Aircraft Rolls Forward/Back- 9 For Hazard Pattern 2, where the aircraft is being
ward towed, the associated latent failures directly ad-
Aircraft is Being Towed/Taxied 108 dress aircraft movements. Towing often takes place
Towing Vehicle Strikes Aircraft 13 in a small, crowded, or di$cult. The area may
Aircraft Not Properly Con"gured 4 also have inadequate, misleading, or missing
for Towing
Aircraft Contacts Object/Equip- 91 painted guidelines. Appropriate unique interven-
ment tions would be to address the physical issues of
Aircraft Contacts Fixed Object 29 aircraft movement, and how the operators control
or Equipment the direction and speed of these movements.
Aircraft Contacts Moveable Ob- 62 Finally, lack of enforcement of pushback policies is
ject or Equipment
Total 265 a latent failure that contributes to aircraft move-
ment incidents. Managerial issues of why the

Table 8
Chi-square analysis of the hazard patterns/latent failure relationship

HP 1: Aircraft HP 1.1: HP 1.2: Aircraft (or HP 2: Aircraft Being HP 2.3: Aircraft

Parked Equipment Component) Moves Towed/Taxied Contacts Equipment
Strikes Aircraft to Contact Object

Hardware 53 47 6 19 11
Environment 20 18 2 31 31
Liveware 22 10 12 12 9
(Individual)
Liveware}Liveware 62 4 31 46 40

Indicates a frequency larger than expected

 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199 197

Table 9
Latent failures over-represented in speci"c hazard patterns

Hazard patterns

HP 1 Aircraft Parked HP 1.1 Equipment HP 1.2 Aircraft (or Component) HP 2 Aircraft is Being Towed
Strikes Aircraft Moves

Latent Failures H: Poor Equipment H1: Poor Equipment LL1: Poor Communication E1: Inadequate Space
LL2: Unaware of LL2: Unaware of Concurrent E2: Painted Guideline
Concurrent Work Work Problems
LL5: Pushback Policies not
Enforced

Table 10
Summary of associations between HPs and LFs from chi-squared analyses

Latent Failures Associated Hazard Patterns

Hardware
H1. Poor Equipment 1.1. Equipment strikes parked aircraft
H1.1. Poor Equipment: Inappropriate for Task
H1.2. Poor Equipment: Mechanical Problem
Environment
E1. Inadequate Space 2.3. Aircraft under tow
E1.1. Inadequate Space: Congested Area
E1.2. Inadequate Space: Ill-suited for Task
E2. Problems with Painted Guidelines 2.3. Aircraft under tow
E2.1. Guidelines: Do Not Exist
E2.2. Guidelines: Do Not Extend Out of Hangar
E2.3. Guidelines: Not Suitable for Aircraft
Liveware (Individual)
LI. Lack of Awareness of Risks/Hazards 1.2. Aircraft or part moves to contact object
Liveware-Liveware
LL1. Poor Communication 1.2. Aircraft or part moves to contact object
LL1.1. Poor Communication: Between Crew
LL1.2. Poor Communication: Between Shifts
LL2. Personnel Unaware of Concurrent Work 1.2. Aircraft or part moves to contact object
LL3. Correct Number of People Not Used (General)
LL4. Pressures to Maintain On-Time Departures (General)
LL5. Pushback Policies Not Enforced 2.3. Aircraft under tow

operators violate the policy should be addressed. Is clearly, if the active failures are eliminated the inci-
the policy good but inadequately enforced? Does dent will be prevented. However, working beneath
the policy con#ict with others, such as #exibility of the surface to expose latent failures can:
workforce assignment or departure processes? For
this hazard pattern, unique interventions need to (a) identify many di!erent problems that have
cover both the physical and managerial aspects of common interventions (e.g., better mainten-
the task. ance of equipment can eliminate many typical
It is not suggested that managers discount the hazard patterns, and thus prevent future inci-
active failures that occur in the system, since dents),
198 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199

(b) allow proposed interventions to go beyond the 1. 1.1. } E2: Problems with Painted Guidelines is
traditional personnel actions of reprimand/ associated with Hazard Pattern 2: Air-
motivate/train, which heretofore have proven craft is Being Towed/Taxied (8%)
to be ine!ective. 1. 1.1. } LL5: Pushback Policies Not Enforced is
associated with Hazard Pattern 2: Air-
3.3. Summary of the GDI analysis craft is Being Towed/Taxied (6%)

1. There are only 2 major hazard patterns, each

with some sub-structure. 4. Addressing ground damage
1. 1.1. There are 3 relatively large hazard patterns,
which account for 94% of all GDIs. The analysis of ground damage incidents in this
1. 1.1. } Hazard Pattern 1.1: Aircraft Parked and study showed that there are relatively few causes
Equipment Strikes the Aircraft (39%) which contribute to most ground damage incidents,
1. 1.1. } Hazard Pattern 1.2: Aircraft Parked and which suggests that by introducing a small number
an Aircraft Part Moves to Contact an of interventions, a large number of ground damage
Object (23%) incidents can be prevented. Results also indicate
1. 1.1. } Hazard Pattern 2.3: Aircraft Under Tow that simply using the `blame-and-traina approach
and Contacts a Fixed or Moveable Ob- to preventing ground damage is ine!ective, since
ject (32%) ground damage incidents are often caused, at least
2. There are only 9 major latent failures, some with partly, by latent failures in the system. These latent
sub-structure. failures cannot be eliminated without making chan-
1. 2.1. Some of the latent failures are general, while ges in the system further upstream than the mech-
others are more associated with speci"c anics, or even the "rst line supervisors. Changes
hazard patterns. must be initiated by upper levels of management,
1. 2.2. General latent failures across all hazard pat- and must become integrated into the existing main-
terns account for 21% of all latent failures. tenance system.
1. 1.1. } LL3: Correct Number of Personnel Not Recently, airlines and other groups have begun
Used (14%), developing programs to speci"cally address ground
1. 1.1. } LL4: Pressures for On-Time Departure damage. The Aerospace Psychology Research
(7%). Group at Trinity College Dublin developed the
1. 2.3. Latent failures associated with speci"c haz- Safety Courses for Airport Ramp Functions
ard patterns account for 66% of all latent (SCARF) program in conjunction with other uni-
failures. versity and airline partners. SCARF was developed
1. 1.1. } H1: Poor Equipment is associated with to address the ramp safety concerns at airlines, and
Hazard Pattern 1.1: Equipment Strikes is described as `an integrated set of four training
Aircraft (27%) programs for the promotion of best demonstrated
1. 1.1. } LL1: Poor Communication is associated practice in the safe and cost e!ective operation of
with Hazard Pattern 1.2: Aircraft (or Air- airport ground handling services (Fuller et al.,
craft Part) Moves to Contact Object is 1994).a These training programs are aimed at ramp
associated with Latent Failures (11%) personnel, "rst line supervisors, managers, and
1. 1.1. } LL2: Personnel Unaware of Concurrent trainers, recognizing that all members of an organ-
Work is associated with Hazard Pattern ization must recognize how their job contributes
1.2: Aircraft (or Aircraft Part) Moves to to ramp safety. The SCARF program has been
Contact Object is associated with Latent implemented at airport sites in Europe, and its
Failures (3%) e!ectiveness is currently being evaluated.
1. 1.1. } E1: Inadequate Space is associated with Various airlines have implemented maintenance
Hazard Pattern 2: Aircraft is Being resource management (MRM) and situational aware-
Towed/Taxied (11%) ness (SA) training programs in their maintenance
 C.A. Wenner, C.G. Drury / International Journal of Industrial Ergonomics 26 (2000) 177}199 199

departments to help foster the safety culture. Delta Drury, C.G., 1994. The speed-accuracy trade-o! in industry.
Airlines has been developing a ground crew human Ergonomics 37 (4), 747}763.
factors training program, to reinforce the import- Drury, C.G., Brill, M., l978. New methods of consumer product
accident investigation. Human Factors and Industrial De-
ance of human factors in ramp operations (Trans- sign in Consumer Products l96}229.
port Canada, 1997), and a research group from Fox, J.G., 1992. The ergonomics audit as an everyday factor in
Purdue University is currently working with an- safe and e$cient working. Progress in Coal, Steel and Re-
other major air carrier on the problem of ground lated Social Research 10}14.
damage. In addition, Transport Canada has re- Fuller, R., McDonald, N., White, G., Walsh, W., 1994. Strategies
to improve human performance safety in ground handling
leased the Ground Crew Dirty Dozen poster series, operations. Presented at the Airports Council International
to parallel their Maintenance Dirty Dozen series, Apron Safety Seminar, Caracas, Venezuela.
to make ground crew personnel aware of potential ICAO, 1989. Human Factors Digest No. 1 Fundamental Hu-
latent failures and local triggers in their environ- man Factors Concepts, Circular 216-AN/131, International
ment. Civil Aviation Organization, Canada.
Marx, D., 1992. Looking toward 2000: the evolution of human
Although all of these programs clearly address factors in maintenance. Meeting Proceedings Sixth Federal
the possibility of failures relating to personnel re- Aviation Administration Meeting on Human Factors
lated factors (e.g., using an inadequate number of Issues in Aircraft Maintenance and Inspection `Mainten-
spotters, or using the wrong piece of equipment), ance 2000a, 22}23 January 1992, Alexandria, Virginia,
they may only tangentially address other latent pp. 64}76.
Maurino, D., Reason, J., Johnston, N., Lee, R., 1995. Beyond
failures in the system. Other interventions may still Aviation Human Factors. Avebury Aviation, Hants,
be necessary to eliminate, or reduce, these latent U.K.
failures. For example, technological changes (e.g., McDonald, N., Fuller, R., 1996a. Safety in airport ground opera-
redesigning the tug hitch, or adding mirrors to tions. A proposal to the Scarf International Group to estab-
facilitate ensuring proper clearance) may be neces- lish a company, Trinity College, Dublin.
McDonald, N., Fuller, R., 1996b. Human Factors and Airside
sary to simplify tasks and reduce the possibility of Safety Management. Trinity College, Dublin.
errors. Further, procedural changes (e.g., improving Monteau, M., 1977. A practical method of investigating accident
the equipment maintenance policies) may be neces- factors. Commission of the European Communities, Luxen-
sary to align the procedures with how the mainten- bourg.
ance personnel actually work. Reason, J., 1990. Human Error. Cambridge University Press,
Cambridge, UK.
Senders, J.W., Moray, N.P., 1991. Human Error: Cause, Predic-
tion and Reduction. Lawrence Erlbaum Associates, Inc.,
References Hillsdale, NJ.
Transport Canada, 1997. The Third Conference on Mainten-
Chandler, J.G., 1995. Putting a dent in ground damage. Aviation ance/Ground Crew Errors and Their Prevention: Confer-
Equipment Maintenance 14 (6), 22}25. ence Notes. Toronto, Canada.