Error Management: Error Management: Achievements and Achievements and

ChallengesChallenges(Have we made a (Have we made a

difference?)difference?)James ReasonJames Reason

HFG Conference, RAeS, 15 October 2003

Once upon a time . . .Once upon a time . . .

Now: A complex systemNow: A complex system

Cascading influencesCascading influencesEconomic & political climate

Top-level management decisions

Line management implementation

Error-producing conditions in the team and workplace

Unsafe acts at sharp end

Exceedances

Incidents & near misses

Accidents

Cu

ltureC

ult

ure

Errors need to be Errors need to be managed at all levels of managed at all levels of

the systemthe system

Everyone’s blunt end is someoneelse’s sharp end.

(Karlene Roberts)

Reaching ever higher for the Reaching ever higher for the fruitfruit

Individual factors

Social factors

Systemic factors

MilestonesMilestones• From 1917: Psychometric testingFrom 1917: Psychometric testing• 1940s: Cambridge Cockpit; Applied Psychology 1940s: Cambridge Cockpit; Applied Psychology

Unit; centres at Ohio State & University of Unit; centres at Ohio State & University of Illinois; ERS (UK)Illinois; ERS (UK)

• 1950s: HFS (US); ‘Human Factors in Air 1950s: HFS (US); ‘Human Factors in Air Transportation’ (Ross McFarland)Transportation’ (Ross McFarland)

• 1960s: Manned space flight; cockpit 1960s: Manned space flight; cockpit ergonomics; command instrumentsergonomics; command instruments

• 1970s: ALPA accident investigation course; 1970s: ALPA accident investigation course; IATA human factors committee; SHEL(L)IATA human factors committee; SHEL(L)

• 1980s: CRM; ASRS; cognitive and systemic 1980s: CRM; ASRS; cognitive and systemic factors; interaction of many causal factorsfactors; interaction of many causal factors

• 1990s: Organizational and cultural factors1990s: Organizational and cultural factors

Sentinel eventsSentinel events

• Tenerife runway collisionTenerife runway collision• Mt Erebus and the Mahon ReportMt Erebus and the Mahon Report• Manchester runway fireManchester runway fire• Dryden and the Moshansky ReportDryden and the Moshansky Report• BASI reports on the Monarch and BASI reports on the Monarch and

Seaview accidentsSeaview accidents• NTSB Report on Embraer 120 accident NTSB Report on Embraer 120 accident

at Eagle Lake, Texas (Lauber dissent)at Eagle Lake, Texas (Lauber dissent)• ChallengerChallenger (Vaughan) and (Vaughan) and ColumbiaColumbia

Accident Investigation Board ReportAccident Investigation Board Report

Individual factorsIndividual factors

• Pilot aptitude measuresPilot aptitude measures• Psychomotor performancePsychomotor performance• Sensory and perceptual factorsSensory and perceptual factors• Fatigue and stressFatigue and stress• Vigilance decrementVigilance decrement• Cockpit ergonomicsCockpit ergonomics• ‘‘Ironies of automation’Ironies of automation’• Cognitive issuesCognitive issues

Predictive value of WW2 Predictive value of WW2 AAF test battery AAF test battery

(from Ross McFarland, 1953)(from Ross McFarland, 1953)

Decrease inelimination rateswith increase instanine scoresindicates value ofproperly weightedbattery of tests.

Social and team factorsSocial and team factors

• Crew resource managementCrew resource management

• LOFT and behavioural markersLOFT and behavioural markers

• Cabin evacuation studiesCabin evacuation studies

• Maintenance teamsMaintenance teams

• Air traffic controllersAir traffic controllers

• Ramp workersRamp workers

• Naturalistic decision makingNaturalistic decision making

• Procedural non-complianceProcedural non-compliance

The high-hanging fruitThe high-hanging fruit

• Targeting error traps and recurrent Targeting error traps and recurrent accidents (e.g. CFIT, maintenance accidents (e.g. CFIT, maintenance omissions, etc.)omissions, etc.)

• Resolving goal conflicts: production vs Resolving goal conflicts: production vs protectionprotection

• Combating the ‘normalization of deviance’Combating the ‘normalization of deviance’

• Striving for system resilience (high Striving for system resilience (high reliability) reliability)

• Engineering a safe cultureEngineering a safe culture

ICAO Annex 13 (8ICAO Annex 13 (8thth Ed., Ed., 1994)1994)

1.17. Management information. Accident reportsshould include pertinent information concerningthe organisations and their management involvedin influencing the operation of the aircraft. Theorganisations include . . . the operator, air trafficservices, airway, aerodrome and weather serviceagencies; and the regulatory authority. Informationcould include organisational structure and functions,resources, economic status, management policiesand practices . . .

Ever-widening search forEver-widening search forthe ‘upstream’ factorsthe ‘upstream’ factors

Individuals

Workplace

Organisation

Regulators

Society at large

Echoed in many hazardous Echoed in many hazardous domainsdomains

Zeebrugge

Dryden

Chernobyl

Young, NSW

Barings

Clapham

Challenger

King’s X

Piper Alpha

Columbia

CAIB Report (August, CAIB Report (August, 2003)2003)

‘In our view, the NASA organizationalculture had as much to do with this accident as the foam.’

‘When the determinations of the causalchain are limited to the technical flawand individual failure, typically the actionstaken to prevent a similar event in thefuture are also limited . . .’

But has the pendulum But has the pendulum swungswung

too far? too far?

Individualresponsibility

Collectiveresponsibility

Mr Justice Moshansky onMr Justice Moshansky onthe Dryden F-28 crashthe Dryden F-28 crash

Had the system operated operated effectively,each of the (causal) factors might have beenidentified and corrected before it took onsignificance . . . this accident was the result ofa failure of the air transportation system as awhole.

Academician Valeri Academician Valeri LegasovLegasov

on the Chernobyl disasteron the Chernobyl disaster

After being at Chernobyl, I drew theunequivocal conclusion that the Chernobylaccident was . . . the summit of all the incorrect running of the economy whichhad been going on in our country for many years.

(pre-suicide tapes, 1988)

CAIB Report (Ch. 5)CAIB Report (Ch. 5)

‘The causal roots of the accident canbe traced, in part, to the turbulent post-Cold War policy environment in whichNASA functioned during most of theyears between the destruction ofChallenger and the loss of Columbia.’

Remote factors: some Remote factors: some concernsconcerns

• They have little causal specificity.They have little causal specificity.• They are outside the control of system They are outside the control of system

managers, and mostly intractable.managers, and mostly intractable.• Their impact is shared by many systems.Their impact is shared by many systems.• The more exhaustive the inquiry, the more The more exhaustive the inquiry, the more

likely it is to identify remote factors.likely it is to identify remote factors.• Their presence does not discriminate Their presence does not discriminate

between normal states and accidents; only between normal states and accidents; only more proximal factors do that.more proximal factors do that.

Revisiting PoissonRevisiting Poisson• Poisson counted number of kicks received Poisson counted number of kicks received

by cavalrymen over a given period.by cavalrymen over a given period.• Developed a model for determining the Developed a model for determining the

chance probability of a low frequency/high chance probability of a low frequency/high opportunity event among people sharing opportunity event among people sharing equal exposure to hazard.equal exposure to hazard.

• How many people would one expect to have How many people would one expect to have 0, 1, 2, 3, 4, 5, etc. events over a given 0, 1, 2, 3, 4, 5, etc. events over a given period when there is no known reason why period when there is no known reason why one person should have more than any one person should have more than any other?other?

Unequal liability: common Unequal liability: common findingfinding

0 1 2 3 4 5 6 7 8

NMore people

have zero eventsthan predicted

A few people havehave more events than

would be expectedby chance alone

Number of events sustained in a given period

No. of exceedances by fleet pilots (John Savage)

Interpreting pilot-related Interpreting pilot-related datadata

• Repeated events Repeated events areare associated with associated with particular conditions. Suggests the need particular conditions. Suggests the need for specific retraining.for specific retraining.

• Repeated events Repeated events are notare not associated with associated with particular conditions:particular conditions: Bunched in a given time period. Suggests

influence of local life events. Counselling? Scattered over time. Suggests some

enduring problem. Promote to management?

End-of-century gradesEnd-of-century grades

A

B+

C

ConclusionsConclusions

• Widening the search for error-shaping factors Widening the search for error-shaping factors has brought great benefits in understanding has brought great benefits in understanding accidents.accidents.

• But maybe we are reaching the point of But maybe we are reaching the point of diminishing returns with regard to prevention.diminishing returns with regard to prevention.

• Perhaps we should revisit the individual (the Perhaps we should revisit the individual (the heroic as well as the hazardous acts).heroic as well as the hazardous acts).

• History shows we did that rather well.History shows we did that rather well.