Colorado Firecamp - wildfire training wildland firefighter training Wildfire Blog Engine Boss Apprenticeship Location and Facility About Colorado Firecamp Frequently Asked Questions

Colorado Firecamp - wildland firefighter training
Swiss Cheese Model

swiss cheese slice

The Human Factors Analysis and Classification System—HFACS

Cover and Documentation
1. Unsafe Acts
2. Preconditions for Unsafe Acts
3. Unsafe Supervision
4. Organizational Influences

HFACS and Wildland Fatality Investigations

Hugh Carson wrote this article a few days after the Cramer Fire

Bill Gabbert wrote this article following the release of the Yarnell Hill Fire ADOSH report

A Roadmap to a Just Culture: Enhancing the Safety Environment

Cover and Contents
Forward by James Reason
Executive Summary
1. Introduction
2. Definitions and Principles of a Just Culture
3. Creating a Just Culture
4. Case Studies
5. References
Appendix A. Reporting Systems
Appendix B. Constraints to a Just Reporting Culture
Appendix C. Different Perspectives
Appendix D. Glossary of Acronyms
Appendix E. Report Feedback Form

Rainbow Springs Fire, 1984 — Incident Commander Narration

Years Prior
April 25th
Fire Narrative
Lessons Learned

U.S. Forest Service Fire Suppression: Foundational Doctrine

Tools to Identify Lessons Learned

An FAA website presents 3 tools to identify lessons learned from accidents. The site also includes an animated illustration of a slightly different 'Swiss-cheese' model called "defenses-in-depth."

A Roadmap to a Just Culture:
Enhancing the Safety Environment

Prepared by: GAIN Working Group E,
Flight Ops/ATC Ops Safety Information Sharing

First Edition • September 2004

4. Case Studies

Four case studies are provided to show the several ways in which different organizations have attempted to create a Just Reporting Culture (with various levels of success), including: the Danish (Nørbjerg, 2003), the New Zealand Civil Aviation Authority (NZ CAA, 2004), and UK Civil Aviation Authority and Alaska Airline’s systems. These case studies are described under different headings, depending on the information available.

4.1 Danish System Legal Aspects

In 2000, the Chairman of the Danish Air Traffic Controllers Association described the obstacles for reporting during an interview on national prime-time television. This influenced the Transportation Subcommittee of the Danish Parliament to ask for the Danish Air Traffic Control Association to explain their case. After exploring various international legislations on reporting and investigating incidents and accidents, the Danish government proposed a law in 2002 that would make non-punitive, confidential reporting possible.

Reporting System

The Danish reporting system ensures immunity against penalties and disclosure but also any breach against the non-disclosure guarantee is made a punishable offense. The system includes the following:

  • Mandatory: Air Traffic Controllers must submit reports of events. It is punishable not to report an incident in aviation.
  • Non-punitive: Reporters are ensured indemnity against prosecution or disciplinary actions for any event they have reported based on the information contained in the reports submitted. However, this does not mean that reports may always be submitted without consequences.
  • Immunity against any penal / disciplinary measure: If a report is submitted within 72 hours of an occurrence; if it does not involve an accident; or does not involve deliberate sabotage or negligence due to substance abuse. Punitive measures are stipulated against any breach of the guaranteed confidentiality.
  • Confidential: The reporter’s identity may not be revealed outside the agency dealing with occurrence reports. Investigators are obliged to keep information from the reports undisclosed. Implementation Process
  1. Danish Aviation Authority body (Statens Luftfartsvaesen) implemented the regulatory framework and contacted those license holders who would mandatorily be involved in the reporting system: pilots; air traffic controllers; certified aircraft mechanics and certified airports.
  2. Danish Air Traffic Control Service Provider (Naviair)
  • Management sent a letter to every air traffic controller explaining the new system, stating their commitment to enhance flight safety through the reporting and analyzing of safety-related events.
  • Incident investigators were responsible for communicating the change, and were given a full mandate and support from management.
  • An extensive briefing campaign was conducted to give information to air traffic controllers; in the briefing process the controllers expressed concerns about confidentiality and non-punitive issues. These issues were addressed by explaining the intention of the law governing the reporting system, the law that would grant media and others no access to the reports and would secure freedom from prosecution. Further it was emphasized that no major improvement in safety would be possible if knowledge about the hazards was not gathered.
  • Priorities were set up on which reports are dealt with immediately, and on how much attention is given by the investigators. The investigation of losses of separation are investigated thoroughly including gathering factual information such as voice recordings, radar recordings, collection of flight progress strips and interviews with involved controllers.
  • Investigative reports have to be completed within a maximum of 10 weeks. The reports include the following elements: Aircraft proximity and avoiding maneuvers; safety nets (their impact on and relevance for the incident); system aspects; human factors; procedures; conclusion and recommendations. The ultimate purpose of the report is to recommend changes to prevent similar incidents.


Increased Reporting: After one year of reporting 980 reports were received (compared to 15 the previous year). In terms of losses of separation, 40-50 were received (compared to the 15 reported in the previous year).

To Reporters: A new incident investigation department was set up at Naviair with six investigators and recording specialists. They provide feedback to the reporter, when the report is first received and when the analysis of the event is concluded. It is important that the organization is ready to handle the reports. Feedback is offered twice a year in which all air traffic controllers, in groups, receive safety briefings (supported by a replay of radar recordings where possible) and discussions are held of safety events that have been reported and analyzed. Four issues of a company safety letter are distributed to the controllers each year.

To the Public: It was acknowledged that, according to the Freedom of Information Act, the public has the right to know the facts about the level of safety in Danish aviation. Therefore it was written into the law that the regulatory authority of Danish aviation, based on de-identified data from the reports, should publish overview statistics two times per year.

Other Flight Safety Enhancements: flight safety partnership- a biannual meeting with flight officers from all Danish airlines is held to address operational flight safety in Danish airspace

Lessons learnt

  • Trust/confidentiality – one break in this trust can damage a reporting system, and that reports must be handled with care.
  • Non-punitive nature – it is important that information from self-reporting not be used to prosecute the reporter.
  • Ease of reporting – Naviair uses electronic reporting, so that controllers can report wherever they have access to a computer.
  • Feedback to reporters – the safety reporting system will be seen as a “paper-pushing” exercise if useful feedback is not given.
  • Safety improvement has been assessed by Naviair, where they think information gathering is more focused and dissemination has improved.

4.2 New Zealand – CAA Overview

In 1999, the NZ CAA became interested in “Just Culture”, and started the process of learning how it functions, and the process required to implement it. They are frequently faced with making decisions regarding the choice of regulatory tool that is appropriate to apply to an aviation participant when there is a breach of the Civil Aviation Act or Rules,
and they saw the “Just Culture” model as holding the promise of promoting compliance and facilitating learning from mistakes. However, to fully embrace ‘Just Culture’ in New Zealand, there will need to be some legislation changes and considerably more selling of the concept to the aviation industry (particularly at the GA end) in order to get the necessary paradigm shift (away from fear of the regulator when considering whether or not to report occurrences).

Reporting System

New Zealand operates a mandatory reporting system, with provision for information revealing the identity of the source to be removed if confidentiality is requested (the latter happens only rarely).

The reporting requirements apply to all aircraft accidents and to all serious incidents except those involving various sport and recreational operations. In addition to the notification requirements for accidents and incidents, the rules require the aircraft owner or the involved organization notifying a serious incident to conduct an investigation to identify the facts relating to its involvement and the causal factors of the incident. A report of the investigation is required within 90 days of the incident, and must include any actions taken to prevent recurrence of a similar incident.

Information received under this mandatory reporting system cannot be used for prosecution action, except in special circumstances such as when false information is supplied or when ‘unnecessary danger’ to any other person is caused. (Ref New Zealand Civil Aviation Rule CAR Part 12.63.)

Implementation Process

Just Culture Seminars – the NZ CAA invited relevant people in the aviation industry (including large and small airline operators) and CAA personnel to attend a seminar by a leading expert on Just Culture. The seminars were extremely well received by all attendees, thus giving the CAA confidence that Just Culture principles were appropriate to apply in a safety regulatory context.

The NZ CAA has a set of tools that they apply to an aviation participant when there is a breach of the Civil Aviation Act or Rules. The tools are many and varied and form a graduated spectrum from a simple warning, through re-training and diversion, to administrative actions against Aviation Documents and prosecutions through the Court. The CAA base their decisions on information which arises from a variety of sources such as: a CAA audit, an investigation of an accident or incident, or a complaint from the public.

For the past four years, the CAA has been using Just Culture principles to decide when:

a) Information from a safety investigation into a mandatory reported occurrence should cross the “Chinese wall” to be used in a law enforcement investigation. (In this context they are using Just Culture to draw the line at recklessness as a surrogate for "caused unnecessary danger", which is the terminology used in the relevant NZ Civil Aviation Rule, CAR 12.63.)

b) Document suspension/revocation is appropriate.

c) Education or re-examination is appropriate.

The perhaps natural tendency for a regulatory authority to draw the line below negligence is resisted. By drawing the line below recklessness when making decisions, the CAA believes it will encourage learning from human errors and, once the approach becomes universally understood and accepted by the aviation community, the incidence of non-reporting of safety failures will decrease.

Lessons Learnt – Legal Aspects

Application of the ‘Just Culture’ in the manner described above requires the Director to exercise his discretionary powers. However, the NZ CAA does not believe it can fully convince the aviation community that the Director will always follow a ‘Just Culture’ approach while the current wording of certain sections of the Civil Aviation Act (S.43, S.43A and S.44) remains. This is because these sections, which draw the line at ‘causing unnecessary danger’ and ‘carelessness’, effectively outlaw human error that endangers flight safety, irrespective of the degree of culpability. They believe this is the reason why many in the aviation community think twice before reporting safety failures to the CAA and indicates the need for confidential reporting. In order to improve reporting, these sections of the Act need to be amended to raise the level of culpability to recklessness (gross negligence) before the particular behavior constitutes an offence.

4.3 UK – CAA MOR (Mandatory Occurrence Reporting System)

The UK CAA has recently reviewed the MOR system to try to improve the level of reporting within the UK aviation community. The objectives of the MOR are to:

  1. Ensure that CAA is informed of hazardous or potentially hazardous incidents and defects
  2. Ensure that the knowledge of these occurrences is disseminated
  3. Enable an assessment to be made and monitor performance standards that have been set by the CAA.

Legal Aspects

Assurance Regarding Prosecution - The UK CAA gives an assurance that its primary concern is to secure free and uninhibited reporting and that it will not be its policy to institute proceedings in respect of unpremeditated or inadvertent breaches of law which come to its attention only because they have been reported under the Scheme, except in cases involving failure of duty amounting to gross negligence. With respect to licenses, the CAA will have to take into account all the relevant information about the circumstances of the occurrence and about the license holder. The purpose of license action is to ensure safety and not to penalize the license holder.


The CAA has the following responsibilities: i) evaluate each report; ii) decide which occurrences require investigation by the CAA iii) check that the involved companies are taking the necessary remedial actions in relation to the reported occurrences, iv) persuade other aviation authorities and organizations to take any necessary remedial actions, v) assess and analyze the information reported in order to detect safety problems (not necessarily apparent to the individual reporters); vi) where appropriate, make the information from the reports available and issue specific advice or instructions to particular sections of the industry; vii) where appropriate, take action in relation to legislation, requirements or guidance. The Air Accidents Investigations Branch (AAIB) investigates accidents, and these are passed on to the CAA for inclusion in the MOR.

Potential Reporters

Pilots; persons involved in manufacturing, repair, maintenance and overhaul of aircraft; those who sign certificates of maintenance review or release to service; aerodrome licensees/managers; civil air traffic controllers; persons who perform installation, modification maintenance, repair, overhaul, flight checking or inspection of equipment on the ground (air traffic control service).

Reportable Incidents

a) Any person specified above should report any reportable event of which they have positive knowledge, even though this may not be first hand, unless they have good reason to believe that appropriate details of the occurrence have been or will be reported by someone else. b) Types of incidents:

i) any incident relating to such an aircraft or any defect in or malfunctioning of such an aircraft or any part or equipment of such an aircraft being an incident, malfunctioning or defect endangering, or which if not corrected would endanger, the aircraft, its occupants, or any other person

ii) any defect in or malfunctioning of any facility on the ground used or intended to be used for purposes of or in connection with the operation of such an aircraft or any part or equipment of such an aircraft being an incident, malfunctioning or defect endangering, or which if not corrected would endanger, the aircraft, its occupants, or any other person.

Submission of Reports

CAA encourages the use of company reporting systems wherever possible. Reports collected through the company are filtered before they are sent to the CAA (to determine whether they meet the desired criteria of the CAA). The company is encouraged to inform the reporter as to whether or not the report has been passed on to the CAA.

- Individuals may submit an occurrence report directly to the CAA, although in the interest of flight safety they are strongly advised to inform their employers. - Reports must be dispatched within 96 hours of the event (unless exceptional circumstances), and informed by the fastest means in the case of particularly hazardous events. - Confidential reports – can be submitted when the reporter considers that it is essential that his/her identity not be revealed. Reporters must accept that effective investigation may be inhibited; nevertheless, the CAA would rather have a confidential report than no report at all. Processing of Occurrence Reports

The CAA Safety Investigation and Data Department (SIDD) processes the reports (and is not responsible for regulating organizations or individuals). They evaluate the occurrences that require CAA involvement; monitor the progress to closure and follow-up on open reports; disseminate occurrence information through a range of publications; record reports in a database (names and addresses of individuals are never recorded in the database); monitor incoming reports and store data to identify hazards/potential hazards; carry out searches and analyzes in response to requests within the CAA and industry; ensure effective communication is maintained between AAIB and CAA in respect of accident and incident investigation and follow-up. Confidential reports are directed to and reviewed by the Head of SIDD, who initiates a dis-identified record. The Head of SIDD contacts the reporter to acknowledge receipt and to discuss further; after discussions the report is destroyed; and the record is be processed as an occurrence, but annotated as confidential (only accessible by restricted users).

4.4 Alaska Airlines

The following section was taken from a corporate statement from Alaska Airlines that was transmitted to all staff.

Legal Aspects

Generally, no disciplinary action will be taken against any employee following their participation in an error investigation, including those individuals who may have breached standard operating procedures. Disciplinary action will be limited to the following narrow circumstances: 1) An employee’s actions involve intentional (willful) disregard of safety toward their customers, employees, or the Company and its property. This is applicable when an employee has knowledge of and/or intentionally disregards a procedure or policy. Reports involving simple negligence may be accepted. In cases where an employee has knowledge but still committed an error, the report may be accepted as long as it is determined that the event was not intentional and all of the acceptance criteria listed herein is met.

2) An employee commits a series of errors that demonstrates a general lack of care, judgment and professionalism. A series of errors means anything over one. Management retains the discretion to review and interpret each situation and determine if that situation demonstrates a lack of professionalism, judgment or care. When determining what reports are acceptable when a series of errors are involved managers should consider the risk associated with the event and the nature and scope of actions taken as a result of all previous events. A risk table is available to assist managers in making a determination of risk.

3) An employee fails to promptly report incidents. For example, when an employee delays making a report in a reasonable time. A reasonable time for reporting is within 24 hours. However, reports should be submitted as soon as possible after the employee is aware of the safety error or close call.

4) An employee fails to honestly participate in reporting all details in an investigation covered under this policy. For example, an employee fails to report all details associated with an event, misrepresents details associated with an event, or withholds critical information in his/her report.

5) The employee’s actions involve criminal activity, substance abuse, controlled substances, alcohol, falsification, or misrepresentation.

Reporting System

The Alaska Airlines Error Reporting System (ERS) is a non-punitive reporting program which allows employees to report to management operational errors or close calls that occur in the workplace. This system is designed to capture events that normally go unreported. It also provides visibility of problems to management and provides an opportunity for correction.

Roles and Responsibilities

The Safety Division has oversight of the program. Supervisors and local management have responsibility for the day-to-day management of reports submitted, investigations performed and implementation of corrective actions.

Users: Any employee not covered by the Aviation Safety Action Program (ASAP) or Maintenance Error Reduction Policy (MERP). These employees are not covered by ERS because they are certificated by the FAA, and the company cannot grant immunity to them in all cases. ASAP provides protection for certificated employees. Pilots and Dispatchers are currently covered under ASAP. Until Maintenance & Engineering develops an ASAP, Maintenance & Engineering employees will be covered under MERP.

Reporting Procedure

1. Reporters can file a report on An employee can also submit a report over the phone by contacting the Safety Manager on Duty. 2. A report should be promptly submitted, normally as soon as the employee is aware of the error or close call. Reports made later may be accepted where extenuating circumstances exist.


The employee’s supervisor will review the report, determine if it meets all criteria for acceptance and notify the employee. If the report is not accepted, the employee’s supervisor is responsible for contacting the Safety Division immediately for review. Concurrence from the Safety Division is required prior to the non-acceptance of a report. The Safety Division will record and review all reports submitted under this program. The Internal Evaluation Program (IEP) will accomplish a monthly review of corrective actions. All long-term changes to procedures and policies will be added to the IEP audit program and become permanent evaluation items for future audits. A summary of employee reports received under this system will be presented to the Board of Directors Safety Committee quarterly. Summary information will also be shared with employees on a regular basis.

<<< continue reading—A Roadmap to a Just Culture, References >>>

Reprinted by permission from the Global Aviation Information Network.


©2005-2006 Colorado Firecamp, Inc. home scheduleblogENGBfacilityabout usFAQ's