Benner developed Multilinear Event Sequencing as an analytical tool for the NTSB, and the method has been refined over the years (Benner, 1975; Benner, 1994). Multilinear Event Sequencing (MES) is a methodology for the data-gathering phase of an accident investigation, based on the proposition that an accident is a process. A process can be depicted by a flow-chart, which is both an aid to understanding the
process, and also indicates clearly where information is lacking, and must therefore be sought. As Benner has said, "Everyone and everything has to be someplace, doing something" during the accident process (Benner, 1994, p. 1-iv). He therefore devised a system of 'Event Building Blocks' (EBBs), each comprising a single actor
performing a single action, to show where everyone and everything was, and what they were doing. These EBBs form the elements of the MES flow chart. The linkages between the elements denote causal relationships. The end result is a network of related events forming a flow-chart depicting the actions comprising the accident sequence.
The MES flow-chart is constructed on a matrix having, vertically, the various actors, and horizontally, the timebase. Time conventionally flows from left to right. The time base is not annotated initially, because actual times may not be known precisely; what is important is that actions should be in sequence. As actions become known during the investigation, EBBs are constructed and placed in approximate position. These positions may be adjusted as further information becomes available. (Fig. 14). P1 P2 Aircraft Flight attendant Time Aircraft action P1 Action
Fig. 14. MES Matrix
It is almost inevitable that there will be interactions between the various actors in the course of an accident sequence. The flow-chart thus takes on the appearance of a network. In this respect MES flow-charts differ from flow-charts based on 'tree'
but not division. The typical form of an MES chart is shown in Fig. 15.
Figure 15. MES network. (Source: Benner, L. (1994). Ten multilinear event sequencing guides. Sterling, Va.: ISASI.).
The MES flow-chart may become quite large. In practice, the author has found it desirable to use a blank wall as the base, the EBBs being annotated on self-adhesive paper squares such as Post-it notes, to allow for repositioning.
The construction of MES flow-charts is controlled by a number of rules. Some rules are intended to ensure that the investigator's focus remains on concrete matters. In Benner's view, higher levels of abstraction impede the ability to visualise the objects of interest, so the investigator must work at the bottom of the ladder of abstraction to develop the description of an occurrence. One such rule is the
prohibition of negative statements: thus "the pilot did not lower the undercarriage" is not allowed. At this stage of an investigation, Benner (1994) considers it essential to focus on what the pilot did, rather than on what the investigator thinks the pilot ought to have done.
Other rules apply logical tests of necessity and sufficiency to ensure the validity of the causal linkages5.
5
The full set of rules is discussed in Benner, L. (1994). Ten multilinear event sequencing guides. Sterling, Va.: ISASI..
Benner (1994) attributes the following benefits to MES charts:
• They enable investigators to form a 'mental movie' of the accident sequence.
• They may direct attention to missing information: where logical linkages cannot be found, one or more EBBs must be missing, so further evidence must be sought.
• Flow-charting has benefits in presentation, helping others to understand complex interactions.
• The flow-chart is an effective quality control tool. Deficiencies in logic are readily apparent, because it is easy to trace linkages on the chart.
At what point should an MES analysis commence? Rimson (1998) has suggested that it should begin with the first perturbation from the ordinary smooth flow of operations, since the analysis is designed to construct a 'mental movie' of what went wrong. It could be argued that with such a starting point, the analysis will
overlook pre-existing conditions, such as failings in corporate structure, which are at the root of many accidents. Indeed it will, but such criticism would be misdirected. Latent failures, while no doubt originating in concrete actions, can seldom be depicted in concrete terms. Thus, in the Zeebrugge disaster, a latent failure was the Board decision not to fit warning lights indicating that the ferry bow doors were not locked (Sheen, 1987; Reason, 1990). The concrete actions involved in this process were presumably deliberations by the individual Board members, followed by them voting, and the Chairman recording the result of that vote. However, these details are unlikely to be known to the investigators, and would in any case be immaterial to the
investigation. Latent failures are thus considered at a higher level of abstraction than the concrete actions with which MES is concerned. MES is intended to focus on concrete actions, and so is not designed to investigate abstract matters.
However, the 'point of perturbation' may not be easy to see, when real examples are examined. Take, for instance, the accident to ZK-SFB (Carruthers, 1988).
Skyferry, a company whose primary operation had been flying passengers across Cook Strait (between the North and South Islands of New Zealand), decided to branch
Cessna 208 'Caravan' single-turboprop aircraft.
A month after the service started, one of the aircraft, ZK-SFB, was lost at sea off the Kaikoura coast. The subsequent investigation showed that at about midnight the aircraft had encountered severe icing while flying at 11 000 feet, stalled, and spun into the sea killing the pilot and a passenger. The aircraft had no airframe de-icing equipment, and there were various deficiencies in maintenance. But why had the pilot continued to fly in severe icing, when he could have escaped by descending to a lower level? In the words of one member of the subsequent Court of Inquiry, "What was he using for a brain?"
Perhaps not much. It transpired that the pilot had worked for 18 hours before the accident, had loaded and unloaded by hand some ten tons of freight, was soaked by rain while doing so (no foul weather gear was provided), had had no proper meal break before the flight and was eating sweets to sustain himself. He had had no oxygen indoctrination course, was not using the aircraft's oxygen system, and would have been mildly hypoxic. Around midnight, his body would have been reaching a low point in its circadian rhythm. The cabin heater may not have been working.
Further investigation showed that the pilot, who was the Operations Manager, and had until recently been also the Chief Pilot, had been having difficulty passing his instrument rating renewal. Previous tests of his general flying had been unsatisfactory. He had a record of previous accidents and incidents which reflected adversely on his judgement.
Surveillance by the Civil Aviation Division (CAD) of the Ministry of Transport ought to have alerted them to these shortcomings, to the excessive hours being worked, and to deficiencies in maintenance. So severe were the deficiencies in surveillance that the Chief Inspector of Air Accidents considered that he was required to bring the matter to the attention of the Attorney General, who ordered a Court of Inquiry under Mr Justice Carruthers.
Here it could be said that the operation was quite normal until ice began to form on the aircraft. But the seeds of this accident were sown in earlier actions. The
ICAO definition of an accident (and the recommended report format) would suggest that investigators should commence examination of the flight when the crew first boarded the aircraft with the intention of flying (ICAO, 1994). But this would exclude considerations of the pilot's flights and actions earlier in the day, which undoubtedly had a bearing on the pilot's actions during the flight. Should the investigation, then, start when the pilot was first woken to undertake the (unanticipated) first flight of the day? But this would preclude consideration of the very short time available for sleep – certainly a factor in the accident. None of these earlier factors were 'perturbations', in that they were not different from ordinary operations in the airline. However, merely because they were ordinary operations did not make them a good idea. In
combination, they were an accident looking for somewhere to happen. They can be distinguished from 'latent failures' (Johnson, 1980; Reason, 1990) in that specific actions were involved, whereas latent failures are systemic, for example lack of an adequate surveillance system.
It seems unhelpful to have a preconceived idea of where the investigation should start. MES is a tool to serve the investigator, and it should be left to the investigator to decide how far back the 'mental movie' needs to go.