ACCIDENT CAUSATION — THE REASON MODEL .1

Chapter 2. Basic Safety Concepts 2-5 2.3.11 The downside of Human Factors endeavours during a significant portion of the “golden era” was that they tended to focus on the individual, with scant attention to the operational context in which individuals accomplished their missions. It was not until the early 1990s that it was first acknowledged that individuals do not operate in a vacuum, but within defined operational contexts. Although scientific literature was available regarding how features of an operational context can influence human performance and shape events and outcomes, it was not until the 1990s that aviation acknowledged that fact. This signalled the beginning of the “organizational era” when safety began to be viewed from a systemic perspective, to encompass organizational, human and technical factors. It was also at that time that the notion of the organizational accident was embraced by aviation. 2.4 ACCIDENT CAUSATION — THE REASON MODEL 2.4.1 Industry-wide acceptance of the concept of the organizational accident was made possible by a simple, yet graphically powerful, model developed by Professor James Reason, which provided a means for understanding how aviation or any other production system operates successfully or drifts into failure. According to this model, accidents require the coming together of a number of enabling factors — each one necessary, but in itself not sufficient to breach system defences. Because complex systems such as aviation are extremely well-defended by layers of defences in- depth, single-point failures are rarely consequential in the aviation system. Equipment failures or operational errors are never the cause of breaches in safety defences, but rather the triggers. Breaches in safety defences are a delayed consequence of decisions made at the highest levels of the system, which remain dormant until their effects or damaging potential are activated by specific sets of operational circumstances. Under such specific circumstances, human failures or active failures at the operational level act as triggers of latent conditions conducive to facilitating a breach of the system’s inherent safety defences. In the concept advanced by the Reason model, all accidents include a combination of both active and latent conditions. 2.4.2 Active failures are actions or inactions, including errors and violations, which have an immediate adverse effect. They are generally viewed, with the benefit of hindsight, as unsafe acts. Active failures are generally associated with front-line personnel pilots, air traffic controllers, aircraft mechanical engineers, etc. and may result in a damaging outcome. They hold the potential to penetrate the defences put in place by the organization, regulatory authorities, etc. to protect the aviation system. Active failures may be the result of normal errors, or they may result from deviations from prescribed procedures and practices. The Reason model recognizes that there are many error- and violation–producing conditions in any operational context that may affect individual or team performance. 2.4.3 Active failures by operational personnel take place in an operational context which includes latent conditions. Latent conditions are conditions present in the system well before a damaging outcome is experienced, and made evident by local triggering factors. The consequences of latent conditions may remain dormant for a long time. Individually, these latent conditions are usually not perceived as harmful, since they are not perceived as being failures in the first place. 2.4.4 Latent conditions become evident once the system’s defences have been breached. These conditions are generally created by people far removed in time and space from the event. Front-line operational personnel inherit latent conditions in the system, such as those created by poor equipment or task design; conflicting goals e.g. service that is on time versus safety; defective organizations e.g. poor internal communications; or management decisions e.g. deferral of a maintenance item. The perspective underlying the organizational accident aims to identify and mitigate these latent conditions on a system-wide basis, rather than by localized efforts to minimize active failures by individuals. Active failures are only symptoms of safety problems, not causes. 2.4.5 Even in the best-run organizations, most latent conditions start with the decision-makers. These decision- makers are subject to normal human biases and limitations, as well as to real constraints such as time, budgets, and politics. Since downsides in managerial decisions cannot always be prevented, steps must be taken to detect them and to reduce their adverse consequences. 2-6 Safety Management Manual SMM 2.4.6 Decisions by line management may result in inadequate training, scheduling conflicts or neglect of workplace precautions. They may lead to inadequate knowledge and skills or inappropriate operating procedures. How well line management and the organization as a whole perform their functions sets the scene for error- or violation-producing conditions. For example: How effective is management with respect to setting attainable work goals, organizing tasks and resources, managing day-to-day affairs, and communicating internally and externally? The decisions made by company management and regulatory authorities are too often the consequence of inadequate resources. However, avoiding the initial cost of strengthening the safety of the system can facilitate the pathway to the organizational accident. 2.4.7 Figure 2-3 portrays the Reason model in a way that assists in understanding the interplay of organizational and management factors i.e. system factors in accident causation. Various defences are built deep into the aviation system to protect against fluctuations in human performance or decisions with a downside at all levels of the system i.e. the front-line workplace, supervisory levels and senior management. Defences are resources provided by the system to protect against the safety risks that organizations involved in production activities generate and must control. This model shows that while organizational factors, including management decisions, can create latent conditions that could lead to breaches in the system’s defences, they also contribute to the robustness of the system’s defences 2.5 THE ORGANIZATIONAL ACCIDENT 2.5.1