The limitations of MES come into two broad categories: limitations arising from the way the rules are defined, and inherent limitations arising from the function of MES.
Limitations Arising from the Rules
The logical rules of necessity and sufficiency do not always fit with what is known of accident structures. The limitations of the 'necessary and sufficient' tests will be discussed later, when the Theory of Constraints is considered.
However, there is one rule which causes particular difficulty, namely the prohibition on the use of negatives. While it is undoubtedly useful to focus on what the pilot was doing rather than what, in the investigators' opinion, he should have been doing, at times this constraint causes the logic to suffer. For example,
clearly has something missing. The reality of the matter is that additional information is needed:
Undercarriage malfunction distracted pilot
Aircraft struck mountain
Aircraft descended towards terrain Pilot did not
monitor flight path
'Pilot did not monitor flight path' may not be a matter of opinion: it may be able to be proved by factual evidence (see, for example, TAIC, 1995). It ought not, therefore, to be excluded from the description of the accident sequence. A possible solution attempted by the author is to incorporate a commentary in a time-line across the top of the MES flow-chart, but this seems a somewhat clumsy contrivance. Alternatively, such a negative could be inserted in a different type of box, as an indication that it should be treated with caution.
Hendrick and Benner (1987) stipulate that the only permissible components of an MES chart are EBBs (defined as a single actor performing a single action) and linking arrows. However, an 'event' can take forms other than 'a single actor
performing a single action'. Gerdsmeier et al (1997) define an 'event' as an action, a once only change of state; a 'state' represents a persisting condition. They also find it necessary to define a 'state-event', where a state persists for a time which may be specified by events. An example of such a state-event would be continued descent by an aircraft, at a steady rate for a prolonged period. The initiation of the descent, and
its termination, are events, while the descent is, for that period, a continuing state of affairs.
Also, while an event can certainly cause another event, it can also cause a state, and a state can cause an event (Bennett, 1988)6. The MES methodology might be more general if it could be expanded to cover these aspects. In his earlier work, Benner (1975) referred to both events and conditions, 'conditions' being synonymous with continuing 'states'. However, he subsequently eliminated 'conditions', because he wished to focus investigators' attention on concrete matters during the course of an investigation (L. Benner, 2000, personal communication).
Hendrick and Benner (1978) take the view that the sequence leading up to an accident comprises events which are causally linked. Ladkin & Loer (1998) argue that this view is inadequate, since it does not allow for consideration of steady states which may influence the accident sequence.As an example of the effect of constraining the analysis to EBBs and causal linkages, consider the Airbus A310 over-run at Warsaw (Hoehl, 1997):
The aircraft overran the end of the runway and struck an earth embankment beyond the runway end. The accident investigators described the sequence of events, but did not consider the embankment to be in any way causal, and made no
recommendations about it. Yet, as Ladkin points out, had the embankment not been there, the damage and loss of life would not have occurred. The presence of the embankment was a necessary condition for the disaster that ensued; its removal would certainly avert a repetition, so this would seem to be a proper matter for a safety recommendation. How did the investigators come to overlook matters which, thus stated, seem self-evident?
The existence of the embankment was not an event - 'something that happens' (Bennett, 1988). It was a continuing state of affairs: what Bennett refers to as a 'fact';
6
example of a fact causing an event (in conjunction, naturally, with other factors). Such a state of affairs could be handled, using MES, as follows (in summary form):
Embankment exerted destructive forces on aircraft
Aircraft struck embankment Aircraft ran off
runway (at 50 knots)
So far, so good. However, there is no necessary requirement to account for the presence of the embankment. If it was man-made, the graph could show
Y constructed embankment X decided to construct embankment Aircraft struck embankment
But there is no prompt to do so, and the embankment might have been constructed many years ago, perhaps before the aerodrome was built. If the
embankment was natural, there is no method for injecting it into the flow-chart, and it is not permitted, under the MES rules, to write "aerodrome constructors did not remove embankment", though this might be a valid matter for consideration. It might be useful if such facts could be injected into the flow-chart, rather than arising by implication.
Limitations Arising from Function.
The purpose of MES is the description of the concrete actions which comprised the accident sequence. The focus on the concrete precludes the
consideration of abstractions. Difficulties may arise if an attempt is made to apply MES to abstractions. Consider, for example, the various factors which caused the pilot of ZK-SFB to be affected by both chronic and acute fatigue (Carruthers, 1988). There were several factors, but for the sake of simplicity just two will be examined: the 18-hour duty day, and the loading and unloading of ten tons of freight by hand. Loading and unloading ('handling') the freight can be represented by an EBB:
Pilot (actor) Handled (action) Ten tons of freight (object)
There is no difficulty in recognising that handling ten tons of freight would be conducive to fatigue, so one could say
Handling freight Fatigued
pilot
However, this does not comply with the rules for EBBs. The gerund 'handling' is not an actor, performing an action on the pilot; indeed, it was the pilot who
performed the action. It is not permitted to use the passive voice: 'the pilot was fatigued by handling the freight' – although this would undoubtedly be true.
In like fashion, while EBBs can readily be established to show that the pilot was on duty for 18 hours, there is no satisfactory way of saying that the 18-hour duty day contributed to the pilot being fatigued.
Indeed, what is fatigue? It is not (in the context of an 18-hour duty day) physical tiredness; nor is it necessarily weariness or sleepiness. A fatigued pilot may feel alert and consider that he is performing well – consider, for example, the
subjective feeling of wellbeing reported by the co-pilot immediately before the accident to the DC 8 at Guantanamo Bay (NTSB, 1994). Fatigue can perhaps be described by its consequences such as slowed reaction times, narrowing of attention, lack of alertness, and poor monitoring (Dinges, 1995). It is a higher level of
methodology for portraying accidents must be able to account for them.
In the accident to ZK-SFB outlined above, the pilot's fatigue was an ongoing state of affairs – a fact. This is an example of a number of events combining to cause a fact. This fact, in conjunction with an event (an encounter with severe icing) caused the pilot to not detect the accumulation of ice on the airframe, though evidence of such accumulation (the progressive reduction in airspeed until the aircraft stalled) was available to him. 'Non-detection' was also a fact, and it resulted directly in the
subsequent stall and spin.
MES, as Benner (1994) has presented it, can tell us that the pilot handled freight before the accident, that the pilot was on duty for 18 hours before the accident, that there was an encounter with severe icing, and that the airspeed then reduced progressively until the aircraft stalled and spun. In putting these occurrences into order it enables us to visualise the sequence, but the rules do not allow the linkages to be made. Yet many pilots have encountered such unsatisfactory operations and can testify to the reality of the ensuing fatigue.
Naturally, man-made rules can be altered should the need arise. However, to permit greater abstraction would be to detract from the focus on concrete matters, which is the raison d'être of MES. This tight focus is of value during the data-
gathering phase of an investigation, so rather than weaken MES in this respect, it may be better to seek other tools to deal with abstractions.