Delft University of Technology MATERIALS ENGINEERING Department Maritime and Transport Technology Mekelweg 2 2628 CD Delft the Netherlands Phone +31 (0)15-2782889 Fax +31 (0)15-2781397 www.mtt.tudelft.nl
This report consists of ## pages and # appendices. It may only be reproduced literally and as a whole. For
Specialization: Transport Engineering and Logistics
Report number: 2014.TEL.7834
Title:
Delicate handling: Towards a
failsafe ground handling process
for the new composite Boeing 787
at KLM
Author:
P.H.L. Crombach
Title (in Dutch) Delicate behandeling: richting een fout vrij grond afhandelings proces voor de Boeing 787 bij KLM
Assignment: literature / computer / experimental / design assignment / Masters thesis Confidential: no / yes (until Month dd, yyyy)
Initiator (university): Prof.Dr.Ir. G. Lodewijks
Initiator (company): Drs. Ir. G.J. Van Hilten (KLM, Schiphol)
Supervisor: Dr. W. Beelaerts van Blokland
Student: P.H.L. Crombach Assignment type: Literature / Computer / Experimental / Design / Master thesis
Supervisor (TUD): Dr. W. Beelaerts van
Blokland Creditpoints (EC): 10 or 12 or 35 or 36 Supervisor (Company) Drs.Ir. G.J. Van Hilten Specialization: TEL/PEL/ME/DE/OE
Report number: 2014.TEL.7834 Confidential: No / Yes
until Month dd, yyyy
Subject: A failsafe ground handling process for the new composite Boeing 787 at KLM.
KLM is to receive their new Boeing 787 ‘Dreamliner’ in October of 2015. For this aircraft there is no knowledge on how it responds to collisions with ground handling equipment. The KLM management considers a ‘no-touch’ policy and further measures to prevent damage need to be investigated
The NLR has done extensive research on the equipment most responsible for damages in ground handling processes. Boeing, the University of California and the EASA have independently investigated damages to composite structures and the KLM has previously mapped their ground handling
processes.
My assignment is to evaluate the damage statistics for KLM ground handling. Analyze the processes in which the damages occur and find out why. With this knowledge advice KLM how to prevent damage in the future; using both new procedures, and new technological aids.
The report should comply with the guidelines of the section. Details can be found on the website.
The professor,
DELICATE HANDLING
Towards a failsafe ground handling process
for the new composite Boeing 787 at KLM
P.H.L. Crombach
Ma
ster
of
Sci
enc
e
Thesi
s
Delicate Handling
Towards a failsafe ground handling process for the
composite Boeing 787 at KLM
Master of Science Thesis
For the degree of Master of Science in Mechanical Engineering, Transport
Engineering and Logistics track at Delft University of Technology
P.H.L. Crombach
July 03, 2014
Faculty of Mechanical, Maritime and Materials Engineering (3mE) – Delft university of
Technology
The work of this thesis was commissioned by KLM – Royal Dutch Airlines. Their collaboration and contribution is hereby gratefully acknowledged.
Preface
This thesis is a result of six months research at Delft University of Technology and KLM the Royal Dutch Airlines. After a preliminary literature survey I was able to have a flying start into this research. The first month was dedicated to understanding the processes, methods and problems concerning the handling of the Boeing 787 at KLM. The other five and a half months were used to build the Bow-Tie method and develop the new quantification method, analyse the data and write this thesis.
The research subject was proposed by KLM after concerns about the composite materials behaviour of the Boeing 787 after contact with ground handling equipment, these issues were raised at a board meeting. The proposition to find an intern who would investigate how to create a failsafe ground handling process came from J. Haeser and G.J. Van Hilten at KLM. I was asked by Dr. W. Beelaerts van Blokland from the Technical University of Delft to adopt this research for my graduation thesis.
Acknowledgements
I would like to thank my supervisor from the Technical University of Delft, Dr. W. Beelaerts van Blokland, who made this thesis possible and his involvement in the progress of my thesis. Drs.Ir. G.J. Van Hilten and N. Lommerse from KLM for their supervision concerning the work on the Bow-Tie and FMEA model and daily supervision at KLM.
I wish to express my gratitude to Prof.Dr.Ir. L. Lodewijks to preside over my graduation.
Last but not least I would like to thank my thesis checking team with helping me to get rid of pesky spelling errors.
Delft, University of Technology PHL. Crombach
I would like to dedicate this thesis to my family and especially to my parents. They have
helped and supported me through my long studies at the Delft University of Technology. Of
course nobody can live without their friends so part of this thesis also has to be dedicated to
them, thank you for providing the distraction I needed to elongate my study but also to keep
my focus to the finish.
“U can’t touch this.”
-oOo-
M.C. Hammer
Summary
According to preliminary research by the NLR the airline industry loses a lot of money on ground handling related damages. Apart from the financial consequences, there are large safety issues regarding these damages. (Balk, Safety of ground handling, 2008) About 1 in every 5000 flights suffers a severe ground handling related damage. From the research by the NLR as well as KLM damage database analysis, it can be concluded that only about 50% of these damages are reported at the place where they are caused. All other damages are found on arrival at the destination.
KLM has ordered a total of 23 of the new Boeing 787-9 aircraft, this type of aircraft is the first commercial passenger jet to have a structure primarily consisting of composite materials. (Figure 1) These materials offer a number of advantages but one big downside is how the material reacts to impacts. Research at the University of California found that the outer composite skin can bounce back to its original shape, potentially hiding internal damages. (DeFrancisci, 2013) This poses a large threat to the airline industry and has sparked worries in the KLM management.
Figure 1: Composite materials in Boeing 787 design
This thesis aims to propose a way to take away the safety risks in the ground handling process. Therefore the main research question is: “How to make the ground handling process for the 787 failsafe” This question was answered using six sub-questions.
The first two questions: “How many ground handling damages occur in the current KLM ground processes?” and “Where in the process are the damages caused?” were answered using the KLM damage database. It appears that KLM suffers 1 severe ground related damage in every 4909 flights, this is in the same region as the industry wide number found by Balk. Most damages are caused around the doors of the aircraft, the vehicles mainly responsible for these damages are cargo loaders and passenger boarding devices.
To answer the questions: “What are the risks on the ground handling process and how are they currently handled?” and “Where in the current ground handling process can improvements be made?”
an elaborate process analyse was made. First a process flow and critical path analysis was made to assess if the two most damage prone GSE were part of the critical process. This proved to be the case. Next a new method to analyse the risks was developed. This is a combination between a Bow-Tie method, the tripod method and FMEA, the 787 situation was used as a test case for this method. The Bow-tie and tripod analysis was done to find failing or missing barriers in the ground handling process. From the analysis it was concluded that the lack of guided docking at Schiphol posed a large safety risk. A no touch policy can provide an extra barrier for four out of the seven threats and aid in clearing the reporting issues. Technological aids can provide added safety for at least three different threats.
The Bow-Tie method is a risk qualification method. To answer the sub-question: “Can the impact of the proposed improvements be measured?” the Bow-Tie method was combined with a Failure Mode Effect Analysis. This new combined method is based on the statistics of the KLM damage database combined with estimated barrier effectiveness determined by eight experts. Four different preventive scenarios and three different reactive scenarios were proposed and tested for two KPI’s: “frequency of damaged departures of the 787” and “Airport Risk factor”. Using the current wide body fleet as a reference, the prospected number of damaged departures each year was calculated. The results can be found in Table 1. The values depicted in the table are the amount of severe damages inflicted on the total 787 part of the KLM fleet, based on the amount of flights per year and the current wide body fleet. Reactive Preventive No report Current 787 No touch 787 Improved Report 787 Current situation
2.40
1.57
1.42
0.73
Best current situation1.49
0.97
0.88
0.45
Worst current situation5.41
3.54
3.21
1.64
No touch scenario0.73
0.48
0.43
0.22
Technical aids scenario0.19
0.12
0.11
0.06
The airport risk factor can be calculated by multiplying the frequency and likelihood of detection by the severity of each threat. With the risk factor KLM can rate an airport and determine if the airport is safe enough for 787 operations. If not, the risk priority factor for each threat can help indicate what barriers need to be installed. An example of the risk priority number and the total risk factor for the preventive scenarios can be seen in Table 2.
RPN * 100.000
Current
Best scenario
worst
scenario
No touch
Tech Aids
High speed
7.64
3.76
15.05
3.76
0.75
Too Late stop
8.73
8.73
15.27
3.49
0.70
Limited space
0.55
0.26
2.06
0.26
0.26
Bad positioning
15.71
7.40
39.46
2.96
0.59
Inadvertent GSE
1.31
1.31
3.93
0.26
0.26
Inadvertent AC
1.15
1.15
1.91
0.23
0.23
Total
35.08
22.60
77.68
10.96
2.79
Table 2: Risk priority number per threat and total risk factor for preventive scenarios With the improvement scenarios determined and the measurement tool proposed, concepts were developed to indicate how KLM can start to work towards a failsafe ground handling of the new composite Boeing 787. An overview of the concepts and their influence on the frequency of severe damages can be seen in Appendix H: Table of all concepts.
Conclusions:
The main research question was: “How to make the ground handling process for the 787 failsafe”. The answer to this question is that complete failsafe is impossible in the airline industry due to the large amount of variables and manual labour. However with the proposed method the influence various improvements have can be determined and this can be used as a basis for which KLM can decide what they find an acceptable risk. Based on the research sub-questions the other conclusions are:
Only 50% of the damages are reported at the station where the damage is caused.
Cargo loaders and passenger boarding devices are responsible for the majority of the damages.
The cargo loader and passenger boarding device are part of the critical process path.
A combination of the Bow-Tie and FMEA methods can provide a quantification of the risks associated with several scenarios.
In the current situation KLM would suffer 1.6 unnoticed damaged departures per year on the complete 787 fleet.
By stricter adhering the current protocol, for instance by implementing the proposed flexible guiding concept this rate could go down to 0.97 damaged Boeing 787s departing each year.
The No-touch scenario can offer an increased safety. It acts as an extra barrier for four threats and can help to reduce the ambiguity in the reporting structure. It can lead to a reduction of damaged departures to 0.43 a year. The recommended No-touch distance is 5cm.
Technical aids can exactly address the threats that have the highest risk priority number in the ground handling process. By implementing for instance park distance control, a reduction of the projected damaged departures to 0.11 a year is possible.
If the reporting is improved this can lead to a further reduction of departures with damage of almost 50%. Technical warning aids can provide extra safety. With all possible measures in place the damaged departure rate for KLM operations can go down to 0.06 a year.
Especially when the aircraft just enters service, a dedicated gate is recommended. This ensures the appropriate GSE is handling the aircraft at all times, reducing the chance of damages.
Recommendations:
The Technical University of Delft can further investigate the strength of the Bow-Tie, FMEA combination. Possibly making (parts of) it part of the curriculum.
Further research at KLM is necessary to apply the combined method and find a risk factor for which KLM finds Boeing 787 operation warranted.
KLM can convince the ground handling division of the need of improved safety measures such as the flexible guiding, No-touch protocol and technological aids such as park distance
Summary in Dutch
Uit eerder onderzoek door de NLR blijkt dat de luchtvaart industrie veel geld verliest door schades opgelopen in het grond afhandelings proces. Los van de financiële consequenties ontstaan er ook veiligheids problemen door deze schades. (Balk, Safety of ground handling, 2008) Ongeveer een op iedere 5000 vluchten leid een zware schade tijdens de afhandeling. Uit onderzoek van de NLR en uit de KLM schade database analyse kan worden geconcludeerd dat slechts 50% van de schades gerapporteerd wordt op de locatie waar deze is veroorzaakt. Alle andere schades worden pas geconstateerd op het moment dat het vliegtuig aankomt op de plaats van bestemming.
KLM heeft in totaal 23 bestellingen geplaatst voor het nieuwe Boeing 787-9 toestel, dit toestel is het eerste commercieel ingezette vliegtuig waarvan de dragende constructie voornamelijk bestaat uit composieten.(Figure 2) Deze materialen bieden een aantal voordelen, helaas heeft het ook een groot nadeel, er is nog grote onzekerheid over hoe deze materialen reageren op harde botsingen.
Onderzoek aan de Universiteit van Californië concludeerde dat the buitenste composiete ‘huid’ van het toestel na een botsing terug kan veren naar zijn oorspronkelijke vorm, dit kan potentiele schades aan de binnenkant van het toestel verhullen. (DeFrancisci, 2013) Een dergelijke situatie kan grote veiligheids problemen veroorzaken voor de luchtvaartindustrie en heeft geleid tot zorgen bij het KLM management.
Figure 2: Composiete materialen in het Boeing 787 ontwerp
Deze thesis heeft als doel een manier voor te stellen waarop de veiligheidsrisico’s in het grond afhandelings proces weg kunnen worden genomen. De algemene onderzoeksvraag behorende hierbij is “hoe kan het grond afhandelingsproces voor de Boeing 787 storingsvrij worden gemaakt?” Deze onderzoeksvraag is onderbouwd en beantwoord met de hulp van zes sub-vragen.
De eerste twee sub-vragen: “Hoeveel grond afhandelings schades doen zich voor in het huidige KLM proces?” en “Waar in het proces komen de meeste schades voor?” zijn beantwoord met gebruik van de KLM schade database. Het blijkt dat de KLM operatie 1 zware schade per 4909 vluchten leidt, dit is in dezelfde orde van grote als de industrie wijde waarde gevonden in de studie van Balk. De meeste schades bevinden zich rond de verschillende deuren van het vliegtuig, de voertuigen die het meest worden gezien als verantwoordelijk voor deze schades zijn de vracht laders en passagier instap apparatuur.
Een uitvoerige proces analyse is uitgevoerd om antwoord te geven op de vragen: “Wat zijn de risico’s in het grond afhandelings proces en hoe worden ze op het moment behandeld?” en “Waar in het huidige proces kunnen verbeteringen worden door gevoerd?” Eerst zijn een proces flow en kritieke pad analyse gemaakt van het huidige omdraai proces om in te kunnen schatten of de twee meest schade gevoelige voertuigen onderdeel uitmaken van het kritieke proces. Beide voertuigen blijken onderdeel te zijn van een kritiek pad, de passagier instap apparatuur is onderdeel van het algemene kritieke pad. De vracht lader is onderdeel van het kritieke pad voor de korte overstap bagage. Vervolgens is een nieuwe methode ontwikkeld om de risico’s in het grond afhandelingsproces te kunnen analyseren. Deze methode is een combinatie van de Bow-Tie, Tripod en Failure Mode Effect Analysis (FMEA) methodes. De huidige situatie met de 787 is gebruikt als case om deze methode te testen. De Bow-Tie en Tripod analyses zijn uitgevoerd om falende of ontbrekende veiligheids barrières te vinden in het afhandelings proces. Uit deze analyses bleek dat het niet uitvoeren van de protocollaire geleide aankoppeling van grond afhandelings apparatuur op Schiphol een groot
veiligheids risico met zich meebracht. Verder kan een No-Touch beleid dienen als extra barrière bij vier van de zeven geïdentificeerde oorzaken van schade en helpen bij het vermijden van rapportage problemen. Technologische hulpmiddelen kunnen voorzien in extra veiligheid bij ten minste drie oorzaken.
De Bow-Tie methode is een risico kwalificatie methode, om antwoord te kunnen geven op de sub-vraag: “Kan de invloed van voorgestelde verbeteringen worden gemeten?” is deze methode
gecombineerd met een FMEA. Voor de berekeningen in deze nieuwe gecombineerde methode wordt uitgegaan van de statistieken uit de KLM database gecombineerd met een geschatte effectiviteit van de barrières bepaald door acht veiligheids experts. Vier verschillende preventieve barrière scenario’s en drie verschillende reactieve barrière scenario’s zijn samen gesteld en getest op twee Key
Performance Indicators (KPI). De twee indicatoren zijn; “Frequentie van beschadigde 787s die vertrokken zijn” en “vliegveld risico factor”. De verwachte hoeveelheid van onopgemerkte
beschadigingen is berekend met de huidige Wide Body KLM vloot als een referentie. Het resultaat van deze berekening kan gevonden worden in Table 3. De weergegeven waardes in de tabel zijn de hoeveelheid beschadigde 787s ieder jaar als KLM de verwachte 23 787s in de vloot heeft die
Reactive Preventive No report Current 787 No touch 787 Improved Report 787 Current situation
2.40
1.57
1.42
0.73
Best current situation1.49
0.97
0.88
0.45
Worst current situation5.41
3.54
3.21
1.64
No touch scenario0.73
0.48
0.43
0.22
Technical aids scenario0.19
0.12
0.11
0.06
Table 3: verwachte onopgemerkte schades in de KLM 787 vloot per jaar
Het risico prioriteits nummer (RPN) kan worden berekend door de potentiele ernst van een oorzaak te vermenigvuldigen met de frequentie waarop deze oorzaak zich aandient en de kans op detectie van de oorzaak. Door de RPN van alle oorzaken bij elkaar op te tellen ontstaat de vliegveld risico factor. Met deze risico factor kan de KLM een vliegveld beoordelen en vast stellen of een bepaald vliegveld voldoet aan de veiligheidseisen voor de 787. Als dit niet het geval blijkt te zijn kan de RPN per oorzaak worden beoordeeld en kan worden gezien voor welke oorzaak extra barrières noodzakelijk zijn. Een voorbeeld van de RPN en de totale risico factor voor een aantal scenario’s kan worden gezien in Table 4.
RPN * 100.000
Current
Best scenario
worst
scenario
No touch
Tech Aids
High speed
7.64
3.76
15.05
3.76
0.75
Too Late stop
8.73
8.73
15.27
3.49
0.70
Limited space
0.55
0.26
2.06
0.26
0.26
Bad positioning
15.71
7.40
39.46
2.96
0.59
Inadvertent GSE
1.31
1.31
3.93
0.26
0.26
Inadvertent AC
1.15
1.15
1.91
0.23
0.23
Total
35.08
22.60
77.68
10.96
2.79
Table 4: RPN per oorzaak en totale risico factor per preventief scenario
Met de voorgestelde verbeter scenario’s en de meet methode afgeleid uit de Bow-Tie, Tripod en FMEA methodes zijn een aantal concepten ontwikkeld om aan te tonen hoe KLM naar een storingsvrij
grond afhandelings proces toe kan werken voor de nieuwe Boeing 787. De verschillende concepten zijn beoordeeld op basis van de mogelijk te bereiken barrière effectiviteit. Niet op basis van kosten, dit omdat veiligheid de drijfveer van dit onderzoek is. Een overzicht van de verschillende concepten en hun verwachte barrière effectiviteit kan gevonden worden in Appendix H: Table of all concepts.
Conclusies:
De algemene onderzoeks vraag was: “hoe kan het grond afhandelingsproces voor de Boeing 787 storingsvrij worden gemaakt?”. Als antwoord kan gesteld worden dan volledig storingsvrij onmogelijk is. Dit komt doordat de luchtvaart industrie een te grote hoeveelheid variabele behelst en er te veel moet worden gewerkt met menselijke arbeid. Met de voorgestelde bereken methode kan worden berekend welke invloed verschillende verbeteringen hebben op de algehele veiligheid in het
afhandelingsproces. KLM kan een minimum veiligheidsniveau bepalen en met behulp van de nieuwe reken methode, analyseren welke verbeteringen moeten worden doorgevoerd om dit niveau te halen. Ook kunnen andere bestemmingen doorgerekend worden en kan worden besloten om wel of niet met de Boeing 787 te vliegen op deze bestemmingen. Op basis van de onderzoeks sub-vragen kunnen de volgende extra conclusies worden getrokken:
Slechts 50% van de schades veroorzaakt in het grond afhandelingsproces worden gerapporteerd op de locatie waar ze daadwerkelijk zijn veroorzaakt.
Vracht laders en passagier instap apparatuur zijn verantwoordelijk voor het gros van de schades.
Zowel vracht laders als passagier instap apparatuur zijn onderdeel van het kritieke pad in het omdraai proces voor een Wide Body vliegtuig.
De combinatie van Bow-Tie, Tripod en FMEA methodes levert een nieuwe methode welke gebruikt kan worden om risico’s in verschillende scenario’s te berekenen
In de huidige situatie, met de huidige barrières, zou KLM 1,6 onopgemerkte schades hebben per jaar als er met 23 787s wordt gevlogen.
Door strikter de geldende protocollen op te volgen en op Schiphol het personeel flexibeler in te zetten om grond afhandelings voertuigen naar hun plaats te leiden kan een hoger
veiligheidsniveau worden gehaald. Hierdoor zouden er nog maar 0.97 onopgemerkte schades zijn per jaar.
Een No-Touch beleid kan een toegevoegde waarde hebben om een hoger veiligheidsniveau te halen. Het fungeert als een extra barrière voor vier van de zeven geïdentificeerde oorzaken van schade en kan helpen de onduidelijkheid in de rapportage weg te nemen. Hierdoor zou de hoeveelheid onopgemerkte schades per jaar kunnen dalen tot 0.43. de aangeraden No-Touch afstand is 5 cm.
Technologische hulpmiddelen kunnen als extra barrières dienen bij de oorzaken waarvan de RPN na het toepassen van een No-Touch procedure nog het hoogst is. Door het toepassen
van automatische passagiers bruggen en bijvoorbeeld uitgebreide parkeer assistentie kan de hoeveelheid verwachte onopgemerkte schades gereduceerd worden tot 0.11 per jaar.
Als ook de schade rapportage kan worden aangepakt kan de schade detectie toenemen met bijna 50%. Technische hulpmiddelen zoals bumpers met sensoren en verf die verkleurt bij aanraking kunnen hierbij helpen. Het aantal onopgemerkte schades per jaar kan hierdoor worden gereduceerd tot 0.06.
Als het nieuwe vliegtuig net in gebruik wordt genomen is het toewijzen van een toegewijde gate aan te raden. Door het toepassen van een toegewijde gate kan ervoor worden gewaakt dat altijd de beste maatregelen en apparatuur worden ingezet bij de afhandeling van de 787 om schades te voorkomen.
Aanbevelingen:
De technische universiteit Delft kan verder onderzoek verrichten naar de kracht van de nieuwe ontwikkelde combinatie methode. Deze methode heeft veel potentie in het
beoordelen van risico’s en kan wellicht worden toegepast in andere onderzoeks gebieden.
Verder onderzoek bij KLM kan aantonen welke risico factor voor KLM aanvaardbaar en haalbaar is. Op basis van deze vastgestelde waarde kunnen vliegvelden worden beoordeeld.
Met behulp van de voorgestelde methode kan KLM aantonen welke verbeteringen nodig zijn om een veilig gebruik van de Boeing 787 te waarborgen. Aan de hand van de resultaten kan de grond afhandelings afdeling overtuigd worden van de noodzaak van een No-Touch procedure en bijvoorbeeld het flexibel personeel concept en technologische hulpmiddelen.
List of figures
Figure 1: Composite materials in Boeing 787 design ... viii Figure 2: Composiete materialen in het Boeing 787 ontwerp... xii Figure 3: Wright brothers flight 1903 ... 2 Figure 4: First flight attendants 1930... 3 Figure 4: Boeing 747 ... 4 Figure 5: Boeing 707 ... 4 Figure 7: Boeing 787 ... 5 Figure 8: Composite materials in Boeing 787 ... 6 Figure 9: Composite test panel and loading device ... 7 Figure 10: Damage at the third test frame after high energy low velocity impact ... 8 Figure 11: detailed damage of the third frame ... 8 Figure 12: Outer surface after applying load ... 9 Figure 13: Flights Scope ... 11 Figure 14: Ground Service Equipment around aircraft in turnaround process ... 11 Figure 14: Graphical method interpretation ... 12 Figure 16: Composite and titanium door surround Boeing 787 ... 15 Figure 17: Bow-Tie analysis build-up ... 17 Figure 18: Generic Bow-Tie schematic ... 18 Figure 19: Average place of damage report ... 25 Figure 19: 2013 damage reporting ... 26 Figure 20: 2012 damage reporting ... 26 Figure 21: outstations damage reporting ... 26 Figure 22: Schiphol damage reporting ... 26 Figure 24: Damaged areas ... 28 Figure 25: Etihad damaged areas ... 29 Figure 26: Damaging processes ... 30 Figure 27: Type of incident ... 31 Figure 28: Equipment causing damage ... 32 Figure 29: current turnaround process with critical path ... 35 Figure 30: Baggage critical path ... 36 Figure 31: Bow-Tie hazard and top event ... 41 Figure 32: Late stop hazard ... 42 Figure 33: Inadvertent movement of GSE hazard ... 43 Figure 34: Inadvertent movement of AC hazard ... 43 Figure 35: Bad Positioning hazard ... 44 Figure 36: Limited manoeuvring space hazard ... 45
Figure 37: High speed on handling area hazard ... 46 Figure 38: Aircraft departs with damage effect ... 46 Figure 39: AC is AOG effect ... 47 Figure 40: Damage to GSE effect ... 47 Figure 41: Tripod for Guided docking ... 49 Figure 42: High loader speed settings ... 50 Figure 43: High loader bumpers ... 51 Figure 44: Tripod for incident reporting ... 51 Figure 45: PDSC tripod ... 53 Figure 46: High-loader control panel ... 55 Figure 47: ramp damage checkers ... 56 Figure 48: Frequency of top event ... 61 Figure 49: Damage contribution per threat ... 62 Figure 50: Graphical interpretation of natural threat calculation ... 64 Figure 51: Risk scenario frequency graph ... 68 Figure 52: Yearly damages departures of the Boeing 787 ... 70 Figure 53: Risk factor per threat and scenario Boeing 787 ... 72 Figure 54: Flexible personnel concept ... 78 Figure 55: Neutral switch cargo loader ... 79 Figure 56: Lathe gear selector ... 80 Figure 57: damaged loader and cargo door ... 82 Figure 58: safety zones automatic brake ... 85 Figure 59: BMW park distance control ... 86 Figure 60: Park distance control display ... 87 Figure 61: Driving lines on park assistance ... 88 Figure 62: Hand throttle ... 89 Figure 63: ThyssenKrupp and Indal automated docking system ... 90 Figure 64: distance sensor for speed control ... 91 Figure 65: A380 triple boarding bridge ... 92 Figure 66: Sensors near passenger door 1 on the Boeing 787 ... 93 Figure 67: Boeing proposed handling of the 787-8 ... 94 Figure 68: Rockford systems safety bumper ... 97 Figure 69: Microcapsules in bruisable paint ... 98 Figure 70: Bruisable paint example ... 99 Figure 71: Example reactive barriers ... 1 Figure 72: Example reactive barrier calculation ... 1 Figure 73: Example preventive barriers ... 2
List of abbreviations
AC: AirCraft
AHM: Aircraft Handling Manual
AOG: Aircraft On Ground: Term in aviation maintenance indicating that the aircraft is technically not airworthy.
ERA: Equipment Restraint Area. The designated area on the airport ramp where an aircraft will park for the turnaround process. Equipment movement is restraint in this area.
FMEA: Failure Mode Effect Analysis. Technique to quantify risks in processes and systems
FOD: Foreign Object Debris. A substance, debris or article alien to a vehicle or system which would potentially cause damage.
GOMS: Ground Operations Manual Schiphol.
GPU: Ground Power Unit. Provides the aircraft with electrical power when it is parked at the ERA. GSE: Ground Service Equipment: Any piece of equipment used in the ground handling of an AC.
For instance; Stairs, High loaders, Fuel truck etcetera. GSOM: General Safety and Operations Manual
IATA: International Air Transport Association. A trade association representing and serving the airline industry world-wide.
ISAGO: IATA Safety Audit program for Ground Operations KLM: Koninklijke Luchtvaart Maatschappij: Royal Dutch Airlines KPI: Key Performance Indicator
PDSC: Pre Departure Service Check
RPN: Risk Priority Number. The result of a FMEA, with this number the risk can be categorized SHOCON: Short Connection. Can apply to both passengers and baggage. Means a connection time of
less than 90 minutes. These passengers and baggage have priority in the ground process. SPL: The IATA airfield code for Amsterdam Schiphol Airport.
ULD: Unit Load Device. A special load bearing unit with standardized dimensions, for instance; container, pallet, etc.
Table of Contents
Preface ... ii Acknowledgements ... iv Summary ... viii Summary in Dutch ... xii List of figures ... xviii List of abbreviations ... xxii 1. Introduction ... 2
1.1 Background Information ... 2 1.1.1 Problem introduction ... 6 1.2 Problem Definition ... 10
1.2.1 Research objectives ... 10 1.2.2 Main research question ... 10 1.2.3 Sub questions ... 10 1.3 Research scope ... 11 2. Research approach and Methodologies ... 12
2.1 Approach ... 12 2.2 Used methods ... 14 2.2.1 Data Analysis methods ... 14 2.2.2 Process flow and Critical path method ... 15 2.2.3 Bow-Tie method ... 16 2.2.4 Failure mode effect analysis method ... 19 2.2.5 Delphi Expert opinion method ... 20 2.2.6 Concept generation method ... 22 2.3 Structure of the report ... 23 3. Damage data analysis ... 24
3.1 Amount of damages ... 24 3.1.1 Sub-Conclusion Amount of damages ... 24 3.2 Damage reporting ... 25
3.2.1 Sub-Conclusions damage reporting ... 26 3.3 Damaged areas ... 28
3.3.1 Sub-Conclusions damaged areas ... 29 3.4 Process causing damage ... 30 3.4.1 Sub-Conclusions process causing damage ... 30 3.5 Type of incident ... 31 3.5.1 Sub-Conclusions type of incident ... 31
3.6 Equipment causing the damage ... 32 3.6.1 Sub-Conclusions equipment causing the damage ... 32 3.7 Sub-Conclusions damage data analysis ... 33 Process analysis ... 34 4. Process flow and critical path analysis ... 34
4.1 Process flow and critical path for current process ... 35 4.2 Sub-Conclusions Process flow and critical path ... 38 5. Bow-Tie analysis ... 40
5.1 Bow-Tie for current process ... 41 5.1.1 Top event: ... 41 5.1.2 Hazards ... 41 5.1.3 Consequences... 46 5.2 Bow-Tie issues ... 49
5.2.1 Current barrier issues ... 49 5.2.2 Missing barriers... 53 5.3 Sub-Conclusions Bow-Tie analysis ... 57 6. Failure Mode Effect Analysis ... 58
6.1 Quantifying research parameters ... 59 6.1.1 Delphi method results ... 59 6.2 Combining FMEA and Bow-Tie ... 61 6.2.1 Frequency and barrier effectiveness calculation ... 61 6.2.2 Risk Scenarios ... 64 6.3 Results from FMEA and Bow-Tie ... 67 6.3.1 Projected frequency of departures with damage ... 67 6.3.2 Total risk factor for an Airport ... 70 6.4 Sub-Conclusions FMEA and Bow-Tie combination ... 74 7. Concepts ... 76
7.1 Concept areas ... 76 7.2 Preventive barrier concepts ... 77 7.2.1 Current best scenario barrier concepts ... 77 7.2.2 No touch scenario barrier concepts ... 80 7.2.3 Technical aids barrier concepts ... 84 7.3 Reactive barrier concepts ... 96
7.3.1 No Touch reporting concepts ... 96 7.3.2 Improved reporting concepts ... 97
Conclusions ... 104 Recommendations... 106 Bibliography ... 108 Appendix A: Scientific research paper ... 1 Appendix B: Example Damage database entry ... 1 Appendix C: Delphi Expert Opinion Results ... 1 Appendix D: Bow-Tie for current Process ... 1 Appendix E: Bow-Tie improved process ... 1 Appendix F: Process flow map and critical path ... 1 Appendix G: Scenario calculation example ... 1 Appendix H: Table of all concepts ... 1
1. Introduction
This thesis contains 7 chapters including the introduction. In this chapter the topic and the problem definition is explained accompanied with the required background information. In section 1.1 the background information of the problem is given followed by the problem definition itself in section 1.2. In this section the goal of this thesis and the main research question is explained. This chapter completes with an explanation of the scope of the research in section 1.3.
1.1
Background Information
With the first manned flight by the Wright brothers on the 7th of December 1903 a new and exciting
way of possible transportation became reality (Tise, 2009). Although the Wright brothers were not the first to attempt flying, they did make the first sustained, controlled, powered heavier-than-air manned flight.
Figure 3: Wright brothers flight 1903
The first aircraft could barely sustain their own weight in the air but they developed fast. The first commercial passenger flights occurred as early as 1911 (Carey, 2013). Although these first so called airliners were not very comfortable.
After the war the first airlines emerged, the Royal Dutch Airlines (KLM) was founded in 1919 being the oldest airline in existence today (KLM, 1999).
The world's first all-metal aircraft was the Junkers F.13, also from 1919 with 322 built. The Dutch Fokker company produced the Fokker F.II followed by its development the F.III. These aircraft were used by KLM when it re-opened an Amsterdam-London service in 1921. The Fokkers were soon flying to destinations across Europe, including Bremen, Brussels, Hamburg and Paris. They proved to be very reliable aircraft.
Concerns about the safety of airplanes kept many people from flying. In 1926, however, the Air Commerce Act, which established regulations and requirements for pilots and airlines and also defined an air-traffic system, improved consumer confidence in the airline industry
By the 1930s, the airliner industry had matured and large consolidated national airlines were established with regular international services that spanned the globe, including Imperial Airways in Britain, Lufthansa in Germany, KLM in the Netherlands and United Airlines in America. Multi-engine aircraft were now capable of transporting dozens of passengers in comfort. (Crouch, 2004)
In the early years, most flight attendants were women, and the airlines often required that they remain unmarried in order to retain their jobs. Airlines also instituted age, height, and weight restrictions. Flight attendants were expected to provide a glamorous and pleasant image for airlines. During this time, employee turnover was very high. However, as the role of the flight attendant became more important and as regulations required them to perform more safety-oriented tasks, the image of the flight attendant changed as well. (Barry, 2007)
Figure 4: First flight attendants 1930
The first modern-looking sleek metal airliners also came into service in the 1930s. In 1932, in the United States, the 14-passenger Douglas DC-2 flew and in 1935 the more powerful, faster, 21–32 passenger Douglas DC-3. DC-3s were produced in quantity for World War II and sold as surplus afterward. The Douglas DC-3 was a particularly important airplane, because it was the first airliner to be profitable without a government subsidy. (Mellberg, 2003)
Long-haul flights were expanded during the 1930s as both Pan American Airways and Imperial Airways competed in the provision of transatlantic travel using flying boats such as the British Short Empire and the American Boeing 314. This prefigured the dramatic growth of transatlantic travel in the post-war period.
After World War II the first jet-powered airliners were developed. In 1952 the De Havilland comet was the first jet powered airliner to go into service. However after a number of accidents, were the aircrafts fuselage had burst apart due to fatigue, all comets were grounded. The Russian made Tupolev Tu-104 was the only jet powered passenger aircraft in use in the period between 1956 and
1958. (Tise, 2009)
Although it was not the first jetliner in service, the Boeing 707 was the first to be commercially successful. Dominating passenger air transport in the 1960s and remaining common through the 1970s, the 707 is generally credited with ushering in the Jet Age. (Wilson, 1998) It established Boeing as one of the largest manufacturers of passenger aircraft.
Boeing then developed the first wide body, twin engine passenger airline in 1970. The now iconic 747 has held the passenger capacity record for 37 years and the nickname Jumbo Jet has become a synonym for all large aircraft. (Irving, 1993) The European based company Airbus wants to compete with Boeing and this has sparked a fierce competition in passenger jet manufacturing.
Airbus has aimed at the largest segment of the market with the introduction of the Airbus A-380 super Jumbo with a capacity up to 800 passengers, Boeing has gone for a different route introducing the smaller but more economic Boeing 787.
Figure 7: Boeing 787
To make the Boeing 787 more economic drastic measures were taken. 80% in volume and 50% of the weight of the aircraft consists of composite materials. This combined with more economic engines can save up to 20% in fuel consumption according to Boeing. (Hawk, 2005)
1.1.1 Problem introduction
Research by the NLR suggests that a ground handling incident occurs in about 1 in 5000 flights. (Balk, Safety of ground handling, 2008). About half of the damages are reported immediately when they happen, the other half is found at the destination airport. Most damages to aluminium aircraft are found via visual inspection. Dents, scratches and holes indicate where the aircraft was hit and if it needs repair or extra investigation.
The 787 is the first aircraft to use composite materials in large load bearing sections of its design. Since this is the first time the composites are used on such a large scale it also imposes new challenges.
Figure 8: Composite materials in Boeing 787
As can be seen in Figure 8 large sections of the fuselage and wings are constructed out of carbon laminate. This material behaves differently than the conventional aluminium aircraft construction when hit by GSE.
According to Boeing composite structures have a lot of advantages over conventional aluminium designs (Boeing, 2006):
An average of 20 per cent weight savings
Greatly reduced maintenance due to fatigue
Reduced scheduled and non-routine maintenance
Less corrosion problems
Comparable repair times and skills required as on conventional AC
Boeing furthermore stated that the composite structure is more impact resistant than conventional aluminium designs. According to Boeing when there is no visual damage apparent, even after a known impact, the AC should be fit to fly.
Of course the statements made by Boeing sparked a lot of controversy among aerospace and composite experts. One of the early investigations on the proposed airframe structure of the Boeing 787 was conducted by the university of California (Kim, 2012), this research was later expanded by (DeFrancisci, 2013) and (Mikulik & Haase, 2012). The researches questioned the impact resilience and damage detectability claimed by Boeing.
The first conclusions from (Kim, 2012) depicted: “Experiments representing GSE impact on a curved stiffened skin structure (five frames, four stringers) at a velocity of 0.5 m/s has shown complete failure of the three frames that were impacted. The exterior skin, however, exhibited no cracks and imperceptible levels of permanent deformation.” This completely contradicts the claims by Boeing that if there was no apparent damage, the airplane would be fit to fly.
For the research by (Mikulik & Haase, 2012) a composite test panel was created and repeatedly loaded with a commonly used GSE bumper. (Figure 9)
Figure 9: Composite test panel and loading device
The load applied corresponds with a High Energy Low Velocity (HELV) impact, considering an incident scenario involving a 2000 kg vehicle at 0.3 m/s (lower limit) and an impact of a 5000 kg vehicle at 1.2 m/s (upper limit) yielded an energy level range between 90 J and 3600 J. The panel was
Figure 10: Damage at the third test frame after high energy low velocity impact As can be seen multiple stringers are cracked, sheered or showing signs of significant delamination. The frame itself is clearly bent and twisted out of shape.
Figure 11: detailed damage of the third frame
The failure initiation energy threshold was found to be 1270 J, which corresponds with an impact of a 2500 kg vehicle at 1 m/s.
When the panel was removed from the testing setup, the outer skin was closely inspected for signs of damage. “Visual examination and ultrasonic A-scan inspection failed to detect growing delaminations in the shear tie radii. The outer skin surface exhibited no visual signs of impact such as scratches or dents.
Furthermore, the identification of the failure of the shear ties along the frame attachment rivet line was not practically possible from an external examination.” (Mikulik & Haase, 2012)
The test panel after loading can be seen in Figure 12. There are no visual marks or dents on the panel, even rubber residue could not be found.
Figure 12: Outer surface after applying load
The above investigations reveal a large problem concerning the use of composite structures in airplane design. Unfortunately ground handling related damaged do and will occur, also in the future. This is mainly due to the high amount of manual labour on a typical platform. It would be nice to think that all the people working near aircraft were highly trained and responsible people, who would report any incidents, but the reality is that if you pay peanuts, you get monkeys. Also if someone is likely to lose their job then a cover up is going to happen.
This poses a large threat for the Boeing 787 and for the airline industry as a whole. With the introduction of the composite Boeing 787 and the composite competitor, the Airbus A350 XWB, the airline industry needs to address these issues to keep the operations safe.
When the De Havilland Comet was introduced in 1952 it was the first jet powered commercial aircraft. After three years the first accidents with the Comet started to occur due to unforeseen fatigue issues. With a technique as new as the composites used in the Boeing 787 and the Airbus A350 all possible measures need to be taken to avoid a repetition of history.
1.2
Problem Definition
In this sub-chapter the goal of the research, the objectives and the research questions will be introduced
1.2.1 Research objectives
As introduced in the previous sub-chapter there is a concern within the KLM Company on damages to the new composite 787 in the ground handling process. The main goal of this research is therefore to take away this concern by developing a failsafe ground handling process.
The research objectives are to identify the common risks in the ground handling of the 787. To propose ways to reduce the chance of damages occurring and to deliver a method with which KLM can quantifiably measure the risks present and the impact of the measures.
1.2.2 Main research question
The main research question directly leads from the research objectives and becomes:
“How to make the ground handling process for the 787 failsafe”
In this research question the failsafe part indicates the need for a measurement tool
1.2.3 Sub questions
To back-up and elaborate the proposed research question, some sub questions are required.
How many ground handling damages occur in the current KLM ground processes?
Where in the process are the damages caused?
What are the risks on the ground handling process and how are they currently handled?
Where in the current ground handling process can improvements be made?
Can the impact of the proposed improvements be measured?
In what ways can the improvements be executed at KLM?
Resulting from these six additional questions, this thesis will comprehend an extensive data research, a thorough process and risk analysis, and a proposed set of solutions for KLM.
1.3
Research scope
This research is conducted for KLM, therefore only the KLM situation will be studied. This means that the damages considered are all derived from the KLM damage database. Since the 787 is a long haul wide body aircraft, only the damages to wide body aircraft are taken into consideration. A graphical interpretation of the scope can be seen in Figure 13.
Figure 13: Flights Scope
KLM will receive a total of 23 Boeing 787’s which will fly to multiple destinations. Every proposed solution and analysis therefore must be applicable at all KLM destinations and the KLM main hub Schiphol.
Only the damages inflicted in ground handling activities will be assessed. The ground handling starts when the aircraft approaches the gate and enters the ERA. The ground handling is finished when the aircraft is pushed back from the gate onto the runway or taxiway.
Figure 14: Ground Service Equipment around aircraft in turnaround process All Flights all Airlines
All KLM Flights Wide Body
2. Research approach and Methodologies
In this chapter the research approach and methodologies will be further specified. First the overall research approach will be addressed. In 2.2 the various methods used to conduct the research will be explained and in 2.3 the overall structure of the report will be presented.
2.1
Approach
The research approach is heavily based on finding an answer to the main research question. To be able to work towards an answer the research questions were formulated. The research sub-questions are the guideline for the complete thesis work. By answering the sub-sub-questions consecutively a final conclusion and answer can be found to the main research question.
The first two research sub-questions; “How many ground handling damages occur in the current KLM ground processes?” and “Where in the process are the damages caused?” were answered using the known KLM damage database. The method used to analyse these data can be found in 2.2.1. After the data analysis the focus of the thesis is clear. The two most contributing GSE are further
investigated to gain a better insight in the risks. First a process flow and critical path analysis will be conducted to provide insight into the place these vehicles take in the ground handling process. The used process flow and critical path method will be explained in 2.2.2. To answer the research questions: “What are the risks on the ground handling process and how are they currently handled?”
and “Where in the current ground handling process can improvements be made?” a risk qualification method called Bow-Tie analysis is used. This is a method used at KLM and it will be explained in 2.2.3. The Bow-Tie is elaborated with the Tripod method to analyse all barriers. With the risks and potential improvements identified the next research sub-question becomes paramount: “Can the impact of the proposed improvements be measured?” A commonly used risk quantification method is the Failure Mode Effect Analysis (FMEA) this will be explained in 2.2.4. The FMEA and Bow-Tie both handle a part of a risk identification and quantification. In this thesis these two methods were combined for the first time and the overlap in both methods was used to answer the sub-research question. A graphical interpretation of the overlap in both methods can be seen in Figure 15.
Bow-Tie Identification
FMEA
Quantification
Figure 15: Graphical method interpretation Used
With the method to measure the effect of certain improvements determined, a couple of scenarios can be calculated. To answer the last sub-question: “In what ways can the improvements be executed at KLM?” the various options KLM has to implement the proposed improvements will be assessed using the methods described above. This eventually leads to an answer to the main research question: “How to make the ground handling process for the 787 failsafe”
The proposed combination of methods eventually supplies a risk analysis method that can be used on numerous other occasions. The 787 analysis therefore can be seen as a test case for the combined risk analysis method.
2.2
Used methods
In the previous sub-chapter the approach of the thesis research was introduced. The used methods were mentioned, these will be further specified in the coming sub-chapters.
2.2.1 Data Analysis methods
For the analysis of the data the KLM’s own damage database was used.
Damages reported to wide body KLM aircraft in 2011, 2012 and 2013 were selected. All stations were considered, so damages caused either at Amsterdam Schiphol airport or at one of the outstations. KLM plans to handle the Boeing 787 no different than the current wide body fleet, hence the use of all wide body statistics is justified.
Damage reports for KLM are centrally collected; each damage report consists of a number of data entries describing the context of the damage. The date of occurrence or discovery, the flight number, the origin and destination airport and the airport attributed as causing the damage. Some entries describing the damage itself; the damaged part of the aircraft, the cause of the damage, the equipment involved, the consequence, the process in which the damage was caused and the risk category of the damage.
An example of some entries in the damage database can be found in Appendix B: Example Damage database entry.
Since the interest for this research lies in the avoidance of composite damages, all internal damages to the aircraft were discarded. For instance damaged hold liners or bulk floors and damages in the cabin.
To further specify the damages of interest only the damages to the parts that are going to be made out of composite are selected. This means damages to the landing gear, engines and external power panels are omitted.
At the doors the decision was made to omit the damages to the door seals. These seals are not made out of composite material and damages mainly occur due to faulty loading of pallets and ULD’s. Not due to equipment. Of course these damages need to be addressed but they do not take part in this investigation.
Boeing recognized the difficulties with composite door surrounds so they made these from titanium. In Figure 16 an overview of the Boeing 787 door surround can be seen. The titanium parts can be clearly distinguished by their white colour while the composite parts are green.
Figure 16: Composite and titanium door surround Boeing 787
The titanium part will dent just like aluminium and this is relatively easy to replace. However in the damage statistics the door surround is mentioned but not clearly defined. Some damages to the fuselage around the door will be filed as door surround while it is actually damage to the parts outside of the actual door surround and vice versa. Damage to the door surround can be caused by mishandling of the load (ULS or Pallet) or by the GSE and is therefore possibly preventable. Damage to a door surround will take a lot of time to repair causing big delays. Because of these reasons the damage to the door surround will be taken into account in the investigation. The doors of the aircraft are made out of composite material and can only be damaged by the GSE therefore these are taken into account as well.
During the analysis of the damage statistics a constant comparison with previous researches from the NLR and IATA will be made to verify the found data and confirm the conclusions.
2.2.2 Process flow and Critical path method
A critical path analysis can indicate where certain sub-processes are positioned in the overall
processes. It can also help indicate if the sub-processes are restrained by the overall time plan of the process or if more time is available to complete the sub-process.
2.2.2.1
Process flow
A process flow diagram is often used to get a better overview of the time plan in a process. It puts the process time on the horizontal axis and the processes on the vertical. For every process the prospected starting time and process time are filled in and plotted on the time axis. The different processes can then be ordered on starting time to provide a clear time/process overview of all processes in the complete system. The process flow diagram serves as a basis for the critical path analysis.
2.2.2.2
Critical Path analysis
Operational researchers developed a method of scheduling complex projects shortly after WWII. It is sometimes called network analysis, but is more usually known as a critical path analysis. (Woolf, 2012) The critical path analysis consists of a time plan of the complete process. Some processes can operate simultaneously others cannot. For every part of the process the minimum time to complete is indicated as well as the processes required to precede the indicated process. For instance when the construction of a house is investigated, the construction of the roof cannot take place before the walls are erected. Therefore the roof process has to be preceded by the wall process. (O'brien & Plotnick, 2010) Eventually there is one ‘path’ in which the processes are represented that have to succeed each other and combine to the shortest path that confines the total time for the process. This is called the critical path. If one activity of the critical path is delayed, the entire project will be delayed. The activities in the critical path have zero slack. Slack can be defined as the difference between the earliest and latest allowable start or finish times of an activity (Willis, 1985).
2.2.3 Bow-Tie method
The exact origins of the Bow-Tie methodology are a little hazy. The earliest mention appears to be an adaptation from the ICI Plc. Hazan Course Notes, presented at the University of Queensland
(University of Queensland, 1979)
Undoubtedly, the Royal Dutch/Shell Group was the first major company to integrate fully the total Bow-Tie methodology into its business practices (M.J. Primrose, 1996) and is credited with developing the technique which is widely in use today. The primary motivation was to seek assurance that fit-for-purpose risk controls were consistently in place throughout all operations world-wide.
The catastrophic incident on the Piper Alpha platform in 1988 awoke the oil & gas industry. After the report of Lord Cullen, who concluded that there was far too little understanding of hazards and their accompanying risks that are part of operations, the urge rose to gain more insight in the causality of seemingly independent events and conditions and to develop a systematic/systemic way of assuring control over these hazards.
Following Shell, the Bow-Tie method rapidly gained support throughout the industry, as Bow-Tie diagrams appeared to be a suitable visual tool to keep overview of risk management practices, rather than replacing any of the commonly used systems.
In the last decade the Bow-Tie method also spread outside of the oil & gas industry to include aviation, mining, maritime, chemical and health care to name a few.
The Bow-Tie method is a risk evaluation method that can be used to analyse and demonstrate causal relationships in high risk scenarios. The method takes its name from the shape of the diagram that you create, which looks like a men’s bowtie. A Tie diagram does two things. First of all, a Bow-Tie gives a visual summary of all plausible accident scenarios that could exist around a certain Hazard. Second, by identifying control measures the Bow-Tie displays what a company does to control those scenarios (Figure 17).
Figure 17: Bow-Tie analysis build-up
However, this is just the beginning. Once the control measures are identified, the Bow-Tie method takes it one step further and identifies the ways in which control measures fail. These factors or conditions are called Escalation factors. Control measures are depicted as barriers, measures that prevent a certain event from happening due to a certain cause. There are possible control measures for Escalation factors as well, which is why there is also a special type of control called an Escalation factor control, which has an indirect but crucial effect on the main Hazard. By visualizing the
interaction between Barriers and their Escalation factors one can see how the overall system weakens when Barriers have Escalation factors.
2.2.3.1
How does a Bow-Tie work
As stated in the previous sub-chapter the Bow-Tie method links causes and consequences to a certain loss event. The Bow-Tie comprises of a set amount of parts; the hazard, the main event, threats or causes, consequences or results and barriers. These are ordered according to the Bow-Tie schematic.
Figure 18: Generic Bow-Tie schematic
The first thing to do in a Bow-Tie therefore is to choose the main event and its context. In this chapter flying an aircraft will be used as an example. The context of the event is the so called hazard. What has the potential to cause harm? In our example the hazard is the actual flying of an aircraft. The top event is the event that happens when control is lost over the hazard. So for our example the top event would be the loss of control during flight.
There are several causes that can lead to this loss of control. These are displayed on the left of the Bow-Tie schematic. Risk management is all about preventing these causes to lead to the top event. To do this, barriers are installed. The barriers on the left side of the schematic are called preventive barriers since they try to prevent a cause from leading to the top event.
When the top event does happen, this can lead to a number of unwanted results or consequences; these are listed on the right side of the schematic. There are also barriers on this side of the Bow-Tie, these are called reactive barriers. These barriers are designed to prevent or minimise the top event from leading to a certain unwanted consequence or reducing the severity of this consequence. All barriers can be assessed on their effectiveness. No barrier is 100% effective except for a barrier that stops the hazard from happening. In that case the whole Bow-Tie is irrelevant so we will omit this result, since for our example not flying would be 100% barrier but no option.
With this Bow-Tie method the possible risks for a process can be explored. It visualises the risks and the methods to prevent these risks. It can also indicate failing or missing barriers.
The effectiveness or failure of a barrier can be explored by the use of escalation factors. An escalation factor is something that can lead to the dysfunction of a presumed barrier. If we look at our example of preventing loss of control during the flying of an aircraft, a cause to loss of control could be stalling. A barrier to prevent loss of control due to stalling could be a stall speed warning light. If we assess the warning light as a barrier there a several escalation factors to this barrier. For instance, the pilot could not react to the warning light. This could be due to; a faulty light bulb, blockage of the line of sight, inattention of the pilot etc. these possible failure mechanisms are called the escalation factors for a barrier.
2.2.3.2
Tripod Method
To analyse the escalation factors and barriers in the Bow-Tie method the tripod method was used. The tripod method is an iterative method that investigates the root cause of a failing barrier. This is conducted using three steps:
1. What was the sequence of events? 2. How did it happen, what barriers failed? 3. Why did the barriers fail?
It essentially regards every barrier as a separate process and investigates the sequence in which the barrier can fail. For every cause indicated as the potential cause why the barrier failed, again a tripod is constructed. The first set of causes are called the immediate causes. The second set of causes, the cause of the immediate cause, are called preconditions.
With the complete set of preconditions an underlying cause can be identified. The underlying cause is the reason why the preconditions exist. If the underlying causes are addressed the preconditions will be resolved and eventually the immediate causes will be resolved as well. That makes the Tripod a very interesting risk analysis method. (Stichting Tripod Foundation, 2008)
2.2.4 Failure mode effect analysis method
Failure modes and effects analysis (FMEA) is a step-by-step approach for identifying all possible failures in a design, a manufacturing or assembly process, or a product or service.
It was one of the first systematic techniques for failure analysis. It was developed by reliability engineers in the 1950s to study problems that might arise from malfunctions of military systems. An FMEA is often the first step of a system reliability study. Ideally, FMEA begins during the earliest conceptual stages of design and continues throughout the life of the product or service. It involves reviewing as many components, assemblies, and subsystems as possible to identify failure modes, and their causes and effects. (Rausand & Hoylan, 2004)
FMEA is a way to quantify different risks of failure in a system. It can also be used to compare certain solutions based on a risk factor to be calculated.
This common risk factor is known as the Risk Priority Number (RPN), it can be calculated for each individual risk or added together to get the total Risk Factor for a system.
The Risk Priority Number (RPN) can be calculated using equation 2-1
(2-1)
will be identified to be a number between 0 and 1. 1 being very severe, 0 being no consequence, if this threat was to become reality. The actual number assigned to the threat has to be dependent on the variable of interest. Some threats pose a large potential monetary loss but appear to be less severe for human injury.
Frequency is the number of times the threat is suspected or expected to occur. The frequency is also indicated with a number between 0 and 1. Here the 1 represents the scenario in which the threat always happens. The 0 indicates the situation where it never happens. The actual frequency of a threat occurrence can therefore be calculated based on historical data.
Likelihood of detection is the chance of the happened threat being detected. A detected threat can be prevented where an undetected threat can cause great consequences. The likelihood of detection is also graded between a 1 and a 0. The 1 is the chance of the threat going completely undetected every time. The 0 is the chance of the threat being detected every time it occurs.
By using equation (2-1) it can be seen that a very severe threat with a high frequency of occurrence and a low likelihood of detection will generate a RPN of almost 1. A low severity threat with a low frequency and high likelihood of detection will generate a RPN close to 0.
Of course the RPN of a high severity threat can be lowered by decreasing the frequency of occurrence or increasing the likelihood of detection.
2.2.5 Delphi Expert opinion method
The name of the Delphi method is derived from the oracle of Delphi. The Delphi technique is a widely used and accepted method for gathering data from respondents within their domain of expertise. The technique is designed as a group communication process which aims to achieve a convergence of opinion on a specific real-world issue (Hsu & Sandford, 2007). The Delphi technique is well suited as a method for consensus-building by using a series of questionnaires delivered using multiple
iterations to collect data from a panel of selected subjects.
2.2.5.1
Common Delphi Method
Theoretically, the Delphi process can be continuously iterated until consensus is determined to have been achieved, however common practice is three iterations, they are found to be sufficient to reach a consensus in most cases. (Cyphert & Gant, 1971)
The Delphi process consists of three rounds although the third round can be repeated various times to achieve consensus.
Round 1: In the first round, the Delphi process traditionally begins with an open-ended questionnaire. After receiving subjects’ responses, investigators need to convert the collected information into a well-structured questionnaire. This questionnaire is used as the survey instrument for the second round of data collection. It should be noted that it is both an acceptable and a common modification of the Delphi process format to use a structured questionnaire in Round 1 that is based upon an extensive review of the literature. The use of a modified Delphi process is
appropriate if basic information concerning the target issue is available and usable. (Hsu & Sandford, 2007)
Round 2: In the second round, each Delphi participant receives a second questionnaire and is asked to review the items summarized by the investigators based on the information provided in the first round. Accordingly, Delphi panellists may be required to rate or “rank-order items to establish preliminary priorities among items. As a result of round two, areas of disagreement and agreement are identified” (Ludwig, 1997)
Round 3: In the third round, each Delphi panellist receives a questionnaire that includes the items and ratings summarized by the investigators in the previous round and are asked to revise his/her judgments or “to specify the reasons for remaining outside the consensus”. This round gives Delphi panellists an opportunity to make further clarifications of both the information and their judgments of the relative importance of the items. However, compared to the previous round, only a slight increase in the degree of consensus can be expected (Cyphert & Gant, 1971)
Round 4: In the fourth and often final round, the list of remaining items, their ratings, minority opinions, and items achieving consensus are distributed to the panellists. This round provides a final opportunity for participants to revise their judgments. It should be remembered that the number of Delphi iterations depends largely on the degree of consensus sought by the investigators and can vary from three to five (Ludwig, 1997)
2.2.5.2
Used Delphi method
For the Delphi research conducted at KLM, the expert group consisted of eight experts from the Ground Service Operational Integrity department. The modified Delphi method was used to provide the experts with a ready list of possible barriers derived from the Bow-Tie analysis and AHM.
Round 1: In round one all experts received a list of possible causes with their barriers in alphabetical order. They were asked to put the barriers in order of effectiveness by grading the barriers. A number one being the most effective barrier for that cause, the higher the number the lower the proposed effectiveness. The grade itself not being of numerical value but only to indicate the order in which the respondent thought the barriers should be. The causes themselves were put in order of severity. Round 2: For round two the experts received an ordered list based on the average order of the first round. Now they were asked to add an assumed percentage of effectiveness to each barrier rounded
