When things appear to be
different, that difference may be more a matter of perspective than difference.
In fact the two might be the same as demonstrated in the iconic Checkerboard Illusion, by Edward H. Adelson
There are two perspectives
in the aviation safety management universe.
The angst between these two camps is not as passionate as that between Shakespeare’s
Montagues and Capulets, but like these two families they are really not that
different.
The first camp says that
the way to a safe operation, i.e. risk management, is to plot the coordinates
of computed probability and severity on a “risk” graph and decide if the result
is in the “green” or safe zone. This is known as a risk assessment process. The
risk assessment provides both the evaluation of the risk as well as an
opportunity to look for ways to adjust or manage the probability and/or
severity to a more “acceptable” value.
The second camp says
that the way to a safe operation is to identify and manage threats to drive the
actual probability toward zero while for operational purposes, assuming there
will be an occurrence. Then evaluate whether,
if there is an occurrence, are there are measures available that will allow the
airplane land safely.
Both of these groups are
trying to reach that coveted “green zone” that signifies a safe operation. Aviation is inherently dangerous and
therefore risky by nature. I’ve talked
about this before. We cannot eliminate risk in aviation. Risk in aviation can only be managed. How then, can it be “managed”? How will we know when risk has been managed
effectively? Hint, the outcome is never
in doubt.
This take us back to the
matrix. The lower left block, 1 on the
probability/severity scale, is the one we’re looking for. Unfortunately, zero does not appear in the
matrix. How will we know if we are in
that box?
Those who see risk on
the probability/severity graph would endeavor to introduce elements into the
operation like procedures and technology as well as training to lower the
probability of the risky event or condition.
In addition they would like to introduce similar elements that avoid or
neutralize elements of the operation to decrease the severity of a given
condition. This was the motivation
behind Safety Management Systems, SMS.
We have to decide what
risk is acceptable and what is not. What methodology do we use to determine acceptable
risk? FAA Advisory Circular 120-92A,
Safety Management Systems for Aviation Service Providers, gives us some
guidance. However, the framework and
structure outlined in the Advisory Circular are mainly targeted at the
organizational level. What about at the
crew level? Whereas the traditional risk
assessment process relies heavily on a high level of compliance and performance,
reality has shown that a successful outcome is more dependent on awareness, analysis
and decision making. Is SOP compliance enough to mitigate risk? Is 100% crew compliance any more achievable
than attaining zero risk? What is the
minimum level of human performance necessary for a risk assessment to be
valid?
This is where Helmreich, Merritt, Klinect, et al were way ahead of their time. They asked probing questions and came to the
following conclusion. Organizational
risk management, in the form of standard operating policy, is not enough. It is only half of the answer. Total risk assessment and management must
include the crew as well. In a dynamic
environment like aviation, policy and procedure provide a solid foundation and provide
and excellent framework, but are they enough?
What role does culture play in risk management? How can risk truly be managed to an acceptable level if human error is
not included in the equation?
For a crew in an operational environment, I
believe the boundaries of acceptable risk for any condition are defined by a probability
as low as practicable and a degree of severity that will, with reasonable
mitigation, assure a safe outcome.
This is the rationale
for Threat and Error Management, TEM. It
is the link between organizational risk management, SMS and crew
performance. TEM recognizes the
strengths and the weaknesses of human performance within the overall safety
management system. Each risk can be expressed
by a set of unique threats. Threats are
commonly described as operational events that occur outside the influence of
the crewmember, increase operational complexity and/or require crewmember
attention to maintain safety margins.
When these threats are effectively managed or mitigated, the risk may be
considered acceptable. Weather events
are an excellent example. In cases when
the threats of the condition can be managed to a safe outcome the risk is acceptable. When they cannot be managed or there is
doubt, the risk is unacceptable.
There are many
components to an effective management or mitigation strategy. The primary and most important component is appropriate
compliance with SOP. It is the soft
skills of situation awareness, leadership, decision making, communication,
monitoring as well as workload and automation management that allow crews to
effectively apply SOPs to the dynamic situation.
As previously mentioned,
a major weakness of the traditional probability/severity risk management
paradigm is the component of human error.
Errors are commonly referred to as crewmember actions or inactions that
lead to deviations from crew or organizational expectations or reduce safety
margins. Errors may occur from
spontaneous human error with no threat present or mismanagement of an existing
threat. The foundational strength of
error management is the acceptance and preparedness for crew error. It is the recognition and ownership of the
inevitability of humans to make errors.
Therefore, the goal is to identify and mitigate errors before there is a
negative consequence rather than to naively assume an unrealistic and unachievable
level of human performance.
Like the overwhelming
love that Romeo and Juliet shared, so do Risk Assessment and Threat and Error
Management share the bond of safety. The
young couple agonized over the barriers of their surnames. What tragedy might have been averted had one
not been named a Capulet and the other a Montague?
JULIET
O Romeo, O Romeo!
Wherefore art thou Romeo?
Deny the father and
refuse thy name;
Or, if thou wilt not, be
but sworn my love.
And I’ll no longer be a
Capulet.
ROMEO (Aside)
Shall I hear more, or
speak of this?
JULIET
‘Tis but thy name that
is my enemy;
Thou art thyself, though
not a Montague.
What’s a Montague? It is
nor hand, nor foot,
Nor arm, nor face, nor
any other part
Belonging to a man. O, be some other name!
What’s in a name? That which we call a rose
By any other name would
smell as sweet;
So Romeo would, were he
not Romeo call’d
Retain that dear
perfection which he owes
Without that title. Romeo, doff thy name,
And for that name which
is no part of thee
Take all myself.
No comments:
Post a Comment