Hugh Carson Summary of the

Swiss Cheese Model of Accident Causation

Posted on theysaid 7/26/03 in response to ML

ML wrote:

"What's more, I am very tired of reading fatality reports that place tactical blame for the folks on the ground. The responsibility on most fatality fires lies not with the on the ground folks who may have made mistakes, but with the agency administrators and fire managers who to this day are still not following a policy that all the heads of our agencies signed in 1995 then reviewed and updated in 2001. All fatality fires have undoubtedly had elements of mistakes from the folks on the ground, but we must look at the root cause...why were they there in the first place?"

I was landscaping my yard this afternoon and ML's comment kept bugging me. Mainly because every time we have a fatality (and I've lost over 40 friends and acquaintances in this business since 1985), that same question of "Are we just going to see another largely useless recitation of the 10 and 18" comes up each and every time.

I couldn't agree with ML more. And the cause of this situation - at least in part - are the accident investigations themselves. There was a reason the National Transportation Safety Board (NTSB) became a party to all DOI/USFS aircraft accidents (other than their expertise, us investigating ourselves is indeed "the fox watching the henhouse.")

It would seem the same (an outside and hopefully objective, disinterested party) should also hold true for ground accidents.

The key here is that these investigations should (must) be conducted by professional accident investigators - a team well-versed not only in the technical aspects of wildland fire (which is usually true) but also - and in most cases even more importantly - highly knowledgeable of the human factors aspect (which is usually not true).

That is not to say that the Salmon Investigation Team lacks these skills: George Jackson of MDTC stands out as highly experienced (unfortunately) in accident investigation. But where are the Human Factors experts who can answer the questions that go beyond the violation of the 10 and 18?

There is a solution. Go to The Human Factors Analysis and Classification System–HFACS (pdf file) and read The Human Factors Analysis and Classification System- HFACS article. Yes, it's lengthy, yes, it takes 2-3 readings to truly understand - but it is the key to more effective accident investigations, and even more importantly, reading it and thinking about yourself and your decision-making may save your life one day.

The HFACS is based upon James Reason's work using the "Swiss cheese" Model of Accident Causation. Those of you who have taken "Fireline Leadership" (FL) during the 2002-2003 training season will (hopefully) remember this model.

I have the honor and pleasure of being part of the Fireline Leadership contracted cadre that teaches this course. DISCLAIMER: the views in this post are mine and mine alone and do not reflect those of Mission-Centered Solutions, the FL course contractor. It is an honor and a pleasure because I believe this single course is largely responsible for many of the positive changes in attitude, awareness, and culture that have occurred in the last 5 years. But of course I'm prejudiced, so take that with a grain of salt.

Bear with me while we go through a synopsis of "Accident Causation 101." The Swiss Cheese model postulates 4 layers of "Swiss Cheese" by which one can trace back to the root causes of an accident:

1. Unsafe Acts;
2. Preconditions for Unsafe Acts;
3. Unsafe Supervision; and
4. Organizational Influences.

Think of these 4 slices on a cutting board, randomly placed on top of each other. It is rare that the holes in all four slices would line up in a random placement so that, staring down, you could see through 4 holes in the Swiss Cheese to the cutting board. But when the holes do line up, an accident is only a matter of time (and luck). You may "get away" with it 999 times out of a 1,000, or even 9999 out of 10,000, but that accident is waiting to happen.

Slice #1: Unsafe Acts: These relate to those involved at the scene of the accident (including the victims), and these acts may consist of both

• errors and
• violations.

Errors involve Perceptual, Decision, and Skill-Based Errors. One of the major mistakes of any organization is to NOT recognize that error is in fact an unavoidable part of the human condition and that there is NO way to avoid humans making errors. Especially in a high-risk, high-tempo operation such as wildland firefighting.

Companies tried to not only reduce error but in fact get rid of it in the 80's with the philosophy of a "zero-defect culture." The results of the zero-defect culture were disastrous: all folks did when they committed an error was hide it (fearing punishment and/or loss of job), leaving the error uncorrected. These errors "simmered away" along with many other unreported and uncorrected errors - until the situation resulted in an accident.

The key preventive measure is to "trap the error" (i.e., identify it through an open process of incident reporting with no adverse consequences to the reporter of the error, and use it as a learning tool). The firefighting agencies engaged in the "zero-defect mentality" big-time after South Canyon. And I'm not so sure that they as organizations still do not take that approach.

Willful violations of policy and procedures, however, are another sort of duck. Violations should never be tolerated. However, in the case of wildfire, wildfire policy itself is either so confusing, or it is not being conveyed adequately to the ground firefighter, or it is not being enforced by supervisors or management (I believe this is your point, ML). If policy is not explained properly or the explanation is confusing because the policy is confusing, then we've placed the firefighter in a classic Catch-22 situation.

Slice #2 Preconditions for Unsafe Acts: This slice involves

• Substandard Conditions and/or
• Substandard Practices.

Slice #2 Preconditions for Unsafe Acts: Substandard Conditions: These are defined as Adverse Physiological States, Physical/Mental Limitations, and Adverse Mental States.

Slice #2 Preconditions for Unsafe Acts: Substandard Practices are Personal Readiness and Crew Resource Mismanagement.

Only time will tell if any of these are brought out in the Cramer Fire/Salmon Helitack fatality investigation.

It is interesting to note that, in the 30-Mile fire investigation, the Swiss cheese Model was used to some extent (see charts and discussion in that report on rest cycles, fatigue, etc). This was primarily due to the involvement in the 30-Mile investigation of Tony Kern (Asst Director, Aviation, USFS) who is committed to HFACs/Swiss Cheese as a means of identifying root causes that are not immediately obvious. However, lest you assume I felt the 30-Mile Investigation Report was a good example of a complete application of Swiss cheese, don't. The 30-Mile Report ignored a very obvious - at least to me and others - Organizational Influence (slice #4) root cause of 30-Mile. More on this below.

The 3rd slice of cheese involves Unsafe Supervision, and it has 4 "sub-slices:"

• Inadequate Supervision;
• Planned Inappropriate Operations,
• Failure To Correct A Known Problem, and
• Supervisory Violations.

There's a real laundry list under each of these but you might see some that ring a bell:

Slice # 3 Unsafe Supervision: Inadequate Supervision: Supervisory failure to provide guidance, operational doctrine, oversight, and/or training or to track qualifications and/or performance.

Slice # 3 Unsafe Supervision: Planned Inappropriate Operations: Supervisory failure to provide correct data, adequate briefing time; improper [staffing]; mission not in accordance with rules/regulations; provided inadequate opportunity for crew rest

Slice # 3 Unsafe Supervision: Failure To Correct A Known Problem: Supervisory failure to correct document in error; failure to identify at-risk [firefighter] or report unsafe tendencies; failure to initiate corrective action

Slice # 3 Unsafe Supervision: Supervisory Violations: Supervisor authorized unnecessary hazard; Supervisor failed to enforce rules/regulations; Supervisor authorized unqualified crew

But again, on Slice #3, let's wait until the accident report is issued and we hopefully have all the facts before we pass judgment on this slice.

And now to the 4th slice: Organizational Influences. Examining this slice intensively (and honestly) can be the key to getting away from the litany of "the victims violated 8 of the 10 Fireline Orders and 14 of the 18 Watchout Situations were present and ignored." NOTE: Before the NTSB adopted HFACS, it was always "Pilot Error." Now if you look at their investigations, you will see HFACS and Swiss Cheese at work.

We know from the past that there is a fair probability that a number of violations will usually be the case in a wildfire fatality investigation, and we should accept those conclusions as a valid application of Slice #1 (Errors and Violations). But now let's get down to brass tacks and find out what's really wrong. I too am absolutely sick of hearing that litany, because it only goes so far, and does not present solutions to anything of consequence. It also avoids advocating any pressing need to effect real change in the organization. In case you haven't figured it out by now (it took me "only" 27 years of my career to figure it out!!), change is anathema to a bureaucracy. So it takes some real visionaries to adopt HFACS and apply it honestly and with integrity, regardless of the results or conclusions.

Unfortunately, when one looks at Slice #4, one skates on some pretty thin ice: agency turf, sacred cow programs, resistance to change, lack of understanding and knowledge by upper management .... you name it, you are there when you go looking around at Slice #4.

Organizational Influences consist of

• Resource/ Acquisition Management,
• Organizational Climate, and
• Organizational Process.

It is important to understand that an "Organizational Influence" can be an influence at the local unit, Regional, National, or interagency Level.

Again, there's a laundry list under each of these sub-slices:

Slice #4: Organizational Influences: Resource/Acquisition Management:

• Human Resources (selection of personnel, staffing/ manning, training);
• Monetary/ Budget (excessive cost-cutting, lack of funding);
• Equipment/ Facilities (poor design, purchase of unsuitable equipment)

Slice #4: Organizational Influences: Organizational Climate:

• Structure (chain-of-command, delegation of authority, communication, formal accountability for actions);
• Policies (hiring/firing; promotion, drugs/alcohol);
• Culture (norms and rules, values and beliefs, organizational justice)

Slice #4: Organizational Influences: Organizational Process:

• Operations (operational tempo, time pressure, production quotas, incentives, measurement/ appraisal, schedules, deficient planning);
• Procedures (standards, clearly-defined objectives, documentation, instructions);
• Oversight: Risk Management and Safety Programs

Whew!! We're done with Accident Causation 101. But I do encourage you to download the full HFACs article and read it. Once again: The Human Factors Analysis and Classification System–HFACS

Adopting HFACS is the ONLY way that I can see that we are going to hold both the accident investigation teams and the agencies accountable for (1) determining both the obvious causes but more importantly, the deeper and much more serious root causes of accidents; and (2) taking meaningful corrective action. Until they/we do this, these accidents will continue to occur. And no amount of Manuals, Handbooks, and Guides (of which I wrote "just a few" during my career), as well as Mitigation Measures, are going to change that. It's that simple.

One caution: the Swiss Cheese model is not meant to deflect the basic, ultimate responsibility that we all have as firefighters: to maintain high situation awareness (SA) and to make good decisions based upon that awareness and through sound application of risk management principles.

And those that don't do this sometimes suffer the ultimate consequence, and unfortunately should and will bear that responsibility.

And let's be honest - at times all of us don't always achieve that goal of good decisions based upon high SA - I know I don't as an Air Ops Director, but I try my damndest all the time - but later, when I recognize that I didn't have high SA and made a "less-than-optimal (read "lousy") decision, it was just plain luck that the dragon didn't jump out and bite me.

There are deeper root causes to these accidents. In some ways, the 30-Mile investigation was a start at the application of HFACS and Swiss Cheese. As an example, the emphasis on looking at preconditions of the crews and firefighters.

But in my mind, it missed the big organizational influence, that of the quality of the NWCG training (the "S" courses). The most cogent and emotionally hard-hitting comment by one of the parents of a firefighter who perished at 30-Mile was "to give kids new to firefighting a 40-hour lecture and then put them on the fireline on a fire like 30-Mile is ........" This father's comment is paraphrased and I am unsure whether he said it was "wrong," or "criminal," or whatever, but in my mind he hit the nail on the head.

I spent the last 3 years of my career (1997-2000) at NIFC Training, and I'd guess 80-90% of the "S" courses are pure classroom lecture, though maybe a few courses have a few exercises thrown in, but the value of these is in some cases questionable. There are some notable exceptions to the S coursework, but they are rare. This is not to say those who work in NWCG are not intelligent, hard-working individuals. They are. It is a direct result of the training philosophy and the training approach: more numbers-oriented ("courses developed/revised and on the shelf") than quality oriented.

Enough said on that - I could write a book on that subject (and did help write a 10-page White Paper on a solution - a submission that was completely ignored by the NWCG Training Working Team). Maybe someone might want to resurrect that - on the other hand, it advocates a real sea change in training, so maybe not.

So what's the problem with the "S" courses? I would suggest that the NWCG Training Working Team just ask any firefighter who has been through the S100-300 level courses. As I was teaching around the country last year, I did ask that question on occasion and the answers were blunt and frequently obscene. I don't ask the question any more. NWCG, they are your customer, and they are not happy with the majority of what they are being provided: content, quality of instruction, lack of simulation, the list is endless.

Specifically, it is a very basic training principle that in order to truly learn - and by this I mean incorporating learning into your subconscious where it can be called up instantaneously when the chips are down, you've got to do it as well as hear it.

It's basic: you should train like you fight. The corollary is of course that you will fight like you've been trained. And if you're training is ineffective and you have not incorporated it into your subconscious, your response in real life will be equally ineffective .... and possibly fatal to you and others.

Bottom line: until the "S" courses are revised to incorporate true simulation to support classroom learning, we will continue to have accidents and fatalities.

To end this lengthy missive - and to get back to the Cramer Fire investigation.

I have several questions to which I feel we all need and should respectfully
request (demand?) answers:

1. Is anyone on the Cramer Fire Accident Investigation knowledgeable of HFACS and the Swiss Cheese Model of Accident Causation?
2. If so, will the accident investigation team utilize HFACS and the Swiss Cheese Model of Accident Causation as their primary investigatory tool?
3. If not, why not?

Thanks all for wading through this. Any comments would be appreciated. -please e-mail a copy of your comment to airops@rmci.net.

Hopefully this type of discussion will lead to some real change rather than just another bunch of bandages applied to what I see as a dysfunctional and severely wounded patient - the wildland fire community.

Stay safe. The dragon is real angry this season.

Regards,
Hugh Carson