Subscribe by Email

Sunday, April 28, 2013

A Rose By Any Other Name……

When things appear to be different, that difference may be more a matter of perspective than difference. In fact the two might be the same as demonstrated in the iconic Checkerboard Illusion, by Edward H. Adelson

There are two perspectives in the aviation safety management universe.  The angst between these two camps is not as passionate as that between Shakespeare’s Montagues and Capulets, but like these two families they are really not that different.  

The first camp says that the way to a safe operation, i.e. risk management, is to plot the coordinates of computed probability and severity on a “risk” graph and decide if the result is in the “green” or safe zone. This is known as a risk assessment process.   The risk assessment provides both the evaluation of the risk as well as an opportunity to look for ways to adjust or manage the probability and/or severity to a more “acceptable” value.

The second camp says that the way to a safe operation is to identify and manage threats to drive the actual probability toward zero while for operational purposes, assuming there will be an occurrence.  Then evaluate whether, if there is an occurrence, are there are measures available that will allow the airplane land safely. 

Both of these groups are trying to reach that coveted “green zone” that signifies a safe operation.  Aviation is inherently dangerous and therefore risky by nature.  I’ve talked about this before. We cannot eliminate risk in aviation.  Risk in aviation can only be managed.  How then, can it be “managed”?  How will we know when risk has been managed effectively?  Hint, the outcome is never in doubt.

This take us back to the matrix.  The lower left block, 1 on the probability/severity scale, is the one we’re looking for.  Unfortunately, zero does not appear in the matrix.  How will we know if we are in that box?

Those who see risk on the probability/severity graph would endeavor to introduce elements into the operation like procedures and technology as well as training to lower the probability of the risky event or condition.  In addition they would like to introduce similar elements that avoid or neutralize elements of the operation to decrease the severity of a given condition.  This was the motivation behind Safety Management Systems, SMS.


We have to decide what risk is acceptable and what is not. What methodology do we use to determine acceptable risk?  FAA Advisory Circular 120-92A, Safety Management Systems for Aviation Service Providers, gives us some guidance.  However, the framework and structure outlined in the Advisory Circular are mainly targeted at the organizational level.  What about at the crew level?  Whereas the traditional risk assessment process relies heavily on a high level of compliance and performance, reality has shown that a successful outcome is more dependent on awareness, analysis and decision making. Is SOP compliance enough to mitigate risk?  Is 100% crew compliance any more achievable than attaining zero risk?  What is the minimum level of human performance necessary for a risk assessment to be valid?   
This is where Helmreich, Merritt, Klinect, et al were way ahead of their time.  They asked probing questions and came to the following conclusion.  Organizational risk management, in the form of standard operating policy, is not enough.  It is only half of the answer.  Total risk assessment and management must include the crew as well.  In a dynamic environment like aviation, policy and procedure provide a solid foundation and provide and excellent framework, but are they enough?  What role does culture play in risk management?  How can risk truly be managed to an acceptable level if human error is not included in the equation?

For a crew in an operational environment, I believe the boundaries of acceptable risk for any condition are defined by a probability as low as practicable and a degree of severity that will, with reasonable mitigation, assure a safe outcome.

This is the rationale for Threat and Error Management, TEM.  It is the link between organizational risk management, SMS and crew performance.  TEM recognizes the strengths and the weaknesses of human performance within the overall safety management system.  Each risk can be expressed by a set of unique threats.  Threats are commonly described as operational events that occur outside the influence of the crewmember, increase operational complexity and/or require crewmember attention to maintain safety margins.  When these threats are effectively managed or mitigated, the risk may be considered acceptable.  Weather events are an excellent example.  In cases when the threats of the condition can be managed to a safe outcome the risk is acceptable.  When they cannot be managed or there is doubt, the risk is unacceptable. 

There are many components to an effective management or mitigation strategy.  The primary and most important component is appropriate compliance with SOP.  It is the soft skills of situation awareness, leadership, decision making, communication, monitoring as well as workload and automation management that allow crews to effectively apply SOPs to the dynamic situation.

As previously mentioned, a major weakness of the traditional probability/severity risk management paradigm is the component of human error.  Errors are commonly referred to as crewmember actions or inactions that lead to deviations from crew or organizational expectations or reduce safety margins.  Errors may occur from spontaneous human error with no threat present or mismanagement of an existing threat.  The foundational strength of error management is the acceptance and preparedness for crew error.  It is the recognition and ownership of the inevitability of humans to make errors.  Therefore, the goal is to identify and mitigate errors before there is a negative consequence rather than to naively assume an unrealistic and unachievable level of human performance.

Like the overwhelming love that Romeo and Juliet shared, so do Risk Assessment and Threat and Error Management share the bond of safety.  The young couple agonized over the barriers of their surnames.  What tragedy might have been averted had one not been named a Capulet and the other a Montague?


O Romeo, O Romeo! Wherefore art thou Romeo?

Deny the father and refuse thy name;

Or, if thou wilt not, be but sworn my love.

And I’ll no longer be a Capulet.

ROMEO (Aside)

Shall I hear more, or speak of this?


‘Tis but thy name that is my enemy;

Thou art thyself, though not a Montague.

What’s a Montague? It is nor hand, nor foot,

Nor arm, nor face, nor any other part

Belonging to a man.  O, be some other name!

What’s in a name?  That which we call a rose

By any other name would smell as sweet;

So Romeo would, were he not Romeo call’d

Retain that dear perfection which he owes

Without that title.  Romeo, doff thy name,

And for that name which is no part of thee

Take all myself.

No comments:

Post a Comment