COMMERCIAL AVIATION

From the first flights of the Wright brothers in 1903, aviation has always been dangerous. Even today, although it is one of the safest activities people participate in, many people still feel that it is extremely dangerous, and even refuse to fly. While the hazards remain real, their effective management provides the compensation that makes flying so safe. The danger is shared not only by the passengers but also by the pilots.

An aircraft crash is almost always disastrous, given the speeds, altitudes, and the presence of dangerous and inflammable materials. This rapidly led to a political, social, and commercial awareness that aviation safety had to be taken seriously. The “barnstorming” style of aviation soon fell into disrepute, to be replaced by increasingly professional attitudes in commercial flying. The consequence of such developments has led to flying being one of the safest means of transport. The guarantee of passenger safety even applies in far flung parts of the world. So, what makes commercial aviation so safe? What does the industry do? This paper will describe briefly how the performance is achieved, but will also consider a different industry, oil and gas exploration and production, which is less public but achieves, in many ways, an even better performance.

THE OIL AND GAS INDUSTRY

The oil and gas industry impacts less obviously on the public, except when supplies are threatened or the price rises. Hydrocarbons remain, nevertheless, extremely dangerous and the activities required to provide them to the customer are also hazardous. The ravages caused by an explosion at a refinery or a chemical plant can bring home how dangerous the industry can be. The Piper Alpha disaster in 1988, when 167 people died, highlighted the dangers to offshore workers.⁸ The hazards of the industry are, however, far more extensive. Operations are found in environments ranging from arctic to high temperature desert conditions, with heavy machinery, involving high temperatures and pressures. These are often performed by untrained or inexperienced local workforces because of the necessity to respect political and legal requirements for local involvement.

In the early years of the industry, accidents, frequently fatal, were regarded as part of the business. There has been a considerable change, brought about partly but by no means exclusively because of the Piper Alpha disaster, so that since the early1990s the industry has become exemplary in its performance.⁹ Societal pressure has required the attention to safety to be extended to environmental and occupational health issues with, more recently, an integration of effort and experience into sustainable development. The levels of safety performance that are currently achieved by many companies, and are required of their contractors, mean that aviation operations are regarded in the oil and gas industry as a major hazard in need of careful management. This evaluation comes as a surprise to those inside aviation who feel they know how safe they are.

ATTITUDES AND ORGANISATIONAL FACTORS CREATING SAFETY

How have these two industries achieved their current levels of performance? The answer appears to lie in the acquisition of good attitudes to safety issues and the application of systematic management of the hazards of the business.

Safety management systems

The processes and beliefs that are required to be proactive about safety are formed by the presence of a systematic understanding of what the enterprise is doing. In the oil and gas industry this step change from a reactive culture was set in train by the legal requirement, following the Piper Alpha disaster, to develop safety cases demonstrating the existence of an active safety management system.⁸ Such mandatory requirements started in the United Kingdom, where the disaster had taken place, but were soon taken up in the regulatory regimes of other countries such as The Netherlands, Malaysia, and Australia, all major producing countries.⁹

Safety management systems (SMSs) are simply the systematic application of management processes to the problem of hazards an organisation faces. One typical approach, used in the oil and gas industry,^9,10 involves the discovery and assessment of the hazards of particular operations, which may differ considerably from place to place, the specification of how those hazards are to be managed, and what is to be done if things, despite best endeavours, go wrong. There is a register of known hazards, as part of the SMS, and a clear understanding of the nature of defences applied to manage those hazards. Risk assessments are regarded as normal, but there is a feeling in many quarters that the numbers should not be taken too seriously as it is the structure and magnitude of the risks that is important. The system is documented, with specified accountabilities and required competence to perform duties critical to safety. Finally, there are a number of levels of audit and review required, given the assumption that, unlike quality management systems, safety will never actually achieve perfection and processes and knowledge can always be improved. The demonstration that there is a safety management system in place and that it is operational and effective is called a safety case.⁸

In commercial aviation full safety management systems are still sporadic. They will only become an International Civil Aviation Organisation (ICAO) standard during this decade, first for air traffic services (2003) and airports (2005) and, somewhat later, for airlines.¹¹ There is, nevertheless, a substantial body of knowledge and required processes embodied in the ICAO’s Standards and Recommended Practices (SARPs). These serve to support many of the requirements of an SMS but were not constructed with a management system, as such, in mind. As a result they are, literally, unsystematic and are not collected together with the requirement to demonstrate an assurance, as with a safety case. They have, nevertheless, served aviation well and form a repository of good practice and safe design.¹²

Aviation attitudes

Aviation has always been seen as dangerous and as a result commercial aviation has had very positive attitudes towards safety from the start. The barnstormers were always in a minority, they crashed and died, thereby hastening the process, so that the industry developed clear standards and rigorous requirements. Pilots and engineers have been licensed and are severely restricted in what they may do, airplanes undergo rigorous certification processes based upon standards often developed as a result of crashes, and these constraints are accepted without question by all involved. I have argued^12,13 that aviation is, despite its exemplary performance, essentially haphazard in its management of the risks of flying, relying more upon positive attitudes and less upon systematic approaches to the management of risks.

Oil and gas attitudes

The oil and gas industry, in contrast, has retained an image of the macho oilman, even to this day. The success of the industry in achieving high levels of safety performance has come more from the hard nosed application of safety management systems, driven by the commitment of senior managers and, where that is less obvious, by the threat of legal sanction. The evident dangers of the business, especially as seen from the level of senior management with a wider horizon, became compounded by the growing realisation that safety performance was a sensitive indicator of economic performance, so that cutting corners to make money was punished too often to make it a worthwhile strategy. The success of early implementations of safety management systems, and the discovery that they were not as difficult or expensive to develop as had been feared, led to major oil companies requiring safety management systems to be in operation even in countries where there is no legal requirement.¹⁰ The discovery was simply that it helps to understand what you are doing, and that understanding is what you have to develop when you create your safety management system.⁹

The limits of safety management

The two industries under discussion appear to have achieved their performance in quite different ways, suggesting that both routes may be feasible. Commercial aviation has achieved its current performance on the basis of positive attitudes towards safety, and is only now coming to the implementation of systematic approaches. Oil and gas exploration and production has achieved considerable progress on the basis of hard and systematic management, despite residual poor attitudes, and is slowly developing approaches to engender better attitudes. The question both industries are currently facing is: how do you go further when you have achieved so much?

The systematic application of safety management principles, culminating in the formal assurance that the goals can and are being achieved, can significantly help to achieve high levels of safety. However, such systems are, by their very nature, paper based and bureaucratic. They tend to set minimum common standards and can easily result in no more than the achievement of such standards, especially when there is competition for managerial attention and resources. A safety management system therefore defines sound systems, practices, and procedures, but is never enough if practised mechanically; an SMS requires an effective safety culture to flourish.^{9–10,13–15} Such a culture enables individuals to fill in the gaps and exercise initiative while retaining high levels of safety performance. A research and development programme, called the Hearts and Minds Programme, is currently under way to attack this particular problem.^14,15 The ultimate aim of that programme is to raise the maturity level of the safety culture in the oil and gas industry, and links are increasingly being made to aviation. But the problem has become—what is a safety culture?

SAFETY CULTURES IN HIGHLY HAZARDOUS INDUSTRIES

Both industries under consideration can be regarded as taking safety seriously and they can be described as having a culture of safety, whether internal or imposed. For a comparison with health care, it is worth examining what such a culture is and how it operates. The following list, first identified by Reason,¹⁶ has wariness added. Such an organisation should be:

• Informed: managers know what is going on in their organisation and the workforce are willing to report their own errors and near misses.

• Wary: the organisation and its constituent individuals are on the lookout for the unexpected, maintaining a high degree of vigilance.

• Just: the organisation is normally a “no blame” culture, although some actions are agreed by all to be totally unacceptable, deserving some retribution.

• Flexible: such organisations reflect changes in demand and adapt rapidly to changes in circumstances, providing both high tempo and routine modes of operation.

• Learning: organisations expect to have to change, are ready to learn and can do what needs to be done to improve.

There is a model of cultural maturity,^9,12 based originally on one developed by Westrum,^17,18 for the evolution of safety culture (fig 1). Westrum¹⁷ initially identified three stages, the pathological, the bureaucratic, and the generative. This development of the model distinguishes a slightly larger number of distinct steps on the ladder and re-labels the bureaucratic stage as the calculative, partly because it is easier for people to accept that they are being calculative than that they are being bureaucratic:

• Pathological: safety is a problem caused by workers. The main drivers are the business and a desire not to get caught by the regulator.

• Reactive: organisations start to take safety seriously but there is only action after incidents.

• Calculative: safety is driven by management systems, with much collection of data. Safety is still primarily driven by management and imposed rather than looked for by the workforce.

• Proactive: with improved performance, the unexpected is a challenge. Workforce involvement starts to move the initiative away from a purely top down approach.

• Generative: there is active participation at all levels. Safety is perceived to be an inherent part of the business. Organisations are characterised by chronic unease as a counter to complacency.

An advanced safety culture can be reduced to four dimensions:

• It is informed at all levels: informedness follows from seeking and providing information.

• It exhibits trust by all: trust is developed by being just and informed, when even bad news can be told and accepted as information to be acted upon rather than as a reason to punish.

• It is adaptable to change: adaptability follows from being flexible and learning from what goes well as well as what goes badly.

• It worries: success does not engender complacency. Being worried is a healthy state that follows from a combination of being informed and a belief that, even when things appear to be going well, life is not always fair, which provides the reason why the culture is wary.

From this analysis it is clear that being informed, knowing what is really going on, provides the primary and necessary step in development of a safety culture. Informedness feeds trust and provides the raw material for adaptability. Worry comes later, when complacency threatens, as chronic unease provides the necessary antidote to the greatest threat to advanced safety cultures, their own success that can cause them to take their eye off the ball.

WHAT DO SUCH CULTURES DO?

Advanced safety cultures in highly hazardous settings have found ways of operating that can serve as lessons for others who might wish to emulate them. The original Berkeley studies into the “high reliability organisation”,¹⁹ a notion very similar to the generative culture, were carried out on non-profit organisations such as the United State’s Navy’s aircraft carrier operations and San Francisco air traffic control, or an exceptional organisation such as a nuclear power plant.^20,21 It is still a question how much the profit and non-profit advanced cultures have in common.²² Organisations described here have to make a profit to survive, they have to acquire and use the information available to them, they have to implement their management systems, and they have to cope with their inherent problems.

Handling commercial pressure

The commercial aviation industry and the oil and gas industries both operate under considerable commercial pressure. There is always a conflict between production and safety and it is a mark of the advanced culture that this conflict is at least contained and at best resolved. Pathological and reactive cultures are open to arguments about the financial benefits of safety, if there is any incentive for an organisation to improve and move up the ladder. Interestingly, personal experience with proactive organisations finds them uninterested in such arguments; they represent a battle already won and they are now convinced by other arguments. Commercial organisations that take safety and, more widely, sustainable development generally seriously perform better economically than their peers. The implication is that both profit sector and non-profit organisations, once they become advanced, have a common view of what is important and which processes are necessary. The belief is that such organisations operate more effectively and improved performance, both in the areas of safety and production, follows naturally.

Informedness

The information needed to create trust and be flexible can be won in a number of ways. Organisations can rely upon investigating and analysing their accidents, by performing audits and by reporting about what happens, which usually means what goes wrong, their near misses. Westrum¹⁷ identified how cultures differ in their response to messengers bearing bad news. In pathological cultures messengers are shot, being blamed for the bad news they bring. In bureaucratic cultures they are tolerated, while in generative cultures messengers, even of bad news, are encouraged because they bring necessary information. More advanced cultures seek out information and, increasingly, are beginning to look at what helps in ensuring that incidents do not turn into worse accidents. Aviation does this well, the oil and gas industry is only now beginning to develop reporting systems for effective near misses, unsafe acts, and unsafe conditions. One approach developed in aviation, the line safety audit,^23,24 is aimed at developing a better understanding of normal operations, with its associated non-consequential errors and violations.

Accident investigation and analysis

Both industries have a tradition of taking their accidents seriously, especially when they involve fatalities. All aviation accidents are investigated and reported publicly. Annex 13 of the ICAO convention²⁵ defines how accidents are to be investigated and is quite specific about how such investigations should be performed in a blame free manner. In the oil and gas industry, investigation techniques have been developed to direct attention away from the “sharp end” and towards underlying causes and senior management.^26,27 The swiss cheese model^28,29 was originally developed as part of a research programme in a major oil company, where it is routinely used for all major incidents and has become the industry standard. The model was rapidly taken up by the world’s aviation industry.²⁵ The Australian Bureau of Air Safety Investigation (BASI) was the first to use Reason’s model for all its major reports, directing attention to organisational factors underlying aviation accidents.^30,31 BASI instigated simple systems for reporting minor incidents in general aviation in order to collect useable information aggregated over larger numbers of minor incidents. The marked safety record of Australasia can be related to the attitudes that also supported BASI’s introduction of potentially embarrassing analysis techniques.^30–32

In the oil and gas industry, accidents, even fatalities, were once dealt with at a local level. Supervisors or the victims themselves were blamed and contractors, who classically ran the greatest risks, were not even counted. Companies now insist on analyses that uncover the underlying factors and managerial failings that led to accidents and then often require chief executive officers to fly, possibly round the world, to head office to be called to account, even for the deaths of those in contracting and sub-contracting companies. Management teams of companies now receive reports of all major and many minor incidents, with predetermined timescales within which reports have to be made. Incidents are rated in terms of their potential damage, which means that apparently trivial incidents may trigger a significant response. Such continued pressure and commitment ensures that safety remains high on the list of priorities and is slowly changing attitudes from the top down.

Incident reporting in aviation

The quality of incident reporting in aviation is exemplary. There are mandatory reporting requirements for many occurrences. Air safety reports (ASRs) have to be submitted to the national aviation regulator, such as the United Kingdom Civil Aviation Authority, by the airline. There are also many events that are not regarded as serious enough to warrant an air safety report but are nevertheless reported to the airline by flight crew and other staff.³³ Much of what is reported is of a simple technical nature, posing no personal problems for the reporters, but the reports may include problems caused by others, such as separation failures, ground handling problems, and unacceptable behaviour of passengers. British Airways operates BASIS, the British Airways Safety Information System, that is also used by many other airlines worldwide, to collect all these reports and allow them to be analysed statistically.

There are, however, situations where the reporter might well attract opprobrium or place a colleague in difficulties by reporting. Under such conditions, usually because someone has performed poorly, there has always been a temptation to bury the information if at all possible. Systems such as the Confidential Human Factors Information Reporting Process (CHIRP) allow for confidential reporting in such a way that the story can be followed up and the lessons learned without revealing the identity of those involved.³³ Such systems are agreed by both airlines and unions to have no repercussions for reporters, while important information can be made available. Aviation has learned that anonymous, as opposed to confidential, reporting is of little value, any incident reported invariably requires a degree of specialised follow up.

Monitoring systems on board modern aircraft can provide detailed information about what happens, such as exceeding rates of descent or being at the wrong altitude, which means that it is becoming harder to escape scrutiny if the information available is used in that way. Aviation had already achieved a sufficiently well developed reporting culture before aircraft monitoring systems were capable of revealing what had happened.

Considerable efforts have been made to remove the concept of blame from both the aviation and the oil and gas industries.^14–15,28 Both industries were prone to blame those at the sharp end, so that pilot error was the traditional end of an accident analysis, while victims were most frequently blamed for their own demises in the macho, and frankly pathological, early days of the oil and gas industry.

Management systems

As described above, the Piper Alpha disaster created the legal requirement for SMS, and the associated assurance, in the safety case, that such systems were operating effectively. In the oil and gas industry SMS was mandatory in a number of countries, but early experience showed the value of such systems, so most companies quickly required their operations to have an SMS even where there was no such requirement. Shell Group’s experience with setting up systems for new operations has led them to use the SMSs as a way of defining more general management systems because they are so useful as well as effective. Experience in the implementation of such systems soon showed that they were an efficient way of understanding how an operation was best carried out.

Now that the International Civil Aviation Organisation has made SMSs a requirement for aerodromes to be in place by 2005,¹¹ while it is already a standard for air traffic services, commercial aviation is catching up rapidly with the oil and gas industry.

Organisational culture

The flight deck is a location staffed by professionals where there is usually a significant difference between the captain and the first officer. The difference in status between individuals in the cockpit is called the cockpit gradient. Aviation learned the hard way that this gradient has to be managed if it is not to be a source of problems. A number of major accidents, such as the Royal Dutch Airlines (KLM) disaster at Tenerife, had such cultural problems as a major cause of the accident. Today, crew resource management^34,35 is a method taught to all flight deck personnel, and increasingly to cabin and maintenance staff as well, enabling them to overcome personal differences and operate effectively as a team, even when a crew might not fly together more than twice a year.

One of the distinguishing characteristics of advanced cultures is the reaction when things do go wrong. Less advanced cultures, the pathological and reactive, emphasise the fault of those immediately involved. This results in denial of organisational involvement in causing incidents, and calls to remove the rotten apples without the critical self examination that leads to the realisation that the problem may well lie with the barrel, not the apples.

SAFETY CULTURE IN HEALTH CARE

So, where does health care fit in this picture? Health care has always taken medical dangers seriously, so the culture cannot be pathological. The lack of systematic risk management suggests that the culture is, at best, reactive, even though there may be the occasional proactive area. The medical culture responds to high profile events (for example, the Bristol³⁶ and Winnipeg inquiries³⁷) with repair measures but is often uninterested in systematic improvements. The difficulty in getting evidence-based healthcare to be accepted argues against the culture being calculative. In many cases medical professionals appear to have difficulty in following protocols, arguing that written protocols, called procedures elsewhere, restrict individual initiative and clinical judgement. Calculative cultures embrace procedures, while proactive ones develop ways of encouraging initiative within well controlled systems of procedures.⁹ As the aviation and oil and gas industries are both borderline calculative–proactive, this places health care some way behind in its cultural maturity.

Health care has always been concerned with managing dangers and hazards, but these are inflicted on others. Unlike pilots, surgeons, physicians, pharmacists, and nurses rarely suffer the fate of their patients. The history of the SARS outbreak is particularly indicative. Medicine, as a discipline, is certainly aware of the hazards for others, but not for its own practitioners, so when it was the medical staff who died first, we can understand the shock effect. This was akin to the captain of the aircraft and the front line supervisor who deny that they have a problem involving them personally, no matter how much they know about the dangers for others.

Reporting

Health care does not report well. That is to say, the reporting of scientific facts, primarily biological ones, is well established and admirable standards for winnowing fact from opinion have been developed over the years, but reporting about individuals and systemic failings has been desultory at best. Messengers have been shot and the “facts” being reported have not been regarded as scientific and, therefore, worthy of regard, let alone analysis and action. This situation is akin to the technical industries that have never experienced problems in reporting technical problems, but took some time to realise that reporting problems associated with people, especially themselves, is equally important, if often personally embarrassing.

Investigation

Incident investigation in health care is, in my experience, amateur. There are no established methodologies, blame still dominates, and it is only in the event of major and multiple incidents^36,37 that any analysis with systemic consequences is drawn. Although the organisational accident model^28,29 is being used in places,^1,2,4,36 this is yet to become a standard in the way it is in the other industries discussed here.

Attitudes

Health care, at least in Europe with a few trivial exceptions, is not a commercial profit based endeavour, so there is no need to have the pressures under which the two industries discussed here operate. Yet the medical community, and indeed the public at large, appears to accept a fatal accident rate estimated at three times that of road accidents and a significant multiple of the rates in aviation and the oil and gas industries.

Medical attitudes are often entrenched in the individual blame culture, characteristic of the pathological and reactive cultures.^9,17,18 Given the importance of general attitudes in the aviation industry, and the attitudes of senior management in the oil and gas industry, this suggests one place where health care needs to examine its organisational culture very closely if improvement is to be achieved. The interpersonal culture of a traditionally hierarchical profession such as the medical profession will also need to move closer to those accepted in aviation.³⁸

Safety management systems

The systematic approach to safety in health care appears to be extremely unbalanced. There is a large body of knowledge about the individual risks of medicines and surgical procedures or about the relative effects of certain patient parameters on survival or quality of life. What appears to be missing is any systematic knowledge about the operation of the system as a whole.^39,40 Therefore, patients are actually at far higher risk from non-medical factors than they believe.

CONCLUSION

Two highly hazardous industries, commercial aviation and the oil and gas industry, have both achieved remarkable levels of safety performance. They have taken slightly different routes that appear to be converging as continuous improvement is sought. Aviation has started from being reactive and has progressed on the basis of good underlying attitudes; the oil and gas industry has improved by becoming systematic and calculative. Both are converging, improving their weaknesses, as they strive to become truly proactive. Health care is, in the light of such experience, still at an early stage of development. Either, or both, routes could be followed to the creation of an advanced safety culture and the associated high performance. In one case, it may be necessary to force the implementation of safety management systems, as occurred after the Piper Alpha disaster and is currently being required by the ICAO. The alternative, attitudinal, approach will require a major change in the way members of the medical profession view their work and each other, regarding it more as a highly hazardous enterprise for patients, paralleling aviation’s attitude to the safety of its passengers. Both approaches have been shown to succeed in hazardous industries; whether health care takes one or both will depend upon the level of disruption such a leap forward may engender and the willingness of the profession to accept the effort and move forward.