Desktop version

Home arrow Management

  • Increase font
  • Decrease font

<<   CONTENTS   >>

Safety Drift at the Individual Level – Behavioural Templates

We saw in Chapter 3 that systems are capable of drifting towards an unsafe state. At the level of the individual, similarly, we see behaviour that represents drift. Because we all act with a degree of autonomy and have different experiences of the world, we develop habits that result in work being managed in a riskier fashion. As with the system-level effects, drift at the individual level constrains the system’s buffering capacity. Drift represents a subversion efficacy in that the activity is considered in terms of personal benefit or identity creation. I propose four categories of drift at Level l in my model:

  • • Consolidation: The reshaping or simplification of action sequences, often seen in situations where delays are built-in to work processes, and individuals chose not to interrupt the workflow. For example, not waiting for the required cooling period after an event (brakes and engine shut down) or completing checklists in advance of the intended point of execution.
  • • Homogenisation: The standardisation of actions, results from adapting generic approaches to an operation rather than follow the specific procedural steps. For example, contract pilots flying for multiple clients sometimes follow a generic process, or pilots trained on multiple types sometimes standardise work processes rather than maintain two repertoires.
  • • Person/Task fit: Choosing to do what is easiest, reflecting the fact that we all differ in our capabilities, and some people work within their limits.
  • • Role drift: Creating interpretations of the task that reflect self-perception and perceived latitude to act.

While recurrent training and periodic standardisation checks attempt to limit drift, it seems to be a fundamental process. Procedural migration is often a product of social interaction in the workplace as workers share experiences or find new ways to achieve a task.

Conclusion – Working at Level 1

At Level l, in my hierarchy, individuals engage with the world and act in order to accomplish a task-related goal. Because of the uncertainty and variability in the real world, the crew are continually having to respond to disturbances and create solutions. Action is predicated on a robust understanding of the job and an ability to interpret and apply rules that, by design, are under-specified. Action is directed at accomplishing a goal that serves a purpose in the broader task assigned to the crew. Control of the situation is a function of the individual’s interventions, and feedback is provided by the extent to which actions are successful. Task failure, or error, is discussed in detail in the next chapter. Actions concerning events are the product of decisions made by individuals. All activities are conducted in a world that is created by the individual and is shaped by the information needed from that world.

I want to end this chapter with a case study that, to my mind, nicely illustrates the speed with which plans can unravel. On 29 December 2010, an American Airlines 757 ran off the end of the runway at Jackson Hole (JAC), Wyoming (NTSB, 2012). The FO was PF and there was a light snow falling at the time. JAC is at an elevation of 6491 ft, and the runway in use was 6300ft long. Being a ski resort, aircraft are often operating at maximum weights during the winter as passengers bring their skiing equipment as well as their normal baggage with them. The captain, as PM, had considerable experience of landing at JAC, and the crew were diligent in checking the weather and running landing performance calculations. An aircraft that landed an hour before the 757 had reported that the braking action was ‘good’ for the first two-thirds of the runway but ‘poor’ for the final third. Runway surface friction readings were obtained 18 minutes before landing. The FO stated that he planned to touchdown with in the first 1000 ft of the runway, and the crew set the spoilers for automatic deployment and the wheel brakes were set to ‘MAX AUTO’. The landing was ‘firm’, about 600 ft from the approach threshold. So far, the performance of the crew was exemplary.

After the aircraft touched down, two things were supposed to happen. First, the spoilers should deploy automatically, an action monitored by the PM, and, second, the PF was supposed to deploy the thrust reversers. Both crew were also required to ensure that the aircraft deceleration was in accordance with their expectations. In order to manage this sequence of events, the pilots, each independently, needed to observe, or perceive, signals in the array of information available inside and outside of the flight deck, attend to specific signals and fit events into a sequence coded as a ‘script’ or the action plan as defined in procedures. While doing their allocated tasks, pilots had to be aware of what the other crew member was doing and whether that activity supported the achievement of the planned goals. What all this means in terms of the events of that day is that, having armed the wheel brakes and speed brakes, one action required of the captain was to monitor that the automated systems activated as required and make the appropriate call-outs.

Similar to the pilot activity, aircraft systems have their own logic that shapes activity. In his determination to land slightly short, the FO’s touchdown was firm. Immediately after touchdown, the FO tried to deploy the thrust reversers. Unfortunately, the aircraft bounced on touchdown, and the air/ground sensing momentarily transitioned to ‘air’ before returning to ‘ground’. This sequence coincided with the FO’s selection of thrust reversers. Unfortunately, the sync-lock mechanism, designed to prevent the thrust reversers deploying in the air, was triggered as the aircraft bounced. Once the air/ground switch returned to the ground mode, there was a 5-second lag before the reversers could be deployed a second time. Unfortunately, on this occasion, the system froze.

Simultaneously, the spoilers started to deploy. The captain’s role was to monitor both the spoilers and the thrust reverser deployment. The speed brake (spoiler) lever started to move, and this prompted him to call ‘deployed’ before he then shifted his attention to the thrust reversers. Unfortunately, because of the slight bounce, the speed brake lever, unnoticed by the captain, returned to the ‘armed’ position.

Because a component in the thrust reverser clutch mechanism had been improperly installed, the system failed in the automatic mode, and it took both pilots a further 18 seconds to deploy the reversers. Ironically, a standard manual deployment of the speed brakes would have worked, but the crew were too busy trying to get the automatic system to work to think of this as a fallback. Despite the best endeavours of the crew to do the best job they could, things worked against them on that day. This chapter starts and ends with two examples of how the world can go from normal to catastrophe in less than 30 seconds. Luckily, in both cases, there were no injuries.

<<   CONTENTS   >>

Related topics