EUROPEAN ORGANISATION FOR THE SAFETY OF AIR NAVIGATION EUROCONTROL EUROCONTROL EXPERIMENTAL CENTRE REVIEW OF ROOT CAUSES OF ACCIDENTS DUE TO DESIGN EEC Note No. 14/04 Project Safbuild Issued: October 2004 The information contained in this document is the property of the EUROCONTROL Agency and no part should be reproduced in any form without the Agency’s permission. The views expressed herein do not necessarily reflect the official views or policy of the Agency. REPORT DOCUMENTATION PAGE Reference: Security Classification: EEC Note No. 14/04 Unclassified Originator: Originator (Corporate Author) Name/Location: EEC – SAS EUROCONTROL Experimental Centre (Safety Analysis and Scientific) Centre de Bois des Bordes B.P.15 F - 91222 Brétigny-sur-Orge CEDEX FRANCE Telephone : +33 (0)1 69 88 75 00 Sponsor: Sponsor (Contract Authority) Name/Location: EATM EUROCONTROL Agency Rue de la Fusée, 96 B -1130 BRUXELLES Telephone : +32 2 729 9011 TITLE: REVIEW OF ROOT CAUSES OF ACCIDENTS DUE TO DESIGN Authors Date Pages Figures Tables Appendix References Alfred Roelen, (NLR) Steve Kinnersly, (AEA) 10/04 viii+41 1 1 3 43 Fabrice Drogoul EEC Contact Project Task No. Sponsor Period 120000-SRD-3-E1- Fabrice Drogoul Safbuild 2003 0000 Distribution Statement: (a) Controlled by: Head of SRT (b) Special Limitations: None Descriptors (keywords): Design, root causes of accidents, ATM, nuclear, rail, aviation Abstract: This document gives the results of a study of the proportion of accidents that have their root causes in design. In particular, it investigates the validity of the claim that 60% of the root causes of accidents arise in the design stages. FOREWORD This document gives the results of a review study from different industry databases of the proportion of accidents that have their root causes in design. The review has been carried out as part of the Eurocontrol SafBuild project. SafBuild aims to establish, within the context of EEC strong designs that are resistant to failure the first place, or else tolerant to it. SAFBUILD aims to support designers in their safety role, to develop a process and supporting tools for integrating safety into the design throughout the design life cycle, leading to a safer and more resilient ATM system. A necessary part of SafBuild is to determine the extent to which accidents are caused by design in order to provide a foundation for building safety into design. The study reviewed accident and incident data and reports from the aviation, railway and nuclear industries. Where the data or reports indicated that design was a root cause, this was taken as adequate evidence. In cases where the data or reports did not give root causes, or where the root causes were investigated or categorised in a way that precluded the possibility of identifying design as a root cause, a judgement was made according to the available evidence. Overall, the results show 50% of all accidents or incidents having a root cause in design. The proportions for the aviation and nuclear industries (51% and 46% respectively) are remarkably similar. In most cases, causes other than design also contributed to the accident or incident. Typical types of design-related oversight that are root causes of accidents are : • Use outside of the design envelope, • Changes of operational context, • Failure of defence in depth, • Misconceptions between designers and operators, • Unexpected failure mechanisms. • Incorrect functioning leading to mistrust of safety system by operator Barry Kirwan Head of SRT v Page intentionally left blank vi CONTENTS FOREWORD ...............................................................................................................v 1. Introduction .........................................................................................................1 2. Purpose of the Study ..........................................................................................1 3. DESIGN stage ......................................................................................................1 4. OTHER Definitions ..............................................................................................2 5. Scope and Content of the Review......................................................................3 5.1 Overall research approach.................................................................................................... 3 5.2 Existing reviews ..................................................................................................................... 3 5.3 Aviation ................................................................................................................................... 5 5.4 Nuclear .................................................................................................................................... 6 5.5 Railways .................................................................................................................................. 6 6. Findings of the Review .......................................................................................7 6.1 Aviation ................................................................................................................................... 7 6.2 Nuclear .................................................................................................................................... 7 6.3 Railways .................................................................................................................................. 8 6.4 Discussion .............................................................................................................................. 8 7. Conclusions.......................................................................................................11 8. Abbreviations and acronyms ...........................................................................12 9. References.........................................................................................................13 Appendix A: List of aviation accidents..................................................................17 Appendix B: List of Nuclear incidents ...................................................................31 Appendix C : Railway Accidents and Incidents ....................................................39 vii Page intentionally left blank viii 1. INTRODUCTION The Eurocontrol Experimental Centre (EEC) works to improve safety in Air Traffic Management (ATM) by better integration of safety in EEC projects, by provision of better safety methods for internal and external use, and by the development and implementation of safety learning processes in the ATM industry. An important element of these safety learning processes is an awareness of the potential impact of EEC projects on aviation safety. The aviation industry has been concentrating a lot of effort on the technical improvement of systems, but despite this, technical failures and failures that are contributed by the design still occur. While the Eurocontrol Experimental Centre is involved in many ATM system design projects, typically a lot of these projects do not lead directly to operational systems. Many are research projects that lead to prototypes for future development. Because of the specific role of EEC in the ATM system design process, it may not be clear how these research activities have an impact on aviation safety. It is essential that EEC be aware of these potential impacts to be able to build safety into the design process. Design is complex, so is safety - what looks easy on paper may not be so in practice. One of the tasks of SAFBUILD is to determine what role design plays in accidents, and the results of this task are described in the underlying report. 2. PURPOSE OF THE STUDY The purpose of this study is to determine how the root causes of accidents can arise from the design stages of a project and to determine the implications for EEC projects that include design. There is a lack of clarity on the precise meaning or scope of the term ‘design’. After a clarification on this topic the study reviews the root causes of accidents from databases and expert experience from a range of relevant industries. 3. DESIGN STAGE ‘Design’ is the process by which detailed specifications sufficient for unambiguous production of an entity (e.g. software item; hardware; visual display; subsystem; system) are developed to satisfy the concepts, requirements, assumptions and constraints for that entity. It could be difficult to know who the designers really are. The design work is a diffuse distributed process. A lot of people involved in the design might not consider themselves as designer even if they are part of the activity. To clarify the position it has been decided to refer to design activity rather than designers. Another point that needs to be clarified is the coverage given to the term design. For engineers design is often considered as one stage after requirement capture. In our safety point of view we consider design to range from concept development and requirement capture to the point of fabrication/construction. 1 For the sake of the study Design does not include the generation of top-level concepts, requirements, assumptions and constraints for an entity. However, the design process may: • Generate lower level concepts, requirements, assumptions and constraints; • Cause top-level concepts, requirements, assumptions and constraints to be questioned and modified. Design does not include the production of the entity (e.g. software