A hybrid model for learning from failures Expert Systems With Applications 93 (2018) 212–222 Contents lists available at ScienceDirect Expert Systems With Applications journal homepage: www.elsevier.com/locate/eswa A hybrid model for learning from failures Calvin Stephen a , Ashraf Labib b , ∗ a University of Manchester, School of Mechanical Aerospace and Civil Engineering, M13 9PL, UK b University of Portsmouth, Operations and Systems Management Group, Portsmouth PO1 3DE, UK a r t i c l e i n f o Article history: Received 4 August 2017 Revised 22 September 2017 Accepted 12 October 2017 Available online 14 October 2017 Keywords: Decision analysis Multiple criteria Decision making a b s t r a c t In this paper we propose the usage of a hybrid of techniques as complementary tools in decision analysis for learning from failures and the reason behind systems failure. We demonstrate the applicability of these tools through an aviation case study, where an accident investigation report was obtained from the Directorate of Accident Investigation in the Ministry of Transport and Communications in Botswana to provide as a basis for the application of the model. The report included all the factual information required to carry out the investigation using the hybrid of FTA, RBD, AHP, HoQ and the DMG tools. We discuss the steps followed in applying the tools in the process of learning from failure. It also shows the importance of such tools in accident investigations by showing the importance of prioritising the available options in order of their importance to the accident under investigation. Most of the available research in learning from failure focuses mostly on the direct causal factors of the failure event. Here we provide a holistic approach to learning from failure by focusing on both direct and indirect causes of a failure event through the use of Reliability Engineering tools, Multi Criteria Decision Making tools and House of Quality. © 2017 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY license. ( http://creativecommons.org/licenses/by/4.0/ ) b c i t e a e r a n w a s a r o 1. Introduction In many organisations failure is always the cause of conflicts as they have inherited a blame and lack of trust culture ( Cox, Jones, & Collinson, 2006 ; and Jefcott, Pidgeon, Weyman, & Walls, 2006 ). Even though this is the case, some organisations view failure as an opportunity to obtain lessons for continual improvement hence a chance of gaining competitive advantage over their nearest rivals. Failure can be defined in many different ways of which the use is influenced by the context it is used on. Torell and Ave- lar (2010) described failure in two distinct ways as the inability of a product or system to perform its required function and also as the inability of a component to perform its required function without hindering the function of the product as a whole. The ability to learn from failures helps organizations, engineers and designers to put in place measures to avert the same inade- quacies from re-occurring. Labib (2015) explains that for clear un- derstanding of the causes of a failure, there is a major need to analyse four factors, which are; human, design, organizational and socio-cultural factors. ∗ Corresponding author. E-mail addresses: calvin.stephen@postgrad.manchester.ac.uk (C. Stephen), ashraf.labib@port.ac.uk (A. Labib). i s l c i https://doi.org/10.1016/j.eswa.2017.10.031 0957-4174/© 2017 The Authors. Published by Elsevier Ltd. This is an open access article u By doing so Labib and Read (2015) suggested that four main enefits could be obtained that include easy identification of root auses of the failure and the associated reasons. The other benefit s that such analysis of failure can help to institute long term plans o prevent similar events from re-occurring and can also act as an arly warning signal just prior to the event in order for defensive ctions to be taken. They also suggested that it helps decision mak- rs with information on priorities for resource allocation for both ecovery and prevention. Labib and Read (2015) proposed categorising of causal factors s either direct cause or contributing factors when dealing with atural disasters. This approach can also be useful when dealing ith failures associated with multi-disciplinary environments such s in aviation where there is an interaction of many specialties uch as operations, maintenance, air traffic control, meteorology, irport services, fire fighting etc. When dealing with failure engineers tend to tackle only the di- ect causes of a failure event hence putting less or almost no effort n averting indirect causes of a failure incident. As a result these ndirect causes remain unsolved hence continuing hidden in the ystem, with a chance of causing further failure in the future. It is the purpose of this paper to present a hybrid model for earning from failures where both the direct causes and indirect auses of failure are investigated. This model utilises the reliabil- ty engineering tools of Fault Tree Analysis (FTA), Reliability Block nder the CC BY license. ( http://creativecommons.org/licenses/by/4.0/ ) https://doi.org/10.1016/j.eswa.2017.10.031 http://www.ScienceDirect.com http://www.elsevier.com/locate/eswa http://crossmark.crossref.org/dialog/?doi=10.1016/j.eswa.2017.10.031&domain=pdf http://creativecommons.org/licenses/by/4.0/ mailto:calvin.stephen@postgrad.manchester.ac.uk mailto:ashraf.labib@port.ac.uk https://doi.org/10.1016/j.eswa.2017.10.031 http://creativecommons.org/licenses/by/4.0/ C. Stephen, A. Labib / Expert Systems With Applications 93 (2018) 212–222 213 D ( H H o d f e t f t n 2 i f r p s S i l o ‘ e a I S i o t o s i b c n c e l t n o m m l t f a l v t b i a w f w c o o u o b l T h s o v a w a s t t f t ( d m T o u e h a e d t h m c m o A m p i c r c t u c t p t f p e s d b w m r m iagrams (RBD) and Fault Modes, Effects and Criticality Analysis FMECA); Multi-criteria Decision Analysis techniques of Analytic ierarchical Process (AHP) and Decision Making Grid (DMG); and ouse of Quality (HoQ). To explain the usefulness and application f the model a case study is used. The next section provides a detailed literature review on how ifferent researchers use the above-mentioned technique to learn rom failure. This is followed by a brief summary of the failure vent that will be used as the case study for the application of he proposed model with the subsequent section focusing on the ramework itself and its application on the case study. Finally sec- ion five gives the conclusion of the report underlining the weak- ess and the strength of the proposed approach. . Theoretical frameworks There is a number of research work carried out by scholars and ndustry experts in order to come up with models of learning from ailures. These literature works act as a starting point for further esearch in this important area and also as a guide for the model roposed in this paper. Classification of hybrid models and modelling of operational re- earch tools can be traced back to the work of Shanthikumar and argent (1983) , who suggested that hybrid approaches can man- fest itself in two ways; either through the models and their so- ution procedures, or through the use of the solution procedure f independent types of models. The former option they called it hybrid model’, whereas the latter they termed it as ‘hybrid mod- lling’. In our approach we will focus on the former option where n output of one type of modelling can be an input to the other. n terms of types and usage of operational research (OR) models, hanthikumar and Sargent (1983) suggested that modelling is used n five ways (i) in analysis, where modelling is used to obtain an utput for a given system and input, (ii) in optimization, where he model and its solution procedure are used to find the values f the decision variables to optimize an objective function, (iii) in ynthesis, where a model is developed to convert a set of inputs nto a set of desired outputs, (iv) in gaining insight into a system’s ehaviour by developing a model of it and using its solution pro- edure to explore its behaviour, and (v) in the comparison of alter- ative systems, where modelling of various alternative systems are arried out to determine the "best" one. In our work we are inter- sted here in two types of synthesis, and gaining insight through earning lessons from failures. Morgan, Belton, and Howick (2016) and Morgan, Howick, & Bel- on, 2017 developed a good review about use of hybrid OR tech- iques, where they concluded that mixing OR modelling meth- ds raises many philosophical issues and that there are argu- ents that suggest benefits and potential problems of mixing OR ethods in general. However, they argue that real-world prob- em situations are highly complex and multidimensional, and po- entially may benefit from different paradigms to focus on dif- erent aspects of a situation. Howick, Ackermann, Walls, Quigley, nd Houghton (2017) used a case study to illustrate how one can earn from mixing OR methods and specifically they focused on the alue or impact of such integration of methods. However, most of he survey literature about case studies of mixing methods tend to e applied to a hybrid f two or maximum three methods, whereas n our case we develop a framework that utilises multiple methods nd we highlight the benefit of using each one. Love, Lopez, and Edwards (2013 ) developed a learning frame- ork that can be used to mitigate design errors and potential ailures and accidents in the construction industry. Their frame- ork acknowledges the fundamental pathogenic influences that ontribute to errors and failures. As such it suggests that a group f approaches should be implemented simultaneously at a project, rganisational and people level in order to lessen errors and fail- res. Failure to do this, according to Love et al (2013 ) would depend n time until the next major failure is experienced. They continue y explaining that reviewing past experiences is the first step in earning from failures but the much bigger step is taking action. his is because taking action involves a major change in both be- aviour and culture. When analysing the Fukushima accident, Zubair, Park, Heo, Has- an, and Aamir (2015) noticed that there exist basic precursors f nuclear accidents that are inherently difficult to quantify with ague priorities. So, to overcome these shortfalls they proposed model, which combined the AHP and the Bayesian Belief Net- ork (BBN). These helped them to accomplish sensitivity analysis nd prior probabilities into posterior probabilities of precursors. As uch they found out that design is the most important precursor hough the chance of an accident is also dependent on other fac- ors such as culture and plant specific conditions, which can af- ect the distribution of prior probability. For a review of AHP in erms of its methodological variation, please see Ishizaka and Labib 2011a, b) . In their research, Ishizaka and Labib (2014) studied the Bhopal isaster and proposed a model for learning from failure. In their odel they demonstrated that the FTA can be improved in Crisis ree Analysis (CTA) in order to map a crisis with the introduction f the revolving gate as opposed to the AND and OR gate that are sed in an FTA. The CTA caters for amplified impact of the input vent to the final event. They also suggested that the RBD could also map crisis with yper-blocks as the complement of the revolving gate. Their model lso utilises the AHP method to measure the criticality of the basic vents. Through the use of their model more realistic and sound ecisions can be made unlike when using each technique in isola- ion. In a bid to show that the use of FTA and RBD can systematically elp in solving complex industrial failures, Yunusa-Kaltungo, Ker- ani, and Labib (2017) applied these techniques to investigate a hronic rotary kiln refractory brick failure in a fully integrated ce- ent plant. They compared the efficiency of these methods to the ne that was being used in the plant that is based on Root Cause nalysis (RCA). The results obtained indicated that the investigative ethod that was used in the plant that is based on RCA failed to revent future occurrences. Through the usage of FTA and RBD the nvestigative team obtained a holistic understanding of the failure ausing factors and their interrelations hence helping in avoiding epetition in the future. Both FTA and RBD have been used in a omplimentary manner ( Bhattacharjya & Deleris, 2012 ). Labib (2015) emphasized the importance of the FTA and RBD echniques in creating a framework for learning from failures. He sed these techniques to analyse the Bhopal disaster and he con- luded that they could be used to serve as both knowledge reten- ion and decision support tools. According to Labib (2015) they can rovide practitioners with guidelines to follow the root cause of he problem, equips them with the tool box leading to more ef- ective decision making practices, process safety and environment rotection. Morgan et al. (2016) presented insights on using hybrid mod- ls by mixing OR methods of system dynamics and discrete-event imulation within a real world project. They presented the model evelopment process, the role of each modelling method and the enefits of using such hybrid models in project design. In their ork, they have shown that by using hybrid models in comple- entary, each model add value to the other resulting in an all- ound solution to the problem. On the other hand, Labib and Read (2015) proposed a hybrid odel for learning from failure that utilises both the reliability en- 214 C. Stephen, A. Labib / Expert Systems With Applications 93 (2018) 212–222 t e i p d e p t i o e p p t o l a r t a t t t f c e i p t i w c a a w A t h n C a w t t w a e w 4 b t e p o p L gineering tools and the multi criteria decision analysis tools. They used the reliability tools of FMECA, FTA and RBD in their model. They used this model to study the Hurricane Katrina disaster. The FTA is the starting point of their model creating inputs for FMECA and RBD. The output for the FMECA, FTA and RBD act as inputs to the MCDA method of AHP which produces the outputs helping the user to make either selection decisions or resource allocation decisions. All the models proposed in the above studied literature have been applied on major disasters as such one can wonder if they can be of ultimate importance in minor failures. They also concen- trate more on the direct cause of the failure with less emphasis on indirect factors. These outlines the importance of the proposed model as it will focus on both direct and indirect causes of a fail- ure with the use of a case study in which no lives were lost. It also tries to appreciate the benefits of using hybrid models by us- ing techniques in complementary. 3. ZS-CME serious incident ZS-CME is a bombardier CRJ-100 series aircraft that is registered by the South African civil Aviation Authority under the ownership of CemAir. This aircraft suffered main landing gear wheel disinte- gration upon landing during its scheduled flight from Cape Town to Gaborone. This incident was investigated as a means to derive lessons and gather facts as to what happened, how it happened, when it hap- pened, where and why it happened by the directorate of accident investigation in the ministry of transport and communications in Botswana. The purpose of this investigation was to obtain facts in order to prevent similar incidents from occurring in the future. According to ICAO annex 13, aircraft wheel disintegration are not classified as accidents but circumstances surrounding the ZS- CME incident made it to be have classified as a serious incident rather than just an incident ( Moakofi, 2016 ). The below sections give a clear synopsis of what really happened. 3.1. Synopsis of the incident On August 31, 2015 ZS-CME operated by Air Botswana under a lease agreement on a scheduled service as BOT 332 experienced starboard outer wheel disintegration upon landing at Sir Seretse Khama International Airport (SSKIA) in Gaborone. The aircraft de- parted Cape Town International Airport (CTIA) earlier that day where it was reported to have experienced excessive vibration dur- ing the take-off roll but the flight crew misjudged as minor and continued with the flight. Two seconds after touch down it was reported that the crew, air traffic control (ATC) and even the fire fighters heard a loud bang sound. Even though the crew had no idea what was the problem they taxied the aircraft for almost 1.3 km in order to clear the run- way for the service that was landing behind them while increasing the inherent risk to passengers. All passengers and crew disem- barked safely as it was noticed the aircraft was tilting to the right as the wheel has disintegrated destroying the right main landing gear and ripping off the inner flap hence creating a fire hazard as the wings contained fuel. 3.2. Investigation findings The worrying issues were the prolonged period the fire and res- cue services (FRS) took to heed help to the occupants in the air- craft and the unavailability of aircraft engineers to attend the in- cident. These prompted the investigators to dig deep to see what could have caused this delays and the unavailability of engineers. As a result, they found out that the Public Address (PA) sys- em that would have made it possible for the ATC to communicate ffectively with FRS was unserviceable which meant the relay of nformation from the ATC to the FRS was ineffective as it has to ass through a third person before the information can reach its estination. The other startling discovery was that since the aircraft was op- rated by Air Botswana under a lease agreement, CemAir did not rovide the ground support engineers at the airport even though he lease agreement stated that, “the lessor shall supply duly qual- fied ground engineers/technicians who shall be available in the perations area to carry out daily line maintenance and minor ngine and airframe inspections on the aircraft as required, as er included costs” ( Moakofi, 2016 ). It was evident the lessee had aid for such services because they had no engineers appropriately rained on the type of the aircraft because they had no such type n their fleet. It is reported that the maintenance crew arrived ater on from Johannesburg. Since the incident resulted in debris all over the runway it was lso noticed that the airport had no serviceable runway sweeper egardless of the threat foreign object debris on the runway pose o safe air travel. The measures put in place to act as an alternative re not only time consuming but also ineffective as compared to he use of a runway sweeper. See Davidson and Labib (2003) on he impact of debris of rubber from the wheel on the runway of he Concorde accident. The direct causes of the incident upon investigation where ound to be originated from a major maintenance work that was arried out some two and half months prior to the incident. It was vident that during maintenance work there occurred an incorrect nstallation of brake lines to the inboard/outboard swivel assembly orts. This would result in a faulty operation of the anti-skid sys- em producing a pro-skid condition which when activated would ncrease load on the landing gear instead of reducing it. This cross iring of brake lines can be attributed to design errors in the air- raft landing gear system which made it possible. Investigators found out that the aircraft manufacturer became ware of the design error and offered a service bulletin (SB), which ccording to Moakofi (2016) it was not evident whether the SB as affected, as the aircraft records from their previous owner, an merican company, were inadequate to tell. The effective date of he SB was 26 December 2014 and operators where required to ave complied within 6600 flying hours from the effective date but ot later than March 2017. Moakofi (2016) also found out that during the take-off roll in TIA the aircraft experienced severe vibration that could have been n indication of fault initiation. The crew then decided to continue ith the flight as they considered the vibration to be minor. Even hough Moakofi (2016) did not mention anything about the vibra- ion limits of the aircraft it can be argued that the pilot decision as informed by what the indicators told them or maybe they cted in negligence. The indicators might have given them inad- quate information that could have left the crew indecisive about hat measure to take. . Proposed model The proposed model is an extension of the model proposed y Labib and Read (2015) that encompasses reliability engineering ools of FTA, FMECA and RBD and the MCDM tool of AHP. As an xtension to this model the new model will make use of a sim- lified HoQ matrix and a modified MCDM technique of DMG. The verview of the proposed model is shown in Fig. (1) . The FMECA tool is not explained in this paper but its ap- lication in the proposed model is the same as explained in abib and Read (2015) , and for a review of its variations please see C. Stephen, A. Labib / Expert Systems With Applications 93 (2018) 212–222 215 Fig. 1. The model overview and interface of techniques. L F i o l a r h t s 4 ( f t i s u l s i t m t t i o h r w d t t f T f g f i a t o e O h m w d t f s iu, Liu, and Liu (2013) . It is the authors’ view that the use of MECA will provide risk priority numbers that will show the crit- cality of the basic events to the AHP. This combat the importance f other basic events to the failure hence resulting in devising a so- ution to the critical causal factors only. As a result the events that re not deemed critical remain unsolved and hidden in the system esulting in them causing failures in the future. In the following, the criteria for application of the proposed ybrid model for learning from failure are summarised. The de- ails about each of the tools used are given in the subsequent sub- ections. Step 1 : Develop an FTA for the root causes of the failure event, expand by mapping the FTA into an RBD and use them to derive an equivalent RBD model. Step 2 : With the information on root causes from the FTA formu- late a FMECA study. Step 3 : Using the risk priority numbers from the FMECA, hier- archical model from the FTA and information on parallel and series structures from the RBD, complete the AHP. Step 4 : Use causes of failure and ways of eliminating them from the FMECA, and the relative importance and priority numbers from the AHP to formulate a House of Quality matrix. Step 5 : Obtain comparison parameters from the AHP model to create a DMG and use relative importance weights from the HoQ matrix in case of events belonging to the same cell of the grid to make decisions on which to prioritise more within the same cell. .1. Fault Tree Analysis (FTA) and the Reliability Block Diagrams RBD) The FTA shows how basic events interact leading to the overall ailure under study. At the top of the FTA is the undesirable failure hat is under study, which in our case study is the ZS-CME serious ncident, with different failures connected underneath until the ba- ic events are reached. Basic events are the root causes of such fail- res that lead to the overall failure under investigation. The use of ogic AND- and OR- gates show the relationship between the ba- ic events and the failures. The AND- gate shows that the system s parallel and the OR-gate indicates series systems. Fig. (2) shows he FTA for the ZS-CME serious incident. It is from the FMECA that we obtain information on failure odes to be used on the formulation of the FTA. We also ob- ain information on how basic events are related towards causing he failure under investigation helping in formulating the reliabil- ty block diagram of the system. The FTA also shows the hierarchy f events that took place towards the failure under investigation ence giving input information for the AHP tool. In other words, the hierarchies in both FTA and AHP are al- eady considering every element (contributing factor). However, e group these factors under the two categories of direct and in- irect causes. The justification for the usage of the two AND- gates that leads o the ZS-CME serious incident is because the analysis is made af- er the incident has taken place, which means all the events that all under those branches had a part to play towards the incident. he occurrence of either event 1 or event 2 would have resulted in ailure on the operational side hence the justification for the OR- ate. Occurrence of unclear maintenance records had a negative ef- ect on the maintenance works carried out on the aircraft lead- ng to maintenance faults. The same applies to the failure by the ircraft design team to avoid interconnectivity of components in heir design, an aspect that played a vital role in the occurrence f the incident. These events on their own would have resulted in rrors in the maintenance of the aircraft hence the usage of the R- gate. As for the indirect causes of the incident, each event would ave had an effect without the influence of another event. This eans that event 6 would result in the outcome of the incident ithout event 7 or event 8. The same applies to the two other in- irect causes hence the reasoning behind the OR- gate. The RBD designed from the interdependency information ob- ained from the FTA is shown in Fig. (3) . It can be noted that rom this diagram the indirect causes of the incident form a series ystem, a finding that should be a main cause for worry. Failure 216 C. Stephen, A. Labib / Expert Systems With Applications 93 (2018) 212–222 Fig. 2. The Fault Tree analysis (FTA) of the ZS-CME serious incident. Fig. 3. The Reliability Block Diagram (RBD) of the ZS-CME serious incident. 1 o 4 w m of either event 6, 7 or 8 results in a complete breakdown of the whole branch of the RBD leaving reliance only on the direct causes branch. This shows that the indirect causes should never be taken lightly when analysing such a failure. The minimum cut set for this system would be a failure of one event in the indirect causes branch of the RBD (6, 7 or 8) and fail- ure of three events from the direct causes. The three events from the direct causes branch could be event 3 and either event 1 or event 2 and either event 4 or event 5. Shown below is the deriva- tion of the minimum cut set of this system. Cut set = (6 + 7 + 8). (4 + 5). (3). (1 + 2) which implies that the minimum cut sets are; t Minimum cut sets are 1.3.4.6; 1.3.4.7; 1.3.4.8; 1.3.5.6; 1.3.5.7; .3.5.8; 2.3.4.6; 2.3.4.7; 2.3.4.8; 2.3.5.6; 2.3.5.7 and 2.3.5.8 From the minimum cut sets we can also notice the importance f event 3. Its occurrence weakens all other sets. .2. Analytical Hierarchy Process (AHP) The MCDM technique of AHP helps in assessing the relative eights of multiple options against given criteria in an intuitive anner ( Parthiban, Zubar, & Garge, 2012 ). From the FTA we get he hierarchical information to be used on the AHP with the sec- C. Stephen, A. Labib / Expert Systems With Applications 93 (2018) 212–222 217 Fig. 4. AHP structure for the direct causes of the ZS-CME serious Incident. o c t b s c t w p r c p a u a b 1 t s t t v e t r a a t a i a P a a c v n t m m o t v h r p c o t i j t s w r p a 4 a c m t o c t o T s ( l nd level being the criteria and the basic events being the sub riteria. The alternatives will be other common factors to consider when rying to solve the basic events and these will include the proba- ility of re-occurrence when the basic event remains unsolved, the afety impact (severity) caused by the basic event and the cost in- urred when trying to devise a solution. These three common fac- ors are considered as decision variables since any decision taken ill tend to focus on mitigation against risk in the form of both robability of re-occurrence and severity, as well as the required esource allocation in terms of cost incurred. Using the AHP, to create the evaluation criteria, basic events are ompared and given weights that will give the information on their riorities when trying to put in place measures that will help to void the similar failure from occurring in the future. This is done sing the methodology that was explained by Saaty (2008) where matrix is formed by comparing each basic event against the other asic events from the FTA and giving a score between 1 and 9 with indicating that the events are equally important and 9 indicating hat one event is absolutely more important than the other. The cores depend on the authors’ judgement of the criteria. However he authors were informed by secondary data based on informa- ion included in the investigations reports of the accident. The formed matrix is then normalised by making the sum of all alues in a column equal to one. We then get the weight of each valuation criteria by adding the values in each row and obtaining he average. To ensure that both the direct causes and the indi- ect causes of the failure are considered as seen from the RBD they re both important, two AHP models are created one for the direct nd the other for the indirect causes. Fig. (4) shows the AHP for he direct causes of the failure with weights of both criteria and lternatives indicated. As for indirect causes, the model is shown n Fig. (5) . In order to come up with the weights for alternatives, we create matrix by comparing the alternatives (safety impact of the basic, robability of reoccurrence if it remains unsolved, cost of devising solution) to each other with respect to each basic event and give score of 1– 9. Then this matrix will undergo a normalisation pro- ess described above for the evaluation criteria and the average of alues in a row obtained. Finally to obtain the weights of alternatives the matrix of alter- atives with respect to the basic event is multiplied with the ma- c rix of criteria. Table 1 and 2 shows the pairwise comparison of the ain criteria with respect to the goal and the pairwise comparison atrix of the alternatives with respect to event 4 respectively. In order to explain how the priorities (weights) are derived nce the comparisons matrices are completed, we use the tradi- ional AHP eigenvalue method as described in Appendix A . From the AHP structure for direct causes we can notice that de- ising a solution for event 4(design errors) have to be given the ighest priority followed by event 3, event 5, event 2 and event 1 espectively. Also from the alternatives we can deduce that it is im- ortant to consider the safety impacts of each criterion before we an consider the probability of re-occurrence and the cost of devel- ping a solution. Probability of re-occurrence has a higher priority han the cost of devising a solution. This information will be very mportant in the formulation of the modified decision making grid. The weakness of the AHP include too much dependency on udgement of the person who is using it as such it can be subjec- ive an aspect that can be eliminated by having a group of experts tating their views on what a score to give to a certain criteria ith respect to the goal or an alternative with respect to a crite- ia. The strength includes simplifying of the users decision-making rocess by expertly comparing criteria with respect to the goal and lternatives with respect to criteria. .3. Simple House of Quality (HoQ) matrix According to Kuei (2002) HoQ is a structured and systematic pproach designed to translate customer needs into appropriate ompany business objectives. The HoQ matrix is made up of six ajor sections that show how the customer specifications are ranslated into the designer’s language. A full HoQ matrix is shown n Fig. (6) . As shown in Fig. (6) the formulation of a HoQ matrix start with ustomer requirements being defined and given the relative impor- ance weights as suggested by the customers, which are the rows, r the ‘Whats’ (i.e. what the customers wants) in the HoQ matrix). he next step is to come up with what designers can achieve to atisfy such requirements, which are the columns, or the ‘Hows’ ie how can the customer requirements be fulfilled). This is fol- owed by the customer’s perception of where the company is as ompared to competitors. At the centre of the matrix is the inter- 218 C. Stephen, A. Labib / Expert Systems With Applications 93 (2018) 212–222 Fig. 5. AHP structure for the indirect causes of the failure. Table 1 Pairwise comparison of the main criteria with respect to the direct causes of the failure. Design errors Unclear maintenance records FOD Pilot indecision Pilot negligence Weights Design errors 1 7 3 8 8 0.507 Unclear maintenance records 1/7 1 1/5 4 3 0.108 FOD 1/3 5 1 7 6 0.283 Pilot indecision 1/8 1/4 1/7 1 3 0.063 Pilot negligence 1/8 1/3 1/6 1/3 1 0.040 Table 2 Pairwise comparison of alternatives with respect to Event 4 (design error). Safety impact of the event Probability of Re -occurrence if unsolved Cost of devising a solution Weights Safety impact of the event 1 5 9 0.723 Probability of Re -occurrence if unsolved 1 \ 5 1 5 0.216 Cost of devising a solution 1 \ 9 1 \ 5 1 0.061 ‘ t e r v a 4 v a c b ( f m w o t f D h S relationship matrix, which shows how the customer needs relate to the engineering characteristics. At the roof of the matrix is a depiction of how the engineer- ing characteristics affect each other. As such the roof of the matrix presents an opportunity for engineers to specify the various en- gineering features that have to be improved collateral ( Hauser & Clausing, 1988 ). The final aspect of the HoQ matrix is the technical assessment and target for each engineering characteristic for the betterment of the product. Hauser and Clausing (1988) described the HoQ as a kind of con- ceptual map that provides the means for inter functional planning; which means it can be used as a diagrammatic representation. It is as such, that in the proposed model a simple HoQ matrix is employed in order to provide a visual representation of the causal factors of the failure and the ways of eliminating or reducing the severity of such factors. The causal factors will occupy the part of the matrix where cus- tomer needs are defined and the engineering characteristics sec- tion will be occupied with ways of eliminating the causal factors to the failure under investigation. The weights obtained for the cri- teria’s in the AHP will be transferred to the relative importance section. It must be noted that both direct and indirect causes to the fail- ure are treated as having equal importance as such each have its section in the matrix. A simplified HoQ matrix for the failure be- ing investigated is shown in Fig. (7) . In Fig. (7) , we simply map the Whats’ (rows) in the HoQ model against the ‘Hows’ (columns). Not hat the ‘Hows’ are potential solutions that in our view can address ach of the rows in varying degrees as captured by the X’s in the elationship matrix in the middle of the grid, which is a simplified ersion of HoQ model. Note that the top of the matrix was gener- ted using the information obtained from Moakofi (2016) . .4. Decision making grid (DMG) The decision making grid is an MCDM technique which pro- ides means of identifying which maintenance actions are vi- ble for a system In order to provide optimised balance between ost and performance risks. Labib developed this concept in 1996 y combining the rule-based approach with the AHP for MCDM Labib, Williams, & Connor, 1998 ). It acts as a map where using multiple criteria the worst per- orming machines can be classed ( Labib, 1998 ). This grouping of achines aid in the implementation of appropriate actions that ill improve their performance, hence moving them to the region f low downtime and low frequency. The objective is to improve he performance of the machines so that they move to the low requency and low downtime cell of the DMG. Fig. (8) shows the MG as proposed by Labib (1998) . The machines that are classed in the cell for high frequency and igh downtime are considered to be the worst performing ones. o, to ensure the improvement in performance for such machines C. Stephen, A. Labib / Expert Systems With Applications 93 (2018) 212–222 219 Fig. 6. A full HoQ Matrix ( Hauser & Clausing, 1988 ). a c e t g m t h n o l F c ( h s d d c i t t a o s t r m a v p d n design out maintenance strategy is used. For machines that are lassed in the low frequency high downtime cell, the rightful strat- gy to implement is the condition-based maintenance. If a machine is put in the low downtime and high frequency, he rule that applies is autonomous maintenance or Skill Level Up- rade (SLU). This implies that operators are trained to perform the aintenance associated with such machine, as the tasks are rela- ively easy. Whereas, if a machine is put in the low frequency and igh downtime, the rule that applies is Condition-Based Mainte- ance (CBM). This implies that there is need to monitor condition f a major type of problem that seldom occurs. As for the ones al- ocated to a low frequency and low downtime cell, an ‘Operate To ailure - OTF’ strategy has to be implemented. For the remaining ells of the DMG, the usage of the Total Preventive Maintenance TPM) strategy needs to be continued. Finally a high frequency, igh downtime implies a Design Out Maintenance (DOM) strategy ince the whole machine needs to be reconfigured. Traditionally, the DMG model that compares frequency and owntime have been used in helping decision makers and policy evelopers in selecting the rightful maintenance strategies for their ritical assets. This technique has recently been extended to help n learning from failures. Aslam-Zainudeen and Labib (2011) stated hat the technique has also been used in crisis management. In this paper we modify the DMG to use it in ensuring that all he causal factors of a failure are solved and preventive measures re put in place as to avoid them to aid in the formulation of an- ther failure in the future. From the AHP developed in the earlier ection we obtain information on which two alternatives we need o pay attention to in order to ensure that the basic events don’t esult in another failure in the future. The two alternatives that received higher rankings in the AHP odels provided earlier are the safety impact of the basic events nd the Probability of re-occurrence. As such we are going to de- elop a DMG with increasing safety impact on the x-axis and the robability of re-occurrence in the y-axis. Each axis would then be ivided into three levels (low, medium and High) to form a grid of ine sections as shown in Fig. (9) . 220 C. Stephen, A. Labib / Expert Systems With Applications 93 (2018) 212–222 Fig. 7. The simplified HoQ matrix. Fig. 9. The modified DMG model. p c s m o c a h c l s a Therefore, in order to summarise how in Fig. (9) , the results of previous methods can feed into this grid, we do this in two ways, one is to determine the new set of axes used (compare original grid in Fig. (8) to the modified one in Fig. (9) ). The second way is through plotting the different basic events from Fig. (2) and their ranking with respect to the two axes as shown in Figs. (4 and 5 ) into the grid. As for how the borders have been set, this judgement is based in the variation in the values, but can also be formalised using different methods. For more details about different methods to set the borders in DMG, please see Seecharan, Labib, and Jar- dine (2018) . Using personal judgement each basic event is allocated to the most appropriate cell of the grid. Each of these cells indicates the priority that should be given to the allocated event. For example the basic event that is allocated to the high safety impact high Fig. 8. DMG ( Lab robability of re-occurrence cell must be given higher priority as ompared to the events in other cells. The objective of this DMG is to ensure that preventive mea- ures for the basic events that are in the High-high cell in the atrix are put in place so that they move to the cells that are f lower safety impact and lower probability of re-occurrence as ompared to their initial allocated cell. The order of ensuring that ll basic events are tackled is to start with event allocated to the igh safety impact high probability of re-occurrence (high-high) ell then high-medium, medium-high, medium-medium, high-low, ow-high, low-medium and low-low respectively. As the output of the proposed model each basic event that re- ulted in the occurrence of the incident under study are prioritized nd preventive measure put in place to ensure that their influences ib, 1998 ). C. Stephen, A. Labib / Expert Systems With Applications 93 (2018) 212–222 221 e l a i d r t i i e f a t a a l r f o s h e u t c e b Z 5 L v f i h s g u n d h i a w a t r t p o i t o p t l u a t t e s a & l h I A f T f ( A m p ( a b ⎡ ⎢⎣ o A w c i a R A B C C D H H I ven on the future are eliminated. These priorities indicates the evel of response, at which the solutions need to be implemented, s such could be compared to the maintenance strategies proposed n the original DMG model by Labib (1998) . In the proposed model, DOM has the same meaning as ‘imme- iate response’. This means that event 3 and 4 would require being esolved immediately. The level of response required in resolving he causal factors reduces with the decrease in either the safety mpact or the probability of re-occurrence, with the factors located n OTF cell being the last one to resolve. Event 7 is solved before vent 6 because from the AHP model for indirect causes the rating or Probability for reoccurrence is higher than that of safety impact nd this is the opposite for direct causal factors. The strengths of this feature of the proposed model is that all he causal factors to the failure are taken and put in one place nd solutions developed one at a time ensuring that the ones that re of high safety impact and have high chance of re-occurring if eft unattended are given attention first before dealing with the emaining ones. This helps to ensure that no causal factors to a ailure are left hidden in the system an issue that can spark a re- ccurrence in the future. The weakness of this feature is that basic events that lie in the ame cell of the grid but at different extremes are treated the same ence in actual facts they have different states. The example being vent 3 and 4. As a solution to this weakness, the proposed model tilises the HoQ matrix that feeds information on relative impor- ance of events to the simplified DMG hence priorities. As such, we an tell that event 4 have to be given higher priority than event 3 ven though the two are in the same cell of the DMG. This can also e solved by the application of fuzzy logic as proposed by Aslam- ainudeen and Labib (2011) . . Conclusions The proposed hybrid model is an extension of the model by abib and Read (2015) . The ZS-CME serious incident has been in- estigated using the proposed model which showed that the causal actors number 3 and 4 should be given high priority when devis- ng preventive measures as they fall in the high safety Impact and igh probability of re-occurrence cell in the modified DMG. The re- ults from the HoQ indicates that even though event 3 and 4 are iven the same priority in the DMG event 4 should be given the tmost priority as it has a high value of relative importance. For Indirect causes, the modified DMG shows that event 7 eeds more priority as compared to event 6 because it falls un- er the high probability of re-occurrence region as compared to igh safety Impact region. This is so because the AHP model for ndirect causes of the failure have awarded a high weight to prob- bility of re-occurrence rather than safety impact, as it is the case ith direct causes. The novelty of the proposed model came from the fact that HoQ nd DMG are used to show the priorities that need to be given o each of the causal factors of the failure and comparing their esults. This comparison cancels out the weakness of the DMG hat is associated with events in the same cell but on the op- osite extremes hence eliminating the need for fuzzy logic. The ther strength that is associated with the proposed model is that t leaves no stone unturned in the event of a failure as was seen by aking consideration of both the direct and indirect causal factors f the failure. The weakness of the proposed model comes with too much de- endency on personal judgement. This does not only bring bias to he failure investigation but also inconsistencies. The authors be- ieve that the inconsistencies and bias can be eliminated by the se of a group of people in situations where personal judgements re required hence resulting in the use of collective judgement of he group. However, group decision making has its own assump- ions and challenges which are beyond the scope of this paper. For xample, individual decision makers in the group can be either as- umed to be equally weighted, or a method needs to be derived to llocate weights to each decision maker ( Chakhar, Ishizaka, Labib, Saad, 2016; Ishizaka & Labib, 2011b ). In addition, there is a chal- enge in finding a suitable group that can represent all the stake- olders in the decision making process ( Poplawska, Labib, Reed, & shizaka, 2015 ). cknowledgements The authors would like to thank the reviewers for their insight- ul comments and suggestions to improve the quality of the paper. he second author would like to acknowledge the funding received rom the Centre for Research and Evidence on Security Threats ESRC Award: ES/N009614/1 ). ppendix A In order to briefly describe the traditional AHP eigenvalue ethod , we start from the case of a consistent matrix with known riorities p i . If the matrix is perfectly consistent, the transitivity rule 1) holds for all comparisons a ij : i j = a ik · a k j (1) In this case, the comparisons of the alternative i and j is given y p i / p j . If, we multiply it with the priority vector � p , we obtain: p 1 / p 1 p 1 / p 2 … p 1 / p n p 2 / p 1 p 2 / p 2 … p 2 / p n … … … … p n / p 1 p n / p 2 … p n / p n p 1 p 2 ... p n ⎤ ⎥ ⎦ = n ⎡ ⎢ ⎣ p 1 p 2 ... p n ⎤ ⎥ ⎦ r grouped: � p = n � p here � p : vector of the priorities n : dimension of the matrix A : comparison matrix (2) Eq. (2) is the formulation of an eigenvector problem. The cal- ulated priorities are exact for a consistent matrix. When slight nconsistencies are introduced, priorities should vary only slightly ccording to the perturbation theory ( Saaty, 2003 ). eferences slam-Zainudeen, N. , & Labib, A. (2011). Practical application of the Decision Making Grid (DMG). Journal of Quality in Maintenance Engineering, 17 (2), 138–149 . hattacharjya, D. , & Deleris, L. A. (2012). From reliability block diagrams to fault tree circuits. Decision Analysis, 9 , 128-137 . hakhar, S. , Ishizaka, A. , Labib, A. , & Saad, I. (2016). Dominance-based rough set approach for group decisions. European Journal of Operational Research, 251 , 206–224 . ox, S. , Jones, B. , & Collinson, D. (2006). Trust relations in high-reliability organiza- tions. Risk Analysis, 26 (5), 1123–1138 . avidson, G. , & Labib, A. W. (2003). Learning from failures: Design improvements using a multiple criteria decision making process. Journal of Aerospace Engineer- ing, Proceedings of the Institution of Mechanical Engineers Part G, 217 (4), 207–216 . auser, J. R., & Clausing, D. (1988). The house of quality. Havard Business Review , May-June. pp. 63–73. owick, S. , Ackermann, F. , Walls, L. , Quigley, J. , & Houghton, T. (2017). Learning from mixed OR method practice: The NINES case study. Omega, 69 , 70–81 . shizaka, A. , & Labib, A. (2014). A hybrid and integrated approach to evaluate and prevent disasters. Journal of the Operational Research Society, 65 , 1475–1489 . http://dx.doi.org/10.13039/501100000613 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0001 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0001 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0001 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0001 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0002 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0002 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0002 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0002 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0003 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0003 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0003 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0003 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0003 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0003 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0004 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0004 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0004 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0004 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0004 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0005 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0005 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0005 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0005 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0006 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0006 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0006 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0006 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0006 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0006 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0006 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0007 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0007 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0007 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0007 222 C. Stephen, A. Labib / Expert Systems With Applications 93 (2018) 212–222 M P S S Y Z Ishizaka, A. , & Labib, A. W. (2011a). Review of the main developments of AHP. Expert Systems With Applications, 38 (2011), 14336–14345 . Ishizaka, A. , & Labib, A. W. (2011b). Selection of new production facilities with the group analytic hierarchy process ordering method. Expert Systems With Applica- tions, 38 , 7317–7325 . Jefcott, S. , Pidgeon, N. , Weyman, A. , & Walls, J. (2006). Risk, trust and safety culture in the UK train operating companies. Risk Analysis, 26 , 1105–1121 . Kuei, C.-H. (2002). House of quality (QFD) in a minute. The International Journal of Quality and Reliability Management, 19 (4), 4 87–4 88 . Labib, A. W. , Williams, G. B. , & O’Connor, R. F. (1998). An intelligent maintenance model (System): An application of A.H.P. and a fuzzy logic rule-based controller. Journal of Operational Research Society, 9 (7), 745–757 . Labib, A. (1998). World-class maintenance using a computerised maintenance man- agement system. Journal of Quality in Maintenance Engineering, 4 (1), 66–75 . Labib, A. (2015). Learning (and unlearning) from Failures: 30 yearson from Bhopal to Fukushima an analysis through reliability engineering techniques. Process Safety and Environmental Protection, 547 , 1–11 . Labib, A. , & Read, M. (2015). A hybrid model for learning from failures: The Hurri- cane Katrina disaster. Expert Systems with Applications, 42 , 7869–7881 . Liu, H. C. , Liu, L. , & Liu, N. (2013). Risk evaluation approaches in failure mode and effects analysis: A literature review. Expert systems with applications, 40 (2), 828–838 . Love, P. E. D. , Lopez, R. , & Edwards, D. J. (2013). Reviewing the past to learn in the future: Making sense of design errors and failures in construction. Structure and Infrastructure Engineering, 9 (7), 675–688 . Moakofi, O. B. (2016). MTC/AIG/43/15 Report on the serious incident to Bombardier CRJ-100, ZS-CME on Runway 08 at SSKIA on 31 August 2015 . Aircraft Incident Re- port. Gaborone: Ministry of Transport and Communication Directorate of Acci- dent Investigation. organ, J. S. , Belton, V. , & Howick, S. (2016). Lessons from mixing OR methods in practice: Using DES and SD to explore a radiotherapy treatment planning pro- cess. Health Systems, 5 , 166–177 . Morgan, J. , Howick, S. , & Belton, V. (2017). A toolkit of designs for mixing discrete event simulation and system dynamics. Forthcoming in European Journal of Op- erational Research, 257 , 907–918 . arthiban, P. , Zubar, H. A. , & Garge, C. P. (2012). A multi criteria decision making approach for supplier selection. Procedia Engineering, 38 , 2312–2328 . Poplawska, J. , Labib, A. , Reed, D. , & Ishizaka, A. (2015). A dynamic framework for stakeholder identification and salience measurement using fuzzy logic method- ology applied to a corporate social responsibility case study. Journal of Cleaner Production, 105 , 103–115 . aaty, T. (2003). Decision-making with the AHP: Why is the Principal Eigenvector necessary? European Journal of Operational Research, 145 (1), 85–91 . aaty, T. L. (2008). Decision making with the analytical hierarchy process. Interna- tional Journal of Services Sciences, 1 (1), 83–98 . Seecharan, T. S. , Labib, A. , & Jardine, A. K. S. (2018). Approaches to criticality and se- lection of maintenance strategies: Decision making grid vs. jack-knife diagram. Journal of Quality in Maintenance Engineering (in press) . Shanthikumar, J. G. , & Sargent, R. G. (1983). A unifying view of hybrid simulation/ analytic models and modeling. Operations Research, 31 , 1030 . Torrel, W. , & Avelar, V. (2010). Mean time between failure: Explanation and stan- dards. APC by Schneider Electric, 1 (78), 1–10 . unusa-Kaltungo, A. , Kermani, M. M. , & Labib, A. (2017). Investigation of critical fail- ures using root cause analysis methods: Case study of ASH cement PLC. Engi- neering Failure Analysis, 75 , 25–45 . ubair, M. , Park, S. , Heo, G. , Hassan, M. , & Aamir, M. (2015). Study on nuclear acci- dent precursors using AHP and BBN, a case study of Fukushima accident. Inter- national Journal of Energy Research, 39 , 98–110 . http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0008 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0008 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0008 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0008 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0009 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0009 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0009 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0009 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0010 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0010 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0010 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0010 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0010 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0010 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0011 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0011 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0012 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0012 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0012 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0012 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0012 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0013 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0013 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0014 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0014 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0015 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0015 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0015 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0015 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0016 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0016 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0016 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0016 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0016 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0017 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0017 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0017 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0017 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0017 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0018 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0018 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0018 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0018 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0018 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0019 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0019 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0019 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0019 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0019 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0020 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0020 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0020 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0020 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0020 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0021 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0021 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0021 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0021 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0021 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0021 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0022 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0022 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0023 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0023 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0024 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0024 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0024 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0024 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0024 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0025 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0025 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0025 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0025 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0026 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0026 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0026 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0026 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0027 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0027 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0027 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0027 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0027 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0028 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0028 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0028 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0028 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0028 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0028 http://refhub.elsevier.com/S0957-4174(17)30713-3/sbref0028 A hybrid model for learning from failures 1 Introduction 2 Theoretical frameworks 3 ZS-CME serious incident 3.1 Synopsis of the incident 3.2 Investigation findings 4 Proposed model 4.1 Fault Tree Analysis (FTA) and the Reliability Block Diagrams (RBD) 4.2 Analytical Hierarchy Process (AHP) 4.3 Simple House of Quality (HoQ) matrix 4.4 Decision making grid (DMG) 5 Conclusions Acknowledgements Appendix A References