Dettmer (1997) describes the Categories of Legitimate Reservation as the logical glue that holds the trees together. They comprise eight logical rules that govern the construction and review of the trees. They are discussed in detail in Dettmer (1997):
• Clarity
• Entity existence • Causality existence
• Cause sufficiency • Additional Cause • Cause-effect reversal • Predicted effect existence • Tautology
Not only are these rules used in the construction and review of trees, but also they have been found to be a good way to express disagreement with others during the construction and review processes, so promoting understanding instead of the
animosity which might otherwise be encountered.
The 'Thinking Process'
The individual tools outlined above can be used separately; there is no
requirement to use all of them. For example, if all that is necessary is to discover what is happening in a system, it might suffice to construct just the CRT. This might be the case where the remedial action, once the problem is identified, is self-evident and non-controversial. However, used together the tools form an integrated 'thinking process'. The TOC can be seen as a methodology for managing change. It may be that adoption of this methodology could allow investigators to go beyond the present concepts of accident investigation. By finding how best to reach a situation where accidents are avoided, and presenting this finding in a logical fashion, it may be possible to overcome the sorts of difficulties described by Charles (1991) and Taylor (1998)
An overview of this 'thinking process' appears in Figure 21. Dettmer (1997) observes that "non-quantifiable problems of broad scope and complexity are
particularly prime candidates for a complete thinking process analysis" (p. 26). There could hardly be a better description of an aircraft accident investigation.
Figure 21. The Thinking Process. (Source: Dettmer, H. W. (1997). Goldratt's theory of constraints: a systems approach to continuous improvement. Milwaukee: Quality Press).
Summary
From the early concepts of an accident as being an undesirable event having a single cause, the present concept of an accident as a process having a multiplicity of causal factors has developed. The idea that an accident is a process gives rise to the possibility that methods used in business for the improvement of processes could have the potential for improving accident processes, so that the undesirable outcomes do not occur. Since these business methods have been developed from the need to discover effective changes and to implement these changes, these methods may offer a way to overcome the seemingly insuperable resistance to safety recommendations which has led to repeated accidents even when the causes of accidents have been known.
Formal methods for the analysis of accidents have been proposed for many years, but few have found favour. Formal methods should ensure that all data are gathered, and analysis is logically sound and therefore persuasive. However, earlier attempts at devising formal methods were either very complex, for example MORT, or were unlikely to produce consistent results because they contained subjective elements. Also, no advice was available as to which of the plethora of possible methods should be used in particular cases.
The use of Multilinear Event Sequencing as a data-managing tool and a means of visualising the accident sequence has stood the test of time. Because it is designed to focus the investigators' attention on concrete matters, it is not well suited to
handling abstract considerations, yet these may be important for the understanding of the accident. However, the recent introduction of Why-Because Analysis provides a complementary method, able to answer the question 'Why did it happen?', whereas MES deals with 'What happened?'
Neither of these formal analytical methods is well suited to answering the final part of the safety question, 'How to prevent recurrence?' This is the realm of process improvement. The Theory of Constraints is a change management methodology widely adopted in business, which has the potential to answer that question.
problems, and in particular for dealing with processes which were producing undesirable outcomes. There is no reference to it being used in aircraft accident investigation, but there is a wide literature of its applicability to a large variety of problems. A particular feature of the TOC is the emphasis on achieving change: in moving from the undesirable 'current reality' to a 'future reality' in which the undesirable effects do not occur. In terms of accident investigation, this offers the possibility of moving from the unsatisfactory situations disclosed by the accident under investigation, to a system without the undesirable features that precipitated the accident. Additionally, the ability to discover 'core problems' - fundamental problems which give rise to a large range of undesirable effects - offers the possibility of discovering 'silver bullets' when these are available to be found, by analysis rather than by intuition.
No one of these systems (MES, WBA or TOC) could be a universal panacea on its own. MES, with its emphasis on the concrete matters, is unable to deal with latent failure. WBA, at a higher level of abstraction than MES, is able to make the linkages advocated by Reason, but has need of inputs from MES during the data- gathering phase. TOC could not be used without the insights provided by MES and WBA, as to the current reality which needs to be changed. However, used as a suite of tools, they have the potential to make a substantial improvement to the quality of investigations.
In this thesis, an accident case study will be analysed with this suite of methodologies, in order to see whether they offer an improvement over existing informal analytical methods.