After you pass through the second set of security doors at Minneapolis Center and walk onto the control room floor, there is a directory board. It’s just past the OMIC desk where a left turn takes you to the areas and a right turn takes you to Airways/Facilities, TMU, and the supervisory offices. The board is the kind with a black background and white letters held in grooved rows. The kind one can change, update, and easily modify.
The Board contains a few pieces of information. It says what the current National Security Color Threat Level is. It says what the traffic count for the previous day has been. And, until a couple days ago, it had two numbers — the EFD and the OEFD. Error-Free Days and Operational-Error-Free Days. Like those signs you see at construction sites — “43 days without an accident!” — the Board was both a source of pride and an indication of a fundamental truth about my job. There will be errors. It’s just a matter of time.
The Board no longer has the EFD and OEFD on it. Now, it says “ATSAP.”
The traditional culturally-assigned meaning of errors, the system I trained in, is as follows. Errors happen. Errors are a result of either a flaw in procedure or a failure by and individual to perform to requirements. Errors are avoided by unwavering adherence to correct procedures. When errors occur, a determination of fault is made. If a procedure is at fault, those who made the procedure are punished and the procedure is corrected. If an individual or individuals are found to have slipped from the path of procedure, they are punished in such a manner as to spur all others to a renewed commitment to procedure. Under this cultural model, errors are the result of negligence or inability.
One of my hobbies is the study of systems errors. I like books about aviation accident investigation, I like reading up on NASA’s disaster investigation program, I like books about public health systems and initiatives, I like reading up on how hospitals work or fail to work. The concept of the Normal Accident is fascinating to me. It’s fascinating to everyone who tries to do complex things.
From the NASA document on Normal Accident Theory:
“Failure in one part (material, human, or organization) may coincide with the failure of an entirely different part. This unforeseeable combination can cause cascading failures of other parts. In complex systems these possible combinations are practically limitless. System ‘unravelings’ have an intelligence of their own: they expose hidden connections, neutralize redundancies, bypass firewalls, and exploit chance circumstances for which no engineer could reasonably plan. Cascading failures can accelerate out of control, confounding human operators and denying them a chance for recovery. Accidents are inevitable — ‘normal.’”
This makes the point that errors and accidents are not the result of poor procedures, negligence, and inability. Or, rather, that all those things play a part in the normal, inevitable accident. That those factors combine in unforeseen ways to produce errors that are new every time. The only way to possibly counter normal accidents is to know why they happened. To study the previously unanticipated ways that people circumvent safety rules, to acknowledge workplace cultures that reward breaking of safety practices, to honestly and objectively evaluate the mechanical and human factors. To then change those portions that are controllable to increase adherence to safety. To make it easier to remain safe.
Punishment does not decrease the risk of normal accident. Punishment decreases the flow of information. A punishment system encourages employees to hide near-errors, to cover-up unsafe practices that have not yet resulted in an error, it encourages a workforce to help the project move forward to meet organizational goals under a “no blood, no foul” mentality. If there wasn’t an error, this thinking goes, we were safe enough. What we know of normal accidents indicates that this is entirely wrong. That systemic erosion of safety actions inevitably leads to a multi-origin, coupled accident.
The FAA is finally acknowledging this truth. Finally moving to grasp a concept that has been known for decades. That punishment discourages the necessary collection of information. To increase the flow of information Air Traffic is adopting the Just Culture approach to incident investigation.
The goal of Just Culture is to learn from unsafe acts before they result in an accident. To do this we must know what unsafe acts are occurring. We must know which unsafe acts are routine, which are accepted. We must know what rewards people in their unsafe acts and restructure the system to reward safety. We must establish what are acceptable and unacceptable practices, and investigate why unacceptable practices persist with the goal of gaining insight, not punishing reflexively. To do this the FAA is establishing a program of self-reporting without punishment. The workforce can report on their own unsafe practices and near-errors without fear of recrimination or reprisal for the purpose of educating the entire system.
This is ATSAP. The Air Traffic Safety Action Program. The first step in ATSAP is the removal of the EFD and OEFD from the Board. It’s a small change, but a symbolic one. We no longer care who had the last error or when — we care about keeping planes safe.
Filed under: Work | Tagged: atc | 3 Comments »