Are you where you think you are?

‘Not until we are lost do we begin to understand ourselves.’ Henry David Thoreau

The first part of working out you’re lost is actually admitting it. This may come as a slow uncomfortable realisation that you aren’t really sure where you are, or it may come as a sudden shock when you turn up somewhere and the people who were expecting you aren’t around. In the space of a month in the North Sea offshore oil fields two AgustaWestland 139 helicopters landed on an oil rig to find that no one was there waiting for them. Up until that point everything was on track. These incidents occurred in surprisingly similar circumstances. How can two ATPL holding aircraft captains both with over 6000 hours experience in a modern aircraft with two crew, supporting planning sections and highly regulated airline style flying environment get lost over the ocean?

The first incident occurred on 20 January 2017 and involved a late change of routing where the aircraft captain was distracted by maintenance issues and could not supervise the co-pilot’s flight planning. The co-pilot had to transcribe from a customer database that used different oil rig codes to that in the flight planning database. A mistake was made when transcribing with Ravenspurn Alpha (RVN) put in as Ravenspurn North (RN) on the flight plan. The helicopter was flight planned to the wrong rig. On arrival at the oil rig the crew used an abbreviate callsign to notify the oil rig deck crew of their approach utilising just ‘Ravenspurn’ instead of ‘Ravenspurn Alpha’ and were cleared to land by the Ravenspurn Alpha deck crew. The helicopter instead landed at Ravenspurn North a short distance away.

The second incident occurred on 19 February 2017 and involved utilising an operations department planning section that was Dutch conducting planning for the UK section as part of ongoing collaboration between different international arms of the helicopter company. The Dutch section did not normally program the UK side of the operation. There were discrepancies between the customer oil rig database and the flight-planning database. The planning section made an error transcribing between systems where similar oil rig names with different database codes resulted in the crew being programmed to Leman 27B instead of Leman 26B. As in the first incident, the crew used abbreviated callsigns to notify of their approach and ended up landing on a nearby similarly named oil rig.

Whilst this may not seem like a major incident it is an interesting case study in a classic Reason model casual chain (see Figure 1). The reason model has latent and active failures. The active failure could be considered the unsafe act of incorrectly transcribing the oil rig codes between the customer database and the flight-planning database. Latent failures are broken down into organisational influences, unsafe supervision and preconditions for unsafe acts. The organisational influences latent failure could have been the use of the Dutch section to plan a UK flight. In the first incident there was an unsafe supervision latent failure where the aircraft captain did not adequately supervise the co-pilot’s flight planning. The preconditions for unsafe acts latent failure could include the use of two databases with different oil rig codes and the use by the pilots of abbreviated oil rig callsigns. The mishap was then landing on an oil rig deck without the required deck preparation and safety staff. Here we can see where the various holes in the swiss cheese line up. Were there sufficient other controls to ensure that this didn’t result in an accident if this had occurred at night or bad weather with an unprepared oil rig helipad?

It is also interesting to look at the recovery from the mishap with a bow tie model (see Figure 2). The previously discussed latent and active failures could be considered preventive defences. These act to stop getting to the undesired aircraft state. After the undesired aircraft state, the crews enacted a ‘pre-planned landing on the wrong helideck’ procedure. This was a recovery defence and minimised the risk of any greater adverse safety outcome.

Ultimately the aircraft captain is responsible for the safety of their aircraft. This statement is very easy to say. However, in the previous analysis, we can see that the aircraft crew were being set up by latent failures—organisation influences and preconditions for unsafe acts. This may seem like a minor incident, however, in both cases these were reported to the national air safety board and investigated. This shows an open and honest reporting culture and is to be encouraged by company management. The challenge now is to take action to solve these latent and active failures. Some issues lie with the crew and applying better discipline. Some issues lie with the operator to improve the overall systems. The reporting of minor incidents may actually indicate more major issues that could lead to far more serious incidents. Could these incidents be actually an indication of wider latent issues? A deeper analysis or wider review may uncover similar issues in other areas. Incidents are embarrassing at least. Accidents can result in death and will be very costly. Once you have had an incident or accident you have paid the price. The initial aim is to learn as much as possible and prevent a reoccurrence of that incident. The next step is to apply what is learnt more widely and act to prevent different or unforecast incidents from occurring. A cheap incident like this could give insight into much wider issues that have potential to be much costlier.

It is always embarrassing to become lost. However, with open and honest reporting of minor incidents, you can learn more about your operations latent issues. Knowing this you can act to prevent them lying in wait ready to cause a bigger incident. These crews found themselves lost but look what was discovered.

‘I got lost but look what I found.’ Irving Berlin