Doc9803航线运行安全审计

民航

ffice:smarttags" />1.1.3 The compromise between production and safetyfficeffice" />

is a complex and delicate balance. Humans are generally

very effective in applying the right mechanisms to

successfully achieve this balance, hence the extraordinary

safety record of aviation. Humans do, however, occasionally

mismanage or incorrectly assess task and/or situational

factors and fail in balancing the compromise, thus

contributing to safety breakdowns. Successful compromises

far outnumber failed ones; therefore, in order to understand

human performance in context, the industry needs to

systematically capture the mechanisms underlying successful

compromises when operating at the limits of the

system, rather than those that failed. It is suggested that

understanding the human contribution to successes and

failures in aviation can be better achieved by monitoring

normal operations, rather than accidents and incidents. The

Line Operations Safety Audit (LOSA) is the vehicle

endorsed by ICAO to monitor normal operations.

民航

1.2 BACKGROUNDfficeffice" />

Reactive strategies

Accident investigation

ffice:smarttags" />1.2.1 The tool most often used in aviation to document

and understand human performance and define remedial

strategies is the investigation of accidents. However, in terms

of human performance, accidents yield data that are mostly

about actions and decisions that failed to achieve the

successful compromise between production and safety

discussed earlier in this chapter.

民航

ffice:smarttags" />1.2.2 There are limitations to the lessons learned fromfficeffice" />

accidents that might be applied to remedial strategies vis-àvis

human performance. For example, it might be possible

to identify generic accident-inducing scenarios such as

Controlled Flight Into Terrain (CFIT), Rejected Take-Off

(RTO), runway incursions and approach-and-landing accidents.

Also, it might be possible to identify the type and

frequency of external manifestations of errors in these

generic accident-inducing scenarios or discover specific

training deficiencies that are particularly related to identified

errors. This, however, provides only a tip-of-the-iceberg

perspective. Accident investigation, by definition, concentrates

on failures, and in following the rationale advocated

by LOSA, it is necessary to better understand the success

stories to see if they can be incorporated as part of remedial

strategies.

民航

ffice:smarttags" />1.2.3 This is not to say that there is no clear role forfficeffice" />

accident investigation within the safety process. Accident

investigation remains the vehicle to uncover unanticipated

failures in technology or bizarre events, rare as they may be.

Accident investigation also provides a framework: if only

normal operations were monitored, defining unsafe

behaviours would be a task without a frame of reference.

Therefore, properly focused accident investigation can

reveal how specific behaviours can combine with specific

circumstances to generate unstable and likely catastrophic

scenarios. This requires a contemporary approach to the

investigation: should accident investigation be restricted to

the retrospective analyses discussed earlier, its contribution

in terms of human error would be to increase existing

industry databases, but its usefulness in regard to safety

would be dubious. In addition, the information could

possibly provide the foundations for legal action and the

allocation of blame and punishment.

民航

Combined reactive/proactive strategiesfficeffice" />

Incident investigation

ffice:smarttags" />1.2.4 A tool that the aviation industry has increasingly

used to obtain information on operational human performance

is incident reporting. Incidents tell a more complete

story about system safety than accidents do because they

signal weaknesses within the overall system before the

system breaks down. In addition, it is accepted that incidents

are precursors of accidents and that N-number of incidents

of one kind take place before an accident of the same kind

eventually occurs. The basis for this can be traced back

almost 30 years to research on accidents from different

industries, and there is ample practical evidence that

supports this research. There are, nevertheless, limitations

Chapter 1. Basic error management concepts 1-3

on the value of the information on operational human

performance obtained from incident reporting.

民航

ffice:smarttags" />1.2.5 First, reports of incidents are submitted in thefficeffice" />

jargon of aviation and, therefore, capture only the external

manifestations of errors (for example, “misunderstood a

frequency”, “busted an altitude”, and “misinterpreted a

clearance”). Furthermore, incidents are reported by the

individuals involved, and because of biases, the reported

processes or mechanisms underlying errors may or may not

reflect reality. This means that incident-reporting systems

take human error at face value, and, therefore, analysts are

left with two tasks. First, they must examine the reported

processes or mechanisms leading up to the errors and

establish whether such processes or mechanisms did indeed

underlie the manifested errors. Then, based on this relatively

weak basis, they must evaluate whether the error management

techniques reportedly used by operational personnel

did indeed prevent the escalation of errors into a system

breakdown.

民航

ffice:smarttags" />1.2.6 Second, and most important, incident reporting isfficeffice" />

vulnerable to what has been called “normalization of

deviance”. Over time, operational personnel develop informal

and spontaneous group practices and shortcuts to

circumvent deficiencies in equipment design, clumsy procedures

or policies that are incompatible with the realities

of daily operations, all of which complicate operational

tasks. These informal practices are the product of the

collective know-how and hands-on expertise of a group, and

they eventually become normal practices. This does not,

however, negate the fact that they are deviations from

procedures that are established and sanctioned by the

organization, hence the term “normalization of deviance”. In

most cases normalized deviance is effective, at least

temporarily. However, it runs counter to the practices upon

which system operation is predicated. In this sense, like any

shortcut to standard procedures, normalized deviance carries

the potential for unanticipated “downsides” that might

unexpectedly trigger unsafe situations. However, since they

are “normal”, it stands to reason that neither these practices

nor their downsides will be recorded in incident reports.

民航

ffice:smarttags" />1.2.7 Normalized deviance is further compounded byfficeffice" />

the fact that even the most willing reporters may not be able

to fully appreciate what are indeed reportable events. If

operational personnel are continuously exposed to substandard

managerial practices, poor working conditions

and/or flawed equipment, how could they recognize such

factors as reportable problems?

民航

ffice:smarttags" />1.2.8 Thus, incident reporting cannot completelyfficeffice" />

reveal the human contribution to successes or failures in

aviation and how remedial strategies can be improved to

enhance human performance. Incident reporting systems are

certainly better than accident investigations in understanding

system performance, but the real challenge lies in taking the

next step — understanding the processes underlying human

error rather than taking errors at face value. It is essential

to move beyond the visible manifestations of error when

designing remedial strategies. If the aviation industry is to

be successful in modifying system and individual performance,

errors must be considered as symptoms that

suggest where to look further. In order to understand the

mechanisms underlying errors in operational environments,

flaws in system performance captured through incident

reporting should be considered as symptoms of mismatches

at deeper layers of the system. These mismatches might be

deficiencies in training systems, flawed person/technology

interfaces, poorly designed procedures, corporate pressures,

poor safety culture, etc. The value of the data generated by

incident reporting systems lies in the early warning about

areas of concern, but such data do not capture the concerns

themselves.

民航

Trainingfficeffice" />

ffice:smarttags" />1.2.9 The observation of training behaviours (during

flight crew simulator training, for example) is another tool

that is highly valued by the aviation industry to understand

operational human performance. However, the “production”

component of operational decision making does not exist

under training conditions. While operational behaviours

during line operations are a compromise between production

and safety objectives, training behaviours are absolutely

biased towards safety. In simpler terms, the compromise

between production and safety is not a factor in decision

making during training (see Figure 1-2). Training

behaviours are “by the book”.