Beyond Aviation Human Factors

Safety in High Technology Systems

Daniel E. Maurino, James Reason, Neil Johnston, Rob B. Lee

• Publisher: Routledge
• Year: 2017
• ISBN:
  9781351955690
• Edition: 1
• Topic: Technology & Engineering
• Subtopic: Aviation
• Index: Technology & Engineering

The authors believe that a systematic organizational approach to aviation safety must replace the piecemeal approaches largely favoured in the past, but this change needs to be preceded by information to explain why a new approach is necessary. Accident records show a flattening of the safety curve since the early Seventies: instead of new kinds of accident, similar safety deficiencies have become recurrent features in accident reports. This suggests the need to review traditional accident prevention strategies, focused almost exclusively on the action or inaction's of front-line operational personnel. The organizational model proposed by the authors is one alternative means to pursue safety and prevention strategies in contemporary aviation; it is also applicable to other production systems. The model argues for a broadened approach, which considers the influence of all organizations (the blunt end) involved in aviation operations, in addition to individual human performance (the sharp end). If the concepts of systems safety and organizational accidents are to be advanced, aviation management at all levels must be aware of them. This book is intended to provide a bridge from the academic knowledge gained from research, to the needs of practitioners in aviation. It comprises six chapters: the fundamentals, background and justification for an organizational accident causation model to the flight deck, maintenance and air traffic control environments. The last chapter suggest different ways to apply the model as a prevention tool which furthermore enhances organizational effectiveness. The value of the organizational framework pioneered by Professor Reason in analyzing safety in high-technology production systems is felt by his co-authors to have an enduring role to play, both now and in coming decades. Applied now in this book, it has been adopted by ICAO, IFATCA, IMO, the US National Transportation Safety Board, the Transportation Safety B

1 Widening the search for accident causes: a theoretical framework

Introduction

This book is about extending the scope of accident analysis from individuals to organizations, from the 'sharp end' to the top-level management of the air transportation system as a whole. In aviation, as in other complex technologies, we are in the age of the organizational accident (Reason, 1990). That is, accidents in which pre-existing and often long-standing latent failures, arising in the organizational and managerial sectors, combine with local triggering conditions –; on the flight deck, in air traffic control centres and in maintenance facilities –; to penetrate or bypass the aviation system's multiple defences.

Every age has a dawning. In the maritime world, Mr Justice Sheen's judgement on the causes of the capsize of the Herald of Free Enterprise represents one such marker. After acknowledging the shipboard (or active) errors of the Master, the Chief Officer and the Assistant Bosun, he wrote:

But a full investigation into the disaster leads inexorably to the conclusion that the underlying or cardinal faults lay higher up in the Company . . . From top to bottom the body corporate was infected with the disease of sloppiness. (Sheen, 1987)

In aviation, we are indebted to Commissioner Moshansky's inquiry into the crash at Dryden, Ontario, perhaps the most exhaustive investigation ever undertaken into an aircraft accident. On the face of it, the accident was due to the Captain's flawed decision to take off in a heavy snow squall without de-icing protection from ground contamination. But Commissioner Moshansky interpreted his brief more widely. Introducing his findings, he wrote:

The accident at Dryden on March 10, 1989, was not the result of one cause but of a combination of several related factors. Had the system operated effectively, each of the factors might have been identified and corrected before it took on significance. It will be shown that this accident was the result of a failure in the air transportation system. (Moshansky, 1992)

The main purpose of this chapter is to outline a theoretical framework that seeks to provide a principled basis both for understanding the causes of organizational accidents and for creating a practical remedial toolbag that will minimize their occurrence. This framework traces the development of an accident sequence from organizational and managerial decisions, to conditions in various workplaces (flight decks, hangars, etc.), and thence to the personal and situational factors leading to errors and violations. It identifies both an active and a latent failure pathway to an event, where an event is defined as the breaching, absence or bypassing of some or all of the system's various defences and safeguards. Such an event may have disastrous consequences or it may merely serve as a 'free lesson'. The outcome depends upon the local circumstances and how many of the defences-in-depth are removed.

The pursuit of safety in aviation, as elsewhere, has seen many fashions. Is this organizational approach just another passing fad, or does it have something of real substance to offer? To answer this question, we have to look in some detail at the tangled question of individual versus collective (i.e. managerial and organizational) contributions to accidents.

Individual or collective errors?

This issue has a number of related dimensions. The first is a moral one, relating to blame, responsibility and legal liability. The second is scientific, having to do with the nature of cause and effect in an accident sequence. The third is entirely practical, and concerns which standpoint, individual or collective, leads to more effective countermeasures.

The moral dimension

From a moral or legal perspective, there is much to be gained from pursuing an individual rather than a collective approach to accident causation. The reasons are listed below.

• It is much easier to pin the legal responsibility for an accident upon the errors and violations of those in direct control of the aircraft or vessel at the time of the accident. The connection between these individual actions and the disastrous outcome is far more easily proved than are any possible links between earlier management decisions and the accident. This was clearly shown by the failed prosecution of the managers implicated (by the Sheen Inquiry) in the capsize of the Herald of Free Enterprise.
• This is further compounded by the willingness of professionals such as aircraft captains and ships' masters to accept this responsibility. They are accorded substantial authority, power and prestige and, in return, they are expected (and expect) to 'carry the can' when things go wrong. The buck and the blame traditionally stops with them.
• Most people place a large value on personal autonomy, or the sense of free will. We also impute this to others, so that when we learn that someone has committed an error with bad consequences, we assume that this individual actually chose an error-prone rather than a 'sensible' course of action. In other words, we tend to perceive the errors of others as having an intentional element, particularly when their training and status suggest that 'they should have known better'. Such voluntary actions attract blame and recrimination, which in turn are felt to deserve various sanctions.
• Our judgements of human actions are subject to similarity bias. We have a natural tendency to assume that disastrous outcomes are caused by equally monstrous blunders. In reality, of course, the magnitude of the disaster is determined more by situational factors than by the extent of the errors. Many bad accidents rise from a concatenation of relatively minor failings in different parts of the system (e.g. the Tenerife runway disaster).
• Finally, it cannot be denied that there is a great deal of emotional satisfaction to be gained from having someone (rather than something) to blame when things go badly wrong. Few of us are able to resist the pleasures of venting our psychic spleens on some convenient scapegoat. And in the case of organizations, of course, there is considerable financial advantage in being able to detach individual fallibility from corporate responsibility.

The scientific dimension

Should one halt the search for causes after identifying the human and/or component failures immediately responsible for the accident (as has been done in many accident investigations), or is it scientifically more appropriate to track back to their organizational root causes? On the face of it, the answer seems obvious. Yes, it must be better (in the sense of being a more accurate representation of the true state of affairs) to try to find all the systemic factors responsible for the accident. But the issue is not quite so simple. Let us examine some of the problems.

• Why should we stop at the organizational roots? In a deterministic world, everything has a prior cause. In theory, therefore, we could go back to the Big Bang. Seen from this broader historical perspective, an analytical stop-rule located at the organizational root causes is just as arbitrary –; in strict scientific terms –; as one located close to the proximal individual failures.
• There is a way out of this muddle, but it is more practical than scientific. In seeking the reasons for an accident, we should go far enough back to identify causal factors that, if corrected, would enhance the system's resistance to subsequent challenges. The people most concerned and best equipped to do this are those within the organization (s) involved, so it makes practical sense to stop the analysis at these organizational boundaries. However, such boundaries are often indistinct, particularly in aviation where there are a large number of inter-related subsystems involved.
• Perhaps the most serious scientific problem, however, has to do with the peculiar nature of accidents and with the way in which they change our perceptions of preceding events. In retrospect, an accident appears to be the point of convergence of a number o...

Table of contents

• Cover
• Half Title
• Title
• Copyright
• Contents
• Foreword
• Preface
• 1 Widening the search for accident causes: a theoretical framework
• 2 Erebus and beyond
• 3 Pathogens in the snow: the crash of Flight 1363
• 4 The BAC1-11 windscreen accident
• 5 The Australian airmiss study
• 6 Remedial implications: some practical applications of the theory
• Index