Brasil
Journal of Aerospace Technology and Management
Sumário Anterior Atual Seguinte
Sumário
ORIGINAL PAPER • J. Aerosp. Technol. Manag. 18 • 2026 • https://doi.org/10.1590/jatm.v18.1428 linkcopy

Open-access Organizational Pressure and Pilot Decision-Making in Adverse Weather: A Naturalistic Decision-Making Analysis of Helicopter Accidents

AuthorshipSCIMAGO INSTITUTIONS RANKINGS

ABSTRACT

This paper aims to analyze helicopter accidents occurring in meteorological scenarios where flights should have been avoided, identifying patterns that influence pilots’ misjudgments. This work uses two analytical frameworks: the Human Factors Analysis and Classification System (HFACS) and bow tie diagrams, applied to four selected helicopter accident cases. The HFACS model systematically categorizes failures at four hierarchical levels (organizational influences, unsafe supervision, preconditions for unsafe acts, and unsafe acts), whereas bow tie diagrams visually map threats, preventive barriers, the critical top event, and mitigation barriers related to the accidents. The results consistently revealed organizational and self-imposed pressures influencing the decision-making of pilots to proceed under unsafe weather conditions, but these decisions were also shaped by additional factors, such as inadequate training, insufficient operational oversight, fatigue, poor risk perception, spatial disorientation, and misuse of onboard instruments, such as the meteorological radar. The bow tie diagrams highlighted latent conditions, the inadequacy or absence of safety barriers, and the critical short timeframe available for mitigating actions once control was lost. The study concludes that enhancing organizational oversight, structured training, and proper understanding of avionic systems, particularly weather radar capabilities and limitations, are important to preventing similar accidents in the future.

Keywords
Human factors; HFACS; Bow tie diagram; Aeronautical accidents; Flight safety management system

INTRODUCTION

Aviation is internationally recognized as the safest transportation mode, an achievement that is far from incidental. Given the inherent risks of flight operations and the considerable stakes involved, highlighted by the 118 million passengers transported in Brazil alone during 2024 (ANAC 2025), this safety record stems from rigorous adherence to internationally established standards. Under the governance of the International Civil Aviation Organization (ICAO), global aviation safety is maintained through programs such as the Universal Safety Oversight Audit Programme, designed to assess and reinforce the safety oversight capabilities of member states (ICAO 2025). These regulatory frameworks cultivate a proactive approach focused on continuously learning from past incidents to prevent future occurrences.

In Brazil, aviation safety responsibilities are shared between the National Civil Aviation Agency (Agência Nacional de Aviação Civil [ANAC]) and the Brazilian Air Force (Força Aérea Brasileira), specifically through its Aeronautical Accident Investigation and Prevention Center (Centro de Investigação e Prevenção de Acidentes Aeronáuticos [CENIPA]) and Regional Services (Serviços Regionais de Investigação e Prevenção de Acidentes Aeronáuticos), components of the Aeronautical Accident Prevention System (Sistema de Investigação e Prevenção de Acidentes Aeronáuticos) (Diário Oficial da União 2018). The central philosophy of this system emphasizes learning and preventive action rather than attributing blame, ensuring that each incident contributes meaningfully to ongoing safety improvements. Therefore, the primary purpose of aviation accident investigations is to prevent future occurrences, not to assign responsibility. This feature ensures that each adverse event contributes to reducing the likelihood of future accidents, thereby incrementally increasing system safety over time.

This structured, learning-oriented safety culture is notably absent in other Brazilian transport sectors. For instance, road transport has consistently resulted in approximately 33,000 deaths annually (ANAMT 2024) (this figure considers only those who die at the scene, excluding those who die later in hospitals, as they are not included in official statistics). The long-standing repetition of this pattern can be interpreted as either negligence or a lack of priority on the part of the Brazilian state to effectively address this issue.

The disparity underscores the ICAO’s effectiveness, as a global governing body, in ensuring that even countries with high accident rates in other transportation domains comply with aviation safety regulations to the extent that they achieve globally recognized standards of excellence in aviation safety.

However, aviation comprises multiple branches such as executive, commercial, agricultural, and military aviation (the latter increasingly employing unmanned aerial vehicles [Casale et al. 2024]). There is a notable lack of uniformity in safety standards among these segments. Commercial aviation, for instance, exhibits the lowest accident rates, whereas agricultural aviation registers a higher frequency of undesirable occurrences (Maliszewski 2021).

Executive aviation, specifically, faces pressures that may compromise operational safety. Often, the client contracting the service is also the aircraft owner and is responsible for hiring the pilot, who simultaneously assumes the roles of flight commander and operator accountable for the safe operation of the aircraft, while also being the employee of the owner. This hierarchical relationship may lead the pilot to feel pressured to fly in suboptimal or unsafe conditions, such as adverse weather, to avoid risking their job. A similar dynamic can occur even if the client is not the owner but contracts services from an executive aviation company. The risk of losing a high-value client (especially one that frequently uses the company’s services) may push both managers and pilots to approve flights under unsafe conditions to avoid financial repercussions.

This underscores that aviation safety is influenced not only by human and technical factors but also by organizational ones. In this context, the Human Factors Analysis and Classification System (HFACS) offers a valuable framework for understanding the different layers of contributing factors in aviation accidents. The HFACS is based on James Reason’s Swiss cheese model (Fig. 1) (Reason 1990) and was developed by Scott Shappell and Doug Wiegmann, initially for application by the U.S. Navy. The model emerged during a shift in focus from technical to human and organizational factors in the analysis of aviation accidents (Souza and Russomano 2017). The HFACS organizes contributing factors into four hierarchical levels (Wiegmann and Shappell 2017):

thumbnail of Figure 1
Figure 1
Swiss cheese model.

  • Organizational influences encompassing resource management, organizational climate, and organizational process.

  • Unsafe supervision, comprising inadequate supervision, planned inappropriate operations, failure to correct problems, and supervisory violations.

  • Preconditions for unsafe acts, comprehending environmental factors (physical environment and technological environment), condition of operators (adverse mental states, adverse physiological states, and physical/mental limitations), and personnel factors (crew resource management and personal readiness).

  • Unsafe acts encompassing errors (skill-based errors, decision errors, and perceptual errors), and violations (routine and exceptional).

The purpose of the HFACS is to support the identification of failures through the analysis and categorization of human factors, serving as a guide for preventive actions and corrective training programs aimed at reducing the recurrence of undesirable events (Small 2020). For the effective application of the HFACS method, it is essential to distinguish between how tasks were actually performed and what was formally prescribed. This distinction enables the structured identification of contributing factors at different organizational levels that led to the occurrence of an accident or undesirable event (Correa and Cardoso Júnior 2007).

The importance of using human factors frameworks such as the HFACS for accident analysis in different domains is widely recognized in the literature, as it allows for the investigation of failures that extend beyond immediate unsafe acts. Correa and Cardoso Júnior (2007), in analyzing and classifying human factors in industrial accidents, argue that the modern form of prevention is based on the early identification of latent failures within the organization and the system.

Furthermore, the failure in decision-making under adverse conditions must be viewed through the lens of naturalistic decision-making (NDM), a field of study that provides a theoretical basis for understanding real-world critical decision situations in ambiguous and dynamic scenarios, such as those faced by the military, firefighters, and pilots (Hoebbel et al. 2024; Klein et al. 1989; Lourenço and Cardoso Júnior 2025), and that also supports structured post-accident analyses (Casale et al. 2026). The NDM departs from traditional rational models by focusing on how domain experts execute rapid, experience-based judgments when faced with uncertainty, emphasizing the critical ability to recognize patterns and initiate swift, efficient actions (Plant and Stanton 2016; Stanton et al. 2013).

Another framework adopted across various high-risk sectors, including aviation, oil and gas, nuclear power, and healthcare, is the bow tie diagram, a graphical method for representing and analyzing risk scenarios, structured to illustrate the causal pathways that link threats to potential adverse consequences (Fig. 2). The first bow tie diagrams reportedly appeared at the University of Queensland, Australia, in 1979, though the method’s exact origin remains unclear (Wolters Kluwer 2025b). This visualization tool demonstrates how a particular hazard can materialize through distinct threat mechanisms, depicted on the left-hand side of the diagram, and subsequently progress to diverse negative outcomes or consequences, shown on the right-hand side. Central to this representation is the concept of the “top event,” positioned at the midpoint of the diagram, serving as the pivotal moment at which the scenario transitions from a controlled to an uncontrolled state, thereby initiating a cascade of events toward undesirable consequences (CCPS 2018).

thumbnail of Figure 2
Figure 2
Bow tie diagram representation.

The utility of the bow tie diagram emerges from its structured depiction of risk management barriers, being used to analyze risks in changing pilot training, for example (Leitão et al. 2022). Preventive barriers, represented between threats and the top event, aim to reduce the likelihood of a hazard materializing. Conversely, mitigative barriers, positioned between the top event and the potential consequences, focus on limiting the severity or impact of outcomes once control is compromised (Voicu et al. 2018). It is noteworthy that the threats depicted on the left side of the bow tie diagram are typically latent, evolving gradually within the scenario and often remaining active for extended periods before culminating in a top event. As a result, preventive barriers designed to counteract these threats generally do not require rapid reaction capabilities. In contrast, the consequences on the diagram’s right side tend to manifest swiftly, leading rapidly to undesirable outcomes. Consequently, the recovery (mitigative) barriers positioned to the right of the top event must function with immediate effectiveness to prevent or mitigate adverse impacts. This twofold approach allows safety analysts and decision-makers to identify vulnerabilities, evaluate the effectiveness of existing control measures, and systematically implement additional safeguards to enhance resilience.

The application of both the HFACS and the bow tie is well-established in the aeronautical safety literature (Bills et al. 2023). Numerous studies have applied the HFACS to investigate accidents in aviation, and new approaches have evolved proposing the integration of artificial intelligence into the HFACS analysis to improve aviation safety (Liu et al. 2025). Similarly, the bow tie method has been widely used for proactive risk management in areas such as runway safety, maintenance procedures, air traffic control, and flight training (Leitão et al. 2022), effectively visualizing how safety barriers can prevent or mitigate undesirable events.

Several factors are associated with the occurrence of undesired events in aerospace activities and may justify the postponement or cancellation of missions, such as environmental and atmospheric conditions (Caruzzo et al. 2021). However, organizational factors can influence decision-makers to initiate or continue missions even under unfavorable weather conditions, thereby assuming elevated risks.

Prior research has indicated that pressure to fly (institutional or self-imposed) can make pilots prone to continuing flying operations under adverse climate conditions, but this factor alone cannot explain their decision to resume the flights (Casale et al. 2025). If they decided to continue flying, it is because they assessed that it was safe enough. In other words, for some reason, they did not identify the real hazards present in the situation and somehow judged that they would succeed in managing the bad weather conditions and finishing their missions. This suggests the existence of unexplored latent conditions that compromise safety in helicopter operations, and literature indicates that NDM tools and methods, such as the HFACS and bow tie diagrams, can be useful for identifying these latent factors.

In this context, aiming to identify potential patterns associated with accidents involving rotary-wing aircraft that occurred under weather conditions in which flight should have been avoided, this study seeks to apply the HFACS and bow tie methods to analyze helicopter accidents under adverse meteorological conditions and to examine, besides the pressure to fly, which systemic (latent) factors contribute to the misjudgment of pilots to believe that they could continue flying under such bad conditions, culminating in erroneous pilot decisions in adverse weather.

METHODOLOGY

This study employs a qualitative approach, and the accidents were selected based on the following criteria: (1) they involved helicopter operations worldwide in the last 10 years; (2) adverse meteorological conditions were present; and (3) official investigation reports were available. The HFACS coding process was conducted by mapping the contributing factors identified in the reports onto the corresponding categories within the four levels of the framework. As the number of cases studied is small, the findings are not intended to be statistically generalizable (which is beyond the objectives of this paper), but to illustrate recurring patterns and systemic vulnerabilities that warrant further attention, offering deep insights into the dynamics of the selected events.

Accident analysis

In this study, four accidents were selected for analysis using the HFACS framework and bow tie methods, which will be presented below.

Final Report A-157/CENIPA/2016

On December 4, 2016, at approximately 3:00 p.m. local time, the aircraft PR-TUN, model R44 II, departed from the Osasco Heliport en route to an event venue in the municipality of São Lourenço da Serra, carrying one pilot and three passengers.

The aircraft was in airworthy condition, with valid licenses, documentation, and maintenance records up to date. The pilot held a valid license, had experience with the aircraft model, and possessed an up-to-date medical certificate. However, the accident report identified shortcomings in the documentation of his training and noted deficiencies in the pilot’s performance during emergency procedures training. Although formally employed, the pilot did not have a regular flight schedule and was often called upon with little notice, which may have contributed to an environment of operational instability and urgency.

The flight in question was intended to transport a bride and two companions to the location of her wedding ceremony. Given the special nature of the occasion, several moments of the flight were recorded by the passengers, and these recordings, including key video frames, were used in the investigation and presented in the final report.

During the flight, weather conditions progressively deteriorated until the aircraft encountered instrument meteorological conditions (IMC). This type of operation is prohibited for the R44 II model, which is not certified for instrument flight, and the pilot was not qualified for such operations. Nevertheless, the pilot chose to continue the flight in an attempt to reach the destination, but ultimately lost control and crashed almost vertically. The aircraft was destroyed, and all occupants sustained fatal injuries.

Table 1 presents the HFACS analysis of the accident, highlighting the contributing factors identified in the official report. It can be noticed that pressure to complete the flight may have influenced the pilot’s decision to continue under adverse meteorological conditions. The report indicates that the pilot was frequently summoned on short notice, which may have created a sense of urgency to fulfill flight tasks. Given the emotional significance of the event for the bride, the passengers’ expectations to arrive at the ceremony, and the aircraft’s proximity to its destination, these elements may have influenced the pilot’s decision to proceed. It is also noteworthy that, at the time of the accident, the pilot had been formally employed by the operating company for only about two months, and this was his first formal aviation job with a fixed salary. This may have contributed to a perceived need to satisfy employer or passenger expectations, so as not to jeopardize his employment. These circumstances were further exacerbated by a degraded organizational climate. Evidence such as the company’s practice of transporting passengers without proper licensing suggests a systemic disregard for regulatory compliance. Moreover, a complacent leadership culture implicitly signaled to pilots that mission completion was expected “at any cost,” thereby reinforcing unsafe operational norms and influencing pilots’ behavior, although it is not possible to state with total confidence the cognitive biases and perceived stress of the pilot.

Thumbnail
Table 1
HFACS analysis for Final Report A-157/CENIPA/2016.

Nevertheless, these factors alone do not fully explain the decision to continue the flight. The pilot appeared confident that reaching the destination was feasible; otherwise, he likely would have aborted the mission. Omissions in his training records and his limited experience contributed to a lack of risk perception regarding the flight conditions he encountered. Moreover, he was unprepared to manage the emergency and relied solely on the Global Positioning System (GPS) indications, disregarding the aircraft’s original instruments, which were providing conflicting information in relation to the GPS. This reliance led to spatial disorientation, compromised the helicopter’s stability, and ultimately resulted in the crash. Therefore, the pilot’s lack of experience, inadequate training, and insufficient knowledge of adverse weather flight conditions fostered an overconfidence that led him to underestimate the risks and believe he could complete the mission.

The bow tie diagram presents the analysis of the threats, barriers, and consequences related to the loss of control over the helicopter (Fig. 3). The pilot’s lack of knowledge or experience can be inferred from the inadequate performance during assessments. Such deficiencies should have been addressed through training; however, the training provided was inadequate, given that assessments and observations were not properly recorded, thus hindering corrective actions to resolve the pilot’s identified shortcomings. This situation can be interpreted as a training-system failure, insofar as the training provided was not sufficiently effective and the deficiencies identified in the pilot’s competency were not adequately addressed. As a result, the pilot did not acquire the level of qualification required to manage an emergency scenario, leading to inconsistent and degraded performance when faced with unexpected conditions. Effective training programs must incorporate a robust feedback loop that systematically identifies weaknesses, corrects hazardous performance patterns, and ensures that pilots develop the cognitive and operational skills necessary for safe decision-making under stress.

thumbnail of Figure 3
Figure 3
Bow tie diagram for losing control over the helicopter in Final Report A-157/CENIPA/2016.

Pilot fatigue and the limited time available for planning could have been mitigated through appropriate crew scheduling. Additionally, the company’s organizational procedures proved inadequate, and supervision of scheduling practices appeared to be nonexistent. In this case, had the company or the regulatory agencies properly supervised the flight plans and alerted those responsible to the improvised nature of the operations, the irregularities would likely have been identified. Effective regulatory oversight, including formal notification to the operator and systematic assessment of its activities, would have revealed multiple non-conformities, such as the conduct of irregular public transport. In such circumstances, regulatory action would have resulted in the suspension of the company’s operational activities until regularization.

These latent conditions and the absence of effective barriers, occurring in a permissive environment and with a newly hired pilot who was possibly feeling pressured to fly (due to the factors described in the previous analysis), contributed to an unintended IMC situation, which resulted in a loss of control of the helicopter (top event).

On the right side of the diagram, the emergency procedures were faulty, and the use of incorrect equipment for orientation, ignoring the helicopter instruments, represented breaking the last barriers to mitigate the consequences of the accident, which resulted in four fatalities and the destruction of the helicopter. There was no mention of an evacuation plan to the nearest hospital, but all occupants were fatally wounded at the moment of the crash, so even an effective evacuation plan would not have avoided the human losses.

Final Report A-165/CENIPA/2018

On November 3, 2018, at approximately 06:45 p.m. local time, the A109E helicopter, PP-MTX, departed from São Sebastião to Osasco, both in the state of São Paulo. The aircraft, operating under private flight, was carrying four passengers, and the pilot was also the owner of the operating company. The pilot, a well-known businessman, was described as active, determined, and hardworking. He flew recreationally on weekends, typically once a month, and had professional commitments outside aviation. The aircraft had been recently acquired, and the pilot had limited experience with this new model, which had been chosen for its advanced onboard technology and perceived safety benefits.

During the flight, weather conditions deteriorated significantly. Thunderstorms, heavy rainfall, and strong winds were reported, with radar and satellite imagery confirming the presence of dense cumulonimbus (CB) clouds along the route. Although both the pilot and one passenger were aware of the adverse weather, explicitly discussed during the flight, the decision was made to continue. As a result, the helicopter entered IMC, despite the pilot lacking the required licensing. The aircraft subsequently lost control, impacted the ground, and was destroyed. All occupants sustained fatal injuries.

Cockpit voice recorder data indicated that after the NAV mode of the autopilot system disengaged, the aircraft exhibited abrupt variations in heading, altitude, and engine power. The final report concluded that the pilot experienced spatial disorientation and visual illusions, impairing his judgment and control of the aircraft. His limited experience with night flying in this specific helicopter model further hampered risk perception and decision-making. No evidence of mechanical failure was found.

According to the analysis presented in Table 2 and based on the HFACS framework, the unsafe acts included the decision to continue the flight under IMC and the pilot’s difficulty in managing the aircraft. Preconditions for unsafe acts included excessive reliance on automated systems, lack of practice with the aircraft under those flight conditions, and improper use of cockpit instruments.

Thumbnail
Table 2
HFACS analysis for Final Report A-165/CENIPA/2018.

At the unsafe supervision level, the pilot’s training process was found to be informal. No instruction logs, training plans, or evaluation reports were available, and instruction was conducted at the discretion of the endorsing pilot, in accordance with the regulations at the time. Organizational influences revealed an informal operational structure. Flight scheduling was conducted via messaging applications, with no established procedures or clear division of responsibilities, limiting the adoption of consistent safety practices. This may have contributed to creating a climate of complacency and lower care about safety, shaping pilot behavior.

Furthermore, the pilot had advanced another flight initially scheduled for the following day, anticipating worsening weather conditions. As a result, he performed three flight segments on the day of the accident. Pilot personality traits such as proactiveness and determination, combined with overconfidence in the newly acquired aircraft, contributed to a predisposition to complete the mission. It is plausible to infer that self-imposed pressure influenced the decision to continue flying in adverse weather conditions, ultimately leading to the accident. Finally, a comprehensive assessment of the circumstances suggests that, due to his limited experience in aviation, treated as a recreational activity, the pilot failed to recognize the severity of initiating a night IMC flight without proper certification.

Figure 4 presents the bow tie diagram for the accident. Among the identified threats, the adverse weather conditions, including CB clouds, heavy rain, and strong winds, played a central role. Despite this, the flight was initiated without adequate preflight briefings or weather risk assessment, and the onboard radar was not properly used for weather avoidance. Adequate training on the capabilities and limitations of the weather radar could have enhanced the pilot’s situational awareness, improving his ability to interpret meteorological cues, avoid hazardous weather regions, and adopt safer courses of action. The sequential failure of these two safety barriers (insufficient training on weather-radar use and the pilot’s complacency in conducting a flight-planning process that properly incorporated weather-risk assessment) constituted a critical breakdown in the defensive layers that, if effectively addressed, might have prevented the accident.

thumbnail of Figure 4
Figure 4
Bow tie diagram for losing control over the helicopter in Final Report A-165/CENIPA/2018.

Operationally, complacency and inadequate proficiency were observed, as the pilot demonstrated overconfidence and limited experience in night VFR operations. These factors should have been addressed through formal IFR training and better supervision, which were either absent or informally conducted. Again, supervision was a barrier that was absent and could have avoided the continuity of unsafe operations, potentially preventing the accident.

Additionally, the flight planning process was informal and unstructured, and no procedural oversight or adherence to planning protocols was in place. These latent organizational conditions contributed to a context in which a non-instrument-rated pilot proceeded into IMC, ultimately resulting in spatial disorientation and loss of control of the helicopter.

On the right side of the diagram, the failure of the mitigation barriers. Although some mitigation barriers are typically expected in such scenarios, such as upset recovery training, flight control management procedures, and the proper use of instruments for spatial orientation, none was effectively employed. Emergency procedures were also insufficient to manage the disorientation and deteriorating conditions.

Final Report the National Transportation Safety Board (NTSB)/Aircraft Accident Report (AAR)-21/01

On January 26, 2020, at approximately 09:07 local time, a Sikorsky S-76B helicopter operated by Island Express Helicopters departed from John Wayne Airport in Santa Ana, California, heading to Camarillo Airport in Camarillo, California. The aircraft was carrying one pilot and eight passengers.

During the flight, the helicopter encountered adverse weather conditions, including dense fog and low cloud ceilings, resulting in significantly reduced visibility. Despite these conditions, the pilot chose to proceed under visual flight rules (VFR). As the flight progressed, the aircraft inadvertently entered IMC, even though neither the pilot held an instrument rating nor was the helicopter certified for instrument flight operations.

According to the official report, the pilot experienced spatial disorientation and judgment errors. Furthermore, the aircraft was not equipped with critical technological safety barriers, such as the Terrain Awareness and Warning System. This sequence of events culminated approximately 40 minutes after takeoff, when the helicopter impacted terrain during a steep descent in Calabasas, California. The aircraft was destroyed, and all occupants sustained fatal injuries.

The analysis based on the HFACS, as outlined in Table 3, identified failures at multiple levels. At the level of unsafe acts, the decision to continue the flight in deteriorating weather conditions represented a violation of operational protocols and disregarded guidance on avoiding inadvertent entry into IMC. At the level of preconditions for unsafe acts, the investigation highlighted that the pilot experienced spatial disorientation after losing external visual references, likely exacerbated by vestibular illusions. At the level of unsafe supervision, the report pointed to deficiencies in the implementation of the operator’s Safety Management System, particularly the lack of effective mechanisms to monitor and evaluate risk assessment forms completed by pilots.

Thumbnail
Table 3
HFACS analysis for Final Report NTSB/AAR-21/01.

The investigation found no evidence of direct pressure from the operator or client to conduct the flight. In fact, the company had a clearly defined policy to suspend flights in adverse weather and resume only once conditions improved. However, the report emphasized the role of self-imposed pressure as a key factor in the pilot’s poor decision-making. It is noteworthy that the pilot regularly transported the principal passenger, basketball player Kobe Bryant, and had developed a personal friendship with him. Thus, the continuation of the flight despite worsening weather was attributed to a combination of the pilot’s desire to meet the client’s expectations, the absence of a viable alternate plan, and a growing continuation bias as the aircraft neared its destination. Additionally, reports indicated that the main passenger specifically requested this pilot for his flights, which may have further reinforced a sense of personal commitment, prompting the pilot to persist in completing the mission.

Therefore, although the pressure was neither institutional nor explicitly imposed, the operational environment and interpersonal relationships created favorable conditions for the emergence of psychological self-imposed pressure. This latent factor, when combined with organizational shortcomings and flawed individual decisions, contributed to the tragic outcome of the flight by influencing pilot actions and decisions to continue the flight even in adverse weather conditions.

The bow tie diagram indicates that certain threats, including an outdated flight risk assessment tool, self-imposed pressure, and increased workload from air traffic control calls and the transponder identity button, converged on the top event: spatial disorientation and loss of control. Preventive barriers failed, were inadequate, or missing. The helicopter entered IMC, the pilot became disoriented, and a rapid descent began. Mitigating barriers failed, and consequently, the aircraft struck the ground at high speed, causing nine fatalities and total loss of the helicopter.

Regarding the barriers that failed, the bow tie diagram (Fig. 5) provides insight into the following aspects: supervision of flight planning may exhibit a low detection probability for unsafe practices when workload is high, oversight is delegated, or informal norms tolerate “routine” deviations. Human-centered barriers are particularly sensitive to time pressure and cognitive load.

thumbnail of Figure 5
Figure 5
Bow tie diagram for Final Report NTSB/AAR-21/01.

The effectiveness of IMC/aeronautical decision-making training and organizational procedures depends not only on the quality of the training content but also on recall under stress and the time available to apply the learned strategies, as a barrier that is theoretically robust but systematically activated too late behaves, from a risk perspective, as a failed barrier. A clear illustration of this principle can be observed in semi-automatic parachute jumps. If a jumper experiencing a main-parachute malfunction initiates the reserve parachute less than 4 seconds before ground impact, the deployment will be ineffective. This occurs because the reserve canopy requires approximately 2 seconds to fully inflate and an additional 2 seconds to decelerate the jumper to a survivable descent rate.

Helicopter accident number 4

To preserve anonymity and confidentiality, specific details of this accident have been withheld, and only aspects relevant to the analysis are discussed. The event involved a helicopter crash occurring in a forested region during a rescue mission. The aircraft entered dense cloud formations, lost control, crashed, and was destroyed, resulting in fatalities. The HFACS analysis identified that operational pressure related to organizational influences significantly contributed to the accident, as mission accomplishment was prioritized, prompting the crew to disregard weather-related risks. The accident report indicates that the prevailing organizational culture encouraged pilots to prioritize mission accomplishment, even when faced with risks that should have been considered prohibitive or, at the very least, required more rigorous planning and risk assessment before authorizing takeoff or postponing the operation. This institutional emphasis on completing missions appears to have fostered a sense of obligation among the crew, potentially pressuring them to proceed under conditions that warranted greater caution. Consequently, the internalization of this “mission-first” mindset may have influenced the crew to attempt to fulfill the task under any circumstances, despite operational limitations and environmental hazards. Furthermore, the crew was accustomed to operating under adverse weather conditions, which increased their confidence to initiate the mission despite being aware of hazardous formations along the route. Unsafe supervision contributed to the lack of measures to inhibit the flight in such climatic conditions. Regarding unsafe acts, the crew improperly utilized the weather radar to navigate through and avoid cloud formations, a practice recognized as incorrect, as elaborated subsequently. The corresponding bow tie diagram is shown in Fig. 6, evidencing the barriers that failed, were missing, or inadequate. In this case, an emphasis can be given to the lack of training, which led to a misuse of the meteorological radar, and the safety culture, attributing less importance to safety than recommended.

thumbnail of Figure 6
Figure 6
Bow tie diagram for accident number 4.
Discussion on the accident analyses

The findings of this analysis, which highlight the critical role of organizational pressures and unsafe supervision as latent conditions leading to accidents, are consistent with broader trends identified in other aviation safety studies that utilize the HFACS framework. Research in commercial and military aviation has similarly demonstrated that while pilot errors (unsafe acts) are the most immediate cause of accidents, they are often symptoms of systemic issues within the organization (Wiegmann and Shappell 2017). The consistency of these findings across different aviation sectors underscores that the pressures and supervisory shortcomings identified in our helicopter case studies are not unique, but rather indicative of a wider challenge in safety management. By integrating the bow tie analysis, this study further contributes by visually demonstrating the failure points of specific safety barriers in the chain of events, a dimension that offers practical insights for targeted interventions.

Pressure to perform missions typically emerges at the organizational influences level in the HFACS. The analysis of the accidents described in Final Reports A-157/CENIPA/2016 and NTSB/AAR-21/01 reveals a complex interaction of factors that may increase operators’ propensity to continue flight under adverse conditions. In both accidents, interpersonal dynamics, including client dependency, friendship with the principal passenger, and the vulnerability associated with being recently hired, cultivated a strong sense of personal commitment. Pilots working in privately contracted or client-dependent contexts often occupy hybrid professional identities (simultaneously aircraft commanders and service providers), which can generate a perceived obligation to satisfy clients or safeguard employment stability. In the helicopter accident number 4, in turn, professional identity motivated this sense of obligation to accomplish the mission, leading to a similar mechanism. The literature on NDM in aviation indicates that, under uncertainty and time pressure, individuals rely extensively on experience-based heuristics and context-specific cues to sustain task continuity, even when environmental conditions begin to degrade (Lourenço and Cardoso Júnior 2025). Within such environments, subtle interpersonal expectations, organizational performance norms, and financial dependencies may transform into internalized motivational pressures that suppress salient risk cues and reinforce continuation bias. These mechanisms are consistent with the findings of Correa and Cardoso Júnior (2007), who emphasize that latent organizational pressures, systemic expectations, and informal norms and values frequently exert stronger influence on operator behavior than formal directives.

Factors associated with decision-making and perceptual errors belong to the unsafe acts level, underscoring the need for integrated training and reinforced operator capabilities. Enhancing basic training and adherence to aircraft operational constraints and crew competencies could prevent repeated dangerous decisions during flight planning and execution. Such shortcomings led crews to falsely perceive a safe operational margin. Scenarios wherein pilots progressively descend to avoid adverse weather until they cannot avoid the clouds anymore and visual references are lost (resulting in spatial disorientation within clouds), can be preemptively mitigated through appropriate training and awareness measures. Among conditions observed in the four accidents studied, improper use and inadequate understanding of meteorological radar proved particularly hazardous, even for experienced pilots, and will thus be examined in further detail below.

Organizational culture can meaningfully shape operators’ judgment and contribute to the emergence of unsafe decision-making patterns. Research in aviation and industrial safety consistently demonstrates that latent organizational conditions, such as weak safety climates, permissive leadership norms, and ambiguous operational boundaries, create environments in which frontline personnel are more likely to commit violations or underestimate operational risks. Classic analyses of latent failures, such as those by Correa and Cardoso Júnior (2007), highlight how organizational processes, resource constraints, and systemic vulnerabilities influence individual behavior long before an accident manifests. Evidence from the Brazilian helicopter sector reinforces this dynamic: maintenance-related accidents frequently originate from organizational and supervisory deficiencies rather than from isolated human errors (Silva Júnior et al. 2024). These insights align with the HFACS logic adopted in this study by illustrating how pilots’ decisions in deteriorating weather conditions can be traced back to organizational climates that normalize risk acceptance, high workload, and flexible rule compliance.

Within the HFACS, the role of organizational culture emerges when examining level 4 (organizational influences), particularly resource management and organizational climate. In the accidents analyzed, recurrent deficiencies at this level indicate a degraded safety culture in which safety programs may be perceived primarily as administrative obligations, whereas commercial priorities, sense of personal obligation, and mission completion receive implicit preference. Such internalized organizational pressure substantially contributes to pilots’ willingness to depart or continue flying even under non-ideal conditions. Moreover, the organizational climate, understood as the prevailing “atmosphere” of the work environment and shaped by the deeper organizational culture, interacts with shortcomings at level 3 (unsafe supervision). Inadequate oversight or a perceived leniency from supervisory bodies can reinforce a permissive environment that tolerates, or even tacitly encourages, operations in adverse weather. In some cases, the limited intervention of regulatory agencies in monitoring training-center practices or ensuring timely correction of technical deficiencies may be interpreted by operators as institutional complacency, thereby normalizing improvised or substandard operational practices. This systemic tolerance further normalizes risk-accepting behavior, ultimately validating the pilot’s decision to pursue the mission despite the hazards involved.

Meteorological radar

Meteorological radar emits radio waves, typically X-band frequencies in modern systems, which reflect off weather phenomena and return to antennas. The reflected data is then displayed inside the cockpit, using a color gradient from green to red. The radar display colors correspond to reflectivity rather than directly indicating hazard severity. Certain high-risk conditions, such as dry ice at the upper portion of the CB clouds, exhibit low reflectivity and appear green despite their danger. Although directing the radar to a lower position can reveal yellow and red regions some thousand feet below the route, indicating a dangerous region ahead (just above a CB), this radar characteristic knowledge, followed by continuous adjustments of radar tilt, range, and gain during flight, is essential for accurate situational awareness.

Regions with high-density cloud formations may absorb radar waves, creating shadow zones that falsely suggest open “corridors” or clear paths ahead. Thus, meteorological radar should strictly be utilized to avoid formations rather than navigate between them, preventing false corridor interpretations. Figure 7 illustrates an example of such a false corridor impression (left image), contrasted with adjusted range settings revealing a central cloud formation (right image). A pilot relying solely on initial radar indications, and using it for the wrong purposes (overestimating meteorological radar capabilities and ignoring its intrinsic limitations), would inadvertently direct the aircraft into the center of a larger, hidden formation.

thumbnail of Figure 7
Figure 7
False corridor impression due to the use of the wrong range (on the left), in contrast to the use of a further range (on the right) for the meteorological radar.
Recommended actions to improve safety

To address the need for concrete interventions and based on the evidence identified in the four accidents studied, this paper proposes the following strategies, which focus on systemic failures (HFACS level 4 and level 3) and training deficiencies (level 2), as well as reinforce the barriers that failed in the bow tie diagram:

First, it is recommended to restructure supervision by the regulatory agencies, as accidents documented in Final Reports A-157/CENIPA/2016 and A-165/CENIPA/2018 reveal a pattern of organizational deficiencies that had persisted well before the accidents occurred. More effective regulatory surveillance would likely have detected evidence of operational violations and systemic non-conformities, thereby triggering corrective actions aimed at addressing inappropriate organizational practices within the companies involved.

Second, educating crews about the NDM, recognition-primed strategies, cue detection under uncertainty, and mitigations for continuation bias would allow pilots to recognize the mechanisms behind taking decisions under stress, with incomplete information and in time-sensitive dynamic environments.

Finally, training should emphasize the correct use of meteorological radar, orienting about the risks of the interpreting of the false corridor effect and reinforcing that radar must be used for avoidance rather than navigation between weather formations. Special attention should be given to showing the risks and consequences of misusing the meteorological radar, providing real examples of accidents to show how situations can escalate quickly and make the rotorcraft uncontrollable.

CONCLUSION

The HFACS analysis of the four accidents systematically identified pressures to operate flights under degraded weather conditions, consistently categorized at level 4 (organizational influences). These pressures encompassed implicit institutional and self-imposed factors often associated with pilot-passenger dynamics, organizational cultures emphasizing punctuality, or critical mission urgencies, notably in the case of the rescue operation. These pressures were exacerbated by pilot inexperience, which impaired effective risk perception. At level 3 (unsafe supervision), deficiencies in operational oversight mechanisms were identified, failing to prevent flights from initiating or continuing despite deteriorating weather. Level 2 (preconditions for unsafe acts) highlighted contributing factors such as pilot fatigue, inadequate rest, gaps in training, and insufficient psychological preparedness to handle critical decisions under stress. At level 1 (unsafe acts), operational violations were observed, including unauthorized entry into IMC, errors in judgment, poor situational awareness, and spatial disorientation.

The bow tie diagrams illustrated latent conditions that existed prior to the accidents, which could have been mitigated by barriers that ultimately failed, were absent, or inadequate. Once the top event occurred, limited time was available for crews to effectively respond or mitigate consequences, with inadequacies in barriers on the diagram’s right side significantly contributing to insufficient mitigation and resultant fatalities.

The analysis using both models revealed that decisions to fly under adverse weather were driven by organizational and self-imposed pressures. However, these pressures alone did not fully explain the pilots’ decision to continue the flights. Ultimately, overconfidence, misuse of onboard instruments, incorrect interpretation of instrument data, or misconceptions about avionics functions, stemming from insufficient training, experience, and knowledge of adverse weather flight conditions, played a critical role. These mechanisms help explain how seemingly rational pilots become increasingly committed to a deteriorating course of action, even when objective risk indicators are clearly present.

Finally, actions to address some of the identified issues and improve safety were proposed, aiming mainly at supervision and training about decision-making under stress and the use of meteorological radar.

ACKNOWLEDGMENTS

We acknowledge to CAPES, as this study was financed in part by the Coordenação de Aperfeiçoamento de Pessoal de Nível Superior - Brasil (CAPES) - Finance Code 001.

  • DECLARATION OF USE OF ARTIFICIAL INTELLIGENCE TOOLS
    In the preparation of this manuscript, AI tools were utilized to support language refinement. Gemini (Google) was employed for grammatical correction and proofreading. No AI tool was involved in the conceptualization, methodology, data analysis, or interpretation of results.
  • FUNDING
    Coordenação de Aperfeiçoamento de Pessoal de Nível Superior
    Finance Code 001

DATA AVAILABILITY STATEMENT

All data sets were generated or analyzed in the current study.

REFERENCES

Edited by

Publication Dates

  • Publication in this collection
    02 Mar 2026
  • Date of issue
    2026

History

  • Received
    28 July 2025
  • Accepted
    13 Jan 2026
Creative Common - by 4.0
This is an Open Access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
location_on
Departamento de Ciência e Tecnologia Aeroespacial Instituto de Aeronáutica e Espaço. Praça Marechal do Ar Eduardo Gomes, 50. Vila das Acácias, CEP: 12 228-901, tel (55) 12 99162 5609 - São José dos Campos - SP - Brazil
E-mail: submission.jatm@gmail.com
rss_feed Acompanhe os números deste periódico no seu leitor de RSS
Reportar erro