A Never-Ending Story
Trapping Safety into Rules: How Desirable orAvoidable is Proceduralization?
Bieder, Corrine; Bourrier, Mathilde (editors). Farnham, Surrey, England and Burlington, Vermont, U.S: Ashgate, 2013. 300 pp. Figures, tables, references, index.
Trapping Safety into Rules — there is a title as provocative as you are likely to see this year in books aimed at aviation safety professionals.
No one needs a definition of rules. Bieder and Bourrier describe “proceduralization” as “firstly, the aim of defining precise and quantified safety objectives, and secondly, the aim of defining a process, describing and prescribing at the same time how to achieve such objectives.” Unfortunately, “these two aspects are usually not defined by the same entity. Some inconsistencies may even exist between the two types of procedures.”
Questioning the role of rules and proceduralization goes to the heart of commercial aviation, one of the most heavily rule-bound industries. Almost every aspect of the industry is covered by regulations (a subset of rules), standard operating procedures, standards and best practices. Accident investigation reports usually conclude with recommendations for new regulations and procedures.
The remarkable safety record of the industry is due in large part to effective procedures. They are the result of lessons learned from accidents and incidents, as well as research and predictive analysis.
But can there be too much of a good thing in the aviation rulebook?
The editors think so. Bieder and Bourrier say that proceduralization of safety is part of a general trend toward “the bureaucratization of everyday life. … Even commonplace consumption or simple emotions are rationalized and subject to prescribed procedures, notably at the workplace. In addition, the dangerous link between bureaucratization and administrative evil has also long been established. The key role played by technical rationality in this irresistible and sometimes dangerous push always combines scientific method and procedures. Therefore, it requires us to stay alert and vigilant in front of constant re-engagement towards more rules and regulations.”1
Personnel do not have infinite attention capacity. Under a regime of excessive proceduralization, they must devote an increasing amount of their attention to keeping up with and following rules and regulations. The corollary is that some time and energy must be debited from attention to the real-world working environment.
Trapping Safety into Rules is a collection of chapters examining various aspects of the theme. Part I is “Where Do We Stand on the Bureaucratic Path Towards Safety?” Part II is about “Contrasting Approaches to Safety Rules.” Part III includes chapters under the heading “Practical Attempts to Reach Beyond Proceduralization,” and Part IV is “Standing Back to Move Forward.”
Claire Pélegrin, in her chapter, “The Never-Ending Story of Proceduralization in Aviation,” traces the evolution of the phenomenon.
“At the beginning of aviation, the designer, the engineer and the pilot were the same person, thus there was no real need for procedures,” she says. It was not long before specialization began, yet even then, pilots determined their own procedures and tried for self-enforcement.
World War II brought the need to train large numbers of pilots quickly and efficiently — as well as, in some cases, getting pilots ready for action without optimum training time. Standard operating procedures and checklists were among the tools for achieving the goal.
Commercial aviation after the war maintained and expanded the procedural approach. “For years, everybody shared the same idea that safety would be guaranteed if pilots were selected and trained to strictly apply procedures,” Pélegrin says. Of course, safety was hardly guaranteed — for one thing, postwar commercial pilots lacked the benefits of today’s technological innovations such as terrain awareness and warning systems (TAWS), traffic-alert and collision avoidance systems, and weather radar. But the procedural emphasis seemed promising.
So it grew, becoming more sophisticated and elaborate. “Cockpit tasks have been organized through checklists, do lists and procedures,” Pélegrin says. “The philosophy behind [them] is very stringent, dictating the accurate way of configuring [and] flying the aircraft and communicating.”
Next in the “never-ending story” came crew resource management (CRM). Among other principles, “CRM training emphasized that [crewmembers] support a shared action plan and shared awareness, which is essential because it creates a mental image to act, synchronize action and manage time. … Procedures also play an important role in interpersonal relationships and in conflict management because they are seen as a neutral reference: In case of disagreement, following the procedures is one way to solve conflict. This is taught in many CRM courses.”
In due season, proceduralization became generalized to the organization, encompassing flight operational quality assurance and today’s widely adopted safety management systems (SMS).
Pélegrin acknowledges the benefits, even the necessity, of many aspects of proceduralization. But they bring drawbacks as well, she says:
“Organizations in aviation are in a vicious circle with the proceduralization approach. They started to focus on technical performance of the technical system (safety analysis and reliability) to become now focused on the safety of the socio-technical system. This is not exactly the same problem and not the same methodology. Liability aspects are part of the overproceduralization. The tendency is to use written procedures as a legal reference in case of legal suit … and push for more procedures. This may become counterproductive, the main difficulty being that everybody may become lost with all these safety requirements.”
Airlines have to balance an inherent contradiction. Pélegrin says, “Standard operating procedures promote the idea of uniformity and standardization at the risk of reducing the human role. At the same time, pilots are seen as ‘far more intelligent than the procedures.’ Pilots are considered ‘better’ than the procedure because they have a certain amount of autonomy in their decisions, especially in case of abnormal situations and emergencies (even if, in some airlines, they have to justify that decision afterwards).”
How far the experience and expertise of a pilot should be allowed free exercise is a question that seems to have no absolute answer, because there is no way to take account in advance of the pilot’s ability to fully know and understand the situation, the pilot’s state of mind, the pilot’s judgment abilities, the time pressure, and other variables. “There have been long discussions in many airlines and in international committees to decide if the first officer should take a decision/action in contradiction to the captain,” such as calling for a rejected takeoff or taking control of the aircraft, Pélegrin says.
Organizations are caught between encouraging individual responsibility and defining its limits. “If an airline promotes the idea that everyone should be engaged in safety, then there should be consistent policies (including training, procedures and practices),” Pélegrin says. “For example, you cannot promote the idea that everyone must play a role in safety and not allow them to act in safety situations.”
But when an organization orders a pilot to take extraordinary action under some circumstances, the long arm of the law reaches into the cockpit. Pélegrin says, “The Indian aviation authority has established a new rule: the copilot needs to shout two warnings to the commander if the aircraft is in danger during its approach to the runway. If the commander doesn’t listen, then the copilot has to take charge of all operational functions. The circular2 noted the new actions would happen ‘only in case of total or subtle incapacitation’ of the commander and also ‘those actions must be inducted from about 500 ft.’”
It would be hard to find a better example of trying to have it both ways, mixing judgment and initiative with proceduralization.
There have been too many accidents in which the captain appeared to have lost situational awareness and the first officer failed to compensate. Such accidents continue (ASW, 3/13, p. 16). But consider the copilot’s dilemma, despite acting under a rule that intends to make his or her position clear.
According to the author’s description, the rule applies only on approach. What if the wrong heading has been entered for the initial climb, a mountain ridge lies ahead, the TAWS is warning of the collision course with terrain and the captain appears oblivious to the risk. Is the copilot authorized to take charge?
But that is only the first decision the copilot must make. He or she is to shout two warnings to the captain. How should they be phrased, what balance struck between respect for the captain’s rank and the second-in-command’s assumed right to avoid an impending accident? How much time needs to be granted for the captain’s response?
First, the rule says that “if the captain doesn’t listen,” the copilot must take charge. That is unambiguous. But the rule also says the action is to happen “only in case of total or subtle incapacitation.” Total incapacitation, likewise, is clear and hardly needs to be embedded in regulation — any copilot in his proper mind would take over if the captain were suffering a medical emergency and completely unable to continue command.
What is subtle incapacitation? The implication is that the captain is conscious and capable of communicating, but speaking or acting irrationally, endangering the flight. To put it paradoxically, how overt must “subtle” be? This theme was central to the classic novel of World War II, The Caine Mutiny, in which the ship’s officers had to decide what to do about the behavior of Capt. Queeg, a crackpot whose eccentricities might or might not have exceeded a captain’s authority.
And what is the copilot to make of “these actions must [emphasis added] be inducted from about 500 ft”?
The rule illustrates the negative side of proceduralization. Undoubtedly, its intentions were good: to protect the lives of the passengers in the case of a captain unable to perform duties adequately in a critical phase of flight; to stiffen the spine of the copilot who has to take the decision to deviate from the normal authority gradient; and perhaps to offer the copilot legal protection ex post facto. But it also adds a series of rules the copilot must remember and analyze while dealing with a pressing safety-of-flight issue.
Several of the book’s chapters suggest that the actual effects of procedures at the “sharp end” must be studied as carefully as their abstract validity. In “Working to Rule, or Working Safely,” Andrew Hale and David Borys say, “Rules and procedures are seen as essential to allocate responsibility and to define and guide behaviour in complex and often conflicting environments and processes. Behind this logical, rational obviousness lies another ‘truth’ about the reality of safety rules and their use.”
They cite a study of Dutch railway workers’ attitudes to safety rules: “Only 3 percent of workers surveyed used the rules book often, and almost 50 percent never; 47 percent found them not always realistic, 29 percent thought they were used only to point the finger of blame, 95 percent thought that, if you kept to the rules, the work could never be completed in time, 79 percent that there were too many rules, 70 percent that they were too complicated and 77 percent that they were sometimes contradictory.”
The authors present two contrasting models of safety rules. Model 1, popular among those with an engineering background or way of thinking, “sees rules as the embodiment of the one best way to carry out activities, covering all contingencies. They are to be devised by experts to guard against the errors of fallible human operators, who are seen as more limited in their competence and experience, or in the time necessary to work out that one best way.”
Model 2, derived more from sociology and psychology, perceives rules as “behaviour emerging from experience with activities by those carrying them out. They are seen as local and situated in the specific activity, in contrast with the written rules, which are seen as generic, necessarily abstracted from the detailed situation.”
Hale and Borys discuss many studies of both models of rulemaking. Each model has researchers who take a stand basically for or against them; other researchers advocate a balanced position.
The authors themselves conclude, “The review of the two models and their development and use has resulted in the definition of a broad set of concerns and dilemmas. The picture that emerges is of a gap between the reality of work and its routines and the abstraction of the written rules that are supposed to guide safe behaviour. We have described contrasting perceptions of deviations from those written rules, either as violations to be stamped out or as inevitable and sometimes necessary adaptations to local circumstances to be used and reinforced. …
“Model 1 is more transparent and explicit than the tacit knowledge and emerging set of routines characterized by model 2. This makes it more suitable for trainers, assessors and improvers, but at the cost of creating a gap between work as imagined in the rule set and work as carried out in practice. … Rules may be imposed from above, but they must be at least modified from below to meet the diversity of reality. …
“Model 2 fits best with complex, high-uncertainty, high-risk domains with great variety and need for improvisation. However, in these activities, there is scope for making guidance and protocols more explicit, usable and used, by specifying them as process rules rather than action rules.”
- Citations of research literature contained in the book have been omitted here for stylistic and space reasons.
- Directorate General of Civil Aviation, Republic of India. Operation circular 15, Aug. 5, 2010.