24th Sep 2002, 10:41

Hi all. I have been working for ages on my ATPL studies and am closing in on my final exams!(Hope they are all passes this time!). Anyhow, since I have been studying sooooo hard I have also been taking all my notes onto computer. I haven't missed a single note.
So if you need a reference to some material, or you want a bit of study notes then take a look at this site I did for you guys out there desperate to do their best.
jar-atpl-notes.fateback.com (http://jar-atpl-notes.fateback.com)
Hope this helps someone because I spent ages looking for this kind of stuff.
oh, and the website is a little slow but it is free! Let me know what you think.
JD

Meeting 12: The 12th Symposium on Human Factors in Aviation Maintenance INTRODUCTION The 12th Human Factors in Aircraft Maintenance Conference was the first of this long-running series to be held in Europe. Some 300 personnel from 140 companies and organizations in 24 countries attended during the 4 days of the meeting and heard 21 papers presented by speakers from Europe and North America. But the statistics only tell part of the story. With meetings of this nature, much of the value is gained through the discussions which take place outside the main conference, in bars and quiet corners. Unfortunately, we cannot reflect these discussions in this document. What we have tried to do is ensure that the papers presented are reproduced here to act as a reminder for those who were present, an opportunity to learn for those who were not, and a reference work for all. On a personal note, the CAA organizing staff would like to thank everyone who participated in the conference, whether as speakers, session chairs or delegates, for their help and co-operation during the event. This was the first of the series to be held in Europe, but we hope it will not be the last. The topic will remain, in one form or other, a subject of importance and a major factor in the continuing battle to raise the standards of safety for air travelers everywhere. The opportunity for professionals to meet and confront their common problems, exchange ideas and then return to their workplace better equipped to implement the solutions is of enormous value. We hope that this conference contributed to the process.
Fiona Belton Conference Organizer
1.0 SYMPOSIUM OPENING REMARKS Donald B Sherritt Transport Canada
Good morning ladies & gentlemen… it gives me great pleasure to welcome you to this 12th Annual Symposium on Human Factors in Aviation Maintenance. I am pleased to see how this symposium has grown over the years into an international event. An event where aviation maintenance experts from many countries can get together to share experiences and focus on how human factors affect our world. It is quite fitting that the first truly multinational Human Factors in Aviation Maintenance symposium be held here, in the United Kingdom, one of the busiest aviation hubs in the world. This particular conference holds great promise. With international speakers representing all facets of the aviation industry, the benefits to be derived from bringing people together and offering up the latest information are immeasurable. I’m sure most of you have gritted your teeth at recent news articles with doomsday predictions of aircraft falling from the sky. Safety forecasters are predicting that if the accident rate remains at the present level, by the year 2010 we could have a major hull loss every week. At the recent symposium on “Technology and the Flight Deck” held in Vancouver, I was particularly impressed by the remarks of Pierre Jeanniot, Director General of IATA. He reminded us that with the anticipated growth in air traffic, we may have to halve the accident rate just to keep the total numbers where they are today. He also made the point that perception is everything. The public is not likely to respond favorably to reassurances that the system is statistically safe. They are far more likely to be moved by the images they see on the six o’clock news. Should we be concerned about these dire predictions? The answer of course, is yes. If we lose the confidence of the flying public, we will not only feel the effects directly in damaged business. There will also be indirect effects as regulators are faced with pressure to respond with overly restrictive counter measures. In reality, the system has never been safer, and the trends are all in the right direction. To take the Canadian situation, 1996 was an exceptional year for aviation safety, with 19% fewer accidents and 52 % fewer fatalities, than the previous five year averages. Nevertheless, Transport Canada recognizes that if we’re to prevent these frightful predictions from becoming a reality, we must find new ways to achieve more ambitious safety goals. Attention to the role of human error in maintenance seems to be one of the most promising ways to do that. Even without the impetus of increased air traffic, we would have been turning our attention to maintenance and human factors. Since the introduction of jet transports in the fifties, we have been continually improving the technological side of the equation, and we are now into an area of diminishing returns. It’s only natural that we should turn our attention to the human element. Human performance on the flight deck has been a concern for a several years now, culminating in the acceptance of Cockpit Resource Management initiatives. We have come to realize that maintenance personnel are subject to similar pressures. Transport Canada
does not however, subscribe to the belief that a slightly altered version of CRM can provide an easy fix for maintenance errors. Instead, we want to work in partnership with the industry to find new ways to resolve these problems, tailored to the maintenance environment. Maintaining aircraft is a complex business, and anything we can do to eliminate complications and reduce stress will be beneficial to all. Modern technology has brought new pressures, some that that our aviation forebears never had to deal with, others oddly familiar. Each new design requires advanced training for the manufacturing and maintenance personnel who will build or repair it. But some of the new technologies, computer software and composite repair for example, do not lend themselves readily to inspection after the fact. Much as with the tradesmen of old, we are forced back into reliance on the integrity of the practitioner. Back to reliance on the human factors. Forums such as this provide members with an opportunity to share timely and accurate information. We should also use the time to discuss how we can jointly improve public confidence in our ever-expanding industry. No doubt you are all, like me, looking forward to the various speakers who, I am sure, will offer lessons we can all learn from. Your varied backgrounds, experience, and expertise will be of great value to all of us participating this week. I would like to thank our regulatory colleagues from the UK, the Civil Aviation Authority, for their efforts in hosting this symposium. And finally, on behalf of the Director General of Civil Aviation in Canada, I am pleased to accept the challenge to host the 14th Annual Human Factors in Aviation Maintenance symposium in the Year 2000. All of you will be apprised of the details once they are finalized. I wish you an enjoyable three days, and look forward to seeing you again at next year’s symposium, and again, in Canada two years hence. I would like now to give the floor to Mr. John Goglia, of the National Transportation Safety Board of the United States of America.
2.0 HUMAN FACTORS IN AIRLINE MAINTENANCE: PAST, PRESENT, AND FUTURE William B. Johnson, Ph.D. Galaxy Scientific Corporation Advanced Information Technology Division
This paper offers a historical perspective on human factors with the primary emphasis on the 1990s and the progress industry and government have achieved in airline maintenance human factors. While aviation-related human factors finds substantive roots back to the 1940s, it took nearly 50 more years for the term “human factors” to become a common term to airline maintenance personnel. The paper reviews the recent ten-year history since the FAA mounted a concerted effort to apply research and development to pragmatic issues in aviation maintenance. The FAA research team, working with the international airline community, has created procedures, software, and guidance that are now applied daily to enhance human performance and to ensure continuing safety. Finally, the paper forecasts the next ten years of maintenance human factors activity.
INTRODUCTION This paper has the goal of reviewing the history of human factors with major emphasis focused on the past ten years of research and development applied to airline maintenance. The paper uses the past decade, from 1988 to 1998, to forecast maintenance human factors activities for the first decade of the 21st century. The best way to review the past decade of progress in airline maintenance human factors is to review agendas and presentations from the semi-annual and annual FAA-sponsored meetings addressing human factors in aviation maintenance and inspection. We shall look at who has participated and how presentation themes have evolved. The FAA human factors research program activities are also an excellent means to “take the pulse” of the industry. We shall review that research and offer an assessment of the impact of the research.
Definitions and Models The industry has evolved to a level where the “definition of human factors” is not a necessary title for a conference presentation. However, even today, definitions are a function of whom you ask. Some would readily offer the opinion that human factors is “maintenance resource management.” Others cannot avoid the vision of a “bearded guru” facilitating “feel good sessions” and then reporting the results in scientific psychobable. There may be validity to both definitions. Many argue that human factors is the study of the human at the center of a given system… that human factors address human capabilities and limitations to minimize error and maximize performance. There are a variety of disciplines associated with human factors, including but not limited to, industrial and safety engineering, organizational and educational
psychology, cognitive and computer science, and more.1,2 The approach to understanding and applying human factors can be simplified using a model. The SHEL model, developed in the ‘60s by E. Edwards, may be the most common model discussed in aviation human factors circles3. However, this author suggests an easier to understand model developed by Dr. Michael Maddox for a maintenance human factors course that we offer. The PEAR model is a means to consider human factors within any organization or context. As we consider the past, present, and future direction of human factors, the PEAR works. Human factors analyses must first consider the human (People). Studying People includes such factors as the following: size, mental and physical capability, attitude, training, age, adaptability, and other such characteristics. It is imperative to understand People in order to proceed with good human factors analyses. E stands for Environment in which People work. The Environment is not limited to such physical measures as temperature, humidity, noise level, and illumination, but also to the organizational environment including such factors as labor contracts, management-worker cooperation, and workplace communication. A is for Actions which People perform in the Environment. Actions describe what the human must do to complete the variety of daily work tasks. Formalized methods for job task analysis (JTA) are important tools that human factors professionals use to define Actions. JTA results help to create precise specifications for hiring, training, designing equipment and information, and determining all critical aspects of job performance. Finally R is for the Resources that are necessary for People working in a defined Environment to perform Actions. Resources include such things as tools, computers, information, other people, time, and more. PEAR works well to understand and address all issues related to human performance in maintenance. It even works to consider the history of human factors.
THE PAST Human Factors from the Beginning of Time With “tongue in cheek” we contend that at the very start of creation, a form of the PEAR model was considered. The human was “designed” to be compatible with and/or adaptable to the Environment of earth. The design/evolution of humans had to consider the Actions the human would be likely to perform and the Resources likely to be available. The Creator had an advantage over those of us working in maintenance human factors; He had generations of time for the human to evolve. We, on the other hand, strive to eliminate and mitigate human error in maintenance at work, immediately! While the “beginning of time” story has reasonable validity, it was not until the 1900s that the human began to fly and maintain heavier-than-air aircraft. Thus, we shall jump ahead accordingly.
Human Factors in the 20th Century While some 747 captains will say that human factors began with glass cockpits, the industrial revolution is a more likely initiating event for the study of human factors. A variety of sources would contend that human factors, as a formal science, started somewhere near the turn of the century. Two industrial engineers, Frank and Lillian Gilbreth, applied a formal task analytic approach to raising the efficiency of surgeons.4 The classic example of the surgeon requesting scalpel and the assistant repeating the request
and providing the scalpel is an early example of human factors at work. This procedure permitted the doctor to concentrate on surgery rather than on finding the correct instrument. The verbal challengeresponse, of course, is used in all cockpits today. Incidentally, today the scalpel is likely to be a laser beam, yet human factors personnel continue to study the performance of medical professionals.5
THE PRESENT By 1910, the U.S. Army was conducting pilot selection and accident investigations based on pilot medical factors. Therefore, it is the field of medicine that may deserve the claim to the first formal study of human factors in aviation. Of course, it can also be reasonably argued that inventors from Leonardo DaVinci to the Wright Brothers considered all items in the PEAR model. Icarus, unfortunately, failed to consider Environment during any human factors analysis he may have conducted. Military aircraft production drove much of the early consideration of human factors.6 During the ‘40s military aircraft were in heavy production throughout the world, driven by WWII. Investigations during the war lead to the conclusion that cockpit design was a problem. The original design, and between-model modifications to displays and controls, caused the pilot to commit errors. The term “engineering psychology” emerged in the ‘40s with the focus on designing aircraft with an improved match to the capabilities and limitations of humans. At a minimum, the early engineering psychologists had to ensure standardization of displays and controls (a.k.a., knobs) within and between aircraft types. The attention to knobs and dials, by the way, resulted in the somewhat humorous term “knobology,” which is indeed a small and ongoing subset of human factors. In the late ‘40s and ‘50s, professional societies of human factors engineers and psychologists formed the Ergonomics Research Society (1949 in the U.K.) and the Human Factors Society (1957 in the U.S.) In 1995 the Human Factors Society evolved to the Human Factors & Ergonomics (HF&E) Society, thus encompassing all physical, physiological, and cognitive aspects of the human in any given system. Today the HF & E Society has over 5,000 active members throughout the world. Maintenance human factors began receiving attention in the early ‘50s at Wright Air Force Base in Ohio. Researchers there focused on such aspects as selection and training of maintenance personnel. Even then researchers were lamenting the growing complexity of aircraft and the associated electronics equipment! Human factors research evolved substantially from the ‘60s through the ‘80s. Manned space flight research made significant contributions to formal studies of the human in the system. While the PEAR model was not formally used all aspects of PEAR were applicable. The design of the complex fighter jets introduced increasingly complex aircraft and weapon systems that could easily overload human processing capability. The importance of the situation awareness was highlighted, not only by the military aircraft, but also by a few famous commercial incidents and accidents. In other industries, such as nuclear power electric generation, many examples of human error taught us that humans sometimes did not fully understand the complex systems that they were “controlling.” Critical incidents like the aircraft accidents at Tennerife (1977), the United DC8 fuel exhaustion accident off the Oregon coast (1978), and the nuclear plant Three Mile Island (1979) focused considerable attention on the study of human factors, such as training, communication, procedures, situation awareness, and crew resource management. Research, development, and products have evolved as a result
of these accidents. In 1988 the Aloha Airlines 737 encountered the famous “convertible aircraft” phenomenon. This accident placed focus on the aging aircraft fleet, but just as much attention was focused on maintenance human factors. The Aloha Accident report identified numerous human factors issues including, but not limited to, training, use of procedures, and use of a manufacturer’s service bulletins.7 In 1988 the U. S. Congress passed the Aviation Safety Research Act (PL 100-592).8 Within that law was the expressed intent to study all aspects of human factors in aviation safety including human factors in maintenance. That Act, and the associated ongoing funding, without doubt, has had the single greatest impact on the current international airline and government attention to human factors in airline maintenance. Since 1988, the FAA Office of Aviation Medicine has invested an average of $1.25M per year on maintenance human factors research and development. The FAA R&D has been matched by considerable aviation industry services and participation in-kind. The success story of the research program constitutes the next subsection of this paper.
Human Factors: Current Status Since 1988 The Aviation Safety Research Act, ten years ago, initiated funding to the FAA Office of Aviation Medicine to conduct maintenance human factors research. However, soon the three-legged stool of government, operators, and manufacturers combined intellectual and fiscal resources to enhance the maintenance research program. From the very inception of the program, the FAA knew that “research” was not the goal…pragmatic results and recommendations were the goal. The research tasks described within this section, therefore, are the pragmatic results of a coordinated effort of government and industry. It would require more pages than this paper will allow to describe all of the activities and products of the research program. Instead a few major categories and projects shall be highlighted.
Conferences on Human Factors in Airline Maintenance and Inspection “I personally am very excited about the fact that people are willing to spend their valuable time to get together and talk about something which, it is fair to say, we know little about [Maintenance Human Factor]. We in the FAA are not sure where this interest will take us, but most likely to somewhere that we would rather be compared to where we are today. Because of the lack of maturity of the subject matter, as some might say, we are in a position where we might be able to make significant contributions to aircraft maintenance and aviation safety with a fairly modest investment of time and resources. It will be exciting to be a part of this activity.” Anthony J. Broderick FAA Associate Administrator for Regulation and Certification To an audience of 40 at the first Workshop on Human Factors in Maintenance and Inspection, October 1988 An excellent means to assess the past ten years, or current status, of human factors in airline maintenance is to use the FAA maintenance human factors workshop attendance, type of participation, and
presentation topics as a measure of progress. The first meeting, ten years ago, attracted 40 participants, of which 14 were speakers. There was no non-U.S. international participation in meeting. By 1997 international participation had grown to nearly 50 of the total 294 attendees. The coordination between FAA, ATA, and Transport Canada for 1998 is an important and clear message that the industry and governments worldwide have recognized the value of these workshops. And, as an industry, we know much more than Mr. Broderick rightfully predicted ten years ago.
Table 2.1 FAA Conferences on Human Factors in Maintenance and Inspection
Meetings Year
Title
1988
Human Factors Issues in Aircraft Maintenance & Inspection
1989
Attendees Location
Presenters
US
Intl.
Gov.
Academic
Industry
Consulta
Washington, DC
40
0
3
4
6
1
Information Exchange and Communications
Alexandria, VA
78
4
4
2
6
3
1990
Training Issues
Atlantic City, NJ
92
4
3
4
5
5
1990
The Aviation Maintenance Technician
Alexandria, VA
74
5
6
1
7
0
1991
The Work Environment in Aviation Maintenance
Atlanta, GA
66
8
2
4
4
4
1992 *
Maintenance 2000
Alexandria, VA
95
8
2
0
6
2
1992 *
Science, Technology, and Management: A Program Review
Atlanta, GA
85
18
3
8
3
5
1993 *
Trends and Advances in Aviation Maintenance Operations
Alexandria, VA
79
10
1
1
11
3
Table 2.1 FAA Conferences on Human Factors in Maintenance and Inspection
Meetings Year
Title
Attendees
Presenters
Location
US
Intl.
Gov.
Academic
Industry
Consulta
Albuquerque, NM
70
13
0
1
1
10
1994 *
The Human Factors Guide
1996 *
Maintenance Alexandria, VA Performance Enhancement and Technician Resource Management
141
36
5
5
9
4
1997 *
Human Error in Maintenance
246
48
3
4
9
4
San Diego, CA
* Preregistered only. Actual registrants were approximately 40% more. As one reviews the topics and agendas since 1988, it is clear that concepts proposed and presented in the early days are success stories of the later conferences. One example is the industry’s request for applied maintenance human factors research. Conference attendees requested wide-spread dissemination of FAA research data. The result was the print publication of all program documents from the very start of the program in 1988. The materials and software were published and distributed, on CD-ROM, starting in 1991 and on an annual basis since that time. In fact, the FAA CD-ROM was the only reason for airline personnel to require CD-ROM players in the early ‘90s. The 1998 conference marks the distribution of the 7th FAA CD-ROM on Human Factors in Maintenance and Inspection—About 14,000 CD-ROMs have been distributed worldwide. The FAA maintenance human factors research program is one of the few programs that successfully accomplished the goal of wide-spread distribution of technical publications and software programs.
Advanced Technology Training Participants at the 1988 meeting asked the FAA to explore advanced technology training, create computer-based training prototypes, and make recommendations regarding best use of such technology. The research program built numerous prototypes over the past ten years. More importantly, key research team members cooperated with the ATA Maintenance Training Committee to define and demonstrate such concepts as intelligent tutoring systems, smart simulations, and other types of distance learning. Example systems, designed and built in cooperation with airline or manufacturer partners include the following: the Boeing 767 environmental control tutoring system, with Delta Air Lines; the Aircraft Maintenance Team Training, with Lockheed-Martin Aerospace; the System for Training Aviation Regulations; and the Web-based Maintenance Resource Management Trainer (www.hfskyway.com). All
The first meeting elicited a request for publications that were written for aviation maintenance managers. The goal was to produce useful documents for the airline maintenance community. Of course, the materials are useful to general aviation maintenance personnel, to regulators, and also to students in human factors programs. Examples of these products include the Human Factors Guide for Aviation Maintenance9 and the Human Factors in Aviation Maintenance and Inspection Website (HFAMI). The third edition of the Guide is completed for this meeting. The HFAMI Website, operational since 1995, has had over 1.3 million hits, of which 1 million were after January 1997. The Website has won national Web awards and sets a standard for other government research programs.
Job Aiding for Maintenance and Inspection Job aids usually capitalize on small computers to support workers. Typically job aids provide information and/or business process automation. Numerous job aids were developed and delivered to industry and government as part of the research. Examples of these systems include an automated Coordinating Agency for Supplier Evaluation system (CASE), a Document Design Aid (DDA, distributed on the 1998 CD-ROM), and the On-line Aviation Safety Inspection System (OASIS). OASIS is an FAA research success story of the ‘90s. The system evolved from a small research prototype, called the Performance ENhancement System (PENS), to a major full-scale implementation for all FAA aviation safety inspectors worldwide. OASIS offers the inspector nearly all documents and access to databases necessary to complete FAA inspector responsibilities. The system is fielded to nearly 800 inspectors and 1,300 more units will be deployed in 1998. An extensive effort of user-centered design ensured a very useable system that received wide-spread user acceptance. The system was fielded properly with extensive user training and telephone service support. The PEAR model best describes the complete human factors analyses that was used to specify, create, deliver, and support OASIS.
THE FUTURE: FORECAST FOR MAINTENANCE HUMAN FACTORS For this paper we shall look ahead five to ten years, since that will be most helpful as we conduct current projects and plan for the future. It is reasonable to expect that airline maintenance human factors activities will accelerate over the next ten years. This projection is founded in the fact that the past ten years has introduced and educated much of the airline industry and governments to maintenance human factors. Airlines have either hired human factors specialists on the internal staff or are using human factors consultants. Universities have started graduate programs specifically for aviation human factors. Many of the human factors students, who conducted research under FAA human factors funding, are graduating and taking positions with airlines and manufacturers. In addition, airline and manufacturing personnel are attending human factors courses offered by private companies or organizations such as the IATA Learning Center. These trained personnel shall have a significant impact as they integrate human factors into their respective organizations. The PEAR model is an excellent model to provide structure to a forecast of the future. The People available for the next ten years are likely to follow recent trends. It is very likely that there shall be an
increasing number of females entering the maintenance workforce. With the trend towards outsourcing airlines will hire fewer technicians. The repair stations shall increase hiring. The number of FAR 147 schools are down and the graduating classes are smaller. There shall be a shortage of trained qualified personnel. It is likely that People entering the airline maintenance workforce will be less passionate about the industry and about aircraft than past maintenance employees. For example, today’s generation did not grow up building model airplanes and flying piper cubs. In many cultures the aspiring airline maintenance worker has never owned or fixed a car much less an aircraft. These People trends shall influence selection, training, certification, equipment and procedure design, workplace design, and more. The past ten years have seen airline maintenance environments grow to accept and capitalize on diversity in the workplace. That positive trend shall continue. The physical Environment shall not undergo radical change in ten years. Maintenance personnel shall continue to cope with environmental extremes related to temperature, lighting, ambient noise, odor, confined spaces, and time of day. Portable units to improve radical environmental conditions shall help. Design of new hangars and revisions to existing hangars shall improve the physical environment and layout. Improved textiles shall offer more comfortable working conditions even when the environment cannot be controlled. The organizational environment has evolved in the ‘90s and shall continue to evolve. Increasing teamwork and enhanced communications shall evolve and improve in the maintenance environment. While technology, such as E-mail, shall help to improve communications, an industry-wide raised consciousness regarding the importance of communication shall evolve. The result shall be a reduction in human error in maintenance. That must occur. Maintenance Actions involve such activities as inspection, servicing, troubleshooting, removal, replacement, and tests. These activities shall continue for the next ten years⎯for the next one hundred years. However, modern aircraft shall require less of all the activities stated above. New aircraft contain improved self-diagnostic equipment, smarter software, new materials, and increased redundancy and reliability. For the past twenty years, we have forecasted that aviation maintenance technicians (AMTs) must increase their knowledge of electronics and of software. At the same time AMTs must maintain the existing aging fleet. Safe and proper servicing of hydraulic systems, sheet metal repairs, and airframe/powerplant inspections must go hand-in-hand with the new technology skills. Other forces will drive the types of Activities AMTs will perform. Because there will be a shortage of qualified People to do the work, the maintenance community must find better and more efficient ways of getting things done with less. AMTs will need to hone their teamwork skills and act as a cohesive unit to compensate for any technical and personnel deficiencies projected to occur. Teamwork requires more than technical Actions; it requires AMTs to be competent in interpersonal Actions as well. To add to this, as maintenance processes become more complex, AMTs will need to gain a more global perspective of where they fit into the “system.” Thinking globally enables AMTs to think about how their Actions affect others, thereby inculcating a culture of safety. Maintaining this perspective, and Acting on it requires a great deal of knowledge, flexibility, decision making, and leadership. In the future, AMTs will be required to use their heads just as much as they use their hands. Programs such as Maintenance Resource Management (MRM) are beginning to address this need. Information technology shall dominate all change in maintenance Environments and People’s Actions. Technicians shall master the software tools for improved tracking and control of the maintenance business process. Technicians will spend less of their Actions referring to the maintenance and fault isolation manuals because of improved electronic publications and other such electronic support equipment. Such job aides will stand-alone and/or will be an integral part of the prime system. The “thin-client” and other such portable information devices will be everywhere. The devices shall increase in power and decrease
in size, to the extent that they will be a FOD hazard. While information technology is a blessing it can also be a curse. Proven human factors principles must be applied to the specification and design of new technology systems. Bad ideas or bad designs do not improve on good computers. JTA and human-centered design must ensure the quality of the information technology. Tested human factors principles shall always be critical for successful design and implementation of new systems. Resources shall also evolve. Training has improved over the past ten years and that trend shall continue. Training shall be provided “just-in-time,” at the work site, by embedded software and by portable computers. Over the next ten years the line between training and job aiding shall become more clouded. The same portable, perhaps wearable, computer that provides electronic technical publications shall also provide on-the-job training and information. One result of this technology is that AMTs shall have a larger set of technical responsibilities because of the increased computer-based technical support available. One Resource that will remain limited is time. We cannot reasonably predict that the complex task of aircraft maintenance shall ever evolve to eliminate the time pressure of schedules, push backs, and completion of an overnight check or the aircraft scheduled for an early morning flight.
SUMMARY AND CONCLUSIONS Human factors, as a formal discipline, emerged in early 1900. By 1940, human factors design and engineering contributed to safety improvements in military aircraft. By the ‘50s, psychologists and industrial engineers were studying performance of maintenance technicians. However, the ‘90s became the decade for the applied study of maintenance human factors. During the ‘90s the FAA and airlines conducted extensive research and development and left a trail of useful products, procedures, and technical publications. Finally, as we look to the future we emphasize that the research program has left many questions unanswered. The FAA and industry research is not over. It will never be over. The research has the responsibility to look to the future, to push the envelope, to continue to recognize the numerous opportunities that maximize human performance and minimize human error in airline maintenance. Industry and government must continue to cooperate in this important endeavor.
ACKNOWLEDGMENTS The author gratefully acknowledges the FAA Office of Aviation Medicine, specifically Dr. William Shepherd (FAA retired in 1997) and Ms. Jean Watson, current Program Manager, who has been affiliated with the research since its beginning in 1988. The FAA sponsor of the Aviation Medicine Program is Mr. Les Vipond, from the Aircraft Maintenance Division of the Flight Standards Service. The author also acknowledges the research team, which comprises excellent applied research professionals from Galaxy Scientific Corporation, The State University of New York at Buffalo, Clemson University, and other private individuals and companies affiliated with the program since 1988. The guidance and assistance from the international airline industry, the NTSB, the Department of Defense, numerous universities, and
consultants are the key for the past and ongoing success of the program and its products.
REFERENCES 1. Johnson, W.B. (1996a). Human factors for maintenance and engineering personnel. IATA Insight, September/October, Vol. 4(05). 2. Johnson, W.B. (1996b). Human factors in maintenance: an emerging training requirement part 1 of 2. Ground Effects. October, Vol. 1(2), part 2 of 2. December, Vol.1(2). 3. Edwards, E. (1972). Man and machine: systems for safety. In Proceedings of British Airline Pilots Association Technical Symposium (pp. 21-36). London: British Airline Pilots Association. 4. Sanders, M.S., & McCormick, E.J. (1976). Human Factors in Engineering and Design. New York: McGraw Hill, Inc. 5. Maddox, M.E. (1997). Designing medical devises to minimize human error. Medical Device & Diagnostic Industry, May 1997, pp. 166-178. 6. Edwards, E. (1988). Introductory overview. In E. L. Wiener & D. C. Nagel (Eds.) Human Factors in Aviation. San Diego: Academic Press. 7. National Transportation Safety Board (1989). Aircraft Accident Report: Aloha Airlines Flight 243, April 28, 1988 (NTSB-AAR-89/03). Washington, DC: National Transportation Safety Board. 8. The Aviation Safety Research Act of 1988, Pub.L.No.100-592, 102 Stat. 3011 (1988). 9. Federal Aviation Administration (1995, 1998). The Human Factors Guide for Aviation Maintenance and Inspection. Washington, DC: Federal Aviation Administration.
3.0 MAN FACTORS IN AEROSPACE MAINTENANCE: PERSPECTIVES FROM NASA RESEARCH AND OPERATIONS Barbara G. Kanki NASA Ames Research Center Donna M. Blankmann-Alexander United Space Alliance Tim Barth NASA Kennedy Space Center
The contributing causes of human error in maintenance operations are not well understood. Because errors may remain latent over long periods of time and operational use, error event chains and their consequences are often difficult to trace and identify. In addition, human errors typically stem from multiple, interrelated sources; some are relatively easy to assess, such as workplace conditions or adequacy of resources; others are more indirect in their effect, such as organizational culture and communication barriers. Consequently, the process of managing error may involve multiple and diverse interventions with no single “magic pill” to cure the problems. Recognizing these challenges, National Aeronautics and Space Administration (NASA) is committed to improving the understanding of human error in maintenance through research as well as developing interventions for immediate use. In the following presentation, Ames Research Center (Ames) and Kennedy Space Center (KSC) jointly present NASA’s approach to human factors in aerospace maintenance from both research and operational perspectives.
AMES RESEARCH CENTER: HUMAN FACTORS RESEARCH Over the past 8 years, researchers at NASA Ames have investigated human factors issues in the maintenance domain. Although there has not been a formal program of research, NASA and the Federal Aviation Administration (FAA) have provided the support to maintain several initiatives. The work has been accomplished by teaming with aircraft manufacturers and airline operators, collaborating with human factors and industrial engineering groups at Kennedy Space Center, and learning from research colleagues. This year, maintenance human factors has been recognized as an element in the new NASA Aviation Safety Program, and NASA Ames researchers will build upon the current research foundation in order to develop a focused program of research in four main areas: •
Improved procedures
•
Human factors task and risk analysis tools
•
Maintenance resource management skills, training and evaluation
•
Advanced displays for maintenance aiding
Goals and Approach NASA’s Maintenance Operations Research Project supports the National Goal of Safety by fostering a better understanding of human factors in maintenance operations and by developing interventions and task aids that reduce human error and enhance safety and effectiveness.
Customer/partner participation Central to the research approach, industry/government/research partnerships will be made that ensure: 1) research issues are relevant to industry needs, 2) research products are realistic and consistent with operational standards and requirements, and 3) researchers make effective use of existing human factors knowledge, techniques and databases. Among industry partners, airlines, unions, and manufacturers will be included. Government and research partners will come from the FAA, NASA, Department of Energy, other government laboratories, as well as the academic community.
Metrics and success criteria It is important to both researchers and customers that research products be operationally validated. From the research standpoint, a proof of concept is often field-tested in order to make needed refinements and to make recommendations for larger scale implementation. From the customer standpoint, the costs and benefits of implementing new technologies and programs must be carefully evaluated against one’s own needs and resources. Although it is desirable to collect as many assessment measurements as possible, often it is not feasible to burden the workforce with additional data collection. Therefore creative and unobtrusive methods of acquiring existing and new data must be devised. Existing databases may include company safety and audit data as well as training records and other routinely monitored performance indicators. In addition, qualitative methods, including surveys, interviews and observational methods may prove to be useful.
Four phases For each of the research areas, four phases make up the research approach: 1. Identify high priority human error problems in maintenance 2. Define human factors requirements through task analyses 3. Develop human factors interventions to errors 4. Validate improvements in operational field sites These phases are depicted along the bottom of the Roadmap in Figure 1. Consider the research area “Improved Procedures” shown near the top. The products for this research area are tools for evaluating, standardizing and documenting procedures. An example of a specific project may be “guidelines for incorporating human factors in the engine change procedure”. In this project, the “guidelines” would constitute the Human Factors intervention developed in phase 3, and operationally validated in phase 4.
The Roadmap also shows that there are pre-cursor phases 1 and 2 in which maintenance human errors (related to engine change procedures) are identified and in which human factors requirements are defined (through an analysis of the engine change task). By basing the development of interventions on phase 1 and 2, we ensure that the intervention addresses relevant high-priority human factors problems and that the intervention is based on an operationally realistic understanding of how the task is performed. Similarly, the research area, Maintenance Resource Management (MRM), Skills and Training will generate products which need to be operationally validated, based upon an understanding of maintenance human error related to MRM. The intervention itself is based on human factors requirements related to the type of MRM skill involved (e.g., communication, team leadership). The research areas Human Factors Task Analysis Tools and Advanced Displays for Maintenance Aiding follow the same 4-phase approach.
Figure 3.1: Roadmap to Maintenance Operations Research Program: 4-Phase Approach It should be noted that specific research projects may emphasize the different phases to different degrees. For example, the goals of some basic research projects are to develop a proof of concept (phase 3) and little more. In such cases, phase 4 operational validation may not be immediately feasible. In contrast, however, all projects need a solid grounding in phases 1 and 2 so that interventions are relevant to industry needs.
Understanding the Nature of Human Error in Maintenance
Aviation Safety Reporting System (ASRS) maintenance error study A study reported in 1995 by Veinott and Kanki1 was the first to analyze maintenance incidents reported to the Aviation Safety Reporting System. Eighty-three reports from 1986-1992 were coded with respect to type of error, contributing factors and operational impact. Among the most interesting findings were the following: •
60% of the errors were related to procedures
•
27% of the errors were related to practices
•
At least 50% of the cases implicated more than a single individual
•
39% results in an air return
It is interesting to note that in spite of the fact that the forms submitted were “pilot” forms (i.e., forms that were not specifically adapted for the maintenance technician), more than two thirds were from ground personnel as opposed to flightcrew.
ASRS maintenance error study II Since the ASRS maintenance form has been available since April 1997, a current research project is analyzing more recent submissions. We presume that a form tailored to the maintenance technician will yield more accurate and complete information. In addition to comparing results to the earlier study, this work focuses on procedural errors only and incorporates a much more detailed coding scheme. Specifically, procedural errors are broken down into 8 error subcategories as shown in Table 1. Incidents involving written documents are coded according to the aspect of the document in question, as well as 7 categories of contributing factors. In addition, incidents are coded for errors related to verbal information support. When verbal communications are involved, the aspect of the communication as well as contributing factors are also assessed. The codes have been developed to be consistent with categories incorporated in the Maintenance Error Decision Aid2 and performance shaping factors incorporated in the Framework Assessing Notorious Contributing Influences for Error.3
Developing Interventions Each research area has the potential for developing different types of interventions. Therefore the program relies on information from maintenance practitioners for specific guidance. Essentially, each project needs to identify the most critical problems and to develop the products which will be most useful. Collaborative help from operational partners are essential for determining an appropriate research focus.
Improved procedures As we are seeing in the ASRS incident reports, procedural errors may be tied to a variety of human factors. Documents themselves may lack sufficient detail, may be poorly organized, may be inconsistent with company practices, and other documents. In addition, technicians may simply not use or complete them for some reason. Some procedures may be technically correct but may be improved through the incorporation of human factors principles. In other words, procedures may be re-designed to enhance
team coordination, planning ahead and the management of time, people and resources. In recent work with Boeing, we evaluated a procedure re-design process by identifying the structural and functional changes made to an engine change procedure.4 Since the new procedure improved productivity by 14%, our goal was to identify the types of changes responsible for this enhancement. Certainly existing procedures differ in their potential for improvement, but there are general guidelines that may be followed for systematic evaluation. This project is in the stage of completion of the Guidelines intervention. We next will move into the operational validation phase by testing the guidelines against airline procedures. We may also consider the applicability of these guidelines to other types of procedures; for instance, in the KSC shuttle operations.
Table 3.1: Coding Process for ASRS Maintenance Error Study II Question 1: Does the incident involve procedural error? ⇒ NO - do not analyze ⇓
YES - Code for Error Type
1. Procedural Omission 2. Error of Intent 3. Selection Error 4. Awareness and Task Execution Error 5. Fault Identification/Diagnosis Inadequate 6. Inspection/Verification Incomplete 7. Values/Units/Scales/Indicators Related Error 8. Maintenance Repair Inadequate
Question 2: Is Written Support Information Involved? ⇒ NO - skip to question 3 ⇓
YES
Identify Document Type
Code for Aspect of the Document
(0-10)* 1. Correctness & Completeness (0-8) 2. Usability (0-6) 3. Supporting Data (0-7) 4. Verification & Inspection (0-3) 5. Warnings/Cautions/Notes (0-6)
Code for Contributing Factors
1. Airplane/Part Design (0-6)) 2. Tools/Equipment (0-5) 3. Personnel (0-3) 4. Environment (0-3) 5. Organizational (0-4) 6. Work Group (0-6)
⇓
7. Task Related (0-8)
Question 3: Is Verbal Support Information Involved? ⇒ NO - skip to End ⇓
YES
Identify Communication Type
Code for Aspect of Communication
(0-7) 1. Problem Solving & Decision Making (0-7) 2. Interpersonal Relationships (0-3) 3. Behavioral Patterns (0-2) 4. Attention to Task/Monitoring (0-2) 5. Communication as Mgmt Tool (0-4)
Code For Contributing Factors
1. Airplane/Part Design (0-6) 2. Tools/Equipment (0-5) 3. Personnel (0-3) 4. Environment (0-3) 5. Organizational (0-4) 6. Work Group (0-6)
⇓ End
7. Task Related (0-8)
* Numbers in parentheses indicate coding selections within category
Human factors task and risk analysis tools A three-year project recently completed by the Idaho National Engineering and Environmental Laboratories (INEEL) introduced human error analysis tools and concepts long used in the nuclear power industry to the aviation maintenance domain. Their research investigated the association between maintenance tasks and human error opportunities. In addition, it identified human factors (performance shaping factors) most likely to influence task performance. Although it may not be feasible to provide exact risk probabilities for specific tasks, the possibilities of unknown risk are narrowed as the relationship between human error and tasks is clarified. The goal of this research area is to develop task analysis tools that enhance our understanding of causal and contributory factors of maintenance human error. Such a tool can be adapted for many purposes. The original INEEL study focused on developing tools that aid in the design of maintenance procedures. However, this analysis tool could also help safety specialists and investigators better understand the causes of incidents and accidents and to identify interventions most needed. Human factors task analysis tools can also be adapted for training uses, such as targeting error-prone areas for special training emphasis.
Maintenance Resource Management skills, training and evaluation The third research area focuses on maintenance resource management (MRM) skills, training, and evaluation. Many airlines have successfully developed the concept of MRM as an intervention to a broad set of human factors problems, including communication, leadership, teamwork, interpersonal relations, problem solving, etc. The next step is to move from “awareness” training of concepts to practical skills training; from one-time stand-alone classes to a continuous recurrent program integrated with technical training. For example, it is essential that technicians become aware of how communication problems can lead to human error. However, such training cannot substitute for training performance-based communication skills such as verbal briefings and writing skills. As mentioned earlier, it is important to both researchers and practitioners that interventions be operationally validated. In order to develop the most effective MRM training materials and media, and to leverage both short and long-term impact of the training, evaluation metrics should be conscientiously collected and analyzed. For example, the work of Taylor and Robertson5 has made great progress in this area and they have given us a model of how MRM training can influence attitudes, behaviors and performance in the workplace. We have also learned the importance of linking training departments with engineering and safety departments who may be providers of useful, existing performance measures.
Advanced displays for maintenance aiding The fourth research area pertains to information displays. Because maintenance work often requires information to be read and used on-line during task performance, the development of display technologies which provide task-relevant information in a timely, convenient form is a promising maintenance error intervention. Information sources which create interruptions to the work flow are not only deterrents to efficiency, but foster opportunities for mistakes to be made.
Industry is developing a variety of technologies for displaying procedures, visual graphics, blueprints, OJT notes, and even virtual objects and many of these should be considered for application to the maintenance domain. For example, a head-mounted see-through display may provide direct access to 3-D aircraft wireharness assembly diagrams or a view of virtual assembly instructions. Another technology may provide video images of live “targets” with superimposed information such as fastener positions and “stay out” areas. In short, the technology is available. Yet we need to know how to make such technologies compatible and useful to technicians in the context of their everyday workplace. The implementation of new technologies, measurement strategies, and training are interrelated issues to be addressed.
ARC/KSC technology transfer workshops Together, NASA Ames and NASA KSC initiated a series of technology transfer workshops on specific human factors topics for the purpose of identifying issues, problems, and 'lessons-learned' in common interest areas across spacecraft processing and aircraft maintenance. Workshop I, held in September, 1996, focused on incident investigation and analysis. Researchers and practitioners from aircraft and shuttle operations participated in a hands-on type meeting, sharing information on the practical aspects of current approaches and solutions. In May, 1997, Workshop II focused on human factors training. Future plans for Workshop III indicates a focus on procedure improvements.
KENNEDY SPACE CENTER: HUMAN FACTORS PRACTITIONERS The human factors practitioners in Shuttle processing at Kennedy Space Center face many of the same challenges and issues related to human errors found in aviation maintenance operations. Incidents are analyzed using a diagnostic tool to identify the systemic causes of errors and to design multiple interventions. KSC targets four main areas of error intervention. Primary human factors interventions are aimed at identifying and correcting work conditions and work processes that induce errors. These “upstream” interventions address 1) Workplace and Task Design/Ergonomics, and 2) Organizational/Cultural Issues. Secondary human factor interventions address the last two error reduction targets: 3) the Individual, and 4) the Team. These “downstream” interventions focus on enhancing workers’ awareness of how individual/group behaviors affect safety, and how to develop personal “safety nets” to stop an error from occurring.
Human Factors Program at KSC: A Brief History NASA’s initial human factors collaboration between the Kennedy Space Center and Ames Research Center began in 1991 under a formal Human Factors Engineering Memorandum of Understanding. The first research project, between NASA KSC and NASA Ames also involved the Center for Creative Leadership and the United States Air Force Academy. Research data was collected on the effectiveness of KSC’s teaming and leadership behaviors, during the summers of 1993 and 1994. See Table 2 for a summary of key accomplishments. The following KSC observations resulted from that research:
•
Hierarchical Culture
•
Formed versus Intact Teams
•
Task Execution versus Self Managed Teams
•
Real Authority is “The Paper”
•
Task Team Leader is an “Assembler” of Co-Acting Individuals
•
Hesitancy to Give Feedback to Team Members
While the observations verified the KSC workers’ technical competence, the data identified a need to enhance the skills required for optimum teaming and leadership behaviors.
Table 3.2: KEY ACCOMPLISHMENTS: Kennedy Space CenterÆs Shuttle Ground Processing Human Factors Team
1991
Human Factors Engineering Memorandum signed between NASA’s Ames Research Center (ARC) and NASA’s Kennedy Space Center (KSC).
1992
Research conducted at KSC, in collaboration with NASA Ames, the Center for Creative Leadership and the United States Air Force. Data collected on the effectiveness of workers’ teaming and leadership behaviors.
to 1994
1993
Formation of the KSC Shuttle Ground Processing Human Factors Team, (July).
1994
Began a Close-Call Reporting System: The Positive Initiative Effort (PIE) Program, (July).
Initial collaboration with NASA Ames and the KSC Human Factors Team, on human error investigation techniques and data analysis methods.
1995
Developed initial diagnostic tool for investigating shuttle ground processing errors.
Developed and presented “Human Factors Awareness Training” to contractor ground operations management personnel. (8/95 - 9/97 = 1,261 personnel trained)
1996
Validated and refined the diagnostic tool and began applying this “model” consistently, when investigating shuttle ground processing human errors. Received recognition of a “best practice” by the Best Manufacturing Practices Center of Excellence. Developed a database, from the causal factors collected. Initial reports to Shuttle Processing management.
Published the inaugural “Time-Out” Newsletter, (July).
Developed “Task Team Roles & Responsibilities” course, for the hands-on workers, (1/96 - 6/96). Presented course to 2,800 workers, (7/96 - 6/97)
Initial “Technology Transfer” Human Factors Workshop, hosted by NASA Ames Research Center, focused on “Accident Investigation Data Analysis,” (September).
1997
Published the “User’s Manual” for the Human Factors Investigation Model. Refined data analysis and reporting techniques. Applied a modified version of the tool to close calls.
Second “Technology Transfer” Workshop hosted by NASA KSC, focused on “Human Factors Training” issues, (May).
Presented error analysis trend data to both NASA and Contractor Senior Management, (July). Addressed the need for a full time human factors team, instead of an Ad Hoc team. NASA and Contractor management attended a 2 day workshop on “Creating a Safety Culture,” which was conducted by an independent consultant, (last Qtr. 1997).
Concurrent with this research, NASA Headquarters (Washington, DC) directed KSC to “assess the human factor aspects of all incidents.” This direction was based on an independent (non-KSC) review of
shuttle ground processing errors. An analysis of 28 months of data (10/90 through 1/93) revealed that the primary causal category, for 72% of the incidents, was “human error.” As a result, the KSC Shuttle Processing Human Factors Team was chartered in July 1993. This team continues to be an ad hoc team comprised of both NASA and Space Flight Operations Contractor (SFOC) personnel. Team membership is cross functional and includes participation from front-line employees who represent safety, quality, shop, systems engineering, industrial engineering, and human factors. Their common goal is to improve ground processing safety in a rapidly changing workplace. The current industry-wide challenge to perform “better, faster, and cheaper” makes the successful attainment of this safety goal all the more imperative.
Error Data Collection Tool: The KSC Human Factors Investigation Model Since the KSC Human Factors team was chartered to investigate incidents, the members needed a diagnostic tool that would provide a consistent method of identifying the systemic causes of ground processing errors. Investigations typically stopped at the “tip of the iceberg” and did not delve into the deeper, underlying causes that resulted in well-intentioned workers making mistakes. As a result, work conditions and processes that induced these human errors continued to exist. The KSC Human Factors Investigation Model is based on the “Team Effectiveness and Leadership Model” designed by Dr. Robert Ginnett, of the Center for Creative Leadership. The research data from observations of KSC work teams also supported the development of the KSC Human Factors Investigation Model. Dr. Ginnett’s model was designed for use as a team formation guide and a diagnostic tool for evaluating team performance. The Human Factors Team expanded Dr. Ginnett’s original model so it could be used to assess a Shuttle ground processing task team’s performance from a safety perspective. The KSC Model provides a more in-depth analysis of causal factors beyond the readily visible operator error. The Model guides an investigator to look at the “big picture” and to analyze the often invisible processes of teaming and leadership dynamics, group norms, organizational practices, and the corresponding unspoken cultural beliefs and values. The KSC Model also is used as a proactive tool to prevent errors from occurring. Just as the “Dirty Dozen” enhance a worker’s awareness of potential error traps so they can be avoided, the KSC Model highlights the work process ingredients that are needed to ensure optimum, safe task performance. The collection of causal data is valuable only to the extent that it helps change the conditions in which people must work. Human Factors interventions are prioritized according to an analysis of the causal data. The most prevalent recurring causal conditions are targeted for countermeasures. The next two sections will describe KSC’s primary and secondary error interventions.
Primary Interventions Workplace & Task Design Ergonomics Although the team’s original charter was to “assess human factor related incidents,” members recognized the need to be proactive and prevent errors from occurring. As a result, the team took the initiative to
expand its charter and focused its first project on identifying and correcting error-prone conditions in the workplace. The team developed a close call reporting system called the “Positive Initiative Effort” (PIE) Program. The PIE Program provides an easy method for the hands-on workers to report unsafe conditions and/or work processes. A pilot effort was implemented in July 1994, at one of the three Orbiter Processing Facilities (OPF) high bays. The program’s success at this initial site encouraged management to expand the close call reporting initiative. By January of 1996, all major Shuttle ground processing facilities implemented the PIE Program. The primary benefit of this close call reporting system has been the reduction of “tech traps.” The PIE program emphasizes the importance of being aware of human/workplace mismatches and taking the initiative to report these situations. In several cases, the technicians have recommended simple, inexpensive hardware modifications that have eliminated or significantly reduced the impact of the original problem.
Organizational/Cultural Issues As Walt Whitman once said, “We convince by our presence.” The heritage at the Kennedy Space Center is exemplified in a “Can Do!” attitude. While this cultural belief has resulted in many amazing accomplishments, it also has been a causal factor in some incidents. The challenge is in knowing where to draw the line between, “I can do it safely” and “I can do it, but I’ll have to take a risk.” This line, however, isn’t fixed and its position often shifts depending on the status of the processing schedule. Historically, NASA’s culture has rewarded “problem solvers” which has reinforced a reactionary mind set. The Human Factors Team recognized the need to unveil these cultural beliefs and openly discuss the invisible value structure of the KSC culture. The unspoken beliefs, values and practices, which had been carried over from the Apollo era, were not always appropriate or effective in the rapidly changing environment of the Shuttle program.
Technical controls An example of how past practices have not kept pace with the current workplace conditions is found in the KSC work procedures. The causal trend data reveals “inadequate paper” as the top contributing cause. While improving the quality of the paper certainly is important, team members realized a more systemic problem was beneath the more obvious symptom of inadequate paper. In most instances of less than adequate technical controls, the workers were unsure of what to do, so they “relied on the paper.” Our human factors data indicates that KSC’s cultural “rule based” approach to tasks (i.e., “Follow the Paper”), in lieu of relying on specific task experience and system knowledge, is a definite link in the error chain. As our workforce resources diminish due to reduced budgets, our “critical skills” are being stretched thin. Along with improving the paper, management interventions need to address core work processes such as Integrated Resource Planning and Scheduling, as well as Training. Organizational structures must design out opportunities for errors, by ensuring the right workers are assigned to the right tasks, with the right tools. Procedures support - not substitute - the technicians’ hardware knowledge.
KSC also recognizes the need to enhance the work instruction system. Through technology transfer and informal benchmarking with aircraft maintenance centers, the KSC Human Factors Team is striving to incorporate aviation maintenance “lessons learned” into Shuttle ground processing procedures.
Cultural change: Doing (goals) versus Being (values) The current challenge at KSC involves a re-balancing of priorities. We have excelled at achieving “mission milestones” by focusing on near-term technical tasks. To maintain this level of excellence, however, in the new era of “faster, better, cheaper,” KSC will also focus on non-technical long term values. A worker infers what management values by how they act. The only way to communicate a value, therefore, is to act in accordance with it. KSC realized the need for management to demonstrate that safety is first and schedule is second. Based on this need, all of Shuttle ground operations contractor management participated in an intensive two-day safety workshop taught by an outside consultant. In an effort to “walk the talk,” all levels of management have been tasked to “walk a mile in their workers’ shoes.” Through regular, periodic visits to the shuttle ground processing facilities, management will gain an understanding of the process-induced workload factors that create opportunities for errors. Some of the workplace conditions that management will focus on correcting include the following: •
lack of task specific experience/technical proficiency
•
scheduling conflicts due to a less than adequate (LTA) integrated workload management system
•
lack of appropriate material resources
•
organizational barriers that impede communications and reduce situational awareness
•
culture that often responds negatively to a “Time-Out” concern, thereby reinforcing the belief that schedule is more important than safety
•
procedures that do not reflect the actual work situation/ergonomic mismatches
•
role accumulation due to downsized workforce
Secondary Interventions Education & Training As Albert Einstein observed, “Problems cannot be solved at the same level of consciousness that created them.” KSC needed to dispel myths about human errors, as well as provide proven methods for enhancing workers’ safety. These new methods had to go beyond the traditional management refrain, which told workers to “Be more careful.”
Human Factors awareness course Realizing that awareness is the first step towards change, the team developed a “Human Factors Awareness” course. This class was presented to 1,261 management personnel during a two (2) year period (8/95 - 9/97).
This four hour course was designed to give a basic orientation to human factors and ergonomic principles, as well as explain how these factors influence human performance. The ultimate intent was to help change management’s traditional “blame and train” approach to errors, by presenting the KSC Human Factors Team’s philosophy on errors: •
Errors are not intentional.
•
Errors result from a series of interrelated contributing causes.
•
Most contributing causes are part of organizational processes and can be managed.
•
Errors often occur due to a mismatch between the work design and the workers’ cognitive and physical capabilities.
Management also was encouraged to actively support their employees’ participation in the close call reporting PIE program, as well as provide positive feedback to workers who asked for a “Time-Out” due to a concern. Additionally, management was reminded of the old adages: “If you’re not part of the solution, then you’re part of the problem;” and “Change begins with me.” The extent to which management personnel gained an awareness of how their own beliefs and behaviors have contributed to the current culture, will determine the extent to which they begin to change, thereby helping to influence a culture shift.
Task team roles & responsibilities Since no workplace is designed perfectly, the team’s secondary training focus was on alerting the workers to conditions that create opportunities for errors. The best detectives know what clues to look for, before they even begin trying to solve a mystery. Likewise, since workers often are the “last line of defense,” we wanted to enhance their awareness of certain workplace clues, (i.e., “Links in the Error Chain”), so they could call a “Time-Out” before an error happens. Teaming and Leadership skills were emphasized as “safety nets” to help prevent errors from occurring. The sharing of “Crew Resource Management” (CRM) and “Maintenance Resource Management” (MRM) information, by the various aviation communities greatly enhanced the development of this four hour class. The design of the course content was a collaborative effort between the Human Factors Team and the hands-on workers. The teaching approach used was “Train the Trainer.” Thirty-nine workers were trained initially and they, in turn, presented the class to their peers. Since part of the course involved challenging current perceptions of certain organizations, we wanted to ensure that the trainers represented a cross-section of the workers. For this reason, a team of three trainers presented the class. Each of the three trainers represented a different ground processing organization: Safety, Quality, Shop, Engineering, Facilities, or Scheduling. Furthermore, classes were organized so the trainers were presenting to the people they interfaced with on a daily basis. The workers who had been selected to be the trainers were regarded, by their peers, as being positive role models. KSC wanted to maximize the trainers’ opportunity to be a “catalyst for change” by facilitating an open dialogue with their own co-workers on the importance of positive teaming and leadership behaviors. The Task Team Roles & Responsibility class was presented to 2,800 shuttle ground processing personnel within a one year period (7/96 - 6/97). Team members understood that initial learning often is passive and that these skills wouldn’t be acted upon with a one time “inoculation.” A Phase Two “Teaming and Leadership” course is being developed based on workers’ feedback from the initial class. They requested additional training on interpersonal skills: Decision Making, Conflict Resolution, Assertiveness in Calling a “Time-Out”, and Effective
Communications Across Organizations. Generally, comments from the class participants were positive. Traditionally, KSC training focused on improving the workers’ technical skills. This was the first course aimed at enhancing the workers’ interpersonal, “soft” skills. The participants’ comments also included a consensus of the need for management to “walk the talk.” Workers wanted management expectations to be explicit - not through words - but through actions.
Just in Time training The third component of KSC’s educational intervention is providing workers with computer based and video refresher training. These “Just in Time” reminders are provided to the workers prior to the start of an infrequent or hazardous task. These computer aided training programs and videos were designed with input from both the technicians and the engineers. The intent of the “Just in Time” training is to heighten the worker’s awareness of the job’s hazards, necessary protective equipment, and “lessons learned” from past operations.
Time-Out newsletter Concurrent with the beginning of the “Task Team Roles & Responsibilities” course, the Human Factors Team published the first “Time-Out!” newsletter in July 1996. The newsletter reinforced the training that the workers were receiving in the class, by encouraging them to be alert for error-likely situations. The newsletter also gave positive recognition to “Human Factor Heroes,” who called a time-out when they noticed a link in the error chain. Subsequent newsletters have been distributed on a quarterly basis.
SUMMARY Since most human errors result from interrelated causes, KSC believes that the most effective approach to controlling errors is through multiple, interrelated interventions. As with all organizational change initiatives, the linchpin of change rests with an acceptance of responsibility for how one’s own beliefs and behaviors have contributed to the current condition. The successes of KSC’s human factors program are a reflection of management’s increased understanding - and acceptance - of how errors really occur. Like most industries and government agencies, KSC has many future obstacles to overcome in the era of Shuttle ground processing contractor mergers and downsizing due to reduced budgets. As the KSC workforce is challenged to “do more with less” and accomplish tasks “better, faster and cheaper,” the Human Factors Team’s goal remains the same: to improve safety, through focused interventions aimed at the work environment, the task, the team, and the individuals.
REFERENCES 1. Veinott, E. S., &. Kanki, B. G. (1995). Identifying Human Factors Issues in Aircraft Maintenance Operations. Poster presented at the 39th Annual Meeting of the Human Factors
and Ergonomics Society, October 9-13, San Diego, CA. 2. Boeing. (1994). Maintenance Error Decision Aid. Seattle, WA: Boeing Commercial Airplane Group. 3. Ostrom, L., Nelson, W., Haney, L., Richards, R., Wilhelmsen, C., & Owen, R. (1997) Structured Human Error Analysis for Airplane Maintenance and Design, INEEL/EXT-97-01093. 4. Repp, T. (1995). Improving 737 CFM56 engine change times. In Airliner (Oct-Dec 1995), Seattle: Boeing Commercial Airplane Group. 5. Taylor, J. C., & Robertson, M. M. (1995). The effects of crew resource management (CRM) training in airline maintenance: Results following three years' experience. (NASA CR 196696). Moffett Field, CA: NASA Ames Research Center.
4.0 DISCIPLINE AND THE “BLAME-FREE” CULTURE David Marx Safety Consultant
OUR INDUSTRY FROM A MEDICAL PERSPECTIVE? On October 12 of last year, Dr. Lucian Leape, a professor at the Harvard School of Public Health, briefed a US Congressional subcommittee on the state of human error management in the US medical industry.1 Dr. Leape began his presentation by telling the subcommittee how prevalent human error is in the medical industry: one million people injured by errors in treatment at hospitals each year in the US, with 120,000 people dying from those injuries. It is a number 3 times greater than those who die in automobile accidents, he said, and 1000 times greater than those who die in commercial aircraft accidents. It is a problem with an annual $33 billion dollar price tag. After undoubtedly gaining the attention of the congressional subcommittee, Dr. Leape then shared his observations of the human error management culture within the US medical industry. Dr. Leape stated that only 2 to 3 % of major errors are reported through hospital incident reporting systems. As a result, he said, most hospitals are unaware of the extent of their errors and injuries. Because of the punitive work environment, he stated, health care workers would report only what they could not conceal. Hospital personnel, as well as most of the public, tended to regard errors as evidence of personal carelessness, the failure of an individual employee to meet an exacting standard of perfect performance. Dr. Leape told Congress that health care organizations must make error prevention a major strategic objective, that hospitals should eliminate punitive error reporting systems so that reporting can be made “safe.” Systems should be established to track error and the effectiveness of corrective measures. Regulators should become a force for error reduction rather than a force for error concealment. Public and media perceptions should be changed from the idea that errors are best controlled by blame and punishment to an understanding of the central roles of systems redesign and corporate responsibility. Ultimately, what did Dr. Leape say was the single greatest impediment to error prevention: that we punish people for making mistakes. So why do I tell you this? It is because of what Dr. Leape said next. Dr. Leape testified that “high reliability industries, such as aviation, air traffic control, and nuclear power, learned long ago the fallacy in this perfectibility approach.” Dr. Leape’s comments raise a few questions for us in the aviation industry. Are Dr. Leape’s impressions of our industry correct? That is, do we endorse the tools of blame, train, and discipline or have we adopted a new human-centered approach that encourages the reporting of errors?
A MORE HUMAN-CENTERED CULTURE? To check Dr. Leape’s assertion, consider the US Federal Aviation Administration’s current perspective toward maintenance error. The current standard of care for technicians working on US registered aircraft is as follows: § 43.13 Performance rules (general). (a) Each person performing maintenance, alteration, or preventive maintenance on an aircraft, engine, propeller, or appliance shall use the methods, techniques, and practices prescribed in the current manufacturer's maintenance manual or Instructions for Continued Airworthiness prepared by its manufacturer, or other methods, techniques, and practices acceptable to the Administrator… (b) Each person maintaining or altering, or performing preventive maintenance, shall do that work in such a manner and use materials of such a quality, that the condition of the aircraft, airframe, aircraft engine, propeller, or appliance worked on will be at least equal to its original or properly altered condition (with regard to aerodynamic function, structural strength, resistance to vibration and deterioration, and other qualities affecting airworthiness).2 By these rules, one can easily argue that dispatch of an aircraft with a discrepancy caused by maintenance error is in fact a violation of the FARs. This rule quite literally requires perfection. The problem is that roughly 48,800 air carrier and repair station technicians make mistakes that put them in violation of FAR 43.13 each year. This equates to roughly 100,000 aircraft dispatched each year into revenue service in an out-of-conformity (technically unairworthy) configuration. In the time that we all spend here at this conference, over 600 aircraft will be dispatched with technician errors on board. And like Dr. Leape’s estimates, these are also conservative numbers. So how do we view these errors? Is it a “blame-free” culture or is it something else? Based on the following FAA Enforcement and Compliance Handbook statement, each and every one of these errors, if known by the FAA, should result in a FAA investigation: “Every apparent or alleged violation must be investigated [by an FAA inspector] and appropriately addressed. … The agency has a wide range of options available for addressing violations … from simple counseling and administrative action to formal legal enforcement.”3 It should be clear by reading the FARs and the FAA Enforcement Manual that the basic duties of an airman do not anticipate or account for the inevitable human error. That is, each FAR 43.13 violation is viewed as a culpable and blameworthy event raising at a minimum the need for counseling by the regulatory authority. Perhaps our human-centered approach that Dr. Leape refers to in the aviation industry is not embodied in the basic FARs, but rather in the modern partnership programs and “enforcement-related incentives” of today. The Aviation Safety Action Program, authorized in January 1997, represents the latest advance in air carrier/FAA partnership. Through a partnership among the carrier, labor unions, and the FAA, the
three groups can co-manage the contributors to safety-related mishaps. In its efforts to facilitate reporting, ASAP has established its own immunity provisions, coined “enforcement-related incentives.” The pertinent provisions of its enforcement-related incentives follow: “Administrative action may be taken in lieu of legal enforcement when all of the following elements are present:
1) Applicable law does not require legal enforcement action. 2) Lack of qualification or competency was not involved. 3) The violation was inadvertent and not deliberate. 4) The violation was not the result of a substantial disregard for safety or security and the circumstances of the violation are not aggravated.
5) The alleged violator has a constructive attitude toward complying with the regulations.
6) The alleged violator has not been involved previously in similar violations. 7) After consideration of items (1-6), a determination is made that administrative action will serve as an adequate deterrent. Substantial disregard means:
a) In the case of a certificate holder, the act or failure to act was a substantial deviation from the degree of care, judgment, and responsibility normally expected of a person holding a certificate with that type, quality, and level of experience, knowledge, and proficiency.
b) In case the violator is not a certificate holder, the act or failure to act was a substantial deviation for the degree of care and diligence expected of a reasonable person in those circumstances.”4 While it is an improvement over the basic FARs, one must question what goals this program was developed to address. If the error is already known to the organization - for example, as I stand near a jack stand that has pierced the skin because I improperly jacked the aircraft - then the “enforcement-related incentive” will ensure that I get better treatment than spelled out through the basic FARs. Yet, as Dr. Leape described in his testimony to Congress, a typical hospital might see only 2 or 3 percent of its errors due to effective concealment by health care professionals. If active reporting of errors is a goal, I ask you to evaluate whether you would come forward under the provisions of this program? Does the enforcement-related incentive give you enough confidence to report your own violation of the FARs?
SO WHERE DO WE GO FROM HERE?
I think it is safe to say that we have not come as far as Dr. Leape might think. Currently, we seem more similar to, than different from, his description of the medical industry. And what we have both been unable to determine, is just where we should draw the disciplinary line and just how we should communicate that line to our employee workforce. Consider the following options: Do we establish the truly “blame-free” system and tell our employees that, unless you intended the damage, no disciplinary action will be taken against you if you report your error and participate in its investigation? Do we continue with punitive systems that essentially outlaw human error, resign ourselves to the fact that employees will never self-report, and restrict our learning to only those errors that cannot be hidden? Do we create confidential reporting systems to collect error data, leaving the technician to fend for himself under current punitive disciplinary policies? Do we draw a line in the sand, educate our workforce to know where the line is drawn, and ask for reporting by those who have not crossed the line?
The Research Data Over the last 18 months, I have been conducting research into where aviation professionals would ideally draw the disciplinary line. That is, what disciplinary approach is in the best interests of safety. Over 100 professionals, primarily within the US, responded to the survey. Their disciplinary approach is as follows:5
Table 4.1 The ôIdealö Disciplinary Criteria As Seen by Aviation Professionals Employees who intend the mishap to occur, are under the influence of drugs or alcohol, or are reckless will be subject to disciplinary action. The severity of the outcome will impact the decision to take disciplinary action, with an accident mandating disciplinary action. Lying about your involvement in a mishap or refusing to supply urine or blood specimens will result in disciplinary action. Attempting to hide the mishap or refusing to participate will weigh strongly in the disciplinary decision. Intentional violations of either the Federal Aviation Regulations or internal company policies will mandate disciplinary action. A history of insubordination, a habitual attitude of job dissatisfaction, sloppy work habits, and horseplay will weight toward disciplinary action. Supervisory pressure to partake in risky behavior will strongly mitigate any decision to discipline.
These are the opinions of your peers. But what does the data really mean? The most important conclusion about where the line must be drawn is the line between negligence and recklessness. Table 4.2 Comparison of Culpability Levels and Their Relationship to System Objectives Culpability
Human factors learning more important than discipline
Discipline more important than human factors learning
No culpability
372 (99%)
30 (9%)
Negligence
462 (66%)
240 (34%)
Recklessness
181 (37%)
311 (63%)
What is the difference between negligence and recklessness? Consider the official response to the US Air Force’s recent accident in northern Italy, where a fighter pilot clipped a ski gondola cable and killed 20 people. An Air Force spokesperson, Major Joe LaMarca, said in response to the accident that “there is a fine line between being aggressive and being reckless.”6 I do not agree with Major LaMarca’s view. As described by an NTSB Administrative Law Judge, negligence is equivalent to ordinary human error.7 Recklessness, on the other hand, is intentional risk taking. It is conscious disregard of a substantial and
unjustifiable risk that the mishap will occur. Consider the following example. On the overnight a technician is assigned to do a detailed inspection for cracks around rivet heads on a portion of the external side of a 737 fuselage. It is night and the aircraft is parked on the tarmac. In accordance with his airline’s policy, he diligently brings out a work stand to get close to the structure and brings out large lamps to provide adequate lighting. Now consider that even though the technician followed all applicable procedures, he has still made an error by missing a crack that ultimately led to an in-flight depressurization. Should the technician be punished for merely making the error? Should he be punished for making an error that led to an in-flight depressurization? Yet, would our attitude change if we knew that the technician stood on the ground to do this same inspection with his flashlight pointed up at rivets that were six feet away? This technician made the same error, missing the crack, as the technician who diligently followed the procedure and used an adequate work stand and the proper lighting. In neither scenario did the technician intend to miss the cracked structure. Yet, while theoretically not guaranteed of failure, the flashlight-equipped technician standing on the ground significantly, unjustifiably, and consciously increased the risk that the error would occur.
ACCOUNTABILITY AND PROFESSIONALISM The question really boils down to what do we want in our human centered culture? If we are to embrace human factors principles, how does it translate into the post mishap setting? Is human factors merely a tool for better aircraft design or can its philosophies be applied to make post-mishap response more human centered? The disciplinary research showed that a line must be drawn where one leaves mere human error behind and enters more culpable and blameworthy behavior. Not all actions should be blame free. Some human errors involve culpable, blameworthy conduct that, in the interests of safety, do warrant disciplinary action. It is a notion that I believe most in our industry support. To many today, accountability and professionalism mean that an employee should never make a mistake. This, I believe is the wrong objective. Professional airmen should work to their maximum reliability, with some errors expected. Additionally, when errors do occur, they should report those errors so that we may learn of their contributors, and drawing upon that knowledge, prevent future accidents. This is not a “blame-free” system. It is a system of accountability and professionalism that recognizes human error as a natural and expected element of human behavior.
REFERENCES 1. Testimony, United States Congress, House Committee on Veterans’ Affairs, Dr. Lucian L. Leape, MD, October 12, 1997. 2. 14 CFR 43.13. 3. FAA Order 2150.3A, Compliance and Enforcement Handbook, December 14, 1988, page 13.
4. Engen V. Chambers and Lansford, 1986 WL 82575 (N.T.S.B.). 5. Aviation Safety Action Program (AC120-66), Federal Aviation Administration, January 8, 1997. 6. Marx, David. The Link Between Employee Mishap Culpability and Commercial Aviation Safety, Seattle University School of Law, January 30, 1998. 7. Military pilots fly razor line, USA Today, February 6, 1998, p. 3A.
5.0 HUMAN FACTORS IN MAINTENANCE: CORPORATE AND INDIVIDUAL LIABILITY FOR HUMAN ERROR By Rupert Britton Secretary & Legal Adviser United Kingdom Civil Aviation Authority
(The views expressed in this paper are those of the author and are not to be taken as necessarily being those of the Civil Aviation Authority)
INTRODUCTION I see from the leading article in last week’s Flight magazine that HF experts put human failures into four different categories: incapacitation, “active errors”, “passive errors” and “proficiency failures”. This analysis is quite helpful in deciding what the liability consequences might be. Liability in this context can arise in three different ways:First, there is criminal liability. Have the operator, maintenance organization or aircraft maintenance engineer broken the criminal law with the result that they are liable to prosecution in the criminal courts with the risk of being convicted and punished by fine or even imprisonment. Secondly, there is what might be described as “regulatory liability”. Have the operator, maintenance organization or aircraft maintenance engineer conducted themselves in such a manner that licensing action is considered necessary by the regulatory authority in relation to the certificates, approvals and licenses that they hold. Thirdly, there is civil liability. Has the accident or incident resulted in a third party being injured or his property being damaged so that he has a claim for compensation against the party causing the injury. This paper seeks to look at some of the issues that arise under these three headings.
I Criminal The safety regulatory system in the United Kingdom still derives principally from the Air Navigation Order which gives effect to the Chicago Convention and its Annexes and generally regulates civil aviation. Parliament has provided that this safety regulatory Order is enforceable by the criminal law of this country.
Article 111 of the current Air Navigation (No 2) Order 1995 provides that if any provision of the Order, the Regulations made under it such as the Rules of the Air or of JAR-145 is contravened in relation to an aircraft, the operator of that aircraft and the commander thereof shall be deemed to have contravened the provision. This is a deemed responsibility and though it is without prejudice to the liability of any other person, maintenance engineers and maintenance organizations are not specifically mentioned. There can therefore be a joint criminal liability on the part of the individual employee and his corporate employer. However Article 111 provides two statutory defenses. First, a person is not liable if he can prove that the contravention occurred without his consent or connivance and that he exercised all due diligence to prevent the contravention. Secondly, there is a more general defense if the contravention was due to any cause not avoidable by the exercise of reasonable care. Thus an operator could avoid a criminal liability by proving that he knew nothing of the actions of the commander of the aircraft or the engineer who maintained the aircraft and that he had good safety management and quality assurance practices in place to prevent and prohibit such an incident occurring. The criminal responsibility for a maintenance failure can be squarely passed to the individual engineer at the sharp end and the corporate employer has a good defense. This is the position where there is the close legal link of an employer/employee relationship within the one company. It would probably be even more difficult to impose criminal responsibility on the operator where all his maintenance is contracted out. In an investigation into an accident or incident he may well be able to point out that he has imposed all manner of contractual obligations on the maintenance organization in relation to quality assurance which would give the operator a good defense in any prosecution. However if there is a failure by the maintenance organization the operator’s aircraft could nevertheless be flying without a valid certificate of airworthiness which the traveling public would probably find unacceptable. The way the offense and defense provisions in the Air Navigation Order are currently framed is not necessarily producing fair or sensible results and we are looking at ways of amending it. Who decides whether criminal liability arises? Breaches of aviation law are in the main investigated and prosecuted by the CAA in England and Wales and also Northern Ireland. The CAA has undertaken this work on behalf of the Crown since it was set up in 1972. Unlike the rest of the CAA’s activities which are paid for by charges levied on the industry, the cost of this activity has always been paid for out of general taxation. In Scotland with its different legal system, while the CAA can investigate cases the decision to prosecute and the conduct of the prosecution is a matter for the Procurator Fiscal Service which is a department of the Crown. However the CAA is not an exclusive prosecutor. The police can of course investigate these offenses for submission to the Crown Prosecution Service and on occasion members of the public have instituted their own private prosecutions. The decision on whether or not to prosecute in a particular case is by far the most important one that has to be taken by a prosecuting authority. The fundamental duty of a prosecutor is to make sure that the right person is prosecuted for the right offense and that all relevant facts are given to the court. For this purpose the CAA adheres to the requirements of the Code for Crown Prosecutors. The Code establishes two stages in the decision to prosecute. The first stage is the evidential test. The prosecutor must be satisfied that there is enough evidence to provide a “realistic prospect of conviction” against each defendant on each charge. A realistic prospect of conviction is an objective test. It means that a jury or bench of magistrates, properly directed in accordance with the law, is more likely than not to convict the defendant of the charge alleged. If the case does not pass the evidential test, it must not go ahead, no matter how important or serious the case may be. If it does, the second stage is for the
prosecutor to decide if a prosecution is needed in the public interest. The classic statement on public interest was made by Lord Shawcross who was Attorney General in 1951 which has been supported by Attorney Generals of both parties ever since: “It has never been the rule in this country - I hope it never will be - that suspected criminal offenses must automatically be the subject of prosecution”. The Code sets out a number of common public interest factors both for and against prosecution. One factor which favors prosecution and which is particularly relevant to aviation cases is where the defendant is in a position of authority or trust. The CAA investigates some 200 cases a year of which on average around three dozen cases are prosecuted. A similar number are dealt with by way of formal caution or warning letter. Of the cases that are prosecuted around half involve pilots mainly for low flying offenses and breach of the Rules of the Air. The other half consists of a mixed bag of offenses for illegal public transport, breach of the Air Travel Organizer’s Licensing Regulations, carriage of dangerous goods, offenses relating to forged documents, falsification of maintenance records and, rather more than in the past, passengers for drunken or unruly behaviour and now refusal to comply with no smoking rules. It is important to stress that the CAA carries out its enforcement activities entirely independently of the Air Accidents Investigation Branch. It is of course the fundamental purpose of investigating accidents as set out in the Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 1996 which implements Council Directive (EC) 94/56 dealing with accident investigation, to determine the circumstances and causes of the accident with a view to the preservation of life and the avoidance of accidents in the future; it is not the purpose to apportion blame or liability. Similarly the CAA has given an assurance since the introduction of the Mandatory Occurrence Reporting Scheme in 1976 that it will not be its policy to institute proceedings in respect of unpremeditated or inadvertent breaches of the law which come to its attention only because they have been reported under the Scheme, except in cases involving dereliction of duty amounting to gross negligence. This assurance has been criticized as in effect giving an amnesty to those who break the law. However it must be of much more importance to the industry to encourage the free reporting of incidents which can be collated, analyzed and disseminated to prevent them happening again. In fact, the reports that we act on come from a variety of other sources including CAA inspectors, the police, HM Customs & Excise and members of the public. However what we will not accept is someone putting in a report under the Scheme when he knows an investigation has been started simply as a means of staving off a prosecution. In addition to the regulatory type offenses contained in the Air Navigation Order, there are two general offenses which are likely to be relevant in the event of an aircraft accident or incident. First, under Article 55 it is an offense for a person to recklessly or negligently act in a manner likely to endanger and aircraft or any person therein. Secondly, under Article 56 a person shall not recklessly or negligently cause or permit an aircraft to endanger any person or property. Most prosecutions for endangering have been brought against individuals acting solely in the capacity of pilot of the aircraft or as the “one man” operator of the aircraft. However in an appropriate case, if it is considered that the operator’s maintenance systems have failed due to negligence, we will prosecute a commercial operator. The penalties available on conviction of an endangering offense are a £5000 fine if the case is dealt with by the Magistrates Court or an unlimited fine or imprisonment for a term not exceeding two years if the case is dealt with by the Crown Court. Serious cases will be taken to the Crown Court and fines imposed on operators have been high.
That then is the current position. However the spate of serious public transport accidents in the late 1980s in particular caused demands for the use of the law of manslaughter following public disasters. The Law Commission has recently produced a report on involuntary manslaughter and devoted particular attention to corporate liability for manslaughter. The Commission recognized that there is a widespread feeling among the public that in appropriate cases it would be wrong if the criminal law placed all the blame for an accident on an employee such as the pilot of an aircraft but did not fix responsibility on their employers who are operating and profiting from the service and who may be at least as culpable. An appalling statistic shows that some 20,000 people have been killed in this country since 1965 in commercially related deaths, principally in factory and building site accidents, but only one company has ever been convicted of corporate manslaughter. This was OLL Limited which you may recall was convicted of four counts of manslaughter after four children died in the Lyme Regis canoe disaster. There was no prosecution of London Underground following Kings Cross, British Rail following Clapham and the platform operator in the Piper Alpha disaster despite serious criticism of these organizations by the Inspectors at the subsequent Public Inquiries. There was a prosecution by the Director of Public Prosecutions of P&O European Ferries and seven individuals following the Herald of Free Enterprise disaster but the trial collapsed after the Judge had to direct the jury to acquit the company and the five most senior individual defendants. The outcome of this case provoked much criticism and the Law Commission took an interest. The Commission in their report have recommended that there should be a special offense of corporate killing broadly corresponding to the individual offense of killing by gross carelessness. Like the individual offense the corporate offense should be committed only where the defendant’s conduct in causing the death falls far below what could reasonably be expected. Unlike the individual offense the corporate offense should not require that the risk be obvious or that the defendant be capable of appreciating the risk. A death should be regarded as having been caused by the conduct of a corporation if it is caused by a failure in the way in which the corporation’s activities are managed or organized to ensure the health and safety of persons employed in or affected by those activities. In particular it should be possible for a management failure on the part of a corporation to be a cause of a person’s death even if the immediate cause is the act or omission of an individual. This point would be crucial following an aircraft accident. The operator would not be able to escape criminal liability because a maintenance engineer made a mistake. The Law Commission have produced a draft of a Bill and the new Government has indicated that it will make available Parliamentary time for the Bill, possibly in the next Session of Parliament. Some might argue that the criminal law is a rather crude intruder into the increasingly sophisticated world of safety regulation where there is now a much greater understanding of why and how humans make mistakes and standards and practices are constantly being developed to prevent mistakes from occurring. The trial Judge in a recent CAA prosecution involving maintenance error by an airline set out the justification for criminal sanctions as follows: “Obviously the public must have confidence that companies that run airlines are taking all proper and necessary steps to ensure the safety of their passengers. Furthermore the public must have confidence that if criminal lapses are detected then the Courts will pass such sentences that not only punish the company for the offense committed but which also act as a spur on that individual company to maintain the greatest possible efforts to ensure the safety of their aircraft and act as a deterrent for the aircraft companies in general in this country and one hopes elsewhere to ensure that they are not tempted to cut corners or to skip in the procedures that they have in place to ensure the safety of aircraft. The company must be punished to ensure that it continues to exert utmost efforts to maintain high standards and
deterrence for the air transport world as a whole to make it quite clear that any cutting of corners is simply not worth the candle.”
II Regulatory The risk of criminal liability arising from an accident or incident for both an individual and an operator is perhaps in practice remote even if it is the most serious liability. Much more likely is regulatory action from the safety regulator. An aircraft maintenance engineer is granted a license by the CAA if the Authority is satisfied that the applicant is a fit person to hold the license and is qualified by reason of his knowledge, experience, competence and skill in aeronautical engineering - Article 13(1) Air Navigation (No 2) Order 1995. An aircraft flying for the purpose of commercial air transport must have a certificate of release to service issued by an organization approved under Joint Aviation Regulation-145. JAR-145 is legally binding throughout the European Community by virtue of being annexed to EC Regulation 3922/91. Before granting a JAR-145 approval, CAA must be satisfied that an applicant meets all the requirements of JAR-145. An operator is granted an Air Operator’s Certificate by the CAA if it is satisfied that the applicant is competent having regard in particular to his previous conduct and experience, his equipment, organization, staffing, maintenance and other arrangements to secure the safe operation of aircraft of the types specified in the Certificate on flights of the description and for the purposes so specified - Article 6 Air Navigation (No 2) Order 1995. If following an accident or an incident doubt is cast on any of these factors, the CAA may consider it necessary to take licensing action not as a punishment but for public safety reasons. This can take the form of revoking, suspending or varying the license, certificate or approval. The CAA’s power to take such action is set out in Article 71(1) of the Air Navigation (No 2) Order 1995. This provision sets out a two stage process. First, the CAA may, if it thinks fit, provisionally suspend a license pending inquiry into or consideration of the case. Secondly, the CAA may, on sufficient grounds being shown to its satisfaction after due inquiry, revoke, suspend or vary any certificate, license or approval. These are fairly draconian powers directly affecting an individual’s ability to earn a living and a company’s ability to trade and the CAA accordingly has to exercise them in accordance with the rules of natural justice. This means that the person or company against whom substantive licensing action is taken has a right to make representations to put forward his side of the case and the right to a fair and unbiased hearing by the person taking the decision. However in the case of provisional suspension action often has to be taken fairly swiftly as a preventative measure while inquiries are carried out. There can be a conflict here between the need on the part of the regulatory authority to take immediate steps to protect public safety and the rights of the individual license holder to have a reasonable opportunity of presenting his case. This problem has been considered by the High Court in a 1989 case involving Romanian pilots who had difficulty meeting the CAA’s licensing requirements which led to the provisional suspension of the airline’s operating permit by the Secretary of State on advice from CAA. The Judge held that when dealing with cases of provisional suspension one is at the lower end of the
duties of fairness to the individual. The position is very different with the second stage of the procedure. Here, the rules of natural justice are in effect enshrined in the statutory procedures prescribed by Regulation 6 of the Civil Aviation Authority Regulations 1991. If for example the Head of Engineer Licensing, who is an employee of the CAA, proposes to revoke, suspend or vary an engineer’s license, the engineer has the right to request that the decision on the proposal be taken by the Members of the Authority who are appointed by the Secretary of State. That decision can only be taken after the engineer has had an opportunity to make written representations on his case and appear at a hearing if he so wishes. The CAA generally holds up to nine such hearings under Regulation 6 a year. While some of the hearings relate to revocation of pilot’s licenses and aircraft maintenance engineers’ licenses where for example engineers have been grossly incompetent or there has been forgery of certifications or license documents, most cases recently have involved the revocation of AOCs. However the sanction of revoking an AOC is very much a weapon of last resort to be used when all attempts at corrective action through the Flight Operations Inspectorate have been exhausted since revocation is usually fatal to the operator’s business. What if the regulator fails to act? This was an issue before the Canadian courts in 1990 (Swanson and Others v R). The case involved a fatal accident to an aircraft owned by Wapiti Aviation Limited. The court held that Transport Canada had failed to inspect and enforce safety regulations and that this failure contributed to the development of a lax safety environment at Wapiti which in turn caused loss to the Plaintiffs. The court apportioned liability equally between the pilot, the operator and Transport Canada. Transport Canada appealed on the grounds that the Crown did not owe a duty of care. Under the Canadian Crown Negligence Act the Crown was not liable for “policy” decisions but could be liable for “operational” decisions. The Canadian Appeal Court held that Transport Canada’s response to the complaints and reports about the lack of safety at Wapiti was an “operational” decision and therefore a civil duty to exercise reasonable care in the circumstances was owed to the passengers and their dependents. Would the CAA be liable in these circumstances? I think the answer is probably no. Whether or not the CAA owed a duty of care in regulatory matters was recently examined by the Court of Appeal in Philcox v CAA. Here the Court held that the CAA did not owe a duty of care to the owner of an aircraft when issuing a Certificate of Airworthiness. The Court held that it was a matter for Parliament to lay down in what circumstances the CAA could be liable for negligence. Parliament had done so when enacting that the CAA would be liable for negligent acts or omissions arising out of the provision of air navigation services but there was no such provision in the Civil Aviation Act where the CAA was exercising its other regulatory functions.
III Civil Liability The third type of liability is civil liability. At common law a person is under a general duty to take reasonable care to avoid acts or omissions which he can reasonably foresee would be likely to injure someone else or their property if that person was so directly affected by the act or omission that the former ought to have had him in mind. If there is a breach
of this general duty of care and damage results, the injured party will have a right of action for compensation. Aircraft accidents are inevitably expensive whether in terms of damage to the aircraft itself, loss of life and limb to persons in the aircraft and they may also involve injury to persons and damage to property on the ground. Most aircraft accidents will therefore generate claims for compensation from those who have suffered loss. All skilled professionals owe at least a common law duty to exercise reasonable skill and care in his occupation. Accordingly if there is a “pilot error” accident a Plaintiff seeking compensation could sue the pilot personally or indeed his estate if the pilot has been killed. If a maintenance error is found to be the cause of the accident the maintenance engineer could be sued personally. We have seen this happen in general aviation accidents where the dependents of the pilot or passenger killed in the aircraft have sued the maintenance engineer for damages. Most pilots are aware of this and protect themselves by taking out insurance cover although it is an oddity that whereas the Road Traffic Acts have required compulsory third party insurance for drivers since 1930 there is no compulsory insurance requirement for pilots. Again there is no compulsory insurance requirement for maintenance engineers. Where a person has prudently taken out insurance cover he is of course obliged to comply with the terms and conditions of the insurance policy. Invariably this will contain a requirement not to infringe the terms of the Air Navigation Order. If there is such a contravention, for example if it is an unlawful public transport flight or the maintenance certification has been falsified, the policy may be voided and the insurers will not pay up. However the individual maintenance engineer is likely to be an employee of an airline or maintenance organization. A Plaintiff seeking compensation then has his right of action against the employer under the doctrine of vicarious liability if the breach of the duty of care by the maintenance engineer had been committed in the course of his employment. In contrast to criminal responsibility there is much less scope for the corporate body to escape from liability to pay compensation. Each one of these topics could be the subject of a day’s conference but I hope that this brief description is an indication of some of the issues involved.
6.0 HUMAN FACTORS IN MAINTENANCE A REGULATORY VIEWPOINT David Hall Civil Aviation Authority
The purpose of this short presentation is to provide you with an understanding of the CAA perspective of human factors in aircraft maintenance. Why we consider it to be important, what we are doing now and what we see happening in the future. To do this it is best if we go back to 1988, the start of human factors in aircraft maintenance for many of us. The Aloha accident in April of that year shook and concerned us all. The human factors elements in the NTSB report were not overlooked by the CAA but we had not experienced anything similar ourselves and hence had no reason to believe that a similar situation could happen here. However, in June 1990 we had our own maintenance mishap which this time came very close to home. A BAC 1-11 windshield was incorrectly installed and blew out at 17,000 feet under cabin pressurization loads. The accident investigators, for the first time I believe, made a serious attempt to determine not just what had occurred but why it occurred, in terms of human performance and contributing factors. The CAA reaction at the time was to explain the event in terms of probability, similar to that used in aircraft type certification and JAR/FAR 25.1309 criteria. Data supplied by the CAA Economic Regulation Group and the Safety Data Analysis Unit revealed that during the period 1982 to 1991 just over 11 million flying hours were accrued by aircraft greater than 5700 kgs and 1270 Mandatory Occurrence Reports (MOR) involving maintenance human error were recorded. 230 of these events manifested themselves in the form of an aircraft operational event. It was determined that, when considering the number of maintenance actions that must have been performed, maintenance human error did not pose a significant risk to the traveling public. Since 1990 we have learned a lot. Not least that statistics can be misleading and can provide comfort when perhaps they should not. In 1993 and again in 1995 UK operators experienced two further maintenance mishaps that by good fortune did not result in any loss of life, but it could easily have been a different story. So it was from early 1994 when the Air Accidents Investigation Branch (AAIB) published their A320 report that the CAA and UK industry really started their efforts to address human factors in maintenance. During the period 1993 to 1997 the CAA strategy was to monitor the research activities being performed in America and encourage the UK industry to apply good human factors principles, particularly the training of engineering staff in human factors awareness. The United Kingdom Operators Technical Group (UKOTG) established a Human Factors Working Group in April 1995 and quickly produced a report which stated amongst other things their desire to implement human factors training. To assist them in meeting this goal the CAA arranged and sponsored Transport Canada to come over and show them what such training comprised of and how it could be delivered effectively. This met with some success in that a few maintenance organizations started to conduct
awareness training, but not nearly enough as we would have liked. In 1995 and again in 1997 the CAA analyzed its Mandatory Occurrence database looking for maintenance errors. We had now experienced three potential accidents directly attributable to maintenance and our perception of a worsening trend was confirmed. As mentioned previously, during the nine year period 1982 to 1991 we had received 230 reports of maintenance related human error that had an operational effect on aircraft above 5700kgs. Between 1992 and 1994 we had exactly the same number of reports, 230, only this time it was of course only a two year period. The following two year period 1995 to 1996 showed the trend steeply rising as 534 reports were received. This startling trend could not readily be explained by the increase in the UK fleet which has grown over the period. We had to conclude that a once stable system of maintenance had now been disrupted and more maintenance errors were genuinely occurring. I would like us all to think about today’s maintenance environment and how it has changed over the last five years. It is now an extremely competitive market place. Competition and the need to make a profit is not new, but the methods by which we achieve this have changed significantly. Business consultant gurus such as Tom Peters and Michael Hammer told us all in the late 80’s that we must radically re-write the way we do business if we are to survive, let alone make a profit. This message hit home in the early 90’s and we started to see Chief Executives appointed to Boards, fired with enthusiasm for these progressive business processes. Whilst these processes undoubtedly make for a more efficient and dynamic organization they have been imported from industries which are not safety dependent. The conventional processes and culture were in fact developed over a long period from lessons learned, often hard lessons. When mistakes were made the system was modified or hardened to prevent recurrence. This may very well have made for inefficiencies but it did ensure that the needs of airworthiness and safety were retained. We must remember that the risks that IBM or Hewlett-Packard takes are predominantly commercial but in aviation we have to consider safety alongside the hungry needs of the shareholders. Following the road map used by other industries will ensure that the minimum JAA requirements are met, as they are necessary for the business, but compliance alone does not ensure that an organization is intrinsically safe. It is often quoted during error investigation that commercial pressure was the cause or at least a contributing factor. Is this true? Is commercial pressure a cause, or an effect. I believe that it is an effect. Frequently an effect of the new business processes such as Business Process Reengineering (BPR), Total Quality Management, Outsourcing, Performance Based Rewards, Self Managed Teams etc. etc. It is apparent to me that we need to consider organizational dynamics far more than we do now and consider just how they impact safety, culture and shape human behavior in the workplace. I am prepared to predict that in five years time the term organizational factors will feature more heavily than human factors at our symposia. It is now almost universally accepted that an increase in the frequency of fatal accidents would result in a loss of public confidence in the air transport system. The CAA is therefore committed to ensuring that the frequency of fatal accidents does not increase in line with the predicted growth in air traffic. This is the major challenge we and industry face, particularly so when set against the current dynamic, complex maintenance environment and the increasing number of human errors.
Two things have therefore shaped our current strategy regarding human factors in maintenance. Firstly, our resources are finite and we need to focus on the areas of risk. With 70 - 80% of accidents attributable to human error, human and organizational factors are going to give us the most return in terms of improved safety. Secondly, we have set ourselves an objective to develop safety improvement concepts and a safety improvement action plan in partnership with industry to ensure that the frequency of fatal accidents does not increase. The following points summarize how we intend to achieve this. •
Ensure that the maintenance related requirements are adequately human centered
•
Promote a global approach to human factors
•
Ensure that the UK maintenance community have the necessary knowledge and skills relating to human performance
•
Identify best practices and facilitate adoption in industry and CAA
•
Identify the areas of error which form the major contribution to accidents
•
Require the adoption of Safety Management Systems by industry
•
Develop a CAA human factors data collection and analysis system
•
Identify and focus on areas of risk
•
Develop a safety partnership relationship between industry and CAA
The CAA has embarked on a number of initiatives in the last 12 months. Multi-functional teams have been set up to look at human centered design, human factors within the Safety Regulation Group, and Safety Management Systems. At the request of the CAA the JAA has conducted a review of the maintenance related requirements to determine if they are adequately human centered. This has now been completed and the CAA is participating in the group established to work the recommendations and produce enhanced requirements. A confidential reporting program has been available to pilots and air traffic controllers for many years. In order to increase our understanding of human and organizational factors in maintenance we have, from June last year, extended the Confidential Human Incident Reporting Program (CHIRP) to include Licensed Aircraft Maintenance Engineers and approved maintenance organizations. Clearly the subject of human factors is not going to go away. Enhanced aircraft technology may provide some more improvements in safety but whilst the maintenance system is dependent upon people performing tasks, mistakes will continue to occur. Our mission is to ensure that those involved in maintaining aircraft are skilled and well educated about human factors and that the application of good human factors principles make the necessary improvements in safety our industry needs and society demands.
7.0 HUMAN FACTORS IN AIRCRAFT MAINTENANCE A REGULATORY VIEW Brian Whitehead Transport Canada
There’s a growing consensus that addressing the causes of human errors is one of the few remaining ways to get a real improvement in safety. It seems unlikely the planes can get much safer, so the people will have to. The question for the airworthiness authorities is, what is our role in the process? Directly, there’s not too much we can do. As Ernest Gann said; “Rule-books are made of paper—they will not cushion the impact of metal on stone.” Indirectly though, there’s plenty we can do, and we can start by making sure that our rules are not part of the problem. In Canada we’ve been fortunate in having an opportunity to re-draft our entire Aeronautics Code, and we’ve tried to take advantage of the situation by incorporating human factors awareness into the new regulations. In the process, we had to seriously change our approach to several items that had previously been articles of faith. First, we decided to keep the rules to a minimum and base them on the principle of “regulation by objective.” That’s the equivalent of the FAA’s “performance based regulation.” The idea is that, wherever possible, we avoid specifying how to do something. Instead, we establish the objective to be met, set out some guidelines, and then leave it up to the certificate holders to meet the objective in the way that best suits them. Of course, we still remain the final arbiters of whether the objective has been met. The actual drafting of the rules is done in conjunction with representatives of the main industry groups, so that keeps us down to earth. While the new Canadian Aviation Regulations themselves (the CARs) are very lean, they are supported by a comprehensive code of standards. These standards also provide a lot of scope for innovation. Allowing different approaches provides a safety valve in itself. If we try to regulate everything up to the hilt, so that every organization does its maintenance in exactly the same way, the only avenue left for competition would be who could cheat the most. By leaving organizations some room to maneuver, the competition centers instead on who can comply with the requirements most efficiently. The next major principle we adopted goes right to the heart of the human factors issue — establishing accountability. We looked at the work already done with flight crews, such as Cockpit Resource Management (CRM) and there’s obviously a lot to be learned there. But we came to recognize there are significant differences between the flight deck and the hangar floor. One of those differences is the social environment. The flight-crew has always been led by an authoritarian figure, the pilot in command. To some extent, CRM has concentrated on fostering assertiveness among the other flight-crew members, to overcome some of the negative aspects of this power difference, and create a team approach. By contrast, maintenance people have pretty well always been treated as a team. I am speaking strictly about large air carrier maintenance. General aviation, air taxi and bush operations, being smaller, are still full of rugged individualists. Until recently though, large air carrier maintenance operations were notable for the lack of a truly accountable person at the working level. It was a team without a quarterback. Dr. Ron Lofaro of the FAA has drawn attention to this difference between the flight deck and hangar
environments, and pointed out the lack of a clear authority figure by describing the technician as being “on the blame line.” In other words, while no one is totally responsible, the technician is in there somewhere. Now, that can’t be right. I suggest the problem began with ICAO Annex I, which has traditionally allowed an Approved Maintenance Organization (AMO) to exercise the privileges of an Aircraft Maintenance Engineer (AME). Apart from a brief mention in Annex VI, that’s still about the only reference to AMOs in the whole Convention, although that’s about to change. Several authorities have argued for a more definitive statement on the AMO’s role, and these efforts are now beginning to show results. The latest amendment to Annex I no longer speaks of the AMO having AME privileges. Instead, it refers to the AMO's appointment of individuals. The difference is subtle, but important. The reason for shifting emphasis to the individual is simple — an AME’s main job is to make decisions regarding the satisfactory completion of maintenance tasks. People make decisions. Organizations don’t. Too often in the past, we’ve seen aircraft signed out because the signatories have been persuaded it isn’t up to them to decide — that they’re merely communicating a company decision. In addition, an amendment to Annex VI, outlining standards for AMOs, has now been developed. It’s already been commented on by the Member States, so we can expect its introduction fairly soon. Both Annex I and Annex VI require persons who sign a maintenance release to meet the same standards as an AME. In the absence of any clear statement from ICAO, many people assumed that an AMO’s only role was to act as an AME. That’s the one function we think an AMO should not have! However, that’s not to say the AMO is without purpose. On the contrary, a sound organization is essential, to manage a whole range of things that can’t be left to individuals. Taking this approach, an AMO can be regarded as a group of AMEs marching in step. The AMO keeps the pace. It provides structure, standards, procedures and a formal hierarchy, within which the AME can do his or her job. What it should not do is attempt to make the AME’s professional decisions, although it may establish the standards against which those decisions will be made. The bottom line here is that the AMO and AME systems need not be mutually exclusive; they’re complementary. The CARs recognize this by assigning to each of these elements the role it’s most fitted to assume. We believe that establishing accountability is the key to an effective code of conduct. Accordingly, we’ve paid a great deal of attention to that feature. We’ve carefully defined the responsibilities of the Air Operator, as distinct from those of the AMO. Even where these entities are one and the same, we’ve recognized this by covering the functions with different certificates. (Incidentally, we’re pleased see the JARs now also include this feature). We’ve outlined the responsibilities of the various parties when maintenance is contracted, defined the role of the quality department and, as I mentioned earlier, established the respective functions of the AMO and the AME. The AME’s responsibility is worth a little more discussion, because it’s fundamental to our whole program. Under the CARs, only licensed AMEs are permitted to sign a maintenance release. If an AME is not satisfied with a maintenance task, he’s expected to withhold his signature, company pressure notwithstanding. His supervisor may sign for the item himself (assuming he also holds the license) but he should do this with some caution. The standards require an AME who signs a release for work done by another person to have personally observed the work to a sufficient degree to be satisfied it’s been completed satisfactorily. It’s pretty hard to do that from an office on the hangar mezzanine! In the drive to focus accountability as finely as possible, we’ve for the most part stayed away from a Required Inspection Item (RII) philosophy. First, this kind of requirement tends to be inconsistent with regulation by objective. But also, we felt it had problems from a human factors perspective. We were
concerned that the advantage of a “second pair of eyes” could be offset by a relaxation in vigilance caused by the knowledge that the second inspection would be taking place. There are no hard data on either side of this question, and there’s anecdotal evidence to support both theories, so you can take your pick. However, we have considerably strengthened the Quality Assurance function, and ensured that QA inspectors will be making random checks of all functions, but more especially on the critical items, so I think it’s fair to expect a net gain in overall quality. As an example, let me explain how this principle was applied to the independent control check. Like a lot of authorities, we had a long-standing “directive” or “prescriptive” type requirement, for work on engine and flight controls to be subject to two separate releases. It gave us a warm feeling, but people still assembled controls wrong with depressing frequency and the second inspection often didn’t catch the error. We considered eliminating the independent check altogether, and came quite close to doing just that, but in the end caution won out. We’re going to try to have our cake and eat it too. We decided to keep the second inspection but still focus the accountability in one place. Accordingly, the current rule still calls for an independent inspection, but that inspection is not subject to a maintenance release. The AME who signs the release for the control system work itself, takes sole responsibility for the entire job. The standards applicable to control maintenance require the AME to obtain a second opinion from a competent person, but that in no way alleviates his responsibility for the correct assembly of the controls. Now, it remains to be seen whether this change is just too subtle to make a difference, but it can’t hurt to give it a try. The independent check procedure is, in fact, a small-scale example of the entire Quality Assurance (QA) approach. The CARs require QA to be completely independent of production. Not only independent of the performance of the work, but also independent of the maintenance release. There is no “buy-off / buy-back” procedure. The QA inspector is a little like a theater critic. He gets to write a report that may have a considerable effect on the play’s run, but he doesn’t get to go backstage and rearrange the scenery. The primary emphasis in QA is along the lines of the Japanese Kaizen philosophy. The aim is not to find and fix individual defects, but rather to identify the causes and gradually improve the entire system. The AMO is required to establish a link between the QA findings and the personnel-training program. This closes the loop when human failures related to training deficiencies are detected. Similar links apply to findings resulting from faulty procedures, equipment, record keeping, etc. Record keeping is another area where we have gone to a great deal of trouble to identify responsibility. We already had quite comprehensive record keeping requirements, but we have now streamlined them, reduced the information recorded to the essentials, and clearly identified who has to record what, and when. The principle we applied is that in any communication, the person sending the communication bears the responsibility for ensuring that the person receiving has understood. This applies particularly for example, in the case of shift hand-over. The CARs make clear that if it becomes necessary to hand over a job mid-way, the person handing over must sign a release for those parts of the work that are completed, and attach a detailed description of the outstanding items. If that’s too difficult, the answer is simple — just stay and finish the work yourself! I have just touched on the highlights here, but I hope they show we already have a framework of regulations that will support operators and maintainers in their efforts to address human factors. We now have to decide, in conjunction with industry and the other national authorities, what to do in the way of data collection, analysis and promotion, and what part the regulators should play in all this. My best guess is that the eventual role for the aviation authorities will be one of facilitator and advocate, with little or no need for direct regulation. But before we make any decisions along these lines, we need to gain a wider
understanding of this whole complex topic of why and how people make mistakes. This forum is an excellent place to do that. Promotion may well be our biggest problem. Enabling new solutions by enlightened regulation is one thing. Persuading certificate holders to take full advantage of all the options available is something else. It’s not good enough to just talk about human factors; real action is going to be needed to change the inappropriate practices and faulty procedures that set the stage for errors. We are going to have to incorporate an awareness of the issue into every facet of our work. Some of our biggest AMOs are still using procedures from the old Engineering and Inspection Manual, which was based on a “regulation by directive” philosophy, and discontinued years ago. There are several reasons for this, including lack of knowledge of the options and simple inertia. In some cases, the organizations would like to change, but the outdated procedures are locked in by employee contracts. There are clearly pitfalls in including this kind of item in the collective bargaining process, especially at a time when the old assumptions regarding what procedures are the safest are being challenged. Changing entrenched attitudes is going to be a major part of the human factors effort. When you get right down to it, a lot of what we call human factors relates to communications of one kind or another. Pilots communicating with AMEs; air operators communicating with AMOs; all of us communicating with our peers; and, at the very end of the line, man communicating with machine. Ergonomics is where the human factors work began, and man-machine communication remains the hardest communication of all. The machine, unlike a human, is not going to try to work out what we really mean. It’s going to do just what we tell it to do. Because machines don’t care! I began with a quote, so I’ll finish with one. Rudyard Kipling had this all worked out a long time ago. Here’s what he said about the man-machine interface, speaking from the viewpoint of the machine. Remember, please, the Law by which we live We are not built to comprehend a lie We neither love, nor pity, nor forgive If you make a slip in handling us, you die!
8.0 LEARNING LESSONS THE (NOT QUITE SO) HARD WAY INCIDENTS, THE ROUTE TO HUMAN FACTORS IN ENGINEERING David F. King Principal Inspector of Air Accidents (Engineering) Air Accidents Investigation Branch United Kingdom
I want to draw attention to a number of Incidents which have fired my interest in Human Factors in Engineering. I am not a psychologist or a physiologist and cannot claim to be a 'Human Factors Expert'. I am however, and have been for a number of years a government air accident investigator, regularly called upon to fulfill the role of Investigator-in-Charge of a wide variety of accident and incident investigations.
WHY HUMAN FACTORS? As an industry we are inclined to boast about our safety record, and in many respects history supports our claims. This record has been achieved through close attention to detail in design, manufacture, maintenance and operating standards, where practices have often been characterised by conservative factors of safety. When it has gone wrong and an accident resulted, meticulous investigation has often identified a visible cause and the lesson has been learnt. By this process many types of accident have been 'squeezed' out of the system. Having eliminated some of the more obvious causes of accidents we are left with those causes that are more difficult to identify and address. Consequently, in recent years the accident rate has remained reasonably constant.. It appears to be generally accepted that 70-80% of accidents are now attributable directly to human failing in the operation of the aircraft. The Department of Transport 1991 Air Traffic forecasts for the United Kingdom include forecasts of annual traffic growth rates up to the year 2005. Air traffic passenger movements at UK airports is expected to increase by between 75% in the low economic growth scenario and 145% in the high economic growth scenario over the period. These figures are consistent with an annual growth rate over the period 1989 to 2005 of between 3.5% and 5.8%. These forecasts agree well with a paper produced by the Boeing Airplane Co. and published in 'Aerospace', the journal of the Royal Aeronautical Society, in July 1990 which stated:The world-wide fleet of transport aircraft (excluding the USSR) is expected to handle a passenger growth rate of 5.5% a year. By the year 2005 the existing fleet of over 8,200 aircraft will grow to
over 14,700. If the accident rates for the last 20 years are used to forecast the future, annual hull loss could increase from 14 to 20 or there will be a hull loss about every 20 days instead of the current 28 days. The combination of a constant accident rate and a steady increase in air traffic movements inevitably results in an increasing number of accidents to be investigated. A study of the total number of civil aircraft accidents occurring in the UK during the last 10 years shows annual rates in the range 180 to 307. Although there are considerable annual fluctuations the trend is for a steady and significant increase in the number of reportable accidents. 1990 was a record year with the 300 mark being passed for the first time, since then we have consistently passed that figure! If, as currently, up to 80% of the accidents are directly attributable to human failing, that is why the Human Factors investigation concerns me so!
WHY ENGINEERING? The June edition of the RAeS Journal Aerospace stated that the number of 'Maintenance Concern' accidents is on the increase and that over the preceding 10 years whilst the number of flights had increased by 55% the number of 'Maintenance Concern' accidents had increased by 100%. Human factor related causes to accidents are not restricted to the flight-deck. I have heard the argument that it is only in the cockpit that actions and results are closely linked in 'real time' and consequently human factors are of little or no consequence elsewhere. If a mechanic completes a task operating alone and is delegated the authority to 'sign off' the work, against a background of time pressure with minimum resources of tooling and supplies, and in a physically uncomfortable environment he is unlikely to give of his best. If the results of his work then go without functional or independent inspection until the aircraft is airborne, any error can result in an in-flight incident or worse. Does it matter that his actions and the final consequences are separated in time by hours, even days, if in that intervening period there was no attempt or opportunity to discover the mistake? Time was real enough throughout the task for the individual and only a sterile period separates cause and effect. An acceptance that human factors have relevance outside the flight-deck has led to expansion of the Confidential Human Factors Incident Reporting Programme (CHIRP) in the UK to accept reports from air traffic controllers and there are imminent moves to include engineers even though there are some significant opponents. At the start of this paper I referred to a number of incidents which had fired and continue to stimulate my interest in this area. I outline three of them below:-
BAC One-Eleven over Oxfordshire, 10 June 1990. The accident happened when the aircraft was climbing through 17,300 feet on departure from Birmingham International Airport en route for Malaga, Spain. The left windscreen, which had been replaced prior to the flight, was blown out under effects of the cabin pressure when it overcame the retention of the securing bolts, 84 of which, out of a total of 90, were of smaller than specified diameter. The commander was sucked halfway out of the windscreen aperture and was restrained by cabin crew
whilst the co-pilot flew the aircraft to a safe landing at Southampton Airport. The following factors contributed to the loss of the windscreen:•
A safety critical task, not identified as a 'Vital Point', was undertaken by one individual who also carried total responsibility for the quality achieved and the installation was not tested until the aircraft was airborne on a passenger carrying flight.
•
The Shift Maintenance Manager's potential to achieve quality in the windscreen fitting process was eroded by his inadequate care, poor trade practices, failure to adhere to company standards and use of unsuitable equipment, which were judged symptomatic of a longer term failure by him to observe the promulgated procedures.
•
The British Airways local management, Product Samples and Quality Audits had not detected the existence of inadequate standards employed by the Shift Maintenance Manager because they did not monitor directly the working practices of Shift Maintenance Managers.
Features of the windscreen change •
Short staffing - Night shift of 7 down by 2.
•
Shift Manager does job himself and alone (10 years RAF 23 years BA - exemplary record).
•
The A/C was remote and took the Shift Manager away from the location of his other duties.
•
Time pressures - the morning shift was short staffed - aircraft was programmed for a wash.
•
The task was conducted between 0300-0500 hrs - a time of Circadian lows.
•
Shift Manager was on his 1st night work for 5 weeks.
•
The Maintenance Manual was only used to confirm that the Job was ‘straight forward’.
•
The IPC was not used. - the IPC was misleading.
•
Shift Manager assumed the bolts fitted were correct - incorrect bolts fitted 4 years before.
•
Shift Manager chose bolts by physical matching - main stores below minimum stock level.
•
Shift Manager ignored the advice of the storeman on bolt size.
•
Shift Manager got bolts from uncontrolled AGS Carousel with faded labels in dark corner.
•
Shift Manager did not use his reading glasses at any time.
•
Shift Manager arbitrarily increased the torque from 15 lb ft to 20 lb ft.
•
Shift Manager didn’t notice excessive countersinking or next window was different.
•
The safety raiser used provided poor access.
•
Shift Manager failed to recognise difference in torque when fitting the corner fairing.
•
Shift Manager rationalised the use of different bolts next night when doing a similar job.
Was this Just one reckless individual? What had happened to QA - what was the organizational Culture - what was the effect of internal and CAA Audits.
Airbus A320-212, Gatwick, 26 August 1993. The incident occurred when, during its first flight after a flap change, the aircraft exhibited an undemanded roll to the right on takeoff, a condition which persisted until the aircraft landed back at London Gatwick Airport 37 minutes later. Control of the aircraft required significant left sidestick at all times and the flight control system was degraded by the loss of spoiler control. The investigation identified the following causal factors: •
During the flap change compliance with the requirements of the Maintenance Manual was not achieved in a number of directly relevant areas:During the flap removal the spoilers were placed in maintenance mode and moved using an incomplete procedure, specifically the collars and flags were not fitted. The re-instatement and functional check of the spoilers after flap fitment were not carried out.
•
A rigorously procedural approach to working practices and total compliance with the Maintenance Manual was not enforced by local line management.
•
The purpose of the collars and the way in which the spoilers functioned was not fully understood by the engineers. This misunderstanding was due in part to familiarity with other aircraft and contributed to a lack of adequate briefing on the status of the spoilers during the shift handovers.
•
During the independent functional check of the flying controls the failure of spoilers 2 to 5 on the right wing to respond to right roll demands was not noticed by the pilots.
•
The operator had not specified to its pilots an appropriate procedure for checking the flight controls.
Features of the Flap change •
LAE and team were new to the task.
•
LAE was A320 authorised but the aircraft were rarely seen, this was 3rd party work.
•
Planning was limited to a job card, change the flap, and provision of some special tooling.
•
Maintenance Manual, A/C Maintenance Task oriented support system (AMTOSS) format.
•
Tooling supplied was deficient or incorrect - no collars for locking spoiler.
•
The LAE requested additional experienced help - none available.
•
Other tasks were tackled during tooling delays and there were changes in task allocation.
•
Task was carried out during the early hours, a time of Circadian lows.
•
Team attempted to remove flap without disabling spoilers but couldn't.
•
Spoilers were disabled without collars or flags, a deviation from Maintenance Manual.
•
Shift hand over verbal, paperwork incomplete, hence misunderstanding over spoilers.
•
Spoilers were pushed down during flap rigging.
•
Familiarity with Boeing aircraft where spoilers auto reset.
•
Flaps were functioned, the spoilers were not - a deviation from the Maintenance Manual.
•
Duplicates were lead by day shift engineer.
•
Failure to follow Maintenance Manual.
•
During flight crew Walk round there was nothing amiss to see.
•
Pre-flight check, 3 seconds mismatch control/surface position required to generate warning.
•
Engineers demonstrated a willingness to work around problems without reference to design authority - including deviations from Maintenance Manual.
Boeing 737-400, Overhead Daventry, 23 February 1995 The incident occurred when the aircraft was climbing to cruise altitude after a departure from East Midlands Airport en-route for Lanzarote Airport in the Canary Islands. Following an indicated loss of oil quantity and subsequently oil pressure on both engines, the crew diverted to Luton Airport; both engines were shut down during the landing roll. The aircraft had been subject to Borescope Inspections on both engines during the night prior to the incident flight. The High Pressure (HP) rotor drive covers, one on each engine, had not been refitted, resulting in the loss of almost all of the oil from both engines during flight. There were no injuries to any crew or passengers. The aircraft was undamaged; both engines were removed and examined as a precautionary measure. The investigation identified the following causal factors:•
The aircraft was presented for service following Borescope Inspections of both engines which had been signed off as complete in the Aircraft Technical Log although the HP rotor drive covers had not been refitted.
•
During the Borescope Inspections, compliance with the requirements of the Aircraft Maintenance Manual was not achieved in a number of areas, most importantly the HP rotor cover drive covers were not refitted. and ground idle engine runs were not conducted after the inspections.
•
The Operator's Quality Assurance Department had not identified the non-procedural conduct of Borescope Inspections prevalent amongst Company engineers over a significant period of time.
•
The Civil Aviation Authority, during their reviews of the ‘Company Procedures’ for JAR-145 approval, had detected limitations in some aspects of the Operator’s Quality Assurance system, including procedural monitoring, but had not withheld that approval, being satisfied that those limitations were being addressed.
Features of the Borescope Inspection •
The Borescope Inspections were not carried out in accordance with the procedures detailed in the manufacturers Task Cards and the Aircraft Maintenance Manual. Specifically:The two HP rotor drive covers, one on each engine, had not been refitted after the Borescope Inspections. A post inspection ground idle engine tests had not been conducted. The entry in the aircraft Technical Log, relating to Borescope Inspections, had wrongly been
signed as having been completed in accordance with the Aircraft Maintenance Manual. •
Work originally planned for Line, transferred to base.
•
Line and Base staff shortages including the absence of three Base supervisors.
•
Minimal preplanned paperwork consistent with Line Maintenance.
•
In order to retain his Borescope authorization Base Controller performed the inspections.
•
A/C was remote and took the Base Controller away from the location of his other duties.
•
The Line Engineer gave a verbal handover to the Base Maintenance Controller.
•
Inadequate reference to Maintenance Manual.
•
Use of an unapproved reference source.
•
Poor lighting conditions.
•
Many interruptions.
•
Early hours of morning - Circadian lows.
•
No post inspection engine runs - a deviation from the Maintenance Manual.
•
9 previous occurrences.
•
Staff had regularly completed Borescope Inspections in a non procedural manner, failing to replace the HP rotor drive cover O-rings or to conduct an idle engine run, both specifically required by the Aircraft Maintenance Manual.
•
The operator's Quality Assurance system had not identified frequent deviations from a procedural approach and failure to observe the requirements of the AMM over a considerable period of time.
•
The regulator’s monitoring system had been ineffective in identifying and making the operator correct the same procedural lapses.
Common Features:•
Night shift.- engineers operating at their Circadian lows. Most Maintenance at night.
•
Supervisors tackling long duration, hands -on involved tasks.
•
Interruptions
•
Failure to use the Maintenance Manual - IPC
•
Confusing -misleading difficult manuals
•
Shift handovers - poor briefing - lack of comprehensive stage sheets
•
Time pressures
•
Limited preplanning paperwork, equipment, spares
•
Staff shortages
•
Determination to cope with all challenges.
Although many ingredients are demonstrated to have come together to create these incidents, what if
some are there all the time?
CONCLUSIONS The only object of identifying the causal factors and contributing features of an accident/incident for the government investigator is accident/incident prevention. This means that once a cause has been identified it must be accepted by the industry and change implemented to avoid a repeat. If nothing changes the most elegant of investigations is as nought, a waste of time and effort. The first hurdle to the implementation of change to address a human factor cause is acceptance of the finding that some one or some organization failed to perform adequately. This involves one or more individuals, a flight crew, a design team, a maintenance crew, a management accepting that their performance on the day or over a period of time, perhaps for reasons outside of their control, fell below par. If the subject of the Investigation is an incident without injury or damage there is generally more of a willingness on the part of all parties to the investigation to accept the findings. When a human factor cause is cited, the burden of coming to terms with the realisation that, as an individual or an organization, performance has been sub-standard can usually be accommodated, even if with some discomfort. None of us finds it easy to accommodate responsibility for our actions when they lead to an incident but much worse an accident. So incidents offer us a route to human factors in engineering. Even when the investigation is of an incident, my personal experience is that the collection and analysis of evidence to produce an acceptable conclusion is very Challenging. Making the connection between individual performance on a specific task to a more general conclusion about the personnel or the organization and its culture is a difficult step. Considering the organizations performance within the context of the Regulations and the role of the Regulator in monitoring compliance, is a further step away from the individual occurrence. However, if the causes are systemic these links are core to understanding the real causal factors and making effective changes. In the investigation of human factors the evidence is often circumstantial, subjective and sometimes easy to collect but often impossible to corroborate. Should Investigators, pursuing such an investigation, be constrained to achieve proof of their findings to meet some legal definition? Can Human Factors be dissected and analyzed in such a way to provide such proof in most circumstances? I believe not. I believe that the incidents cited in this paper, along with others that I have investigated, indicate that many of the factors which came together to contribute to their causes are with us most, if not all of the time. The development of maintenance practices over several generations of aircraft types has delivered us to where we are today. Are the processes appropriate to today’s high technology aircraft which we operate in a high pressure, fiercely competitive operational climate? The volume of material that the engineer is required to have available and accessible to perform his task on the aircraft is enormous - is it really presented in such a way that he can be aware of all of its significance? Is information in a large number of volumes on the shelf or on a micro-film reader readily available and usable by the engineer trying to meet tight operational deadlines? In moving from Quality Control to Quality Assurance in some cases are we monitoring the administration of the task and not the quality of the engineering product? Have commercial pressures resulted in minimal staff allocations to the task, allocations which rarely
materialize due to absences for leave, sickness or training? Up to the time of the above incidents all of the individuals involved were considered to be well qualified, competent, reliable employees selected for management roles. Immediately afterwards they were shocked at what had happened and would be condemned by many; but how had they suddenly changed during the few hours of the task? The answer is that they had not! The individual must shoulder some responsibility but the real causal factors are systemic and do not stop at the individual but reside within the culture of the organization. An organization approved by the Regulator. The significance of incidents as rehearsals for catastrophic accidents is sometimes recognized all too late; these three incidents have identified a wide range of common features conspiring to undermine the pursuit of quality in aircraft maintenance. What this indicate is that there is a need for an independent review of the way we regulate, conduct and deliver assured quality in aircraft maintenance. I believe that incident investigation is the route to human factors in engineering. This route and these investigations are already telling us something. Are we going to listen, are we going to act?
REFERENCES 1. Aircraft Accident Report 1/92. Report on the accident to BAC One-Eleven, G-BJRT over Didcot, Oxfordshire on 10 June 1990. HMSO 2. Aircraft Accident Report 2/95. Report on the incident to Airbus A320-212, G-KMAM at London Gatwick Airport on 26 August 1993. HMSO 3. Aircraft Accident Report 3/96. Report on the incident to Boeing 737-400, G-OBMM overhead Daventry on 23 February 1995. HMSO
9.0 A WORKPLACE PERSPECTIVE OF HUMAN FACTORS GERRY EVANS (Association of Licensed Aircraft Engineers)
INTRODUCTION The Association of Licensed Aircraft Engineers are very pleased to have been invited by the Civil Aviation Authority to make a presentation at this symposium. All too often people talk at us or about us and decide principle and practice on our behalf. Some of those people were once practicing maintenance engineers but rather more of them are not. Let us hope that the maintenance engineer will be given a higher profile in the future. I am the legal representative for the ALAE. My remit is to provide advice and legal assistance to our members. I also provide counseling following maintenance incidents. It has been very hard to gather views and opinions on the subject of human factors, despite having made requests for written contributions through our monthly magazine we have received very little. My presentation is based upon my own work experience together with a large number of informal discussions with practicing maintenance engineers throughout the United Kingdom.. In addition to this I have used some of the cases handled by me. This lack of response is not unusual from engineers and although I do know that the magazine is well read I did not expect there to be many replies. Most engineers do not make errors, perhaps therefore they see no point in joining the fray. We are moving towards a six hundred seat aircraft, the enormity of the consequences should any incident occur does not bear thinking about. There is rather too much at risk for us to fail in our application of human factors training and awareness in aircraft maintenance, likewise, and more importantly, in the training of our maintenance engineers. I still have a gut feeling that we are not yet moving in the right direction.
WORKPLACE VIEW OF HUMAN FACTORS The licensed engineer’s view of human factors is clouded by cynicism often to the point where he dismisses the subject from his mind. Human factors is viewed by many as a means to allocate blame. There is inherent in these two statements a clear indication of the distrust of the science of human factors that is prevalent amongst engineers, a distrust that breeds the cynicism manifest in nearly every discussion I have had on this subject with engineers. The “blameless culture” that is currently in vogue is also distrusted and in any case is alien to the engineers “no nonsense” way of thinking. If something goes wrong there must be some accountability, some action must be taken. Provided the action taken was
consistently fair it would always be acceptable. It is also felt that the no blame culture generates more error and incident than was previously manifest. I failed to meet anyone who could acknowledge that he was conscious of any human factors considerations when he was working. In every case the engineer was locked into what he was doing. There was also a clear opinion from any about the need to have consistent performance from management and better communication. This results from a decade of very unsettling restructuring, separate limited engineering companies, devolved maintenance etc. It is also very hard for the engineer to be objective when the spare he wants are never available, the training cut to the bone and the current changes in licensing not yet understood. These three views were frequently expressed to me.
THE MAINTENANCE ENGINEER From the ICAO Digest 12, “the reliability of mechanical and electronic components has increased markedly over the past thirty years. People have stayed the same”. This is simply not true. People do and have changed. Today we are dealing with a different animal. We are all a product of our time, and in our employment we are a product of the culture and environment that surrounds us. The maintenance engineer is a product of the establishment, we would do well to ask what precisely we expect of this product. Social attitudes and education methods have changed considerably, the need to develop and maintain an enquiring mind is not so prevalent as it once was. This does not mean that today’s engineer is less qualified or less able, far from it, but he does have a different outlook, sense of value and discipline. In the UK we now have authorizations for “Limited & Simple” tasks. These authorizations are granted for some basic inspections (PDC) and for the replacement of a controlled number of components. This practice has proved to be a superb tool, the engineers accepting training and authorization have been very enthusiastic and are in no way cynical. I have found, however, that holders of such authorizations are not always wholly aware of the attendant responsibility that authorization carries.
CONTRACT ENGINEERS Contracting of engineers is a growing business, the itinerant way of life is well liked. Most of those who choose this way of life are reluctant to change. Interestingly I have not handled a single maintenance related incident involving contract engineers, neither do we received any complaints concerning work content or environment. These engineers have a very real problem where training is concerned, they must either buy their training or take a permanent job to extend their authorizations. Their development is a separate consideration, but what of their human factor training. If human factor training is to be standardized across the industry then how are these engineers to be trained.
TRAINING From the investigations and interviews I have conducted as the result of major and minor incidents I have
come to the conclusion that specific human factors training would not have made any difference whatsoever, those incidents would still have occurred. What would have made the difference is training of a different kind. We need to train engineers totally for what we expect from them, technical competence is not enough. So just how do we train our engineers? To start with we never train them so say no. The employer gives to technically suitable persons a type course, such a course in today’s world is conducted in the shortest possible time. It is only from such a type course that an engineer will find himself in a position of real accountability and liability. The granting of authorization is a major change in the engineer’s life, but how many are really prepared properly for such responsibility. The only information imparted on type courses is literal, a straight reproduction of facts on which to be examined. The thinking process required to investigate defects is not addressed, this probably being outside the ability of the instructor anyway, and the proper use of manuals is left to the student to work at. Authorization is duly granted and from then on the individual is, in the main, left to develop himself. He becomes a product of his environment, a product (the engineer) that is not subject to audit. His ability to cope, to develop a clear overview, the manage his team, to maintain a discipline such as to not make an error, remains in his own hands. Provided the on-time departure rate is good and scheduled maintenance goes out on time we continue to believe we are getting it right. We do not look at ourselves when things do not go wrong. Although I consider that type courses have been abbreviated to a dangerous level I have experienced only a very few incidents that were related to poor technical knowledge level. I carried out a small survey to discover how many engineers were conversant with the JAR’s and the company exposition, in particular the Terms of Reference for the accountable manager. Sadly very few had read fully the company exposition. I also discovered that very few had seen JAR’s, and also that the JAR was, so often, not available in the workplace. My point being, that the certifying engineer should have a sound understanding of the need to support the accountable manager. Such philosophy should be accentuated in training. The considerations to be made in the production of the competent maintenance engineer should be absolute. Technical training should be followed by personal development and human factors training, and greater emphasis given to understanding legislation. The different facets of training should not occur together, technical training should be carried out in isolation. All of you would do well to bear in mind, when maintenance is complete and certified, at that point in time the signatory is the regulator, is quality assurance, is responsible for the maintenance package in hand, and if he does not perform to the highest standard and with integrity then the product will fail. This can easily happen with the best infrastructure, and has.
APPRENTICE TRAINING An incident I investigated concerned damage to an aircraft for which the supervisor accepted responsibility. The damage was considerable and very expensive. The supervisor was working with an apprentice and therefore responsible for his training. He did, in fact, instruct the apprentice in a particular procedure that was incorrect. The apprentice faced with having to call for the procedure to be repeated on
another aircraft, felt confident to carry out the procedure himself. This he did, and severe damage was caused. The important point to consider is not the engineer himself, but the apprentice. What other bad practices had this apprentice learnt. Apprentices in the workplace are allocated to engineers for work experience. This places considerable responsibility upon the engineer. The apprentice will be moulded in his attitude and practice by this experience. This again is a practice that should be subject to strict audit, and the selection and suitability of the mentor given particular consideration. Inadequate training results in a good deal of arbitration between engineers on defects and procedures, one learns from the other’s greater experience. This is certainly a very good thing as it will take about two years of practice to produce a competent engineer on type. But suppose they all suffer from poor training? We never re-examine engineers at any time except for procedures. Once authorized it is taken for granted that they will be satisfactory thereafter, so the training must be right first time. Another very good need for improved training is illustrated in Appendix 1. This article was written in response to a recurring problem addressed to the ALAE concerning the relationship between pilots and engineers.
PRESSURES The greater number of cases requiring my assistance have occurred as the result of distraction and three of those (major incidents) involved the senior person in charge. The distractions were related to staff shortage and the lack of experience and good training of the licensed engineers under their supervision. The third case involved sheer volume of work. Two of these engineers were dismissed before the operator stopped to consider the deeper causes of the incidents. Evident in two of these cases was the need for the supervisor in charge to give considerable assistance to his engineers, reflecting again upon the quality of their training. The ability of individuals to handle pressure varies considerably, and pressure is not something we train for. We are, however, expected to control those pressures. Staff shortage for whatever reason creates huge pressures as does the need for on time delivery. All such pressures originate from the production side of the business, they have always been there and they will not go away. To be really competitive we run a continual race requiring us frequently to work on the edge. This is what makes this industry so exciting, it is certainly never dull. The inability to cope with such pressure has resulted in incidents with varying consequences. One thing however that does not vary, is that the person blamed will not repeat the error neither will they forget it. On the other hand there is very little evidence that the community at large will learn from the misfortune of others. So how do we learn from others..............
LITERATURE I was a Health and Safety secretary for a large group of people for a term of five years. The H & S infrastructure of the company was absolutely superb, the literature available first class, and the training
and support for reps, excellent. So why did we have so many accidents? The greater number of cases I handle for the ALAE are accidents at work. Is human factors to go the same way, good infrastructure, good literature, good training, more incidents. There is a very real danger this will happen, people become inured to the subject. They see it so often they cease to take notice of it. Consider carefully this symposium, this is the twelfth of its kind, perhaps we should now audit our performance in real terms and report at the next symposium some tangible results or stop meeting. Like Health and Safety, Human Factors is a nebulous subject, and although the engineer’s mind works well with technical matters it does not work as well with legislative matters. The presentation of HF material has to be managed carefully and must be acceptable. I sat in a crew room reading, opposite me was an engineer reading a human factors magazine. Quite suddenly he threw the magazine across the room. Curious, I picked it up and asked him to show me the article he was reading. Having read it, I too felt the same way. The author required speaking to, but the damage was done. The article was condescending to an infuriating degree, had it come from another maintenance engineer, however, I am sure the response would have been different. The never ending “this is how you should behave” method of approach would be improved by “this is how we should behave”. Much of the material is good, but it is not having any significant impact. This is possibly because it is so distant from reality, and engineers do not think about it when they are working. Most importantly, from what source is this material derived. Referring back to my introduction yet again, the engineer is being spoken at by people who do not carry out maintenance. Teamwork has been one of the “in vogue” driving phrases so well used of late. Teamwork suggests a partnership, now that would be nice. Some educated direction by all means, but do not talk at us. Remember, we too have something to contribute. We are the people carrying out the maintenance and when we make a certification or sign a certificate for release to service, that is where the buck will stop.
APPENDIX 1 Engineers vs. Pilots by G. Evans As we are about to talk at length about the relationship between Pilots and Engineers, I pause to wonder just how they see us. There are only two people in aviation, the engineer and the pilot, all the others could do their jobs in any other business. These two people are required to be examined and licensed and are accountable in law
for their actions. But how do they get on? They only come together during operations, that is when the engineer is working on an aircraft that is due to fly or when an operational aircraft is defective. The engineer may require to impart information to the crew as the result of a maintenance function, such information being referred to a maintenance manual or procedure, fairly straightforward. The crew may want to debrief the engineer on a particular defect or discuss a recurring problem, again straightforward. Suppose, however, there should be a departure defect or perhaps the crew have a particular question they require to be answered. There should be some caution exercised here; walking into a flight deck and answering questions off the top of your head is a risk. Let us suppose that you should give incorrect information, the consequences could be embarrassing, and in any subsequent inquiry there would be two flight crew giving evidence and one of you. It is taken for granted that engineers are an available source of reference for flight crew, but there is nothing in law that requires the engineer to answer flight crew questions, it is something that is, quite simply, taken for granted. The requests for assistance and information when the aircraft is airborne raise more poignant questions. The training of engineers and flight crew has been abbreviated to such a degree that the need for pilots to ask questions has increased and the ability of engineers to respond has decreased. So where do we go from here ……………. Well quite clearly the communication between engineers and pilots must be maintained, it is too important, but there must be safeguards. In the first instance do not allow yourself to be pressurised, if you are unsure then say so and take reference. Reference can either be from a maintenance manual or written procedure, this would provide adequate verification. Asking another engineer and then imparting that information just might compound the problem unless he is prepared to talk to the crew himself. Engineers who have not at least two years experience on type should be particularly cautious. Experienced pilots converting to another type tend to ask all the same questions we have heard before, and there is attendant with such pilots, another problem. They have trouble disengaging their minds from the previous aircraft type they operated. Caution should be exercised when listening to the question being asked as it may not relate to the present aircraft type. This confusion can also occur where the pilot is flying two aircraft types seen by him to be alike, but to the engineer very different. For example, same switches and lights but totally different circuits. The pilot actioned PDC constantly raises queries, one sometimes wonders just who trains pilots for this function. (Interestingly the JAA do not seem to place any importance whatsoever upon this function). Engineers, at present, give support for PDC but they may not be there in the future, pilots beware …………….. It would be most useful for pilots and engineers to meet regularly and to maintain a healthy rapport, there is so often a difference of opinion which serves nobody’s interest. The attitude of pilots to engineers and the demands made by pilots leave much to be desired. With some it is a singularly pleasant and useful
exchange, with others somewhat less so, and no doubt they see us in a similar light. But the bottom line is, if you do not want to answer pilots’ questions then you don’t have to, you are not and never have a source of reference for pilots and neither are you paid for this function. Should any of you have Terms of Reference that specify a requirement to answer pilot queries then be sure that you, and not your employer, retain control of this function. Do not hesitate to say “no”, or “please wait”, do not allow yourself to be pressurized. A contentious article, something you have not thought about before, something perhaps you should think about now. Your views are invited…………..
10.0 THE INFLUENCE OF HUMAN FACTORS ON THE SAFETY OF AIRCRAFT ENGINEERING AND MAINTENANCE - A UKOTG PERSPECTIVE Simon Witts Engineering Director AirUK Engineering Ltd, UK
INTRODUCTION The UK Operators Technical Group (UKOTG) is a Group within the British Air Transport Association (BATA) dedicating to encouraging the safe, healthy and economic development of UK civil aviation. The UKOTG established a Human Factors Group some time ago to work on the development of clear guidelines and best working practice on this vital subject. The UKOTG Human Factors Group consists of representatives of the following airlines: - Britannia Airways - British Regional Airlines - KLM uk (Re-branded from AirUK) - TNT - Virgin Atlantic Airways This Group represents aircraft, engineers and support staff from operators whose aircraft range from the biggest (Boeing 747-400) to some of the smallest (Jetstream 41, ERJ-145 etc.) and who carried over 25m passengers in 1997. The reason for this scene setting is to illustrate the diverse interests of the UK Industry and to set the foundation for the reason for our passionate belief in the application of Human Factors initiatives to all aspects of our work.
THE MAINTENANCE REQUIREMENT The aircraft maintenance requirement has fundamentally remained very similar throughout history and consists of the following basic stages:
∗ The Requirement (as stated in the Maintenance Review Board, Maintenance Planning Document and Aircraft Maintenance Schedule [AMS]) ∗ The Task (originating in the AMS and ending up in a Workpack on the aircraft) ∗ The Release (which might result in re-visiting some areas of the Workpack for critical task review etc.) Traditionally, the requirement and generation of the task have been carried out by office-based staff with the sharp-end staff implementing the task on the aircraft and releasing the product. Many companies have tried to bridge the gap between planning and production and only now is real progress being made by siting both parties together in order to fully engineer the plan prior to release. The changes have mainly taken place in the following areas: ∗ The time available for maintenance (growing trend to maximize flying during the day and service at night, thus reducing the daylight downtime to major checks) ∗ The complexity of the maintenance (multiple systems, composite materials etc.) ∗ The pressure on the quantity and expense of qualified staff which can lead to the use of contracted staff with the complications of additional controls ∗ The need for more frequent and sophisticated training to cope with the complexity of aircraft As these demands grow, so cracks can appear in the fabric of the maintenance and recently, Human Factors have played a major part in a number of incidents and consequently have entered the spotlight for engineering and maintenance organizations.
HOW DOES THE UK INDUSTRY DEFINE HUMAN FACTORS The basic approach in the UK to tackling the issue of Human Factors is encapsulated in the words of former FAA Administrator Admiral Don Engen, who was quoted as saying in 1986 “We spent over fifty years on the hardware, which is now pretty reliable. Now it’s time to work with the people”. The only link that this paper seeks to make between Human Factors and Aircraft Maintenance is one of safety. One can look at all other impacts but none can match the impact of a serious incident or accident. Hence the old adage - If you think Safety is expensive, try an accident. So how do we link Human Factors with Safety? It is our view that one of the best links between Human Factors and Safety is to adopt the well-recognised premise than an accident or incident can, in virtually all cases, be analysed as having been caused by a number of factors i.e. links in the chain. In analysing how Human Factors can influence the links in the chain, one technique is to read across the universally adopted method of System and Aircraft Safety Analysis to Human Failures. There are many
parallels which can be drawn once the Human is considered as part of a System e.g. The Human Part of an automatic process - flight director in cockpit or “Meat Servo.” Assuming this as a basis, therefore, it is straightforward to consider that generally a Human Factors failure will have been one of the following types:
Single active failure An “active failure” is a single Human failure, the result of which is to produce a deterioration in the performance of a system or the aircraft, for example, the failure to replace the oil filler cap on an engine or to plan a modification without giving sufficient thought to the consequences. The Safety Net, if present in the process will prevent this link.
Passive and undetected (dormant) failure A passive failure is a Human failure which produces no immediately observable effect on the performance of a system. It can be of a subtle nature depending upon whether or not there is an indication of a failure. An example might be the breakdown of a management structure between management layers whereby a direct link is created between the source and result, bypassing an essential part of the process. The existence of an independent monitor is an obvious method of heading off such failures, however, the monitors themselves may fail in a passive manner.
Combinations of independent failure It is possible that there may be combinations of active Human Failures that are not all in the same area and which might not be prevented by independent monitors in one area. This can result in a hazardous combination of active and undetected failures.
Common-Mode and Cascade failure It is possible for the same root cause to affect each part of the human process, thereby allowing the same Human failure to have a knock-on effect throughout the structure and directly influence the end result i.e. the aircraft leaving maintenance in an unsafe condition. This could be an issue such as a widespread company re-structuring or pay cut. The faulty setting up or rigging of equipment in multi-channel systems provides one of the most frequent causes of common-mode failures attributable to maintenance. Cascade failures also fit into this category, since they are a particular type of common-mode failure where a single failure, which in itself may not be hazardous, can precipitate a series of other failures.
Failure produced by the environment One has to consider whether certain maintenance tasks are particularly vulnerable to some environmental conditions, particularly if they can cause common-mode failures. Poor lighting, lack of hangarage, lack
of adequate tooling can all be classified here. Accepting, then, that an incident or accident may involve many different aspects, it can be recognized that human factors may affect each and every link in a chain of events or it may be one on its own. The severity of the end result will then back-drive the measures which are then put in place against the Human failures. In 1979, a large passenger airliner crashed in North America when an engine fell-off after take-off ostensibly due to failure of the pylon attach fitting. In fact, the investigation involved analysis of the procedures given to (and followed by) the crew, the pylon attachment design, the design and operation of the hydraulic system, the airline’s maintenance procedure and the FAA’s surveillance and malfunction reporting system. The view could be taken that Human Factors played a part in each of these items. The application of Human Safety Analysis to this incident might have shown that measures could have been taken to prevent the accident. Of course, the impact on safety relies on the existence of a direct link between a human factors event and an incident or accident where safety is compromised. It is the existence of such a direct link that has focused so much effort in recent years on Human Factors and the methods by which the link can at worst be weakened and at best eliminated.
HOW DO HUMAN FACTORS IMPACT ON AIRCRAFT ENGINEERING AND MAINTENANCE So how do Human Factors impact on Aircraft Engineering and Maintenance? If one applies these failures to design, manufacturing, engineering and maintenance errors the picture of the possible links in the chain begins to emerge. At the design and manufacturing stage, the link begins since, for example, critical parts must be identified and manufactured in accordance with the requisite standards. Such critical parts must then be subject to inspection and test requirements, as necessary, in the Aircraft Maintenance Schedule. The planning engineer cannot be blamed for not calling up a check that isn’t in the Schedule. Similarly, the aircraft engineer cannot be blamed for failing to carry out an inspection he was not asked to do, unless the fault is something that is glaringly obvious. ∗ The designer can take steps to minimize the likelihood of certain maintenance errors, for example: ∗ Detailed design precautions e.g. idiot-proofing ∗ Making critical areas readily inspectable ∗ Devising adequate check-out procedures to cater for maintenance errors which could result in hazards ∗ Measures to ensure that the allowable deficiencies in the MMEL take account of the possible failure modes which could result from maintenance errors. At the Engineering stage, there is a generally held view that maintenance errors are the only type of error
and that engineering errors can have little effect on the end result of the maintenance check. This is a complete fallacy since the person who specifies the work to be carried out i.e. the person who tailors the Maintenance Schedule into tasks for the aircraft check has a much greater influence on the safety of the end result than the aircraft engineer himself. These Engineering areas can be characterized into the following areas - any of which can suffer from the type of human failure above. ∗ Administrative errors - straightforward errors in the documentation, the ordering of tasks or the omission of a particular step ∗ Technical errors - incorrect or incomplete information ∗ Monitoring errors - caused by improper monitoring and feedback of the results of checks There are many other Human Factors which can have a direct effect on the links in the chain. Pressure and Stress - either actual or perceived Environment - too dark, too cold etc. Circadian Rhythm - natural body variations on shift work
HOW TO CONFRONT THE ISSUE Talking about Human Factors is one thing. Confronting the issue is another entirely and is the subject of much current debate in the Industry. The first stage must be to ensure that the Company embraces Human Factors at all levels and in every area. Human Factors is not somebody else’s problem. It requires commitment from the Chief Executive down and the Cleaner up. It is our view that creating a separate Human Factors function in a company, whilst apparently reassuring, is not the way to go. It must be made a part of each and every person in the organization’s responsibility to be vigilant for Human Factors failures in their everyday work. The best way, in our view, to implement Stage one is to organize briefing sessions for all members of the company, starting at the top. This can then be followed by more detailed “training” sessions. All members of staff must understand that the process applies to them and it also relies on the successful introduction of a “just” culture such that events which occur can be reported to allow detailed investigation and rectification action to take place. It will not be possible to introduce a Human Factors related program whilst all events are driven “underground”. The second stage is to review the outputs of the company which have an impact on safety and to review the sensitivity to events leading up to release to the types of Human Failures described above. Examples of this could be: Aircraft Base Maintenance Outputs Line Maintenance Release
Specified Tasks to be completed by Line Maintenance Closure of an Air Safety Report The third stage is to review the working practices in the company at all levels to establish whether the company is exposed to any failures and if so to ensure that measures are put into place to head off any problems. The Human Failure analysis approach to company processes is offered as a solution to this problem. The fourth stage is to ensure that all aspects are fully documented in clear, concise procedures which are part of induction and continuation training. The fifth and final stage is to ensure that sufficient measures are put in place to prevent the matter of Human Factors from slipping off the company agenda.
THE ROLE OF THE JAR145 ACCOUNTABLE MANAGER JAR145 requires that the maintenance organization nominates an Accountable Manager who has access to the funds and resources to ensure that the organization has sufficient staffing levels and resources. UK CAA Research has shown that the nominated senior executives are generally of a sufficiently high stature in the structure of the organization that they are remote from issues that directly affect safety. This situation is driven from the interpretation of the requirement for full access to and control of resources. This can patently lead to a breakdown in the objective of the requirement which is to ensure that safety is not compromised by commercial issues. A gap therefore exists between the requirement for and implementation of the safety culture in the organization. A solution is to achieve a “delegated” function approach which does not abdicate the authority but ensures direct influence on the safety culture. This delegated function enables a proper closed-loop review process between the Regulator, the Accountable Manager and the product. It is this solution that has been adopted in certain organizations in the UK to great effect.
THE LEGAL FRAMEWORK It is important to ensure that the Accountable Manager review process is not affected by any legal framework in place. The ability for the industry and the regulator to be effective in the review process can be severely hampered by a legal framework which penalizes any identified failure. JAA is endeavouring to continue to work with industry to identify and pro-actively rectify problems through National Authority initiatives and UK Engineering actively promotes this approach.
THE TRAINING ISSUE
One of the most important issues which directly affects Human Factors is the training issue. Our industry relies on the ability to recruit the next-generation of engineer into our organizations. This begs the question whether with the perception of the industry currently that engineering and maintenance are not as attractive as the “soft” careers, would you encourage the next generation to follow an aviation career? If the answer is yes, why? One of our major concerns in Northern Europe and certainly in the UK is the lack of engineering and maintenance personnel and we in the UK industry are taking active steps with local schools to ensure that engineering and maintenance becomes an attractive career. This issue is patently so important since training remains essential regardless of the complexity of on-board fault isolation. No aircraft yet developed is capable of rectifying and releasing itself into service. Getting the Human Factors approach issue correct is therefore the critical factor affecting the future enhancement of safety.
HUMAN FACTORS - CHOICES AND WAY AHEAD There are probably many choices and directions one can take to take the Human Factors issue forward. Creating a Human Factors Office and creating a “closed-door investigative and corrective function for the subject is, in our view, avoiding the issue and is also symptomatic of a similar approach to Quality that generally fails. Confronting the issue involves getting the message across to everyone in the organization and is only successful when these people live and breathe the subject, as effectively as they do in their home life. The way ahead then is clear to us in the UK industry. Against the background of industry experience there is a lot of work to do, but having embarked on a process of Human Factors education that all in the company can believe in and participate in, we believe that the major milestone is passed. Our aim is to ensure that all major elements in the process are addressed in order that we can enhance the overall safety of the product by adding the Human Factors dimension to all other communicative, investigative and process tools that we already have. Our aim as part of the aviation industry, is also thoroughly clear. The industry as a whole faces the challenge of embracing the role that Human Factors can play in the safety of Aircraft Maintenance and is at the forefront of the lobby which wishes to see the issue adopted at industry level and is taking steps to ensure a common approach to the problem and hopes that, through Conferences such as this and Industry Groups alike to see progress at this level. It makes no sense to us that we approach a common problem separately. In the meantime, we in UK industry will continue to strive to improve our knowledge of this complex subject. By doing so, we firmly plan to play our part in achieving the 33% improvement in Air Transport accident rates that is required over the next ten years that is necessary to prevent an increase in aircraft accidents
resulting from the growth of the industry. Human Factors is a global problem, enhanced safety is a global target, however, people remain an untapped solution and tapping that resource is an aim that we must all achieve together!
REFERENCES 1. Human Factors in Aviation - Weiner, Nagel 2. Systematic Safety - Tye, Lloyd
11.0 HUMAN FACTORS TRAINING IN THE TRAINING SCHOOLS Gordon Dupont Special Programs Coordinator Transport Canada, System Safety Pacific
INTRODUCTION Human Factors (HF) training for aviation maintenance personnel (often referred to as Maintenance Resource Management or MRM) is finally being looked at seriously by the aviation industry. The International Civil Aviation Organization (ICAO) has proposed an amendment to Annex 6 Chapter 8 that would require all member countries to include “training in knowledge and skills related to human performance, including coordination with other maintenance personnel and flight crew” as part of the continuation training required within an approved maintenance organization. As we are finally beginning to provide maintenance personnel with the training they require to avoid making maintenance errors then it is time to extend this training to those in training to become part of the maintenance work force. This paper will look at this next step in the effort to reduce maintenance error.
A BRIEF HISTORY A brief history of MRM in Canada doesn’t have to go back very far and, as is so often the case in our industry, it starts with an accident in which 24 people died. The Dryden accident on March 10, 1989 was Canada’s wake up call. This accident occurred less than a year after the American wake up call in Maui, Hawaii with the infamous Boeing 737 “convertible”. However unlike the Aloha accident, the Air Ontario crash at Dryden had only a small maintenance component. Maintenance contributed to the accident by forming a link which caused the F28’s auxiliary power unit (APU) to be unserviceable (U/S). It is felt that the APU being U/S was a contributing factor to the Captain’s decision to attempt a take off with ice on the wings. Out of the 191 far reaching recommendations, in the 1992 final report, one called for the extending of HF training to dispatchers, air traffic controllers and aircraft maintenance engineers (AMEs). As a result, Transport Canada (TC), in March 1993 established the position of “Special Projects Coordinator” with the task of developing, in cooperation with the industry, a HF workshop for maintenance personnel. An Industry Liaison Committee (ILC) was struck with representing members from the FAA, the major airlines, general aviation, the helicopter sector, the component overhaul sector and the Canadian military. A “test flight” (trial run and evaluation) of the resulting two day “Human Performance in Maintenance”(HPIM) workshop was held in January of 1994 with great success. Instead of disbanding, the ILC worked with Transport Canada to develop and produce the now well
known “Dirty Dozen” posters. They then worked to actively promote HF training within their industry sponsoring the three Canadian conferences which helped give birth to this Symposium. This small industry group still exists today under the name of “Maintenance And Ramp Safety Society” (MARSS). Transport Canada remains an active member of this group who are working, as they did since their inception: to reduce aviation maintenance and ground crew human errors. In August 1995, TC ran a “test flight” of a two day Human Performance for Ground Crew workshop. The workshop was well received, however it was felt that no company would be willing to expend two days of lost productivity to train its ground crew in Human Factors at this time. The program was put on the “back burner”, however the industry committee, MARSS, endeavored to produce a series of “Dirty Dozen” posters for ground crew which I understand is still awaiting sufficient funding in order to proceed. Transport Canada has also developed a follow up HPIM Part 2 workshop which was released after a “test flight” in September , 1996. Many of the participants have said that this workshop is better then Part 1, but I suspect that it is more likely they come into Part 2 with a much more positive outlook towards the material presented.
THE PRESENT Since its release in January 1994, HPIM Part 1, this workshop has been presented all across Canada, from Victoria, BC to St. Johns Newfoundland. It has been warmly received by all who have participated. Richard Komarniski, Grey Owl Aviation, an aviation consultant, has presented both HPIM Part one and two across Canada and the United States. Several major airlines and regional carriers have adopted the workshop to train their personnel. Two thousand sets of the “Dirty Dozen” posters have been distributed all around the world, from the Falkland Islands to New Guinea. These posters were designed to be a follow up reminder of material learned in HPIM Part one, but have developed into a standard of their own. They are in the process of being translated and printed in French. Permission was granted to have them printed in Chinese. MARSS is in the process of doing a third reprint. MARSS, working with Transport Canada, is right now working on a second set of posters to be a follow up to HPIM Part two. They will be called “The Magnificent Seven” These posters will be all positive in nature and promote the AME as a professional. Work is ongoing in developing a HPIM Part three which would see the AME, the pilots and company personnel together in a one day workshop which would cover risk management and personnel interaction. MARSS will provide industry input into the content and carry out a “test flight”, on behalf of the industry, later this year. Transport Canada is presently working with the Canadian Aviation Maintenance Council (CAMC) in developing a HF training program to be presented as part of the training curriculum utilized by the aviation maintenance training schools across Canada. CAMC is a Canadian industry supported organization which in coordination with the various divisions of the industry, develops and maintains national standards in aviation maintenance. They work closely with the training schools with the objective of ensuring that common training curricula are utilized by all accredited training organizations.
THE NEXT STEP Both TC and CAMC recognize that HF training must be introduced in the training schools and that there are two important issues to be addressed. One The course material must provide the best possible benefit to the student to enable an individual to enter the work force with a knowledge of how to avoid maintenance human errors. . Two How to ensure the standard of training is consistent across Canada so that every student receives the same basic training.
DELIVERY METHOD The traditional method of lecture with a textbook and test at the end does not lend itself to efficient training of HF. This method works reasonably well when the material to be learned is finite and has only one correct response. HF is not finite and there is often more then one correct response. Because we are dealing with humans and human situations, we often find that the correct response can vary. This method is not recommended for young students who will have a lot of questions and “but what ifs” to ask. Some thought was given to providing this initial training on a CDROM as computer based training (CBT) which would ensure the consistency of the training. The majority of today’s students are very familiar with computers and comfortable with this form of training as long as it is presented in an interesting and informative way. However CBT has some drawbacks. The computer has no way of detecting when the respondent is in disagreement with what is being presented. Students become very adapt at providing the correct response to any question without even being sure of the question. Should a natural leader of a student group have a negative reaction to the CBT training then it would be possible for the majority in his sphere of influence to also reject the program. Therefore total reliance on CBT used for abinitio training in HF is not recommended. However some video clips and a form of interesting follow up in the form of case studies are useful as long as they provide real life situations which the student can relate to. The ideal way to provide HF training to students is a team situation with experienced AMEs as part of the team. This has been done on a test basis with very positive results both from the students but also from the AMEs on the team. The main reason for this is, what the student may lack in knowledge, he often makes up for in enthusiasm. With experienced AMEs as part of the team, the student more readily accepts what is being presented and most, coming from a learning environment, are ready participants of the exercises. While the student/experienced AME mix may be the optimal, it may not be the most practical or even possible. This leaves the last option, which is a training package designed for the student. This training package would be delivered by using the team concept and a series of modules which actively encourage interaction and provide for team exercises.
TIME AND TIMEFRAME “How much is enough and can I do the training during coffee breaks?” Experience has shown that maximum benefit can be obtained with a two day workshop provided as a block. Splitting the modules up results in a lot of time being spent in review to get everyone back up to speed. If there is extra time for this review/reinforcement, then that could be an effective way to train. However if the total time allocated is finite then I recommend the two day back to back workshop. The “sleep on it over night” appears to have a positive effect on the final outcome. More then two days would be excellent as it would allow for more case studies to reinforce what is being presented. It would allow for more team exercises and it would allow for a more in-depth presentation of the material. However, this extra time would likely have to be at the expense of some other portion on the course and may not prove to be practical.
THE WORKSHOP MATERIAL Most will have little difficulty in agreeing that the “dirty dozen” messages should be covered in a simple, basic, and interesting way. I would envision an ab initio introduction to human performance in maintenance could contain the following modules. 1. An introduction and brief history to set the tone and provide the purpose of the workshop. Time allocation 1 hour 2. What determines a persons characteristics and a simple behavioural analysis should follow to set a foundation for the balance of the workshop. Time allocation 1 ½ hour 3. The “Dirty Dozen” messages beginning with Lack of Knowledge, specially as it applies to a new person on the job which the student will one day be. Time allocation ½ hour 4. Next should come its close cousin, Lack of Awareness. Time allocation ½ hour 5. Lack of Assertiveness is going to be a problem for the students when they obtain that first job and are not comfortable with the norms of the company. To speak up against a norm could mean job loss. Time allocation ½ hour 6. Pressure is one which they will soon be exposed to and they will already be familiar with as they strive to succeed in their studies. They will learn how to recognize when the pressure is self induced and when it is excessive. Time allocation ½ hour 7. Lack of Resources should follow with plenty of examples to illustrate the problem. Time allocation ½ hour
8. Lack of Teamwork should be covered. There are a number of exercises which help illustrate the value of synergy. Time allocation ¾ hour 9. Complacency is one which the student will not have to deal with for awhile but must be covered in order to become aware of what it is, how to recognize it and what to do about it so it doesn’t cause a problem. Time allocation ½ hour 10. Distraction is a common problem which they will relate to well. Time allocation ½ hour 11. Fatigue may not appear to be a big problem for the young student but must be empathized and understood. Time allocation ¾ hour The next 3 messages are very important to cover adequately as they are likely to be the big 3 for a new person on the job. 12. Lack of Communication both verbal and written. Time allocation 1 hour 13. Stress is an insidious contributor to the unintentional maintenance error. Time allocation 1 hour 14. Norms are one of the most important as new employees will come across them soon after beginning any job. Company culture must be tied into the norms as it is a major influencer of Norms. Time allocation 1 hour 15. At least 2 case studies, and more if time permits, which illustrate what has been covered should be incorporated. Time allocation 2 hours 16. A wrap up must be provided at the end for the student to focus on what he is going to do different and to provide feedback on the training received. The wrap up will center on the student writing a letter to himself which he will receive back in 6 months Time allocation ½ hour
THE FACILITATOR The facilitator is critical to the success of the training. There are a number of things which should be in place to ensure a successful human factors facilitator. 1. The facilitator must be a strong believer in human factors and the benefits of positive thinking. A negative person will have great difficulty in presenting the concepts in the workshop.
2. The facilitator must have creditability with the participants. This means that he/she must have experienced working with aircraft and preferably not be limited to a background in psychology or flying. He/she has to have “walked the mile” to be an effective facilitator. 3. The facilitator must receive proper training on both what is in the workshop but also how to present the material. 4. The facilitator has to know the material well and be able to provide his own experiences in appropriate places to add creditability to the material. This can be difficult for some persons. 5. The facilitator must be willing to listen to, as well as ask, questions of the participants in order to sense their acceptance of the material. The more the participants can discover for themselves the better. 6. Two facilitators working together are the ideal as more material can be effectively covered in the same time frame, they are able to carry out demonstration skits to vary the training method and they are able to assist each other to ensure that all points are covered. This concept also helps ensure consistency of the material taught. 7. The facilitator should have access to the latest training material in order to keep up to date with the latest techniques and concepts. 8. The facilitator should have a means of obtaining answers to any problems or questions he is unable to find answers for. Knowledge of Human factors can not be bluffed for any length of time before the facilitators creditability is gone.
SUMMARY By providing quality human factors training in the maintenance training schools we will turn out persons who have a basic knowledge of what causes maintenance errors and how to avoid them. We will also have personnel in the industry who have accepted the concept that human factors training is worth having. If their training is done right, they will “spread the word” and be willing to participate in further training in that field. Thus it is critical that we get it right the first time if we are to benefit in the future. By working together I know we can do just that.
CONTACTS Transport Canada, System Safety, Pacific Gordon Dupont Special Programs Coordinator Phone: 604 526-8367 Fax: 604 666-9507 Email: [email protected] Maintenance And Ramp Safety Society (MARSS) John Braund Secretary Phone: 604 207-9100
Fax: 604 207-9101 Email: [email protected] Website: [email protected] Canadian Aviation Maintenance Council (CAMC) William Weston Executive Director Phone: 613 727-8272 Fax: 613 727-7018 Email: [email protected] Website: [email protected] Grey Owl Aviation Consultants Richard Komarniski Phone: 204 848-7353 Fax: 204 848-4605 Email: [email protected] Website: www.greyowl.com
12.0 EVALUATING THE EFFECTIVENESS OF MAINTENANCE RESOURCE MANAGEMENT (MRM)
1
James C. Taylor Ph.D. Santa Clara University
WHAT IS MRM AND HF TRAINING? A Definition of MRM. Taken together, two recent innovations in maintenance define MRM. These innovations are 1) labor-management cooperation for improving safety and 2) the development of positive and assertive communication practices. MRM, by this definition, is not addressing individual human factors of the Aviation Maintenance Technician (AMT) or his/her manager, but it is involved in the larger system of human factors concerns involving AMTs and managers (and others) working together to promote safety. MRM is an original and creative response to an event of great significance. That response is about communication and its results in aircraft maintenance -- an occupation in an industry for which communication was a largely neglected topic. The event occurred in 1988 -- a 19 year old B737, on a scheduled flight in Hawaii, experienced major hull disintegration which was attributed to problems in the airline’s maintenance system management (NTSB, 1989). There was sudden awareness of two problems -- the crisis of an aging fleet, and an industry-wide crisis of communication between management and the worker in conducting safe and cost-effective maintenance operations. As MRM has evolved, and continues to evolve in response to these problems, many airlines are discovering that solving them will require changes in management, organization, and organizational culture -- changes requiring collaboration among people, changes beyond people one at a time. Two social science studies of airline maintenance operation in the US began shortly after the 1988 accident. They were funded and subsequently published by the FAA (Drury, 1991; Taylor, 1991). Other, similar studies in airline maintenance had been conducted in Britain (Lock & Strutt, 1981) and in the Netherlands (Alders, et al., 1989). The effect of poor communication practices had been accurately noted in the U.S. during the 1980’s as well (Strauch & Sandler, 1984). The conclusions from all of these studies showed that maintenance management and group effects, such as those noted by the US National Transportation Safety Board (NTSB), could be generalized in part as a problem of poor communication practices and skills throughout the industry. There was evidence, from some of the airlines studied, that good communication practices were in use, but that these were the exception (Taylor, 1991). Other positive results had been reported outside the US about changes in management style and structure at British Caledonian airlines (anonymous, 1987), SAS-Scandinavian Airlines, and British Airways (Carlzon, 1987; Lima, 1995).
BACKGROUND OF MRM PRACTICE IN THE U.S. MRM Measures Four steps to measuring training effectiveness A relatively low number of companies report the use of evaluation methods which assess and measure behavior changes on the job and/or subsequent change in organizational performance. Rarely do organizations conduct longitudinal, multiple-measure evaluation processes to examine the effects of training programs. The most prevalent method for evaluating training consists simply of evaluating the trainees' reactions to the training and their level of learning. However, to objectively demonstrate the beneficial effects of training programs, a systematic approach should be taken (Kirkpatrick, 1979, 1983; Alliger & Janak, 1990). Kirkpatrick proposed a four level training evaluation model as follows: 1) the trainee’s reaction to the training program, 2) the assessment of how well the trainee has learned the course material, 3) the assessment of the trainee’s behavior at the jobsite, following this training; and 4) the objective measures of organizational performance (1979). Less than a decade ago a mere 10% of organizations studied reported using all four criteria levels of Kirkpatrick’s model (Alliger & Janak, 1990). Considering these statistics, the MRM evaluation process introduced by the University of Southern California in 1991 (Taylor & Robertson, 1995), and now continued at Santa Clara University, is at the vanguard. Measurement at each of the four levels is implemented to assess the relative effectiveness of MRM programs (Robertson & Taylor, 1996).
The Maintenance Resource Management/Technical Operations Questionnaire We use several kinds of measures in assessing success of the various approaches to MRM. A cornerstone measure is the “MRM Technical Operations Questionnaire” (MRM/TOQ), a proven instrument containing a core set of attitude and opinion items which assess respondent attitudes and perceptions relevant to MRM practice (Taylor, in press). The MRM/TOQ is derived from a 1990 version of the Cockpit Management Attitudes Questionnaire (CMAQ) -- a well-known training, evaluation and research tool (cf., Helmreich, Foushee, Benson, & Russini, 1986). The CMAQ questionnaire contained a number of items measuring attitudes that are either conceptually or empirically related to communication and teamwork training provided to flight crews. Taggart (1990) revised the CMAQ for use in an aviation maintenance department, and reported positive initial results following CRM training conducted for maintenance managers in late 1989. Fourteen CMAQ items were eventually adapted for use in the MRM/TOQ and they included some of Taggart’s modifications as well. The four MRM practices measured by those 14 attitude items are: sharing command responsibility, teamwork and cooperation, stress management, and assertive communication. In addition to the 14 items comprising the four attitude scales just described, an additional eleven opinion items are included in the MRM/TOQ. Six of the eleven deal with communicating and setting goals
within and between work units. This goal sharing scale has been previously developed and tested in prior aviation maintenance studies (Choi, 1995; Taylor, in press). The five remaining items measure various aspects of a maintenance department’s practices in safety awareness. These safety awareness items are drawn from later versions of the University of Texas CMAQ survey instrument.
A Longitudinal Model For Measuring Success The MRM/TOQ is applied at various points in an MRM change effort. It is used to determine a baseline measure before any program is put into place and is thereby useful in program planning and design. The MRM/TOQ is also used to survey participants before and after an MRM training course. As part of the longitudinal design the questionnaire is used to survey participants’ attitudes and opinions in the months following MRM interventions. For example, the longitudinal application of the MRM/TOQ helps measure and assess how effectively participants’ apply and transfer the learning and knowledge from MRM training to the job. In addition to attitude assessment, behavioral assessments at the job site occur several months following the training. We measure these behaviors with self-reports in follow-up questionnaires two, six and twelve months after training as well through confirmatory field investigation and observation. Organizational performance measures, provided by participating companies, are tracked longitudinally, before and after the implementation is completed. These measures are correlated with the post-training attitudes and behaviors. This demonstrates the ultimate effects of the MRM program. To accurately assess those measures is a challenge that we address directly. Initially it was argued by Kirkpatrick (1979) and further supported by Steven & Hellweg (1990) that evaluation efforts employing performance data are not far beyond what they were in the 1960s. Furthermore, these researchers claim there still is a necessity for innovative and rigorous social science techniques for evaluating training through performance. A combination of data analysis methods drawn from Survey Research, Ethnographic Research, and Econometric Research is applied in the following longitudinal model shown in Figure 12.1.
MRM Intervention (Changes in policy, practice, structure, training) undertaken by airlines and repair companies.
Attitudes improve toward vigilance assertiveness, collaboration, and stress management.
Behaviors expected to change due to the MRM changes (e.g., teamwork, open discussion, safe practices).
Opinions increase regarding goal-setting & sharing, and safety climate.
Safety and productivity improvements are related to attitude and behavior changes.
Figure 12.1: A Longtitudinal Model for MRM Evaluation
The USC/SCU Data Base Since 1991 we have been evaluating MRM-type interventions in U.S.-based aircarriers and repair stations. Those interventions include major programs in four large airlines and smaller interventions in four other airlines and repair stations. In several sites, data collected have covered the spectrum from base-line measures of attitudes and performance to follow-up attitudes and behavior surveys and performance data collected many months, even years, after the onset of the MRM programs. In other locations more limited attitude measurement and few to no performance measures were available. In all, our data base now contains the MRM/TOQ responses from over 7,000 individual aviation technical-operations employees, from all levels and functions (and more than two-thirds of those respondents have completed multiple versions of the survey), as well as some 260 measurement-months for nearly 150 separate stations and repair locations (over 11,000 data points of performance measures). This data base provides a rich source of information on the effects of MRM programs. The most important findings to date include Level 1 information about the degree of enthusiasm such programs elicit, Level 2 information about the effect of MRM programs on attitudes changed over time, and Level 4 information about the effects of the programs (and of the attitudes changed thereby) on safety and productivity.
HOW EFFECTIVE IS MRM AND HF TRAINING? Enthusiasm for the potential of MRM training is high immediately afterward. From the beginning of its use in maintenance, MRM-type training has been enthusiastically embraced by its participants – especially immediately following the training. Figure 12.2 shows that effect for five separate maintenance samples measured between 1991 and 1998. At least 60% of these maintenance participants
in all five sites feel strongly that the MRM training they just completed will be useful. To obtain a perspective on how strong this maintenance response is Figure 12.2 also includes a typical flight operations sample following their CRM training (Helmreich, 1989). Although flight crews see their CRM training as very useful, the comparable maintenance response is stronger by far.
Figure 12.2: Immediate Post-training Reactions: 'This training will improve safety and teamwo These results in enthusiasm are generally consistent with other reported CRM and MRM training research projects (e.g., Helmreich, 1989; Taggart, 1990; Taylor, 1998). Differences in particular results across companies are more often found in the resulting values and opinions actually shaped by the training. Such differences are likely to be the result of phenomena including, but not limited to differences among the design of the MRM programs and among the organizational cultures (Marske & Taylor, 1997) of the companies themselves. Attitudes reflecting MRM values increase 15-25% (and more) immediately after training. Across all companies we have studied since 1991, MRM-type training has produced a change in participant values consistent with the focus and direction of that training (Taylor & Robertson, 1995; Taylor, 1998). Each company has designed and delivered its training program consistent with its purpose for that training, whether implicit or explicit. Both the increased endorsement of values following training and the different profiles produced by the different programs are evident in Figure 12.3. For example companies 'A' and 'B' show a least a 15% improvement in agreement with the value of participative decision making, while the added company, 'D,' shows the greatest increase in that value. Company 'B' on the other hand shows its greatest improvement in values of teamwork and it displays the only improvement in valuing assertiveness immediately after the MRM training. The relative results among these three companies are not coincidental and their patterns match the emphases of their programs.
MRM and Improvements in Safety: What is the Evidence? MRM training leads to lower occupational injury and aircraft ground damage – with high dispatch
reliability. In 1995 we presented evidence that a multi-year MRM-type training effort for maintenance managers and staff professionals had clear and positive connections with subsequent trends in safety without sacrificing flight line productivity (Taylor & Robertson, 1995). That report also established the association between improvement in MRM related attitudes (especially “assertiveness”) and improvements in safety performance. The connection between MRM-related attitude changes and safety performance was later confirmed for an AMT population -- and in that case the relationship between assertiveness and performance was linked more directly and closely in time (Taylor, Robertson & Choi, 1997). Studying another MRM intervention with an even larger AMT sample, that direct and timely effect of increases in MRM values (especially the importance of recognizing and managing stress) on subsequent safety performance was further confirmed (Taylor, 1998).
Figure 12.3: MRM Training Effect on Agreement with Values
WHAT ARE THE CHALLENGES FOR MRM? In recent years airline maintenance departments, large and small, have found encouragement and assistance in undertaking their own MRM programs. Major trends include an emphasis on specially created MRM training for AMTs as well as sometimes including familiarization programs for maintenance managers designed to emphasize the importance of safety and communication. These trends are well intentioned -- and as described above, highly successful in the short run -- but obstacles and pitfalls remain for the unwary. Particular problems include the over-emphasis on training
AMTs and allowing a resulting under-emphasis on simultaneously training maintenance managers to achieve the same communication skills and embrace the same safety culture as their wage-grade workforce. That problem is exacerbated by MRM training which is implemented as a stand-alone program and not part of larger, on-going programs to change maintenance culture toward greater teamwork and safety consciousness. Often such stand-alone training is given a fixed and limited period of time -- half a day, one day, or even two days -- which does not address specific skills training to help participants learn to “walk the talk” as well as “talk the talk.” In other words the current trend for stand alone MRM training for AMTs risks losing true management support, as well as losing the opportunity for AMTs and managers to practice the most important skills of MRM -- cooperation and open communication. Recent experience seems to illustrate that effect. Despite the many positive results above, continued enthusiasm for MRM programs seem problematic to maintain. In one site recently studied a marked decline in reported usefulness of MRM training and the increased frequency of negative comments about how the training is applied were noted two months and six months following training. AMTs had high initial hopes for the training's impact -- but they fall off dramatically (Taylor, 1998). Evidence for diminished motivation to change. Figure 12.4 shows mean scores for six attitude and opinion scales measured over time. Comparing these AMTs’ attitudes immediately after their training with their pre-training attitudes showed significant improvement on three scales. Figure 12.4 shows that values espoused in the MRM training about participation, teamwork, cooperation -- as well as the values of managing stress -- all rose significantly after training. Furthermore, these changed values were not a flash in the pan, but they persist over time. Additionally, participants’ assessments of goal sharing at work increased following the training, but then fell back later. Because AMT participants came to the training from different work units and sometimes different shifts they could (and did) recognize their common ground and their 'goal sharing' scores confirm this. However, in the following months, that positive opinion diminishes and the six-month score is significantly lower than the immediate post-training survey. Goal sharing has not yet become a robust feature of everyday working life. It has not yet replaced the old culture practice of management goal-tending. Assessment of maintenance department 'safety climate' remained unchanged. This opinion scale measures respondent's assessment of the availability and effectiveness of local safety-related practices and policies. Figure 12.4 shows a fairly high assess of the safety climate overall -- but it also shows little change in that assessment over time. It is not surprising that ongoing policies and practices are not seen to change in the pre- and post-training surveys -- even when safety awareness is a central focus of this training. It is disappointing, however that the safety climate is not seen to improve in the months after the training. These results plainly say that MRM training, in itself, is not enough to effect fundamental departmental practices. In the eyes of the AMTs the safety climate did not improve.
Figure 12.4: AMTs' Views About MRM Topics Over Time Figure12.4 shows that some important values earned higher marks, and stayed that way. The value of assertiveness dips first then increases in the months following training. That spike of improvement after six months reveals an energy to act. That energy might be seen as arising out of frustration over the difference between the heightened desirability of assertiveness and the existing system's tendency to dampen its actual practice. Performance Changes Related to the MRM Training. In the 18 months following the onset of MRM training the safety performance for aircraft ground damage and lost-time injuries improved (Figure 12.5). Positive attitudes toward stress management 2 months after training showed the strongest correlations with low rates of injury and aircraft damage (Taylor, 1998). Stress management is a topic the MRM training program emphasizes and respondents' attitudes show that the training acheived expected improvement. Stress management is an activity that maintenance personnel can do by themselves and which does not require the involvement of others (although cooperation may benefit all parties in this regard). The training helps AMTs and their Leads improve their individual approach to handling stress. As it does so that improvement is related to improved safety. But this continued emphasis on working alone may be placing AMTs in the position of not knowing whether or how much the MRM program is working, or whether other people actually value the lessons of the training as they did. This uncertainty may lead to frustration. Reported changes from the MRM training are typical in our experience. One question included in the immediate post-training survey and in the 2-month and 6-month follow-up surveys asked respondents to list the personal changes they intended to make following the training. A further question in the 2-month and 6-month surveys asked respondents to list what changes they actually did make as a result of the MRM training.
Figure 12.5: Safety Performance Improves following MRM Training Intentions to change. Figure 12.6 presents that company's employees' intentions to change. Specifically Figure 12.6 a summarized selection of respondents' answers to the question: 'How will you use the training on the job?' Results in Figure 12.6 represent the most important and frequently stated answers. Although many other specific answers were given they accounted for smaller proportions of the total [4] and are not included here. For this reason the total percentage for any of the three surveys does not equal 100 percent. But for the immediate post training questionnaire, however, Figure 12.6 shows that three answers account for almost half of the respondents. “More Interaction” (or intending to work more closely and cooperatively with others), “Fight Complacency” (or intending to work more carefully), and being “More aware of themselves and others” totaled 45 percent of the written answers received in the
survey at the end of the training. For the 2-month and 6-month follow-up surveys, the total proportion drops to a little over one-third (35% and 34% respectively).
Figure 12.6: How will you use training on the job? Intentions to change, changed. More important than the drop in those positive intentions is the increase in more critical issues shown in Figure 12.6. The percentage of respondents saying simply that they didn’t intend to change, or who made a negative comment about the program or its effects on their future behavior, increased dramatically over time. Those two critical responses together account for less than five percent of the immediate post- training responses, but they increase to totals of 19 percent and 27 percent in the 2-month and 6-month surveys. This is a four- to five-fold increase in negative outlook with the passage of time. Like New Year's resolutions, good intentions definitely faded. Looking behind the summaries at what respondents actually said, many of the negative comments given revealed that respondents had tried to change but they were ignored, or not supported, or they had actually been punished when they tried to speak up and become more active. The culprit is the old culture, exerting its powers of self-preservation, as all cultures do when pressured to change. Cultural change does not come without resistance, ever -- not even when everybody seemingly agrees to the change.
Figure 12.7: How have you used the training? Reports of changed behaviors. Not surprisingly, Figure 12.7 shows that in the months following training results didn’t always match intentions. Although one-sixth of the respondents said that their post-training intentions were to increase interaction and communication with others (Figure 6), Figure 12.7 shows that less than half that number report actually practicing more interaction and communication with others. On the other hand, Figure 12.7 also shows that reports of working more carefully (fighting complacency) and being more aware of self and others do more-closely match earlier expectations. These results suggest that early intentions to behave differently with others in the workplace may be overly optimistic or naive. Many respondents actually favored only new behaviors that they could adopt passively or by themselves. “Stress Management” is an example of this trend toward individual and private action. Although too few AMT respondents specifically state that they will subsequently apply the lessons learned about managing stress to show in Figure 12.6, many do report acting more carefully and self-consciously in the months following training (Figure 12.7). Being thorough, fighting complacency, being aware of one’s own impulses and feelings and observing those of their colleagues -- all of these are useful behaviors that AMTs could do by themselves. But actually speaking up, or initiating work-related conversation with others is more difficult to do without having other, larger, changes occurring in the workplace. In particular such changes require the involvement of management in the MRM training. Figure 12.7 also shows that reports of “no change” or negative comments about changing and/or the effects of the MRM training are quite high. In fact the combined percentage of “no change” and negative answers approaches 30 percent of the total for the 2-month and the 6-month surveys -- and the proportion of negative answers to the more neutral “no change” increases by nearly one-half between the 2- and 6-month surveys.
Raising AMT Participants’ Expectations For MRM May Be A Problem. If AMTs are pushed to the front of what is essentially a culture change, they then wonder where everybody else is -- and then get frustrated and/or discouraged when they don’t see enough support. Despite positive trends apparent in this and other programs, there may not be enough continued action or management support for MRM. In particular the positive effects of these programs on attitudes and performance are often not widely or quickly available for diffusion to those company’s participants. Increased involvement of the training’s past participants in survey feedback and in ongoing safety initiatives and continued attempts to improve communication may counter the negative backlash observed in the preceding example. MRM training that becomes an exercise in mere “spray and pray,” whether by intention or by accident, may sow the seeds of its own discontent. The ideas and behaviors are too liberating to expect participants to see them erode without reaction. The big payoff for the commitment by company or trade union to MRM-style change is a culture that breeds continuous improvement in human effectiveness and airplane safety.
THE SIGNIFICANCE OF THIS RESEARCH The primary benefit from this research is the timely documentation of significant effects of MRM programs as measured by positive changes in maintenance personnel attitudes and behaviors demonstrated over time and positive improvements in maintenance operations performance. Through this research the industry partners and general industry community are alerted to the best practices in current MRM and can determine what MRM elements are proving most successful in their own company and elsewhere. The secondary benefit of this program is to continue the development of a MRM training evaluation database, to confirm the importance of a longitudinal evaluation process and to provide information for future developments and improvements in such training and allied interventions for the end users. The first product is the delivery of frequent data feedback to MRM program managers, sponsors, and facilitators to help them continuously improve their own programs. Such feedback may be face to face, telephonic, or by Email. It is usually accompanied by informal documentation. Such informal feedback is largely unscheduled, but is usually as frequent as data analysis and trend visibility will allow. More definitive results and conclusions to improve MRM practice in the industry are documented for wider distribution. These reports represent a second tier of deliverables -- special reports prepared on a periodic basis for FAA and NASA, and for the aviation industry, on trends and effects observed from the data which can be used to improve practice in other MRM programs throughout the industry. A third tier of deliverables includes methods and practices to assist airline companies and other users collect behavioral data, while maintaining the conditions required for reliability and validity of those data. Over the course of the program such methods are documented and transferred to the participating companies. Such data collection methods are, however, virtually useless without parallel methods of analysis and interpretation. Interpretive tools and algorithms will therefore accompany any data collection instruments delivered. Protocols and worksheets for capturing field observations are being developed. These tools will be distributed to selected end users, in draft form for further development. Final versions of the core survey questionnaire (“MRM/TOQ”) and of ethnographic data collection
forms will be made available to sponsors and end users. The performance regarding injury and aircraft damage which are currently available may not be adequate for the future. Currently active discussion in the aviation industry is exploring a global error analysis and detection system. The collection of these more comprehensive data in more companies should be encouraged (whether they currently have an MRM program or not). A report of in-process results and implications will be prepared at the end of each year’s research (years two and three, 1998 and 1999). A major research report will be prepared at the completion of the funded period.
REFERENCES 1. ________, (1987). Industrial relations management and the maintenance engineer. Proceedings of the British Air Transport Industry Training Association. pp. 101-108. 2. Alders, B., R. Bilderbeek, & W. Buitelaar, (1989). Study into the changing duties of aircraft mechanics against the background of technological developments in aircraft maintenance in KLM. STB-TNO Centre for Technology and Policy Studies, Apeldoorn, The Netherlands. 3. Alliger, G.M., & Janak, E.A. (1990). Kirkpatrick’s levels of training criteria. Personnel Psychology, 42, 331-342. 4. Carlzon, J., (1987). Moments of Truth. New York: Harper & Row. 5. Choi, S. (1995). The Effects of A Team Training Program and Inferences for Computer Software Development. Ph.D. Dissertation, Education Department. Los Angeles: University of Southern California. 6. Drury, C., (1991). The maintenance technician in inspection. In Shepherd, W.; Johnson, W.; Drury, C.; Taylor, J.; & Berninger, D. Human Factors in Aviation Maintenance Phase 1: Progress Report. Federal Aviation Administration, Office of Aviation Medicine. Washington, D.C. 7. Helmreich, R.L., (1989). Evaluating the effect of cockpit resource management training. (Abstract) Human Error Avoidance Technical Conference. Washington, D.C. 8. Helmreich, R.L., Foushee, H.C., Benson, R., & Russini, R., (1986). Cockpit management attitudes: exploring the attitude-performance linkage. Aviation, Space and Environmental Medicine, 57, 1198-1200. 9. Kirkpatrick, D. (1979). Techniques for evaluating training programs. Training and Development Journal, 31 (11), 9-12. 10. Kirkpatrick, D. (1983). Four steps to measuring training effectiveness. Personnel Administration, 28, (11), 19-25. 11. Lima, E.P. (1995). “Pioneering in People.” Air Transport World, 32, (4) April, pp.51-54. 12. Lock & Strutt, (1981). Reliability of in-service inspection of transport aircraft structures
(CAA Paper 5013). London: Civil Aviation Authority. 13. Marske, C.E., & Taylor, J.C., (1997). “The Socio-Cultural Transformation of Transportation Safety.” In Proceedings of the Symposium on Corporate Culture and Transportation Safety. Washington, DC: National Transportation Safety Board, 14. Maurino, D.E., Reason, J., Johnston, N., & Lee, R.B., (1995). Beyond Aviation Human Factors, Aldershot:Avebury Press 15. NTSB (National Transportation Safety Board), (1989). Aircraft Accident Report NTSB/AAR-89/03. Washington, D.C. 16. Robertson, M.M., & Taylor, J.C. (1996). “Team Training in Aviation Maintenance Settings: A Systematic Evaluation.” In Hayward, B.J. & Lowe, A.R. (eds.) Applied Aviation Psychology. Avebury Press. 17. Strauch, B., & Sandler, C.E., (1984). 'Human factors considerations in aviation maintenance.” Proceedings of the 28th Annual Meeting of the Human Factors Society, pp. 913-916. 18. Stelly Jr., J., & J. Taylor, (1992). Crew coordination concepts for maintenance teams. Proceedings of the Seventh International Symposium on Human Factors in Aircraft Maintenance and Inspection -- Science, Technology and Management: A Program Review. Federal Aviation Administration, Washington, D.C. 19. Steven, M. D., & Hellweg, S.A. (1990). Toward a standard of communication training effectiveness evaluation. Proceedings of Annual Meeting of the Speech Communication Association. 20. Taggart, W., (1990). Introducing CRM into maintenance training. Proceedings of the Third International Symposium on Human Factors in Aircraft Maintenance and Inspection. Federal Aviation Administration. Washington, D.C. 21. Taylor, J.C., (1991). Maintenance organization. In Shepherd, W., Johnson, W., Drury, C., Taylor, J., & Berninger, D. Human Factors in Aviation Maintenance Phase 1: Progress Report. Federal Aviation Administration, Office of Aviation Medicine. Washington, D.C. 22. Taylor, J.C., (1998). “Evaluating the effects of maintenance resource management (MRM) interventions in airline safety.” 1997 Report Of Research Conducted Under FAA Grant #96-G-003, to FAA Office of Aviation Medicine, Washington, DC; Santa Clara University, February. 23. Taylor, J.C. (In Press) “Reliability and validity of the ‘maintenance resources management/technical operations questionnaire (MRM/TOQ)’.” International Journal of Industrial Ergonomics [Special Issue on Human Factors in Aviation Maintenance]. 24. Taylor, J.C., & Robertson, M.M., (1995). The Effects of Crew Resource Management (CRM) Training in Airline Maintenance: Results Following Three Years Experience. Washington, D.C.: National Aeronautics and Space Administration. 25. Taylor, J.C., Robertson, M.M., & Choi, S. (1997). ' Empirical Results of Maintenance Resource Management Training for Aviation Maintenance Technicians.' In Proceedings of
the Ninth International Symposium on Aviation Psychology. Columbus, Ohio, The Ohio State University.
13.0 THE INTRODUCTION IN THE ROYAL AIR FORCE OF SELF-SUPERVISION PROCEDURES IN AIRCRAFT MAINTENANCE Group Captain J. Mackreath HQ Strike Command Royal Air Force High Wycombe
BACKGROUND Although relatively small when compared with the USAF which is the world’s most powerful air force by far, the RAF is still a sizeable organization. We have almost 700 operational aircraft ranging from large wide-bodied Transport and Tanker aircraft such as the L-1011 Tristar; several different types of combat aircraft including the Tornado and VSTOL-capable Harrier; as well as medium- and heavy-lift helicopters, for example Chinook. We also operate some 350 training aircraft and 150 gliders. Strike Command now ‘owns’ all the operational RAF aircraft and these fly from fixed bases in the UK and Germany, and also in the Falkland Islands and Cyprus. We have of course always sent our large transport aircraft ‘down route’ around the globe in much the same way as any commercial operator. However, driven by the current geo-politico climate, more so than ever before all of our aircraft types now operate singly or in small packages on long-term deployments such as those in support of peacekeeping in Bosnia and to help maintain the no-fly zone in Iraq. Also, to make use of the excellent range facilities not available in Europe we take a full part in annual USAF-run Flag-style exercises in Nevada, Florida and Alaska; in the Canadian Forces Maple Flag in Alberta; and fly regularly from Goose Bay in Labrador. We also take part in multi-national exercises in South East Asia, the Gulf, and Eastern Europe. The UK Ministry of Defence has its own regulatory framework to govern military aircraft design, operation and maintenance, so we establish and follow our own maintenance practices and procedures. Most of the maintenance work on our aircraft and their equipments is carried out by RAF engineering tradesmen although there are exceptions such as in the case of the BAe 146/RJ series and the Raytheon 125s we operate from RAF Northolt, both of which are maintained by a Contractor following RAF procedures. Some of our aircraft have always operated in unusual circumstances: for example, Harriers and our Support Helicopters fly from rural ‘field’ sites working with the Army. More significantly we now routinely need to be capable of operating virtually all our aircraft fleets from airfields with no or very few maintenance facilities. This has put our operational flexibility at a premium and prompted us to look very closely at our maintenance procedures to ensure we are optimising the use of our aircraft engineering manpower. For over thirty years all aircraft-related maintenance activity in the RAF has been underpinned by a formal, auditable documentation process involving two signatures: first that of the individual doing the work and then a counter-signature by a supervisor. This Paper describes an initiative to introduce a system of what we describe as ‘Self-Supervision’. In effect this means that carefully selected individuals are empowered to carry out and sign for maintenance work without direct supervision by a second person. We recognise that this move away from a ‘dual check/dual signature’ procedure increases the potential
for Human Factors considerations to induce maintenance error, with significant airworthiness ramifications. We are therefore introducing the new Self-Supervision process in a measured manner. Against that general backdrop and to aid understanding of our approach to Self-Supervision an explanation is first necessary of the general structure of our maintenance workforce and documentation system. Therefore, this paper includes the following main sections: a. Our maintenance personnel and their roles as producers and supervisors. b. The original ‘checks and balances’ in our maintenance work and documentation processes. c. Our Self-Supervision terminology. d. How we select and evaluate our Self-Supervisors. e. Our Self-Supervision implementation procedures. f.
A short review of progress and the benefits gained.
RAF MAINTENANCE PERSONNEL - PRODUCERS AND SUPERVISORS RAF Producers and Supervisors There are approximately 12000 uniformed aircraft maintenance personnel in the RAF spread between the flight-line operation and base hangars on our main operating bases, and our repair and overhaul depots. All RAF maintenance activity, both on-aircraft and component maintenance off-aircraft, for example on aero-engines, is very closely controlled. There is naturally a comprehensive suite of maintenance manuals and procedures for each of our aircraft and equipment types, which relate directly to the skill and knowledge within our aircraft maintenance trades of Airframes, Propulsion, Electrics, Avionics and Weapons specialisations. As a military organization we have a rank structure which we exploit using regulations linking the various ranks with status as maintenance Producers, Supervisors and Junior Managers, thus reflecting the skill and experience of an individual as his career progresses. The ranks and status are as follows: a. Leading Aircraftsman (LAC)
Producer (needs close supervision and instruction in his first year of productive work after initial training).
b. Senior Aircraftsman
Producer.
c. Junior Technician
Producer.
d. Corporal
Producer/Supervisor.
e. Sergeant
Producer/Supervisor.
f.
Producer/Supervisor.
Chief Technician
g. Flight Sergeant h. Warrant Officer
Junior Manager. Junior Manager.
LONG-STANDING ‘CHECKS AND BALANCES’ IN RAF MAINTENANCE PROCEDURES Maintenance Work Signature Chain All RAF maintenance activity is recorded and signed for. A mandatory signature chain was introduced in the early 1960s at the onset of the Cold War when we tended to operate permanently from large well-formed bases in this country and Western Europe. The signature chain introduced then is still in use today and is as follows: a.
The signature of the individual who has carried out the task, i.e. the producer.
b.
A countersignature by the task supervisor.
c.
A co-ordinating signature, usually by a Sergeant or above, to certify the integrity of the
documentation.
Independent Inspections and Vital Checks We also employ a similar safeguard to the ‘duplicate inspection’ procedure followed in UK commercial aviation. Our regulatory framework stipulates that ‘independent inspections’ are to be carried out after maintenance work on most aircraft flying control systems, undercarriage, brake and ejection seat systems. Here, of course, safety considerations are paramount, and we need to take the extra precaution to ensure that the disturbed system has been re-assembled and functions correctly. Additionally, following work on ejection seat systems, ‘Vital’ checks are mandated at defined stages of installation to ensure that all locking, routing and installation processes are satisfactory. It is not necessary in the course of this Paper to describe the ‘independent’ and ‘vital’ check processes in detail. Suffice it to say that they both involve an extra pair of eyes looking at the maintenance work, and the formal recording that this has taken place.
SELF-SUPERVISION TERMINOLOGY
Self-Supervision Study In 1993 the RAF carried out a detailed study into the benefits of introducing Self-Supervision, which you will recall involved moving towards a ‘single-signature’ concept for selected individuals. The study recommendations, which were subsequently endorsed by the Air Force Board, included a full appraisal of CAA regulations for training and licensing aircraft maintenance personnel. The agreed way ahead was the introduction of Self-Supervision, subject to rigorous authorization, certification and tasking procedures.
Self-Supervision Terminology At this point, I need to introduce some more terms which now form part of our maintenance ‘vocabulary’: a. Type Specialisation. Although for very many years we have had a system of recording an individual’s experience of working on a certain aircraft or equipment, as part of our move towards Self-Supervision we have introduced a more formal Type Specialisation procedure. Now, when an individual has accumulated on-type aircraft or equipment experience and systems knowledge over a period of approximately 2 years, his line management judge whether or not he can be considered ‘Type Specialised’ on that particular equipment. Type Specialisation is the first building block in our Self-Supervision procedure. Once an individual achieves Type Specialisation on a particular equipment, he retains that qualification as he moves around from base to base on posting (or transfer). However, the authorization lapses if he does not work on the particular equipment concerned for a period exceeding 2 years. b. Self-Supervision. In our terminology Self-Supervision means that an aircraft maintenance engineer has the authority to discharge the responsibilities of task supervisor as they apply to work he also completes as the ‘producer’. A Self- Supervisor’s signature on the appropriate documents certifies that he takes full responsibility for the quality and completeness of the work tasked. An individual gains Self-Supervisor status at his particular base or unit. When he leaves that unit on posting he does not automatically take his Self-Supervising powers with him to his next unit; and local management there will re-assess his capability and decide if and when he may re-gain the authority to Self-Supervise. To take this explanation a little further, we also have two different categories of Self-Supervision; Full or Limited as defined as follows: (1) Full Self-Supervision. Only Type Specialised NCOs, that is Corporals, Sergeants and above may be authorised as Full Self-Supervisors. A Self-Supervisor’s ‘power’ extends to all tasks designated as being within his or her Type Specialisation annotation. (2) Limited Self-Supervision. Any of our aircraft maintenance engineers, except for our LACs (who are in effect still ‘in training’), may be authorised as Limited Self-Supervisors. This enables them to carry out specific, simple and repetitive maintenance activities under the ‘single signature’ philosophy. (3). Tasks Which Are To Be Fully Supervised. In principle Self-Supervision can apply to all maintenance activities. The one exception to this is that, for the time being, we continue to require all maintenance work on ejection seats to be subject to the ‘two
signature’ philosophy. However, more generally, the relevant RAF Engineering Authority, that is the office which approves the maintenance manual for a particular equipment, decides whether there are certain other tasks which must continue to be fully supervised. This is done using the simple algorithm at Figure One and by considering the flight safety implications and the need for independent and vital checks associated with specific activities. Each aircraft or equipment maintenance manual now contains a list of activities where the full ‘two signature’ procedure is always to be followed, and Self-Supervision is not permitted.
HOW WE SELECT AND TRAIN SELF-SUPERVISORS Having explained why we have decided to introduce Self-Supervision, and the terms and basic groundrules we use, I shall now describe how we go about selecting and training Self-Supervisors.
Local Procedures Probably in much the same way as commercial operators and maintenance organizations, at each of our flying squadrons or maintenance units we appoint a ‘Trade Manager’ for each of our maintenance specialisations (Airframes, Avionics etc). Normally, the Trade Manager is of Chief Technician rank. As discussed later, the Trade Manager plays a vital role in selecting and ‘educating’ potential Self-Supervisors. Also, as part of the process of introducing Self-Supervision on our various units, we have introduced Standards Cells, which I shall speak about in due course. However, before doing that, l first need to describe our process of ‘Boarding’ an individual for Self-Supervision. We regard this as a very important milestone, and a key safeguard measure which helps us to ensure that the risk associated with adopting a ‘single signature’ approach is minimised.
The Squadron Board A Board is convened to assess an individual’s suitability before he is authorised as a Self-Supervisor. We deliberately make the Squadron Board a formal occasion. Chaired by the Officer-in-Charge (always an engineer) of the particular maintenance squadron (a Squadron Leader or Major), Board members also include the squadron Warrant Officer (Chief Master Sergeant), the relevant Trade Manager and a representative from the Standards Cell, which I mentioned earlier. The Squadron Board: a.
Checks the individual’s awareness, understanding and acceptance of the added responsibilities he will hold when employed as a Self-Supervisor.
b.
Determines his attitude towards: (1)
Airworthiness.
(2)
Flight Safety.
(3)
Health and Safety.
(4)
Quality Assurance.
(5)
Engineering husbandry.
c.
In the case of a candidate for full Self-Supervisor status, the Board also checks that the individual fully understands the systems on which he is employed, and that he has successfully completed a broad spectrum of representative trade tasks.
d.
For potential Limited Self-Supervisors, the Board confirms that the candidate understands fully that his ‘single signature’ authority is confined only to those very specific maintenance tasks listed in his personal ‘log book’ by his Trade Manager.
Following assessment as suitable by a Squadron Board, the unit’s Chief Engineer personally authorises an individual as a Full Self-Supervisor; the Chief Engineer may delegate the authorization of Limited Self-Supervisors to Squadron Board chairmen.
The Role Of The Trade Manager The Trade Manager obviously has a very important role to play in the assessment and preparation of individuals for Self-Supervision. He knows his people and their working environment. Therefore the Trade Manager: a.
Constantly monitors and reviews an individual’s performance and attitude, and through this his suitability to Self-Supervise.
b.
When the individual achieves Type Specialisation, and is ready in all respects, agrees the individual’s nomination with his line management.
The Trade Manager also must monitor the work of all authorised Self Supervisors and recommend removal of their authorization if required. The Role of the Standards Cell. On each unit, as we introduce Self-Supervision, we form a Standards Cell comprising 5 experienced SNCOs, one in each of our main trade specialisations, and headed up by a Warrant Officer. The Cell reports directly to the unit’s Chief Engineer, and its role is to: a. Prior to an individual’s Squadron Board, provide local training on the general principles of Self-Supervision to ensure that he fully understands the Self-Supervisor’s role and responsibilities, and is fully familiar with the related QA processes, Orders and Instructions, and documentation procedures. b. Again prior to the Squadron Board, formally examine individuals to test their knowledge of all the Self-Supervision safeguard mechanisms. c. Carry out an Annual Standardisation Check on each authorised Self-Supervisor. d. On behalf of the unit Chief Engineer, audit by attending Squadron Boards to ensure that these are being conducted properly and uniformly in all squadrons.
The flow-chart at Figure Three summarises the path an individual follows to become a Self-Supervisor.
OUR SELF-SUPERVISION IMPLEMENTATION PROGRAMME Timescales of Introduction. We have deliberately approached the introduction of Self-Supervision cautiously through a controlled implementation programme. The result has been a long gestation period. Not only was our original study in 1993 very comprehensive but we also trialled the initiative on two units for a 12 month period to iron out all the inevitable wrinkles in our procedures, and to ensure ourselves that our maintenance standards would not become lower under a ‘single signature’ regime. However, by the end of this year, 9 of our main bases will have adopted Self-Supervision, and we aim to have completed its introduction fully before the end of the Millennium.
Implementation Procedures - Staff Advisory Team In order to confer a degree of uniformity of approach and to offer practical advice to units, we have set up an Advisory Team which spends a few months on each unit during the initial introduction of Self-Supervision.
RESULTS AND BENEFITS Benefits of Self-Supervision The general consensus of opinion is that the Self-Supervision scheme is of great benefit. In particular, the enhanced operational flexibility resulting from the ability to fix aircraft in remote locations with fewer maintenance personnel has been extremely valuable. Also some minor manpower savings have been possible in the component maintenance areas, where the workflow is predictable.
Reaction Of Personnel There were some initial misgivings and resistance to change. Some of our very experienced maintenance personnel believed there would be an inevitable degradation in standards without the ‘second pair of eyes’ observing all maintenance activity, and were reticent to accept the new concept. Also, there was a view that we needed to reward Self-Supervisors financially for the extra responsibility they would bear. We have not done this, but gradually individuals have begun to realise that authorization as a Self-Supervisor is a recognition of their skill and integrity; this itself generates a degree of self-satisfaction, but also, of course, such recognition is likely to be a positive ‘tick in the box’ when annual performance reports are completed. The net result is that Self-Supervision is being wholeheartedly embraced and has become accepted as an invaluable discipline.
Importance of Continuous Standards Monitoring So far, we have no reason to believe that our move to introduce Self-Supervision in our aircraft
maintenance process was ill-advised. However, accepting that we have actually removed some of the earlier ‘checks and balances’, we recognise very clearly that if we are to continue to maintain airworthy aircraft, an effective QA system is now even more important. Given their closely-related roles, we have amalgamated the Self-Supervision Standards Cells with our unit QA department, and this arrangement is working well. For the time being, in addition to our full programme of quality audits, we consider that the personal Annual Standardisation Check of Self-Supervisors should remain part of our quality process. That said, we shall continue to monitor the efficacy of this particular mechanism over the next few years.
14.0 MANAGING HUMAN FACTORS WITHIN A SAFETY MANAGEMENT SYSTEM Clifford John Edwards Quality Manager and Aviation Adviser Shell Aircraft Limited, London.
INTRODUCTION This paper discusses the work Shell Aircraft Ltd (SAL) has done in developing an aviation Safety Management System (SMS) and, in particular, aspects of managing Human Factors within the maintenance element of an aviation business that has developed an SMS. The same principles have also been applied in our model to manage and control the operational aspects of aviation. It would be more correct to describe SAL’s system as an Integrated Management System (IMS) because, apart from safety, our system was developed incorporating the ISO-9000 Quality Assurance model as the active tool to drive the elements of quality, health, safety and environment and complying fully with JAR-Ops-1/3.035 and JAR-145. However, first it might be appropriate to explain why an oil company is involved in developing an SMS for aviation. SAL not only operates a London-based corporate fleet of aircraft for the Shell Group, but also provides an Aviation Advisory Service to the Shell Group around the world. The Advisory Service is required by the Corporate Management to assure the safety of its aviation support operations. A stated objective for SAL is to reduce Shell’s world-wide aircraft accident rate. This requirement has for some time committed SAL to reduce the 1992 accident rate by 50% by the year 2000 and again by a further 50% by 2005. The majority of flying for Shell is carried out by contracted aircraft operators. Therefore, to achieve a real reduction in the Group’s accident rate SAL need to work with these aircraft operators, and our own in-house operations, to improve their safety performance. To aid our achieving this reduction SAL carry out periodic audits of all of contracted or in-house operations, which gives us a broad view of the status of the industry. It has enabled us to develop a number of safety initiatives which can be introduced into the operators systems where required. One such initiative is the aviation SMS. SAL recognises that developing an aviation SMS is likely to take considerable research and development effort, much of which is the same for all aircraft operations. Therefore, where possible to avoid all the operators doing this work SAL, together with others, have worked on building the core knowledge which is available to share and develop with contracted aircraft operators. The current aviation usage exposure to the Shell Group is approximately 70,000 flying hours per year of which some 50,000 are flown in helicopters. In many of our operations these hours are flown in the most hostile environments for aircraft operations. The aviation industry statistics identify that approximately 20% of accidents are related to technical or airworthiness failures and 80% to human factors. Generally, the accident rate relating to technical or airworthiness causes is reducing, but all of the investment in that
area is addressing only 20% of the problem, whereas, the Human Factors accident rate is actually increasing world-wide. In reality, little is meaningfully being achieved to stop that rise; FAA and NTSB records identified 31 maintenance error induced accidents in 30 years with 5 happening in 1995. These statistics show that relevant to the flying hour levels the number of maintenance related incidents have doubled in the last ten years, and there is no evidence to show this trend is slowing. Shell’s accident record mirrors that of the industry although, over the last ten years, SAL has seen some improvement in the Shell Group accident rate. However, the reductions in the accident rate achieved to date are not enough to meet SAL’s objective, hence the commitment to introduce an aviation SMS. The benefits of Safety Management Systems were recognised in the Cullen Report, which followed the Piper Alpha disaster. In that, oil industry companies were charged to demonstrate clearly that they and their supporting contractors had systematically examined every safety critical activity in their business and taken steps to manage the hazards identified. This required an analysis of the facilities and systems, the identification of latent hazards with the potential to cause harm and the measures taken to control them. This resulted in the production of a Safety Case which is a statement of fitness for safe operations; to systematically manage the hazards identified it was necessary to build a Safety Management System. Shell Aircraft drew from the experience the Shell Group has gained in developing Safety Cases and Safety Management Systems for off-shore and on-shore facilities whilst building an aviation specific SMS model. Within Shell, all offshore facilities now have Safety Management Systems and the Shell Group has a declared requirement for all its direct contractors to have achieved the same status by the end of 1999. Aviation operators supporting Shell Group Companies fall into this category.
SAFETY CULTURE It is SAL’s view that the introduction of an SMS may require a culture change in the aircraft operator. Culture changes can only be achieved if the management openly demonstrate commitment to change to gets “buy-in” from the staff. The culture generally found in industry today is potentially a hindrance to the furtherment of safety, because deep down both staff and management believe they are safe enough. Aviation companies tend to accept the levels of incidents as being the price of doing business, and generally don’t believe accidents can happen to them; in reality, if the industry chose to, it could be a lot safer. However, there is cost in effort, commitment and up-front investment. This paper does not suggest that safety should be sought at any cost, because the price of addressing the extremely unlikely might be very high. Indeed, part of the development of an SMS requires the operator to establish what level of risk is acceptable. Therefore, it is essential in the objective setting for the Company to initially state what the SMS is trying to manage and to what level of risk. It will take time to change the culture of a company and management should be prepared for several years of repeated effort to achieve this. However, the potential rewards could be as much as an order of magnitude improvement in accident rate in ten years. The culture sought, needs to be based on a number of things: • trust of the management by the staff, • an open reporting culture, • a communicative culture and, importantly,
• a Just Culture. These elements could build the framework necessary for change but they can only be born out of management’s demonstrated commitment to the prime objective of safer operations. To underpin the safety culture of the company, the systematic approach of a Safety Management System allows the company to review the business and aid the introduction of safety improvements.
Safety Management in Engineering Safety management of engineering in aviation requires the company to consider why maintenance is done, for what benefit and to what standard; in its simplest term maintenance is the “management of actual and potential failures”. If that premise is accepted, then engineers will recognise an SMS as the “maintenance programme” for the company’s systems. Therefore, in the same way that operators and aircraft manufacturers design maintenance programmes to reduce the risk of failure to a predetermined level, the operator should design the SMS to reduce the risk of release of a potential hazard to acceptable and manageable levels.
THE SHELL AIRCRAFT SMS MODEL Concept The methodology SAL used to design an aviation SMS was to identify all the processes and subordinate activities carried out in the company’s business, resulting in a Business Process Map (BPM). Each activity is then analysed to find those that are safety critical. Those activities are then further broken down to identify the tasks that are to be done, the competencies needed to do the tasks, the procedures that apply the required level of control and the hazards that exist in any task, for example, inflating a high pressure tyre. Using this approach of analysis of the business it is possible to identify all the hazards and the controls necessary to reduce the likelihood of the release of each hazard. In this context, “hazard” is defined as that which has the potential to cause harm, injury or damage. Once a hazard is identified the operator should try where possible to either remove the hazard, reduce its potential, or at least manage that hazard. Hazards will always exist; however, it is controlling their potential to cause harm and reducing the damage caused when they are released that is important. For example flying itself is a hazard, as the aircraft in motion has both kinetic and potential energy. To remove this hazard requires the operator to stop flying, an unlikely scenario. Alternately, to reduce the hazard we are able to use “safer” aircraft, cut to a minimum the amount of flying being done, build in system redundancy, or improve the operating procedures.. However, ultimately the measure most often taken is to ensure that the hazard is managed in the best way possible through controls in place to maintain the hazard within safe operational criteria; steps such as effective procedures, training, quality assurance and supervision can mitigate the risk of hazard release. The controls necessary are simply effective barriers which reduce to acceptable levels the likelihood of the release of the hazard. The controls identified in the SMS also need to ensure that suitable recovery measures are established to deal with the consequences of a release and return the situation to normal. Therefore, it can be seen that a safety management system does not propose safety at any price, but a structured approach to manage the risk of release of the hazards that could do the most harm to the
company’s staff, assets, customers or reputation, all of which are the key reasons for being in business.
Structure The Model SMS SAL developed uses a custom designed computer software tool to manage the information, known as SAMS. However, the software tool in itself is not an SMS. The SMS is the structure of management for safety selected in the operator’s company. Underpinning and describing that structure is a manual, which SAL consider to be the headline manual of the Company. This manual sets out the policies, objectives and mission statement; it also describes the methodology by which the SMS is enacted. In our model it also forms the Company Quality Manual based on ISO9002. However, to avoid unnecessarily increasing procedures or regulations, something the aviation industry does not need, the manual simply uses cross references to the Operations Manual, Maintenance Exposition and company procedures. Our SMS manual is structured in five parts containing: Part 1
Introduction - Policy - Standards - Quality Model - Business Process Map and methodology of application of the process.
Part 2
Is set out in three functional sections, Engineering, Operations and Company Management. These detail in the form of checklists a breakdown of the BPM into activities and tasks together with the competencies of staff and the procedural cross references the staff need to carry out the tasks. The output of the Part 2s is a listing of hazards pertaining to the various activities (interacting with Part 5); and the shortfalls against the required controls noted in any activity and task checklists feed into the remedial action plans (held in Part 4).
Part 3
Details the documents and manuals used in the company.
Part 4
Holds the remedial action plan; this is the health check of the operator, listing all the shortfalls and non-compliances currently extant in the company.
Part 5
Describes the Hazard Management, detailing from the output of Parts 2 what hazards exist in the Company and completes a risk analysis of each hazard. It also identifies what threats could release the hazard and what control barriers are in place or are needed to manage each hazard. This part also includes the escalation factors that might make the initial hazardous event worse if it is not controlled; it also identifies the consequences of releasing the hazard and if possible what recovery measures might restore the status quo. The output of Part 5 goes to Part 4 as remedial action plans to resolve shortfalls. Part 5 also forms a key part of the Safety Case.
CONTROL OF HUMAN FACTORS WITHIN AN SMS Human Factor issues impact on operational and maintenance activities in many ways, and already much work has been done, both theoretically and practically, to better understand the problem and reduce its potential to cause harm. To date, the bulk of the work has focused on flight operations, which is probably correct given that the potential effects of error in that environment is greater. However, as yet work on engineering is only scratching the surface of human factors in the working environment. Addressing human factors within an SMS industry should start from a base line which recognises that aircraft maintenance is not benign. The act of intervention in the aircraft systems adds potential risk; this risk should be taken into account as part of the assessment of hazard management and risk reduction. Wherever human error arises it is a potential hazard to safe operations and as such can be managed within the SMS. The hazard analysis process already described should identify the hazard, the threats that could release it and the control barriers necessary to control it. In the case of human error these are often soft barriers, such as effective procedures, compliant practice, communication and training. Soft barriers are less easy to manage than facilities and equipment and completed documentation, but nonetheless must be addressed in the analysis if the SMS is to be robust. There is a shopping list of known problem areas that exposed the potential release of human error triggered incidents; these include: • workplace environment • poor hand over of work at shift change • workload of individuals • poor procedures and • non-compliant practice • lack of supervisory oversight • time pressures • tooling/equipment availability • night working If viewed from the hazard potential viewpoint, measures can be taken to protect the company from any of these hazards. Experience to date has shown that most companies find it easier to address the hard barriers such as workplace lighting, quality assurance inspections on night shifts and tooling availability, whereas, other opportunities are largely ignored. For example, in an industry where pilots line checks for compliant practice are mandated, no such requirement has been introduce by the operators or the regulators for engineers. (Reference “On the Racing Line” Edwards 1996). A strength of having a Safety Management System that systematically reviews the business and identifies the problems that the workforce face, is that it gives the management the structured opportunity to address the most significant issues before those problems become tomorrow’s accidents. A supporting structure of internal audits, safety meetings, toolbox (pre-job) briefings and, importantly, the line’s use of SMS checklists are all aids in keeping safe working in the engineers’ focus. These measures are operational
tools for cross checking every aspect of the activities that the company undertakes. The feedback from such aid the management to address the most critical current problems.
Workplace Environment The initial review of the activities a company undertakes identifies the locations that work will be carried out at and as part of that the hazards relating to that worksite. Supporting this, the process of structured safety audits by teams using the SMS checklists caters for the worksite to be reviewed on a regular basis and noted shortfalls to be logged in the remedial action plans. The environment can include working conditions, weather, lighting, equipment and tooling required to support any task.
Poor Handover of Work Shift handovers have been a recognised problem for more than 30 years, although in that time little improvement has been achieved; neither has there been any Regulatory requirements introduced to reduce the problem. We consider that stronger disciplines in diary management are needed and that the handover log should be a historical record of the days work filled out as the day progressed, and not a list raised at the end of the shift from memory. The SMS review should identify shift or work handover as an essential control barrier
Workload of Individuals As part of the process of risk identification time allocation for tasks, including preparation, should be considered when establishing control barriers. Normally, workload is not the initiator of an incident, but is frequently an escalation factor that allows the situation to deteriorate therefore, adequate manning levels are treated as required escalation control barriers. It is our view that a working hour limit for engineering shifts of 12 hours maximum should be imposed.
Poor Procedures Any of us can put procedures or task cards in place, but it is the relevance of these and the engineers’ compliance with them that really matters. Poor procedures lead engineers to lack respect for them which encourages the use non compliant, potentially dangerous practices. Procedures are often seen by maintenance staff as guidance material for the engineer to interpret, which is incorrect. They should be step by step instructions that should be literally applied. Part of the activity analysis process identifies procedures as control barriers. If procedures are to be effective, then they must be periodically reviewed; if nothing else procedures should be checked to see if they can actually be achieved as written, rather than needing interpretation for their intent. If it is a company procedure we are able to take direct action to resolve any ambiguity. If it is a manufacturers procedure then it is essential the manufacturers processes address the problem and allows for all of the industry to benefit from improved clarity. One positive aspect of reviewing procedures is that if done properly it will consolidate and reduce the number of procedures engineers need to consider when doing a task.
Non-Compliant Practice
Management cannot fix what it does not know is broken. Within aircraft engineering very little compliance monitoring or audit is carried out. Aircraft engineering is heavily populated with “can do” people, which usually manifests itself in a culture of their not telling management about the problems being faced and engineers using their ingenuity to overcome problems. Often when investigating incidents it is possible to see that the causal factors were not isolated one-off aberrations of the individual, but in reality are the systematic practice of the majority of staff. Such non-compliant practice is classified as a violation. (James Reason 1990) Within the aviation industry’s working environment, there is frequently little time available to read and use the procedures in task-cards, or maintenance procedures. It is common practice for maintenance staff to work from memory once he has done a task more than twice, possibly referring occasionally to the task card or procedure. If work is routinely done from memory it is only a matter of time before personal practice are introduced. These personal practices may differ between the staff and not meet the task design requirements and unintentionally may be unsafe. Frequently management expect the maintenance staff to work from memory, calling it expediency to get the aircraft back in the air. If nothing goes wrong, the engineer may get praised, but if there is an incident he will be criticised. The SMS considers compliant practice an essential escalation control barrier. If the control is to be effective it needs to be routinely tested. A paper I presented in 1996 on Process and Practice Monitoring suggested that operators should monitor the practices of their engineers periodically using a similar approach to that used for pilots in the “Line Check.” This process, carried out by the immediate supervisor had the added benefit of reviewing a procedure for relevance and ability to be achieved as a literal instruction. Process and practice monitoring is not a trapping exercise; after all, engineers and technicians are not bad guys who set out to make mistakes or violate procedures. It is usually latent failures in the company systems and procedures that trap them into errors, believing they are optimising their efforts to get our aircraft back on line expediently.
Lack of Supervisory Oversight In many aviation companies, cost related cutbacks have reduced manpower, which has resulted in staff supervision being a task that few Supervisors have time for. A percentage of the work which any supervisor should be doing is that of over-viewing their teams’ work, but in many operators this is no longer the case. The supervisor can give guidance, see shortfalls in resources, equipment, spares or tooling, maintain the shift log history, establish priorities and monitor the staff; these are all control barriers which an SMS would require to be in place. If we are to learn from the mistakes of others, it is necessary to avoid using the shift supervisor as just another pair of working hands. The supervisor is part of the safety net for his team and as such he cannot be his own safety net; nor should the industry accept his working without a safety net.
Time Pressures Maintenance organizations in the aviation industry are struggling to maintain commercial advantage over their competitors; in fact the situation is worsening if anything, particularly where airline engineering has been established as a separate company. The SMS workplace audits should identify insufficient time allocations and feed this back through the remedial actions to the planners who can then allocate adequate time for the job.
Night Working Night work is endemic in aviation and therefore cannot generally be avoided; the aircraft is an asset which must be optimally utilised to make the investment pay. Therefore, the control that an aviation SMS seeks is: a suitable environment, adequately lit, with working practices and procedures in place which are correct and mirror those used in the day shift carried out by staff who have not had excessive duty periods. The operator should have established quality assurance checks during night shifts to check the quality of the work produced including all those items listed.
Tooling/Equipment Availability An SMS requires all the tasks being undertaken to be adequately resourced, and provision of equipment is a control barrier. If the tooling or equipment is unserviceable or unavailable then temporary injunctions to the task should be raised to warn that if the task has to be completed during the shortfall then special precautions should be applied. Shortfalls in equipment and tooling are areas where engineers are at their most inventive and learning from the mistakes of others identifies how essential these control barriers are.
POSITIVE SMS ACTIONS Training One of the key steps required in an SMS is provision of competent staff. The competencies required to maintain aircraft encompass basic knowledge, aircraft type courses, company procedures, and regulations. Additional competencies called for in an SMS would be workplace safety training, knowledge of quality assurance principles and human factors training. Engineering human factors training, initially based on the Crew Resource Management (CRM) training is still being developed, but has already been introduced into a number of companies. Those companies that have given the most consideration to human factors training are orienting their course material to engineering to ensure its relevance to engineers; when developed specifically for engineers the training is known as Maintenance Resource Management (MRM). The training should give the workforce, including management, an understanding of their interaction with others, situational awareness, decision making, physiological issues, communications, and the necessity of feedback.
Motivation Management need to motivate the staff to be committed to the Safety Management System. Safety improvement needs to be understood, and believed in, and must be seen to have at least equality with commercial pressures. The perception that rewards arise from getting the job done by doing whatever needs to be done to get the aircraft back on line should be changed to emphasis on a safe working culture. The risk assessment which is part of the hazard analysis should identify what is acceptable. When engineers believe it expedient to cut corners (optimise the task) they are also likely to be adding unnecessary risk and that needs to be controlled. Therefore it is essential that the motivation and
leadership given to staff correctly reflects that need for safety first.
Communication As in all elements of business, the need to communicate the safety requirements and establish safety accountability within the staff is the key to success. Managing human factors safely in the business requires regular demonstrated and transmitted communication of the corporate commitment to safety. If the focus is not maintained as a clear requirement then other issues such as commercial pressure will replace safe thinking and safe working in the minds of the staff. It is necessary to accept that safe working is not instinctive for human beings; we have evolved by testing the barriers that limit us and by taking risks stepping outside those limits. Consider that bravery is commonly perceived as a positive attribute, whereas it could be assessed as somewhere between stupidity and enjoyment of risk.
Investigation Most investigation processes employed by operators are focused on prime cause identification, rapid resolution and close out. However, these actions do not serve the company well. Investigation of near incidents, incidents and accidents should be carried out to identify the underlying causal factors (frequently latent failures) that allowed the incident to occur. Subsequent systematic actions should address the causal factors to remove the potential for recurrence. Currently, a review of the actions taken as the result of an investigation frequently result in the engineer being sacked. In reality unless the person had been malicious or deliberately violated the procedures, the action of firing the individual is a negative step. It will not encourage others to openly report near miss incidents nor will it remove the underlying causal factors. The management should consider if the engineer was really a bad worker with poor standards or just the unfortunate inheritor of an existing problem in the Company systems, and if he was a bad worker why had their supervisory and quality systems failed to identify it before the incident. The analytical process of an SMS seeks to identify the potential latent failures in advance of incidents or accidents. However, in the real world it is recognised that not all problems will be avoided and therefore robust investigation processes are needed to underpin the SMS. The focus of an investigation should be to identify the underlying causal factors implicated in the incident and finding ways to resolve such problems. Human factors related parts of a safety management culture should address near miss incidents. These near incidents are failures which, but for a control barrier, would have escalated into a more serious occurrence. It is recognised that there is a direct relationship between fatal accidents, serious incidents, minor incidents and near misses. The statistically proven pyramid with which most of us are familiar is just as relevant in aviation as other industries. Therefore, the controls identified in the development of an SMS can be enhanced by remedial actions raised from investigation and this can best be done by investigating the lower order incidents and thus potentially protect the company against damage to the assets, environment, customer/staff or reputation.
CONCLUSION Developing an SMS in a company is a significant task, initially requiring a culture change in the
workforce from management down. The investment in effort can result in significant reductions in the risks in the business and introduces better loss control measures in their systems. The systematic approach inevitably results in improvements in the human factors issues that lead to human error initiated incidents and accidents. As more companies develop these types of systems, there is an increasing potential for information exchange and learning from others. To achieve an effective SMS requires the involvement of the management, workforce, regulators and the customers. This interfacing helps to build a more positive relationship between these parties. The effort and investment that the development and introduction of SMS will be significant, but this can be recovered in time through the efficiencies gained and the reduction of accidents and incidents.
GLOSSARY OF SAFETY MANAGEMENT TERMS Hazard
An entity having the potential to cause harm, ill health or injury, damage to property, plant, products or the environment, production losses or increased liabilities.
Threat
Something that could cause the release of a hazard
Risk
The product of the probability that a specified undesired event will occur and the severity of the consequences.
Hazardous Event
The first event resulting from the release of a hazard.
Barrier or Control
Some kind of countermeasures such as procedures, system redundancy, competencies etc.
Escalation Factor
A secondary threat that if not controlled with worsen the situation of the incident
Escalation Barrier
Some kind of countermeasures such as procedures, system redundancy, competencies etc.
Consequence
The result of the release of the hazard and any subsequent escalation’s.
Recovery measures
Those actions required to return the status to normal.
Function
Significant groups of business process within a business, e.g. Aircraft Engineering
Process
Separate describable parts of a business, e.g. Maintain Aircraft.
Activity
The sub-parts of a business process, e.g. Replace propeller
Task
The sub-parts of an activity, e.g. Sling propeller for removal using overhead gantry.
Business Process Map
A structured descriptor of all the processes and activities that form
a function. Procedure
Detailed list of instruction and descriptions that enable a task to be carried out in a predictable and repeatable manner.
Process and Practice Monitoring
A periodic review of the working practices used and compliance with a given procedure.
Safety Case.
A statement of fitness of a single element of the business.
Incident
An unplanned event or chain of events which has caused or could have caused injury, illness and /or damage (loss) to assets, revenue, the environment or third parties.
Abbreviations Used SAL
Shell Aircraft Ltd
SMS
Safety Management System
IMS
Integrated Management System
FAA
Federal Aviation Administration
CAA
Civil Aviation Authority
NTSB
National Transport Safety Board
JAR
Joint Airworthiness Requirements
BPM
Business Process Map
ISO
International Standards Organization
SAMS
Shell Aircraft Management System
CRM
Crew Resource Management
MRM
Maintenance Resource Management
ACKNOWLEDGEMENTS In developing this paper information was drawn from the following documents: James Reason Clark, Goulter & Edwards C J Edwards Shell Group HSE
Various Papers 1991 - 1996 Safety Management Systems, (Shell Aircraft) 1995 On the Racing Line (Process and Practice Monitoring) 1996 Safety Management Systems 1994.
15.0 QUALITY MANAGEMENT SYSTEMS IN AIRCRAFT MAINTENANCE Professor Roger Wootton FEng MRAeS Dean of Engineering, City University, London
INTRODUCTION This paper differs from all the others at this conference in that the author has little involvement in the air transport industry except that I chaired the JAR (Joint Airworthiness Regulation) 145 Quality Assurance Review Team set up by the CAA-SRG (Civil Aviation Authority - Safety Regulation Group) in 1996/7 as a result of an AAIB Safety Recommendation. This is, therefore, a view of the industry from outside, from a member of the travelling public. I suppose that what impressed me most during the Review Team work was: •
The dedication of individuals in aircraft maintenance to the goals of airworthiness. Very rough calculations indicate that for UK operations, a maintenance error leading to an MOR (Mandatory Occurrence Report to the CAA) occurs about once every 5-10 million working man-hours on aircraft maintenance which equates to 50 or more working careers. Impressive as this is, the CAA believes that the total rate of incidents must improve by a factor of three over the next two decades if the airline accident record is to remain acceptable and part of this improvement must come from maintenance.
•
A key problem that the industry appears to have is maintaining the present quality and quantity of the production workforce. It is difficult to attract dedicated young engineers and provide them with the right experience to maintain this quality of workforce.
•
Whether or not management admit it or agree, almost all staff at production level believe that the pressures on them are increasing. In more cases than I would have wished, I met production staff who were under a great deal, and probably too much, stress. Where the excellent maintenance performance of the past has depended on people it may or may not be improving at all.
•
There seems to be an erosion of the respect for the licenses held by Certifying Engineers. This is a complex subject but it seems to me that the core of the safe and successful operation of UK air transport lies in licensed Engineers and it is perilous to ignore that fact.
•
Some maintenance manuals were almost universally stated as being user unfriendly. I was astonished to discover that usability of manuals plays no part in the issue of a C of A. There seems to be enthusiasm amongst many production staff to use computers and I.T. systems for information and this should be resourced by maintenance organizations.
•
The vagueness of understanding of the operation of JAR 145 throughout the industry but most importantly at the Quality Manager and Accountable Manager level.
THE WORK OF THE REVIEW TEAM The Terms of Reference of the Review Team are given in Table 15.1. The main activities of the Team were to: •
Review the legal framework of JAR 145: one interesting feature of the review is that relatively few people in the industry seemed to understand the correct relationship between the CAA and the JAA (Joint Aviation Authority) and at least in part this must be because there is no clear exposition available from CAA and JAA.
•
Visit the Accountable Managers and/or the Quality Managers of a number of maintenance organizations working under JAR 145 (including large international airlines at home and secondary bases, regional airlines, specialist aircraft operators, independent maintenance organizations and component maintenance organizations).
•
Have parallel meetings at shop floor level on a confidential basis and with others who have had considerable experience in aircraft maintenance.
•
Seek the confidential views of those on production by means of a questionnaire (with room for free ranging comments). This resulted in over 120 responses.
•
Obtain certain statistical data on, for example, the age distribution of licensed engineers, the occurrence of maintenance related MOR’s (Mandatory Occurrence Reports) and the CAA resources for supporting UK aircraft maintenance.
The evidence collected from all of these sources (about 400 recorded conversations and written submissions of various forms) provided a coherent view of the state of the industry.
Table 15.1 Terms of Reference To consider the CAA view that emphasises the importance of an effective and independent Quality Assurance (QA) System in the UK maintenance organizations. The Group should:
Review the development of QA systems and their associated requirements in the aircraft maintenance field in the UK, the USA, and at least one other JAA member country. Identify the purpose and value of QA systems and the objectives they meet in aircraft maintenance organizations by comparison with an inspection system. Review the working of a small sample of existing QA systems to evaluate their effectiveness in achieving the objectives in 2 above, and if not why not. Assess the CAA procedures and available resources for the approval and subsequent monitoring of maintenance organizations focusing on QA systems, in order to judge whether the scope and depth of CAA monitoring is sufficient to ensure compliance with current requirements and procedures. Propose new or amended requirements and quideline material which would result in more effective QA systems able to meet the objectives in 2 above. Propose new or ammended procedures for the existing JAA requirements and any new or amended material proposed in paragraph 5 above.
SOME EXAMPLE SURVEY AND DATA ANALYSIS RESULTS A confidential questionnaire was prepared and distributed to those who requested it as a result of advertisements in trade journals and notices. Over 120 responses were received. It must be noted that respondees are self selecting: those who do not have strong views or who believe that the industry requires no change are less likely to respond. However, the discussions held by independent members of the Team at the production level with certified engineers and mechanics (who were not self selecting) very much confirmed the responses to the questionnaire. A summary of the responses to the questionnaire is as follows for all respondents. Is pressure and stress on maintenance staff increasing?
Yes Sometimes No
95% 5% 0%
Do Certifying Engineers understand their responsibility for quality control?
Yes No No comment
80% 16% 4%
Are standards better today than 10 years ago (Nil responses, where the respondent has less experience, No excluded)?
Yes
9% 91%
Is the Hanger Team leader or supervisor able to control the workload or team size allocated to him? -In the line maintenance environment -In the base maintenance environment Do Supervisors and management accept their quality Yes responsibilities?
Yes Sometimes 9% 40% 15% 49% 37% Sometimes No
No 51% 36%
49% 14%
Internal QA audits
Notified in advance?
67%
Yes 19%
Sometimes 14%
No
What is your perception of their purpose?
PR Quality Punishment 33% 56% 11%
What kind of discrepancies are found?
Housekeeping Technical Both 45% 16% 39%
Are the right kind of corrective actions taken?
Yes 28%
Where errors have been reported, do management..?
Establish cause Punish Both 44% 44% 12%
Has JAR changed the way..?: Yes a) Work is performed b) The way that QA is performed
Sometimes 61%
No 11%
No 36% 68%
64% 32%
Respondees were free to add any comments that they would wish: many did. A summary is as follows: (the results are as a percentage though each response may contain more than one comment or no comments). QA department is only concerned with paperwork
15%
Commercial pressures are increasing to the detriment of quality
15%
Company authorizations are being given out too freely
14%
QA department is not independent of management
10%
Workload levels are too high: ratio of licensed Engineers to mechanics is too low
10%
There is too much stress in the job
6%
QA/CAA audits are a waste of time
4%
QA only become involved after a event
4%
QA staff are unqualified
3%
Human factors training is needed
3%
The key results are that of those responding: •
95% feel that pressure and stress is increasing.
•
80% feel that Certifying Engineers understand their responsibility for Quality Control.
•
91% believe that standards are no better today than 10 years ago.
•
About half note that the hanger team leader or supervisor does not control workload or team size.
•
Most QA audits are notified in advance. ⇒ Only half are thought to benefit quality of actual maintanance work. ⇒ Less than a third always result in corrective action
•
When errors are found, nearly 60% of the cases are thought to result in punishment of individuals.
•
I was disturbed by the number of licensed engineers who I interviewed or who wrote to me who described working in a ‘blame’ culture. I was told, for example, that to delay an aircraft departure without a very serious and obvious safety reason was ‘career limiting’. The feelings of those relating these comments to me is undeniable: whether they are justified is, I suggest, not as important as the fact that those working on production genuinely feel to be under threat in some organizations. What concerns me is that there was consistency in the responses within one or two organizations whilst many others appeared to have no staff who felt threatened or likely to be blamed for reporting an error.
•
The introduction of JAR-145 has had much more effect on the way QA is performed than on the way work is carried out.
In some cases, the results are more usefully analysed by organization. About 75% of the responses came from 6 maintenance organizations, notated A to F in Tables 15.2 to 15.5 below.
Table 15.2 Has training in Human Factors been given to you or to anyone in your team? (Percentage by organization) Organization
Yes
No
A
100
-
B
15
85
C
-
100
D
-
100
E
-
100
F
-
100
TOTAL RESPONSE: No.
20
80
Table 15.3 Are your company procedures..? (Percentage by organization)
Question
...Easy to Understand?
...Used and Followed?
Organization
Yes
Sometimes
No
Yes
Sometimes No
A
40
40
20
-
100
-
B
40
40
20
5
85
10
C
100
-
-
50
50
-
D
40
40
20
25
75
-
E
30
30
40
20
60
20
F
40
40
20
40
60
-
Table 15.4 Where errors have been reported, do management..? (Percentage by organization) Organization
Establish Cause
Punish
Both
A
50
-
50
B
40
40
20
C
20
20
40
D
25
50
25
E
20
70
10
F
60
25
15
Table 15.5 Is the relationship between flight crew and Engineers too distant? (Percentage by organization) Organization
Yes
No
A
90
10
B
70
30
C
10
90
D
40
60
E
25
75
F
50
50
The Human Factor Occurrences due to both improper installation and improper servicing have been analysed for 1992 to 1996. The results are given in Table 15.6 below.
Table 15.6 Year
Improper Servicing
Improper Installation
Total
1992
45
111
156
1993
39
102
141
1994
54
148
201
1995
60
144
204
1996
84
153
237
The age distribution of licensed Engineers as of October 1996 is set out in Table 15.7 below. Noe that the CAA statistics cannot separate those who have U.K. licenses and are employed overseas and those who retain their licenses but no longer use them as part of their employment. Table 15.7 Age
2024
2529
30-3 4
35-3 9
40-4 4
45-4 9
50-5 4
55-5 9
6064
6569
7074
7579
8084
% of number
3.3
6.7
13.4
15.9
17.2
13.5
10.6
10.8
5.6
1.8
0.6
0.3
0.2
For example, from these figures, nearly 20% of current licensed Engineers are aged over 55 which, if representative of the numbers of those active in U.K. airline aircraft maintenance, could be an indicator of shortages in years to come. Finally, some very broad statistics based on the Mandatory Occurrence Reports 1994-97 divided by the average number of aircraft in the fleet during that period and using the same lettering for each company as in previous company-split data are set out below in Table 15.8.
Table 15.8 Company
MOR’s per aircraft over period 1994-7
A
1.3
B
2.0
C
0.4
D
NO ACCURATE FIGURES
E
1.70
F
NO ACCURATE FIGURES
G
1.2
H
2.3
In the case of companies G and H, the number of questionnaires returned and identifiable by company was insufficient to analyse. In looking at those figures it should be noted that high MOR’s / Aircraft (i.e. poor) ratios could be due to: •
being lead carrier for new aircraft type.
•
having a very open management style and avoiding punishment for disclosure of faults.
•
running very short haul routes or specialist aircraft (e.g. helicopters).
That said, in the case of Company B only 5% of questionnaire respondees believed that company procedures are followed and 70% believe that the relationship between flight crew and Engineers is too distant. In the case of Company C (with the best MOR’s / aircraft ratio), 100% said that the company procedures were easy to understand and follow, 50% said that they were used (implying all of the time) and 90% accepted the flight crew / Engineer relationship. In the case of the Human Factor Occurrences involving significant risk, the numbers are judged to be related to maintenance for U.K. registered aircraft: 1995
-
6
1996
-
4
As previously noted, these are very low figures for such a large air transport activity.
THE MAJOR RECOMMENDATIONS It seems to me that the central requirement for a safety management culture in an organization is that those involved should have respect for organizational infrastructure in which they work. In the
contemporary airline environment there is a strong historical positive framework that is clouded by several factors. The first is that there is greater commercial pressure on companies and, through them, on individuals to perform to highly demanding operational requirements. I was concerned, for example, at a very high pressure on some maintenance staff at Heathrow compared with regional airports. Whether or not an airline openly declares the goal of saving money, rising up some league table of punctuality or having the lowest fares, it is clear that the management has to respond to this commercial situation. It seems to me to be a genuinely very difficult task for management to, concurrently, pass down the message that the quality of maintenance must improve so that the rate of MOR’s due to maintenance decreases and yet improve operational performance. That this has been achieved to date is of great credit to all concerned but continuous extrapolation cannot necessarily be assumed. In particular, there is an increasing pressure in the role of the Accountable Manager, a position which is central to every organization acting in air transport. Surprisingly, we found a number of deficiencies in the regulating framework for Accountable Managers. First, when appointed by a company, the choice of individual cannot be formally challenged by the CAA. Second, there is no requirement for them to have any technical knowledge, skill or qualifications; they do not even have to have a demonstrable knowledge of JAR-145, for example. It seems to me that those working on production must have respect for their Accountable Manager and, as a result, the Team has made a number of recommendations about the requirements of personnel filling this position. This will, for example, require an Accountable Manager to have good technical knowledge. Whilst it may be an extreme position, I am concerned that in some companies many production staff regard QA Audits as rather pointless. It is indicative that they do not feel that their Accountable Managers are in contact with their real, high stress, world. Another factor is the developing role of the Joint Aviation Authority. Throughout the survey, I learnt of the respect that almost everyone in the industry has for the quality of the CAA Safety Regulation Group Surveyors. I have concern that cost cutting within the CAA could reduce their numbers until their only activity is desk bound, satisfying the bureaucracy of the regulations. Also, there was comment about the ability of the CAA to oversee large organizations as effectively as it does small ones. As important is the issue of their future role under JAA. There seems to be a serious risk that the style of JAA is for greater and more detailed regulation that may diminish the authority and value of the judgement of individual Surveyors. The questionnaire responses suggest that the introduction of JAR-145 has affected the operation of Quality Assurance (and that includes an increase in paperwork) but not had any (beneficial) effect on the production work. At least in part this is because concurrent with the introduction of JAR-145 (but to be fair, not necessarily linked) the QA departments in many organizations have become remote from production and its issues and problems. Some QA departments have become edifices of the I.T. revolution, which is only really relevant to the airworthiness of aircraft if those systems are also available to production staff. We have made a number of recommendations with respect to the Quality Assurance function in organizations. Yet although there is this disquiet about JAA, most in the industry believe, incorrectly, that JAA is an authority above CAA and that in due course CAA will become the ‘agent’ of JAA. We even heard one operator who wanted to bypass the CAA and deal directly with JAA on a particular matter. Another important issue concerns the respect held in the industry of the Aircraft Maintenance License. In an era where 30% of U.K. school leavers go to universities to get degrees (a qualification that gives the recipient letters after their name whatever their subsequent knowledge of the subject studied), there is relatively little incentive for able contemporary young people to study for the licenses that carries none of the cache′ of a degree and that can in any case be lost, for many reasons, in later life. This is of no making
of anyone in aircraft maintenance. However, within the industry there has been erosion of the Licensed Engineer’s position in several ways, for example by the use of unlicensed mechanics to carry out limited and simple tasks (though it could be noted that this scheme was reported to the Review Team as being generally regarded as valuable and not misused) and by company authorizations of the equivalent of type rating (which has been the subject of rather more criticism). More clearly, there has been a general reduction of support for training and lack of enhanced salaries for those who hold licenses, particularly if not being currently used. Yet the aircraft maintenance license system is actually central to the provision of airworthy maintenance and for it to be effective, license holders must have pride in their possession and those above, below and around them in organizational terms must have respect for the possession of a license. The situation should be seen as exactly parallel to that of aircrew and the ATPL (Air Transport Pilots License). It concerns me greatly that the pressure to erode the role of the licensed engineer will increase industry-wide over the next few years as a result of the retirements even though JAR 66 is intended to arrest any decline in standards. I have the impression that there is insufficient training and education going on in the aircraft maintenance industry at present. It is simply not acceptable for operators to plan substantial aircraft fleet expansion and yet expect to be able to recruit qualified and experienced maintenance staff from the open labour market. With every airline and maintenance organization expecting to do the same it is obvious that there will soon be no pool. There is a need for industry-wide assessment and if need be, collaborative action in the recruitment, training and education of Licensed engineers. It might be thought by some outside the industry that the solution to most of these problems might rest with greater regulation, notably in the three areas of hours of working, shift handover and ratio of unlicensed mechanics to licensed engineers in any team or shift. However in my view, such regulation is by its nature complex and tends to inhibit rather than encourage best practice. The Review Team decided against more regulation in these areas, though with respect to working hours it is expected that the U.K. will incorporate the EU Social Chapter soon and that this legislation will place adequate limits on working hours. Respect for the framework of airline maintenence depends on individuals being able to take the right level of personal responsibility and that the whole industry adheres to the best practices available. There are some threats in the Team’s report in this area: for example reports of MOR’s related to maintenance will in future have to include details of the hours worked by those involved prior to the event and the qualifications and workload of the team.
OTHER RECOMMENDATIONS There are a number of other areas where the Review Team made recommendations. These include: Aircraft maintenance manuals should be easy to use by production staff. Apparently, the usability of manuals does not form part of the C. of A. requirement. Given the widespread criticism of some manuals this is unsatisfactory even though operators can and do produce their own job cards summarising the official manuals. One obvious problem is that such card (or I.T.) systems may not pass on to second and subsequent owners of the aircraft. We found considerable interest in the use of V.D.U. screen-displayed manual information and this does need to be developed for wider use. Given that some aircraft types last for 40 years, it is important to put
the maintenance manuals of existing aircraft onto such systems. The reporting of faults by aircrew to engineering staff can be variable: in part it seems to depend on the respect between the two professions in any particular company. Aircrew must recognise that they have a responsibility to give much relevant information, for example, on the sequence of events and indications that led up to a fault, as possible. Simply writing the epitaph ‘u/s’ in the log is not usually useful even if it satisfies the letter of the law. The relationship between aircrew and engineers seems to be very variable even within one company from fleet to fleet and station to station. A major improvement would be for uniform upgrading to current best practice.
CONCLUSIONS To anyone looking at aircraft maintenance for the first time, the dedication to airworthiness is very impressive. The figures for incidents and accidents show a quite amazingly low rate of error amongst the front line staff. However, the pressures that surround the industry appear to be leading to a significant stress level in staff. It will take considerable leadership by those at the top of the industry, both in the operations and regulatory sides, to ensure that the safety record continues to improve.
16.0 ERROR MANAGEMENT IN A 3RD PARTY REPAIR STATION William B. Ashworth Vice President, Safety, Quality, and Engineering BFGoodrich Aerospace The 1996 Federal Aviation Reauthorization Act created the National Civil Aviation Review Commission. The legislation charges the Commission with considering future Federal Aviation Administration budget needs and appropriate financing mechanisms, as well as suggesting productivity and safety improvements. On December 11, 1997, the commission issued a report titled Avoiding Aviation Gridlock and Reducing the Accident Rate, A Consensus for Change. The following recommendation is included in the executive summary of that report: “Aviation safety programs in industry and government need to be improved by establishing more effective safety risk management programs. This should include self-audit and self-disclosure programs within aviation companies, protecting and sharing safety information in non-punitive ways, and encouraging research to support these activities. Where possible, these programs should include the analysis of real flight and operational data. The aviation community must look deeper than accidents and incidents to identify latent and emerging problems and fix them before a mishap occurs. There needs to be a willingness in government and industry to invest in new ways of doing business. This will require changes in the traditional regulatory relationship so that tools beyond the simple enforcement of rules are available to improve safety.”
INTRODUCTION The concept is simple: pay close attention to the cause of errors; use a structured investigation process to identify contributing factors; analyze the data to look for trends; develop corrective actions that focus on the contributing factors; and make sure the results are disseminated. Why, then, are programs such as those referenced in the above recommendation of the National Civil Aviation Review Commission still in their infancy? The problem involves many issues, including corporate inertia, hesitance to be first, sensitivities about data sharing, and the enforcement bias of the regulatory authorities--all of which a few individuals can do little about. This problem becomes even more complex in the 3rd party maintenance industry, where it is expected that the maintenance process fall in lock step behind that of the air carrier. If the carrier is not ready for a maintenance provider to include them in an error management program, there is little chance of success. The challenge, therefore, is to recognize the reality of the National Civil Aviation Review Commission recommendation and begin building an error management program that moves us, however slowly, toward our safety objectives. This paper describes such a first step and provides some suggestions that have thus far shown signs of success.
The growing international focus on maintenance error reduction strategies has made many new training, investigation, analysis, and corrective action tools available to the maintenance provider. An error management system, however, must go beyond the sporadic application of individual error reduction concepts to ensure that the system is properly tailored for the environment in which it is to function. The ideas that follow form the basis of the Error Management System currently in use by the Airframe Services Division of BFGoodrich Aerospace. It was developed by taking advantage of available error reduction techniques and integrating them into the unique 3rd party maintenance environment. This system has been in use for approximately ten months and is already showing modest improvements in error rates. It is, however, not the only way to manage and reduce errors. Other maintenance providers are using very different systems. The key is to begin some form of error management program as soon as possible so that the safety improvement process can begin.
DEVELOP A CORPORATE ERROR MANAGEMENT PHILOSOPHY For an error management program to succeed, a maintenance provider’s safety objectives must become an integral part of corporate culture. Every person in the company must recognize that safety and error reduction are as important to their collective success as administrative or financial objectives. To accomplish this it is important to understand that safety and economic success are not separate issues. Once it is generally accepted that fewer errors not only improve safety but enhance the economic performance of the maintenance provider and airline alike, a simple error management philosophy will emerge. A corporate philosophy can take the form of a written statement, a motto, or simply be a message consistently supported by company leaders. The philosophy may be different for each company, but it should make up the underpinnings for each aspect of the error reduction program. In doing so, it should continually reinforce the importance of the economic health of the company and include the idea that diligent attention to human factors in maintenance error reduction, and improved financial performance, go hand in hand. ‘Human factors’ is a term, however, which is overused and under defined. For the purpose of establishing an error management philosophy, it should be clearly defined as an intervention strategy focused upon improving the opportunity for the maintenance technician to make the right decision and to perform the task properly. To implement this idea, communication with the technician and the active involvement of the technician in the error management program are of utmost importance.
ERROR MANAGEMENT PROGRAM BARRIERS TO 3RD PARTY MAINTENANCE PROVIDERS A 3rd party maintenance company is similar to an airline maintenance department in many ways. Obviously the same basic maintenance manuals are used, the same civil aviation regulations apply, and
human frailties which cause errors in any organization are always present. There are, however, a few significant differences or barriers which can impede the implementation of an error management system in a non airline environment. These barriers are, for the most part, inaccurate perceptions often held by Repair Station upper management about how the implementation of an error management system will effect the financial aspect of the business. Though such perceptions will be overcome as the basic objectives of an error management system are better understood, it is nonetheless important to recognize the types of barriers that can develop in order to anticipate and minimize their potential effect. Start up barriers of a 3rd party maintenance provider error management program can fall into any of the following categories: •
Concern about non compliance with air carrier maintenance programs.
•
Conflict with an existing air carrier error management approach.
•
Airline concern about uncontrolled data sharing.
•
Questions about applicability, since all current error management research and experience is airline derived.
•
Concern about government access to information and subsequent enforcement action.
•
Concern over the possible negative message that an error management program start up sends to customers and authorities.
RECOGNIZE UNIQUE ERROR MANAGEMENT ISSUES FACED BY 3RD PARTY PROVIDERS Any error management program must begin with a clear recognition that the maintenance provider plays a significant role in the continued airworthiness of the aircraft maintained, and that the maintenance process has as great an impact on safety as airplane design and operational influences. This belief must then be transformed into a maintenance safety objective designed to: 1. identify through research, proven error reduction strategies applicable to the type of maintenance performed; 2. participate in and learn from industry organized efforts to develop new error management strategies; and 3. incorporate the results of these efforts into company error management programs and measure the resultant impact on maintenance safety performance. As these objectives are carried out, an error management system will emerge as a best fit for each unique user. As BFGoodrich Aerospace evaluated various error reduction strategies, the benefits of the application of human factors concepts to airplane maintenance surfaced as the single area having the greatest potential to aid in the improvement of maintenance safety. It also became clear that the advantages of a maintenance human factors program apply equally to both 3rd party maintenance providers and airlines. A maintenance contractor, however, must serve many airline customers requiring that the program be compatible with or at least acceptable to each customer. A 3rd party maintenance provider should, therefore, design their error management program to take advantage of human factors concepts and to be compatible with their customers’ flight safety focus, as
well as ensure full compliance with each customer maintenance program. This may not be a simple task due to the political and legal sensitivities of sharing data and reporting errors. The system-wide solution to this potential barrier must, therefore, begin by focusing on issues common to all maintenance programs, thereby initially avoiding most data sharing problems associated with specific airline customers. This process has been referred to as adjusting the maintenance error identification threshold. A low threshold error management program focusing on errors such as miss-drilled holes would be welcomed by most airlines, while a high threshold program that includes task card inadequacies and major repairs caused by errors may not be compatible with airline data control policies. The following are a few examples of high threshold error categories upon which a new 3rd party maintenance error management program could be based without raising the concern of the airline customers: •
Compliance with applicable Civil Aviation maintenance regulations. In many maintenance organizations a surprising improvement in error rates can be achieved by focusing on such basic regulatory requirements as ensuring adequate documentation of maintenance, referring to technical data, and maintaining technical competence to perform the task.
•
Adhering to general maintenance manual procedures. General maintenance manual procedures vary greatly between carriers. A procedure or maintenance process required by one carrier may be considered an error if used in conjunction with another carrier’s maintenance program. Training and verification to ensure appropriate application will reduce errors.
•
Observing industry standard practices. Procedures common to all customers, such as fastener installation or lubrication techniques, can make up part of an error management program without infringing on carrier-specific processes.
•
Maintaining housekeeping and cleanliness standards. Quite often a significant contributing factor in many system or C.A.S.E. type audit findings involves simple lack of organization.
CREATE AN ERROR MANAGEMENT PROGRAM DEFINITION Once appropriate attention has been given to establishing an error threshold, an error management program definition or template must be defined. This template should provide a program road map or guide through the error management process. As error management strategies are considered, it will become clear that there is no simple “off-the-shelf” comprehensive error management program available. Although a significant amount of work has been accomplished in developing new approaches to human factors training, a meaningful maintenance error reduction program must also include classical investigation, analysis, communication, and measurement components for it to be successful. The error management road map which emerged at BFGoodrich Aerospace focused on the following six primary components:
A structured human factors based error investigation system The error investigation process selected is of significant importance to the overall success of the error management program simply because it reveals the problem area. There is a great deal of research and experimentation underway by airlines, the regulatory authorities, and a few independents to test existing systems and develop new ones. Maintaining an awareness of these new developments in human factors
investigation techniques can be accomplished by participating in industry working groups and symposiums focused on maintenance safety. The Society of Automotive Engineers, the Air Transportation Association, the Federal Aviation Administration and the National Transportation Safety Board have all sponsored efforts in this area and are willing to provide information by mail or through Internet sites. BFGoodrich Aerospace selected the Boeing Maintenance Error Decision Aid (MEDA) because it is easy to use, focuses on human error based contributing factors, and is supported very well by its creators.
Validation of investigation results If the investigation is successful in identifying human factors oriented contributing factors, a validation process should then be conducted to confirm the findings and reveal how widespread the problem is. If an error is truly isolated to a maintenance crew or individual, appropriate corrective action would be far different than that for a problem which is determined to be systemic. This is of even greater importance in a 3rd party maintenance environment, where isolation of a recurring maintenance error to a specific airline maintenance program, or verification that it exists company-wide, is critical to the success of the design of the corrective action. Validating investigation findings, however, must be focused on the contributing factors--not the error itself--and routine information collection techniques like written statements and incident orientated investigations will quite often prove to be inadequate. BFGoodrich Aerospace has adopted a series of special audits, inspections, and evaluations to form the basis of the validation process. We first thought that extensive research and training would be required to develop these methods; however, through trial and error we found that procedures, some complete with checklists in place, were readily available. Some ideas came from our customers, others from the FAA. The lesson learned was that checklists used by customers and regulators not only prepare a maintenance provider for eventual audits and inspections, but can form a ready-made validation procedure. Validation techniques currently showing promise fall into the following three categories: •
Unscheduled 'FAA type' audits and spot checks, using FAA guidance and checklists, conducted by small three-man teams comprised of both Quality Assurance and maintenance personnel.
•
Maintenance procedure checks, called “operational audits,” designed to evaluate the performance of small or large maintenance tasks. (A major airline customer of BFGoodrich Aerospace already had procedures and checklists in place to accomplish this.)
•
Focused scheduled system audits patterned after C.A.S.E. procedures and checklists are not only scheduled on a recurring basis, but are tailored around Quality Assurance issues identified during error investigations.
Data analysis So far none of the components of the error management process requires a computer or a data base management system. In fact, if your error threshold is set high and you do relatively few investigations, computerization should not be necessary. Data basing can, however, be beneficial in large organizations where many users require access to the investigation data for corrective action purposes and where the number of investigations conducted exceeds the memory retrieval capability of the average human brain.
Computerizing the investigation process has also been shown by one company to assist greatly in the investigation documentation process by using advanced programming and search concepts to simplify the entry of standardized descriptive data. This assures more accurate categorization and, therefore, retrieval of contributing factors trend data. The disadvantage of computerization in a 3rd party maintenance environment is that individual airlines worry that data may not be secure, and that regulators and or competitors may gain unwanted access. A second problem resulting from computerized data sharing involves a customer concern that a unique airline customer problem may become an issue for all airlines doing business with that maintenance provider. As the investigation data base grows it becomes immensely important to track, analyze, and trend numerous error related facts and resultant contributing factors, including: time of day, maintenance line, ATA code, nomenclature, interview text, and aircraft type. Relying on memory, or support staff, will soon become inadequate. At that point you have two choices: buy a data base system or build your own. Purchasing is fast, but incurs cost and reliance for outside support; building your own system takes time and skill that you may not have. BFGoodrich Aerospace elected to build their own system, simply because the company’s needs could not be satisfied with a commercially available system at a reasonable price. The process required approximately 90 days (part time) with minimal programmer consultant assistance, and provided a very flexible system that can be changed as needed. The program is based on a well known data base management system and is formatted around the Boeing MEDA investigation technique. It resides on the company’s network, and can be accessed through any personal computer. It also incorporates an occupational safety investigation and analysis tool.
A management backed corrective action system Once an error is investigated and the contributing factors are identified, a corrective action plan must be developed. This is a commonly understood element of every continuous improvement process that both the regulatory authorities and repair station airline customers demand. This process must now become part of the error management system so that corrective actions are focused on contributing factors identified during the investigation and validation phases. An essential element, however, is 100 percent backing of the corrective action process by senior management. This is necessary to assure the work force that management buys into the error management system and supports the necessary corrective changes. Without this management visibility, the entire error management philosophy may not be taken seriously by the work force. Organizational responsibility and accountability for the development of corrective action plans should reside with the technical departments cited in the finding or concern. The plan should then receive management scrutiny as well as a follow up review after implementation. Each corrective action plan should include the following elements: •
Identification or description of the error.
•
Analysis of objective evidence obtained during the investigation and validation phases to determine the root cause(s) of the error.
•
Identification of planned corrective steps to address the factors contributing to the error.
•
Implementation schedule, including a time frame for putting corrective steps in place.
•
Identification of individuals or departments responsible for implementing the corrective steps.
•
Follow up status reporting requirements
A metrics system to track the success or failure of correction actions In a busy maintenance organization, there is no greater waste of time than corrective actions which do not solve problems or will not be used. To ensure that the error management program is providing positive results, the repair station should publish and distribute program performance information. Preparing metrics information does not require complex data analysis procedures, nor should it be confused with an airline reliability program. It can be as simple as a bar chart plotting the number of like errors against time. The primary objective is to ensure that improvement, or lack thereof, is visually evident. Collection of this data should also be kept simple to avoid non value-added effort. BFGoodrich Aerospace collects this information through the error investigation and validation process, and as a part of normal in-process and pre-delivery inspections. In addition, some information on the performance of the airplane during its first few weeks or months of service is provided by the airline customer’s operational tracking system. Examples of sources of metrics data include the following: •
Internal Quality Control identified pre-delivery discrepancies.
•
Customer identified pre-delivery discrepancies.
•
Post delivery operational performance evaluation (reliability).
•
Records accuracy tracking through audits.
•
Crew reported maintenance problems.
A feedback/ training system to ensure the results are disseminated to the work force The final and most important step in the error reduction process is to ensure that the work force benefits from the information generated by the error management system. This is the only consistent way of effecting change. If the maintenance technicians are made aware of the impact of corrective actions, they will be able to make adjustments to ensure long term success. The results of special inspections, the success or failure of a corrective action--or simply the fact that an error occurred--is of great value to a technician. It is important to keep in mind the core idea of a human factors based error management program, which is to provide the technician everything he or she needs to do the job right the first time. Information dissemination is the key to this process. Information flow and training addressing at least the following subjects has been found to be effective at the BFGoodrich
Aerospace heavy maintenance facility: •
Error investigation and corrective action feedback, the latter of which can be accomplished through the distribution of reports or special presentations at crew meetings.
• FAA regulation and policy reviews. It is often underestimated how valuable a recurring refresher course in the basic content of the regulatory requirements can be. An improved knowledge base here allows technicians to better interface with regulators and to understand the “why” of many basic maintenance controls. • Leadership training incorporating human factors concepts. Human factors based error reduction strategies should be integrated into company training and leadership development programs and into the development of corrective actions. Education programs should be offered that are designed to enhance awareness of the effects of human factors issues on maintenance error reduction. Sometimes referred to as Maintenance Resource Management (MRM), this education concept includes focus on human performance, situation awareness, error chain recognition, stress management, communications, assertiveness, and team synergy. • Maintenance error investigator training (MEDA). A significant improvement in the quality of BFGoodrich Aerospace’s investigation reports resulted when investigators received formal training, including an explanation of how the process was developed and how to conduct interviews. Should you elect to use the MEDA process, Boeing provides an excellent on-site initial training course. • Specialized 'FAA oriented' auditor/inspector training. In the preceding section, “Validation of investigation results,” the benefits of using regulatory authority inspection techniques and checklists were discussed. Some training on how to use this information is warranted; available sources include former regulatory personnel, or participation in government provided training programs.
DEVELOP A PROACTIVE MAINTENANCE SAFETY CULTURE For the error management program to be a success, its components must become a visible part of everyday corporate life. A cultural shift of this kind often requires that the error management philosophy be reinforced through talk and action on a daily basis. To accomplish this, the program must not only include training and visible management support, but company commitment must be consistently demonstrated by involving employees in all aspects of the process. One means of providing this reinforcement is to continually look for expected behavior through scheduled follow-up reviews, special inspections, audits and evaluations. If these actions are tied to mandatory corrective actions or appropriate disciplinary steps, some behavior change is likely to take place as a result of expectation of enforcement--much like we all respond to traffic and tax laws. An error reduction strategy must, however, be clearly communicated both to employees and customers if buy in is to be attained. Although improving safety, reducing rework, and enhancing financial performance are valid goals, the error management philosophy must be driven by actions and objectives that are tangible to the work force and visible on a daily basis. The following cultural shift strategies are currently being used by BFGoodrich Aerospace to direct the pursuit of the error management philosophy •
All company personnel, regardless of job title, are encouraged to learn about the maintenance safety performance of their company. This process must begin with senior management.
•
All involved personnel are asked to participate in error reporting, audits, evaluations, and error or incident investigations.
•
The repair station and the airline customer will share in the implementation of the error management system objectives.
•
The FAA is encouraged to monitor the system rather than 'inspect' it. This is currently a tall order in the United States since current “Partnership” programs in the 3rd party maintenance industry are at best experimental. It has been our experience that liberal use of the self disclosure process is the best avenue available to share information with the authorities without the constant threat of enforcement action.
•
A structured disciplinary system is under development that recognizes the importance of obtaining information over punishment but does not tolerate deliberate or careless unsafe actions.
•
Above all else, a successful maintenance safety culture should recognize that mistakes are normal, and that the error reduction process should always focus on factors that contribute to maintenance errors, not the person or the discrepancy.
DEFINITIONS Many error management and human factors concepts are based on structured investigation, auditing, and data analysis mechanisms. Quite often the terms describing these mechanisms will be unfamiliar, or at least not clearly understood by all participants. Varying terminology becomes a larger problem when a 3rd party maintenance provider is performing maintenance for several airline customers, each with their own meanings for similar terms. A glossary of definitions should, therefore, be developed as part of the program plan. The following key terms and phrases have been borrowed from various sources. They are offered as a starting point for any 3rd party maintenance provider error management program because these definitions are generally accepted airline industry wide. •
Airworthiness. The condition in which an aircraft, component, or part conforms to its FAA approved design and is in condition for safe operation with respect to maintenance status, wear, and deterioration.
•
Error. Noncompliance with a customer maintenance program, a civil aviation authority regulation, or a company procedure that requires rework, causes an operational or schedule interruption, or results in a cost to the maintenance provider or its customer.
•
Evidence. Evidence is a documented statement of fact, prepared by a maintenance error investigator, that may be quantitative or qualitative and is based on observations, measurements, or tests that can be verified. For the purpose of an audit or incident investigation, evidence should generally be in the form of technical documentation or reports that support an audit or investigation conclusion. These data are necessary to substantiate findings or concerns and to enable management or evaluators to determine root causes of, and contributing factors to, any reported findings.
•
Controls. Controls are the procedures, responsibilities, and decisions used by an organization to
ensure compliance with company, customer, or FAA standards. •
Finding. A finding is a conclusion that demonstrates noncompliance with a specific standard.
•
Concern. A concern is a conclusion, supported by objective evidence, that does not demonstrate a finding, but rather a condition that may become a finding.
•
Inspection. An inspection is the act of observing a particular event or action to ensure that correct procedures and requirements are followed during the accomplishment of that event or action. The primary purpose of an inspection is to verify that established standards are followed.
•
Audit. An audit is a methodical, planned review used to determine how standards or requirements are being complied with.
•
Evaluation. An evaluation is an anticipatory process, and is designed to identify and correct, or prevent potential findings before they occur. The evaluation process builds on the concepts of audit and inspection.
•
Analysis. An analysis is a structured, sometimes analytical, review of all available data pertaining to an error or category of errors. The purpose of an analysis is to understand trends and to assist in the development of corrective actions.
RESPONSIBILITIES The pragmatic approach to any new program or system requires that individual responsibilities be spelled out in the planning process. Even though such responsibilities are fluid, a formal assignment will send a clear message of expectations and often spark a healthy debate about where the responsibility really belongs. The purpose of this section is to provide a simple example of an error management system responsibility distribution that incorporates the ideas presented above. A similar section should be included in any new error management system plan, and should identify the positions or departments within the organization that have the responsibility and authority to direct, perform, or participate in various aspects of the maintenance error management program: •
Quality Assurance will define and schedule investigations, audits, and special inspections.
•
Maintenance will staff audit, investigation, and special inspection teams.
•
Quality Assurance will lead scheduled audit and special inspection teams.
•
Quality Assurance will identify and record any findings or concerns, and the evidence necessary to substantiate findings or concerns.
•
Maintenance, Quality Control, or Engineering, as appropriate, will initiate, recommend, or develop action plans to provide solutions to findings or concerns.
•
Maintenance will verify the implementation of actions and solutions within a specific time.
•
Quality Assurance will communicate and coordinate all audit and special inspection activities with senior management, regulatory authorities and customer personnel on a regular basis.
•
Quality Assurance will recommend, through the incorporation of investigation and audit findings,
MRM education program content changes and additions to the Training Department. •
The Training Department will ensure the availability of MRM type educational opportunities for all personnel performing maintenance functions.
•
The General Manager has the responsibility to ensure that the Maintenance Error Reduction Program is properly established, implemented, and maintained.
•
The General Manager will conduct monthly Flight Safety Program Meetings to review program progress, and to ensure appropriate top management involvement.
RECORDS Records documenting the actions and results of the error management program should be maintained and archived like any other maintenance record. Records are considered to be the principal form of evidence, and documented evidence is essential in analyzing and determining the root causes of maintenance errors. Evidence also substantiates the effectiveness of corrective actions so that improvements can be identified for broader application or for data sharing opportunities. Error management program records may be maintained as part of the investigation data analysis system or in a separate location, but they should include at least the following types of data: •
Scheduled audit reports.
•
Error investigation forms.
•
Special inspection, audit, or evaluation reports, including the error trends or other reasons necessitating the actions.
•
Follow-up evaluation reports.
•
Responses to findings or concerns contained in reports.
•
Corrective action plans submitted in response to findings.
•
Metrics information describing the success or failure of the corrective actions.
•
Individual training records pertaining to error management system training and education initiatives.
A FINAL WORD ON DATA SHARING The National Civil Aviation Review Commission included the following statement on data sharing in their report: “It appears that the only way to obtain in-depth safety information within a company, between companies, or involving the FAA, is for people who operate in the system (pilots, mechanics, controllers, dispatchers, airlines, manufacturers, airport operators, etc.) to agree to disclose this information and to allow it to be consolidated and analyzed for accident prevention purposes. Individuals and companies will not agree to assemble or disclose safety data if it can be used punitively, be misinterpreted by non-experts, reveal trade
secrets, or expose them to undue liability.” Data sharing, whether on a local or global level, still has two primary barriers keeping it from becoming a reality. First, the enforcement bias of the regulatory authorities have caused most error data to be considered proprietary or legally protected by airlines and repair stations. Second, data collection systems and analysis tools vary significantly, making true electronic sharing of data a technical challenge. The National Civil Aviation Review Commission statement above recognizes data sharing as a necessity if accident rates are to be significantly reduced. Given this fact and the belief that error management techniques are ready to be implemented on a widespread basis, it is now time for the regulatory authorities to make their partnership programs a reality instead of a campaign promise. Although FAA headquarters is deeply committed to the furthering of these ideas, a workable data protection and enforcement incentive program has not been put in place; as a result, fledging industry error management programs are not progressing at an acceptable pace. The regulatory authorities must also participate in industry efforts to develop data systems, both from a concept and cost standpoint, so that all airline and maintenance companies, regardless of financial strength, can participate. Today, the only indication of progress toward these goals are conferences to exchange ideas, and a few emerging national programs oriented around the “self disclosure” process. Although a step in the right direction, it is not nearly enough!
17.0 ORGANIZATIONAL CULTURE AND ITS AFFECT ON SAFETY Aviation Maintenance Human Factors Research Team, Purdue University Gary M. Eiff, Denver Lopp
INTRODUCTION The aviation industry, perhaps more than any other except the nuclear industry, has always expended considerable time, energy and resources in proactive measures to enhance operational safety. Throughout its history such efforts have resulted in a steadily improving industry safety record which have made traveling by aircraft the safest mode of transportation ever devised by mankind. The early beginnings of this journey were marked by many simple, seemingly obvious, changes which had a dramatic impact on the safety of flight. Improvement in aircraft design, standardized training, regulation, enhanced navigation systems, and the development and use of better materials and processes were a few of the fundamental changes which bore considerable fruit in the form of dramatic improvements in flight safety. Like most endeavors focused on refinement, however, optimizing operational safety in aviation was much easier in the early stages of our industry’s growth than it is today. Early efforts produced dramatic results and often were much simpler to identify and understand. The investment required by the industry was also much more modest; there was a much greater “bang for the buck.” As high impact low investment problems were resolved, the industry found each generation of intervention to be increasingly more difficult to identify and implement. As anyone who has studied the logistical concepts of reliability or fault prediction knows, each iteration of improvement carries with it an exponential increase in difficulty and expense. Lulled into a false sense of security by dramatic improvements in safety and a resultant low accident rate while at the same time faced with the exploding investments in time, energy, and money to further resolve safety issues, the industry has languished in relative complacency toward new safety initiatives. The industry seemed content in the fact that air travel is, by far, the safest form of transportation devised by man. The uncomfortable truth, however, is that, without further advances in the safety of flight operations, projected growth in airline travel will result in unacceptably high accidents within the next decade. Projections of this nature have recently spurred the industry into frenzied activity to identify and address new safety initiatives. Areas previously deemed “safe enough” have now come under renewed scrutiny. The “big” or easy to resolve safety issues and those with potentials of producing dramatic safety gains have, for the most part, been resolved. Thus, as we toil in renewed efforts to improve aviation safety, we find today’s labors at improving operational safety to have become much harder, the tasks more complex. It seems that we are left with only hard questions.
THE ISSUE OF SAFETY CULTURES Historically, attempts at optimizing safety had most often stopped with an evaluation of the causal factor which was most apparent. The last link in the error chain. The Honorable Jim Hall, Chairman of the National Transportation Safety Board, recently cautioned that “the proximate cause is not the same as the probable cause; we must dig deeper to get to the true safety issues.”1 The initial focus of safety initiatives on the machines of aviation resulted in dramatic improvements in aircraft design and technology. Aircraft design, technology, and mechanical failure soon faded as an important causal factor in aircraft accidents and incidents. Human errors rapidly replaced mechanical considerations as the principle causation of accidents. Focusing on the proximal human operator or technician soon became the primary locus of investigative scrutiny. Early research and efforts to determine and manage human errors focused almost exclusively on the actions of individual technicians. The analysis of individual human errors which were either causal or contributory to accidents or incidents soon revealed, however, that many of these errors were not isolated events with their origin rooted solely in intrinsic human failings. Instead, many were exogenous in nature and demonstrated that errors were often the result of forces or influential factors pervasive to the context of the work environment. At the very least, the work culture often blunted the individual’s safety focus and error control strategies. It soon became apparent that the most effective way to promote further advances in industry safety was to develop strategies whereby the work environment promoted optimal safety. To move aggressively toward a higher degree of safety within the aviation industry, therefore, research and intervention strategies must now turn to the “mechanism” of human enterprise, the cultural and interrelational aspects of the corporate workplace.
What is a Workplace Culture? Although many workers and managers resist recognizing it, work is a “social” event which takes place within the context of a corporate “societal” structure. Like any other social activity, the personalities, feelings, and actions of individuals in the aviation industry workplace are influenced by the contextual goals, expectations, constraints and influences imposed by the corporate structure. Issues such as corporate economic health, operational climate, rules, discipline, communication, personal freedom and power, and individual achievement and rewards influence worker behavior in much the same way that citizens are influenced by the social structure of a country or government. The honorable Jim Hall, NTSB Chairman, recently described corporate cultures has having as “its basic components…the beliefs held by workers and managers in an organization about the way operations ought to work. The practices and customs that have become the norm, and …how these various factors are valued either positively or negatively.”1 Not unlike other cultures, workplace cultures are shaped by many factors. Rules and codes of conduct are one of the foundations defining an environment’s culture. Commonly shared beliefs such as moral and ethical values, work goals and performance expectations as well as normative expectancies about responsibilities, accountability, discipline and fairness are the bedrock of the societal context of a company. Just as in the cultures of countries and communities, these facets of social order are brought to life and framed in importance through interpretation and implementation by charismatic individuals. Many mistakenly assume that these influential people are those individuals given leadership authority by the corporate structure. Observations and studies performed by Purdue University researchers have demonstrated that the most influential and charismatic individuals in work cultures are not necessarily,
and quite often not, the company’s managerial leaders.
Moving Toward Safety Cultures A contemporary theme in the aviation industry is that the corporate cultures of aviation organizations must become “safety cultures” if the industry is to successfully move toward a higher state of operational safety. Within such “safety cultures” the preeminent focus of the corporation is the optimization of safety at all levels, all of the time. As the central, core valuation of the organization, safety takes precedence over all other parameters in operational decision making within such cultures. Each employee, regardless of their position, job description, or task, exudes the belief that safety must be guarded above all else.
Safety Culture: Something an Organization “Is” or “Has” The development of safety cultures within the aviation industry seems to be stuck in the quagmire of misunderstanding as to what constitutes a “safety culture” and how best to develop an organization into one. There even seems to be a fatalistic belief among some that a “safety culture” is something that an organization “is” or is not. To these individuals, an organization has intrinsic attributes, one of which is its collective attitude about safety. The organization, therefore, is presumed to “develop” or mature with these intrinsic attributes and these individuals believe that little can be done to change these characteristics after the fact. Among these individuals, there is a pervading belief that an organization “either has it or it doesn’t” and it is futile to attempt to change an organization’s collective safety attitude. The rationale used by these individuals often centers around their belief that the organization’s safety attitude is comprised of the employees’ collective individual attitudes and beliefs tempered by the organization’s safety policies and procedures. They propose that changing the organization’s structure, policies, or procedures will do little to overcome the tremendous inertia represented by the employees’ collective beliefs. They seem also steadfast in their belief that changing enough individual attitudes to effectively change the momentum of the collective employee mindset is beyond the realm of possibility. Equally disturbing are those who believe that a “safety culture” is simply something an organization “has” and that the organization can attain this status through the implementation of managerial edits and structural, policy, and procedural changes. Cultural experts suggest that considering a safety culture to be something that an organization has “emphasizes management’s power to change the culture through the introduction of new measures and practices.”3 It is asserted that “because of the important role of practices in organizational cultures, the [‘has’ approach] can be considered as somewhat manageable.”6 Considering the frustration many may feel at the prospects of trying to change the collective mindset of the organization’s employees as would be required for the “is” approach, it is not surprising that many, especially in management, have rushed to embrace this prospective. Unfortunately, a misunderstanding of the true nature of the problem has fostered a belief by some that all that is needed to move an organization toward being a safety culture is to proclaim such and to implement changes in policies and procedures which they deem will promote safe practices. While it is certainly true that “practices are features an organization has” and it is undeniable that corporate policies and operational practices play critical roles in fostering an environment conducive to the development of a safety culture, the simple implementation of these changes does not guarantee that a safety culture will emerge within the organization. Such a belief, however, ignores the fact that the proximate cause of human errors are individuals. Without addressing the need to elicit the active participation of the individual employee in the scheme for enacting safe work practices, the success of such an approach is doubtful. As the normal
“agent” of errors, individual workers are a necessary facet of any successful strategy. A safety culture exists only within an organization where each individual employee, regardless of their position, assumes an active role in error prevention. True safety cultures exist only in organizations which are populated by individuals who are continually vigilant for error potentials and seek to limit such opportunities full-time regardless of management leadership or operational or economic conditions. According to one of the world’s leading authorities on human error management, “An ideal safety culture is the engine that continues to propel the system towards the goal of maximum safety…regardless of the leadership’s personality or current commercial concerns.”3 As such, it is the development and embodiment of a collective work ethic supported by an organizational structure which aggressively pursues the optimization of employee and operational safety as one of its fundamental precepts of business. Safety can be portrayed as a “living” facet of an organization which possesses a true safety culture. It pervades all aspects of the organization and its operation. It is aggressively pursued and promoted by every individual employee. Thus, it could be characterized as something the organization “is” since, as an organizational attribute, it will survive individual shortcomings in operational procedures or practices and/or worker vigilance or action. Even though, according to James Reason, “we must acknowledge the force of the argument asserting that a culture is something that an organization ‘is’ rather than something it ‘has’” he goes on to declare that “if [an organization] is to achieve anything approaching a satisfactory “is” state, it first has to ‘have’ the essential components.”3 We must, therefore develop a corporate structure and climate wherein safety will naturally actualize. An environment in which individual and collective efforts of employees will spontaneously foster optimal organizational safety. As Reason goes on to say, these procedural, policy, and structural changes “can be engineered…the rest is up to the organizational chemistry.”3 A true safety culture is, therefore, the amalgamation of effective safety planning, strategic changes to policy and procedural changes, and the development of a collective employee attitude which actively supports and pursues safety at all levels.
Developing a Safety Culture If, as Reason suggests, corporations must first cultivate the correct climate for a safety culture to develop in, it is first necessary to provide the fundamental elements for the company to “have” a safety focus. Such cultures do not, however, spring to life simply at the declaration of corporate leaders. Nor do simple edits or mandates move a corporation toward a safety culture. Building a successful safety culture with lasting impact requires that considerable effort and expense be dedicated to the venture over a protracted period of time. Corporate cultures do not happen spontaneously but rather “emerge gradually from the persistent and successful application of practical and down-to-earth measures.”3 The implication is that movement toward a safety culture must be addressed as a “strategic” initiative of the company with all of the requisite requirements for the dedication of talent, time, resources, and longitudinal commitment as other strategic programs. To be effective, a safety culture must be freely and enthusiastically embraced and supported by management and labor alike as a corporate way of life. Each must “sees the culture as a global property that emerges out of the values, beliefs and ideologies of the entire membership of the organization.”3 This type of commitment leaves no room for changes in the pre-eminent status of safety. Despite operational pressures and economic considerations, each employee must remain steadfast in their
dedication to safety as the first priority. Reaching this lofty goal is by no means easy. Most companies represent cultures which have considerable inertia. Overcoming years of established goals, beliefs and norms and realigning them to assume the new dynamics of a progressive safety culture will require considerable planning and dedicated implementation. As Hofstede suggests “Changing collective values of adult people in an intended direction is extremely difficult, if not impossible.”6 As Carroll Suggs, CEO of Petroleum Helicopters, suggests “acquiring a safety culture is a process of collective learning.”3 This is true not only for the working masses but also for management. The emphasis is on “collective” learning. If nothing else has been learned from the research at Purdue University, researchers have learned that many answers to critical safety questions are readily apparent to the employees who perform the day-to-day operations. Structuring an environment where management is willing and open to learning from their workers is crucial to promoting an effective safety culture. Such an environment “depends critically on respect – respect for the skills, experience, and abilities of the workforce and, most particularly, the first line supervisors.”3
Characteristics of Safety Cultures While each individual company must find the correct “chemistry” to make the various attributions of a safety culture work, there are certain fundamental ingredients which must be involved in the safety culture equation. James Reason provided some much needed insight into the identities of these necessary elements in his recent presentation at the NTSB “Corporate Culture and Transportation Safety” conference. According to Reason, safety cultures must be “informed cultures” characterized by four important company attributions. Companies which possess a “good safety culture” are organizations which also have the characteristics of being a good reporting culture, a committed learning culture, an organizationally flexible culture and a just adjudicative and disciplinary culture.
An Informed Culture Reason suggests that an “Informed Culture” is “one in which those who manage and operate the system have current knowledge about human, technical, organizational and environmental factors that determine the safety of the system as a whole.”3 The implication is that such cultures will have all of the requisite knowledge and information upon which to make informed decisions about safety issues. Central to such a culture is a thorough understanding by all employees, from the managers to the front line workers, of the importance of human error management and a generalized understanding of the human factors underlying the causation of errors. The understanding of human error, its types and causes is essential in order to cause all employees of the organization, from the highest manager to the front line worker, to recognize that human errors are an intrinsic part of being human. All organizations and individuals are susceptible to making them and, without proper error management techniques, they can lead irrevocably to undesirable outcomes. Only through such an understanding will all members of the organization develop a “state of intelligent and respectful wariness” which fosters the heightened state of vigilance for error potentials and dedication to performing safe acts which constitute the environment of a safety culture.
A Reporting Culture
Keystone to the success of a safety culture is the effective gathering of information about the types and causes of human error which are prevalent in the organization. As Reason insists, such an organization will focus on “creating a safety information system that collects, analyses and disseminates information from incidents and near misses, as well as from regular proactive checks of the system’s vital signs.”3 But the information system itself is not enough. For an organization to be a good safety culture, every individual must be supportive of the uninhibited collection of information about human error causation. This can only be accomplished when the information about such errors is gathered completely and honestly. Self-reporting is a necessary facet of such a culture since it is the only way to insure a complete and accurate representation of the true nature and context of the organization’s human error puzzle. For this reason, a reporting culture must be “a corporate climate in which people are prepared to report their errors and near misses.”3 Since an accurate portrayal of human errors and their causes depends so heavily on honest reporting, the organization’s safety information system therefore “depends critically on the willing participation of the workforce, the people in direct contact with the hazard” to aggressively report safety issues.3
A Just Culture Implicit to the development of a safety culture is a system of just adjudication and discipline. A safety culture based on the need to divulge complete and honest error data depends fundamentally on the reporter’s trust that the organization will fairly evaluate the intent and actions of the erring individual and assess appropriate discipline. O’Leary and Chappell state, “For any incident reporting programme to be effective in uncovering the failures which contribute to an incident, it is paramount to earn the trust of the reporters…Trust is the most important foundation of a successful reporting programme.”7 To be effective and promote participatory error reporting, the organization must be dedicated to a system of unwavering consistency in the evaluation of causation and intent as well as the assignment of just discipline. When pursuing causation, the system must not only look beyond the most proximate individual in the event chain to exogenous actions or influences of the organization and/or other individuals but must also evaluate the evil intent or active negligence of the error perpetrator. The method by which the system performs these evaluations must be clear to all involved and must always be consistent in both evaluation and disciplinary action. If it deemed otherwise by workers, “A single case of a reporter being disciplined as the result of a report could undermine trust and stop the flow of useful reports.”7 The expressed need for a just culture has been misinterpreted by some to mean that the industry should seek a blameless reporting system. As Reason states emphatically, “A no-blame culture is neither feasible nor desirable…”3 He goes on to say that a just culture is “an atmosphere of trust in which people are encouraged, even rewarded, for providing essential safety-related information …but in which they are also clear about where the line must be drawn between acceptable and unacceptable behavior.”3 Industry technicians have expressed repeatedly to Purdue University researchers that they want and feel that they need to be held accountable. Most suggest the use of systems similar to the “substitution test” proposed by Neil Johnston’s or another similar peer reviewed process as a fair system for assessing accountability. Reason describes the substitution test in the following way,“This [test] involves asking the individual’s peers the following questions: Given the circumstances that prevailed at the time, could you be sure that you would not have committed the same or similar type of unsafe act? If the answer is
'‘no'’ then blame is almost certainly inappropriate. The best people can make the worst mistakes.”3
A Learning Culture The single most important facet of a good safety culture is that it aggressively learns from its mistakes. Reason proposes that an organization is a good learning culture if they have “the willingness and the competence to draw the right conclusions from its safety information, and the will to implement major reforms when their need is indicated.”3 The organization must be dedicated to ferreting out the answers to hard safety questions. To identifying human error causal factors wherever they occur and despite who influenced or perpetrated the error. Upper management must commit the resources necessary to effectively decipher the causes of error and to develop and implement appropriate intervention strategies to correct causal factors. In light of the significant investment required in time, effort and resources, to gather a comprehensive database of human error reports and the dire consequences of not remedying safety failings, one would presume that an organization would be committed to learning from its mistakes and implementing solutions based on that learning.
A Flexible Culture To become an effective safety culture, an organization must be flexible enough to modify its operational structure and procedures in order to accommodate changes dictated by the error data. Organizational rigidity will insure that nothing will change despite the enormous efforts and resources committed to collecting and analyzing human error data. It is possible that moving toward a safety culture will require a total rethinking of the structure and design of the organization. Jim Hall, Chairman of the NTSB, indicates that safety investigators within his organization look critically at the structure of the organization after an accident. Highly hierarchical and authoritarian management structures often predispose the organization to rigidity when it comes to accommodating changes. Reason suggests that “shifting from the conventional hierarchical mode to a flatter professional structure, where control passes to experts on the spot, and then reverts back to the traditional bureaucratic mode once the emergency has passed.” May be a more appropriate model.3 Regardless of the organizational structure, it is imperative that it be sufficiently flexible to accommodate the changes necessary to implement effective safety solutions.
Safety is a Shared Responsibility Previous safety refinement efforts have significantly limited design and technology causal factors of aviation accidents, leaving human error as the most prevalent contributor to incident and accident generation. It is estimated that in excess of 80% of the aircraft industry’s incidents and accidents have as their root cause some form of human error. Organizational safety, therefore, be it viewed from the employee injury or product perspective, has as its quintessential center human error management. Human error management is a collective effort. It cannot be mandated by management or government, engineered out of existence by fleet engineering, nor totally prevented by the most proximate individual in operational chain of events. It takes the collective efforts of all members of an organization to successfully manage human errors. Human errors do not occur in a void, they occur within the operational and cultural environment of the organization. Just as the organization’s operational performance is the collective effort of all employees, so too is safety and error management.
Management’s Safety Role It has long been recognized that management plays a critical role in promoting company environments in which there is a greater or lesser commitment to safety. Case studies of industrial accidents in all types of business contexts have implicated managerial involvement in human error caused accidents and incidents. The National Transportation Safety Board (NTSB) and aviation accident and safety investigators have long recognized that the aviation industry is not immune to the influences of corporate cultures and managers whose primary focus is other than safety.8 Chairman Jim Hall recently stated that when performing accident investigations, the NTSB looks at management practices, policies and attitudes as potential influences on the generation of errors. He goes on to say that “flags” the NTSB uses to “recognize potentially unsafe cultures” include such things as “management thinking and practices that are antagonistic or indifferent toward their employees in safety sensitive jobs”. Another sure indicator of a poor safety climate within a company is when the “organization’s practices… vary from the accepted standards found in the industry.”1 This is often indicated when “it is determined that an employee’s operating performance conform to carrier procedures or reflect the accepted values and attitudes found in the carrier and an unsafe situation still occurred.”1 To correct such a climate, management changes are not enough. Instead, “we must understand that the best management in the world cannot overcome the influences of a corporate culture that is bent on emphasizing other attributes over safety.”1 It must be remembered that “companies can, through their actions, communicate to their employees an attitude that subsequently influences the degree to which employees comply with operating rules and with safe operating practices”1 For this reason, it is an imperative that management take proactive measures to design, implement and nurture an environment which actively promotes safety in a consistent manner at all levels and at all times. Instilling all employees with a “collective mindset” centered around a “safety first and always” corporate lifestyle is the single most important contribution managers can make to developing an effective safety culture. To be effective, these efforts must be highly visible to all employees. There must be a demonstrated commitment, both organizationally and personally, by the highest levels of management in order for the safety message to be unequivocal. Management must be totally and unwaveringly committed to providing the impetus, direction, and resources for the implementation of safety initiatives.
Individual Employee’s Safety Role The individual employee, especially the frontline worker, must be the vanguard of safety for an organization. It is widely recognized that human errors may originate at any level within an organization and may be rooted in company procedures, policies, or other factors. Despite the fact that many individuals other than those in proximate positions may be the origin of the error chain, the fact remains that the vast majority of the time the frontline worker represents the last possibility for recognizing the error and preventing it from becoming an event. For this reason, it is imperative that organizations instill in all employees the understanding that they are critical players in error management. Preparing individual workers to assume the role of safety vanguard is a potentially difficult proposition. Workers must first recognize their critical role in the process of organizational safety and error management. This is a necessary precursor to the internalization of their role as active error inhibitors
and leads to the pivotal dedication and motivation which are keystones to their success as safety advocates. In order to reach a state of mind which allows for the internalization process to occur, workers must first be made aware of what human errors are, how they are generated, how errors can be prevented, and how they, as individual workers, can play an important role in accident prevention. Only then will workers relinquish their reliance on the organization and others to maintain safety in the workplace. Workers will be receptive to acquiring the tools to assume these duties once they perceive themselves in the role of safety advocate and guardian against error generation and propagation. Building on their basic understanding of the nature and types of human error, they will learn to become sensitive to error potentials and actively vigilant for existing errors as they perform their duties.
Unity and Clarity of Focus on Safety Of paramount importance in developing a safety culture is the need for the organization to foster a highly visible, strongly supported, and unified corporate safety initiative. This requires the establishment of clearly defined and communicated safety goals. It requires the unwavering dedication of adequate effort and resources to support the safety initiatives throughout all levels of the organization. Perhaps most critically, it requires that all employees, from the highest levels of management down through the frontline worker, have a fervent belief in and an exhibited dedication to safety first and always. The identification of safety as one of the guiding principles of the organization is critical to establishing an effective safety culture. Declaring clearly and emphatically the message that safety is the primary concern in all operational matters sends an unambiguous mandate to all workers that safety is not to be compromised for any reason. Experts suggest that organizations cannot develop a true safety culture without this clear message that safety is the organization’s pre-emanate concern. James Reason relates that in organizations with strong safety cultures, “people way down the line know what they are supposed to do in most situations because the handful of guiding values is crystal clear.”5 Defining these safety goals in clear and simple terms allows no opportunity for “interpretation” and supports a uniformity of treatment at all levels by everyone concerned. As Reason states, “a strong [safety] culture is one in which all levels of the organization share the same goals and values.”3 This is a critical facet of the safety culture since, as NTSB Chairman Hall puts it, “It takes the full cooperation and dedication of every level in an organization to produce an atmosphere where safety is given pre-eminent status in a corporation’s strategic planning”1
Issues Inhibiting Safety Cultures in the Aviation Industry Research studies at Purdue University at numerous organizations and in various sectors of the aviation industry have determined that a myriad of forces are at work which support and inhibit the development of safety cultures in today’s aviation workplace. Moving large corporations toward a pervasive safety focus among all employees is a formidable task which requires considerable time, effort, and resources. Overcoming the inertia of a large workforce populated by individuals from various backgrounds, each with differing views on the importance of safety and understandings on how to effectively control human errors, approaches the impossible. It certainly is not an easy, low-cost, or short- term venture. Just as moving a corporation toward compliance with a major initiative like the quality program ISO 9000, moving the corporation toward an effective safety culture will require a total rethinking of the business philosophy, goals, organizational structure, and operational priorities of the company. Unfortunately, most aviation concerns are attempting to resolve this critical issue by issuing edicts, enacting one-time
programs, or simply publishing motivational posters. In all but a few cases, there seems to be a lack of long-term commitment to make it happen as most organizations labor under the impression that a “band aid” is needed when, in reality, major reconstructive surgery must be undertaken to place the organization on the road to recovery. Over the last several years, researchers at Purdue University have participated in a large number of research studies with various aviation organizations from a diverse segment of the aviation industry. These studies have provided valuable insight into why many organizations are resistant to movement toward the establishment of safety cultures. Throughout the research, a generalized and pervasive theme concerning factors inhibiting safety culture formation was noted regardless of the size or nature of the organization’s aviation commerce. Many of the same factors were prevalent among various air carriers and even in other segments of the industry such as manufacturing, corporate operations, and even large general aviation concerns. The research referred to in this article encompasses a broad range of methodology, including extensive research observations, surveys, and interviews, and involves a diversity of organizational types and sizes. Due to the sensitivity of the research, names of the organizations and the number and nature of their aviation business are revealed. Instead, the research is referred to as an aggregate and is referred to in general terms as the Purdue research. Due to the pervasiveness of the issues, readers may be tempted to interpret the material as centering around their organization or feel that they know what organization is being represented by the article. This would be a misrepresentation of the facts as the article represents no one specific organization but rather the generalized state of the industry at large.
Corporate Cultures Verses Work Cultures One issue which is prevalent among many organizations is the belief that establishing a “corporate culture” which espouses and promotes safety is sufficient to move workers to a greater safety focus and a generalized reduction in error generation. The expectation in these organizations is that simply establishing a corporate culture which declares safety as a central focus and structuring a climate which responds to safety concerns will insure a change at all levels and result in a replication of these precepts throughout the organization. Such misunderstandings seem rooted in confusion of the difference between corporate cultures and work cultures. This perception by the researchers was supported by conversations with managers who portrayed an expectancy that establishing safety as a corporate goal and structuring safety training, programs, and initiatives would result in a corporate culture shift which would permeate the organization. They fully believed that the concepts would reach all levels of the organization and be embraced and supported by every worker. It was the researchers’ observation that in many cases, the corporate safety initiatives were lost as they filtered down through middle management. In numerous cases, frontline workers received mixed signals and confusing messages. The corporate “safety goals” were brought to their attention but localized operational pressures and attitudes sent a clear message that “nothing has changed.” Many workers viewed corporate safety initiatives as another “flavor of the month” program that would soon fade into oblivion. Organizational initiatives within these companies seemed to be predicated on upper management’s belief that changing the corporate culture would change the culture at the most remote level of the business. Their failure to differentiate between the true nature of a “corporate culture” as opposed to the localized “work culture” appeared to be central to this misunderstanding.
Perhaps the best way to portray the difference between corporate cultures and work cultures is to use the analogy of the game of football. In the game of football, the conference or league sets the dimensions of the field of play, the boundaries, goals, field markers and the rules of the game. This is not unlike the “goals”, procedures, rules, and expectations set out by corporations as they establish the character of their corporate culture. Much like the game of football, however, this does not insure a winning team or that the game will be played as expected. How the game is played is left to the coaches and the individual players. The individual football team, much like the local workers of the work culture, will have a collective perception of the importance of certain rules and a collective view of sportsmanship (ethical values). Much of their performance depends on shared beliefs, expectations, and team play. In the same fashion as coaches and team captains, local managers and charismatic workers determine the actual nature of the local work culture. In order to actually having a winning (safety) team, it is imperative that these local influences provide the proper interpretation of the operating procedures and actively pursue the corporate safety initiatives. In larger organizations, Purdue researchers often noted a wide diversity in the local work cultures and their emphasis on safety between the various stations of the company. In many instances, marked differences were even noted at various locations or on different shifts at the same station. This finding sends the clear message that safety cultures cannot be a corporate level initiative only. Instead, it must represent values and actions which are fostered and supported at the most proximate level. The research performed at Purdue strongly suggests that localized influences can either reinforce or defeat the best corporate safety initiatives. The actual manifestation of safety in a work environment is directly related to the value and emphasis ascribed to safety initiatives by frontline managers and charismatic workers.
The Industry as a Reporting Culture As Reason states, one of the foundations of a true safety culture is that it is a reporting culture. To move toward zero errors in any environment, it is first necessary to identify and understand the nature and causation of errors prevalent within the context of that specific environment. The systematic identification, classification, and evaluation of the human errors leading to incidents and accidents is a keystone to understanding the true causes of errors. Without the venue of a robust data set rich in both error type and context, safety researchers and practitioners are deprived of the critical information from which they can glean the true nature and causation of maintenance errors. Any prospects of moving toward a safety culture, either industrial or organizational, must first begin with the careful structuring, comprehensive implementation, and critical evaluation of a historic database of maintenance error events. Due to the relative rarity, latent nature, and diversity of maintenance error incidents, true understanding can be realized only through the review of a large number of events. Therefore, the rapidity with which the industry, and even more specifically individual companies, can reach a state of understanding necessary to formulate effective error control methodologies is dependent upon devising a system for collecting large amounts of maintenance error data without exposing the industry or individual companies to significant risk. Efforts to move the aviation industry toward a better understanding of the causes of maintenance errors have been stymied by the lack of a comprehensive and telling database of error case histories. Repeated attempts to implement various industry-wide data base schemes have been neutered by several forces. Fundamental to the repeated failure to establish a comprehensive maintenance error data set is the lack of a mutually agreed upon classification scheme (taxonomy) for the causal events leading to maintenance errors. It is incumbent upon safety researchers and practitioners to help guide the industry toward a pragmatic way to classify and evaluate error data so that its evaluation will illuminate the causes of
maintenance errors and lead directly to effective intervention strategies to control or eliminate these errors. While this is a formidable undertaking, it is, none the less, a necessary first step toward effective error management. Developing and implementing efficient and effective intervention strategies will prove to be elusive without this pivotal precursory step. From the perspective of formulating a comprehensive and discerning data set of maintenance error causes, it is generally agreed that the number and diversity of such events within most companies is sufficiently rarified to make meaningful interpretation a long-term venture. To move the industry toward a more timely and meaningful resolution, numerous safety advocates are encouraging the establishment of an industry-wide error database of shared information between companies. The larger event pool and the richness of both error type and context afforded by such a strategy promises to provide a more effective means for isolating, identifying, and classifying error causation so that maintenance error management strategies may be contemplated. The prospects of an industry-wide database are troubling to many company managers. In the highly competitive environment of the airline industry, concerns about the potential that such information could be used to leverage a market advantage is viewed as having ominous potentials. In the United States, companies have expanded concerns. The litigious implications of collecting historic data on maintenance errors seems insurmountable to many industry leaders. The potential that such data could be used in tort cases to implicate the carrier causes many managers to be resistant or even openly antagonistic toward the concept of sharing error data. Another apparent concern is that of loss of public image and trust at the hands of what some consider to be a hyperactive media bent on sensationalist portrayal of highly rarified events. The assertion by some that the collection of maintenance error data would cause a “feeding frenzy” among sensationalistic media mongers is hard to dispel considering the demonstrated propensity by some media factions to focus on isolated, sometimes unrelated facts when presenting a story line. Considering the public’s interest and sensitivity to media releases with regard to air travel safety, this is an argument which must be carefully considered during movement toward an industry-wide collection of data. In terms of establishing an industry-wide error database, the pivotal question seems to be finding a way to maintain the confidentiality of such information. Companies in the United States are especially concerned since discoverability of such information under the Freedom of Information Act (FOIA) is a very real and ominous probability. Resistant to becoming involved in an industry-wide effort to collect and analyze maintenance error data, many companies have attempted to design and implement internal databases of error events. It has been our researchers’ experience that in the vast majority of cases, these database have centered around the simple accumulation of incident reports whose structures are founded on little or no intrinsic analysis algorithm for ferreting out error causation. Attempts at data analysis during industry research partnerships with numerous companies have forced Purdue researchers to concluded that, despite the best intentions of these company efforts, the robustness and accuracy of these data sets leaves much to be desired. In fairness to the companies, however, it is very difficult to structure an effective data collection and analysis tool when no error taxonomy, hierarchy, or cause and effect relationships have been defined and generally agreed upon for maintenance errors. These resulting attempts at data collection were subsequently generally diffused in their focus, simplistic in analysis, and reactionary in their application. In addition, it was not uncommon to find that organizations were accruing data but had never attempted to analyze it. The vast majority of data rendering by companies was summative in nature and generally the simple relating of numbers of accidents and incidents with little definition of human factor implications. Most commonly, the organizations had made no attempt to normalize the data or perform a trend analysis to gain insight into the transitional state of human errors within the organization. Poorly designed data collection techniques centered around incomplete or inaccurate metrics coupled with poor or incomplete
tracking procedures resulting in little insight regarding the rate of error generation or the nature or causes of the errors being committed. Another important facet of a good reporting culture is the free and uninhibited reporting of safety issues that come to the attention of workers during the course of their daily activities. Research at Purdue indicated that technicians are generally reluctant to report safety issues or to make safety recommendations. Many organizations we visited had established safety reporting programs whereby technicians could report safety concerns or raise safety related issues. Technicians reported that they did not use the system and most often reported the reason to be that they “never heard anything back about the report” or “no one listens to me anyway.” One worker jokingly reported that “the janitors empty the box once a month and throw the suggestions away.” This futility seemed to be rooted in the fact that most programs did not have any structured feedback systems to inform the worker that the suggestion or concern had been reviewed and of the final disposition of the suggestion or concern. When it came to reporting errors or safety infractions, workers reported that they seldom reported the issues and related that this was most often due to their concerns about the possibility of punitive action against them.
The Industry as a Fair Culture As Reason points out, one of the principle ingredients of a successful safety culture is the fair evaluation of events leading to rule infractions, incidents, or accidents and the just administration of discipline when things go wrong. There exists a general perception among aviation workers in various career fields that much of the evaluation and subsequent discipline meted out for such events lacks fairness of treatment and that penalties are often not suitable or proper in their nature. This is especially true of their feelings about company imposed sanctions. It is often reported by employees that they feel managers and companies are more interested in assigning blame and making an example out of proximal individuals rather than finding the true cause of the event. Researchers have witnessed numerous cases where individuals were assessed sanctions for events which involved component design, procedural, or other causal factors which produced an environment or conditions which predisposed the technician to execute an error. In one particular case, a design flaw of a certain component caused repeated errors being committed by technicians during the component’s installation. The practice of assessing blame to the proximate individual, in this case the erring technician, resulted in numerous technicians with outstanding safety records being blamed and punished for an exogenous causal factor. Because the “true” cause, the defective design, is being ignored, the likelihood that this error will continued to plague the aircraft’s operators is great. Only through addressing the actual cause of the problem and redesigning the part will we be able to eliminate this error potential. Also expressed to the researchers during the study was the concern that employees felt management avoided taking ownership of errors they were responsible for causing. Several expressed the feeling that the reason some managers were so quick to place blame on workers was to avoid their own implication or that of the system. This should not be construed to imply that workers did not feel that they should be held accountable because that was not the case. If workers were truly responsible for making an error, researchers found that they reported strong feelings of guilt. In discussions with technicians, it was often expressed that they felt they should be held accountable for their actions and, indeed, wanted to be. They expressed the general belief, however, that the current system was often unfair in its evaluation and harsh in its discipline.
The Industry as a Learning Culture Historically, the aviation industry has generally been an effective learning culture. Throughout its history, aircraft designs have been steadily improved through the critical evaluation of accidents and incidents. One needs look no further than the industry’s Airworthiness Directive and Service Bulletin system for proof of that fact. It is also true that systematic assessment of flight crew performance and accidents involving flight crew errors has lead to numerous improvements in flight deck design and crew training. This even holds true for flight crew human factors issues such as those that lead to the development of Crew Resource Management and Line Oriented Flight Training programs. Unfortunately, the industry has struggled with identifying and structuring similar efforts in other aviation fields, particularly maintenance. This failing is due, for the most part, to the lack of dedication of resources to the tasks of identifying causal factors leading to maintenance errors and the structuring of effective intervention strategies. In fairness, however, the effort is still quite young. There seems to be a generalized reluctance, however, on the part of governmental agencies and companies alike, to dedicate resources and effort on the magnitude of those spent on design and flight crew issues when the questions revolve around maintenance. Perhaps this is due, at least in part, to the historically low rate of maintenance involvement as a causal factor in aircraft accidents and incidents. As an industry, we must, however, renew our efforts to provide the resources and energy which are required to identify and control maintenance errors lest they assume a new magnitude of contribution. Without finding the resources to ferret out the causal factors of maintenance human error, such errors will, no doubt, become a significant issue early in the next century. Much could be done, however, by individual companies to promote learning from errors and safety breaches. Organizations wishing to foster a safety culture must develop a proactive and aggressive system of learning from its mistakes. Repeatedly throughout the research, it was noted that many organizations fail to provide effective feedback to frontline workers regarding maintenance errors or safety infractions. It was also noted that mechanics also felt that they had little in the form of performance metrics which would inform them of their individual level of performance. Many mechanics reported that safety briefings occurred only on an infrequent and irregular basis and normally lacked substance or specific examples. It was also noted that maintenance stations generally lacked an effective means for forwarding safety information. The most common method used for conveying safety information in the workplace was through the use of safety bulletins which were posted on a central display board. Mechanics related to researchers that they felt the use of bulletin boards and company mail for relating safety issues to be highly ineffective methods of distributing safety information.
Management’s Safety Role There is no doubt that management’s role is a difficult and critical one during the transitional period of developing a safety culture. Management must provide adequate resources to meet the needs of the developing culture and provide consistent and unwavering support for safety initiatives. Research at Purdue suggests that workers perceive management to be less than dedicated to the formation of a true safety culture. Many expressed the concern that management valued operational concerns over safety. They felt that this resulted in operational pressure to meet departures at the expense of safety. It was the observation of the researchers that this perception was generally not founded in the expressed edicts or actions of management and was, instead, often self-imposed by the worker. Regardless, the
perception was pervasive among workers. This would indicate an apparent need for managers to send a clear and unambiguous message to the workers that safety was the primary concern and was not to be compromised for operational performance. A common theme among maintenance technicians is that they generally feel that they are not respected or appreciated and that their contribution to safety and operational performance is undervalued. It is not surprising that researchers found the greatest dedication to safety and operational performance at those facilities where technicians enjoyed the respect and appreciation of their immediate managers. This fostered an environment of trust and resulted in good working relationships which promoted effective and efficient work efforts toward collective goals. Probably the most important contribution management can make toward developing a safety culture is that of providing the leadership and resources necessary to promote a unified commitment to safety. In many arenas, researchers found sporadic and often inadequate commitment of resources to the development of safety initiatives. It was common to witness dramatic swings in commitment of resources during changing operational conditions or periods of economic stress. While it is understandable that corporate resources must be routed to the point of greatest need, the message received by workers is that safety is an important goal of the organization only when things are going well. For safety programs to be genuinely effective, management must be committed to providing adequate, consistent, and unwavering leadership, energy, and resources to the development and implementation of safety initiatives.
Unity and Clarity of Safety Focus Purdue University research observations suggest that perhaps the single most prominent barrier to the development of safety cultures in today’s aviation industry is the failure of many organizations to promote highly visible, clearly defined and obviously supported safety goals. As a result, studies indicate that the focus on safety during work activities is dramatically mixed. Workers generally perceived that safety was “ important as long as it did not interfere with operational performance.” Many also related their belief that “upper management is promoting safety but they really aren’t committed to providing the resources necessary to make it happen.” It was often portrayed to researchers that the new safety initiatives were just another “flavor of the month” and would soon fade like all of the previous programs and initiatives. In many cases, researchers found genuine support and commitment to safety at the upper levels of the organization’s management structure. In a large number of organizations, upper level managers sincerely believed that safety must be improved and were committed to moving the organization toward safety cultures. However, as any other initiative or program is, the mechanics of making safety “happen” in the organization was handed down to middle management. With little guidance or insight into how to design, implement, or resource the initiative, middle management often failed to move the company any closer toward the development of safety cultures. Thus the safety commitment and support is often lost as it filters down through middle management. To maintain a dedication to safety at all levels, it is imperative that the statement of clear, concise, and unambiguous safety goals be communicated to all employees. This message should be initiated by the highest level manager of the organization and be reinforced by all lower managers. Every individual employee should perceive these goals as, in Jim Hall’s words, “guiding values” which are “crystal clear.” Only through establishing these goals as uncompromisable and unquestionable guiding principles of the company can we build an environment in which “people way down the line know what they are supposed
to do in most situations because the handful of guiding values is crystal clear.”5
Operating Procedures Training It was observed throughout the research at numerous locations that much of the training employees receive regarding operational procedures was provided through “on the job training”. Further investigation revealed that in many instances, this type of training did not involve the use of designated trainers or a standardized training curriculum. Instead, much of this experiential training was accomplished by pairing the trainee with another, more experienced technician who was perceived to be accomplished at the task. Without specific training for the OJT mentors or training material guidelines, these experiences provide less than the desired results. Trainers often reported that they had forgotten to cover some of the material. In several instances, trainers were overheard making comments like “this is what the procedures say to do, but this is the way we do it here.” The net effect of utilizing unstructured OJT training is that new personnel are trained inconsistently in operational procedures and “norms” become institutionalized. Without a set training curriculum, critical information is lost when the trainer fails to remember to include the material during the training experience. If the individual being trained is later designated as a trainer for someone else, the likelihood that this information will be conveyed to future trainees is remote. It was even reported to researchers by technicians that they had occasionally been signed-off as having received training for which they had received only partial or, in some cases, no training at all. It is an important commitment to safety for management to insure that operational and safety training experiences are effectively structured, uniformly administered, and provided adequate resources to provide adequate training experiences for inexperienced workers.
Selecting Safety Advocates In an effort to promote greater safety in the workplace, many organizations have instituted some form of a safety advocacy program. As a part of this type of program, many organizations have designated local “safety representatives” or advocates to facilitate local safety initiatives and monitor conditions and safety concerns. In the vast majority of cases, the number and distribution of these individuals is inadequate to properly support the development of local safety cultures. Many stations had only one safety representative to support the entire maintenance staff at each specific maintenance location. Survey results indicated that these representatives were deemed as “important” and “effective” by workers on the day shift at most locations. Respondent technicians also reported that they “frequently” observed safety representatives performing their duties and felt that they were making an important contribution to station safety. Not surprisingly, however, “swing” and midnight shift workers reported that they seldom, if ever, saw safety representatives and felt that they were ineffective at promoting safety in the workplace. To promote a safe work culture on every shift, it is necessary to structure a system of safety advocacy which has representation every working day and across all shifts in order to demonstrate management’s commitment to a safe work environment. Another problem was apparent in the way that safety representatives were selected. Researchers noted a vast difference in safety focus and the perceived importance of safety among various stations. In an effort to identify why such differences existed, researchers evaluated the structure, initiatives, implementation, and advocates at each of the numerous stations. It was determined that the wide disparity in perception and outcomes was not a result of the minor differences which existed between the programs’ structures, initiatives, or implementations. Rather, the differences seemed to be related to “who” was selected to be
the safety advocate. Organizations appeared to select safety advocates in one of two different ways. At some locations, the most effective and respected maintenance technicians were asked to be the safety advocates for the station. It was observed that these locations had a much better safety focus and the safety initiatives were deemed to be highly successful. By comparison, other locations assigned the safety advocate positions to technicians who were ineffective in their maintenance positions or who didn’t get along well with others in the work environment. The premise seemed to be that these “misfits” were not productive as mechanics, so why not put them in a position where they were not responsible for operational performance. The problem with this strategy is that it sends the message that “safety is not important….look who management assigned to the safety position.” To provide optimal support for such advocacy programs, management must carefully consider who it selects for the advocate positions. Selecting highly effective and respected technicians for such positions demonstrates management’s commitment to safety and promotes “buy-in” from the other technicians.
Individual’s Safety Role There is much that the individual worker can and should do to promote an environment which actively resists error generation. Maintaining a constant vigilance for error potentials and utilizing all available resources for human error management are among some of the rudimentary activities which individual workers can do which will significantly contribute to the reduction of maintenance errors as well as a safer workplace.
Resisting Complacency Studies at Purdue University uncovered a convoluted commitment to safety by individual workers. The vast majority of workers observed in the field maintain an ardent commitment to “flight” safety. Maintaining and protecting the integrity of the aircraft was the center of their universe. These same individuals, however, demonstrated a very low regard for protecting their own or other worker’s safety from injury and gave little priority to the damage and destruction of ground service equipment, tools, and fixtures. On the one hand, they were very concerned about the aircraft and its operational safety. This heightened state of concern seemed to be equally matched with a much lower regard for issues not related to aircraft integrity. When technicians were asked if they would correct a fellow worker if they observed them performing an unsafe act or procedure which would impact flight safety, the vast majority said that they would bring the issue to the attention of the individual. These same individuals, however, reported that if they observed a fellow worker performing a procedure in a way that might cause them personal injury or damage equipment, they reported a generalized reluctance to bring the issue to the attention of their fellow worker. Researchers were troubled by these responses since it is their opinion that a true dedication to safety is exhibited throughout all activities. It is important to instill in all workers a strong and universal commitment to safety and a resistance to becoming complacent with regards to any safety issue.
Don’t Take Risks When reviewing the historic data on maintenance accidents and incidents at numerous organizations, it
was troubling to find that many events involved knowingly taking risks. Research observations at various aviation locations and involving widely different aviation business settings lead researchers to believe that this is a pervasive issue. Workers were observed leaving ladders and other equipment near an aircraft during “functional checks”, often relating to the observer “I think it will miss [the object]” or “it should be OK”. Workers were frequently observed using ground equipment, work stands, or other support equipment which they knew had defects or was unsafe. Technicians were observed on several occasions using equipment not designed for the procedure because “the correct [item] is not available” or “I would have to go clear down to [place] to get the correct [item]”. Individual workers should be encouraged to resist taking risks during any procedure. If they are not absolutely sure the activity will be successful, they should openly question continuing the procedure.
Utilize Error Management Techniques It was evident throughout the research that individual workers do not effectively utilize organizational error management tools and techniques. Technicians seem to be totally committed to their own personal error management techniques and harbor a belief that they are superior to any company or governmental systems. Despite the fact that maintenance “task cards” and manuals are specifically designed to be a part of the human error management strategy, many technicians do not effectively utilize them as such. In their defense, however, few recognize them as error management tools. After observing many technicians “pocketing” task cards or manual instructions and reading them only at the completion of the job or when performing the “sign-off”, researchers asked workers their perception of the purpose of the document. The vast majority related that these items were “instructions” for performing the work. It is well established that maintenance technicians are resistant to using “instructions”. When researchers explained how the document could be an effective error management tool, many were surprised and seemed to view the documents in a new light. The research suggests that workers are not fully aware of the various error management techniques available to them and how to optimize their use during the performance of their daily duties. It is the researchers’ belief that bringing the true nature and proper utilization of such documents to the attention of the worker could have a significant impact on organizational safety.
SUMMARY To effectively move aviation organizations toward proactive safety cultures, we must first provide the ingredients for the organization to “have” a collective safety focus. The industry must solve the problems of providing an industrial environment in which organizations can become informed by determining a method of effective error reporting. Such a system should go beyond reporting accidents and incidents to the establishment of metrics which will assess all types of human errors and the human factors which lead to such errors. It should also provide an industry-wide database so that even the smallest company may benefit from the knowledge gained through such a venture. Critical to moving aviation organizations toward safety cultures is the need to provide a fair and equitable means of adjudication and discipline. A system which provides for consistent and fair assessment of causation and the assignment of appropriate discipline. Aviation organizations must actively seek to learn from even their smallest mistakes. This will require an increased dedication to organizational learning and involve a consistent and unwavering commitment of resources, energy, and time. How do we know that we are making progress toward our goal of becoming an organizational “safety culture”? James Reason provides guidance as to what one can look for in an organization to determine if
there is the requisite commitment to safety necessary to become a safety culture. He poses the following questions as a means of assessing an organization’s safety commitment:3 •
Which board members have responsibility for the organizational safety – as opposed to conventional health and safety at work concerns?
•
Is information relating to organizational safety discussed at all regular board meetings – or their high-level equivalent?
•
What system, if any, does the organization have for costing the losses caused by unsafe acts, incidents, and accidents?
•
Who collates, analyzes, and disseminates information relating to organizational safety? By how many reporting levels is this individual separated from the CEO? What annual budget does this person’s department receive? How many staff does he or she oversee?
•
Is a safety related appointment seen as rewarding talent (you’re going places) or is the organizational oubliette for spent forces?
•
How many specialists in human and organizational factors does the company employ?
•
Who decides what disciplinary action should be meted out? Are the defendant’s peers and union representative involved in the judgement process? Is there any internal appeals process?3
REFERENCES 1. Hall, J. (1997, April 24). Remarks given before the Symposium on Corporate Culture and Transportation Safety. Washington, DC: National Transportation Safety Board. 2. Slater, R. E. (1997, April 24). Remarks given before the Symposium on Corporate Culture and Transportation Safety. Washington, DC: National Transportation Safety Board. 3. Reason, J. (1997, April 24). Corporate culture and safety. Proceedings of the Symposium on Corporate Culture and Transportation Safety. Washington, DC: National Transportation Safety Board. 4. Uttal, B. (1983, October 17). The corporate culture vultures. Fortune. 5. Peters, T.J., & Waterman, R.H. (1982). In search of excellence: Lessons from America’s best-run companies. New York: Harper & Row. 6. Hofstede, G. (1994). Cultures and organizations: Intercultural cooperation and its importance for survival (p. 199). London: Harper Collins. 7. O’Leary, M., & Chappell, S. (1996). Confidential incident reporting systems create vital awareness of safety problems. ICAO Journal, 51: 11-13. 8. Miller, C. O. (1997, February 15). Three faces of aviation accident prevention management investigation. ISASI Forum, April-June, 1997.
18.0 THE MEASUREMENT OF SAFETY James Reason Department of Psychology, University of Manchester
INTRODUCTION What is a safe organization? The usual answer is one that has relatively few bad events or negative outcomes—accident, incidents, quality lapses and the like. But there are many problems with this type of assessment. •
In aviation, the most obvious difficulty is the scarcity of bad events. Major accidents have fluctuated around the same low level (around 1.5 x 106 departures) for the past twenty years or so. There are, of course, a much larger number of less serious events but—in maintenance especially—these are massively under-reported.
•
Bad events have a large chance component. Only if system managers had complete control over all possible accident-producing factors could the number of bad events sustained by the organization provide a valid index of its absolute safety. But this is not the case. Natural hazards can be anticipated and defended against, unsafe acts can be moderated to some degree, but neither can be eliminated altogether. There is no way—short of ceasing operations altogether—of preventing the chance conjunction of unsafe acts, local triggers and latent conditions so that they penetrate—albeit very rarely—the system’s many barriers, controls and safeguards (1,2). In short, there is no such thing as absolute safety. There is no ‘target zero’.
•
The large random component in accident causation means that ‘safe’ organizations can still have bad accidents and ‘unsafe’ ones can still escape accidents for long periods. Chance works both ways. It can afflict the deserving and protect the unworthy.
•
Where there are large numbers of bad events, as in construction or road transport, for example, outcome measures based on accident rates do provide a reasonable measure of an organization’s relative safety. But when the numbers are small and asymptotic, as in aviation, such measures are both unreliable and, on occasions, dangerously misleading. Organizations having the same comparably low levels of bad events could actually differ very widely in their degree of intrinsic safety.
If we cannot use negative outcome measures reliably, what then is the alternative? The argument to be presented here is that the most meaningful way of assessing safety is through process measures that reflect the system’s current ‘safety health’ through the regular sampling of its vital signs. In order to provide a principled basis for this claim, we need to consider more closely what is meant by the term ‘safety’ other than some unattainable freedom from hazard or danger. As indicated earlier, neither gravity nor terrain will go away; nor will human fallibility or systemic weaknesses.
THE POSITIVE FACE OF SAFETY Safety has two faces. The negative face is very obvious and is revealed by bad events, near misses and the like. This face lends itself very easily to be being quantified and so holds great appeal to managers. But there is also another face that is both benign and more hidden. This aspect of safety can be defined as the system’s intrinsic resistance to its operational hazards. In other words, some organizations will be more robust, more resistant, or more resilient than others in coping with the dangers associated with their core business. This will be true for aircraft maintenance organizations as for any other part of the wider aviation system. Let us give some substance to this rather vague notion of ‘intrinsic resistance.’ Consider a ball bearing resting upon blocks of various shapes: convex, rectangular and concave. Imagine that the ball bearing and the block are being continuously perturbed by forces equivalent to operational hazards. A bad outcome occurs when the ball bearing is displaced from the block. Clearly, it will take a good deal more agitation to disturb the ball on the concave block than either of the other two. Now consider an even more concrete example. Engineers are accustomed to carrying out tests to destruction. For a particular aircraft type, a ‘test to destruction’ is roughly analogous to the number of factors required to bring about a fatal accident. A recent study (3) examined 90 fatal accident investigation reports carried out by the UK Air Accident Investigation Branch between the 1970s and the 1990s with a view to establishing how many of 16 possible contributory factors were implicated in accidents sustained by three different aircraft types: large jets, light aircraft and helicopters. The contributory factors included such things as airframe problems, system problems, fuel problems, wind, precipitation, pilot handling problems and the like. The results were very clear. On average, it took 1.95 problems to crash a helicopter, 3.38 for a light aircraft and 4.46 problems for a large commercial jet. Not surprisingly, helicopters—that merely beat the wind—are considerably more vulnerable (or less resistant) than large jets.
THE SAFETY SPACE Another way of representing the ideas of resistance and vulnerability is as the extremes of a notional cigar-shaped space—termed the safety space. Each organization occupies—at any one time—a position within this space. The space is cigar-shaped because most organizations will cluster in the midpoint regions with the numbers diminishing as one moves to either end Organizations are free to move up and down the space. In this, they are subject to two kinds of forces: those existing externally within the space itself and those emanating from the organization. The external forces act inwards from either extreme of the space. If the organization drifts too close to the vulnerable end, it is likely to suffer an accident. This, in turn, will bring about both internal and external pressures to become more resistant. Improvements in the safety management system will drive the organization towards the resistant end. But these are not often sustained, so that the organization drifts once again back towards the vulnerable end. Left largely to their own devices, organizations will tend to drift to and fro within the space. Two things are required to both drive the organization towards the resistant end and then to keep it these.
First, it requires effective navigational aids—that is, something other than the frequency of bad events. Secondly, it needs an ‘engine’ to overcome the external tides and currents and to maintain a fixed heading.
REACTIVE AND PROACTIVE MEASURES Where major accidents are few and far between, the reactive measures will be derived mainly from near miss and incident reporting systems, or ‘free lessons.’ Such safety information systems have been considered at length elsewhere (2, 4) and will not be discussed in detail here. We can, however, summarise their likely benefits. 1. If the right lessons are learned from these retrospective data, they can act like vaccines to mobilise the organization’s defences against some more serious occurrence in the future. And, like vaccines, they can do this without lasting harm to the system. 2. These data can also inform us as to which safeguards and barriers remained effective, thus thwarting a more damaging event. 3. Near misses and incidents provide important qualitative insights into how small defensive failures could combine to create major accidents. 4. Such data can also yield the larger numbers required for more far-reaching quantitative analyses. Analyses of several comparable incidents (e.g., missing O-rings, missing fastenings, etc.) can reveal patterns of cause and effect that are rarely evident in single-case investigations. 5. Most importantly, an understanding of these data serves to slow down the inevitable process of forgetting to be afraid of the operational dangers. Proactive measures identify in advance those factors likely to contribute to some future accident. Used appropriately, they help to make visible to those who operate and manage the system the latent conditions and ‘resident pathogens’ (1) that are an inevitable part of any hazardous technology. Their great advantage is that they do not have to wait upon an accident or an incident; they can be applied now and at any time. Proactive measures involve making regular checks upon the organization’s defences and upon its various essential processes—planning, forecasting scheduling, budgeting, maintaining, training, creating procedures, and the like. There is no single comprehensive measure of the organization’s overall ‘safety health.’ Just as in medicine, establishing organizational fitness—or intrinsic resistance—means sampling a subset of a larger collection of leading indicators, each reflecting the various systemic vital signs. A more detailed consideration of these diagnostic indicators has been given elsewhere (2, 5). Effective safety management requires the use of both reactive and proactive measures. In combination, they provide essential information about the state of the defences and about the workplace and systemic factors known to contribute to adverse events. The main elements of their integrated usage are summarised in Table 18-1.
Table 18.1. Summarising the interactions between reactive and proactive measures
Type of navigational aid Reactive Measures
Proactive measures
Local and organisational conditions
Analysis of many incidents can reveal recurrent patterns of cause and effect.
Identify those conditions most needing correction, leading to steady gains in resistance or 'fitness.'
Defences barriers & safeguards
Each event shows a partial or complete trajectory through the defences.
Regular checks reveal where holes exist now and where they are most likely to appear next.
SOME PROACTIVE MEASURES APPLICABLE TO AVIATION MAINTENANCE A number of proactive safety measures have been created specifically for aviation maintenance. Two are listed below. Each has been discussed at length elsewhere. 1. Managing Engineering Safety Health or MESH (2) 2. Proactive Error Reduction System or PERS (6)
CONCLUSIONS 1. Negative outcome data are both too sparse and two unreliable to provide an adequate measure of a maintenance system’s safety health. 2. Safety is a function of an organization’s intrinsic resistance to its operational hazards. 3. This can only be achieved by the combined use of both reactive and proactive measures. MEDA (Maintenance Error Decision Aid) provides a good example of a reactive measuring tool capable of identifying accident-producing factors before they combine to cause a bad event (7). MESH and PERS operate proactively to identify those systemic ‘vital signs’ that need fixing in order to enhance a system’s resistance to hazards.
REFERENCES 1. Reason, J. (1990). Human Error. New York: Cambridge University Press. 2. Reason, J. (1997). Managing the Risks of Organizational Accidents. Aldershot: Ashgate.
3. Stephens, D. (1996). The ‘rule of three’ in aircraft accident causation. Manchester: University of Manchester, Department of Psychology Report. 4. Van der Schaaf, T.W., Lucas, D.A., & Hale, A.R. (1991). Near Miss Reporting as a Safety Tool. Oxford: Butterworth-Heinemann. 5. Hudson, P., Reason, J., Wagenaar, W., Bentley, P., Primrose, M., & Visser, J. (1994). Tripod-Delta: Proactive approach to enhanced safety. Journal of Petroleum Technology, 40: 58-62. 6. Drury, C.G., Wenner, C.L., & Murthy, M. (1997). A proactive error reduction system. In: Proceedings of the 11th Meeting on Human factors Issues in Aviation Maintenance and Inspection, March 12-13, San Diego. Washington DC: Federal Aviation Administration. 7. Boeing (1994). Maintenance Error Decision Aid. Seattle, WA: Boeing Commercial Airplane Group.
19.0 CREATING A PROCEDURES CULTURE TO MINIMISE RISKS USING CARMAN David Embrey Ph.D. Managing Director, Human Reliability Associates Ltd
INTRODUCTION The purpose of this paper is to describe the aircraft maintenance applications of a comprehensive methodology for reducing procedures violations that has been applied in the petrochemical and other high risk industries. The methodology is called CARMAN (Consensus based Approach to Risk Management), because it involves the explicit identification of sources of risk, and the development, using a consensus process, of work practices which will control these risks. CARMAN is primarily directed towards the reduction of human errors and violations in proceduralised activities such as maintenance. It also can also produce improvements in areas such as learning from operational experience, and raising the awareness of risks. A particular focus of the approach is the development of a participative culture which provides a basis for the sharing of information from all sources in the organization, including informal, normally undocumented knowledge possessed at the operational level. This information is used to develop Best Practices to control risks, such as maintenance errors, which could lead to catastrophic losses. This participative culture is developed by allowing technicians to play a significant role in the development of operational procedures and job aids that reflect the practicalities of the working environment. Another aspect of the methodology is the provision of a process for evaluating, in a rational manner, the relative contribution of training, competency and job aids to support Best Practices that minimise risk. CARMAN provides a process for setting up a database of Best Practices which can be used both to develop training programmes and also to assess competency. We will first describe a survey which addressed the factors influencing the use of procedures in a high risk industry. This will be followed by a discussion of the individual and system causes of procedural violations and a description of how the CARMAN process addresses these causes. The paper concludes with a detailed description of how CARMAN is applied in practice.
THE ROLE OF PROCEDURES IN HIGH RISK INDUSTRIES Over the past few years the author has been involved in projects concerned with predicting and improving human reliability in high risk systems in industries such chemical processing, aerospace systems and transportation (Embrey et al1). One of the main characteristics of such systems is that risks are controlled by means of operational procedures which are designed to control any hazards that have not been eliminated by design, or which cannot be economically controlled by means of some form of automatic protective systems. In industries such as nuclear power, for example, there has been considerable emphasis on developing sophisticated Emergency Operating Procedures, even though the role of the
control room operator has mainly been as a back up for the operation of the automatic safety systems. In fact, reviews of incident data from the nuclear industry have shown that maintenance errors probably constitute a far greater source of risk than errors during the handling of severe emergencies. This is partly because nuclear power safety systems have typically focused on major emergencies, despite the fact that they can be vulnerable to other sources of risk, particularly maintenance errors during the shut down state. Another factor is that maintenance is typically highly labour intensive, and therefore the opportunity to make errors is considerably higher during maintenance compared to the rare but high profile scenarios such as loss of coolant accidents (e.g. Three Mile Island). In addition, far less attention has been paid to the issue of human error in maintenance, because this issue does not normally feature prominently in the safety cases that must be produced for the regulatory authorities in high-risk systems such as nuclear and chemical plants. The procedures in such systems are typically subject to considerable scrutiny, since they are intended to represent the way in which the system is operated, and, at least implicitly, how risks arising from these operations are controlled. For this reason, technical specialists usually write procedures when the system is first set up. If an incident occurs which leads to significant safety or environmental consequences, the operator of the system will be required to demonstrate that a safe system of operation (as represented in the procedures) existed. Then, if the incident can be shown to have arisen because the procedures were not followed, (a so-called procedural violation), the organization can assign a significant portion of the blame to the hapless operator. Another reason for the proliferation of written procedures is the need to satisfy the documentation requirements of quality management systems such as ISO 9000. These systems typically require that all working practices which can impact on quality be fully documented in the form of comprehensive written procedures.
Results of Survey of Procedures Usage in High Risk Industries As part of our work in a number of high risk industries, we have conducted surveys regarding the attitudes of the workforce to procedures, and the extent to which written procedures are actually used to support technicians when they are performing their day to day tasks. The insights from these surveys, together with our experience in providing training and consultancy in procedures systems for a number of organizations, have provided the basis of the CARMAN approach. We will first describe the results of one of these survey activities, and then the general conclusions that emerged. A procedures culture questionnaire was developed and distributed to nearly 400 operators and managers in the petrochemical industry. The first set of questions related to the extent that procedures were actually used for different categories of task. The results indicated that for tasks perceived to be safety or quality critical, the use of procedures was high (75% and 80% respectively) but by no means universal. Perhaps even more interesting was the finding that for problem diagnosis (regardless of whether a system was safety critical or not) only 30% of the respondents used procedures. In the case of routine tasks (which would include routine maintenance operations), only 10% of the respondents said they used procedures. When a task is described as ‘proceduralised’ there is an implicit assumption that the procedures will actually be referred to when performing a task. However, the results of the survey indicated that even in tasks where procedures were said to be used, only 58% of the respondents actually had them open in front of them when carrying out the task. This indicates that the earlier findings regarding procedures use are probably an over estimate if ‘use’ is defined as actually working from the procedure while performing the task. These figures imply that the actual average ‘on-line’ usage for safety critical, problem solving and routine tasks is 43%, 17% and 6% respectively. If these findings translate to the aviation domain, the
assumption that maintenance and testing errors will be minimised because of the availability of procedures would appear to be misplaced. Certainly the results indicate that the level of on-line usage of procedures is low, particularly in tasks not perceived to be safety critical.
Use of standardised working methods One of the important functions of procedures is that they can provide the basis for standardised working practices, which ensure that the objectives of the task are achieved. One of the items in the survey concerned the use of ‘black books’ i.e. personal sets of notes held by individuals as informal job aids. The results indicated a very high usage of black books by both operators and managers (56% and 51% respectively). Although there is no reason in principle why such informal job aids should not be compiled by individuals, their existence suggests that there may be considerable variation in the way that tasks are actually performed. There are obvious implications for safety critical maintenance operations if some of these variations in performance do not achieve the required objectives. Another dimension assessed by the study was the extent to which procedures should be regarded as being guidelines, or needed to be followed ‘to the letter.’ Although there was considerable agreement that safety and quality instructions should be followed to the letter (90% and 75% respectively) for most other categories of task about 50% of respondents believed that they were primarily guidelines. This came as a considerable surprise to the management of the companies included in the survey.
Strategies for improvements The final part of the survey considered the question of why procedures were not used. Following prior discussions with technicians, seven factors were investigated with regard to their impact on procedure usage. These are set out in Figure 19.1. It can be seen from this table that there was a high level of agreement with most of the suggested reasons for lack of usage of procedures. Another part of the survey asked people to indicate the five main reasons that procedures were not used, and the five changes that would be most effective in improving the quality of procedures and their use. The most highly ranked reasons for procedures not being used were as follows: •
If followed to the letter the job wouldn’t get done
•
People are not aware that a procedure exists
•
People prefer to rely on their skills and experience
•
People assume they know what is in the procedure
The most highly ranked strategies for improvements were: •
Involving users in the design of procedures
•
Writing procedures in plain English
•
Updating procedures when plant and working practices change
•
Ensuring that procedures always reflect current working practices
There were no significant differences between the reasons for lack of procedure usage, but ‘involving users in the design of procedures’ was rated significantly higher than any of the other approaches to improvements.
Conclusions from the Survey The conclusions that emerge from this study are that in the safety critical industry surveyed, the majority of maintenance and testing operations were performed without the on-line use of step by step written procedures. There were also significant variations in the ways in which a task was performed, which sometimes differed significantly from the ‘official’ procedures. People will not follow procedures if they feel they are impractical, and they will not routinely use written procedures if they believe they have sufficient skill and experience to get the job done on the basis of their skill or experience alone. However, the existence of ‘Black Books’ indicates that there is a significant need for some form of on line support, which is not provided by the existing procedures systems. Also, there appears to be significant variations in the way in which tasks are performed, between shifts or individuals. An obvious question is the extent to which these findings are specific to the industries surveyed, or whether they could reasonably be expected to apply to the aviation sector. Although we have not yet performed a survey of this type in the aviation sector, over the past few years we have worked in many high-risk industries. These include petrochemicals, offshore oil production, manned space flight, and nuclear power generation, marine operations, medical and rail transport systems. In every case we have observed similar practices, and it seems unlikely that the aviation industry, is significantly different in this respect. This assertion is supported by several specific incident investigations that have shown non-compliance with procedures as a specific cause. For example, ICAO2 listed ‘failure to comply with procedures’ as one of the organizational causes common to accidents involving maintenance error. In a recent project concerned with military aircraft maintenance, where one would expect a strong culture of procedure compliance to exist, we have also observed similar practices, even for highly safety critical equipment such as ejection seats.
UNDERLYING CAUSES OF NON-COMPLIANCE WITH PROCEDURES In this section, we shall examine the various causes for procedural non-conformance that can arise, primarily from the basis of our industrial experience, but also from the perspective of research findings on violations. The reasons for procedural non-compliance can be divided into two broad groups: individually based and system based. Because there has been extensive work in the area of the individual causes of non-compliance (usually referred to as violations because there is often an implied value judgement that they arise from blameworthy negative intentions), we will only provide a summary of this area in this paper. More detail will be provided on the system causes of non-compliance, which has received less attention in the literature. However, it should be emphasised that there is some degree of overlap between these two groups of causes.
‘Procedures are not used because…’ (percent agreeing)
Accuracy
…they are inaccurate (21) …they are out-of-date (45)
Practicality
…they are unworkable in practice
(40)
…they make it more difficult to do the work …they are too restrictive
(42)
(48)
…too time consuming (44) …if they were followed ‘to the letter’ the job couldn’t get done in time (62) Optimisation
…people usually find a better way of doing the job (42) …they do not describe the best way to carry out the work (48)
Presentation
…it is difficult to know which is the right procedure (32) …they are too complex and difficult to use (42) …it is difficult to find the information you need within the procedure (48)
Accessibility
…it is difficult to locate the right procedure (50) …people are not aware that a procedure exists for the job they are doing (57)
Policy
…people do not understand why they are necessary (40) … no clear policy on when they should be used (37)
Usage
…experienced people don’t need them
(19)
…people resent being told how to do their job
(34)
…people prefer to rely on their own skills and experience (72) …people assume they know what is in the procedure (70) Figure 19.1: Reasons for Non-Usage of Procedures
Individual Causes of Non-Compliance Violations can be broadly defined as intentended actions which deviate from the specified rules or procedures of a system, even though the rules are known to the actor. Hence an individual who is unaware of the correct rules is not technically committing a violation if they are transgressed, even though the consequences may be serious. Free3 has developed a classification of four types of violations: routine, situational, exceptional and optimising. Routine violations are often activities which have become the unofficial working practices in an organization, even though they do not comply with the official rules or procedures. Routine violations may become so common that they come to be performed unconsciously, but will normally be recognised as violations if a person is questioned. Routine violations are said to arise when the costs of compliance seem to be greater than the benefits of violating the rules. Benefits in this sense could simply be the convenience of doing a job in a simple way that appears to save time compared with an apparently time consuming and cumbersome method set out in an official procedure. If an individual’s perception of the costs and benefits is correct, then the chosen strategy may actually be the optimal one for the system. This conclusion emphasises the dangers of making value judgements about violators. Unless a process exists for ensuring that the official rules are actually the optimal rules, then routine violations are likely to flourish, and not always for negative reasons. Routine violations often arise because of group pressures to conform to a particular working practice adopted by a group, or individuals with ‘expert power’ such as supervisors or experienced technicians. The concept of a violation as arising from an incorrect perception of the balance between risks and benefits is a general principle which also applies to other forms of non-compliance. From this perspective, a general strategy for reducing violations is to ensure that an individual has an accurate perception of the risks associated with tasks, which is communicated either by training or by the procedures themselves (e.g. via warnings and comments). Situational violations arise from procedures that are either impractical or are applied generally when they are only relevant within a limited domain. Impractical rules are often violated simply to get the job done. A situational violation may become routinised if the causes of the violation persist over a long period of time. This category of violations can also be seen as partly caused by procedures which are not optimal in that they do not recognise the practicalities of performing the task in the prescribed manner. Exceptional violations are usually associated with rare or unusual situations where people are trying to solve problems in the knowledge based mode (Reason4). In these situations, people may assume that the normal rules do not apply, and therefore they may attempt to develop an ad hoc procedure without a full evaluation of its potential risks. The Chernobyl accident was a classic case of an exceptional violation of the reactor safety rules. The final class of violations arises from the desire to optimise a work situation, from the point of view of exploring its boundaries or to make a repetitive or unchallenging job more interesting. Optimising violations can be seen as part of a process of learning by a person investigating the dynamics of a system by means of possibly risky ‘experiments’. Normally, optimising violations are associated with more complex tasks than those encountered in aviation maintenance, where it is difficult for a technician to
fully understand a system.
System causes of Non-Compliance Although most violations are ascribed to individual causes, in fact there are usually specific system problems that create the preconditions for violations. In this section we will explore some of these causes, from the point of view of how they are addressed in CARMAN. The primary system causes of procedural non-compliance can be summarised under the following headings: •
Absence of an auditable process for systematically developing optimised working practices (‘Best Practice’) which control risks and which are acceptable to the workforce.
•
‘Official procedures’ which are out of date and impractical and therefore lack credibility with the workforce
•
Lack of a culture which develops ownership of procedures by a process of active participation in their development, thus giving rise to ‘buy-in’ and compliance without the need for repeated motivational campaigns.
•
Lack of communication channels in an organization to allow procedures to be frequently updated in line with organizational learning.
•
Absence of a process for capturing formal and informal knowledge which may be distributed widely both within and between levels in an organization.
•
Lack of the detailed knowledge of how to perform complex or infrequently encountered tasks, due to a failure to integrate training, competency and procedures development
•
Failure to recognise that different types of procedural support are required depending upon familiarity, task complexity and other factors.
•
Absence of a method for identifying the critical information needed to perform a task
Requirements for an Auditable, Risk-Based Approach to Procedure Development In most organizations, many of the formal written procedures do not document current Best Practice. ‘Best Practice’ is defined as the performance of a task in the manner which achieves the required objectives whilst minimising the safety, economic and quality risks. This is due to two main reasons. Firstly, procedures are often written by technical specialists or engineers who do not necessarily have a high level of hands –on experience with the environment and the practical constraints of performing a task in the field. A second reason is that there is rarely a system in place for ensuring that procedures are modified to take into account organizational learning and gradual changes in working practices. In the military aircraft maintenance context for example, it may take months for recommended changes in working practices to actually be fed back to the equipment vendor so that they can be approved and appropriate changes made in the procedures themselves. In the light of these delays, it is not surprising that technicians frequently make informal changes to working practices without bothering to put these changes through the formal review system. This process gradually erodes the credibility of the official procedures, and can give rise to a considerable body of informal undocumented methods which may or
may not be effective. In CARMAN, the working practices which are actually used by the technicians are examined using a participative process which documents the variations that exist, and then attempts to evaluate them from the point of view of whether they are practical and whether they control all the risks associated with critical tasks. Best Practices are then developed and documented, which take into account the preferences and insights of the workforce, whilst ensuring that all risks are adequately controlled.
Developing a Participative Culture In any system of procedures there are three elements: the database of procedures held by the organization, the Best Practices which control risks in the most efficient manner and the preferred working practices of the technicians who actually perform the maintenance tasks. The key to eliminating non-compliance with procedures lies in ensuring that these elements converge. In order to achieve this, a process is required which harmonises working practices to achieve agreement about the best methods for performing maintenance tasks. It should be emphasised that such a process must not only include the maintenance technicians, but also technical specialists who may have insights into why a task should be performed in a particular way. This process seeks to provide a neutral forum for the exchange of information about differing working practices (e.g. between shift teams) and also to allow insights to be gained into the risks associated with different ways of carrying out tasks. Technical specialists contribute to this information exchange process, but do not dominate it. This is because it is essential to ensure that the developers of the revised procedures have a shared sense of ownership. This is a major factor in encouraging compliance, once a compromise has been established amongst the different stakeholders (i.e. technicians, maintenance teams and technical specialists) concerning the working practices that will be adopted.
Integration Between Training, Competency Assessment and Procedures One of the major reasons for lack of compliance with procedures is simply that the person making an error is unaware of the Best Practice for performing a task. This often arises from the absence of a system for generating Best Practice, which provides a baseline against which to develop training programmes and assess competency. Obviously, unless standardised methods have been agreed with regard to how risks are to be controlled in safety critical tasks, then assessing competency will be extremely difficult. Unfortunately many industries have adopted an approach which essentially relies on providing training in generic skills, with the assumption that task specific skills will be acquired through working with an experienced technician. Unfortunately, without the existence of a database of Best Practices, there will be no standardisation in the methods transmitted from the trainer to the trainee. The absence of the database also means that competency will probably be assessed against the standards of the trainer, rather than those defined by the Best Practices. In CARMAN, the procedures, training programmes and competency assessments are all based upon the same Best Practices.
Matching the Type of Procedural Support to the Needs of the End User
In most high risk industries it is common to find voluminous manuals containing detailed step by step instructions for performing tasks, in control rooms and maintenance technician’s office. However, a close examination of these documents generally shows that they are either in pristine condition, or are very dusty, both of which indicate that detailed step by step instructions are rarely consulted by experienced technicians. The insistence that a large volume of procedures is the best form of job aid is based upon a misunderstanding of the role of procedures. The Best Practice database generated by CARMAN is essentially for reference purposes, in that it provides the basis for training and competency assessment, and also documents the risks associated with tasks. Only a limited subset of the information in the database needs to be transmitted to the technician in the form of on-line job aids, to supplement the competencies acquired through training. Essentially, most tasks will be performed primarily on the basis of skill and experience. Experienced technicians will usually be operating in the skill based mode defined by Rasmussen’s5 classification. In some cases, some form of on-line job aid will be required, particularly if a task is complex and / or infrequently performed, and where the technician is likely to be operating in a rule-based mode. The format for such job aids is often best left to the discretion of the technician, since it needs to be tailored to his or her specific needs. Obviously, a trainee will require a more comprehensive set of job aids than an experienced technician. Many of the best job aids are found in technician’s Black Books and it is often a useful exercise to encourage the sharing of this information during the development and documentation of Best Practice. One of the functions of job aids is to provide the critical reference information such as dimensions and tolerances in an easily accessible form. One of the commonest forms of job aids in maintenance tasks are job cards. These should contain all the reference information required by the technician. However, unless the content of the job cards is based upon the Best Practice for the task, it is unlikely that all the relevant information will be available. The CARMAN process provides some decision aids for selecting the appropriate level of support.
THE CARMAN PROCESS CARMAN comprises two stages: the development and documentation of Best Practice, and the development of job aids, competency standards and training programmes based upon the Best Practices. Prior to commencing the steps of the first stages of CARMAN, it is first essential to appoint a facilitator, and to provide training in the tools and philosophy of CARMAN. His or her role is to collect information from the various technicians about their working practices, and to assist in the development of consensus regarding Best Practice. It is essential that the facilitator is respected by the technicians, and that he or she has good communication skills. It is also desirable to provide some awareness training for the technicians, and also basic training in task analysis. The first step of stage 1 is to list the tasks that exist in the system. This list is called a Task Inventory, and is intended to ensure that no important tasks are omitted. Following the development of the Task Inventory, a screening analysis may be conducted to identify all tasks which are considered to be critical. The current practices for the tasks of interest are then documented using Hierarchical task Analysis (HTA). This method of task analysis is used because we have found it to be particularly flexible in allowing tasks to be analysed at whatever level of detail is required to identify risks. Usually there will be discrepancies and differences between shift teams regarding how tasks should be performed. These are compiled by the facilitator, and then resolved by convening consensus groups, which examine the similarities and differences between methods. These groups also evaluate the consequences associated with various types of error, and on the basis of these risk assessments and the discussions, consensus is
reached on the Best Practice. At this stage, technical specialists are invited to the consensus sessions to comment on the draft Best Practices. Unless the specialists provide specific reasons for modifying the Best Practice, this is then appended to the database in the form of an HTA Reference Procedure together with information concerning the possible hazards and consequences. In Stage 2 of CARMAN, the Reference Procedures in the Best Practice database are used to develop competency specifications, training programmes and supporting job aids, based upon the level of on-line support required for each task. The primary factors that are considered when determining the level of on-line support are the severity of consequences if the task fails, the frequency with which the task is performed and its complexity. The more severe the consequences, the lower the frequency of task performance, and the greater the complexity, the more elaborate the level of support that is provided. An example of a decision rule for a set of operators is shown in Figure 19.2. In this figure, it can be seen that the majority of tasks will be performed without written instructions. As the tasks become more critical, complex and infrequent, the level of support increases. However, overall, less than ten percent of the tasks require step by step instructions.
Task Critically
High
Medium
Low
Task Familiarity Freq
Infreq
Rare
Freq
Infreq
Rare
Freq
Infreq
Rare
Task Complexity Low
NWI
NWI
JA
NWI
NWI
JA
NWI
NWI
NWI
Medium
NWI
JA
SBS
NWI
NWI
JA
NWI
NWI
NWI
High
JA
JA
SBS
NWI
JA
SBS
NWI
NWI
JA
No Written Instruction required (NWI) Job Aid required e.g. checklist/memory aid (JA) Step by Step instruction required (SBS) Figure 19.2: Decision Aid for Choosing Level of Job Aid Support
CONCLUSIONS This paper has described a systematic approach to the management of risk arising from human error and violations that has been applied to high-risk industries over the past five years. The intention of the paper has been to indicate the potential of the approach to achieving similar objectives in the aviation maintenance sector. Although we are only at the preliminary stages of applying CARMAN to this area, we believe that it has considerable potential.
REFERENCES 1. Embrey, D.E., Kontogiannis, T., & Green, M. (1994). Guidelines for Reducing Human Error in Process Operations. New York: Center for Chemical Process Safety. 2. ICAO Human Factors Digest No. 12 (1995). Human Factors in Aircraft Maintenance and Inspection. Circular 253-AN/151. 3. Free, R.J. (1994). The Role of Procedural Violations in Railway Accidents. Unpublished PhD thesis, University of Manchester. 4. Reason, J.T. (1990). Human Error. Cambridge: Cambridge University Press. 5. Rasmussen, J. (1981). Human factors in high risk technology (RISØ N-2-81). Roskilde, Denmark: Risø National Laboratories.
20.0 GUIDELINES IN PRODUCING AN EFFECTIVE SHIFT AND TASK HANDOVER SYSTEM Bob Miles Health And Safety Executive
SUMMARY This report reviews available literature on the topic of shift handover. The topic is defined and the task of controlling complex systems is examined, with particular reference to the offshore industry. Relevant theoretical work on effective communication is described and implications for effective communication at shift handover are drawn. The report then examines published accidents/incidents, where failures of communication at shift handover were amongst the contributory causal factors. Lessons from these incidents for effective shift handover are also explored. Various studies and surveys which have sought to understand and improve the process of shift handover are then described. Finally, existing guidance on shift handover is analysed and compared to knowledge which has been identified elsewhere in the review. The report draws conclusions regarding the current state of knowledge and highlights implications for best practice.
INTRODUCTION Maintaining continuity between shifts is important, not only in the offshore sector but in all continuous process operations. The present review will therefore draw upon research from all continuous process industries to inform good practice in offshore oil operations. It is anticipated that this report will also be useful to onshore continuous process industry operators.
Shift Handover: A Definition Consider the situation when a person with sole responsibility for a task takes a break from work, the returns to the same task following their absence. If the task has not been progressed or altered by someone else, communication is not an issue. Contrast this with work which is shared between more than one person or continues during an absence. Under such conditions, communication and coordination assume crucial importance. In industries which operate continuous processes, continuity is maintained across shift changes via shift changeover. Shift changeover typically includes 1) a period of preparation by outgoing personnel, 2) shift handover, where outgoing and incoming personnel communicate to exchange task-relevant information and 3) cross-checking of information by incoming personnel as they assume responsibility for the task. The goal of shift handover is the accurate, reliable communication of task-relevant information across shift changes, thereby ensuring continuity of safe and effective working.
CONTROLLING COMPLEX SYSTEMS: THE TASK Offshore oil exploration and production are continuous 24-hour operations. Personnel typically reside on the offshore installation for 2-4 week periods, working alternating 12-hour shifts. Their goal is to maximise exploration, production or support functions without compromising safety. Complex technical systems place demands on the operator's information-processing and decision-making skills. The operator may be physically remote from the system, and rely on an internal 'mental model' to understand and control the invisible process. The accuracy of this model determines how effectively operators start-up, monitor, adjust and shut-down the process. Successful control requires three components to be present: •
clear specification and understanding of the future goals of production
•
an accurate mental representation of the current state of the process
•
an accurate internal model of process dynamics.
Many continuous process tasks are characterised by long system response times between process alterations and effects. Actions may not have their effects until subsequent shifts. Without adequate communication of information at shift handover, diagnosis of effects resulting from actions on previous shifts is problematic. Amongst the distinctive features of offshore facilities are their geographical isolation and unusual shift patterns. All or part of the crew may leave the facility in a short period of time. Clarification of issues not adequately recorded or communicated at shift handover is therefore potentially problematic. Significant fluctuations in alertness and performance have been observed over two-week offshore shift cycles, the most marked and adverse effects occurring during the shift-change phase. Furthermore. offshore workers can be exposed to high noise levels. both on and off-duty, which increases potential for misunderstood verbal communications.
THEORETICAL WORK This section of the report reviews theoretical work on effective communication. By using concepts from the mathematical theory of communication, cognitive psychology and organizational behaviour, human communication can be analysed to understand how effective, reliable communication is best achieved. Aids and barriers to effective communication are identified and summarised and implications for effective shift handover communication drawn.
Communication theory and its implications Table 20.1 displays aids and barriers to effective communication derived from communication theory, and their implications for ensuring effective shift handover communication.
Table 20.1: Communication Theory & Implications for Effective Shift Handover Communication Aids to Effective Communication
Implications for effective shift handover communication
The intended communication must first be encoded and physically transmitted in the form of a signal, which may be written, spoken or gestured. The introduction of redundancy to a communication reduces the risk of erroneous transmission.
Information should be repeated via more than one medium, e.g. verbal and one other method (for example, written, diagrammatic, etc.)
Availability of feedback increases accuracy of communication.
Two-way communication with feedback is essential at shift handover.
Effective communication can be aided by qualitative aspects of speech, such as assessments of comprehension, confidence, competence gained via pace, phrasing, hesitancy and fluency.
Verbal face-to-face communication at handover is desirable.
Accurate alignment of present and future perceived system states (mental models) with actual system states, depends on successful communication. Successful communication is facilitated by a shared mental model.
Miscommunications and misunderstandings are most likely to occur when mental models held by incoming and outgoing personnel differ widely. This can occur during deviations from normal working, plant maintenance, following a lengthy absence and between experienced and inexperienced staff. In order to achieve shared mental models, handovers can be expected to take longer at such times.
Written communication is facilitated by design of documents which consider the information needs of the user, support the communication task and demand inclusion of relevant categories/types of information.
Operator supports (logs, computer displays) based on specification of the information needs of personnel at shift handover are likely to facilitate accurate communication.
Barriers to Effective Communication
Implications for Effective Shift Handover Communication
The intended message may be buried in irrelevant, unwanted information or “noise”, which requires time and effort to extract and interpret.
Key information needs to be specified and presented, and irrelevant information excluded.
Natural language is inherently ambiguous
Efforts need to be expended to reduce ambiguity by
1) carefully specifying the information to be communicated e.g. specifying a plant item and tag
2) facilitating two-way communication which permits clarification of ambiguity (which plant item are you referring to?. Transmission of information is limited by the capacity of the communication channel.
Eliminate unnecessary information.
Misunderstandings are an inevitable feature of human communication and effort needs to be expended to identify, minimise and repair misunderstandings.
Communication needs to be two-way, with both participants taking responsibility for achieving accurate communication.
People and organizations frequently refer to communication is unproblematic, implying successful communication is easy and requires little effort. Over-confidence and complacency are common.
Effort need to be expended by organizations to address complacency by
1) emphasising the potential for miscommunication and its possible consequences
2) setting standards for effective communication 3) developing the communication skills of organizational members.
Summary The review of communication theory indicates that to ensure effective shift handover communication organizations should: •
give effective shift handover communication a high priority
•
pay particular attention to handovers which occur when staff have returned following a lengthy absence from work; during plant maintenance; during deviations from normal working; and when handovers take place between experienced and inexperienced staff
•
specify key information needed by the incoming operator to update their mental model of plant status
•
use operator supports (logs, displays etc.) designed on the basis of the operator's information needs include communication skills in their selection criteria for shift-workers
•
develop the communication skills of existing staff.
Individual handovers should: •
be conducted face-to-face
•
be two-way, with both participants taking joint responsibility for ensuring accurate communication
•
use verbal and written means of communication
•
be given as much time as necessary to ensure accurate communication.
ANALYSIS OF PUBLISHED INCIDENTS Many accident analyses cite miscommunication as being amongst the contributory causes. In the aviation domain, constructive goal-oriented communication distinguishes successfully resolved safetv-critical incidents from those which were less effectively managed. The discontinuity of work which inevitably accompanies shift-working has been associated with an increased rate of accidents. Several studies report an increased rate of accidents at or near shift
changeover, with the highest incidence at the commencement of the shift. The MHIDAS database identifies three major accidents, resulting in 20 fatalities, 35 injuries and £46 million worth of damage which occurred at or following shift changeover. However, the specific reasons for the higher incidence of incidents at or near shift changeover are not known. There are five known published investigations into accidents/incidents where failure of communication at shift handover was held to have been a contributory causal factor. These were major accidents/ incidents resulting in actual or potential loss of life, major property damage and/or environmental impact. These incidents were therefore subject to very close scrutiny. It should be emphasised that, in each of the incidents described, failures of communication at shift handover formed part of a complex combination of design and operational failures. It is believed by the present author that these highly-publicised incidents form the tip of an iceberg of numerous unpublished lost production incidents or near-misses caused by failures of communication at shift handover.
The Sellafield Beach Incident During November 1983 highly radioactive waste liquor was accidentally discharged to sea from BNFL's Sellafield Works. The subsequent Nuclear Installations Inspectorate investigation found that, due to a failure of communication between shifts, a tank which was assumed to contain liquid suitable for discharge to sea, but in fact contained highly radioactive material, was discharged to sea creating an environmental hazard. This incident occurred during plant shutdown for routine annual maintenance. As a written description of the tank contents was carried forward from one shift log to the next, across several consecutive shifts, the written description of the tank contents changed from “ejections from HASW” to “ex HASW washout.” As a result of this change, what had originally been interpreted as highly radioactive material was later interpreted as being low level effluent suitable for discharge to sea. In this incident, the contents of the tank were described in terms of their origin, rather than their nature. Liquid waste handled at the plant could be categorised as highly active liquid waste, medium active liquid waste or low level effluent. Failure to describe the tank's contents in such unambiguous categorical terms, when coupled with transcription errors made as written log book contents were copied from page to page, led to a misunderstanding. A subsequent safety audit of BNFL Sellafield Works found that plant managers' responsibilities for shift handover were outlined by a statement of objectives, rather than procedures which indicated how an effective handover should be conducted. The audit report recommended the establishment of a common procedure for handover between shifts at all managerial and supervisory levels.
The Piper Alpha Disaster The Cullen Report concluded that one of the many factors which contributed to the Piper Alpha disaster was failure of transmission of information at shift handover. Specifically, knowledge that a pressure safety valve had been removed and replaced by a blind flange was not communicated between shifts. Lack of this knowledge led to the incoming shift taking actions which initiated the disaster. The Cullen Report concluded that there were no written procedures for shift handover. Furthermore, the type of information which the lead production operator wrote on his notepad and communicated at shift handover was left to his discretion. There was no pre-determined analysis or categorisation of important
items to include in the handover and maintenance work was not always included in logs.
The Sutherland fatality The Cullen Report also refers to an incident in 1987 when an offshore contractor's rigger was fatally injured whilst preparing to crane-lift a motor. The platform operator subsequently pleaded guilty to a prosecution under the Health and Safety at Work Act. The complaint specified 'inadequate communication of information from the preceding day-shift to night-shift'. Further information on this incident is not publicly available.
The Windscale Vitrification Plant Shield Door Incident In this incident, a container of highly radioactive vitrified waste was raised into a control cell for monitoring. Due to failure of six separate engineered and procedural protective systems, two shield doors designed to protect people outside the cell from radiation were left open. No-one was exposed to radiation as a result of the incident, however the potential for significant overexposure did exist. Failure of the six protective systems was due to a complex coincidence of design and procedural errors. The sequence of events leading up to the incident began with maintenance work on a cell robot. Due to unforeseen complications, this work continued over four consecutive shifts. To resolve problems encountered during maintenance, a temporary plant modification proposal (TPMP) was issued to temporarily override a programmable logic controller. Details of the TPMP were referred to in the Shift Manager's TPMP book, shift log book and the permit to work. Following completion of the maintenance work, the control cell was re-commissioned without removal of the temporary over-ride. It appears the existence of the temporary over-ride had been forgotten as an initial reference to its existence had not been carried forward from shift to shift in the Shift Manager's log book. Ironically, the programmable logic controller which had been temporarily overridden contained a coding error which rendered it ineffective. Had this device been working properly, recommissioning the control cell with the temporary override still in place would have made raising the container impossible, thus preventing the incident. The HSE report on the incident highlighted the need for 'proper transfer at the time of shift handover of the necessary information on the status of the plant, particularly in relation to any modifications, whether temporary or permanent, and any permits to work (p.11)'.
A serious injury during offshore maintenance HSE guidance on how offshore workers can help improve health and safety includes a case study on failure of communication at shift handover. A man was seriously injured while repairing a valve in a high pressure line. The accident happened when workers on one shift isolated the valve by shutting a valve on either side and opening the drain-line between. They knew the isolating valves were not operating properly so they closed the drain-line again. They left a message for the next shift that it must be re-opened first to blow the line down. The permit to work and Isolation Certificate did not describe the method of isolation in detail. During the shift handover, the message was not passed on. A fitter (who was
unfamiliar with that type of job) removed the clamp bolts holding the pipe flanges together, instead of just loosening them and cracking a joint. Pressure had built up in the line again and a coupling blew apart. The fitter received very serious head injuries and will never fully recover.
Published incidents and communication theory When analysed in terms of communication theory, these incidents forcibly demonstrate the consequences of: •
failing to take account of the inherent ambiguity of natural language
•
the increased potential for misunderstanding present when people hold differing mental models of plant status
•
failure to consider the information needs of others, and provide a means of capturing key information unambiguously
•
over-reliance on one means of communication, namely one-way written communication. In four of the five incidents, communication by written means failed as the intended message was misunderstood or simply not communicated.
Summary The incidents described identify areas of risk at shift handover. •
All the incidents involved planned maintenance work.
•
In some of the incidents planned maintenance work continued over a shift change. Thorough communication of such work should be afforded a very high priority.
•
Operator supports (logs) were not designed to capture key information reliably and unambiguously.
•
A lack of procedures which specified how to conduct an effective shift handover was evident.
•
Inaccurate and unreliable carry-forward of written information from shift to shift was evident. For example, reference to a temporary safety system over-ride was not carried forward.
EMPIRICAL WORK This section of the report first describes two studies which compared the effects of 8-hour versus 12-hour shifts on communication between shifts. Two further groups of empirical studies are then reviewed which sought to a) observe, understand and describe how personnel responsible for continuous process tasks hand over the task to incoming personnel and b) improve the content and process of shift handover.
8-Hour vs. 12-Hour Shift Working The effects of a change from 8-hour to 12-hour working in fifty US and Canadian chemical and petroleum industries were examined in a 1977 study. A field survey of managers' opinions concluded that, on balance, inter-shift communication gained in continuity with 12-hour shift working as the number of
handovers per day decreased by 50%. 12-hour shift personnel frequently received their shift handover from the same person who they had briefed 12 hours earlier. Communications between production and maintenance staff were also reported to improve, as most maintenance work was started and completed within the 12-hour day shift, rather than spanning the two 8-hour morning and evening shifts. The need to brief incoming staff about ongoing maintenance work was therefore reduced. Disadvantages of 12-hour working for communication included less opportunity to interface with day staff and a need for greater reliance on written communication and log-keeping. Further consequences of 12-hour working were longer breaks between tours of duty, necessitating longer shift handovers to ensure all information was understood and incoming staff requiring a longer time to become reacquainted with operations. The effect of a change from 8-hour to 12-hour shifts was studied in depth at a US experimental nuclear reactor. Possible effects on alertness and shift to shift communication were examined. Computerised cognitive tests of alertness were conducted. Accuracy of log book entries was quantified before and after the change from 8-hour to 12-hour working, and operators were questioned about effects of the change. Operators were slightly less alert on 12-hour shifts. The base-line error rate in log books, which was initially very low, declined further following the change. Operators reported greater ease in supervising day-shift craft personnel. Eighty percent of operators reported shift handover communication was easier under the 12-hour shift system. Much of the improvement was attributed to the fact that, on 12-hour shifts, the incoming personnel received their shift handover from personnel they handed over to 12 hours earlier. The change to 12-hour working meant breaks between work lengthened from 4 to 7 days. A significant proportion of staff reported that shift handover communication was more difficult following a 7-day absence, taking longer to 'get back in the groove' of what had happened.
Shift Handover In Process Industries The first group of empirical studies concern process operators, supervisors and managers in the nuclear reprocessing, chemical, paper manufacture and oil-refining industries.
Chemical Industry A recent survey of permit-to-work systems in 19 small to medium-sized UK on-shore chemical plants identified communication at shift handover as a problematic issue. Fifty maintenance fitters, supervisors and managers were interviewed. One of the survey questions concerned the sequence of events at shift changeovers. When asked whether work should carry on over the shift change with an existing permit? the majority of fitters and supervisors replied that a new permit should be issued. In contrast. the majority of managers were of the opinion that work should carry on with the existing permit. A lack of clarity about how to keep incoming personnel informed of the current work situation was evident. The survey report recommended that a formal procedure for both maintenance and production shift handovers be developed which included face-to-face communication between in-coming and outgoing supervisors and a means of informing the incoming shift of work in progress.
Nuclear reprocessing industry Formal shift handover procedures and two-way face-to-face communication were evident when production supervisors and managers in a nuclear reprocessing plant were observed during shift changeover35 and their handovers tape-recorded. Considerable time and effort was devoted to preparation
for shift handover by outgoing personnel. During their shift information was collated, checked and recorded in a written log which summarised plant status. This log had a pre-determined structure to ensure that key items of information pertaining to safety, production and technical problems (ongoing and resolved) were included. The process of collation and checking intensified towards the end of the shift. Information was collated from a variety of sources including other written logs, face-to-face discussion with colleagues and personal inspection of the plant. All handovers occurred face-to-face with the shift log present, providing an opportunity for the incoming participant to give feedback or ask for clarification. The content of the shift log was used to structure the verbal handover, which elaborated upon the written log entries. During the handover, outgoing personnel gave information and opinions. Incoming personnel gave their colleagues passive and active feedback. The crucial importance of a two-way discussion at shift handover was demonstrated by detailed analysis of sixteen taped handover conversations and written logs. A total of six instances of misunderstandings arising during conversation were identified. The majority of these misunderstandings occurred during discussion of deviations from normal working. Four of these misunderstandings related to safety issues. On each occasion the misunderstanding was identified and repaired by the potential 'victim' of the misunderstanding taking an active part in the handover by asking for confirmation, clarification and repetition. When incoming personnel had been absent for a ten-day rest period, additional effort was expended by outgoing personnel when preparing for such handovers. A summary of important events which had occurred during the incoming participant's absence was prepared and included in the verbal handover. The average ten-day handover took longer to complete. Significantly more information was given during ten-day handovers. The difference in length was accounted for by the outgoing participant giving additional historical information to bring the incoming participant up-to-date with current plant status. Following a ten-day handover, incoming personnel read through the logs covering the period of their absence to update their knowledge and cross-check this with the information given to them by their colleague. Management procedures pertaining to shift handover recognised the importance of face-to-face communication, specifying that handovers must be conducted in this fashion. The problematic nature of ten-day handovers was also recognised, and it was expected that such handovers would take longer to complete than normal handovers. A thirty-minute shift overlap was allowed for all handovers.
Paper manufacturing industry The importance of two-way communication at shift handover in preventing misunderstandings was also illustrated by a study of process operators in a French paper manufacturing plant. During one handover, an operator arriving to commence a shift observed a colleague adjusting the paper-making machine. In the absence of a verbal or written handover, the incoming operator made an incorrect assumption about the cause of the breakdown. Whilst no adverse consequences resulted this incident demonstrates how the absence of verbal communication increases the potential for misunderstandings.
Oil-refining industry Improvements to communication at shift handover were reported following a research-based intervention
in a UK oil refinery. Prior to the intervention. process operators and supervisors recorded information to be communicated at shift handover in an unstructured desk diary. Although shift handover was deemed important by management. no guidance was available to operational personnel specifying how to conduct an effective handover. The intervention involved process operators and supervisors in defining the information they would need at the start of a shift to do their work safely and effectively. Information needs were categorised and these categories used as the basis for designing structured log books for each post. Critical incident interviews were held with experienced personnel to elicit effective handover behaviours, from which behavioural guidelines were developed, specifying how to conduct an effective shift handover. The project affected 315 personnel in 63 posts refinery-wide. Some 2-3 months after implementation, 70 personnel (21% of users) were interviewed to evaluate the intervention's effectiveness. Three-quarters of those interviewed believed the introduction of structured logs had a beneficial effect on how log books were completed, citing greater continuity between shifts, more information being passed between shifts and key items (e.g. equipment out of service) being recorded in writing and discussed verbally. Over half of those interviewed believed the introduction of structured logs had also led to improvements in the way handovers were conducted. Colleagues talked through the log book in a more structured fashion and major problems were being highlighted more reliably. Involving end-users in design and implementation of communication methods and processes was held to be a major influence on the project's success.
Shift Handover In Nursing Care There are many parallels between continuous process tasks in industry and provision of in-patient nursing care. Both are delivered on a 24-hour basis by shift workers, who must communicate information on the human or technological systems they monitor and control across shift changes. In nursing, inaccurate communication or misunderstandings can lead to hazardous actions and medicolegal liability. A body of research on communication at shift handover in the nursing profession exists, which is summarised below. A review of the nursing literature identifies two major considerations: the goal of the nursing task and the process of communication. Definition of the task role lends clarity to the goal of shift handover; namely to accurately communicate information so that safe nursing care can be provided from an adequate knowledge base. The review recommends basing the format and content of intershift reports on a conceptual model of the nursing task, thereby guiding the gathering of discrete, useful data to achieve the task goals. Empirical studies of nursing have identified a number of problems associated with shift handover, implemented solutions and evaluated outcomes. Problems included reactive, routine factual reports rather than problem solving reports, missing, unnecessary or inaccurate information of variable quality and failure to carry forward information over successive shifts. Solutions attempted were of three types: meeting nurses' information requirements by formatting documentation on the basis of a conceptual model of the nursing task, altering other methods of communication at shift handover and providing training on giving shift reports. One study implemented a computer generated shift report solution to provide pertinent and necessary information, reduce time spent on shift handover and minimise interruption to ongoing work. Report
categories were established, with an emphasis on reporting of abnormal findings/results. Guidelines for giving and receiving a report were also written. The need to transcribe information which had not changed from shift to shift was eliminated via the use of a computer system, thereby reducing the risk of transcription errors. When evaluated, the reported benefits included improved communication of pertinent information In a separate study, nurses opinions on the efficacy of tape-recorded versus oral shift-to-shift reports were sought. Although taped reports were held to be less time consuming, they were deemed most appropriate for patients whose condition required little elaboration. In contrast, intensive care and coronary care nurses preferred a verbal report as the complex measures involved in a patient's care required elaboration and discussion with their relief. Taped reports had been tried and found inadequate. In a third study, concern existed over traditional methods of inter-shift reporting which were largely verbal, time-consuming and contained a considerable amount of unnecessary information. Staff were encouraged to become involved in designing and implementing new methods and processes of inter-shift communication. A revised reporting format was introduced, and written guidelines for giving a shift report prepared. The project was informally evaluated. Benefits reported included more accurate and comprehensive written information and more efficient use of time. Staff involvement was seen as crucial to the project's success.
Summary This review of empirical studies of shift handover identifies that: •
when compared to 8-hour shifts, communication at shift handover is reportedly improved in 12hour shifts. Greater reliance is however placed on written communication, and longer shift handovers are required. More effort is also needed to brief personnel who have been absent for longer periods.
•
specification of information needs, and introduction of a method for capturing such information systematically, aids communication at shift handover (e.g. structured written log, computer-based log).
•
information needs should be analysed on the basis of task goal.
•
provision of guidance on how to conduct an effective shift handover has been found useful.
•
critical incident technique is a useful method for identifying effective and ineffective behaviours at shift handover.
•
misunderstandings do occur during shift handovers between experienced operators, and are repaired by face-to-face, two-way communication.
•
involvement of end-users when implementing changes to established methods of communication at shift handover aids their acceptance and use.
•
additional preparation, time and effort is required for shift handovers which take place after a lengthy absence. This fact should be reflected in management procedures and day-to-day practice.
•
written transcription of information from page to page across successive shifts is time-consuming and error-prone, and can be aided by use of a computer-based log system.
EXISTING GUIDELINES Given the important contribution of effective shift handover communication to industrial safety, what guidance is available to those seeking to improve their current practice? Five sets of guidance were reviewed to answer this question. 1. The Health and Safety Executive report entitled 'Dangerous maintenance', which includes guidance on how to prevent maintenance accidents in the chemical industry 2. Oil Industry Advisory Committee (OIAC) guidance on permits-to-work in the petroleum industry 3. Health and Safety Executive guidance on human factors in industrial safety 4. The Institute of Electrical and Electronics Engineers human factors guidance for Nuclear Power Generating Stations 5. Human Factors Reliability Group guidance on reducing human error in process operations The first two sets of guidance refer specifically to permits-to-work and ask 'is there a shift-change procedure for permits-to-work?' and 'does the permit include a handover mechanism for work which extends beyond a shift or other work period. including work which has been suspended?'. HSE human factors guidance poses the question 'what arrangements (e.g. written logs. formal handover procedures) are there for conveying information between shifts on matters such as maintenance in progress. plant out of service, process abnormalities etc.?' This guidance also asks ' are procedures for communication between departments (e.g. operations and maintenance) and within departments well-defined and monitored?' IEEE guidance recommends 'proper (shift) turnover methods' be incorporated to ensure that the next shift has received and understands the current operating status of all plant and systems. Human Factors Reliability Group guidance draws attention to the importance of shift handover by referring to the Piper Alpha disaster and highlights the need for written procedures.
Summary All of the guidance reviewed succeeds in drawing attention to the importance of shift handover, and in some cases refers to information which is particularly important to communicate accurately; i.e. permits-to-work, maintenance in progress, plant out of service, process abnormalities. None of the guidelines indicate: •
the elements which should be present for effective communication: i.e. analysis of information needs; face-to-face, two-way communication; written and verbal communication etc.
•
all known risk areas: for example, during deviations from normal working; during maintenance, particularly if work continues over a shift change; between experienced and inexperienced staff; following a lengthy absence from work.
•
a suggested approach to improving current practice, yet this is presumably why many people consult guidelines.
CONCLUSIONS This report has confirmed the importance of shift handover in ensuring safe and efficient continuity of work on continuous process industries. On the basis of the literature reviewed, clear conclusions can be drawn about the responsibilities of organizations operating continuous processes offshore and supervisors of continuous process staff. They should: •
give effective shift handover communication a high priority
•
include communication skills in their selection criteria for shift-workers
•
develop the communication skills of existing staff
•
provide procedures which specify how to conduct an effective shift handover
•
place greater reliance on written communication when 12-hour shifts are in operation, and allow for longer shift handovers. More effort is needed to brief personnel who have been absent for longer periods
•
where possible, plan maintenance work to be completed within one shift, thereby eliminating the risk of miscommunication of maintenance issues at shift handover.
Sufficient information is available to provide general guidance on how to conduct an effective shift handover, which should be: •
conducted face-to-face
•
two-way, with both participants taking joint responsibility for ensuring accurate communication
•
via verbal and written means
•
based on a pre-determined analysis of the information needs of incoming staff
•
given as much time as necessary to ensure accurate communication.
Sufficient information is also available to provide guidance on how to assess and improve current practice. This includes: •
specification of key information needed by incoming operators to update their mental model of plant status
•
design of operator supports (logs, displays etc.), based on the operator's information needs
•
involvement of end-users when implementing changes to established methods of communication at shift handover, thereby facilitating their acceptance and use.
This literature review has identified areas of risk, namely: •
during plant maintenance, particularly when this work continues over a shift change. Thorough communication of such work should be afforded a very high priority
•
when safety systems have been over-ridden
•
during deviations from normal working
•
following a lengthy absence from work
•
when handovers are between experienced and inexperienced staff.
Further research which compares best practice described in this report with current practice offshore would help to identify areas for improvement. A second area meriting further research is how to ensure accurate and reliable and unambiguous carry-forward of written information from shift to shift. Information technology offers a possible solution.
REFERENCES 1. Lardner, R. (1992). Do you know what I know?: a field study of shift handover in a safety-critical industry. Unpublished MSc Thesis, University of Sheffield. 2. Grusenmeyer, C. (in press). 'Shared functional representation in co-operative tasks. The example of shift changeover' in International Journal of Human Factors in Manufacturing. 3. Kragt, H., & Laandweerd, J. (1974). 'Mental Skills in Process Control' in Edwards, E. & Lees, F. (eds) The Human Operator in Process Control. London: Taylor Francis. 4. Wickens, C.D. (1984). Engineering psychology and human performance. Columbus, Ohio: Merril. 5. Parkes, K.R. (1993). Human factors. shift work and alertness in offshore oil industry. Report OTH 92 389 London: HMSO. 6. Ross, B.C. (1978). 'Noise on offshore platforms' in Occupational Health, Vol 30, No 11 pp 524-527. 7. Shannon, C.E., & Weaver, W. (1949). The mathematical theory of communication. Champaign, IL: University of Illinois Press. 8. Hunns, D. (1986). 'Human Factors in Reliability and the Psychology of Communications' in International Journal of Quality and Reliability Management 3,1, pp 22-37. 9. Axley, S.R. (1984). 'Managerial and organizational communication in terms of the conduit metaphor' in Academy of Management Review, 9, pp 428-37. 10. Bellamy, L. J. (1984). 'Not Waving but Drowning: Problems of Human Communication in the Design of Safe Systems' in Proc. I. Chem. E. Symposium no 90, pp 167-177. 11. Shannon, C.E., & Weaver, W., op cit. 12. Leavitt, H.J., & Mueller, R. (1962). 'Some effects of feedback on communication' in Hare, A.P.; Borgatta, E.F.; Bales, R.F. (eds.) Small Groups: Studies in Social Interaction. New York: Knopf. 13. Hopkin, D.V. (1980). 'The measurement of the Air Traffic Controller' in Human Factors, 27(5), p 547-560. 14. Hunns, D., op cit.
15. Miller R.B., (1984). 'Transaction structures and format in form design' in Easterby R. and Swaga, H. (eds) Information Design. Chichester: John Wiley. 16. Bellamy, L.J., op cit. 17. Reddy, M. (1979). 'The conduit metaphor - a case of frame conflict in our language about language' in Ortony, A. (ed.) Metaphor and Thought pp 784-374. Cambridge: C.U.P. 18. Shannon, C.E., & Weaver, W. op cit. 19. Axley, S.R., op cit. 20. Axley, S.R., op cit. 21. Weich, K.E., (1990). 'The vulnerable system: An analysis of the Tenerife air disaster' in Journal of Management Vol 16, No 3, pp 571 -593. 22. Tjosvold, D. (1990). 'Flight crew collaboration to manage safety risks' in Group & Organization Studies vol 15 no 2 pp 177-191. 23. Cloutier, E., & LaFlamme, L. (1984). Analysis of 94 occupational accidents which occurred in sawmills between 1st Jan and 31st October 1993, Quebec, Canada: IRSSTQ. 24. Werner, E. et al (1979). Working hours and accidents Dortmund, Germany: Bundesanstalt fur Arbeitsschutz und Unfallforschung. 25. Godimu, P. et al (1977). Medical problems of shift work Lille, France: Caisse regionale d'assurance maladie du Nord de la France. 26. Major Hazard Incident Data Service: AEA Technology / HSE. 27. Health and Safety Executive (1983). The contamination of the beach incident at British Nuclear Fuels Limited. Sellafield. November 1983. London: HMSO. 28. Health and Safety Executive (1986). Safety Audit of BNFL Sellafield 1986. Vol 1 & 2 HSE (NII), London: HMSO. 29. Department of Energy (1990). The Public Enquiry into the Piper Alpha Disaster Vols I & 2 Cm 1310 London: HMSO. 30. Health and Safety Executive (1991). Windscale Vitrification Shield Door Incident, 15 September, 1991. London: HMSO. 31. Health and Safety Executive (1994). Play Your Part: How offshore workers can help improve health and safety. London: HMSO. 32. Northrup H.R. et al (1979). 'The twelve-hours shift in the petroleum and chemical industries' in Industrial and Labor Relations Review Vol 32, No 3. 33. Lewis, P.M., & Swaim, D.J. (1988). 'Effect of a 12-hour/day shift on performance' in Proceedings of the 4th IEEE Conference on Human Factors and Power Plants June 5-9, pp 513-6 Monterey, California: IEEE. 34. Riley, D.B., & Weyman, A.K. (1995). 'A survey of permit-to-work systems and forms in small to medium sized chemical plant' in IChemE Symposium Series No 139 pp 367-380.
35. Lardner, R. (1992). op cit. 36. Grusenmeyer, C. (in press). op cit. 37. Adamson, S.S., & Lardner, R. (1995). 'Safe communication at shift handover: setting and implementing standards' in IChemE Symposium Series No 139 pp 411-424. 38. Riegel, B. (1985). 'A method of giving intershift report based on a conceptual model' in Focus on Critical Care Vol 12. No 4 pp 12 - 18. 39. Vandenbosch, T.M. (1986). 'Tailoring care plans to nursing diagnoses' in American Journal of Nursing Vol 3 pp 312-314. 40. Kihlgrhen, M. et al. (1992). 'The content of the oral daily reports at a long-term ward before and after staff training in integrity promoting care' in Scand J Caring Sci Vol 6, No 2 pp 105- 112. 41. Baldwin, L., & McGinnis, C. (1994). 'A computer-generated shift report' in Nursing Management Vol 25, No 9. pp 61 - 64. 42. Young, P. et al. (1988). 'Implementing changes in critical care shift report' in Dimensions of Critical Care Nursing Vol 6, No 6 pp 374 - 379. 43. Richards, J.A. (1988). 'Congruence between intershift reports and patients' actual conditions' in Image: Journal of Nursing Scholarship Vol 20, No 1. pp 4 - 6. 44. Joy, P.M. (1975). 'Maintaining continuity of care during shift change' in Journal of Nursing Administration Vol 5, pp 28 - 29. 45. Ross, M.E. (1964). A thematic content analysis of the nursing change-of-shift reports Los Angeles, California. Unpublished master's thesis. 46. Baldwin, L., & McGinnis, C. (1994) op cit. 47. Mitchell, M. (1976). 'Inter-shift reports: to tape or not to tape' in Supervisor Nurse Vol 7, October 1976, pp 38-9. 48. Young, P. (1988) op cit. 49. Health and Safety Executive (1987). Dangerous maintenance: a study of maintenance accidents in the chemical industry and how to prevent them. London. HMSO. 50. Oil Industry Advisory Committee (1986). Guidance on permit-to-work systems in the petroleum industry. London HMSO. 51. Health and Safety Executive (1991). Human factors in industrial safety. London: HMSO. 52. IEEE (1989). IEEE Guide for the application of Human Factors Engineering to Systems, Equipment and Facilities of Nuclear Power Generating Stations. New York: The Institute of Electrical and Electronics Engineers. 53. The Human Factors in Reliability Group (1991). The guide to reducing human error in process operations. Warrington: The SRD Association.
21.0 WIRELESS TECHNOLOGY: DELIVERING TECHNICAL INFORMATION TO LINE MAINTENANCE MECHANICS Phil Hastings Galaxy Scientific Corporation and Jose Lizarzaburu Electronic Data Systems
INTRODUCTION As part of a joint effort between the Federal Aviation Administration and Continental Airlines, a study was conducted at George Bush Intercontinental Airport in Houston for the purpose of determining the feasibility of using Portable Data Terminals (PDT) to display aircraft maintenance documents. The PDT devices were connected to a network via spread spectrum (no FCC license required) Radio Frequency (RF) transmission. The study was arranged to use the PDTs in much the same way as they would be used in a production environment. A script was created using actual aircraft maintenance documents such as the General Maintenance Manual (GMM), Illustrated Parts Catalog (IPC), Minimum Equipment List (MEL) and others. The purpose of the study was two-fold, to evaluate the human factors using specific vendor equipment and to sample response times for additional vendors as a continuation of testing performed in the summer of 1996. A total of three vendors completed the requirements to participate in the study. For the human factors evaluation, aircraft line maintenance mechanics performed simulated maintenance tasks while using the PDT devices. At the conclusion of the simulated maintenance the aircraft mechanics were surveyed to gather data necessary for the evaluation. This report concludes that based on the human factors issues that it would be feasible to use both RF and Portable Data Terminals in a production aircraft maintenance environment. The objective of the Technical Test was to obtain a sampling of response times that can be expected when these devices are implemented in a line maintenance environment. Based on the results of the technical testing, it was determined that although some vendors response times were better than others, there were no clear cut winners that out performed the others conclusively. Furthermore with exceptions for certain dead zones, response times were for the most part acceptable for use in a production environment.
BACKGROUND Aviation Maintenance Technicians (AMTs) typically access maintenance documents using microfilm or microfiche, and print copies of these documents for use during work tasks. Increasing demand for fast and accurate maintenance information prompted research into alternative methods of passing technical documents to AMTs. Continental Airlines, EDS, and Galaxy Scientific Corporation (under FAA Contract No. DTFA01-94-C-01013) worked in partnership to explore the feasibility of spread spectrum wireless technology in line maintenance. The study focused on the delivery of technical publications to line maintenance technicians using portable pen-based computers that displayed technical publications. Types of information tested during the study included Maintenance Manuals (MMs), Illustrated Parts Catalogs (IPCs), General Maintenance Manuals (GMMs), Minimum Equipment Lists (MELs) and Structural Repair Manuals (SRMs). The format of these documents was Adobe™ Portable Document Format (PDF). The research team defined line maintenance tasks and compiled the relevant technical publications required for each task. The team developed a structured script that enabled mechanics to simulate five troubleshooting scenarios. The team also wrote a technical testing script that enabled the team to record response times for each vendor and network architecture.
Test Environment and Method Tests were conducted during the night shift at Bush International Airport in Houston, TX. A total of three vendors participated in the testing which started July 29th and ended August 12th, 1997. Weather conditions were favorable during every test. Testing began with the outside setup of the hardware at Gate 40 around 9:00pm. A Boeing 737-500 arrived for overnight servicing around 10:00pm, when the simulation took place. The average length of time for a given test was approximately 5 hours. The study consisted of two types of testing. The first type, called the technical test, evaluated response times and network load for each of the vendors. The technical test included a simultaneous use test, in which multiple computers downloaded technical documents at the same time. The second type, called the human factors test, involved a script of five troubleshooting tasks that were designed to require the testing mechanics to utilize all types of technical manuals. The mechanics simulated completion of five open logbook items while using the handheld computers to lookup necessary information in the technical manuals. After completing the script, mechanics rated the usability of the pen computer and digital manuals.
Participants Participants in the study included the vendors who supplied the wireless LAN test equipment, the technical testers who measured performance aspects of the equipment, and the testing mechanics who gave subjective evaluations of the equipment.
Vendors
A total of three vendors participated in the wireless testing. A requirements list was provided to each vendor to standardize the testing environment, however this list was not strictly followed by any vendor. Requirements included pen computers with Windows 95 or Citrix Winframe™ Client, 2 wireless access points to an Ethernet-based LAN, extra batteries, carrying cases and straps, external keyboards if needed, and technical support during the testing. All of the vendors provided portable pen computers capable of operating on a wireless spread spectrum LAN (frequency-hopping 2.4 GHz band). The server for the LAN was either provided by the vendor or by Continental Airlines, depending on vendor preference. The following paragraphs describe in detail each of the vendor’s hardware and network architecture. Vendor #1: July 29th, 1997 Server: Dell Pentium 133Mhz with 64MB RAM, Windows NT 3.51 running sessions of Citrix Winframe. Clients: Wyse Winterm 2930, running Citrix Winframe client from the server. There is no hard drive in these units, only firmware ROM and 4MB RAM which contains the Winframe software and startup operating system. The display was dual-scan color LCD. Wireless Architecture: Two Proxim access points with standard gain antennae. Access points were mounted on adjacent jetways (approximately 150 ft from the server) and connected to the hub with twisted pair Ethernet cable. Vendor #2: August 5th, 1997 Server: Dell Pentium 133Mhz with 32 MB RAM, Windows NT 4.0. Clients: Fujitsu Stylistic 1000RF with 24MB RAM, Windows 95, transflective LCD displays. Used NetBEUI protocol with direct drive mapping to server. Wireless Architecture: Two Proxim access points, one with high gain omnidirectional antenna mounted above adjacent jetway, and one with medium gain directional figure-eight antenna mounted on the server platform in front of the aircraft. Connected to hub with twisted pair Ethernet cable. Vendor #3: August 12th, 1997 Server: Dell Pentium 120Mhz XPi with 32 MB RAM, Windows NT 3.51 running sessions of Citrix Winframe. Clients: Fujitsu-ICL TeamPad 7600 with 16MB RAM, each running Citrix Winframe™ client sessions. Active color LCD display. Wireless Architecture: Two RDC access points mounted on adjacent jetways with standard gain antennae, connected to hub with twisted pair Ethernet cable.
Technical Testers Participating technical testers were members of the research team that helped to facilitate the human factors scripting and then measured performance of the computers. The testing team was made up of representatives of Continental Technical Publications, EDS Network Architects, EDS Maintenance Automation Consultants, and the Galaxy Scientific Corporation.
Mechanics The research team requested that three mechanics be present for each test, preferably the same mechanics each week to minimize variation of individual preference and initial training. However, only two mechanics were present for each test due to unforeseen sickness and scheduling difficulties. All participating mechanics had at least ten years experience as an AMT and understood the line maintenance tasks well. One mechanic was present for all three trials. One mechanic was present for the last two trials, and one mechanic was present for only the first trial. Mechanics had a wide variation of skill level with computers. The most proficient mechanic owned an Apple Macintosh computer and was familiar with the Adobe Acrobat Reader and the use of PDF files. The least proficient mechanic had not ever used a computer.
TECHNICAL TESTING The Radio Frequency - Portable Data Terminal technical test was conducted to measure response times for hand-held portable computing devices at an airport aircraft maintenance environment. Multiple vendors participated in these tests with each operating under similar circumstances and with comparable equipment. The testing was conducted over a period of three weeks. Five different vendors were originally scheduled to participate. The three previously mentioned vendors completed their participation, one however could not meet the time window for participation, the other had inadvertently routed their equipment to the wrong location.
Test Methodology This test consisted of loading and navigating the same documents described in the Overview of Study section of this document. In each case the documents were loaded on the server and displayed on the portable data terminals. A stopwatch was used to determine response times in loading and navigating through the various types of documents. The same tests were repeated in different sections of the aircraft. This was done to produce a test environment consistent with that which would be encountered in real life aircraft maintenance situations. With the exception of the first test, the tests were performed simultaneously on two Portable Data Terminals loading the same data at the same time in the same section of the aircraft. The first test was
performed on a single device while another device was being used to do similar tasks on other sections of the same aircraft, this situation would have likely produced better results in the response time testing.
Results For vendor #1 and #2, certain areas of the aircraft were out of the range of coverage, causing the portable data terminal lose communications with the access point. The most troublesome area was the aft lavatory. However, vendor #3 had no difficulty with signal loss in any part of the aircraft. In general, response times were adequate for use during line maintenance tasks. The average response time for a document load was only 1.9 seconds for the fastest vendor, #3. The most significant impact on response time appeared to be RAM and not the wireless link. This is an encouraging finding, suggesting that the only barrier to good response time is screen painting speed rather than lack of bandwidth. This means that feasibility of wireless connectivity is very positive. With augmented video RAM capability, response time should average in the sub-second range.
HUMAN FACTORS EVALUATION Human factors refers to a set of engineering principles that takes into account the perceptual, physical, and mental constraints of humans as they complete work tasks. A central goal of human factors is to create and evaluate work tools and environments to achieve an optimum “human” fit. With the introduction of new technology, an assessment of the human impact should be undertaken to understand the benefits and costs associated with the technology. Prototype analysis and pilot group user feedback are valuable sources of information about how changes in work design affect productivity and job satisfaction. The current study attempts to evaluate the usability of a proposed method of delivering technical manuals to AMTs. The human factors evaluation targets a number of subjective aspects of the system, including screen legibility, computer responsiveness, timesaving potential, usefulness for the job, and other characteristics.
Methodology The objective of the human factors test was to ask mechanics to use the proposed system for an extended period of time and make an assessment about it’s usefulness and usability. In order to make certain that each mechanic tested all aspects of the system in a standard way, a structured script was developed. Members of Continental’s Maintenance Operations and Technical Publications met to create a set of five troubleshooting tasks that would require technical manual lookups. A stipulation of the scenarios was that the mechanics would need to visit major zones of the aircraft to complete the lookups. Additionally, the mechanics would have to solve simple troubleshooting tasks and record their answers on the scripts so that the researchers could be sure that the mechanics were completing the entire script. The scriptwriting was assisted by an outside consultant from Galaxy Scientific Corporation to ensure that clear and concise language was used. Hints were also added to the right hand side of the script so that mechanics could refer to them if needed. The script underwent minor revisions after the first trial due to
typographical errors. These changes resulted in the deletion of one subtask lookup, and the correction of a reference pointer to reflect the proper digital document. The changes were assumed have no influence on the subjective ratings of the system. The time it took to complete the scenarios remained roughly equal. The final script is located in Appendix A. A brief training program oriented the mechanics to all of the features of the software used to view the technical documents. PDF files were viewed using the Adobe Acrobat Reader™ 3.0. The training session was scripted for standardization purposes, and may be found in Appendix B. At the conclusion of the training, a walkthrough of the first seven steps of a troubleshooting task was used to gain proficiency with the program. A reference card that details the major functions of the Acrobat Reader was provided to the mechanics during the testing. This card may also be found in Appendix B. The human factors evaluation consisted of two parts, the troubleshooting scenarios and the survey questions. Mechanics were given a script that described four open logbook items, and one routine servicing item. The five tasks involved a VHF communications transceiver, a lavatory pump motor assembly, foreign object damage (FOD) in the #1 engine, a leading edge bird strike on the right horizontal stabilizer, and an oxygen cylinder replacement. These five tasks enabled the mechanics to visit all major zones of the aircraft to test the wireless coverage for each area. The mechanics simulated each task according to the script, but did not actually replace or repair any components of the aircraft. The troubleshooting scenarios were followed by the completion of a two-page survey measuring the following aspects of the pen computers: Potential Timesaving: a three-item scale measuring the potential for saving time using digital documents on a mobile computer compared to the current method of accessing technical documents. Usefulness to the Job: a four-item scale measuring the degree to which mobile computerized technical manuals would be useful to a line maintenance technician. Pen Computers vs. Microfilm: a five-item scale measuring the degree to which the pen computers are preferred to the microfilm readers. Legibility: a six-item scale measuring the legibility of both words and graphics, combined with items about the size of the screen and glare from the screen. Navigation: a four-item scale measuring the ease with which mechanics were able to access, view, and manipulate technical documents on the pen computers. Input: a two-item scale measuring the ease of using the pen as a pointing device. Responsiveness: a four-item scale measuring the speed of loading and displaying the technical documents. Handling: a three-item scale measuring the ease of carrying and handling the pen computer on the job. Durability: a three-item scale measuring the subjective durability of the pen computer.
Survey Scales The survey may be found in Appendix C. Scales were content validated for consistency and relation to target domain by the research team. All items were answered using a 1-5 Likert scale indicating agreement with statements about the computers. Scales were constructed by averaging items within each
of the nine domains. Scales ranged from 1 to 5, with 5 being a positive evaluation. Some items were reverse coded as a check against rater repetition (e.g. when raters simply answer each question with the same value). Inspection of the data revealed no such repetitive trends. Due to the small sample size, accurate reliability estimates of the scales cannot be provided.
Results Descriptive scale characteristics are presented in Figure 21-1 below, in Box and Whisker plot format. As can be seen below, mean ratings across vendors for every scale are above the midpoint (3.0) of the scales, suggesting a possible halo effect or leniency bias. However interviews with mechanics after completion of the surveys confirmed this generally positive attitude toward the wireless units. Figure 21.1 illustrates overall averages across vendors on each scale. The next section presents more detailed graphs that breaks each scale into it’s own Box and Whisker plot for a comparative assessment of vendor equipment.
5.5 5.0 4.5 4.0 3.5 3.0 2.5 2.0
Durability
Handling
Responsive
Input
Navigation
Pen/Mfilm
Usefulness
1.0
TimeSaving
1.5
±Std. Dev. ±Std. Err. Mean
Figure 21.1: Descriptive Statistics for Survey Scales
DISCUSSION Following is a discussion of the specific features and performance of the vendor products. The discussion is based on observations, survey results, and comments from the research team and the mechanics during the tests.
Vendor #1 The WyseTerm 2930 is a thinly designed pen computer with an integrated wireless antenna. The thin profile and lack of a hard drive contribute to its fairly light weight at 3.4 lbs. The unit is surrounded on its
edges by a rubber bumper to reduce the shock of impact, although the bumper does not cover all edges. The grip of the unit is comfortable due to a thin and wide lip surrounding the unit. A benefit of this unit is that it does not maintain any data on the client side; all transactions except for the graphical display commands occur on the server. This means that if a unit is damaged during data entry or data lookup, the session can be completely recovered on any other working unit. Additionally, the WyseTerm is a fairly simple implementation of an LCD touch screen display and integrated firmware, meaning that the unit is relatively inexpensive and requires less configuration maintenance than more complex designs. The pointing device is not active, so that any pen or tool (including a finger) can be used as the pointer. The display controls are located as icons on the right side of the unit and are fairly intuitive to use. The display was disappointing in bright fluorescent lighting, where there was a noticeable screen glare. It is assumed that daylight conditions would further decrease screen legibility due to glare. The vendor advised that there are monochrome screen options that are less vulnerable to glare. Battery life for the unit was superior to all other units tested. After 3.5 hours of testing, approximately 75% of battery life was left. No carrying case or shoulder strap was provided for assessment. According to the representatives cases and straps are available as options. Response times for these units were adequate but the slowest of all units tested. There was an occasional problem with continued scrolling of documents after the pointer was removed from the screen. Wireless coverage was problematic in the aft lavatories and in the aft cargo area. Slower response times were also encountered at the tail of the aircraft.
Vendor #2 The Fujitsu Stylistic 1000RF was the heaviest of the units evaluated at just under five pounds, but also contained the most components. Carrying cases and straps were provided for the Stylistic units, along with screen covers which protected the units and decreased glare. The handles on the carrying case were comfortable, and the unit was believed to be durable within its casing. This was the only unit containing a hard drive. The pointing device was active electromagnetic field and required a small battery. The mechanics believed that the pen would be easy to lose if it were not tethered to the machine. There was a tethering loop on the pen. The unit had a transflective LCD black and white display with the largest screen size. The display was the most bright and legible of all units tested. It was the favorite display of the mechanics. Battery life was not as great after 3.5 hours of testing as the WyseTerm and was about the same as the TeamPad 7600, at about 42%. The response time for this unit was much faster than the WyseTerm 2930, and almost as fast as the TeamPad 7600. There were temporary coverage problems in the aft lavatories, but overall coverage was better than the WyseTerm 2930. It should be noted that Fujitsu-Personal Systems used higher gain antennae, which probably increased the coverage.
Vendor #3
The Fujitsu-ICL TeamPad 7600 was the lightest unit evaluated, at 2.7 pounds. A rubber bumper surrounded it on the edges, and all openings to the unit were sealed with rubber plugs. There were no external switches or controls except for the on/off buttons. The most prominent feature was the passive color touch screen display that covered most of the area of the computer. As with the WyseTerm 2930, any pointing tool could be used with the touch screen. The brightness of the screen was adequate, although it seemed that the screen was smaller than the Stylistic 1000RF and therefore words from technical documents were slightly less readable. A wide stretchable hand-strap went across the back of the machine so that one could slide an open palm into the back of the unit rather than hold the computer on the sides. No carrying case or shoulder straps were provided. Representatives claimed that the cases and straps would be available soon. Other options demonstrated were an attachable numeric keypad, a docking station, and a barcode reader. As with the WyseTerm 2930, there was no hard drive in the machine. All of the disk storage was located on a 20MB FlashRAM card, which contained the operating system and the WinFrame Client software for connection to the server. Thus there are similar benefits of data recovery discussed previously. However, the machine is not designed to be a graphics terminal machine, but follows the Intel™ specifications for a 80486 processor and circuit board. This contributes to more complex internal design and more expensive components. Responsiveness for this unit was the best of all units tested, although probably not significantly better than the Stylistic 1000RF. Loading documents was very fast and scrolling through documents was also good. Though a standard gain RDC antenna was used for the testing, coverage was easily the best of any vendor. Connection to the server was reliable even within the aft lavatories, unlike the other trials.
CONCLUSIONS The research team explored three major issues concerning the use of wireless technology to deliver accurate technical information to line maintenance technicians. First, we examined the feasibility of a wireless LAN in the line maintenance environment using technical measures. Second, we surveyed mechanics who used the system in order to evaluate its usability. Third, we interviewed mechanics to discover in what cases a similar system would be useful in relation to their work tasks. The question of feasibility is fairly easy to answer in the affirmative. Network speed for wireless LANs is fast enough to handle fairly large technical graphics, especially when using a graphics terminal architecture. Coverage was adequate even for the worst performing system tested, and could be considered excellent with the best system. Even when dead zones were encountered due to interference or distance, mechanics would simply walk toward an access point until the connection was restored. It is obvious when one encounters these dead zones; the machine is not able to respond to screen commands or load documents. However, in our tests the worst dead zone was inside of the aft lavatory. Mechanics handled this quickly by walking back into the main aisle without prompting. The radio technicians believed this was due to the large amount of steel contained in the lavatory. The question of usability is more complex because so many factors enter into a rating of usability. Responsiveness, software interface, bulkiness, and screen size all interact to produce this overall concept of usability. However, certain aspects of the system can be improved to greatly increase user acceptance. These ideas originated from comments made by mechanics during the testing and are presented below. Responsiveness of the units is a top priority for user acceptance. Mechanics will not be satisfied with
a system that requires noticeable “wait time” during screen updates and scrolling procedures. Even if the total amount of time to retrieve a technical document is far less than finding and using a microfilm machine, the user’s perception of time is what matters. Accessories, such as carrying cases and straps that are designed to fit well, are important to mechanics. Especially useful is the ability to grip the computer in multiple places to ease hand strain. Larger screen sizes with bright screens are preferred. Eyestrain was noticeable during testing with the smaller screens. Color screens were not important for the type of manuals tested, and mechanics could not think of a situation where color would be required. At this time, color screens tend to fade out in sunlight more than black and white screens. Although the Acrobat Reader™ was easy to learn and use, PDF file formats are not suited well to small screens on mobile computers. Mechanics were forced to zoom in to a document to read the words, rather than being able to read the document at the default screen size. Once a document was zoomed, it was difficult to navigate through the document because the page numbering system on the scroll bar did not reflect the page numbers at the bottom of each page. Also, PDF files are simply images of the paper manuals, so there is no word wrapping. On smaller screens, this is a serious problem because when the words are big enough to read, one cannot view the entire line at once and must resort to horizontal scrolling. Horizontal scrolling has been identified as a frustrating user action in a number of interface design texts. At the current time, the FAA has not approved any other digital format. However, it is expected that the ATA Spec 2100 will eventually become an aviation standard for SGML documents. This format allows word wrapping and word searching, as well as object handlers specific to many types of graphical data. Smaller screens should not be an issue when users are able to view words at a readable size without zooming out to see the words that are “off the screen.” This research provides strong evidence for the use of data formats such as SGML that enable the use of various screen sizes. The question of usefulness in the line maintenance job is particularly important when implementing broad changes in work design. Mechanics were generally positive about most aspects of the mobile computers, and viewed them as a significant improvement to the current method of looking up technical information. Mechanics envisioned themselves carrying the computers when necessary rather than wearing them in a holster or backpack. They believed that a workbench computer that could be undocked easily would the most effective method of use. Mechanics stated that the portable computers would be used most frequently in the following situations: a) When values change frequently during repair (such as pressure limits during trim runs) b) During lookups in the Illustrated Parts Catalog (IPC) c) When accessing wiring diagrams (for zoom capability) d) To send documents to other work stations (e.g. printing technical manual pages to a remote printer to discuss repairs with another mechanic or supervisor) e) When there is limited or time-consuming access to paper or microfilm documents (such as the B-check pad)
f) During non-routine repairs and write-ups g) When manuals could be accessed via modem while on road calls at remote repair stations h) For use in accessing maintenance workcard and non-routine write-up systems. Two of the mechanics emphasized that training for the system would need to be a high priority when it is actually implemented. Overall, the mechanics viewed the mobile pen computers as a useful and usable addition to their set of work tools, and looked forward to the implementation of a similar system in the future. Other mechanics not involved with testing who saw the units being used by their coworkers voiced similar positive attitudes toward the technology. The test of wireless technology in the line maintenance environment appears to have been successful. A broad implementation of a similar system would probably be accepted by many mechanics as long as concerns about legibility, training, handling, and data access are addressed.
APPENDIX A Pen Computer Testing Script Overview The purpose of this test is to determine the effectiveness of using a wireless pen to look-up aircraft manuals in an airport environment. Information gathered from this study will be evaluated and applied to future development of the Document Management System. The pen computer is similar to a normal computer, except that the pointing device is a pen rather than a mouse. Moving the pen across the screen will allow you to move the cursor. Tapping the pen on a button or a link on the screen will allow you to “select” that button. The pen computer contains sample manual information for the B737-300 type aircraft. On the left side of the screen you will find buttons for the following manuals: • AMM - Aircraft Maintenance Manual • IPC - Illustrated Parts Catalog • SRM - Structural Repair Manual • MEL - Minimum Equipment List • GMM - General Maintenance Manual • Bulletin - M&E Bulletins To open any manual, tap the button with the tip of the pen.
Practice Tap/Select Home Toolbars Scroll Grab Expand/Collapse Hiding bookmarks Full screen view Zoom
Background Aircraft 306 just arrived from EWR. The pilot called in stating that his VHF Com #1 is inop. He also mentioned three other log book entries that maintenance needs to look into. You meet the aircraft at the gate. The flight crew has already left, so you review the open log book entries in the cockpit. You find these items: • VHF Com #1 inop. • Left Aft lav flush motor inop. • #1 Engine FOD • Right horizontal stabilizer leading edge bird strike Planning has also requested that you change the Oxygen Cylinder during the holdover. After looking up deferrable items in the MEL, you decide to proceed with repairs.
Log Book Item 1: VHF Com #1 inop
Hints
Walk into the cockpit with the pen computer turned on. Using the computer to reference the appropriate manuals, troubleshoot the system with these steps: 1. Tap the AMM button on the computer (with the tip of the pen).
This will “select” and open the AMM.
a. Select Z23 TOC (Chapter 23 Table of Contents).
Tap the tip of the pen once to the computer screen for selecting buttons and references.
b. Locate the reference pages for VHF Com #1 Description and Operation.
The reference location should be 23-21-00 pg. 1.
c. Expand Z23 TOC in the bookmark section and select 21-00 Pg. 1.
The bookmark section is the left-hand portion of the screen. You “expand” a chapter to see what the chapter contains by tapping on the small triangle [Z]. You “collapse” a chapter the same way. When a chapter is expanded, the triangle will point downward [V].
d. Locate and read paragraph 5, Operation.
You must “scroll” downward to see this paragraph. Tap the pen on the right side of the screen to move the document. This is the “scroll bar”.
e. Go to Figure 2, Wiring Diagram.
You must scroll down again to see this figure.
f. “Zoom” into the lower left corner of the drawing until you can read the words.
Tap the button that looks like a plus
g. Restore the page to normal size by selecting the “Page Width” [ ] button.
The Page Width [ ]button may be found at the top of the screen. Selecting this will always restore the document to normal size.
h. Select 21-00 Pg. 101 in the bookmark section.
The bookmark section is the left-hand portion of the screen.
i. Go to paragraph 2, Troubleshooting Chart, and view the chart. j. Assume that the TRANSCEIVER ASSY-VHF COMM was found faulty, so you must replace the unit.
sign inside a magnifying glass [ ]. Now use the pen and drag it over the section of the picture you want to see. That section will become magnified, or “zoomed”.
2. Select the Home [ ] button in the upper part of the computer screen.
This will always return you to the main reference page.
3. Select the IPC button to lookup the part number:
You have now opened the IPC.
a. Select Z23 TOC.
Chapter 23 Table of Contents.
b. Locate reference page for TRANSCEIVER ASSY-VHF COMM.
You should see reference 23-21-21-02 Pgs. 0-4.
c. Expand Z23 TOC in the bookmark section and select 21-21-02 Pg. 0.
Expand by tapping the triangle [Z] in the bookmark section. When a chapter is expanded, the triangle will point downward [V].
d. Lookup the TRANSCEIVER ASSY-VHF COMM part number (effectivity 301379). e. Record part number here: ____________________ 4. Assume that you have replaced the TRANSCEIVER ASSY-VHF COMM. The operational check you perform is OK. 5. Select the Home [ ] button in the upper part of the computer screen to prepare for the next task.
Put the correct part number in the space provided.
Congratulations!
This will always return you to the main reference page.
Log Book Item 2: Left Aft Lav won’t flush
Hints
Walk to the aft of cabin to inspect the trouble. Enter the lavatory with the pen computer. 1.
Select the AMM button.
This will open the AMM.
a. Select Z38 TOC in the bookmark section.
The bookmark section is the left side of the screen containing chapter numbers.
b. Locate the Toilet System Trouble Shooting procedures.
You should see reference 38-32-00 pg. 101.
c. Expand Z38 TOC in the bookmark section and select 32-00 Pg. 101.
Expand by tapping the triangle [Z] in the bookmark section. When a chapter is expanded, the triangle will point downward [V].
d. Scroll downward to page 102 and begin reading “Toilet does not flush. . .”
Use the scroll bar on the right hand side of the screen, or Page Down using the [b] button on the scroll bar.
e. After reading the chart assume that the lav motor must be replaced. 2. Select the Home [ ] button on the tool bar of the Browser.
This will always return you to the main reference page.
3. Select the IPC button to lookup the replacement part number.
This will open the IPC.
a. Select Z38 TOC.
This will open the Table of Contents for Chapter 38.
b. Locate the page reference for MOTOR ASSY-FILTER AND PUMP in the TOC.
You should see 38-32-21-01 Pg. 0.
c. Expand Z38 TOC in the bookmark section and select 32-21-01 Pg. 0.
Expand by tapping the triangle [Z] in the bookmark section. When a chapter is expanded, the triangle will point downward [V].
d. Page down to Figure 1., Page 2.
e. Lookup MOTOR ASSY-FILTER AND PUMP part number (effectivity 301379). f. Record the applicable Part No. _________________.
Use the scroll bar on the right hand side of the screen, or Page Down using the [b] button on the scroll bar.
g. Assume that you attempted to order the part from stores, but the part number is not in stock. You must now review MEL requirements for a Lav Motor Inop placard. 4. Select the Home [ ] icon button to get MEL information. 5. Select MEL button. a. Expand Z38 TOC in the bookmark section and locate Lavatory Flush Motor Inop MEL Number.
Expand by tapping the triangle [Z] in the bookmark section. When a chapter is expanded, the triangle will point downward [V].
b. Select the appropriate MEL Number in the bookmark section. c. Record MEL No. ________ Page No. _______. d. Review MEL requirements for Lav Motors Inop placards. Assume you have read the requirements and placed the placard properly. e. Select the Home [ ] button to prepare for the next task.
View this section briefly.
Log Book Item 3: Foreign Object Damage (FOD) No. 1 Engine
Hints
Exit the aircraft and proceed to the front of the No. 1 engine. 1. Select the AMM button. a. Select Z72 TOC in the Bookmark section b. Page down to the reference for COMPRESSOR SECTION, BLADES - FAN ROTOR, Inspection/Check.
You should see 72-31-02 Pg. 601.
c. Expand Z72 TOC in the Bookmark section and select 31-02 Pg. 601.
Expand by tapping the triangle [Z] in the bookmark section. When a chapter is expanded, the triangle will point downward [V].
d. Follow the inspection procedure in paragraph 2. D. 4). Page down to figure 601 to identify the damage.
Use the scroll bar on the right hand side of the screen, or Page Down using the [b] button on the scroll bar.
e. Assume you found a nicked area of approx. 0.025 depth on the leading edge, Area B. f. Follow the inspection task to paragraph 2. D. 4) (d) 1) to review the damage limits. g. Record the max allowable limit for leading edge Area B: ___________ 2. Select the Home [ ] icon button on the tool bar of the Browser to prepare for the next task.
Use the scroll bar on the right hand side of the screen, or Page Down using the [b] button on the scroll bar.
Log Book Item 4: Right Horizontal Stabilizer Leading Edge Bird Strike
Hints
On a ladder with access to the computer, assume you have just measured the depth and diameter of the dent at station 86.66. The depth was 0.045 inch and was 1.5 inches from adjacent hole material. Complete the following while remaining on the ladder: 1. Select the SRM button.
This will open the SRM.
a. Select Z55 TOC in the bookmark section. b. Locate Horizontal Stabilizer Skin Allowable Damage in the TOC. c. Expand Z55 TOC in the Bookmark section and select 10-01 Pg. 101.
Expand by tapping the triangle [Z] in the bookmark section. When a chapter is expanded, the triangle will point downward [V].
d. Scroll Down to Page 103 and review illustration.
e. Review Pages 104 and 105 to determine limits. f. Is damage allowable?
(Circle One) YES
NO
g. What is that max allowable depth without repair? Depth ________ 2. Tap on the Home [ ] icon button to prepare for the next task.
Use the scroll bar on the right hand side of the screen, or Page Down using the [b] button on the scroll bar.
Planned Service Item 5: Oxygen Cylinder Servicing
Hints
Planning has informed you that the oxygen cylinder must be changed during the aircraft downtime. With the computer in hand, gain access to the forward cargo compartment. 1. Select the GMM button to review procedures for servicing the oxygen cylinder: a. Expand ZLEP Chapter 09 in the Bookmark section and select 09-74-72 Oxygen Cylinder Servicing Procedures.
Expand by tapping the triangle [Z] in the bookmark section. When a chapter is expanded, the triangle will point downward [V].
b. Read paragraph 4, Replace Supply Cylinder.
Located on pg. 4.
c. Assuming you have now replaced the Supply Cylinder, Page Down to the Oxygen Temperature/Pressure Table.
Located on pg. 6.
d. Assume the Bottle temperature is 95 degrees. Locate the proper pressure for an 1850 PSI type bottle.
You must read the table to get this value.
e. Record the proper pressure here: _____________ . Congratulations. You have completed the simulation.
f. Tap on the Home [ ] icon.
Please return the computer and this script to the facilitator. You will be finished after completing a brief questionnaire.
APPENDIX B Overview: Pen Computer Study Thank you for participating in the study of wireless computer technology at Continental Airlines. Our objective with these tests is to evaluate: 1. The delivery of timely information to line mechanics over wireless networks 2. The usefulness of the pen computers 3. The durability of the pen computers 4. The ease-of-use of the pen computers. There are no right/wrong answers to the tests. You will not be graded on your performance. We would simply like to get your honest feedback about using the computers. The more feedback we receive, the
better judgements we can make concerning the equipment. We hope that you will find this experience as trouble-free as possible. In order to facilitate your use of the computers, we have designed a set of practice exercises to get you familiar with the equipment and software.
Practice Tap/Select This is the method of choosing objects on the computer screen. Simply tap the tip of the pen on the desired object. When you tap a button, the button will perform a certain action. If you tap a text link (such as the name of a section of a manual) the computer will display that document.
Home The Home [ ] button (or Home bookmark) will always return you to the top-most level of the manuals.
Toolbars Rows of buttons are called Toolbars. The document viewer has a number of buttons which perform actions such as zooming in and out, fitting a page into the size of the screen, and changing the position of the document.
Scroll/Page Down In order to move about in a document, it is necessary to use some tools. One tool is the scroll bar, which is always located on the right side of the screen. The plain button shaped object slides up and down the scroll bar when you drag it with the pen. To drag the button, simply touch the pen to the button and move it up or down. You can also move through a document by tapping on the buttons with small black triangles [b].
Grab You will notice that sometimes the cursor turns into the shape of a hand. This allows you to grab things and drag them to new places. For example, when your cursor is over the document, it will become a small hand. Touch the pen to the screen and drag it downward. You will notice the page move as if you grabbed it with the hand.
Expand/Collapse The bookmarks, or chapter/section titles, are outlined to the left of the screen. When you first view the bookmarks, only the major headings will show. Any chapter with sub-sections will have an open triangle
next to it [Z]. You “expand” a chapter to see what the chapter contains by tapping on the small triangle [Z]. You “collapse” a chapter the same way. When a chapter is expanded, the triangle will point downward [V].
Hiding Bookmarks You may hide the bookmarks section of the screen by selecting the ___ button. This will allow you to view a bigger portion of the document.
Zoom Tap the button that looks like a plus sign inside a magnifying glass [ ]. Now use the pen and drag it over the section of the picture you want to see. That section will become magnified, or “zoomed”. You can zoom out by using the tool with the minus sign.
Normal View You can always return to the normal view of the document. The Page Width [ ]button may be found near the top of the screen, third button to the right. Selecting this will always restore the document to normal size.
Multiple Tapping Sometimes the computer is slow to respond because it needs time to perform an action. You will see an hourglass icon next to the cursor when this happens. This means to wait for the computer to finish what you have asked it to do. Tapping the pen more than once when it is performing an action can cause the computer to malfunction or “freeze up.” Be patient and you will get the hang of it.
APPENDIX C Mechanic’s Feedback Thank you for participating in the study of new maintenance technology. Feedback about your experiences will help determine future tools that might be used by you and your fellow mechanics. Please rate your agreement to the following questions using the rating scale below:
1 = Strongly Disagree
2 = Disagree
3 = Undecided
4 = Agree
5 = Strongly Agree
Time
Usefulness
Pen Computer vs. Microfilm
Legibility
1. Having all necessary references on the pen computer would save me time.
1 2 3 4 5
2. The pen computer would take more time to use than the microfilm machine.
1 2 3 4 5
3. With more practice, I would probably save time using the pen computer.
1 2 3 4 5
4. Using technical documents on the portable computer would help me in my work duties.
1 2 3 4 5
5. The pen computer with digital documents would not assist me in completing my work.
1 2 3 4 5
6. With some improvement, the pen computer would be a useful tool.
1 2 3 4 5
7. The pen computer would not be of much use to me.
1 2 3 4 5
8. I would rather use the pen computer than print out the documents at the microfilm machine.
1 2 3 4 5
9. I prefer using paper documents printed from microfilm.
1 2 3 4 5
10. Having reference information on the portable computer is better than using the microfilm machine.
1 2 3 4 5
11. I would prefer to use the pen computer to my current method of getting technical information.
1 2 3 4 5
12. Viewing documents on the pen computer is easier than viewing on the microfilm reader.
1 2 3 4 5
1. The words were clear enough for my work tasks.
1 2 3 4 5
2. The graphics/diagrams were clear enough for my work tasks.
1 2 3 4 5
3. I found it easy to read words.
1 2 3 4 5
4. I found it easy to read graphics.
1 2 3 4 5
5. The screen size was large enough.
1 2 3 4 5
6. I did not have much trouble with screen glare.
1 2 3 4 5
1 = Strongly Disagree
Navigation
Input
Response Time
Handling
Durability
2 = Disagree
3 = Undecided
4 = Agree
5 = Strongly Agree
1. Locating documents on the computer is fairly easy.
1 2 3 4 5
2. Zooming in and out of the document was not difficult.
1 2 3 4 5
3. I found it difficult to position documents so I could use them.
1 2 3 4 5
4. I thought it was easy to navigate through the documents.
1 2 3 4 5
5. The pen was easy to use.
1 2 3 4 5
6. Pointing and clicking was easy to get used to.
1 2 3 4 5
7. Using the on-screen keyboard was fairly difficult.
1 2 3 4 5
8. Logging into the system using the pen was simple.
1 2 3 4 5
1. The pen computer was too slow to be of use.
1 2 3 4 5
2. Loading documents took only a short time.
1 2 3 4 5
3. I spent too much time waiting for the computer to load documents.
1 2 3 4 5
4. The response time of the pen computer was good.
1 2 3 4 5
5. Wearing the computer would not hinder my ability to do my work.
1 2 3 4 5
6. I don’t like carrying around the pen computer.
1 2 3 4 5
7. The pen computer is too bulky for general use.
1 2 3 4 5
8. The carrying straps are well designed.
1 2 3 4 5
9. The carrying case is well designed.
1 2 3 4 5
10. I think the pen computer would be durable enough for use on the job.
1 2 3 4 5
11. I would bring the pen computer with me for rough jobs.
1 2 3 4 5
12. I could wear/carry the pen computer into most work areas without fear of damage.
1 2 3 4 5
PROGRAMME 12th Symposium on Human Factors in Aviation Maintenance 10, 11, & 12 March 1998, Gatwick Hilton Hotel, Gatwick Airport, England
Tuesday 10 March 1998 INTRODUCTION 13.30
Symposium Opening Remarks A joint welcome from Don Sherritt, Transport Canada; John Goglia, NTSB; Peter Hunt, CAA
13.55
Chairman’s Address and Symposium Introduction Chairman: Peter Hunt, CAA Head of Operating Standards Division
14.10
Human Factors in Maintenance, the Past, Present and Future Speaker: William Johnson, Galaxy Scientific Corporation
14.40
Human Factors in Aerospace Maintenance - Perspectives from NASA Research and Operations Speaker: Barbara Kanki, NASA Ames Research Centre; Donna Blankmann-Alexander, United Space Alliance
15.10
Coffee Break
SESSION ONE - DISCIPLINE AND LIABILITY 15.40
Session Opening Remarks Chairperson: Tim Scorer, Dibb Lupton Alsop, Partner
15.45
Discipline in a No Blame Culture Speaker: David Marx, Aviation Safety Consultant
16.15
Corporate and Individual Liability for Human Error Speaker: David Stoplar, CAA Legal Advisers Office
16.45
Questions and Discussion
19.00
Drinks Reception
Wednesday 11 March 1998 SESSION TWO - HUMAN FACTORS - A REGULATORY VIEWPOINT 09.00
Session Opening Remarks Chairperson: Tony Ingham, Head of Aircraft Maintenance Standards, CAA
09.05
Human Factors - A Regulatory Viewpoint Speakers: David Hall, CAA; Leslie Vipond, FAA; Brian Whitehead, TC
10.15
Coffee Break
10.45
Questions and Discussion
SESSION THREE - A VIEW FROM THE SHARP END 11.00
Session Opening Remarks Chairperson: Mick Skinner, Manager Quality Fleet 3, British Airways
11.05
Learning Lessons the Hard Way Speaker: David King, Aircraft Accident Investigation Branch
11.35
A Workplace Perspective of Human Factors Speaker: Gerry Evans, Association of Licensed Aircraft Engineers
12.05
The Influence of Human Factors on the Safety of Aircraft Engineering & Maintenance - a UKOTG perspective. Speaker: Simon Witts, Engineering Director, Air UK
12.35
Questions and Discussion
13.00
Lunch
SESSION FOUR - HUMAN PERFORMANCE AND MRM TRAINING 14.30
Session Opening Remarks Chairperson: Joe Kania, Director of Quality Control, US Airways
14.35
Human Factors Training in the Training Schools
Speaker: Gordon Dupont, Transport Canada 15.05
Coffee Break
15.35
Evaluating the Effectiveness of Maintenance Resource Management Speakers: Michelle Robertson and James Taylor
16.05
Making the Transition to Self Certification Speaker: Group Captain Jamie Mackreath, Royal Air Force
16.35
Questions and Discussion
Thursday 12 March 1998 SESSION FIVE - ERROR AND SAFETY MANAGEMENT 09.00
Session Chair Opening Remarks Chairperson: David Nowzek, Regional Director, Civil Aviation, Transport Canada
09.05
Human Factors as Part of a Safety Management System Speaker: Cliff Edwards, Shell Aircraft Ltd.
09.35
Quality Management Systems in Aircraft Maintenance Speaker: Roger Wootton, Dean - School of Engineering, City University London
10.05
Coffee Break
10.35
Error Management in a 3rd Party Repair Station Speaker: Bill Ashworth, VP Quality & Engineering, BF Goodrich Aerospace
11.05
Organizational Culture and it’s Affect on Safety Speaker: Gary Eiff, Purdue University
11.35
The Measurement of Safety Speaker: James Reason, University of Manchester
12.05
Questions and Discussion
12.30
Lunch
SESSION SIX - APPLYING HUMAN FACTORS PRINCIPLES 14.00
Session Chair Opening Remarks Chairperson: Maureen Pettitt, Chief Scientific & Technical Adviser for Human Factors, FAA
14.05
Creating a Procedures Culture to Minimise Risks Speaker: David Embrey, Human Reliability Associates Ltd.
14.35
Guidelines in Producing an Effective Shift and Task Handover System Speaker: Bob Miles, Health and Safety Executive
15.05
Moving Towards Recommendations
Digital
Technology
Publications:
Selected
Issues
and
Speaker: Phil Hastings, Galaxy Scientific Corporation 15.50
Questions and Discussion
16.20
Symposium Summary
16.40
Closing Remarks by Richard Profit OBE, CAA Group Director, Safety Regulation
LIST OF ATTENDEES Martin Abbott, Lecturer, CSE Aviation, Oxford Airport, Kidlington, Oxon, OX5 1RA, UK, Tel: 01865 842235, Fax: 01865 841048, Delegate Mick Adams, Base Maintenance Manager, Monarch Aircraft Engineering, Luton (London) Airport, Luton, Beds, LU2 9LX, UK, Tel: 01582 398642, Fax: 01582 398989, Delegate Greger Ahlbeck, Director Technical Administration, SAS, Dpt Stoma, S-19587 Stockholm, Sweden, Tel: 46 879 72945, Fax: 46 879 71280, Delegate Ali H Al-Harabi, PhD Research Student, Cranfield College of Aeronautics, Air Transport Group, Building 115, Cranfield, Bedfordshire, MK43 0AL, UK, Tel: 01234 750111 X-2232, Fax: 01234 752207, Delegate Brian Almond, Managing Director, British Midland Engineering, Donington Hall, Castle Donington, Derby, DE74 2SB, UK, Tel: 01332 852301, Fax: 01332 852271, Delegate Dave Andrews, Engineering Policy, RAF Brampton, HQ Logistics Command, Huntingdon, Cambs, PE18 8QL, UK, Tel: 01480 52151 x 6074, Fax: x 6206, Delegate Mike Angel, Mechanic, Purdue University, 6034.E., Edgewood Avenue, Indianapolis, IN. 46237, USA, Tel: (317 ) 786 8750, Delegate Len Arnot-Perrett, Civil Aviation Authority, Aircraft Maintenance Standards Dept, 1W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573144, Delegate William Arthur, Senior Quality Surveyor, Quality Stds, Qantas Airways, Quality Assurance Dept. M271/3, Kingsford-Smith Airport, Mascot Jetbase MB5, Sydney, 2020, Australia, Tel: 61 2 9691 8399, Fax: 61 2 9691 8219, Delegate Peter Ashmore, Projects Manager, Hunting Cargo Airlines, East Midlands Airport, Castle Donington, Derbyshire, DE74 2YH, UK, Tel: 01332 813142, Fax: 01332 811601, Delegate Bill Ashworth, VP Quality and Engineering, BF Goodrich Aerospace, 11323 30th Avenue West, Everett, Washington 98204, USA, Fax: 425 423 3006, Speaker Jurgen A. G. van Avermaete, Human Factors Engineer, National Aerospace Laboratory NLR, Man Machine Integration Dept, Anthony Fokkerweg2, 1059 CM Amsterdam, The Netherlands, Tel: 31 20 511 3266, Fax: 31 20 511 3210, Delegate Brian Ayling, Technical Director, TNT Aircraft Maintenance Svces, Unit 6013, Taylor's End, Long Border Road, Stansted Airport, Essex, CM24 6RL, UK, Tel: 01279 666660, Fax: 01279 666667, Delegate Sue Baker, Senior Human Factors Specialist, Civil Aviation Authority, Medical Research and Human Factors, 1W, Aviation House, Gatwick Airport South Area, West Sussex, UK, Tel: 01293 573564,
Delegate James Ballough, FAA, Pittsburgh, Pennsylvania, USA, Delegate Paul Barnes, Human Resources Manager, BAe Aviation Services, Quality Dept, Building O8P-42, Filton, Bristol, BS99 7AR, UK, Tel: 0117 936 4660, Fax: 0117 936 3742, Delegate Mike Bartron, NTSB, USA, Delegate Ed Belshaw, Personnel Development Manager, Manx/British Regional Airlines, Viscount House, Isle of Man Airport, Ballasalla, IM9 2JE, UK, Tel: 01624 826057, Fax: 01624 826001, Delegate Spencer Bennett, Sr Manager Maintenance Training, Federal Express, 3400 Prescott, Memphis, Tenessee, TN 38118, USA, Tel: 901 360 4930, Fax: 901 360 4955, Delegate Rolf Bergstrom, Maintenance Manager, Helikopter Service, PO Box 522, Stavanger Lufthavn, Norway, Tel: 4751 653700, Fax: 4751 656390, Delegate Ed Bewley, Flight Operations Inspector, Civil Aviation Authority, Flight Operations Department, 1W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573451, Delegate Mel Birdsall, Quality Manager, Farnborough Aviation Services, Farnborough Airport, Hampshire, GU14 6XA, UK, Tel: 01252 372400, Fax: 01252 372774, Delegate Garry Bisshopp, Head SDU 2, Civil Aviation Authority, Safety Data Dept., Aviation House, Gatwick Airport South, West Sussex, RH6 0YR, UK, Delegate Donna Blankmann-Alexander, Senior Human Factors Specialist, United Space Alliance, Mail Code/USK-285, Kennedy Space Center, FL 32899, USA, Tel: 407 861 4811, Fax: 407 861 5380, Speaker Fred Bloor, Quality Assurance Manager, Nordic Aero, Control Tower Road, Gatwick Airport, West Sussex, UK, Tel: 01293 502512, Fax: 01293 567816, Delegate Bruno Bolis, Directeur Maintenance et Qualite, Airbus Inter Transport, 1 Rond Point Maurice Bellonte, 31707 Blagnac Cedex, France, Tel: 056193 3447, Fax: 056193 3093, Delegate Jackie Booth-Bordeau, General Technical Specialist, Transport Canada, Maintenance Manufacturing, 330 Sparks Street, Ottawa, Ontario, K1A ON8, Canada, Tel: 613 952 7974, Fax: 613 952 3298, Delegate Jean-Bernard Boura, Deputy Program Manager F900/F900EX, Dassault Aviation, 2A Louis Breguet, BP12, F-78141, Velizy, France, Tel: 408 32998, Delegate Andrew Brazier, Human Reliability Associates, 1 School House, Higher Lane, Dalton, Wigan, Lancashire, Delegate John Bright, GM Airworthiness and Maintenance, Britannia Airways, Luton (London) Airport, Luton, LU2 9ND, UK, Tel: 01582 428050, Fax: 01582 428206, Delegate Rupert Britten, Secretary and Legal Adviser, Civil Aviation Authority, Room T1420, CAA House, 45 -
59 Kingsway, London, WC2B 6TE, UK, Tel: 0171 832 5794, Fax: 0171 832 5429, Speaker John Broadhurst, Technical Training Manager, G.E. Caledonian, Prestwick International Airport, Prestwick, UK, Tel: 01292 673491, Fax: 01292 673283, Delegate Paul Broadway, Managing Director, Atlantic Aeroengineering, Hangar S, Coventry Airport, Coventry, UK, Tel: 01203 307566, Fax: 01203 305748, Delegate Frank Buggie, Quality Assurance Manager, Team Aer Lingus, Dublin Airport, Dublin, MD132, Ireland, Tel: 353 1 7053292, Delegate Peter Burrow, Approval Engineer, Civil Aviation Authority, Air Traffic Services Standards, 1E, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573696, Delegate Eduardo Capello, Technical Trg and Qualifications, Aerolineas Argentinas, Suc Aeropuerto Ezeiza (b), 1802 Buenos Aires, Argentina, Tel: 54 1 480 5146, Fax: 54 1 480 5130, Delegate Hugh Chalkley, Quality and Technical Services Manager, Maersk Air Engineering, Jetstream House, Birmingham International Airport, Coventry Road, Birmingham, B26 3QB, UK, Tel: 0121 693 3232, Fax: 0121 782 0205, Delegate Alison Chaplin, Quality Assurance Engineer, British Airways Engineering, H2, TBA, 5392, PO Box 10, Heathrow Airport, Hounslow, Middlesex, , TW6 2JA, UK, Tel: 0181 562 5655, Fax: 0181 562 8893, Delegate Cheow Eng Chee, Manager Quality Control, Singapore Airlines, Quality Control Dept, 9A Airline House, 25 Airline Road, Singapore 819829, Tel: 65 541 5983, Fax: 65 542 4167, Delegate Boon Pin Chew, Maintenance Manager, TAECO, 20 Diliao Road, East Gaogi International Airport, Xiamen, PR China, Tel: 592 573 7555, Fax: 592 573 7551, Delegate WM Chung, Hd of Section Trg and Quality Control, HAECO, 60 Concorde Road, Hong Kong International Airport, Hong Kong, Tel: 2767 6464, Fax: 2752 6036, Delegate Chris Clark, Quality Manager, JEA Engineering, Exeter Airport, Exeter, Devon, EX5 2BA, UK, Tel: 01392 364520, Fax: 01392 446127, Delegate Joanne Clark, DERA, Room 2012, Probert Building, Farnborough, Hampshire, GU14 0LX, UK, Tel: 01252 394 787, Delegate Richard Clifford, Technical Training Instructor, BAe Aviation Services, Building 08M, PO Box 77, Bristol, BS99 7AR, UK, Tel: 0117 936 2879, Fax: 0117 936 2396, Delegate Roy Clifford Hickman, Business Inprovement & QA Manager, Hymatic Engineering Co, Burnt Meadow Road, North Moons Moat, Redditch, Worcestershire, B98 9HJ, UK, Tel: 01527 64931, Fax: 0152 7591117, Delegate Alan Cole, Customer Training Officer, Messier-Dowty, Cheltenham Road, Gloucester, GL2 9QH, UK, Tel: 01452 711312, Fax: 01452 713821, Delegate
Paul Connor, Civil Aviation Authority, Change Team, 3E, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573674, Delegate Bryan Corrigan, Quality Assurance Manager, G.E. Caledonian, Shawfarm Industrial Estate, Prestwick, KA9 2RX, Scotland, Tel: 01292 673305, Fax: 01292 671623, Delegate Marco Costantini, Registro Aeronautico Italiano, Direzione Risorse Umane, Via Di Villa Ricotti 42, 00162, Roma, Italy, Tel: 39 644 185344, Fax: 39 644 185417, Delegate Art Coulomb, Director, Maintenance & Materials, ATA, 1301 Pennsylvania Avenue, NW, Suite 1100, Washington, DC 20004, USA, Tel: 202 626 4134, Fax: 202 626 4081, Delegate Hazel Courteney, Human Factors Specialist, Civil Aviation Authority, Medical Research and Human Factors, 1W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573446, Delegate Bryan Cowin, Flight Safety Manager, BAe Regional Aircraft, Woodford Aerodrome, Chester Road, Stockport, Cheshire, SK7 1QR, UK, Tel: 0161 955 3021, Fax: 0161 955 3028, Delegate Jeffrey Crick, Psychologist and Project Manager, DERA, Room 2012, Probert Building, Farnborough, Hampshire, GU14 OLX, UK, Tel: 01252 394781, Fax: 01252 394700, Delegate John Crook, Aircraft Training Manager, Air Canada, 681 Service Building, Napier Road, Heathrow Airport, Middlesex, TW6 2LL, UK, Delegate Gareth Cunningham, Director Engineering, Air 2000, Commonwealth House, Chicago Avenue, Manchester International Airport, Manchester, M90 3DP, UK, Tel: 0161 489 0398, Fax: 0161 908 2282, Delegate Colin Daly, Researcher, Aerospace Psychology Research Group, Department of Psychology, Trininty College, Dublin 2, Ireland, Tel: 353 1 608 2605, Fax: 353 1 671 2006, Delegate Veronica Danley, Executive Assistant, Galaxy Scientific Corp., 2130 La Vista Executive Park Dr., Tucker, Georgia 30084, USA, Delegate Evangelos Demosthenous, Human Factors Co-ordinator, Aircraft Engineers International, 3A Egratias Street, Nicosia 2331, Cyprus, Tel: 357 2 384015, Fax: 357 2 777321, Delegate Peter Dexter, Quality Manager Airworthiness, Inflite Engineering Services, The Jet Centre, Stansted Airport, Essex, CM24 8QW, UK, Tel: 01279 680736, Fax: 01279 680104, Delegate Lloyd Dingle, Lecturer, Brooklands College, Heath Road, Weybridge, Surrey, KT13 8TT, UK, Tel: 01932 79 7770, Fax: 01932 828596, Delegate Julian Dinsell, Managing Director, TVC, 15 Greek Street, London, WIV 5LF, UK, Delegate Sarah Doherty, Civil Aviation Authority, Safety Data Dept., Aviation House, Gatwick Airport South, West Sussex, RH6 0YR, UK, Delegate LuVern Dokter, Division Manager, FAA AVN-300, PO Box 25082, Oklahoma City, OK 73125, USA,
Tel: 405 954 4126, Fax: 405 954 6217, Delegate Jim Done, Gatwick Regional Manager, Civil Aviation Authority, c/o AMSD, 1E, Aviation House, Gatwick Airport South, West Sussex, RH6 0YR, UK, Delegate Pat Doolan, Deputy Head, Application & Certification, Civil Aviation Authority, 2W, Aviation House, Gatwick Airport South Area, West Sussex, UK, Tel: 01293 573160, Delegate Colin Drury, Professor, State University of New York, Industrial Eng Dept, 342 Bell Hall, Buffalo, New York, NY14260, USA, Tel: 716 645 3624, Fax: 716 645 3302, Delegate John Dunne, Engineering Safety Officer, Virgin Atlantic, Aeronautics House, Business Quarter, Manor Royal, Crawley, West Sussex, RH10 2QH, UK, Tel: 01293 744540, Fax: 01293 744527, Delegate Charles Dunstan, Technical Instructor, Air Nova, 310 Goudey Drive, Halifax International Airport, Enfield, Nova Scotia, B2T 1E4, Canada, Tel: 902 873 5052, Fax: 902 873 4960, Delegate Gordon Dupont, Special Programs Co-Ordinator, Transport Canada, 318 - 4160 Cowley Crescent, Vancouver International Apt South, Richmond, British Colombia, V7B 1B8, Canada, Speaker Howard Dyer, Civil Aviation Authority, Aircraft Maintenance Standards Dept, 1E, Aviation House, Gatwick Airport South Area, West Sussex, , RH6 0YR, UK, Tel: 01293 573367, Delegate Ken Edgington, Head of Medical Division, Civil Aviation Authority, GW Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573675, Delegate Cliff Edwards, Quality Manager and Aviation Adviser, Shell Aircraft, Cardinal Point, Newall Road, London Heathrow Airport, Hounslow, TW6 2HF, UK, Tel: 0181 730 5208, Fax: 0181 730 3789, Speaker Uwe Eggerling, Director of Maintenance & Reliability, Airbus Industrie, 1 Rond Point Maurice Bellonte, 31707 Blagnac Cedex, France, Tel: (33 5) 61933943, Fax: (3356) 1932872, Delegate Gary Eiff, Aviation Maint HF Research Team, Purdue University, West Lafayette, Indiana, USA, Speaker David Embrey, Managing Director, Human Reliability Associates, 1 School House, Higher Lane, Dalton, Wigan, Lancashire, WN8 7RP, UK, Tel: 01257 463121, Fax: 01257 463810, Speaker Gerry Evans, Legal Representative, Assoc of Licensed Acft Engineers, Bourne House, 8 Park Street, Bagshot, Surrey, GU19 5AQ, UK, Tel: 01276 474888, Fax: 01276 452767, Speaker Tony Fellows, Aircraft Maintenance Manager, Devon and Cornwall Police, Air Support Unit, Police Headquarters, Middlemoor, Exeter, Devon, , EX2 7HQ, UK, Tel: 01392 452829, Fax: 01392 426467, Delegate Nigel Finch, Regional Manager - East Midlands, Civil Aviation Authority, 1st Floor, West Wing, Building 65, Ambassador Road, East Midlands Airport, Castle Donnigton, Derbyshire, DE74 2SA, UK, Tel: 01332 811245, Delegate David Finch, Consultant, 12 Rectory Close, Windsor, Berkshire, SL4 5ER, UK, Tel: 01753 866819, Fax:
01753 866819, Delegate Bob Ford, Director, Repairs Operations, Smith Industries, PO Box 9013, Clearwater, 33738, Florida, USA, Tel: 8135 391631, Fax: 8135 390680, Delegate Rich Friot, Manager of Flight Operations, Sikorsky Aircraft Corporation, 6900 Main Street, PO Box 9729, Stratford, CT 06497 9129, USA, Delegate Bill Gall, Head of Human Factors, AEA Technology, TH3/L4, Thomson House, Risley, Warrington, Cheshire, WA3 6AT, UK, Tel: 01925 25 4522, Fax: 01925 25 4036, Delegate Des Gaynor, Training Executive, Team Aer Lingus, MD300, Dublin Airport, Ireland, Tel: 353 1 705 6094, Fax: 353 1 705 3942, Delegate Mrs Gemon-Saintemarie, Airbus Industrie, 1 Rond-Point, Maurice Bellonte, 31707 Blagnac Cedex, France, Tel: 05 61 93 3116, Fax: 05 61 932 827, Delegate Jim Gibbons, QA and Training Manager, Air UK Engineering, Liberator Road, Norwich Airport, Norwich, Norfolk, NR6 6ER, UK, Tel: 01603 254511, Fax: 01603 254435, Speaker Dave Gibson, Training Manager, FR Aviation, Bournemouth International Airport, Christchurch, Dorset, BH31 6XJ, UK, Tel: 01202 409007, Fax: 01202 580936, Delegate Ray Glenister, Chief Engineer Quality Training, British Airways Engineering, H2 TBA 5347, Heathrow Airport, PO Box 10, Hounslow, Middlesex, TW6 2JA, UK, Tel: 0181 562 5799, Fax: (0181) 562 5390, Delegate John Glynn, Flight Safety Committee, IAMAW Air Transport District 143, 2600 Egan Woods Drive, Suite 220, St Paul, MN 55121, USA, Tel: 612 688 2640, Fax: 612 688 7229, Delegate Justin Goatcher, Civil Aviation Authority, Unit 101, Parkway, Worle, Weston Super-Mare, BS22 0WB, UK, Tel: 01934 522260, Delegate John Goglia, Board Member, NTSB, 490 L'Enfant Plaza East SW, Washington DC, 20594, USA, Tel: 202 314 6660, Fax: 202 314 6665, Speaker Ray Goldsby, Senior Aviation Specialist, Galaxy Scientific Corporation, 1858 Parkwood Drive, San Mateo, CA 94403-3958, California, USA, Tel: 650 341 8142, Fax: 650 341 8170, Delegate Barry Goodliffe, Civil Aviation Authority, Sipson House, 595 Sipson Road, West Drayton, UB7 0JD, UK, Tel: 0181 759 0205, Delegate Robin Gordon, Civil Aviation Authority, Flight Operations Department, 1W, Aviation House, Gatwick Airport South Area, West Sussex, UK, Tel: 01293 573409, Delegate Paul Gorof, Dir Manager, SR Tecnics, Line Maintenance Hangar, CH - 8058, Zurich Airport, Switzerland, Tel: 41 1 812 6491, Fax: 41 1 812 9859, Delegate Anand Gramopadhye Ph D, Assistant Professor, Clemson University, Industrial Engineering, 110
Freeman Hall, Clemson, SC 29634 0920, USA, Tel: 864 650 8211, Fax: 864 656 0795, Delegate Harold Greenhalgh, Quality Manager, European Aviation Maintenance, European House, Bournemouth International Airport, Hurn, Christchurch, Dorset, BH23 6EA, UK, Tel: 01202 591191, Fax: 0120 2591050, Delegate Eddie Guazzielli, T/L Engineering Systems Development, G.E. Caledonian, Shawfarm Industrial Estate, Prestwick International Airport, Prestwick, Ayrshire, KA9 2RX, UK, Tel: 01292 673228, Fax: 01292 673333, Delegate Frank Haag, Director Maintenance Training, Airbus Service Company, Training Centre, PO Box 660037, Miami Springs, FL 33266-0037, USA, Tel: 305 871 3255, Fax: 305 871 4649, Delegate Toni Haerry, Manager Line Maintenance, Crossair, Postfach, 4002 Basel, Switzerland, Tel: 416 13253408, Fax: 416 13254568, Delegate Robert Hagmann, Maintenance Personnel Inspector, Federal Office for Civil Aviation, Maulbeerstrasse 9, CH-3003, Berne, Switzerland, Tel: 031 325 8054, Fax: 031 325 8048, Delegate Martyn Haines, Head of Maintenance Programs & Planning, Virgin Atlantic Airways, Aeronautics House, Crawley Business Quarter, Manor Royal, Crawley, West Sussex, UK, Fax: 01293 744504, Delegate Phil Hall, Director of Quality & Safety Management, Monarch Aircraft Engineering, Luton (London) Airport, Luton, Beds, LU2 9LX, UK, Tel: 01582 398506, Fax: 01582 706157, Delegate Dave Hall, Deputy Regional Manager - Heathrow, Civil Aviation Authority, Sipson House, 595 Sipson Road, West Drayton, UB7 0JD, UK, Tel: 0181 759 0205, Delegate Hakan Hallborn, Airworthiness Specialist, Swedish Civil Aviation Administration, Maintenance & Production Office, S-60179, Norrkoping, Sweden, Tel: 46 11 192295, Fax: 46 11 1925515, Delegate Richard Hamer, Regional Manager, Europe, American Airlines, Room 642, Norfolk House, South Terminal, Gatwick Airport, West Sussex, RH6 ONP, UK, Tel: 01293 549499, Fax: 01293 567384, Delegate Tom Hamilton, External Relations Manager, Civil Aviation Authority, Corporate Affairs, Aviation House, Gatwick Airport South, West Sussex, RH6 0YR, UK, Delegate Derek Harper, Engineering Manager, Manx/British Regional Airlines, Isle of Man (Ronaldsway) Airport, Ballasalla, Isle of Man, IM9 2JE, Tel: 01624 826044, Fax: 01624 826041, Delegate Adrian Harrison, Base Maintenance Manager, Manx/British Regional Airlines, Isle of Man (Ronaldsway) Airport, Ballasalla, Isle of Man, IM9 2JE, Tel: 01624 826044, Fax: 01624 826041, Delegate Dave Haward, Deputy Chief Surveyor, Civil Aviation Authority, Aircraft Maintenance Standards Dept, 1W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573363, Delegate
Larry Heintz, Safety Officer, MAF Europe, Enterprise House, Godinton Road, Ashford, Kent, TN23 1EU, UK, Tel: 01233 647933, Delegate Joe Henebry, General Manager, Delta Air Lines, Dept 226, Atlanta, Georgia, 30320, USA, Tel: 404 714 0096, Fax: 404 714 5423, Delegate Dag Hermansson, Instructor, Aviation College of Sweden, Hasslogatan 2, S72131, Vasteras, Sweden, Tel: 4621 801390, Fax: 4621 801795, Delegate Tan Hin, Quality Control Inspector, SIA Engineering Company, 6-L Hangar 2, Airline Road, 819831, Singapore, Tel: 65 541 5511, Fax: 65 543 0561, Delegate Anthony Hines, Chief Executive, Aviation Training Association, 125 London Road, High Wycombe, Bucks, HP11 1BT, UK, Tel: 01494 445262, Fax: 01494 439984, Delegate Steve Hodgkiss, Engineering Director, City Flyer Express, Iain Stewart Centre, Beehive Ring Road, Gatwick Airport, West Sussex, , RH6 0PB, UK, Tel: 01293 507482, Fax: 01293 507592, Delegate Barry Holloway, Quality Manager, Marshall Aerospace, The Airport, Cambridge, CB5 8RX, UK, Tel: 01223 373230, Fax: 01223 373567, Delegate Yuan Hong, Senior Technical Specialist, Boeing Commercial Airplane Group, 3855 Lakewood Blvd, MS 0035-0035, Long Beach, CA 90846, USA, Tel: 562 497 6492, Fax: 562 593 6380, Delegate Peter Horner, Quality Assurance Manager, British Midland Engineering, Donington Hall, Castle Donington, Derby, DE74 2SB, UK, Tel: 01332 852320, Fax: 01332 852459, Delegate Mark Hsiu-Chaiang Tseng, Manager, UNI Air, Flight Safety Division, UNI Air, Kaohsiung Airport, Kaohsiung, Taiwan, Tel: 886 7 8056948, Fax: 886 7 8088884, Delegate Peter Hunt, Head of Operating Standards Division, Civil Aviation Authority, 1W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573655, Speaker Anthony Incorvati, Staff Engineer, SAE International, 400 Commonwealth Drive, Warrendale, PA 15096, USA, Tel: 412 772 7191, Fax: 412 776 1830, Delegate Barry Ingham, Quality Manager, Avrotec Aircraft Services, Chester Road, Woodford, Stockport, Cheshire, SK7 1QR, UK, Tel: 0161 955 3083, Fax: 0161 955 3267, Delegate Tony Ingham, Chief Surveyor, Civil Aviation Authority, Aircraft Maintenance Standards Dept, 1E, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573362, Speaker Malcolm Irwin, Quality Assurance Manaager, FR Aviation, Bournemouth International Airport, Christchurch, Dorset, BH31 6XJ, UK, Tel: 01202 409007, Fax: 01202 580936, Delegate Flavio Izzo, Quality Engineering, Officine Aeronavali Venezia, Via Nuovo Tempio, 20, 80144, Napoli, Italy, Tel: 39 81 234 4770, Fax: 39 81 234 4881, Delegate Peter Jack, Instructor, Bristows Helicopters, Redhill Aerodrome, Redhill, Surrey, RH1 5JZ, UK, Tel:
01737 822353, Fax: 01737 822694, Delegate Steve James, Head of Mechanical & Fluid Systems, Civil Aviation Authority, Aircraft & Equipment Department, 2E, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573116, Delegate Francois Janvier, Executive Manager, Air Eurosafe, Transpolis Schipol Airport, Polaris Avenue 53, 2132 JH, Hoofddorp, Netherlands, Tel: 31 23 5685758, Fax: 31 23 5685769, Delegate Kelvin John, Quality Co-ordinator, GEASE, Caerphilly Road, Nantgarw, Cardiff, Tel: 01443 47229, Fax: 01443 847427, Delegate David Johnson, Deputy Director (Engineering), CHIRP, RAF School of Aviation Maintenance, Farnborough, Hampshire, GU14 6SZ, UK, Tel: 01252 371630, Fax: 01252 543860, Delegate Bill Johnson, Vice President, Galaxy Scientific Corporation, 2130 Lavista Executive Park Drive, Tucker, Georgia 30084, USA, Tel: 770 491 1100, Fax: 770 491 0739, Speaker Keith Jones, V.P. Maintenance, Air Nova, 310 Goudey Drive, Halifax International Airport, Enfield, Nova Scotia, Canada, Tel: 902 873 5000, Fax: 902 873 4606, Delegate Julie Jones, Assistant Program Manager, Galaxy Scientific Corporation, 2130 La Vista Executive Park Dr., Tucker, Georgia 30084, USA, Tel: 770 491 1100, Fax: 770 491 0739, Speaker Joe Kania, Sr Director Quality & Safety, US Airways, 2000 Commerce Drive, Building One, Pittsburgh, PA 15275, USA, Tel: 412 747 3195, Fax: 412 747 3884, Speaker Barb Kanki, HF Researcher, NASA Ames Research Centre, M5 262-4, Moffett Field CA, 94035 1000, USA, Tel: 650 604 5785, Fax: 650 604 3323, Speaker Takahiro Kawai, Manager Quality Assurance, All Nippon Airways, 3-4-5 Haneda Airport, Ota-ku, Tokyo 144, Japan, Tel: 81 3 5756 5491, Fax: 81 3 5756 5503, Delegate Padhraic Kelleher, Head of Corporate Affairs, Civil Aviation Authority, Corporate Affairs, 3W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573403, Delegate Shigeo Kimura, Representative in Europe, Japan CAB, JETRO Amsterdam, Strawinskylaan 447, 1077XX, , Amsterdam, The Netherlands, Tel: 312 0 471 2141, Fax: 312 0 664 7597, Delegate Mike Kinch, Lecturer, Embry-Riddle University, 32a Chiltern Road, Hitchin, Hertfordshire, UK, Tel: 01462 455598, Delegate David King, Principal Inspector of Air Accdts (Eng), AAIB UK, Dept of the Environment Transport and the Regions, DERA, Farnborough, Hants, GU14 6TD, UK, Tel: 01252 510 300, Fax: 01252 376 999, Speaker Jerry Koellner, Flight Safety Director, IAMAW Air Transport District 143, 2600 Egan Woods Drive, Suite 220, St Paul, MN 55121, USA, Tel: 612 688 2640, Fax: 612 688 7229, Delegate Horst Koepke, Vice President Quality Management, ASL Aircraft Services Lemwerder, Flughafeustrasse
5, D27809, Lemwerder, Germany, Tel: 49 421 6722896, Fax: 49 421 6722842, Delegate Joan Kuenzi, Sr Specialist Human Factors, Northwest Airlines, 5101 Northwest Drive, St Paul, MN55 111-3-3034, Dept C8025, USA, Tel: (612 ) 726 1203, Fax: (612 ) 726 7164, Delegate Wouter Kunz, Human Factors Specialist, KLM Royal Dutch Airlines, Engineering Department SPC/CE, PO Box 7700, 1117 ZL, Schiphol Airport, Schiphol, Netherlands, Tel: 31 20 6496905, Fax: 31 20 6488412, Delegate Anil Kurup, Asst Manager (Risk and Loss Control), ST Aerospace Engineering, 540 Airport Road, Paya Lebar, Singapore 539938, Tel: 65 380 6570, Fax: 65 282 3236, Delegate Lily Lachance, Training Assistant, Air Canada, 681 Service Building, Napier Road, Heathrow Airport, Middlesex, TW6 2LL, UK, Delegate Johan Larsen, Maintenance Supervisor, Helikopter Service, PO Box 522, Stavanger Lufthavn, Norway, Tel: 4751 653700, Fax: 4751 656390, Delegate Brian Lavers, Regional Manager - Heathrow, Civil Aviation Authority, Sipson House, 595 Sipson Road, West Drayton, UB7 0JD, UK, Tel: 0181 759 0205, Delegate Mark Leatherbarrrow, Civil Aviation Authority, Waldron Court, Parsonage Lane, Bishops Stortford, Herts, UK, Tel: 01279 466747, Delegate Dave Lewis, Manager Applications & Certifications, Civil Aviation Authority, 2W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573157, Delegate Fred Liddell, Chairman, IAM/FAA Conformance Committee, T.W.A. inc., PO Box 20126, Room 10012, Kansas City MO 64195, USA, Tel: 816 891 1908, Fax: 816 891 4704, Delegate Graham Liddy, Inspector of Accidents, AAIU, Dept. of Public Enterprises, 25 Clare Street, Dublin 2, Ireland, Tel: 353 1604 1293, Fax: 353 1604 1514, Delegate Goran Lindstrom, Design Reviewer - Maintenance, Saab Aircraft AB, SE-58188 Linkoping, Sweden, Tel: 46 131 83105, Fax: 46 131 81700, Delegate Tom Llewellyn, Civil Aviation Authority, Aircraft Maintenance Standards Dept, 1W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573961, Delegate Janet Loach, Civil Aviation Authority, Corporate Affair, 3W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573058, Delegate Denver Lopp, Professor, Purdue University, 3060E 7UUS, Brook FWD 47922, USA, Speaker Costas N. Loulloudes, Snr Maintenance Training Officer, Cyprus Airways, Maintenance Department, Larnaca International Airport, Larnaca, Cyprus, Tel: 357 464 3212, Fax: 357 464 3319, Delegate Chris Lowenstein, Senior Airworthiness Engineer, Sikorsky Aircraft Corporation, 6900 Main Street, PO Box 9729, Stratford, CT 06497 9129, USA, Tel: 203 386 4240, Fax: 203 386 7850, Delegate
Tony Lowery, Quality and Safety Foreman, US Airways, 2000 Commerce Drive, US Airways, Building One, Pittsburgh, PA15275, USA, Tel: 412 747 3887, Fax: 412 747 1473, Delegate Benjamin Lu Bing Rung, Inspector, UNI Air Quality Assurance, Quality Assurance Section, UNI Air, Kaohsiung Airport, Kaohsiung, Taiwan, Tel: 886 7 8036942, Fax: 886 7 8060343, Delegate Ian Ludlow, Quality Manager, FLS Aerospace, Long Border Road, Stansted Airport, Essex, CM24 1RE, UK, Tel: 01279 825020, Fax: 01279 825007, Delegate Goran Lundin, Director, Aviation College of Sweden, Hasslogatan 2, S 72131, Vasteras, Sweden, Tel: 4621 801390, Fax: 4621 801 795, Delegate John Lynch, Management Analyst (EPP), FAA Office of Aviation Medecine, AAM-240, 800 Independence Ave SW, Washington DC 2059, USA, Tel: 202 267 9711, Fax: 202 267 5219, Delegate Bill Mackie, Quality Manager, FLS Aerospace, Long Border Road, Stansted Airport, Essex, CM24 1RE, UK, Tel: 01279 825020, Fax: 01279 825007, Delegate Jamie Mackreath, Grp Capt Logistics Plans and Strategy, HQ Strike Command, RAF High Wycombe, Buckinghamshire, HP14 4UE, UK, Tel: 01494 497002, Fax: 01494 497675, Speaker Jack MacLean, Head of Engineering, Bond Helicopters, Aberdeen Airport East, Dyce, Aberdeen, AB21 7DU, Scotland, Tel: 01224 725505, Fax: 01224 722425, Delegate Dave Marsh, Civil Aviation Authority, Aircraft Maintenance Standards Dept, 1W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573356, Delegate David Marx, Aviation Safety Consultant, 3814 N. Stevens Street, Tacoma, Washington 98407, USA, Tel: 253 761 5390, Fax: 253 761 5390, Speaker Tony Mazurek, Director of Training, Michigan Institute of Aeronautics, 47884 'D' Street, Belleville, MI 4811, USA, Tel: 734 483 3758, Fax: 734 438 1449, Delegate Enda McGuigan, Lecturer (Airframe), Bedford College, Cauldwell Street, Bedford, MK42 9AH, UK, Tel: 01234 345151, Fax: 01234 342674, Delegate John McKell, Human Resources Manager, Rolls Royce, Mavor Avenue, Nerson Industrial Estate, Glasgow, G74 4PY, UK, Tel: 01355 277548, Fax: 01355 277611, Delegate Jim McKenna, Head of Engineering Licensing Department, Civil Aviation Authority, Engineering Licensing Department, GE, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573623, Delegate Les McKinty, General Manager Engineering, Virgin Atlantic, Aeronautics House, Crawley Business Quarter, Manor Royal, Crawley, West Sussex, RH10 2QH, UK, Tel: 01293 744540, Fax: 01293 744540, Delegate Andrew McLaren Robertson, Manager Powerplant Overhaul, HAESL, 60 Concorde Road, Hong Kong International Airport, Hong Kong, Tel: 852 276 76786, Fax: 852 275 26041, Delegate
Malcolm McMillan, Deputy Regional Manager East Midlands, Civil Aviation Authority, 1st Floor, West Wing, Building 65, Ambassador Road, East Midlands Airport, Castle Donnington, Derbyshire, DE74 2SA, UK, Tel: 01332 811245, Delegate Dennis Mendoros, Managing Director, Euravia Engineering and Supply Co Ltd, Euravia House, Colne Road, Kelbrook, Lancashire, BB8 6TE, UK, Tel: 01282 844480, Fax: 01282 844224, Delegate Neil Menzies Calvert, Engineering Manager, British International Helicopters, Aberdeen Airport, Buchan Road, Dyce, Aberdeen, AB21 7BZ, UK, Tel: 01224 796539, Fax: (0122) 4771316, Delegate Paul Merrick, Civil Aviation Authority, Consort House, Consort Way, Horley, Surrey, HR6 7AF, UK, Tel: 01293 823993, Delegate Fiona Merritt, Human Factors Specialist, Civil Aviation Authority, Medical Research and Human Factors, 1W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573485, Delegate Bob Milburn, Maintenance Manager, British International Helicopters, Aberdeen Airport, Buchan Road, Dyce, Aberdeen, AB21 7BZ, UK, Tel: 01224 796541, Fax: 01224 771316, Delegate Bob Miles, Research Manager, HSE, 2 Southwark Bridge, London, SE1 9HS, UK, Tel: 0171 717 6685, Fax: 0171 717 6909, Speaker John Miller, Deputy Regional Manager - Scotland, Civil Aviation Authority, 1st Floor, North Norfolk House Annexe, Pitmedden Road, Dyce, Aberdeen, AB2 0DP, Scotland, Tel: 01224 724684, Delegate Art Millington, Deputy Quality Manager, MAGEC Aviation, Luton Airport, Luton, Bedfordshire, LU2 9NT, UK, Tel: 01582 724182, Fax: 01582 481530, Delegate John Mitchell, General Manager Engineering, Maersk Air Engineering, Jetstream House, Birmingham International Airport, Coventry Road, Birmingham, B26 3QB, UK, Tel: 0121 693 3232, Fax: 0121 782 0205, Delegate Karine Moal, HF and Experience Feedback, DGAC - France, 48 rue Camille, Desmoulins F92hJ2, Issy les - Moulineaux, France, Tel: 33 1 4109 4608, Fax: 33 1 4109 4513, Delegate Mike Moffat, Line Maintenance Manager, HAECO, 60 Concorde Road, Hong Kong International Airport, Hong Kong, Tel: 2767 6368, Fax: 2752 6036, Delegate Russ Mondon, Surveyor, Civil Aviation Authority, Aircraft Maintenance Standards Dept, 1W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573147, Delegate Carolyn Moody, Editorial Asst/Journalist Human Factors, Bart International, Aviation House, 23 Ste Anne, B -1380 Ohain, Belgium, Tel: 322 652 1226, Fax: 322 653 1629, Delegate Nigel Muncey, Shift Manager, Virgin Atlantic Engineering, Room Jo 202 - 213, Pier 6, Terminal 3, Heathrow Airport, Hounslow, Middlesex, TW6 1JH, UK, Tel: 0181 897 5072, Fax: 0181 897 5074, Delegate Danny Nelson, Technical Director, European Air Transport NV/SA, Building 4 - 5, Brussels National
Airport, B-1930 Zaventem, Brussels, Belgium, Tel: 322 718 1414, Fax: 322 718 1540, Delegate Dick Nesbitt-Dufort, Head of Safety Data Department, Civil Aviation Authority, 2W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573744, Delegate Terry Newman, Regional Manager - Scotland, Civil Aviation Authority, 1st Floor, North Norfolk House Annexe, Pitmedden Road, Dyce, Aberdeen, AB2 0DP, Scotland, Tel: 01224 724684, Delegate Ping Nieh, Quality Manager, TAECO, 20 Diliao Road East, Gaogi International Airport, Xiamen, PR China, Tel: 592 5737560, Fax: 592 5730224, Delegate Peter Norman Hayes, Quality Assurance Manager, HAECO, 60 Concorde Road, Hong Kong International Airport, Hong Kong, Tel: 852 2767 6300, Fax: 852 23273345, Delegate Dave Nowzek, Regional Director Civil Aviation, Transport Canada, 620-800 Burrard St, Vancouver, British Colombia, V6Z 2J8, Canada, Tel: 604 666 5851, Fax: 604 666 1175, Speaker Doyle Oden, Safety Specialist, FAA, AVN-320, PO Box 25082, Oklahoma City, OK 73125, USA, Tel: 405 954 6595, Fax: 405 954 8704, Delegate David Oldbury, Quality Assurance Manager, IAP Aircraft Maintenance, Southmill Road, Bishop's Stortford, Herts, CM23 3DH, UK, Tel: 01279 508644, Fax: 01279 508522, Delegate Lee Ostrom, Advisory Scientist, LMITCO, PO Box 1625, Idaho Falls, ID, 83915-3855, USA, Tel: 208 526 2899, Fax: 208 526 2930, Delegate Pascal Pache, Aircraft Maintenance Inspector, Federal Office for Civil Aviation, Maulbeerstrasse 9, CH-3003, Berne, Switzerland, Tel: 031 325 1141, Fax: 031 325 8048, Delegate Ed Paintin, Quality and Safety Manager, British World Airlines, Viscount House, Southend Airport, Southend Airport, Essex, SS2 6YL, UK, Tel: 01702 354435, Fax: 01702 331914, Delegate John Park, Quality Manager, CityFlyer Express, Iain Stewart Centre, Beehive Ring Road, Gatwick Airport, West Sussex, , RH6 0PB, UK, Tel: 01293 507482, Fax: 01293 507592, Delegate Rex Parkinson, Senior Inspector of Air Accidents, Air Accdt Investigation Branch, DERA, Farnborough, Hants, UK, Tel: 01252 510300, Fax: 01252 376999, Delegate Derek Paterson, Quality Assurance Manager, Rolls Royce Aero Engine Services, Nerston Industrial Estate, East Kilbride, Glasgow, G74 4PY, Scotland, Tel: 01355 277796, Fax: 01355 277624, Delegate Ron Pearson, Head of Medical Research & Human Factors, Civil Aviation Authority, GW, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573663, Delegate Mike Peer, Maintenance Manager Instructor, Air Mobility Warfare Center, 5656 Texas Avenue, Fort Dix, New Jersey, 08640-7400, USA, Tel: 609 562 4081, Fax: 609 562 4107, Delegate Stewart Penney, Regional Reporter (Europe), Press - Air Transport Intelligence, Reed Aerospace, Quadrant House, The Quadrant, Sutton, Surrey, SM2 5AS, UK, Tel: 0181-652-3903, Fax:
0181-652-3892, Delegate Carlos Roberto Pereira, Maintenance Manager, Rio Sol Linhas Aereas, Praca Lineu Gomes, S/No, Congonhas Airport - VARIG - Hangar 2, Sao Paulo-SP, ZN 04626020, Brazil, Tel: 55 11 5340 211, Fax: 55 11 5340 211, Delegate Thomas Perry, Systems Engineer, Civil Aviation Authority, Air Traffic Services Standards, 1E, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573025, Delegate Arne Petter Clausen, Director Quality Assurance, SAS Technical Division, Frosumdaviks Alle 1, SE-195 87, Stockholm, Sweden, Tel: 46 879 72439, Fax: 46 879 71200, Delegate Maureen Pettitt, Chief Scientific and Tech Advisor for HF, FAA, 800 Independence Avenue SW, Washington DC 20591, USA, Tel: 262 267 7219, Fax: 262 267 5797, Speaker Julie Philpott, Engineering Quality Manager, Monarch Aircraft Engineering, Luton (London) Airport, Luton, Beds, LU2 9LX, UK, Tel: 01582 598740, Fax: 01582 706157, Delegate Terry Pittam, Technical Manager, Rolls Royce Aero Engine Svces, Ansty, Coventry, CV7 9JR, UK, Tel: 01203 623382, Fax: 01203 623377, Delegate Steve Poole, Engineering Manager, Normalair-Garrett, Yeovil, Somerset, BA20 2YD, UK, Tel: 01935 475181, Fax: 01935 446583, Delegate Peter Pope, Manager Human Factors, Britannia Airways, London Luton Airport, Luton, Bedfordshire, LU2 9ND, United Kingdon, Tel: 01582 428084, Fax: 01582 428304, Delegate Vincent Pounailloux, Consultant, Eurisys Consultants, 14 Rue du Printemps, 75017, Paris, France, Tel: 0140 2122437, Fax: 0140 547575, Delegate Jon Pran, Over Inspector, AAIB Norway, PO Box 165, 1330 Oslo Airport, Norway, Tel: 671 22319, Fax: 671 25333, Delegate Paul Price, Quality Assurance Manager, Air 2000, 6th Floor, Tower Block, Manchester International Airport, Manchester, M90 2EP, UK, Tel: 0161 489 3845, Fax: (0161) 489 2339, Delegate Richard Profit, Group Director, Safety Regulation, Civil Aviation Authority, 3W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573083, Delegate Jose Manuel Queuedo, Technical Co ordination Dep., Senasa, Auda Hispanidad, 12, 28042 Madrid, Spain, Tel: 34 1 301 9468, Fax: 34 1 301 9469, Delegate James Reason, University of Manchester, Department of Psychology, Crawford House, Precinct Centre, Oxford Road, Manchester, M13 9GH, UK, Speaker Don Reichard, Maintenance Curriculum Development Mgr, Air Mobility Warfare Center, 5656 Texas Avenue, Fort Dix, New Jersey, 08640-7400, USA, Tel: 609 562 4081, Fax: 609 562 4107, Delegate Iain Ritchie, Deputy Training Manager, Air Service Training (Eng), Perth Airport, Perth, PH2 6NP,
Scotland, Tel: 01738 552311, Fax: 01738 553369, Delegate Michelle Robertson, Assistant Professor, Univeristy of South California, 5 Goodnow Lane, Framingham, MA, USA, Tel: 508 370 9260, Fax: 508 370 9526, Speaker Fitzroy Ross, Air Jamaica, Maintenance Engineering Dept, Norman Manley International Airport, Kingston, West Indies, Jamaica, Tel: 876 924 8793, Fax: 876 924 8155, Delegate Heike Rottgering, Manager, Lufthansa Technical Training, Weg beim jager 193, D22335, Hamburg, Germany, Tel: 49 405070 2226, Fax: 49 405070 4746, Delegate Susannah Russell, Psychologist and Project Manager, Defence Evaluations Research Agency, Room 2012, Probert Building, Farnborough, Hampshire, GU14 OLX, UK, Tel: 01252 394787, Fax: 01252 394700, Delegate Dennis Russell, Technical Director, Bristows Helicopter, Redhill Aerodrome, Redhill, Surrey, RH1 5JZ, UK, Tel: 01737 822353, Fax: 01737 822694, Delegate Scott Rydberg, HF Co-ordinator, Northwest Airlines, 7200 34th Avenue, Minneapolis, Manhattan, 55450-1196, USA, Tel: 612 727 6667, Fax: 612 727 6094, Delegate Mark Sampson, Quality Assurance Manager, H+S Aviation, Airport Service Road, Portsmouth, PO3 5PJ, UK, Tel: 01705 304094, Fax: 01705 304201, Delegate Bob Sargent, Senior Specialist Engineer, Boeing Commercial Airplane Group, Maintenance Human Factors, PO Box 3707, M/S 2J-54, Seattle, Washington, 98124-2207, USA, Tel: (206 ) 544 8872, Fax: (206 ) 544 8502, Delegate Arun Sarin, Maintenance Manager, European Air Transport NV/SA, Building 4 - 5, Brussels National Airport, B-1930 Zaventem, Brussels, Belgium, Tel: 322 718 1414, Fax: 322 718 1540, Delegate John Saull, Executive Director, IFA, Little Beeches, Woodshill Lane, Ashurst Wood, West Sussex, RH19 3RF, UK, Tel: 01342 822712, Delegate Adrian Sayce, Head of Safety Analysis Department, Civil Aviation Authority, Safety Analysis Department, 2W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573346, Delegate Stuart Schofield, Technical Director, British Midland Engineering, Donington Hall, Castle Donington, Derby, DE74 2SB, UK, Tel: 01332 852320, Fax: 01332 852459, Delegate Peter Schultz, Regional Manager, SAS Maintenance Training, PO Box 150, DK2770, Kastrup, Denmark, Tel: 45 323 23036, Fax: 45 323 22488, Delegate Geoff Scollick, Senior Engineer Q.A., Cathy Pacific Airways, 9/F Block T, Cathy Pacific Building, Hong Kong International Airport, Hong Kong, Tel: 852 2747 8268, Fax: 852 2194 7951, Delegate Tim Scorer, Partner, Dibb Lupton Alsop, 2 Minster Court, Mincing Lane, London, EC3R 7XW, UK, Tel: 0171 796 6516, Fax: 0171 796 6783, Speaker
Paul Sellears, Quality Assurance Manager, British Midland Airways, Donington Hall, Castle Donington, Derby, DE74 2SB, UK, Tel: 01332 854868, Fax: 01332 854864, Delegate Richard Sharpe, Quality Manager, Flight Test & Delivery, De Havilland Inc, 123 Garratt Blvd, Downsview, Ontario, M3K 1Y5, Canada, Tel: 416 375 4469, Fax: 416 375 4504, Delegate Don Sherritt, Dir Aircraft Maint & Manufacturing, Transport Canada, 330 Sparks Street, Floor 2, Ottawa, Ontario KIAON8, Tel: (613 ) 952 437, Fax: (613 ) 952 3298, Speaker Steve Shorrock, Human Factors Analyst, National Air Traffic Services, ATMDC - Bournemouth Airport, Christchurch, Bournemouth, BH23 6DF, UK, Tel: 01202 472222, Fax: 01202 472236, Delegate Phil Sibthorp, Quality Assurance, FLS Aerospace, Long Border Road, Stansted Airport, Essex, CM24 1RE, UK, Tel: 01279 825020, Fax: 01279 825007, Delegate Swaran Sidhu, Maintenance Superintendent, Maersk Air Engineering, Jetstream House, Birmingham International Airport, Coventry Road, Birmingham, B26 3QB, UK, Tel: 0121 693 3232, Fax: 0121 782 0205, Delegate Wing Commander Steve Sims, EIFS (RAF), RAF Bentley Priory, Stanmore, Middlesex, HA7 3HH, UK, Tel: 0181 838 7604, Fax: 0181 838 7638, Delegate Bill Singh Sandhu, Qualiy Manager, CSE Aviation, Oxford Airport, Kidlington, Oxford, OX5 1RA, UK, Tel: 01865 841234, Fax: (0186) 5379123, Delegate Liam Sisk, Technical Manager, Team Aer Lingus, Dublin Airport, Dublin, MD 132, Ireland, Tel: 353 1 7056327, Delegate Arild Skaalerud, Inspector, AAIB Norway, PO Box 165, 1330 Oslo Airport, Norway, Tel: 671 22319, Fax: 671 25333, Delegate Graham Skillen, Head of Flight Test Section, Civil Aviation Authority, Flight Department, 2E, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573089, Delegate Sharon Skinner, Operations Safety Executive, British Airways, Compass Centre (S752), PO Box 10, Heathrow Airport, Middlesex, TW6 2JA, UK, Tel: 0181 513 0921, Fax: 0181 513 0957, Delegate Robert Slater, Rolls Royce, Engine Services Limited, PO Box 31, Derby, DE24 8BJ, UK, Delegate George Smith, Engineering Manager, British World Airlines, Viscount House, Southend Airport, Essex, SS2 6YL, UK, Tel: 01702 354435, Fax: 01702 331914, Delegate Steve Smith, Quality Manager, TNT Aircraft Maintenance Services, Unit 6013, Taylor's End, Long Border Road, Stansted Airport, Essex, CM24 6RL, UK, Tel: 01279 666670, Fax: 01279 666667, Delegate Martin Stainthorpe, Junior Engineer, Normalair-Garrett, Yeovil, Somerset, BA20 2YD, UK, Tel: 01935 475181, Fax: 01935 446583, Delegate John Stelly Jr, Director Systems and Training, Continental Airlines, Suite 600 Gateway Building 1, 3663
North Sam Houston Parkway, Houston TX 77032, Tel: 281 985 1194, Fax: 281 985 1189, Delegate Warren Storey, Deputy Quality Assurance Manager, Gill Aviation, New Aviation House, Newcastle Airport, Woolsington, Newcastle Upon Tyne, NS13 8BT, UK, Tel: 0191 2146600, Fax: 0191 2861219, Delegate Bruno Stutz, Division Manager, SR Technics/TES, Technical Flight Safety, CH 8058, Zurich Airport, Switzerland, Tel: 41 1 812 6400, Fax: 41 1 812 9132, Delegate Dave Surgenor, Line Maintenance Manager, Manx/British Regional Airlines, Isle of Man (Ronaldsway) Airport, Ballasalla, IM9 2JE, Isle of Man, Tel: 01624 826044, Fax: 01624 826041, Delegate Steve Sykes, General Manager, Avrotec Aircraft Services, Chester Road, Woodford, Stockport, Cheshire, SK7 1QR, UK, Tel: 0161 955 3083, Fax: 0161 955 3267, Delegate Peter Tait, Director, CHIRP, RAF School of Aviation Medecine, Farnborough, Hampshire, GU146 6SZ, UK, Tel: 01252 370760, Fax: 01252 543860, Delegate Jim Taylor, Adjunct Professor, Santa Clara University, School of Engineering, 500 El Cawino Road, Santa Clara, CA 95053-0590, USA, Tel: 408 554 4154, Fax: 408 554 5474, Speaker Kader Tazerout, General Manager Quality Assurance, Emirates Airline, PO Box 686, Dubai, UAE, Tel: 9714 822230, Fax: 9714 820236, Delegate John Todd, Quality Manager, FLS Aerospace, Long Border Road, Stansted Airport, Essex, CM24 1RE, UK, Tel: 01279 825020, Fax: 01279 825007, Delegate Charles Torrey, Director of Training, COMPTRA Learning Systems, 209-67 Miner Street, New Westminster, British Columbia, V3L 5N5, Canada, Tel: 604 728 8724, Fax: 604 728 5203, Delegate Rob Van der Boom, Manager Policy and Regulations, RLD, PO Box 575, 2130 AN Hoofddorp, The Netherlands, Tel: 31 23 566 3153, Fax: 31 23 564 0741, Delegate Carlo Vergari, Quality Assurance Manager, Metro Business Aviation, No2 Maintenance Area, Heathrow Airport, Hounslow, TW6 3AE, UK, Tel: 0181 585 7309, Fax: 0181 585 7301, Delegate Leslie Vipond, Sponsor Human Factors Programme, FAA, Speaker Mike Vivian, Civil Aviation Authority, Flight Operations Department, 1W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573470, Delegate Mike Walker, Shift Manager, Virgin Atlantic, Atlantic House, Gatwick Airport, West Sussex, RH6 ONP, UK, Tel: 01293 444040, Fax: 01293 444043, Delegate Pete Walkington, Quality Engineer, British Airways Avionics Eng, Ely Meadow, Talbot Green, Pontyclun, Mid Glamorgan, CF72 8XL, Tel: 01443 234505, Fax: 01443 234998, Delegate Anne Wallace, Civil Aviation Authority, Corporate Affairs, 3W, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573886, Delegate
Ian Walters, Quality Manager, Muirhead Vactric Comps, 33 Oakfield Road, Penge, London, SE20 8EW, UK, Tel: 0181 659 9090, Delegate David Watkins, Head of Quality Assurance, Rolls Royce Aero Engine Svces, Ansty, Coventry, CV7 9JR, UK, Tel: 01203 624231, Fax: 01203 623580, Delegate Jean Watson, Prog. Mgr. Aircraft Maint. HF Research, FAA, 800 Independence Avenue, Washington DC 20591, USA, Tel: 202 267 8393, Fax: 202 267 5894, Delegate Doug Webb, Civil Aviation Authority, Waldron Court, Parsonage Lane, Bishops Stortford, Herts, CM23 5DB, UK, Tel: 01279 4666747, Delegate Martin Weedon, Engine Overhaul Manager, Rolls Royce Aero, Engine Services Limited, PO Box 31, Derby, DE24 8BJ, UK, Tel: 01332 246634, Fax: 01332 246837, Delegate Ian Weston, Head of ATS Investigation, Civil Aviation Authority, Air Traffic Services Standards Dept, 1E, Aviation House, Gatwick Airport South Area, West Sussex, RH6 0YR, UK, Tel: 01293 573646, Delegate Fred Whetnall, Manager Fleet Technical, British Airways Engineering, PO Box 747, Gatwick Airport, West Sussex, RH6 OFH, UK, Tel: 01293 462800, Fax: 01293 462888, Delegate Dave Whitcroft, Maintenance Technical Instructor, Air Ontario, 1000 Air Ontario Drive, London, Ontario, N5V 3S4, Canada, Tel: 519 453 8440, Fax: 519 453 8454, Delegate David White, Quality Manager - Luton, Metro Business Aviation, Hangar 62, Percival Way, Luton Airport, Luton, LU2 9XD, UK, Tel: 01582 435065, Fax: 01582 435156, Delegate Nick White, Manager Base Maintenance, Britannia Airways, Luton Airport, Luton, Beds, LU2 9ND, UK, Tel: 01582 428019, Fax: 01582 428212, Delegate Eric White, Chief Mechanic 757 Program, Boeing Service Engineering, PO Box 3707, MS03-CU, Seattle, Washington, 98124, USA, Tel: 4253 421408, Fax: 425 2948585, Delegate Brian Whitehead, Chief, Policy Development, Transport Canada, 330 Sparks Street, Floor 2, Ottawa, Ontario KIA ON8, Canada, Tel: 613 941 8371, Fax: 613 952 3298, Speaker Stephen Windsor, Quality Engineer, ATC Lasham, Lasham Airfield, Lasham, Hampshire, GU34 5SP, UK, Tel: 01256 356123, Fax: 01256 467487, Delegate Dave Witchard, Technical Operations Manager, Avrotec Aircraft Services, Chester Road, Woodford, Stockport, Cheshire, SK7 1QR, UK, Tel: 0161 955 3083, Fax: 0161 955 3267, Delegate Simon Witts, Engineering Director, Air UK Engineering, Liberator Road, Norwich Airport, Norwich, Norfolk, NR6 6ER, UK, Tel: 01603 254511, Fax: 01603 254435, Speaker Woon-chung Wong, Manager Technical Training, HAECO, 60 Concorde Road, Hong Kong International Airport, Hong Kong, Tel: 852 2767 6381, Fax: 852 23273345, Delegate
Ian Woodhouse, RAF Bentley Priory, Stanmore, Middlesex, HA7 3HH, UK, Delegate Pete Woollacott, Head of Development Engineering - Airbus, Virgin Atlantic, Aeronautics House, Crawley Business Quarter, Manor Royal, Crawley, West Sussex, UK, Tel: 01293 744617, Fax: 01293 744 674, Delegate Roger Wootton, Dean - School of Engineering, City University, School of Engineering, Northampton Square, London, EC1V OHB, UK, Tel: 0171 477 8100, Fax: 0171 477 8101, Speaker David Wyatt, Maintenance Systems Manager, Executive Aircraft Charter, Room 1, First Floor, North Terminal, Dublin Airport, Dublin, Ireland, Tel: 0410 385019, Fax: 353 1 704 4783, Delegate Kenichi Yamamoto, Staff Director, Japan Airlines Co QA, Maintenance Center Building, 1-9-1 Haneda Airport, Ota-ku, Tokyo, Japan, Tel: 81-3-3747-3821, Fax: 81-3-3747-4133, Delegate Ralph Young, Qantas Airways, Technical Training Dept, Mascot, Sydney, Australia, Tel: 61 2 9691 7944, Fax: 61 2 9691 8901, Delegate Art Younkin, Manager Human Factors Engineering, Continental Airlines, Suite 600 Gateway Building 1, 3663 North Sam Houston Parkway, Houston TX 77032, USA, Tel: 281 985 1194, Fax: 281 985 1189, Delegate Roland Zilz, Civil Aviation Authority, International Services, Aviation House, Gatwick Airport South, West Sussex, RH6 0YR, UK, Delegate Klaas J. Zwart, Project Manager Human Factors, RLD, PO Box 575, 2130 AN Hoofddorp, Saturnusstraat 71, The Netherlands, Tel: 31 23 566 3132, Fax: 31 23 564 0741, Delegate