P H O T O : P H O T O L

COVER STORY I HUMAN FACTORS SPECIAL B R A R Y -

T O N Y S T O N E

Heroic compensations:

The “brainy bunch”: (left to right) Professor The benign face of the human factor James Reason, originator of the “Swiss cheese” model of accident causation; Captain Dan Maurino, HERE ARE O ppro ches to studying hum n perform- head of human factors at the International Civil TW a a a

n nce in high-technology h z rdous systems: one involves g r: On 23 July 1983, ch nce of l nding. By the time the ircr ft his w s heroic improvis tion t its most Aviation Organization; and Dr Bob Helmreich, a a a Gimli lide a a a a a T a a a the “fly-on-the-wall” observation of normal activities; the aircraft enroute to Edmonton from ran reached the beginning of the runway, it had to inspired. Director of the University of Texas human factors T other is triggered by the occurrence of n dverse event. An out of fuel over Red L e,Ont rio, bout h lfw y be flying low enough nd slowly enough to l nd e re c fr ew r : he literature provides research project, which has conducted thousands of a a ak a a a a a a Th o ti al am o k T

o event is something untow rd th t disrupts the flow of norm l to its destin tion. he re sons for this were within the length of the 7,200ft [2,200m] relatively little in the way of theoretical guidance observations of how crew recover from threat and “ ” a a a a T a a or intended ctivities nd which m y, nd often does, h ve combin tion of inoper tive fuel g uges, fuel runw y. when it comes to understanding and facilitating error in normal operations. a a a a a a a a a harmful consequences. loading errors and mistaken assumptions on the “As they approached Gimli, Captain Pearson these remarkable adaptations. Most safety-

•Reason, Helmreich and Maurino were key speakers s In human factors research at least, there can be little doubt that part of the flight crew. These errors and system and First Officer Quintal discussed the possi- related studies have focused upon identifying at the fifth Australian aviation psychology the dominant tradition is the event-dependent one.Such analyses failures were dealt with at length in the 104-page bility of executing a side-slip to lose height and those factors that create moments of vulnera- symposium, which was held in Manly, Sydney, in focus upon the errors and violations that either constitute or report of the Board of Inquiry. speed close to the beginning of the runway.This bility rather than elucidating the nature of

November 2000, and was organised by the Australian a contribute to an event. The worse the event, the more intensive is Only three paragraphs were devoted to the the captain did on the final approach and resilience.The two notable exceptions are,firstly, Aviation Psychology Association (AAvPA). the investigation of the preceding decisions and actions.As a result, most extraordinary feature of this event: the touched down within 800ft [244m] of the the observation-based analyses of high-reliability Membership of AAvPA is open to all individuals or we have learned a good deal about the varieties of unsafe acts and, forced landing at Gimli, a disused military threshold.” organisations; and, secondly, the more person- organisations interested in aviation psychology and e to a lesser degree,we know something of the circumstances that can airstrip, from which all 61 passengers and eight The last laconic sentence is a masterpiece of oriented work on mental readiness in the human factors; the cost is $30 per year, plus a joining provoke and shape them. flight crew walked away unharmed from an achievement of sporting and surgical excellence. fee of $15. Membership application forms are Unfortunately, this has established a very biased view of the aircraft that was fit for service after relatively It is unlikely that either Although these two research areas derive from available from www.vicnet.net.au/~aavpa/. human factor—as something that is causally implicated in the minor repairs. different disciplinary backgrounds, they reveal R For more information about the Association, large majority of bad events. To compound the problem further, When the second engine stopped, the aircraft “Boeing or Captain Pearson’s similar processes operating at both the organi-

contact the AAvPA President, Dr Graham Edkins: stating that people make errors is probably one of the least inter- was at 35,000ft and 65nm from . All sational and individual levels. [email protected]. esting observations about the human condition – on a par with the electronic gauges in the cockpit had ceased to employers had ever There would appear to be at least two vital declaring that we breathe oxygen and will some day die.Such infor- function, leaving only stand-by instruments components underpinning both high-reliability

s mation is undoubtedly important, but hardly newsworthy. operative. The first officer, an ex-military pilot, imagined the side-slip organisations and individual excellence: Nonetheless,errors are sufficiently uppermost in the minds of the recalled that he had flown training aircraft in and • a mindset that expects unpleasant surprises. managers of hazardous technologies that they often regard the out of Gimli, some 45 miles away. When it manoeuvre being applied to • the flexibility to deploy different modes of e main goal of safety management as the elimination of human falli- became evident that they would not make it to adaptation in different circumstances. bility rather than the avoidance of its damaging consequences. Winnipeg, the captain, in consultation with air In short, there is a mental element and an So if human fallibility is a mere truism,what is there that is really traffic control, redirected the aircraft to Gimli, a ... jet airliner. action element.Of these,the former is at least as interesting about human performance? The answer I believe,lies on now 12 miles away on the shores of Lake ” important as the latter. Effective contingency the reverse side of the coin.As operators of complex systems,people Winnipeg. The report continues as follows: understatement:“It is unlikely that either Boeing planning at both the organisational and the m have an unmatched capacity to adapt and adjust to the surprises “Fortunately for all concerned,one of Captain or Captain Pearson’s employers had ever imag- personal levels depends on the ability to antici- thrown up by a dynamic and uncertain world. This includes the Pearson’s skills is gliding.He proved his skill as a ined the side-slip manoeuvre being applied to a pate a wide variety of crises. Both components often remarkable ability to compensate for their own errors. pilot by using gliding techniques to fly the wide-bodied jet airliner.” are resource-limited.Any person or organisation a Making errors is a fact of life, but recovering them – particu- large aircraft to a safe landing. Without power, As it turned out however, it was almost can only foresee and prepare for a finite number larly when these recoveries involve heroic improvisations – is quite the aircraft had no flaps or slats to control the certainly the only way that the aircraft could have of possible circumstances and crisis scenarios. another matter. rate and speed of descent. There was only one made a safe landing under those circumstances. Crises consume available coping resources J

28 > FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 < 29 HUMAN FACTORS SPECIAL

cumulatively eroding the limited compensa- relating to the operational hazards. This cogni- tory resources of the surgical team. All [operators] make tive stability depends critically upon an The message from this study was clear. All informed culture – or what Weick and his surgeons make errors, but the best of them “errors, but the best ... have colleagues have called “collective mindfulness”. have the ability to compensate for any adverse Collective mindfulness allows an organisation effects. This ability depends on the skill and the ability to compensate to cope with the unanticipated in an optimal experience of the surgeon, as well as the extent manner. “Optimal” does not necessarily mean to which they have mentally rehearsed the for [them]. This ability “on every occasion”, but the evidence suggests detection and recovery of their errors. that the presence of such enduring cognitive The “Swiss cheese” model The variability paradox: The reduction – or depends on the ... extent to processes is a critical component of organisa- even elimination – of human error has now tional resilience. of accident causation become one of the primary objectives of which they have mentally Since catastrophic failures are rare events, system managers. Errors and violations are collectively mindful organisations work hard to viewed, reasonably enough, as deviations rehearsed the detection and extract the most value from what little data they from some desired or appropriate behaviour. have. They actively set out to create a reporting The new Reason “Swiss Cheese” model: All systems have and adverse events. This ability is eroded as the number of minor Having mainly an engineering background, culture by commending,even rewarding,people multiple layers of defence against hazards and errors. It is only when events increases. All operators make errors, but the best of them recovery of their errors. such managers attribute human unreliability for reporting their errors and near misses. the failures in these defences line up that an accident or incident have the ability to compensate for any adverse effects. This ability to unwanted variability. So, as with technical They work on the assumption that what results. depends on their skill and experience, as well as the extent to which ” unreliability, they see the solution as one of pated events, they distinguish two aspects of might seem to be an isolated failure is likely to The last line of defence, represented in the model by a slice of they have mentally rehearsed the detection and recovery of their ensuring greater consistency of human organisational functioning: cognition and come from the confluence of many “upstream” cheddar cheese, is the operator’s ability to compensate for errors errors. action. activity. causal chains.Instead of localising failures,they They do this through procedures and by The cognitive element relates to being alert generalise them. Instead of applying local very rapidly.Only those people or organisations so as to permit the full circulation of oxygenated happen when major adverse events, usually the buying more automation. What they often to the possibility of unpleasant surprises and repairs, they strive for system reforms. They do that have invested a considerable amount of blood. Without such an intervention, the child result of errors, go uncompensated. Happy fail to appreciate however, is that human vari- having the collective mindset necessary to not take the past as a guide to the future. preparatory effort in the pre-crisis period will would die. outcomes – by far the majority – are due in ability in the form of moment-to-moment detect, understand and recover them before Aware that system failures can take a wide be able to deploy compensatory responses in a The children upon whom the ASO is large part to effective compensation by the adaptations and adjustments to changing they bring about bad consequences. variety of yet-to-be-encountered forms,they are sufficiently timely and appropriate manner so performed are born with the great vessels of surgical team. events is also what preserves system safety in Traditional “efficient”organisations strive for continually on the lookout for “sneak paths”or as to maintain the necessary resilience. the heart connected to the wrong ventricles: On average, there were seven adverse events an uncertain and dynamic world. And therein stable activity patterns, yet possess variable novel ways in which active failures and latent These three concepts – cognitive readiness, the aorta is connected to the right ventricle per procedure. One of these was life-threat- lies the paradox. By striving to constrain cognitions – these differing cognitions are most conditions can combine to defeat or by-pass the pre-prepared responses and the restricted nature and the pulmonary artery to the left ventricle. ening (a major event); the remaining six were human variability, they are also undermining obvious before and after a bad event. In high- system defences. of coping resources – proved to be extremely The operation may last for five to six hours relatively minor events that disrupted the one the system’s most important safeguards. reliability organisations,on the other hand,flex- Professor James Reason, Department of valuable in interpreting the data obtained from and is highly demanding both technically and surgical flow but did not immediately jeopar- The problem has been encapsulated by ibility is encouraged in their activity,but there is Psychology, University of Manchester, the surgical study described below. in human terms. dise the safety of the patient. Nearly all of these Weick’s insightful observation that “reliability consistency in the organisational mindset Manchester, UK. Good compensators: Over the past few years, The most challenging part of the procedure events arose as the result of errors on the part is a dynamic non-event”. It is dynamic because we have been investigating the compensations involves relocating the coronary arteries, each of the surgical team. processes remain under control due to carried out by UK paediatric cardio-thoracic comprising very thin friable tissue. The arterial Over half the major events were successfully compensations by human components. It is a Be prepared surgical teams during the course of the neonatal switch procedure takes the surgical team – and compensated. When this happened, there was non-event because safe outcomes claim little arterial switch procedure.We were fortunate in particularly the consultant surgeon – close to no increase in the risk of death in that partic- or no attention. •Human variability is both a source of error and a vital system defence. How having a skilled human factors observer present the edges of the human performance envelope ular procedure. However, only 20 per cent of The paradox is rooted in the fact that acci- can we limit one while still promoting the other? at 165 of these procedures.In other words,it was on a variety of parameters: psychomotor skills, the minor events were compensated. Surgical dents are salient, while non-events by defini- •The key to resilience at both the individual and an event-independent study. Twenty-one naturalistic decision making, and in its claims teams varied in their compensatory success. tion are not. Recently, Weick and his co- organisational levels lies in being mentally prepared for nasty surprises, and consultant surgeons in 16 institutions upon knowledge, experience, leadership, Good compensators had good outcomes. workers have challenged the perceived wisdom having the counter-measures in place to deal with them. throughout the country performed these management and communication skills. Compensation for minor events was far less that an organisation’s reliability depends upon •The ability to make effective compensations appears to be resource-limited, neonatal switch operations Errors of one kind or another are almost important than their total number within a the consistency, repeatability and invariance of and is liable to be eroded by the cumulative effects of minor stressors. The arterial switch operation (ASO) involves inevitable under such conditions. What given operation. The larger the numbers of its routines and activities. Unvarying perform- •Mental preparedness and flexibility of response help to limit the stress- correcting cardiovascular congenital defects in matters are not the errors per se but whether minor events, the less likely were the team to ance, they argue, cannot cope with the unex- related attrition of these crucial coping abilities. very young babies by transposing the great or not they are detected and recovered. In the cope effectively with a major event. Minor pected. To account for the success of high-reli- arteries – the pulmonary artery and the aorta – surgical context, as we shall see, bad outcomes events appeared to exert an additive effect by ability organisations in dealing with unantici-

30 > FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 < 31 COVER STORY HUMAN FACTORS SPECIAL

A closer inspection: What really happens in the cockpit

CHIEVING SAFETY requires accurate data about the into a de-identified database and no crew the error. Decision errors. When crews choose to follow way an organisation functions in normal operations and actions are reported to management or the Varieties of error: Drawing from the obser- a course of action that unnecessarily how it responds to threat and error. regulatory agency. vations of error, we have been able to classify increases risk to the flight in a situation not h A However, airlines have historically relied on data from From the information we have collected, we all of the errors seen into five broad categories: governed by formal procedures, this action performance in training and on formal proficiency checks are confident that trust has been achieved, and procedural errors, communications errors, is classified as a decision error. For example,

c conducted in simulators. that we are indeed observing normal opera- decision errors, proficiency errors and viola- crews may choose not to deviate around These data provide accurate information on a pilot’s tech- tions. tions. weather on their flight path, resulting in an i nical competence and ability to respond to particular challenges. One of the important aspects of LOSA is the Procedural errors. These are what most people encounter with turbulence. In the case of line oriented evaluation (LOE) the data show fact that it captures exemplary as well as defi- think of as errors: crews intending to follow a Proficiency errors. This classification is

e ability to respond to normal and abnormal situations. Data are cient performance: it is important for organi- applied to situations where a crew member also obtained from line checks in which an evaluator grades sations to know areas in which they excel as lacks the knowledge or stick-and- skill

r performance during normal flight operations. well as those in need of improvement. The data show that 72 necessary to perform a task. A number of The limitation of this kind of data is that they do not tell you Observers generate a narrative of the flight “ observed proficiency errors involve lack of how crews behave when they are not under formal surveillance. classified by phase. Coding begins with crew per cent of flights observed knowledge of flight deck automation. Are the behaviours during formal evaluation routinely followed behaviour in the pre-flight phase and includes Intentional non-compliance. When crews by crews not under scrutiny? ratings of the behavioural markers of CRM obviously and intentionally violate company m encountered one or more Another source of safety data comes from monitoring digital practices developed by the University of Texas or regulatory requirements, these are classified l flight data recorders (flight operations quality assurance or group (see Helmreich and Foushee, 1993 for threats, with an average of as intentional non-compliance errors. Failing FOQA). FOQA data provide a precise record of flight parame- history). to abort an unstable approach as required by

e ters and crew actions and have been hailed as a major contri- Up to 1997 we observed more than 3,000 two per flight ... company procedures would fit into this classi- bution to safety. flight segments in five airlines using ratings fication. However, the limitation of FOQA data is that no informa- based on CRM behaviours. Since 1997 the ” The outcomes of threats and errors can be tion is recorded about why particular actions were taken. research group has focussed explicitly on procedure, but doing it incorrectly. Procedural inconsequential or consequential. In our H Finally, formal analyses of data on accidents and incidents threat and error, and has observed more than errors include the usual classification of slips, methodology, consequential errors are those

provide insights, but are limited because they are rare events 1,000 flight segments. This involves coding lapses and mistakes. This type of error can that result in an undesired aircraft state or lead that may not be representative. external threats to safety and errors committed only be committed when actions are covered to additional crew error. Undesired aircraft To get a full picture of crew behaviour and system perform- by external agents such as air traffic control. by formal procedures. states include deviations from desired naviga-

b ance and to check on the impact of safety initiatives such as The behavioural markers employed to manage Communications errors. These involve fail- tional path or altitude, unstable approaches, crew resource management (CRM), our research group at the threat are also coded. ures in the transfer of information, including long or hard landings, being on the wrong University of Texas at Austin placed specially trained, expert Error is classified in LOSA as deviation from misstatements, misunderstandings and omis- runway or taxiway and arriving at the wrong

o observers in the cockpit of normal line flights. We call this a organisational or crew expectations or inten- sions. The identification of communications airport or wrong country. Most undesired line operation safety audit, or LOSA. tions. Errors committed by the flight crew are errors in accident investigations provided states put flights at increased risk. The critical difference between a LOSA flight and a line check described and coded along with actions (if impetus for the development of CRM When an error (or threat) becomes conse- is LOSA’s guarantee of anonymity for the crew. Data are entered any) taken to deal with the consequences of training. quential, the crew is no longer managing threat B

32 > FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 < 33 COVER STORY HUMAN FACTORS SPECIAL and error, their task becomes management of one or more violations and those with none. the undesired state. We then looked at the incidence and conse- Since 1997, we have conducted six formal quences of other types of errors by each group. LOSAs involving US and foreign air carriers We found that crews with a violation were using the threat and error management almost twice as likely to commit one of the methodology. The data show that 72 per cent other four types of error and that the errors of flights observed encountered one or more were nearly twice as likely to be consequential. threats, with an average of two per flight and Examination of the outcomes of error while in 12 per cent no attempt to alleviate tions of this are that the methodology can be of threat and error counter-measures. Using the model as a template can aid in the a range of 0 to 17. The most frequently reveals that 85 per cent of all errors are incon- the situation was observed. used to sample any type of operation and can Using the data from LOSA, we have devel- identification and remediation of latent threats encountered threats were adverse weather (34 sequential – evidence of the error tolerance of There was also substantial variability in the show norms and also variability in a highly oped a model of threat and error management. before they have adverse consequences. per cent), ATC actions or errors (34 per cent) occurrence of threat and error across phases complex system. The model fits well with Reason’s renowned Non-jeopardy assessment of crew behaviour and aircraft malfunctions (15 per cent). of flight (see table below). Consistent with the Value assured: Organisations that have partic- “Swiss cheese”model (1990). It recognises both provides a valid picture of normal flight oper- Errors were observed on 68 per cent of flights, The most frequent type of global accident rate, it is not surprising to find ipated in LOSA have been enthusiastic about overt and latent threats and how they fit into ations. The fact that a majority of the errors again with an average of two per segment and a that the highest percentage of both threats and its value. The data provide management with management of error and undesired states. The observed involved violations of procedures or range of 0 to 14. The most frequent source of “error – more than half of errors were encountered in the approach and information that helps them to prioritise safety error component of the model is shown in the regulations indicates that crews trust the error was data entry into the mode control panel landing phase. What is surprising is the fact initiatives, and training departments can use diagram below. system and do not perceive the observations or flight management computer. The second that more than 20 per cent of threats and the information to develop targeted training. The model is proving useful as a guide to as threatening their status. most frequent error involved the use and comple- those observed – was non- errors were found during the pre- The various types of error suggest different the analysis and understanding of incidents tion of checklists. The figure below shows the departure/taxi phase, emphasising the impor- remedial strategies. For example, a high inci- and accidents and is being employed by the Bob Helmreich is head of the University of percentage of each error type as well as the compliance or violation. In tance of pre-flight and departure activities. dence of violations can point to poor proce- safety department of one major airline. Texas Human Factors Research Project. percentage of each type classified as consequen- We note that the most significant differences dures, weak leadership, and/or a culture of tial. contrast, proficiency errors between national cultures found in our survey non-compliance. ERROR MANAGEMENT The most frequent type of error – more than of pilots in more than twenty nations related Procedural errors may suggest poor work- half of those observed – was non-compliance or were the least frequent (five to the importance of adhering to rules. load management or may be a reflection of violation. In contrast, proficiency errors were The US scored as the least accepting of the inadequate procedures. Communications the least frequent (five per cent) – a tribute to per cent). importance of following rules. As a result of errors may reflect a need for more focus on the qualification standards of the airlines. these cultural differences, we would not expect CRM, especially interpersonal communica- Intentional Non-compliance Violations matter: With only two per cent of to find a comparable percentage of intentional tions issues. ” Procedural violations leading to undesired aircraft states, it non-compliance errors in cultures higher on Similarly, decision errors may suggest a Error Types Communucation is tempting to say that most intentional non- the aviation system. Of those errors that were the rules and order dimension. need for further CRM concentration on Proficiency compliance is of little import, a bit like driving consequential, 12 per cent resulted in unde- A high degree of variability was found expert decision making and risk assessment. just over the speed limit. However, analysis sired aircraft states and three per cent resulted between airlines in the number of threats Finally, proficiency errors suggest a need to Operational Decisions suggests that this is not the case: violations in additional error, creating an error chain. encountered, the number of errors committed tighten standards for qualification and eval- matter since those who violate place a flight at When the error resulted in an undesired and the percentage leading to undesired uation. greater risk. aircraft state, 79 per cent of these were miti- aircraft states. Requests from airlines in the US and abroad Trap We reached this conclusion by splitting the gated by crew action. In two per cent of the This is hardly surprising as the airlines far outstrip the capabilities of the University Error Responses Exacerbate database into two groups, those flights with cases crew action exacerbated the situation sampled differed in many ways. The implica- of Texas research group. The current LOSA Fail to respond procedures are better suited to research than to operational assessment. The research team THREAT AND ERROR ERROR TYPE aims to develop a more user-friendly set of procedures that can be applied by organisa- tions for self-assessment. Error Outcomes Inconsequential Undesired State Additional Error As it grows, the database can be used to 54 answer very specific questions, for example is Non-compliance 2 crew performance better with the captain or Phase of Flight Threat % Error % 29 the first officer flying? Based on data from Mitigate Procedural Undesired State Pre Departure / Taxi 22% 23% 23 3,800 flights, the answer is that it makes no Exacerbate difference if the environment is benign, but Responses Take-off / Climb 28% 24% 6 Fail to Respond Communications 13 effectiveness is significantly higher in complex, Cruise 10% 13% 5 challenging environments with the first officer Descent / Approach / 39% 40% Proficiency 69 flying (Hines, 1997). Land 6 One of the strengths of the LOSA project is Incident/ Decision the fact that a database is being developed that Undesired State Recovery Additional Error Taxi / Park 1% 2% 43 Accident allows organisations to compare their results Outcomes 0 10 20 30 40 50 60 70 80 with those of other airlines. Such comparisons help in interpretation of the significance of, Threat and error by phase of flight Percentage of error type (orange) and percentage The error management component of the University of Texas threat and error for example, the number of procedural and of each type classified as consequential (black) management model. decision errors observed and the effectiveness

34 > FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 < 35 COVER STORY HUMAN FACTORS SPECIAL

Tired of sweeping up at the end of the parade

nalysis of the behaviour of operational personnel in acci- humans are generally very effective in applying of aviation and therefore capture only the dents and incidents has traditionally been the method the right mechanisms to achieve success, hence ... operational personnel external manifestations of errors. Second, inci- Aused to assess the impact of human performance on the extraordinary safety record of aviation. dents are self-reported, so the processes and o Hum n o om m o n “ develop informal and m n m un n n o m no safety. a s d s eti es fail t bala ce the echa is s derlyi g a err r ay t reflect The behaviour preceding a negative outcome is analysed, compromise, so contributing to safety break- reality.Third – and most importantly – incident searching for human error, with usually only limited consider- downs. However, since successful compromises spontaneous group reporting systems are vulnerable to what has

n ation of the processes that could have led to the “bad”outcome. far outnumber failures, in order to understand been described as “normalisation of deviance”.

i An investigator will already know that the behaviours displayed human performance in context the industry practices that circumvent Normalised deviance:Over time, operational by operational personnel were “bad” because the negative needs to systematically analyse the mecha- personnel develop informal and spontaneous outcomes are a matter of record, a benefit the operational nisms underlying successful compromises, group practices that circumvent poor equip- r poor equipment design, personnel obviously did not have at the time. In this sense, inves- rather than those that failed. ment design, clumsy procedures, or policies tigators examining human performance in safety occurrences Incident and accident investigation: The clumsy procedures, or incompatible with operational realities, all of enjoy the benefit of hindsight. most widely used tool to document operational which complicate operational tasks. Precisely u Conventional wisdom holds that, in aviation, safety is first. human performance and define remedial policies incompatible with because they are normal, neither these prac- Consequently, human behaviours and decision-making are strategies is the investigation of accidents. tices nor their down sides will be noted by inci- considered to be totally safety oriented. However, all produc- However, there are limits to the lessons avail- dent reporting systems. a operational realities, all of tion systems – and aviation is no exception – generate a migra- able through this process. This problem is compounded by the fact that tion of behaviours: under the imperative of economics and effi- For example, it might be possible to identify which complicate the most willing reporters may not fully appre- ciency, people tend to operate at the edges of the system’s safety the type and frequency of errors, or discover ciate what events should be reported. If you space. specific training deficiencies related to identi- operational tasks. are continuously exposed to substandard

M A more realistic approach is to consider operational behav- fied errors, but this is only the tip of the iceberg. managerial practices, poor working conditions, iours and decision-making as a compromise between produc- Nevertheless, accident investigation has a ” or flawed equipment, you might have difficulty tion and safety. The optimum behaviours to achieve the produc- clear role within the safety process. It remains strophic state of affairs. Should accident inves- working out what problems are reportable. tion demands may not be fully compatible with what is needed the appropriate tool to uncover unanticipated tigation restrict itself to mere retroactive While these factors would arguably be to achieve the theoretical safety demands. In fact, it might be failures in technology or rare, bizarre events. If analyses, its only contribution in terms of reported if they generated incidents, there u dth t th t d m of p t not y of p n only no m l op t on mon to d humn o ouldb n d ndu t yd t - m ns th d ff ult t s of v lu t ng ho n arg e a e ra e ark ex er s is ears ex erie ce, r a era i s were i re , a err r w e i crease i s r a a re ai e i ic a k e a a i w but how effectively they manage the compromise between defining assumptions about safe/unsafe behav- bases, the usefulness of which remains dubious. they create less than safe situations. production and safety. iours would prove to be a task without a frame Incidents are more telling markers than acci- Incident reporting systems are better than Op t on o donot d nth p on on n- o n d nt t t o t m t u th d nt n t t on fo und t nd n a era i al err rs resi e i e ers , as c ve f refere ce. e s – a leas f sys e safe y – beca se ey acci e i ves iga i s r ers a i g tional safety knowledge would have us believe. They reside Therefore, a properly focussed and contem- signal weaknesses within the overall system system and operational human performance. within task and situational factors, emerging as the consequence porary accident investigation can reveal how before it breaks down. There are, nevertheless, Their value lies in pinpointing areas of concern; of mismanaging compromises between safety and production. specific behaviours, including errors and error limits to the value of this information. however, incident information does not neces-

D These compromises are a complex and delicate balance, and management, can generate an unstable or cata- First, incidents are reported in the language sarily capture the concerns themselves.

36 > FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 < 37 Essential knowledge from Airservices Publications HUMAN FACTORS SPECIAL Beyond Aviation Emergency Position Human Factors for Human Factors Indicating Radio the Professional Pilot Daniel E Maurino, James Reason, Trevor Thom Neil Johnston and Rob B Lee Beacons (EPIRB) Less demand for skill and The observation of training behaviours, such the quantity and quality of regulation, new A broad view applying aviation psychology more stamina are now placed on a EPIRBs are completely self-contained as flight crew simulator training, is another tool technology, or new training, error will continue effectively to the practicalities of aviation, and pilot. The mental, social, The majority of errors radio transmitters designed for encompassing the whole aviation system. It covers management and leadership which can help us to understand operational to be a factor in operational environments emergency use. When activated, they training, systems safety, organisational culture, skills have become paramount. human performance. However, training behav- “ have no damaging because it is simply the down side of human simultaneously transmit an passengers, ground operations and maintenance. Certainly the pilot still needs to internationally recognised distress iours re he vily bi sed tow rds s fety, things cognition. learn how to manipulate the a a a a a – ...the most authoritative text on aviation signal on both 121.5 and 243 MHz. controls and to navigate, but are done “by the book”, providing only an Error is a conservation mechanism afforded psychology and human factors to date. They are designed to be used when consequences because these skills alone are insufficient. approximation of behaviour during line opera- by human cognition to allow us to operate flex- Canadian Aeronautics and Space Journal the safety of you, your craft or your Training is not preparing us, as well as it should, for crew is endangered and you have no the essential tasks of wise decision-making and tions. operational personnel ibly under demanding conditions for prolonged WEB ISBN: 9781840149487 m mm other eans of co unication. effective interpersonal communications. Digital Flight Data Recorder (DFDR) and periods without draining our mental batteries. Now available in softcover, only $62.70 Q Fits comfortably into your pocket WEB ISBN: 9781875537594 $59.95 Quick Access Recorder (QAR) information In other words,error is the price we pay for being (approx. 65mm x 140mm x 20mm; 200 gms) employ successful coping from normal flights are valuable diagnostic able to think on our feet. Q Supplied complete with protective carry case. Handling In-Flight Human Performances tools. While DFDR/QAR read-outs provide In operational contexts, errors that are Fitted with long life Lithium Iron Disulphide strategies, and system Q information on the frequency operational caught in time and do not produce damaging Emergencies batteries. & Limitations limits are exceeded and their locations, these consequences are, for practical purposes, This information packed Q 48 hour minimum continuous transmission time. Tony Wilson defences act as a manual for private and cannot yield information on the human behav- inconsequential. Counter-measures to error Full function test facility allows the beacon to be Airlines are placing greater emphasis on human recreational pilots, flight Q checked at any time. factor training, and safety authorities are including a iours leading to an event. Pilot reports are still should not just look at avoiding errors; but instructors and students containment net. greater element of human factors in examination at all necess y to p ov de the context n wh ch to r ther to m ing them visible nd tr pping describes a variety of Q COSPAS/SARSAT satellite compatible. ar r i i i a ak a a licence levels. This comprehensive manual outlines procedures that can be used to diagnose the problems. them before they produce damaging conse- Q GME Electrophone 5 year warranty. the people skills which must be learnt. Such skills successfully cope with almost ” include communication, leadership, decision-making, Although probably under utilised because defences act as a containment net. It is by quences. This is the essence of error manage- any emergency situation in the Q Meets CASA regulations for aviation use. and knowledge of our human condition and the of cultural and legal factors, DFDR/QAR data understanding these successful strategies and ment. air. By following the advice in Q Can also be used for bush walking and hiking, environmental factors of flight The manual covers the can help to identify the operational contexts defences that we can best learn to shape reme- Under a Line Operation Safety Audit (LOSA), this practical guide, you ll establish a regular training offshore yachting, parachuting and small boating. level of knowledge required for pilots aspiring to an routine that will improve your ability to handle Q Australian made and designed! aviation career, and is designed to introduce the within which migration of behaviours dial strategies, rather than by continuing to flaws in human performance and the prevalence emergencies and to reduce your chances of being in subject to private pilots and new commercial pilots towards the edge of the system’s safety limits focus solely on failures. of error are taken for granted, and the objective an emergency situation. WEB ISBN: EPIRB who are self-developing their knowledge and skills. take place. Looking only at data after the fact feels a bit becomes improving the context within which WEB ISBN: 9780070150935 $64.90 RRP $299.00 NOW ONLY $253.00 . WEB ISBN: HPAL $26 40 In order to uncover the mechanisms under- like trying to design a good celebration by humans perform.LOSA aims ultimately to intro- lying the human contribution to failures and focussing on “sweeping up after the parade”.It is duce a buffer zone or time delay between an error Qty Product Price successes in we need to focus essential to move beyond the visible manifes- and the point its consequences become a threat to ...... on the monitoring of normal line operations. tations of error when designing remedial safety. The better the quality of the buffer or the Any typical line flight involves inevitable – strategies. longer the time delay, the stronger the tolerance ...... mostly inconsequential – errors. Examples A new approach: Progressing to normal of the operational context to the negative conse- ...... include selecting wrong frequencies, dialling operations monitoring requires adjusting the quences of human error...... wrong altitudes, acknowledging incorrect read- prevailing view of human error. In the past, The challenge for the large-scale implemen- + Postage $8.50 backs and mishandling switches and levers. safety analyses in aviation have viewed human tation of analysis of normal operations is to Some errors are due to flaws in human perform- error as an undesirable and wrongful manifes- overcome the obstacles presented by a blame- Order Form Total ...... ance, others are fostered by shortcomings in the tation of human behaviour. In recent years, a oriented industry. Pilot Licence Number / ARN ...... Name / Company ...... system; most are a combination of both. considerable body of practically oriented Captain Daniel E. Maurino is head of the Address ...... The majority of errors have no damaging research has substantiated a fundamental human factors program for the International consequences because operational personnel concept of human cognition: error is a normal State ...... Postcode ...... Civil Aviation Organization. employ successful coping strategies, and system component of human behaviour. Regardless of Delivery address (if different than above) ...... Tel (bh) ...... (ah) ...... ASHLEY PROJECTS Email: ...... * If ordering from overseas, payment should be in the form of a bankdraft, in Australian dollars, or by credit card. Overseas postage rates available upon application. Aviation Consultants I enclose a cheque for A$ ...... Please debit my credit card with amount A$ ...... Specialising in operating techniques for the light Twin Charter market. Card type ...... Number ...... Aircraft purchasing advice. Including log Exp ...... Signature ...... book searches and AD compliance

F reports. S

PO Box 1986, Carlton South, Vic 3053, Australia A 0 1 0

1 Philip Smith, Principal• PUBLICATIONS CENTRE Call 24 hours 1300 306 630, or fax (03) 93474407 Phone: 0419 191 167 Fax: 08 9493 1967 Easy ordering through www.airservices.gov.au/publications Email: [email protected]

FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 < 39 COVER STORY HUMAN FACTORS SPECIAL Score your safety culture

YES ? NO CHECKLIST FOR ASSESSING INSTITUTIONAL RESILIENCE Money vs Safety: It is appreciated that commercial goals and safety issues can come into conflict. Measures are in place to recognise and resolve such    Scoring: YES = This is definitely the case in my organisation (scores 1); ? = “Don’t know”, “maybe” or $ conflicts in an effective and transparent manner. “could be partially true” (scores 0.5); NO = This is definitely not the case in my organisation (scores zero). YES ? NO Reporting encouraged: Policies are in place to encourage everyone to raise Mindful of danger: Top managers are ever mindful of the human and organisational safety-related issues (One of the defining characteristics of a pathological culture is that     factors that can endanger their operations.     messengers are “shot” and whistleblowers dismissed or discredited). Top management accepts occasional setbacks and Accept setbacks: Trust: The organization recognises the critical dependence of a safety management nasty surprises as inevitable. They anticipate that staff will make errors    system on the trust of the workforce – particularly in regard to reporting and train them to detect and recover from them.    ! systems. A safe culture – that is, an informed culture – is the product of a reporting culture that, in turn, can only arise from a just culture. Committed: Top managers are genuinely committed to aviation  safety and provide adequate resources to serve this end.    Qualified indemnity: Policies relating to near miss and incident reporting systems make clear the organisation’s stance regarding qualified indemnity against sanctions, Regular meetings: Safety-related issues are considered at high-level meetings on a       confidentiality, and the organisational separation of the data-collecting ✍ regular basis, not just after some bad event. department from those involved in disciplinary proceedings. Events reviewed: Past events are thoroughly reviewed at top-level meetings and the lessons Blame: Disciplinary policies are based on an agreed (ie, negotiated) distinction learned are implemented as global reforms rather than local repairs.    between acceptable and unacceptable behaviour. It is recognised by all staff

 that a small proportion of unsafe acts are indeed reckless and warrant  Improved defence: After some mishap, the primary aim of top management is to sanctions, but that the large majority of such acts should not attract identify the failed system defences and improve them, rather than to seek to divert    punishment. The key determinant of blameworthiness is not so much the act    responsibility to particular individuals.  itself – error or violation – as the nature of the behaviour in which it was Health checks: Top management adopts a proactive stance towards safety. embedded. Did this behaviour involve deliberate unwarranted risk-taking, or That is, it does some or all of the following: takes steps to identify recurrent error traps a course of action likely to produce avoidable errors? If so, then the act would and remove them; strives to eliminate the workplace and organisational factors be culpable regardless of whether it was an error or a violation. likely to provoke errors; “brainstorms” new scenarios of failure; and conducts    regular “health checks” on the organisational processes known to contribute Non-technical skills: Line management encourages their staff to acquire to mishaps. the mental (or non-technical) as well as the technical skills necessary to achieve safe and effective performance. Mental skills include anticipating possible errors and rehearsing the Institutional factors recognised: Top management recognises that error-provoking appropriate recoveries. Such mental preparation at both the individual and    institutional factors (like under-manning, inadequate equipment, inexperience, patchy training,    organisational level is one of the hallmarks of high-reliability systems, and bad human-machine interfaces, etc.) are easier to manage and correct than fleeting goes beyond routine simulator checks.  psychological states such as distraction, inattention and forgetfulness. Data: It is understood that the effective management of safety, just like any other Feedback: The organisation has in place rapid, useful and intelligible feedback management process, depends critically on the collection, analysis and    channels to communicate the lessons learned from both the reactive     dissemination of relevant information. and proactive safety information systems. Throughout, the emphasis is  upon generalising these lessons to the system at large. Vital signs: Management recognises the necessity of combining reactive outcome data (ie, the near miss and incident reporting system) with active process Acknowledge error: The organisation has the will and the resources to acknowledge information. The latter entails far more than occasional audits. It involves the    its errors, to apologise for them, and to reassure the victims (or their relatives) that the    regular sampling of a variety of institutional parameters (scheduling, lessons learned from such accidents will help to prevent their recurrence. budgeting, fostering, procedures, defences, training, and the like), identifying   which of these “vital signs” are most in need of attention, and then carrying out remedial actions. INTERPRETING YOUR SCORE HEALTH WARNING 16-20 So healthy as to be barely credible. High scores on this checklist provide no guarantee of immunity from accidents or Staff attend safety meetings: Meetings relating to safety are attended by staff    11-15 You’re in good shape, but don’t forget to be uneasy. incidents. from a wide variety of departments and levels. 6-10 Not at all bad but there’s still a long way to go. Even the “healthiest” institutions can still have bad events. But a moderate to good 1-5 You are very vulnerable. score (8-15) suggests that you are striving hard to achieve a high degree of robust- 0 Jurassic Park ness while still meeting your other organisational objectives. The price of safety is Assignment to a safety-related function (quality or risk management) ▲ Career boost: chronic unease: complacency is the worst enemy. is seen as a fast-track appointment, not a dead end. Such functions are accorded    There are no final victories in the struggle for safety. appropriate status and salary. Checklist written by Professor James Reason and presented at the 2000 Manly Conference.

40 > FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 < 41