P H O T O : P H O T O L COVER STORY I HUMAN FACTORS SPECIAL B R A R Y - T O N Y S T O N E Heroic compensations: The “brainy bunch”: (left to right) Professor The benign face of the human factor James Reason, originator of the “Swiss cheese” model of accident causation; Captain Dan Maurino, head of human factors at the International Civil HERE ARE TWO approaches to studying human perform- Aviation Organization; and Dr Bob Helmreich, n ance in high-technology hazardous systems: one involves Gimli glider: On 23 July 1983, a Boeing 767 chance of landing. By the time the aircraft This was heroic improvisation at its most the “fly-on-the-wall” observation of normal activities; the aircraft enroute to Edmonton from Ottawa ran reached the beginning of the runway, it had to inspired. Director of the University of Texas human factors T research project, which has conducted thousands of other is triggered by the occurrence of an adverse event. An out of fuel over Red Lake, Ontario,about halfway be flying low enough and slowly enough to land Theoretical framework: The literature provides observations of how crew recover from threat and o “event” is something untoward that disrupts the flow of normal to its destination. The reasons for this were a within the length of the 7,200ft [2,200m] relatively little in the way of theoretical guidance error in normal operations. or intended activities and which may, and often does, have combination of inoperative fuel gauges, fuel runway. when it comes to understanding and facilitating harmful consequences. loading errors and mistaken assumptions on the “As they approached Gimli, Captain Pearson these remarkable adaptations. Most safety- •Reason, Helmreich and Maurino were key speakers s In human factors research at least, there can be little doubt that part of the flight crew. These errors and system and First Officer Quintal discussed the possi- related studies have focused upon identifying at the fifth Australian aviation psychology the dominant tradition is the event-dependent one. Such analyses failures were dealt with at length in the 104-page bility of executing a side-slip to lose height and those factors that create moments of vulnera- symposium, which was held in Manly, Sydney, in focus upon the errors and violations that either constitute or report of the Board of Inquiry. speed close to the beginning of the runway. This bility rather than elucidating the nature of November 2000, and was organised by the Australian a contribute to an event. The worse the event, the more intensive is Only three paragraphs were devoted to the the captain did on the final approach and resilience. The two notable exceptions are, firstly, Aviation Psychology Association (AAvPA). the investigation of the preceding decisions and actions.As a result, most extraordinary feature of this event: the touched down within 800ft [244m] of the the observation-based analyses of high-reliability Membership of AAvPA is open to all individuals or we have learned a good deal about the varieties of unsafe acts and, forced landing at Gimli, a disused military threshold.” organisations; and, secondly, the more person- organisations interested in aviation psychology and e to a lesser degree,we know something of the circumstances that can airstrip, from which all 61 passengers and eight The last laconic sentence is a masterpiece of oriented work on mental readiness in the human factors; the cost is $30 per year, plus a joining provoke and shape them. flight crew walked away unharmed from an achievement of sporting and surgical excellence. fee of $15. Membership application forms are Unfortunately, this has established a very biased view of the aircraft that was fit for service after relatively It is unlikely that either Although these two research areas derive from available from www.vicnet.net.au/~aavpa/. human factor—as something that is causally implicated in the minor repairs. different disciplinary backgrounds, they reveal R For more information about the Association, large majority of bad events. To compound the problem further, When the second engine stopped, the aircraft “Boeing or Captain Pearson’s similar processes operating at both the organi- contact the AAvPA President, Dr Graham Edkins: stating that people make errors is probably one of the least inter- was at 35,000ft and 65nm from Winnipeg. All sational and individual levels. [email protected]. esting observations about the human condition – on a par with the electronic gauges in the cockpit had ceased to employers had ever There would appear to be at least two vital declaring that we breathe oxygen and will some day die. Such infor- function, leaving only stand-by instruments components underpinning both high-reliability s mation is undoubtedly important, but hardly newsworthy. operative. The first officer, an ex-military pilot, imagined the side-slip organisations and individual excellence: Nonetheless, errors are sufficiently uppermost in the minds of the recalled that he had flown training aircraft in and • a mindset that expects unpleasant surprises. managers of hazardous technologies that they often regard the out of Gimli, some 45 miles away. When it manoeuvre being applied to • the flexibility to deploy different modes of e main goal of safety management as the elimination of human falli- became evident that they would not make it to adaptation in different circumstances. bility rather than the avoidance of its damaging consequences. Winnipeg, the captain, in consultation with air In short, there is a mental element and an So if human fallibility is a mere truism,what is there that is really traffic control, redirected the aircraft to Gimli, a ... jet airliner. action element. Of these, the former is at least as interesting about human performance? The answer I believe,lies on now 12 miles away on the shores of Lake ” important as the latter. Effective contingency the reverse side of the coin.As operators of complex systems, people Winnipeg. The report continues as follows: understatement:“It is unlikely that either Boeing planning at both the organisational and the m have an unmatched capacity to adapt and adjust to the surprises “Fortunately for all concerned, one of Captain or Captain Pearson’s employers had ever imag- personal levels depends on the ability to antici- thrown up by a dynamic and uncertain world. This includes the Pearson’s skills is gliding. He proved his skill as a ined the side-slip manoeuvre being applied to a pate a wide variety of crises. Both components often remarkable ability to compensate for their own errors. glider pilot by using gliding techniques to fly the wide-bodied jet airliner.” are resource-limited.Any person or organisation a Making errors is a fact of life, but recovering them – particu- large aircraft to a safe landing. Without power, As it turned out however, it was almost can only foresee and prepare for a finite number larly when these recoveries involve heroic improvisations – is quite the aircraft had no flaps or slats to control the certainly the only way that the aircraft could have of possible circumstances and crisis scenarios. another matter. rate and speed of descent. There was only one made a safe landing under those circumstances. Crises consume available coping resources J 28 > FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 FLIGHT SAFETY AUSTRALIA, JANUARY-FEBRUARY 2001 < 29 HUMAN FACTORS SPECIAL cumulatively eroding the limited compensa- relating to the operational hazards. This cogni- tory resources of the surgical team. All [operators] make tive stability depends critically upon an The message from this study was clear. All informed culture – or what Weick and his surgeons make errors, but the best of them “errors, but the best ... have colleagues have called “collective mindfulness”. have the ability to compensate for any adverse Collective mindfulness allows an organisation effects. This ability depends on the skill and the ability to compensate to cope with the unanticipated in an optimal experience of the surgeon, as well as the extent manner. “Optimal” does not necessarily mean to which they have mentally rehearsed the for [them]. This ability “on every occasion”, but the evidence suggests detection and recovery of their errors. that the presence of such enduring cognitive The “Swiss cheese” model The variability paradox: The reduction – or depends on the ... extent to processes is a critical component of organisa- even elimination – of human error has now tional resilience. of accident causation become one of the primary objectives of which they have mentally Since catastrophic failures are rare events, system managers. Errors and violations are collectively mindful organisations work hard to viewed, reasonably enough, as deviations rehearsed the detection and extract the most value from what little data they from some desired or appropriate behaviour. have. They actively set out to create a reporting The new Reason “Swiss Cheese” model: All systems have and adverse events. This ability is eroded as the number of minor Having mainly an engineering background, culture by commending, even rewarding, people multiple layers of defence against hazards and errors. It is only when events increases. All operators make errors, but the best of them recovery of their errors. such managers attribute human unreliability for reporting their errors and near misses. the failures in these defences line up that an accident or incident have the ability to compensate for any adverse effects. This ability to unwanted variability. So, as with technical They work on the assumption that what results. depends on their skill and experience, as well as the extent to which ” unreliability, they see the solution as one of pated events, they distinguish two aspects of might seem to be an isolated failure is likely to The last line of defence, represented in the model by a slice of they have mentally rehearsed the detection and recovery of their ensuring greater consistency of human organisational functioning: cognition and come from the confluence of many “upstream” cheddar cheese, is the operator’s ability to compensate for errors errors.