Decision Trees and Bowties

Management ultimately means calling the shots. In an airline organization, the decision making lies with the management team, in particular the accountable manager who has the authority for ensuring that all activities can be financed and carried out in accordance with the applicable requirements while establishing and maintaining an effective management system. On the flight deck, the responsibility lies with the pilot-in-command and, as in senior executives’ decisions, the tools matter.

The high-consequence nature of airline operations, the ever-existing threat of catastrophic failure, makes decision making a sensitive process.

A tragic decision-making failure related to flight safety is the 1986 Space Shuttle Challenger disaster. Flight STS-51L was launched from the Kennedy Space Center in Florida on Jan. 28, 1986, but never made it into space. The shuttle broke apart 73 seconds into its flight, leading to the deaths of its seven crewmembers. The spacecraft disintegrated over the Atlantic Ocean.

The accident occurred because an O-ring seal in the shuttle’s right solid rocket booster (SRB) failed at liftoff, and cold weather was a contributing factor. The O-ring failure caused a breach in the SRB joint it sealed, allowing pressurized hot gas from within the solid rocket motor to reach the outside and impinge on the adjacent SRB attachment hardware and external fuel tank. This led to the separation of the right-hand SRB’s aft attachment and the structural failure of the external tank. Aerodynamic forces rapidly broke up the orbiter.

Flawed Decision Making

According to the Rogers Commission Report, produced by a U.S. presidential commission charged with investigating the Challenger disaster, there also was a serious flaw in the decision-making process leading up to the launch of flight 51L: “A well-structured and -managed system emphasizing safety would have flagged the rising doubts about the solid rocket booster joint seal. Had these matters been clearly stated and emphasized in the flight readiness process …, it seems likely that the launch of 51-L might not have occurred when it did.” The commission report also said that “the waiving of launch constraints appears to have been at the expense of flight safety. There was no system which made it imperative that launch constraints and waivers of launch constraints be considered by all levels of management.”

Behavioral Economics

The Challenger accident became a case study in academic fields such as engineering safety, safety communication and, most importantly, decision making.

In behavioral economics, the Challenger disaster is used as a case study in trying to boost efficiency in the way humans make decisions individually and collectively. Behavioral economics is a discipline derived from studies in economics as well as in psychology, and it “has demonstrated that people are motivated by impulses that are measurable and predictable, and often irrational.”¹

Although the first research activities in the field of behavioral economics date back to the 1970s, until recently the discipline was limited to the academic world. However, since the 2008 global financial crisis, behavioral economics has started to receive more attention from policy makers and developers of risk models.

About the contribution of behavioral economics to driving efficiencies in decision making, Iris Bohnet, a behavioral economist and academic dean and professor of public policy at the Harvard Kennedy School, said, “Theories assuming rationality — such as the rational actor model used in economics — prescribe what is optimal but do not do a good job at describing how people really behave.”

Critical analyses of decision-making styles, as enabled by the considerable amount of research produced by behavioral economists, can reduce the probability of flight safety failures like that of the Challenger. Bringing sophisticated — that is, as far as possible free from biases — decision making into risk management optimizes the results of the risk analyses and provides a more targeted treatment of risks.

The alternative to flawed decision making suggested by behavioral economics is sophisticated decision making, which assumes that individuals are biased and biases are systematic. “Biases, however, can be dealt with systematically,” Bohnet said. “There are theories built on these behavioral regularities which describe and predict how people actually behave. Sophisticated (although not fully rational) decision making implies understanding how to overcome biases to make quasi-optimal decisions.”

Common decision-making biases are numerous, and counterstrategies exist for many of them. We have elected to analyze three biases that are evident in aviation — non-systematic consideration of all options available; the availability heuristic; and groupthink. We also will outline strategies for encouraging sophisticated safety-related decision making in aviation organizations.

Non-Systematic Consideration

Aviation organizations often require multiple management systems (including several trans-organizational systems), have dispersed operations, have many technical functions requiring skilled employees, and are highly regulated and characterized by overlapping state jurisdiction.² Within this operational complexity, there is considerable room for inefficiencies in decision making due to the difficulty of accessing the full spectrum of options.

Counterstrategies include graphic techniques — such as fault tree analysis, decision trees and bowtie risk analysis — that are helpful in organizing thinking, and therefore decision making, systematically.

Fault tree analysis (FTA) was developed at the Bell Laboratories in the early 1960s and later was adopted and refined by, among others, the Boeing Co. FTA is a graphical tool for analyzing complex systems to determine potential failure modes and their probabilities of occurrence. FTA uses a logic block diagram with symbols to indicate various states. It is built from the top down, beginning with a potential failure mode. Pathways are used to interconnect events that contribute to the failure. These pathways use standard logic symbols. If the probability of failure of each component is known, a quantitative analysis can be performed.³ Figure 1 contains an example of a fault tree.

Decision trees conceptually are very similar to fault trees. The main difference is that decision trees are not developed with strict regard to failure events, but more generally to allow for decisions to be made in a more systematic way, representing all paths that a decision maker might follow.

The symbols used in decision trees differ from, and are fewer than, those utilized in FTA (Figure 2). Decisions to be made are represented by squares. Chance events are represented by circles. Options available to the decision maker are represented by branches emanating from a decision node (square). Branches from decision nodes must guarantee that one alternative can be chosen. Outcomes of a chance event are represented by branches emanating from a chance node (circle). Outcomes must be mutually exclusive and collectively exhaustive (no other possibilities exist; probabilities have to sum to 1). Consequences are specified at the ends of the branches.”⁴

Using bowtie risk analysis (Figure 3) is an effective way of understanding risk analysis and managing threats (called hazards in this method). The analysis, already being used in the aviation industry, consists of a simple methodology to frame an undesired event within a standardized scheme with the following principal components: triggering events, avoidance barriers, hazards, hazardous events, recovery barriers and outcomes.

Bowtie risk analysis makes visible what essential controls should be in place and which need to be provided and maintained. Bowties can support safety investigations, aid audit teams in tracking controls and enable staff to report when additional controls are needed.⁵

Availability Bias

The availability heuristic makes us evaluate the likelihood of an event based on things we can easily call to mind.

The decision-making process leading to the Challenger disaster is valuable in understanding how availability bias works. The Rogers Commission reported that “the managers compared as a function of temperature the flights for which thermal distress of O-rings had been observed, not the frequency of occurrence based on all flights. In such a comparison, there is nothing irregular in the distribution of O-ring ‘distress’ over the spectrum of joint temperatures at launch between 53 degrees and 75 degrees F [11.7 degrees to 23.9 degrees C; the forecasted range of temperatures for the launch]. When the entire history of flight experience is considered, including ‘normal’ flights with no erosion or blow-by, the comparison is substantially different.” The commission also reported that “if the decision makers had known all the facts, it is highly unlikely that they would have decided to launch 51-L.” For risk management to produce information in support of flight safety decision making, it is essential to invest in data quality, with a well-defined taxonomy (ASW, 5/13).

One of the downfalls of a classification scheme, however, is that it narrows the observer’s identification scope and, with the availability bias, can lead to the inability to identify new issues.⁶

Availability can also influence threat identification, especially in an aviation organization with a very basic risk management system. To speed up the process, an immature organization might use checklists (or other predetermined lists of risks) during, or in lieu of, risk-identification brainstorming.⁷

A counterstrategy to “win” despite the availability bias at the time of hazard identification is to avoid the use of checklists until after brainstorming. It is also very important that subject matter experts involved in system design/analysis — as well as employees reporting occurrences — feel empowered to think analytically, or as one specialist said: “Experience and knowledge will always form a valuable part of the risk identification process. The way that the process is managed must ensure that this historical information does not block out a creative assessment of the future, where matters which have never been seen before might arise, and the balance between familiar risks might shift dramatically.”⁸

In the air transport industry, availability bias is common because aircraft accidents are particularly easy to recall. While there are invaluable post-accident lessons to be learned, the decision maker should, however, also appreciate that an accident’s circumstances are peculiar to the given occurrence. Doing otherwise can lead to ignoring variables worth consideration and, when qualitative judgment is required, to over- or under-assess probabilities related to possible outcomes of hazardous events under consideration. Additional techniques to avoid availability bias are developing an exhaustive list of possible options and outcomes; comparing the actual frequencies of various events and putting them in perspective; and publicizing these actual frequencies in order to educate the decision makers involved.

Groupthink

Groupthink is “a deterioration of mental efficiency, reality testing, and moral judgment that results from in-group pressures.”⁹

Groupthink is another decision- making bias that played a part in the decisions leading up to the loss of the Challenger. One of the ways groupthink manifested itself at NASA was through pressure on dissenting group members: “The decision to delay a Shuttle launch had developed into an ‘unwanted’ decision by the members of the Shuttle team. In other words, suggestions made by any group member that would ultimately support a scheduled launch were met with positive support by the group. Any suggestion that would lead to a delay was rejected by the group.”¹⁰

The self-censorship of deviations from group consensus was another manifestation of groupthink before the Challenger disaster: “All members of the group decision support system felt that they should live up to the ‘norms’ of the group. Although the Thiokol [a NASA supplier] engineers were firm on their recommendation to scrub the launch, they soon changed their presentation of objections once threatened with the possibility of being expelled from the program (as suggested by a NASA administrator who was ‘appalled’ at a company that would make such a recommendation based on the data available).”¹¹

As counterstrategies against groupthink, it is possible to adopt different decision-making procedures, namely those widely known as devil’s advocacy and dialectical inquiry.

In an emergency or in other decision-making situations, it can be advisable for the group leader not to attend all the meetings in order to keep the discussions from being inhibited. Personal recommendations may change when the leader is present, and even participants with strong contrary personal views can alter recommendations based on what they believe the leader wishes to hear. The leader should instruct the decision-making group to come forward with recommendations for one course or possibly several alternative courses of action. During deliberations, all participants need to speak as equals.¹²

The decision-making group needs to be split into subgroups to write the recommendations, trying to anticipate all possible contingencies and recommendations as to how to react to them. Each subgroup should then review what the others have come up with, dissecting and considering the other subgroups’ findings. Further exchanges should then enable the subgroups to develop further answers. From this, the outline of definitive plans should come gradually.¹³

For dialectical inquiry or devil’s advocacy, emphasis should be put on:

• Evolving the mode of thinking, from one-dimensional to multi-dimensional, with the creation of alternatives;
• Evolving the mode of discussing, from a person/position/rank orientation to a problem/task/issues orientation;
• Evolving the mode of negotiating, from affective (based on personal conflict) to cognitive (based on factual disagreement); and
• Evolving the mode of making decisions, from persuasive (i.e., my solution is the best) to deliberative (i.e., let’s search for our solution).¹⁴

Interestingly, devil’s advocacy and dialectical inquiry can be classified as decision-making procedures. The term procedure is stressed because the aviation industry has a history of focus on procedural compliance.

Both applicable aviation safety regulations and industry standards such as International Air Transport Association (IATA) Operational Safety Audits, the IATA Safety Audit for Ground Operations and the International Standard for Business Aircraft Operations mandate management system requirements — among which devil’s advocacy and dialectical inquiry as decision-making styles would most certainly fit. Aviation organizations already are implementing such generic requirements, and they are also being audited against them.

The Rogers Commission also issued recommendations on such management system areas as management structure, the Shuttle safety panel, criticality review and hazard analysis, safety organization and improved communications. Typically, aerospace accident investigations issue recommendations dealing not only with technicalities but also with higher-level safety management issues. This is how civil aviation has evolved to proactive and predictive safety management.

Given the aviation industry’s mindset favoring procedural compliance, if new provisions were made for different decision-making procedures in the relevant risk-management manuals, it would not seem unlikely to expect that devil’s advocacy and dialectical inquiry will indeed become the industry standard for management decision making.

Mario Pierobon works in business development and project support at Great Circle Services in Lucerne, Switzerland. The author wishes to thank Professor Iris Bohnet of the Harvard Kennedy School for inspiring this article.

Notes

1. Tritch, Theresa. “Helping People Help Themselves.” The New York Times. Feb. 14, 2007.
2. Lonsbury, Sandra. “Integrated Aviation Management Systems (IAMS).” Presentation at City University London on May 28, 2010.
3. Stolzer, A., Halford, C. and Goglia, J. (2008) Safety Management Systems in Aviation. Aldershot, Hampshire, England, United Kingdom: Ashgate Publishing.
4. Bohnet, Iris (2002) Individual and Collective Decision Making. Course presentations at Harvard Kennedy School.
5. Edwards, C. Active Safety Management. From notes to the Active Safety Management module at City University London. London, England, United Kingdom: City University London. May 23, 2011.
6. Stolzer, Halford and Goglia.
7. Broadleaf Capital International (2007). Tutorial Notes: The Australian and New Zealand Standard on Risk Management, AS/NZS 4360:2004. Pymble, New South Wales, Australia.
8. Broadleaf Capital International.
9. Janis, Irvin L. (1982) Groupthink: Psychological studies of policy decisions and fiascoes.
10. Forrest, Jeff. “The Space Shuttle Challenger Disaster — A failure in decision support system and human factors management.”<dssresources.com/cases/spaceshuttlechallenger/index.html>. Accessed March 2013.
11. Forrest.
12. Bohnet. Elaboration from Robert F. Kennedy’s Thirteen Days: A Memoir of the Cuban Missile Crisis (Kennedy, 1969); the elaborated quote has been accessed from Individual and Collective Decision Making.
13. Bohnet.
14. Bohnet. Individual and Collective Decision Making.