Theoretical Model for Accident Prevention Based on Root Cause Analysis With Graph Theory.

INTRODUCTION: Despite huge investments in new technology and transportation infrastructure, terrible accidents still remain a reality of traffic.
METHODS: Severe traffic accidents were analyzed from four prevailing modes of today's transportations: sea, air, railway, and road. Main root causes of all four accidents were defined with implementation of the approach, based on Flanagan's critical incident technique. In accordance with Molan's Availability Humanization model (AH model), possible preventive or humanization interventions were defined with the focus on technology, environment, organization, and human factors.
RESULTS: According to our analyses, there are significant similarities between accidents. Root causes of accidents, human behavioral patterns, and possible humanization measures were presented with rooted graphs. It is possible to create a generalized model graph, which is similar to rooted graphs, for identification of possible humanization measures, intended to prevent similar accidents in the future. Majority of proposed humanization interventions are focused on organization. Organizational interventions are effective in assurance of adequate and safe behavior.
CONCLUSIONS: Formalization of root cause analysis with rooted graphs in a model offers possibility for implementation of presented methods in analysis of particular events. Implementation of proposed humanization measures in a particular analyzed situation is the basis for creation of safety culture.

Introduction

Globalization and connections between different parts of the world have increased the importance of traffic. A part of today's live is the use of different types of transport. Today, almost everybody uses different modes of transport. Almost every day we can see and hear reports about traffic accidents: reports of plane crashes, ship fires, buses falling off roads, train crashes, or burning balloons. All those reports are followed by the same questions – would it be possible to prevent the accident, what was the role of the driver, the train conductor, or the pilot, was he/she able to prevent the accident, was there enough support in the environment to prevent the accident?

Answers to all these questions have the same common theme – the identification of the root cause of the accident to identify the last trigger causing the accident. Identified root causes may be in the environment, technology, organization, or in human actions. Although there are obvious differences between environmental conditions (air, sea, road, and railway), there are also some similarities: increased traffic density, greater time pressure, and more competition in the traffic market [1]. Transport is a complex system with high risks that requires new approaches and safety awareness [23].

Safety culture

It is the time to introduce the concept of safety culture to all aspects of traffic; according to Reason [2], safety culture is “The concept whose time has come”. All modes of traffic share the same similarity: agents of transportation – drivers, conductors, pilots, sailors, and so on. There are high expectations about safety focused on the behavior of drivers. According to Cooper [3], safety culture is expressed through the behavior of workers (drivers) performing work activities. Safety culture acts as a guide to how workers will behave at work. External manifestation of behavior also depends on the psychological factors of each individual worker [3]. Beliefs, values, and attitudes of workers toward safety also have a significant influence on safety culture [4].

is a part of organizational culture [5]. It cannot be less important than – both cultures are similar to twin siblings. Safety culture defines the goal – safe functioning of a system. Organizational culture provides the tools to reach this goal. Safety culture creates the framework for the entire system. It determines environmental borders, functioning of the technology, and the organizational model and relations. The most important part of safety culture is (workers, management, stakeholders, and public) [6]. Safety culture determines human behavior to achieve stable and safe system operation. The are the stable parts of the system. The of the system is less stable – it is more susceptible to outside influences. The main issue of creating a safety culture is to retain the human part of the system within predefined limits (parameters).

Human behavior

Human behavior is the external (visible) manifestation of the actual availability of the worker. Worker's behavior depends on his/her psychophysical dimensions. Some of these dimensions such as basic cognitive abilities are stable and have formed before the employee joined the workplace; some of them are, however, less stable and should be influenced by external factors and motivation. On the level of additional external and internal impacts, cognitive style is determined and it defines human behavior [21]. The intellectual development is finished at the end of adolescence [9]. For a majority of the workplaces in the traffic sector, the entrance age is around twenty years, which means that the intellectual abilities have already been fully developed. Perception, reactions, and coordination abilities reach their peak in the ages between 20 and 30. At the workplace, there is only limited opportunity to improve those abilities. There is only the time to tailor those general abilities to the particular working environment – to develop the particular skills.

The decision-making process should be adopted in the workplace. Experiences and skills should be incorporated in the process of decision-making. This process never ends, and it is the key element of safe behavior and is the foundation of safety culture [10].

Discrete mathematics and graph theory

Graph theory [11] from discrete mathematics defines a directed graph (or digraph) as an ordered pair of graph vertices and graph arrows . Other notations for vertices are “nodes” and “points”, while other notations for arrows are “directed edges” and “arcs”. Graph arrow is a directed connection from an initial vertex to the terminal vertex . Graph in this article is a structure from graph theory and not a plot of mathematical function as the word “graph” is used more colloquially.

Psychological data in the theoretical model presented in this article are analyzed and presented with multipartite digraphs from mathematical graph theory. Data presentation and the basis of the theoretical model presented in this artilce is the AH model. In the multipartite digraph, defined in the AH model, there are formally defined mathematical presentations of the environment, technology, organization, and human behavior, as well as connections between them. Owing to simplicity, this article names multipartite digraphs as simply graphs [7].

Root cause analysis

Root cause analysis (RCA) is a method that has been developed for identification of main causes of accidents and to prevent the occurrence of the same accident again. The goal of RCA implementation is identification of the most influential cause of the accident to identify the accident barrier which should be implemented. The single-factor approach is often implemented, and according to Holden [22], the main cause of aviation accidents in the analyzed period was flight crews. For complex systems, this approach is not sufficient as it stresses too much attention on human behavior. According to Dekker et al [20], other influential factors such as organization have to be considered. Effective RCA needs all important data of the accident. One of the possible approaches for data collection is Flanagan's critical incident technique composed of 5 W (What, When, Where, Who, Why) [17]. Collected data are analyzed with a multivariate approach where multiple items are simultaneously analyzed with a use of graph theory. Graphs in this article connects 5 disjunct sets: (1) critical human behavior patterns, (2) mechanisms of human behavior, (3) root causes of inadequate behavioral patterns, (4) psychological basis of behavioral patterns, and (5) preventive accident preventions.

AH model

Human behavior is determined by an individual's abilities, personality, health, attitudes, and motivation. The role of motivation is crucial [28,29]. The AH model [7] presented on Fig. 1 defines basic items of a production system as graph vertices and influences between them as graph arrows.

Fig. 1

AH model presented as graph (vertices ~ components, arrows ~ relations).

Presentation of the AH model as a graph models relationships between organization (O), technology (T), environment (E), man (M), and impacts to work (W); they are defined as work components. The work influences perception of human actual availability (A) where the availability determines health (H) and performance (P). Cost of performance and health decrease are compared with the cost of humanization interventions (I). Humanization interventions are focused to the organization, environment, technology, and human to reduce perception of work load. Expansion of the AH model means that safety of the system depends on human actual availability. The external manifestation of safe behavior and adequate actual availability is safety culture [8].

Hypotheses

It is possible to identify the root causes of accidents.

There are similar causes of accidents for different types of traffic.

Methods

The main research goal of this study is the identification of main root causes of the events that caused catastrophes and the identification of possible similarities between different accidents.

To achieve the research goal, a novel variant of RCA [12] was performed. Using publicly available sources and descriptions of selected accidents, all available data describing events and human behavior of participants were collected. Four major traffic accidents were selected from the four most often used models of transportation: see, rail, air, and road.

Costa Concordia disaster on 13 January 2012, with 33 dead [13].

Santiago de Compostela derailment on 24 July 2013, with 140 injured and 79 dead [14].

Germanwings Flight 9525 on 24 March 2015, with 144 dead [15].

Puisseguin road crash on 23 October 2015, with 43 dead [16].

Generalization of the RCA

To extend the capabilities of RCA, we propose a methodological extension of the model based on graph theory that we call graph partitioning root cause analysis (GP-RCA). To formalize the GP-RCA model, following definitions are proposed. Sets , , , , and are used in the GP-RCA model and are defined as follows:

is the set of critical human behavior patterns.

is the set of the mechanisms of human behavior.

is the set of the root causes of inadequate behavior.

is the set of the psychological basis of behavior.

is the set of humanization measures (accident preventions).

The GP-RCA model is based on the assumption (assumption 1) that the power of the set (set size) of critical human behavior patterns is equal to the power of the set of mechanisms of human behavior and it is equal to the power of the set of root causes of inadequate behavioral patterns: .

The deployment of the formal theoretical model that is based on RCA is proposed in three steps:

Discover the psychological basis of behavioral patterns (see Figs. 2, 3, 4).

Fig. 2

GP-RCA model graph. GP-RCA = graph partitioning root cause analysis.

Fig. 3

Step 3: The GP-RCA graph is partitioned into 3 partitions (orange, green, blue). Deleted connections are dotted red. GP-RCA = graph partitioning root cause analysis.

Fig. 4

Graphs for Step 1 and Step 2 for the GP-RCA for Costa Concordia disaster. GP-RCA = graph partitioning root cause analysis.

Define possible humanization measures in response to critical human behavior patterns based on discovered psychological basis of behavioral patterns (see Figs. 2, 5, 7).

Fig. 5

Graph for Step 2 for theoretical modeling of the rail accident at Santiago de Compostela.

Fig. 7

Graph for Step 2 for the Puisseguin road crash.

Determine minimal partitions on the GP-RCA graph by removing connections between sets and  and and according to psychological analysis. Resulting minimal partitions identify the root causes that are based on the same underlying psychological basis Pi and can be addressed by similar set of humanization measures (see Fig. 3).

Each critical behavior determines its mechanism of human behavior and it determines the root cause of inadequate behavioral pattern . Each root cause of inadequate behavioral pattern then determines a root cause in the individual's psychological basis of behavioral pattern .

Phases of the GP-RCA

Data were collected and analyzed in three phases.

Phase 1: Data collection

Data were collected from the publicly available sources on the web. The description was composed based on the John Flanagan critical incident technique [17].

The obligatory data included in this description were as follows:

Description of the event and situation by eyewitnesses and from expert’ reports.

Identification of the time: When?

Identification of the main actors in the event: Who?

Identification of the location: Where?

Identification of the share of fatally injured people among all passengers: How many persons died?

Phase 2: GP-RCA

All collected data were analyzed by implementing the RCA for each event [18]. The following key items were identified:

Critical event points

Possible probable causes

Possible reduction measures to prevent similar accidents

Main root causes presented in the graph were classified into one of the main root cause groups based on the AH model (environment, technology, organization, human behavior) [7].

Phase 3: Availability humanization interventions

Possible interventions from the group of human factors were identified as humanization interventions. These were main human behavior interventions, applicable to the prevention of crucial accidents in different areas of traffic.

Results

Four accidents and the coverage of four different transportation modes were analyzed with a method divided into three stages: (1) Data collection, (2) GP-RCA, (3) Availability of humanization interventions. Relevant subsections provide detailed descriptions and results for each of the analyzed traffic accidents.

Costa Concordia disaster

Facts

Gradual sinking of the ship

Complete loss of power

Proximity to the shore in calm seas

Maritime law requires all passengers to be evacuated within 30 minutes of the order to evacuate the ship

The order to evacuate the ship was issued more than one hour after the initial impact

The evacuation of Costa Concordia took more than six hours

Not all passengers were evacuated.

Critical points of the event

Turning off the alarm system for the ship navigation system

Ship striking the rock

Decision to evacuate the ship

Speed of evacuation

Captain of the ship

Francesco Schettino, in 2010, as a captain of Costa Atlantic entered the port of Warnemünde in Germany at too high speed and caused damage of AIDAblu ship. He received unfavorable personality descriptions in available reports (daredevil, prone to insubordination).

Critical human behavior patterns

Deciding on the route passing too close to Isola del Giglio (uncharted rocks?)

Deciding to turn off the alarm system for the ship navigation system.

One-hour delay for the decision to evacuate the ship (one hour less for evacuation).

Poorly organized evacuation taking too much time (evacuation took more than six hours).

Early departure of the ship (not all passengers had been evacuated).

Mechanisms of human behavior

Errors in information processing (accepting unverified information).

Errors in the decision-making process (overconfidence).

Errors in the decision-making process (not incorporating all circumstances and facts).

Errors in the decision-making process (decision to not follow the adequate procedure for evacuation).

Failures in the behavior pattern execution.

Root causes of inadequate behavioral patterns

Overestimated experience and competences.

Over-self-confidence.

Poor communication with subordinates.

Focus of the captain only on himself.

Psychological basis of behavioral patterns

Personality traits influenced by.

Possible accident preventions

The most effective accident preventions are prepared. Accident preventions are focused on creating adequate safety culture. Relationships to psychological basis and consequently to root causes of inadequate behavioral patterns are presented in brackets. The first accident prevention is related to the psychological root causes , and . Formal specifications of these relations are represented in the following items:

Creation of adequate safety culture with communication founded on mutual trust.

Creation of a shared perception of the importance of safety issues.

Fostering confidence in the team and efficiency of all preventive measures.

Driving responsibility of all workers to maintain safety.

Organization of immediate management reactions to the reports concerning aberrant coworker behavior (regardless of the hierarchical position of the problematic individual)

Personality trait, discovered as the only psychological basis for the behavioral pattern, is the connection between preventive measures (possible preventive or humanization, ) and root causes of inadequate behavioral patterns .

Detected connections from critical human behavioral patterns to mechanism of human behaviors to root causes of inadequate behavioral patterns and finally to personality traits are discovered as the psychological basis of behavioral patterns. This is the Step 1 in the GP-RCA.

Desired behavioral pattern should be achieved with humanization interventions. Step 2 is the definition of possible accident preventions to respond to critical human behavior. There are connections from personality traits to accident preventions with a positive impact on root causes of inadequate behavior patterns and then to mechanisms of human behaviors and finally to critical human behavioral patterns as it is presented on the Fig. 2.

Santiago de Compostela derailment

Train derailment

Three cars were torn apart

Other cars and generators caught fire due to gaseous leaking diesel fuel

The train was traveling at over twice the posted speed limit when entering the curve.

The driver received three alarms of going over the speed limit before entering the curve

Entering the curve at over twice the posted speed limit

Leaking diesel fuel and fire catching the cars and generator

Train driver

The driver was Francisco José Garzón Amo, and he had passed the dangerous curve 60 times before the accident. Before the accident on March 2012, he posted an image of the speedometer at 200 km/h with the comment: “If I'll drive faster, I'll get a penalty, it will be funny, a great penalty for RENEE”.

Before entering the curve, the train speed at 195 km/h (too high for effective breaking).

Four seconds before the derailment, the train speed was 179 km/h (too late to do anything).

At the moment of the derailment, the speed was 153 km/h.

Before the accident, the train driver was speaking on the phone.

The train driver was watching the map to consult it about the oncoming route.

Failures in subjective goals and motivation of the train driver.

Failures in accepting information about train speed.

Failure in the acceptance of error (error was not accepted).

Errors in the decision-making process (influence of personality).

Errors in the decision-making process (an inadequate procedure was selected).

The need for self-estimation.

Inability to distribute attention.

Not accepted information.

Overestimated experience and competences.

Underestimation of the situation.

Personality traits

Creation of a shared perception of the importance of safety issues

Encouraging timely reporting of inadequate behavior by colleagues and coworkers

Creation of open communication founded on mutual trust

Organization of processes for monitoring workers' behavior and having discussions with workers about them .

Encouraging responsibility for safety among all workers

The graph for Step 1 for theoretical modeling of the rail accident at Santiago de Compostela is as it is on Fig. 2 with one vertex , the vertex that represents personality traits. The graph in Fig. 5 is the graph for Step 2 and is formed on the same principle as the graph for Step 2 for the ship accident of Costa Concordia was. Arrows from vertices to vertices represent the knowledge from this GP-RCA. These arrows represent the root causes of inadequate behavioral patterns. The same as in previous graph for Step 2, arrows from to represent the mechanisms of human behavior for root causes of inadequate behavior and the arrows from to represent critical human behavior patterns of mechanisms of human behavior.

Germanwings Flight 9525

Crashing of the Airbus A320-211 in the French Alps

Fast descent of the aircraft

At the time of the incident and immediately before descending, only the copilot was in the cockpit

The door of the cockpit was locked from the inside, and the lock's code panel was disabled

The copilot did not answer to questions from air traffic control

The aircraft was in extended service in 2012, and the aircraft service life was extended to 120,000 hours

At the time of the incident, the aircraft accumulated 58,000 hours

Medical doctors were prevented from informing Germanwings that copilot Lubitz should not fly due to “medical secrecy requirement”.

The pilot was not able to enter the cockpit after returning from a probable toilet break

Copilot

The copilot was Andreas Lubitz. He took time off from his training for several months. In 2009, he informed Training Pilot School of a “previous episode” of severe depression. After completing the training, he spent an eleven-month waiting period working as a flight attendant. He joined Germanwings in September 2013. He had commercial pilot's license with 630 flight hours of experience. In 2015, he was declared unfit to work by a medical doctor. The letter describing unfitness to work was in a waste bin in Lubitz’s apartment.

Critical human behavior patterns of the copilot

Extremely fond of flying and took flying lessons in sports clubs.

Treated for suicidal tendencies before his training as a commercial pilot.

Temporarily denied the US pilot license due to his treatment for depression.

For the past five years serious sleeping problems.

Vision problems and consulted more than forty medical doctors.

Fear of going blind.

Taking prescription drugs and suffered from a psychosomatic illness.

Searching on the web for “ways to commit suicide” and “cockpit doors and their security provisions”.

Afraid of losing his pilot license.

Subjective goals and motivation of the copilot.

Not fit to work (to fly).

Hiding of information.

, , Not fit to work (health problems).

, , Intrinsic factors determined by the copilot personality.

Root causes of not adequate behavioral patterns

Failure of self-esteem.

, Failure of health self-esteem.

, Failure of environment esteem.

Failure of competence esteem.

, Failure of personality esteem.

Failure of personality.

Personality traits

Health problems

The relationships to psychological basis are presented in brackets.

Creation of adequate safety culture

Creation of a shared perception of the importance of safety issues

Creation of a shared perception of coworker behavior

Fostering communication founded on mutual trust

Driving confidence in the efficacy of preventive measures

Responsibility to maintain safety culture and safety measures at the defined and desired level

The Fig. 6 shows the graph for the GP-RCA for airline accident of the Germanwings Flight 9525. The knowledge about this RCA is presented with 39 arrows (9 + 9+2 + 9+9 + 1) from vertices that represent accident preventions to vertices that represent root causes of inadequate behavioral patterns.

Fig. 6

GP-RCA graph for airline accident of the Germanwings accident partitioned into 2 partitions (orange, blue). Deleted connections are dotted red. GP-RCA = graph partitioning root cause analysis.

Puisseguin road crash

Dangerous bend

Narrow road with poor visibility and the bend was almost a blind spot

No signs to warn of the danger

Passengers of the coach were senior citizens

A three-year-old boy was in the cabin accompanying the truck driver

Most of the victims have been killed by the fire

Morning time with no expected heavy traffic on the local road

Older passengers in the coach

A child in the truck cabin

A blind spot on the narrow road with trees on both sides of the road

The coaches caught on fire

Drivers

The coach driver (survived) tried to avoid the accident. The truck driver (died) hit the coach directly.

Decision of the truck driver to take a child on the journey.

Organization of the trip for senior citizens.

Abandoning the warning signs before the bend.

Both vehicles not reducing speed.

Error in the behavior of the truck driver.

Error in the decision-making of trip organizers.

Error in the decision-making of the road maintenance service.

External circumstances of the road not included.

Overestimated experience of drivers.

Underestimated complexity of the trip organization for senior citizens.

Underestimated road danger.

Stereotypical repetition of previous behavioral patterns for both drivers.

Personality traits

Possible preventive or accident preventions

Relationships to psychological basis are presented in brackets.

Creation of adequate safety culture (trip organizers, road maintenance)

Creation of a shared perception of the importance of safety issues (local government, local population)

Driving everyone's responsibility to maintain safety in each moment (both drivers) .

Fostering confidence in preventive measures (warning of local population)

The graph in Fig. 7 represents Step 2 for the Puisseguin road crash. This graph is similar to the graph presented in Fig. 5.

Discussion

Significance of presented research results is summarized as a theoretical model for accident prevention based on RCA with graph theory. According to the obtained results, there are obvious similarities between all analyzed accidents. For all four accidents, it is possible to identify partitions in graphs that corresponds to the following:

Critical human behavioral patterns

Mechanisms of human behavior

Root causes of inadequate behavioral patterns

Psychological basis of behavioral patterns

Possible humanization or preventive measures to prevent occurrence of the same or similar event.

According to the GP-RCA model, there is only 1 set of critical root causes for Costa Concordia, Santiago de Compostela, and Puisseguin road crash catastrophes. There are 2 minimal partitions for Germanwings accident as there are 2 sets of related sets of root causes (Fig. 6).

From the psychological point of view, it is possible to identify personality traits as the unique basis of all four accidents. Inadequate estimation of the situation and circumstances and the confidence of the main actor in their own competences led to the accident. The accident was not only the consequence of human behavior. All other preventive measures, such as appropriate adequate living procedures, defined decision logs, integrity of information flow, affective problem identifications, corrective actions, redundant separate and diverse communication, management role, and the role of a regulator, do not have a significant impact [24].

To assure adequate behavior of a conductor, driver, pilot, or captain, it is mandatory to invest in preventive measures':

In the environment – technology of the car, train, ship, or plane has to be in accordance with maximum safety standards.

In the organization – safety issues and safety culture have to be crucial elements of all procedures, trainings, and every day routine operations. The ongoing organization measures assuring adequate working process without improvisation are the most affective barrier, and they are approved in the nuclear industry [25].

In the human capital (human factors) – selecting and following up with personnel regarding observations, reporting and evaluation of psychological traits and behavioral patterns have to become the foundation of all activities and crucial element allowing workers to enter the train, plane, ship, or a car [26].

The developed theoretical model offers the opportunities to define specific procedures in shaping safety environment with an adequate level of safety culture in working environments with high risk of accidents. The theoretical model is a generalized skeleton. The tissue and muscles on the skeleton are particular vertices of the theoretical model. Each vertex presents a particular root cause of inadequate behavior. On the basis of this cause as external manifestation, there are particular behavioral patterns as the consequences of personality traits and competence's manifestation in the real situation.

According to the presented analyses, the most important personality trait is realistic self-estimation of the main actor. Self-estimation is a combination of adaptation and accommodation abilities with individual appraisal needs. According to the presented results, it is important to select workers with adequate abilities and personality traits. Selection, however, is just the first step which opens the door for getting the right people for the job.

To maintain adequate behavior, all additional preventive measures have to be implemented. To achieve the desired goal – safe operation and transportation – we propose the implementation of a procedure founded on the basis of the presented theoretical model with check points for permanent evaluation of drivers' behavior and reporting of all observed deviation.

Presented formalization of RCA with graphs offers a clear transparent system with accessible gripping points for interventions. Intervention points are the vertices {H1 ⋯ H6} of the theoretical model graph. The content of the intervention should be developed and determined on the basis of GP-RCA. Selected interventions are tailored for each particular behavioral pattern, its psychological basis, and mechanism of human behavior.

For all 4 events, it is possible to identify the same elements in each step of the GP-RCA model. Integration of the root cause procedure with a graph in the theoretical model is the final output of this research. The proposed approach is focused only on the human part of the system, compared with other more generalized approaches [30,31]. Proposed humanization interventions are mostly organizational changes as the best preventive barriers assuring adequate human behavior.

Conclusions

The presented GP-RCA model allows identification of root causes with graph partitions with removing the connections based on psychological analysis. Resulting minimal partitions identify related root causes that are a manifestation of the same underlying psychological basis and that can be addressed by similar humanization measures.

The presented approach offers an opportunity to identify gripping points for intervention in the analyzed situations and to compare different situations in terms of the identified elements [17]. It is the tool for effective analysis and offers basis for implementation of preventive measures. The same theoretical model should be used in each situation where safety is crucial.

According to the presented analysis, human behavior is an important basis of safe operation. Maintaining adequate levels of safe and stable operation needs awareness of the importance of the human role, permanent observation of all activities, and maybe even fewer financial investments in new and improved automation technology [19]. Safer technology with safe behavior is the winning combination for safe transportation in the air, on the sea, on the rails, and on the road. It is more effective than investments in only one of the influential areas (technology, environment, organization, or human).

Safe environment, safe technology, and safe behavior integrated with organization as an effective glue compose a safety umbrella for each complex system. External manifestation is safety culture. According to experiences from the nuclear industry, safety culture is the holy grail for each complex system and its performance [27].

Conflicts of interest

No conflicts of interests.