1. Managing Human Factors Risk
Captain Steve Sheterline
General Manager Training
British Airways Flight Operations
Back in 1993 I was a delegate at the IATA 22nd Technical Conference in Montreal, Canada. The central theme of the conference was Human Factors in Aviation. At the time CRM was a relatively new concept in the UK.
Cockpit Resource Management concepts were formalised into the British Airways initial and recurrent training programmes in The language was new and alien to many managers and flight crew.
The average fatality rate in commercial aviation had remained fairly constant for nearly 20 years and the prospect of increasing numbers of fatalities in a steadily growing industry needed to be addressed.
Statistics showed that the primary cause of aircraft accidents by a wide margin was human error. This was typically regarded as sufficient cause of an accident. Accident causes were generally restricted to the actions of those at the human-machine interface. This sometimes meant that the consequences of fundamental flaws in organisations were neither recognised understood.
Much of the human factors knowledge we have today is largely a result of academic research. This language it generates can appear alien to both managers and practitioners alike, however it can and should provide the stimuli to developing new ideas and techniques in the management of risk in safety critical industries. Turning theory into practice can be fraught with difficulty. The potential benefits of improvements to safety through HF programmes are often difficult to quantify. Safety management initiatives have to compete for resource and funding just like any part of the business. Compromises are inevitable.
REASON – “All commercial operators of hazardous systems must obey two principles that do not always push in the same direction”
This leads to the ALAP principle : “Keep your risks as low as possible”
and the ASSIB principle : “And still stay in business”
In Flight Operations our understanding of HF risks and risk management methodologies has been significantly influenced by 4 experts in the field.
Jim Reason – ‘Organisations, Corporate Culture and Risk’
Bob Helmreich – ‘Threat and Error Management’
Mica Endsley – ‘Situation Awareness’ and
Garry Klein – ‘Cognitive Task Analysis’
During this presentation I will share some of our ideas and practical tools about how we manage safety related risk in British Airways
NEXT SLIDE

2. Overview What is Risk Management?
How do we manage risk in Flight Operations?
Safety Culture
Management Recognition Tools
Operational Mitigation Tools
Training/Feedback
Presentation overview
What is Risk Management?
‘Effective control of risk in a hazardous environment’
NEXT REVEAL
How do we manage risk in Flight Operations
Safety culture
Management recognition tools
Operational mitigation tools
Training/feedback
Very few accidents or serious incidents involve recklessness or an intentional disregard for company operating procedures but rather a lack of appreciation of, or ability to manage the threats or risks they are exposed to, so when does a reasonable idea become unsafe? Let’s have a look at some examples………..NEXT 9 SLIDES

3. So in a safety critical business……….
Safety is No Accident
So in a safety critical business……….
………..how do we manage the risks?
So in a safety critical business ………how do we manage the risks?

4. Effective Risk Management
Organisation
Procedures/Technical
Training
Data
REVEAL SLIDE – ORG to DATA
ORGANISATION – REASON -What are the values (what is important) and beliefs (how things work) that interact with an organisation’s structures and control systems to produce behavioural norms (the way we do things around here).
PROCEDURES/TECHNICAL - How do we ensure that company operating procedures and technology mitigate against the risk of incidents and accidents?
TRAINING - What are the key competencies that need to be trained and assessed. How is this best achieved and what are the standards?
DATA – How do we generate feedback and how can this be used to improve safety?
NEXT SLIDE

5. Layered Defences Safety Threats Flying Ops REVEAL SLIDE –
Airline operations are inherently exposed to a variety of safety threats ( hazards), all of which can contribute to a potential accident. A serious incident or accident sequence begins with the negative consequences of organisational processes (i.e. decisions concerned with planning, scheduling, forecasting, communicating, regulating, maintaining etc…).
These ‘latent’ failures of organisation are transmitted to the workplace where they can create the local conditions for errors or violations. Most of us in this room will relate to the significance of this e.g. the pressure to meet financial or operational targets – Airline ops – slot time/ punctuality targets – Health management – waiting lists/throughput of patients..
This does not mean to say that such targets are wrong or inappropriate but rather there is acceptance by those who are accountable for safety that error and violation producing conditions are likely to lead to errors and violations in the situation or task.
It is therefore important that robust defence mechanisms is put in place to prevent an error or series of errors leading to a serious incident or accident.
NEXT SLIDE

6. Layered Defences Safety Threats Safety Culture SOPs Technical Training
Flying Ops
REVEAL SLIDE
Irrespective of the level of individual competency of the crew, their ability to operate safely will be influenced by the quality and robustness of the defences designed to mitigate the consequences of errors or violations. One of the basic principles of error management is that it is often the best people that make the worst mistakes.
Let’s have a look at some typical defences:
FIRST REVEAL – Safety culture
Perhaps the most fundamental of a layered defence approach to risk management is the safety culture that prevails within an organisation. This above all else will drive the behaviours of the practitioners.
NEXT REVEAL SOPs
Standard Operating Procedures define how our aircraft should be operated. They take account of the type of operation we undertake, feedback through a sustained period of operational experience from both within and outside of British Airways and new technology. They are designed to provide a framework where the crew can operate the aircraft safely.
NEXT REVEAL – Technical
The consequences of some errors are so serious that SOPs alone cannot mitigate effectively against the risk of an accident. It is often possible to develop technical tools that warn the crew that action is required.
Tools such as Enhanced Ground Proximity Warning System (EGPWS) and Aircraft Collision Avoidance system (ACAS) are excellent examples. They are however reliant on the crew responding correctly to the warning.
NEXT REVEAL - Training
Effective training will equip the crew with the required skills and competencies to do the job. As well as technical competence, it should equip the crew with effective strategies to manage risk.
NEXT SLIDE

7. Layered Defences Erosion Safety Threats Flying Ops
None of these defences are impenetrable.
NEXT SLIDE
Each has it’s flaws whether it be an unforeseen error condition, human failure or poor training.

8. Layered Defences Erosion Safety Threats Flying Ops
Each has it’s flaws whether it be an unforeseen error condition
NEXT SLIDE

9. Layered Defences Erosion Safety Threats Flying Ops
Human failure or poor training
NEXT SLIDE

10. Layered Defences Erosion Safety Threats Flying Ops
Our ability to avoid, trap or mitigate against errors or system failures by understanding how we can strengthen our defences will minimise the risk of a potential accident.
NEXT SLIDE

11. Layered Defences Ineffective
Safety
Threats
Possible ACCIDENT
Flying Ops
A failure to be adopt a pro-active and high energy approach to safety critical issues and inattention to effective defensive measures provide the conditions for a possible Accident.
NEXT SLIDE

12. Incident / Event data life cycle
Safety Support
Feedback
Feedback
Analyse Data - Assess Risk
Safety Groups
FSB
FOSG
FOPG
Safety Services
BSRC
Flying Ops
SAFETY DATA
BUILD UP SLIDE
Our ability manage risk effectively is influenced by the quality of information we are able to access about what happens at an operational level and our ability to analyse that information.
To demonstrate how of our safety management system is integrated into the management and safety governance structure within the airline, it may be helpful to explore the life cycle of an incident or event.
REVEAL - Safety Support
In order to provide effective safety support it is necessary to ensure that all relevant safety information is appropriately fedback into the flying operation. One of the primary functions of the Flight Ops management team is to provide a climate where our crew can manage a safe operation.
NEXT REVEAL – Flying Ops
Let’s consider an incident involving crew error.
NEXT REVEAL – FOSU
Information may come from a variety of sources. In the case of an aircraft limit being exceeded (FLAP) this may be recorded remotely on the FDR. It may also be reported by the crew in the form of an Air Safety Report (ASR). The FDR will only inform that the limit has been exceeded. The ASR will normally inform the conditions that prevailed and
Any additional safety information considered relevant by the crew.
This safety information is collated by the Flight Operations Safety Unit and where appropriate fedback directly into the operation and safety support areas.
NEXT REVEAL – FOPG etc
It is also fed into the Flight Operations safety groups who analyse the data and update their assessment of the operational risks.
FOPG comprises experienced training and technical mangers who review/research and advise/recommend changes to policy. No executive authority to change policy.
FOSG comprises Heads of Flight Ops departments who hold cabinet responsibility for the day to day safe operation of our aircraft. This body has executive authority to change policy.
FSB – one of 3 boards ESB & GSB that report on safety issues to the Board.
NEXT REVEAL – Safety Services
An important part of safety governance is that all safety related data is channelled through an independent body that reports directly to the CEO and the BA Board. This group oversee the quality and audit processes across Engineering/Flight and Ground operations as well as providing an interface for externally generated safety info (other airlines etc…)
In the case of a serious incident they would conduct an independent investigation. In some circumstances this could involve the AAIB.
NEXT REVEAL – feedback to safety support
Actions or recommendations from both the BSRC and FSB may be directed to the Flight Operations Standards Group. Relevant information will be fed into the safety support system.
NEXT SLIDE
Flt Ops Safety Unit FOSU

13. Organisation – Key Ingredients
Strong Safety Culture
No Blame
Open Reporting
REVEAL SLIDE
NEXT REVEAL –Strong Safety Culture
Safety has to be seen to being taken seriously from the Boardroom to the shop floor. Each has to recognise their role and responsibilities and be accountable for what they do. The behaviours demonstrated by those who with influence and control will determine the standards adopted throughout the company.
NEXT REVEAL – No Blame
It should be accepted as a given that no-one comes to work with the intention of ‘screwing up’. The attribution of blame, though often emotionally satisfying, hardly ever translates into effective countermeasures. Blame implies delinquency, normally dealt with by exhortations and sanctions. These are wholly inappropriate if the individuals did not choose to ‘err’ in first place, or were not markedly error prone.
NEXT REVEAL – Open Reporting
An open reporting culture reveals rich streams of safety related information that would otherwise be invisible to the organisation.
To be effective it requires a high degree of trust by the individual in how the company will use the information. It must lead to a beneficial outcome.
For an organisation to manage safety in an optimal way, every individual needs to own the safety responsibility.
Open reporting is an essential element of closing the feedback loop.
NEXT SLIDE - PROCEDURES

14. Procedures Designed around TEM Easily Understood Consistently Applied
Acknowledge what experts do
Talk to slide
REVEAL- TEM
REVEAL- EASILY UNDERSTOOD – can be challenging
REVEAL- CONSISTENTLY APPLIED
REVEAL- ACKNOWLEDGE WHAT EXPERTS DO – avoid temptation to restrict design to the back room boys
NEXT SLIDE- TRAINING

15. Training Blend of Technical and Human Factors HF Common Language
Trainer Skills
Operational Rigour
Talk to slide
REVEAL – BLEND
Easy – technical. More complex HF. Get the balance right. Structured approach
REVEAL HF language
Framework for observation/analysis/feedback/recording
Notechs – SOCIAL – Leadership/Management and Teamwork (use of Emotional intelligence)
COGNITIVE – SA and DECISION MAKING
NEXT REVEAL – Trainer skills
Biggest bang for the buck – need support in developing competencies. Pre-requisite for the job.
NEXT REVEAL – Operational rigour
Corporate complacency. Operation of highly reliable systems. Understanding safety critical tasks.
Prioritisation.
NEXT SLIDE

16. Data Air Safety Reports (MOR) SESMA (FDR Data) Incident Analysis (CTA)
Risk Assessment (RAT)
TALK TO SLIDE
REVEAL – ASRs – link to training and HF framework – open reporting
REVEAL – SESMA – FDR confidential – BALPA protocol – link to ASRs. Trend data – set in context
REVEAL- Incident analysis (CTA)
Consider different techniques foe debriefing incidents - what is problem single significant event or a number of linked events. Look at CTA example shortly.
REVEAL – RAT
Look at a more formal Risk assessment tool
NEXT SLIDE

17. Potential Accident Types
CFIT
Collision – Mid-Air/Ground
Loss of Control - Tech / Non Tech
Runway Excursion
Fire / Smoke/ Fumes
Security
Runway Excursion
TALK TO SLIDE
Before we look at each of these areas in more detail it is helpful to identify and consider potential accident types.
NEXT SLIDE

18. X X Near miss example Normal Touchdown zone (X) with planned roll out
35 knots fast
Approx 80 knots passing normal turnoff
Actual Touchdown (X) and rollout X

19. Confidence (Training)
Incident Analysis
HUMAN FACTORS
Mindset (Training)
Overload (SA)
Tunnel vision (SA)
Confidence (Training)
TALK TO SLIDE
Mindset – believed they were committed to land below DA. Had never rec’d training in GA from below DA.
Overload – When a headwind turned into tailwind close to the end of RW and the aircraft started to go above the optimum approach slope there was a capacity conflict for both pilots in their ability to act and their ability to think.
Tunnel vision – Both pilots became focussed on completing the task and lost sight of the big picture.
Confidence Their confidence in their own ability was shattered.
THEY WERE BOTH COMPETENT PILOTS
The combined technical and HF debrief has caused us to review our training in this area and provide a hitherto latent failure of organisation…..
One of the additional challenges in this type of scenario is overcoming issues related to assertiveness and tunnel vision. This most frequently manifests itself in HE approaches as what we politely call the VISUAL DEVIL.

20. Incident debrief methodology
Traditional
- analytical questioning supported by data
(FDR/weather reports/ATC etc)
- informs what happened and how
- Investigators to establish causal factors
Cognitive Task Analysis
- informs individual/crew understanding of SOPs, custom and practice (work-arounds), what happened, how it happened and why the crew did what they did
- better informs causal factors and remedies
TALK TO SLIDE

21. Q? What is the crew understanding of the procedure?
CTA Process – 3 Stages
1. Timeline with Key Events established beforehand
Timeline will contain relevant phases, decisions, procedures, checklists etc.
00:00
10:00
05:00
Start
Finish
Q? What is the crew understanding of the procedure?
2. Custom and Practice
00:00
10:00
05:00
Start
Finish
Q? What is custom and practice (e.g commonly seen workarounds/ time saving on the line?)
TALK TO SLIDE
SET SCENE FOR DEBRIEF CLIMATE – OPEN – NO JEOPARDY
3. Incident Timeline
Follow up areas
00:00
10:00
05:00
Start
Finish
What actually happened?

22. CTA Output Use output to: Review/modify procedures
Review/modify training
Develop expertise

23. CTA Example – Taxi Incident
Summary: Aircraft attempted to taxi without flap and with personnel under aircraft
NORMAL PROCEDURE
Start Procedure
Push Back Procedure
After Start Check List
Taxi Clearance/Taxi
00:00
03:00
06:00
Approx Timeline
Potential Distractions
Time Pressure?
Lack of Rigour?
CUSTOM & PRACTICE
TALK TO SLIDE
Refer to compelling aural or visual info – distractions
C& P warning lights in start procedure/ blocking cul de sac – busy RT/ Pre –empting taxy clearance or prompt from ATC.
No Flap & Personnel still under aircraft
System warning
Completed
Not actioned
INCIDENT

24. CTA Taxi Incident Outcome
Output from taxi incident CTA used to:
Change 2 SOP’s based on Crew feedback
SESMA event for taxy no flap
Check Ride feedback item introduced
Develop generic distraction management training
module for Sim Checks (all fleets)
SOPS – Pause points in CL and change of terminology for Ground Crew Clearance
- Requirement to verbalise After Start CL complete before calling for Taxy Clearance
- SOP restricting actions to be completed during start & push excepting in emergency

25. Risk Assessment Tool (RAT)
What does it do?
………….and how does it do it?
Example
RISK ANALYSIS BY DEPENDENCY MODELLING
What: We use a risk analysis tool to:
Understand and minimise risk
To forecast and minimise unforeseen risk
To provide a written record
In 1998, British Airways decided to seek a formal method of Risk Analysis.
We looked at several proprietary risk analysis software modules, including the one from SHELL, but they all required us to IDENTIFY hazards, before proceeding to protect ourselves against them.
Then we discovered a new approach: instead of asking “what can go wrong?”, we ask “what must go right?” in order to achieve
our objective. In other words we ask “what does success depend upon?”
When we have answered that question, we look at the answers and ask what they, in turn, depend upon.
And so on. In this way we construct a dependency model.
(The software we use for dependency modelling is called RAT - Risk Analysis Tool)
Let’s look at an example …….. NEXT SLIDE

26. Risk Assessment Tool (RAT)
Aircraft does not
land gear up
Gear system operates successfully
Gear is selected down
“AND” Relationship

27. Risk Assessment Tool (RAT)
Gear is selected down
Pilots are prompted to select the gear down
Pilots remembers to
select the gear down
“OR” Relationship

28. RAT Example Aircraft does not Gear is selected Pilot remembers to
Procedural selection
land gear up
down
select the gear down
as part of SOP's
Crew monitoring and
checklist discipline
Pilot is prompted to
Horn prompt tied to
select the gear down
flap/throttle
GPWS gear mode
Gear system
Normal System
Hydraulic pressure
operates sucessfully
works correctly
is available
Control system
sequences correctly
Alternate system
works correctly

29. RAT Example Outcome In this case, the previous slide shows that the
probability of an aircraft landing with the gear up is
approximately once in 100 million flights.

30. Summary Risk Management – closing thoughts……….. Tools
CTA - Cognitive Task Analysis
RAT – Risk Assessment Tool
Key points
1. Thinking of Safety in a different way
2. Never relax your effort - you are always cutting the grass!
Risk Management - Effective control of risk in a hazardous environment
Many facets – it requires a holistic and disciplined approach
Variety of tools – select appropriate tools to suit the situation.
Some BA tools - HF analysis/ CTA/ RAT
KEY POINTS Read from slide

31. Questions?