normalization of deviance
TRANSCRIPT
Error Management: Error Management: Achievements and Achievements and
ChallengesChallenges(Have we made a (Have we made a
difference?)difference?)James ReasonJames Reason
HFG Conference, RAeS, 15 October 2003
Once upon a time . . .Once upon a time . . .
Now: A complex systemNow: A complex system
Cascading influencesCascading influencesEconomic & political climate
Top-level management decisions
Line management implementation
Error-producing conditions in the team and workplace
Unsafe acts at sharp end
Exceedances
Incidents & near misses
Accidents
CultureC
ultu
re
Errors need to be Errors need to be managed at all levels of managed at all levels of
the systemthe system
Everyone’s blunt end is someoneelse’s sharp end.
(Karlene Roberts)
Reaching ever higher for the Reaching ever higher for the fruitfruit
Individual factors
Social factors
Systemic factors
MilestonesMilestones• From 1917: Psychometric testingFrom 1917: Psychometric testing• 1940s: Cambridge Cockpit; Applied Psychology 1940s: Cambridge Cockpit; Applied Psychology
Unit; centres at Ohio State & University of Illinois; Unit; centres at Ohio State & University of Illinois; ERS (UK)ERS (UK)
• 1950s: HFS (US); ‘Human Factors in Air 1950s: HFS (US); ‘Human Factors in Air Transportation’ (Ross McFarland)Transportation’ (Ross McFarland)
• 1960s: Manned space flight; cockpit ergonomics; 1960s: Manned space flight; cockpit ergonomics; command instrumentscommand instruments
• 1970s: ALPA accident investigation course; IATA 1970s: ALPA accident investigation course; IATA human factors committee; SHEL(L)human factors committee; SHEL(L)
• 1980s: CRM; ASRS; cognitive and systemic 1980s: CRM; ASRS; cognitive and systemic factors; interaction of many causal factorsfactors; interaction of many causal factors
• 1990s: Organizational and cultural factors1990s: Organizational and cultural factors
Sentinel eventsSentinel events• Tenerife runway collisionTenerife runway collision• Mt Erebus and the Mahon ReportMt Erebus and the Mahon Report• Manchester runway fireManchester runway fire• Dryden and the Moshansky ReportDryden and the Moshansky Report• BASI reports on the Monarch and BASI reports on the Monarch and
Seaview accidentsSeaview accidents• NTSB Report on Embraer 120 accident NTSB Report on Embraer 120 accident
at Eagle Lake, Texas (Lauber dissent)at Eagle Lake, Texas (Lauber dissent)• ChallengerChallenger (Vaughan) and (Vaughan) and ColumbiaColumbia
Accident Investigation Board ReportAccident Investigation Board Report
Individual factorsIndividual factors• Pilot aptitude measuresPilot aptitude measures• Psychomotor performancePsychomotor performance• Sensory and perceptual factorsSensory and perceptual factors• Fatigue and stressFatigue and stress• Vigilance decrementVigilance decrement• Cockpit ergonomicsCockpit ergonomics• ‘‘Ironies of automation’Ironies of automation’• Cognitive issuesCognitive issues
Predictive value of WW2 Predictive value of WW2 AAF test battery AAF test battery
(from Ross McFarland, 1953)(from Ross McFarland, 1953)
Decrease inelimination rateswith increase instanine scoresindicates value ofproperly weightedbattery of tests.
Social and team factorsSocial and team factors• Crew resource managementCrew resource management• LOFT and behavioural markersLOFT and behavioural markers• Cabin evacuation studiesCabin evacuation studies• Maintenance teamsMaintenance teams• Air traffic controllersAir traffic controllers• Ramp workersRamp workers• Naturalistic decision makingNaturalistic decision making• Procedural non-complianceProcedural non-compliance
The high-hanging fruitThe high-hanging fruit
• Targeting error traps and recurrent Targeting error traps and recurrent accidents (e.g. CFIT, maintenance accidents (e.g. CFIT, maintenance omissions, etc.)omissions, etc.)
• Resolving goal conflicts: production vs Resolving goal conflicts: production vs protectionprotection
• Combating the ‘normalization of deviance’Combating the ‘normalization of deviance’• Striving for system resilience (high Striving for system resilience (high
reliability) reliability) • Engineering a safe cultureEngineering a safe culture
ICAO Annex 13 (8ICAO Annex 13 (8thth Ed., Ed., 1994)1994)
1.17. Management information. Accident reportsshould include pertinent information concerningthe organisations and their management involvedin influencing the operation of the aircraft. Theorganisations include . . . the operator, air trafficservices, airway, aerodrome and weather serviceagencies; and the regulatory authority. Informationcould include organisational structure and functions,resources, economic status, management policiesand practices . . .
Ever-widening search forEver-widening search forthe ‘upstream’ factorsthe ‘upstream’ factors
Individuals
Workplace
Organisation
Regulators
Society at large
Echoed in many hazardous Echoed in many hazardous domainsdomains
Zeebrugge
Dryden
Chernobyl
Young, NSW
Barings
Clapham
Challenger
King’s X
Piper Alpha
Columbia
CAIB Report (August, CAIB Report (August, 2003)2003)
‘In our view, the NASA organizationalculture had as much to do with this accident as the foam.’
‘When the determinations of the causalchain are limited to the technical flawand individual failure, typically the actionstaken to prevent a similar event in thefuture are also limited . . .’
But has the pendulum But has the pendulum swungswung
too far? too far?
Individualresponsibility
Collectiveresponsibility
Mr Justice Moshansky onMr Justice Moshansky onthe Dryden F-28 crashthe Dryden F-28 crash
Had the system operated operated effectively,each of the (causal) factors might have beenidentified and corrected before it took onsignificance . . . this accident was the result ofa failure of the air transportation system as awhole.
Academician Valeri Academician Valeri LegasovLegasov
on the Chernobyl disasteron the Chernobyl disasterAfter being at Chernobyl, I drew theunequivocal conclusion that the Chernobylaccident was . . . the summit of all the incorrect running of the economy whichhad been going on in our country for many years.
(pre-suicide tapes, 1988)
CAIB Report (Ch. 5)CAIB Report (Ch. 5)
‘The causal roots of the accident canbe traced, in part, to the turbulent post-Cold War policy environment in whichNASA functioned during most of theyears between the destruction ofChallenger and the loss of Columbia.’
Remote factors: some Remote factors: some concernsconcerns
• They have little causal specificity.They have little causal specificity.• They are outside the control of system They are outside the control of system
managers, and mostly intractable.managers, and mostly intractable.• Their impact is shared by many systems.Their impact is shared by many systems.• The more exhaustive the inquiry, the more The more exhaustive the inquiry, the more
likely it is to identify remote factors.likely it is to identify remote factors.• Their presence does not discriminate Their presence does not discriminate
between normal states and accidents; only between normal states and accidents; only more proximal factors do that.more proximal factors do that.
Revisiting PoissonRevisiting Poisson• Poisson counted number of kicks received by Poisson counted number of kicks received by
cavalrymen over a given period.cavalrymen over a given period.• Developed a model for determining the Developed a model for determining the
chance probability of a low frequency/high chance probability of a low frequency/high opportunity event among people sharing opportunity event among people sharing equal exposure to hazard.equal exposure to hazard.
• How many people would one expect to have How many people would one expect to have 0, 1, 2, 3, 4, 5, etc. events over a given 0, 1, 2, 3, 4, 5, etc. events over a given period when there is no known reason why period when there is no known reason why one person should have more than any one person should have more than any other?other?
Unequal liability: common Unequal liability: common findingfinding
0 1 2 3 4 5 6 7 8
N More peoplehave zero events
than predictedA few people have
have more events thanwould be expectedby chance alone
Number of events sustained in a given period
No. of exceedances by fleet pilots (John Savage)
Interpreting pilot-related Interpreting pilot-related datadata
• Repeated events Repeated events areare associated with associated with particular conditions. Suggests the need particular conditions. Suggests the need for specific retraining.for specific retraining.
• Repeated events Repeated events are notare not associated with associated with particular conditions:particular conditions: Bunched in a given time period. Suggests
influence of local life events. Counselling? Scattered over time. Suggests some
enduring problem. Promote to management?
End-of-century gradesEnd-of-century grades
A
B+
C
ConclusionsConclusions
• Widening the search for error-shaping factors Widening the search for error-shaping factors has brought great benefits in understanding has brought great benefits in understanding accidents.accidents.
• But maybe we are reaching the point of But maybe we are reaching the point of diminishing returns with regard to prevention.diminishing returns with regard to prevention.
• Perhaps we should revisit the individual (the Perhaps we should revisit the individual (the heroic as well as the hazardous acts).heroic as well as the hazardous acts).
• History shows we did that rather well.History shows we did that rather well.