FROM THE BRIEFING ROOM

Safety and the cost killers

By Jean Paries
Jean graduated from the French
National School of Civil Aviation
as engineer, and then joined
the DGAC for several positions
dealing with air safety regula-
tions. He was a member of the
ICAO Human Factors & Flight Safety Study Group
since its creation in 1988. In 1990, he joined the
Bureau Enquêtes Accident as Deputy Head, and
Head of Investigations, where he led the techni-
cal investigation into the Mont Saint-Odile Acci-
dent, 1992. Currently Jean is CEO - of Dédale SA.
He holds a Commercial Pilot Licence with Instru-
ment, Multi-engines, Turboprop, and Instructor
ratings and a Helicopter Private Pilot Licence.

A global race

Because he had lifted the Nissan car-maker limitations in the design of the work environment the Mars Observer was lost in 1993, NASA had
company from near bankruptcy and given it in- and processes. None of these conditions come already invested a billion dollars - and all its sci-
dustry-leading profit margins in just four years, without a cost. Hence killing costs may affect entific hopes - into the project. In contrast, the
Carlos Ghosn got the sort of adulation in Japan safety as well. On the other hand, there might be combined price tag for the Mars Climate Orbiter
that is normally reserved for rock stars. But when some wisdom in the idea that a smart and coher- and Polar Lander failure7 “only” amounted to
he took over as the CEO at Renault, French jour- ent evolution of a system can win on all fronts. $235 million. So, as a NASA manager once put it,
nalists had already dubbed him “the Cost Killer”, After all, aviation history itself is a nice example “If you do a multitude of missions, it’s better than
a rather backhanded welcome compliment. of getting faster, better, cheaper - and safer, if you put all of your resources in one basket.”
Further evidence of cultural differences... But at the same time. So, which vision is right?
welcome or not, “cost killing” and productivity What is the relationship between economic While it’s a bit difficult to imagine a straightfor-
are now characteristic of the fierce, global race pressure and safety? ward transfer of such debate to ATM – unlike in
between companies, regions and nations. Every space ventures, an accident is not an option in
industry has come under powerful pressure to ATM – it is a nice illustration that simple ideas
shorten project realisation time, cut production Faster, better, cheaper… failure? are rarely correct where safety is concerned.
costs, and also improve quality. Whatever the Because it emerges from complex interac-
product or service, anything which is designed, To launch this discussion, it might be interest- tions across its components, the safety of large
produced, or operated – including ATM – must be ing to draw on the sources. The “faster, bet- systems often has surprising, counter-intuitive
done “faster, better, and cheaper”. ter, cheaper” motto was coined at NASA in the properties. More is not necessarily better. Local,
early 90s, when stricter budgets from US Con- isolated efforts to optimise safety generally fail to
But can it be safer as well, or even maintain the gress forced the space agency to demand bet- generate an overall best. Using superficial logic,
same level of safety in the face of these chang- ter performance from small missions with tighter the introduction of an additional safety net like
es? It is in fact quite sensible to raise concerns schedules5. It ignited a long-lasting debate over TCAS onboard aircraft is categorically good for
about the impact of economic pressures and the value of the new credo. Many voices claimed safety… unless, as sadly shown by the Überlin-
“cost killing” efforts on the (operational and oc- that faster and cheaper were obviously not bet- gen accident and several other events, its poten-
cupational) safety of operations. Obviously, safety ter6. The debate intensified when it appeared that tial interactions with the existing safety process
has a cost. Safety requirements include carefully the rate of design errors and associated space are considered. For similar reasons, the conse-
thought-out fail-safe design with adequate back- mission failures was growing. But its supporters quences of economic pressures on safety are not
ups and redundancies, high quality equipment argued that the idea still held: when a mission is straight-forward.
maintenance, adequate staffing and training, due inherently risky, it’s better to have a cheap disap-
consideration of stress, fatigue and other Human pointment than an expensive catastrophe. When

Hindsight 16 Back to Content

FROM THE BRIEFING ROOM

Several constraints Quality Management is the key process: clarify are squashed on their wings. Desert lizards are
the goals, set the proper requirements, do what so well adapted that they can survive for years
In fact, safety is one of the three main constraints is specified, monitor what happens, learn from without water, but would disappear if the climate
that shape production activities. The other two experience, and adapt requirements accordingly. changed by a few degrees. Trained controllers
are the economic pressure to increase efficiency, can handle up to thirty aircraft in a busy sector…
and the social pressure from staff striving to win Is this approach valid for all components of per- provided all aircraft behave exactly as expected.
more favourable work conditions. As shown by formance? Safety is no exception. Most safety
the picture, borrowed from Jens Rasmussen’s experts would agree that an efficient safety Thus rational and formal optimisations of produc-
work, these three constraints are only partially strategy includes the following components: tion systems make them better (more efficient,
antagonistic. They delimit a “green area” which design reliable technology, automate what can more reliable), possibly cheaper, and generally
is the envelope of acceptable operations. Outside be automated, anticipate all work situations safer within their adaptation envelope. Unfortu-
the boundaries of this area, the business cannot (including emergency situations), specify every nately, they also make them less “resilient” out-
survive. detail of “the right” behaviour through appro- side their adaptation envelope. Resilience is the
Boundary of priate procedures, select the “right” operator capability of a system or organisation to maintain
acceptable cost profiles, train them to follow procedures, its integrity and main functions after a disruption
of activities monitor adherence to procedures, blame the - i.e. an external or internal disturbance that fall
deviants (intentional violations), detect and explain outside the scope of adaptive behaviour of that
Econ
“honest errors”, learn from them and fix the system. Resilience is about how a system can
Pres omic system accordingly. actively ensure that things do not get out of hand.
sure
Regulations

Boundary of It is not enough that a system like ATM be reliable

Safety

acceptable (so that the failure probability is acceptably low);

l
safety level cia re
So essu
P r Efficiency versus flexibility: Should it must also be resilient and have the ability to
recover from disruptions and unexpected degra-
Boundary of the desert lizard show the way? dations. It needs not only well adapted process-
acceptable es and procedures, but also robust yet flexible
work conditions In other words, economic pressures and safe- processes, in the face of disruptions or ongoing
ty requirements tend to take the same form: production pressures. And the main source of
Within the boundaries, the operation represents rationalisation, formalisation, proceduralisation, robustness and flexibility is intelligence, at both
a compromise between efficiency, safety and automation. Essentially, they both try to reduce the individual and collective level, in particular for
comfort. The best way to relax this antagonism the messiness and uncertainty in the system front-line operators. The system must maintain
and shift these boundaries is a fundamental by reducing variety, diversity, deviation, in- and safeguard this intelligence at any cost.
technological change. When jet airliners were stability. But the side effect is that this also
introduced, they simultaneously offered more reduces autonomy, creativity, and reactivity.
efficiency, more comfortable work conditions for They try to increase order, conformity, stabil-
the crew, and safer flights. Similar improvements ity, predictability, discipline, anticipation, rep- 5
Employees were cut from about 25,000 to
occurred within ATM with the introduction of etition, etc. Achieving this renders the systems 18,500 over 7 years.
new technologies like radar, transponder, or more efficient, cheaper, and more reliable…
computer-based flight displays. within the confines of their standard environ- 6
See for example Dekker SWA (2005) Ten
ment. They also make it more and more brittle Questions about Human Error. Lawrence.
outside the boundaries of the normal envelope. Erlbaum, Mahwah, p144.
The Long March Towards Quality They tend to over-adapt the systems and pro-
cesses to their standard business and operating 7
In September 1999, a failure to convert between
But technological revolutions do not happen environment. This trade-off between efficiency metric and English units condemned the Mars
every day. The overall progress of a system (adaptation level) and flexibility (adaptation Climate Orbiter to an unexpected end, while a
like ATM also results from the confluence of bandwidth) is universal. Formula 1 car tires software flaw contributed to its sister ship
many streams of evolution and improvement: have an incredible grip… within a tempera- (Mars Polar Lander) crash landing in December
better organisation, better technology, bet- ture range of plus or minus 5°C. Competition (the software erroneously detected a landing
HINDsight Edition 8 Winter ‘09

ter work processes, better procedures, better gliders can fly more than 50 km in calm air from when the landing gear deployed, and
training, and so on. Better is the key word. And an altitude of 1000m… provided no mosquitoes prematurely shut down the engines).

Back to Content Hindsight 17