Module 4
Antecedents
a. Visual Information
Operators acquire and use system-related information to understand the current
and near-term system states and the associated operating environment. Operators can
obtain this information through any sensory modality. Although most systems present
system information visually and aurally, some use tactile cues as well, such as the stick
shaker in high performance aircraft that signals an impending aerodynamic stall.
Presenting information through different sensory modalities has unique advantages and
disadvantages in terms of their effects on operator performance.
Visual displays enable information with a high degree of precision to be
presented. As a result, most system information is presented visually. But visually
presented information must be displayed properly for operators to efficiently obtain
critical information, and operators must be looking at the displays in order to access the
information. Visual displays differ in the ease with which operators obtain and interpret
system-related information, depending on different facets of their presentations. These
features affect the quality of operator interpretation of visual information, number of
displays, organization and layout, conspicuity, interpretability, and trend portrayal.
Visual information is presented primarily through either analog or digital
displays. Analog displays are found in older systems, and generally show a one-to-one
relationship between a component or subsystem and the corresponding display of
information. Systems with numerous components and subsystems may have hundreds of
analog displays, each providing critical information about one component or subsystem.
The operator would have to search the displays to identify and locate the needed
information before even trying to comprehend the cause of the occurrence. During high
workload periods, such as during anomalous operating conditions, numerous displays
could interfere with an operator’s ability to quickly locate and understand the critical data
in the available time.
Display organization can influence an operator’s ability to access needed system
data, especially in a system with numerous displays. Display groupings that do not
conform to the logic that operators use to understand the system state can prolong the
time they need to find and understand the needed data. The more readily the display
organization allows operators access, the fewer the opportunities for operator error.
Rasmussen and Vicente (1989) propose organizing information according to what
they term “ecological interface design,” by matching the organization of the displays to
the operator’s mental model of the system state. This will support an operator’s cognitive
activities during interactions with the systems, and hopefully reduce opportunities for
error. Poorly organized displays, “cluttered” displays, or displays that do not separate
critical information from noncritical information will adversely affect operator
performance. Wickens and Carswell (1995) refer to these adverse effects as the
“information access cost” of display organization. The greater the cost, the more
cognitive effort operators exert and the more time they will need to access and interpret
critical information.
The greater the contrast between a display feature and that of other displays, the
more conspicuous the displayed data will be and hence, the lower the operator’s
information access cost. Conspicuity is influenced by display size, contrast, and
luminance relative to adjacent displays. The larger a display, and the relatively brighter it
is compared to others and its surroundings, the greater it will stand out against the
prevailing background, and the more likely the operator will notice.
The more interpretable the data, the more readily operators can use the
information to understand the system state. Consider a gauge that displays an
automobile’s coolant temperature. By itself, the temperature has little meaning to those
who are unaware of the engine’s optimum temperature range in “normal” operating
conditions. But a gauge that displays a picture of an engine as a face that smiles, with the
smile changing to a frown and the face color becoming a deeper red as the temperature
increases would be considerably more interpretable to drivers who may otherwise not
understand the relevance of the temperature to the engine status.
Designers have used different methods to increase operators’ ability to understand
visually presented data. Abbott (2000) describes a method of presenting aircraft engine
information that is considerably more interpretable than current displays of the same
information, because the presentation more closely matches the needs of the operator.
Aircraft engine-related data displays, and their effects on operator performance.
Color can also readily convey information. Parsons, Seminara, and Wogalter
(1999) found that in numerous countries and cultures, the color red indicates hazardous
conditions. Similarly, green and yellow or amber signify normal and cautionary operating
conditions, respectively. Designers have often placed colors behind a pointer or gauge on
analog displays so that operators can quickly recognize the value of the component
parameter as the pointer approaches the color. Automobile drivers use tachometer colors
to determine when an engine “red lines” or approaches its maximum safe operating range
to obtain maximum engine performance when changing gears.
Digital displays allow substantial flexibility in presenting data. They can be
designed to present pictures, smiles, or frowns, for example, to convey information.
Some systems use flow diagrams to display the state of electrical, pneumatic, and other
subsystems, enabling operators to quickly identify a flow anomaly and recognize its
impact on the system as a whole.
Although digital displays offer flexibility in presenting information, the
relationship of display flexibility to operator performance has not been demonstrated
consistently. Miller and Penningroth (1997) conclude that digital displays may not
necessarily result in superior operator performance relative to analog displays. By
contrast, Abbott (2000) believes that properly designed digital displays can enhance
operators’ ability to interpret data.
Because of the dynamism of many complex systems, operators need to quickly
detect and interpret the direction and rate in which component parameters change, in
order to understand their effects on system state. Nonetheless, understanding the state of
the system at any one given moment, depending on the system, may not be as critical as
recognizing how quickly a system state is changing and the direction of its change.
Analog displays have traditionally presented direction information by the clockwise or
counterclockwise movement of an indicator or pointer, and rate of change by the rapidity
of that movement. These features are often seen in airplane disaster movies, for example,
in which the rapidly unwinding altimeter—the instrument that depicts an aircraft’s
altitude—conveys the seriousness of the situation. Some analog displays use vertical or
horizontal “tapes” or lines to convey trend information. The lines move up or down or
left or right to convey the direction and rapidity of system changes.
Digital displays do not necessarily present trend information better than do analog
displays. A digital format that presents system parameters in Arabic numerals gives the
operator precise parameter information. However, in the event of a rapid change, the
numerals corresponding to the parameter would also change rapidly, and operators may
not be able to quickly interpret the direction of change, that is, whether the parameters are
increasing or decreasing. Yet, properly designed digital displays can present trend
information in at least a comparable, if not superior way, to analog displays. These
generally depict the nature and rate of the change pictorially to minimize operators’ time
spent interpreting trend data, as in the illustration of the face to portray engine coolant
temperature.
b. Aural Information
Visually presented information has one major drawback; operators must look at
the information to receive it. If they are looking at displays of noncritical information, or
engaged in other tasks and focusing elsewhere, they will not receive the information.
Designers compensate for this shortcoming by adding aurally presented information to
the presented information.
Because of the salience of aurally presented information—even inattentive
operators receive the information—designers have usually relied on aurally presented
information to rapidly communicate critical information to operators (e.g., Patterson,
1990; Edworth, Loxley, and Dennis, 1991). However, aurally presented information also
has limitations in that the conveyed information is less precise than visually presented
information, and it can quickly distract operators and hinder their performance (e.g.,
Banbury, Macken, Tremblay, and Jones, 2001).
To perceive aurally presented information operators must distinguish the critical
sound from other sounds. Designers generally use of one of two methods to increase the
conspicuity of critical sounds relative to those of other sounds, increasing volume or
varying such sound elements as pitch, frequency, and rhythm. Patterson (1990) suggests
increasing the volume of critical sounds by at least 15 dB over the volume of background
noises to make them clearly audible. In environments in which the ambient sounds are
fairly loud, this could make the aurally presented information quite loud, even
approaching dangerous levels over extended periods.
Once aural information has been presented, continuing to present the sounds adds
little additional information, and can distract operators and degrade their performance.
The longer aural information continues to be presented and the more conspicuous the
sound, the more likely the information will interfere with and degrade operator
performance. On the other hand, Banbury et@al. (2001) point out that after about 20
minutes of exposure the distracting effects of sounds are reduced. Unfortunately,
exposure to interfering sounds for as long as 20 minutes can substantially degrade
operators’ ability to respond effectively in that interval.
Aurally presented information should cease to be presented after operators have
received and understood it. However, many systems cannot recognize when this has been
accomplished. Too often, aural information first informs and then distracts operators.
Aural information can also distract and interfere with the work of operators who were not
targets of the initial information, especially in small operating environments such as
locomotive cabs, ship bridges, or aircraft cockpits. Allowing operators to silence alerts
might negate these disadvantages. However, as will be discussed shortly, systems that
allow operators to silence alerts have other disadvantages.
Aurally presented information that is inaccurate or inconsistently useful will lose
its value overtime, eventually failing to elicit operator attention. Yet, designers generally
consider the consequences of missed alerts, where aural information is presented but
operators do not respond, to be more critical to system safety than those of false alarms,
where alerts are sounded but a response is unnecessary. As a result, designers tend to
favor providing more rather than fewer alarms in a system to ensure that operators are
informed of potentially important systems-related information.
Further, designers set the threshold in these systems sufficiently low to ensure that
critical events will elicit alerts, even if this results in noncritical events eliciting alerts as
well. Unfortunately, doing so with sufficient frequency can expose operators to repeated
false alarms, which has been found to reduce operator sensitivity to the alerts, and as
Sorkin (1988) found, on occasion can even lead to outright operator silencing them
altogether.
In a January 1987 rail accident near Baltimore, Maryland, the locomotive
engineer and brakeman, who were operating two freight locomotives, silenced an alarm
they had considered distracting, a shrill whistle that sounded when the head locomotive
passed a stop signal (National Transportation Safety Board, 1988). Neither operator
noticed or responded to the stop signal, nor did the train consequently enter a track
section that was reserved for an approaching, high-speed, passenger train. The passenger
train then struck the freight locomotives, killing its engineer and 16 passengers.
Investigators concluded that the aural alert would have informed the freight locomotive
engineer and brakeman of their impending entry onto a prohibited track section.
Investigators also found that the two operators had smoked marijuana before the accident
and were impaired at the time.
Designers create distinct sounds that are associated with different system
elements, system states, or desired operator responses. Uniqueness characterizes the
degree to which a sound is associated with specific system-related information. Operators
learn to associate certain sounds with their corresponding system states so that when the
sounds are heard the operators can quickly recognize their meaning, and will be unlikely
to confuse the sounds with others. For example, emergency vehicles use distinctive sirens
to alert drivers in order to increase the likelihood that drivers will quickly recognize and
respond to them.
Aurally presented information can take a variety of forms. “Traditional” sounds
such as bells, whistles, horns, and sirens are found on older equipment. Each sound can
be readily distinguished from others and, if loud enough, could be heard over ambient
sounds. As with visually presented information, modern digital equipment usually offers
more flexibility in presenting aural information than does older equipment. Synthesized
or recorded human voices that articulate simple voice messages can be used, in addition
to traditional sounds (Stern, Mullennix, Dyson, and Wilson, 1999). Belz, Robinson, and
Casali (1999) proposed using auditory icons, such as screeching tires, sounds that can be
distinctly associated with particular system states, to enhance operator recognition and
response to the sounds.
Today, digital capabilities have expanded to the point that many automobiles are
equipped with navigation capabilities that can guide drivers to their destinations, taking
traffic flow into account as well as proximity to other vehicles, whether they are in front,
behind, and alongside. Drivers, if using vehicles not so equipped, can use their
smartphones to provide navigation and other capabilities, with the ability as well to select
from a number of voices, male and female, for example, with different accents or
different languages to direct them, so that the simple instructions, for example, “turn left
in 70 meters,” can be quickly understood.
A single event can precipitate multiple system warnings or alerts, each reflecting
the state of a single system parameter rather than the event that led to the parameter state.
In some systems, certain phenomena can elicit so many sounds and alarms from the
effects of an event, rather than the precipitating event itself, that a cacophony of sounds is
produced. When this occurs, the operator’s ability to effectively evaluate the individual
alerts in order to understand the phenomenon that led to the alerts, rather than the effects
of the phenomenon on the system, is made considerably more difficult.
Some systems inhibit both visual and aural alerts, without operator action, during
critical operating cycles. This reduces the likelihood that noncritical alerts would distract
operators during critical tasks, as occurred in the crash of a Boeing 757 off the coast of
Lima, Peru, in October 1996. Investigators found that pitot-static tubes, critical
components that are necessary to measure airspeed, climb and descent speeds, and
altitude, were blocked by a maintenance error, which led to the speed and altitude
displays presenting erroneous information to the pilots (Accident Investigation
Commission, 1996). After takeoff, numerous airspeed and altitude warnings and alerts,
including low terrain, low airspeed, impending stall (the “stick shaker”), and wind shear,
sounded. The alerts began within 5 seconds of each other and continued until impact.
Each signaled a specific hazardous situation, but there was no alert that corresponded to
the failure that had caused the multiple alerts—the blocked, and hence inoperative pitot-
static system. The pilots were unable to determine the cause of the alerts. More
important, operating at night and over water they could not visually estimate the
airplane’s airspeed and altitude. The alerts distracted the pilots, hindered their
communications, and interfered with their ability to effectively diagnose the anomaly.
Some years later, an accident occurred that shared many of the characteristics of
the 1996 Boeing 757 accident, an Airbus A-330 crashed into the Atlantic after the pitot
tubes became blocked. Investigators attributed the blocked pitot-static tubes to ice
crystals that formed after the airplane entered an area of adverse weather while the flight
was at cruise altitude (Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation
civile, 2012). The initial aural alert that the crew received pertained to the autopilot’s
disengagement, not to the blocked pitot tubes. This alert, which serves to inform the crew
that manual airplane control is needed, is critical to ensure that pilots recognize that the
autopilot is no longer operating, valuable information to help pilots recognize that they
must address the alert and manually control the airplane. However, the underlying cause
of the disengagement, the rapid alteration in measured airplane speed caused by the pitot-
tube blockage, was not presented.
The pilots’ failure to recognize that the airspeed they were perceiving was
inaccurate led to their failure to recognize the cause of the problem that they encountered
and their subsequent mismanaging of airplane control. The airplane stalled and crashed
into the ocean 4 minutes and 23 seconds later, killing all 228 passengers and crew
onboard.
Some have proposed presenting information through sensory modalities other
than visual and aural ones to compensate for the limitations of presenting information in
these modalities (e.g., Sklar and Sarter, 1999; Sarter, 2000). Transport airplane designers
use both kinesthetic and aural cues to simultaneously alert pilots to a critical event, an
aerodynamic stall. A stall requires immediate pilot action or the airplane may crash. Just
before reaching the airspeed that would precede an aerodynamic stall, pilots hear a
particular alert and feel a distinctive control column motion, sensations that are very
difficult to ignore. However, as with aurally presented information, constant presentation
of kinesthetically or tactually presented information can distract operators and degrade
their performance.
c. Controls
Operators use controls to modify system state and system operation. Control
design characteristics can influence operator performance and the likelihood of error, as
can displays. Controls can take many shapes and forms, move in a number of directions,
and be placed in a variety of locations. Automobiles, for example, employ at least three
primary controls to enable drivers to direct their vehicles. The accelerator controls
forward motion, the brake pedal slows or stops the vehicle, and the steering wheel
controls lateral motion. Vehicles equipped with standard transmissions have two
additional controls, a clutch and gearshift lever, for changing transmission gears as
vehicle speed and engine rotation rates change. Other controls enable drivers to maintain
selected speeds, and control windshield wiper speed and headlight brightness, sound the
horn, and engage turn signals, for example. Further controls allow passengers and drivers
to change window height, audio and video system characteristics, and vehicle interior
temperature or ventilation levels.
Accessibility, the ease with which operators can reach and manipulate desired
controls, can influence the quality of operator performance. In systems with relatively
unlimited space, in which time to manipulate controls is not critical, accessibility will not
substantially influence operator performance. However, in systems with space
limitations, designers need to shape and locate controls so that operators can readily
access them, irrespective of the operators’ physical characteristics such as arm length.
Well-designed systems have controls that operators can reach and manipulate without
moving far from their stations. Inaccessible, hidden, or obscured controls can delay
operator response when time is critical and thus serve as antecedents to error. Large
church or concert organs illustrate well-designed controls. Organists adjust their access to
the controls by moving their seats, and use both their hands and feet to operate the
controls, the keys, and the pedals.
The direction in which a control moves should intuitively correspond to the
direction of change in the corresponding component. Raising a control should increase an
aspect of the system such as production rate, component height, or illumination level,
while lowering a control should reduce it. Depressing a button should engage a
component function while releasing the depressed button should disengage it. Controls
that move in directions that are counterintuitive can become antecedents to error if
operators actuate the control incorrectly after using similar controls that move in a
“standard” direction.
Systems with limited available space, as well as advanced electronic controls,
often employ multifunction controls in which one device controls multiple system
functions. Operators who are unfamiliar with or do not perceive the distinction among the
various control functions may initiate a control action and an unanticipated system
response, what has become known as a mode error (Norman, 1988).
Multifunction controls can be designed to reduce opportunities for mode errors by
giving operators unambiguous information or feedback regarding the system’s operating
mode. The quality of the feedback is affected by the same visual, aural, and kinesthetic
factors discussed previously. Visually presented feedback should be sufficiently
conspicuous to enable operators to receive the information. Aurally presented
information is likely to be the least confusing, but operators will tend to ignore aural
information if presented repeatedly.
Investigators concluded that the pilots of an Airbus A-320 that crashed short of
the runway at Mont St. Odile, France, in 1992, committed a mode error while preparing
to land (Commission of Investigation, 1993). A single control, a knob that turned
clockwise or counterclockwise to increase or decrease the rate of change in the desired
mode, also controlled both the airplane’s descent rate and its flight path angle. Pilots
selected the mode by either depressing or pulling the knob and then turning it to establish
the desired descent rate or descent angle. Incorrectly controlling the knob engaged the
mode other than the one intended.
Investigators concluded that the pilots had inadvertently selected the wrong mode,
and established a descent rate that was triple the typical rate, believing that they had
commanded a moderate descent angle. Because of the dual purpose of the control knob,
and ambiguity in the information presented regarding the descent rate that they had
engaged, the pilots were not aware of their error and then failed to notice the rapid
descent to the ground.
Controls can take a number of forms, designs, and shapes, such as knobs, buttons,
wheels, switches, levers, or pedals. Designers may shape a control to resemble a
distinctive task or function. In some systems, regulators have mandated specific design
characteristics. For example, the lever that extends or retracts airplane landing gear is
required to be circular to reduce the possibility of confusion with an adjacent control. By
shaping the lever to correspond to the shape of the controlled component, the aircraft
wheels, pilots can recognize the control by touch alone, minimizing the possibility of
control confusion.
Control shape can play an important role in operator performance. In high
workload or stressful situations, operators may not have the time to visually identify a
control before manipulating it. Rather, they may locate and select controls by touch
alone, without visual verification. In these circumstances, operators may find similarly
shaped controls to be undistinguishable, and select the wrong control.
Controls that actuate different subsystems or have different functions (e.g., go fast
and go slow), should not be placed near each other, and if so, should be shaped
differently so that in the event that operators must engage them quickly, they can identify
them without having to visually verify that they have actuated the desired control to
initiate the control operation desired. The effects of placing identically designed controls,
with differing actuation results, adjacent to each other can be seen in the investigation of
a marine accident (National Transportation Safety Board, 2011).
In this accident, which was caused by a marine pilot’s late recognition of the need
for a turn (influenced by his fatigue), the vessel he was piloting first collided into a vessel
traveling in the opposite direction as his vessel, and then collided with a second, docked
vessel. Just before the accident, the captain, seeing the impending collision, attempted to
rapidly slow the vessel by actuating a control, a button that caused the engine to quickly
slow. However, the button actuating that control was located adjacent to an identical
button that caused the engine to do the opposite of what the captain intended, speed up
rapidly, the button that the captain actually depressed. Although investigators determined
that at the time the captain actuated the control the accident could not be avoided,
investigators faulted a design that was counter to the standards of good design.
Operators have come to expect a certain configuration, shape, and direction of
movement in the controls that they manipulate. Unfortunately, unless regulators establish
rules governing the design of both displays and controls, designers may create designs
that suit their own rather than the operators’ needs. This can lead to differences in the
shape of similar controls on comparable equipment. Those who have driven cars at night
that are different from their own, and had difficulty locating and engaging the windshield
wipers or headlights because the controls were located in unexpected places, have
witnessed the errors these control differences can create.
So long as operators interact with only one type of equipment, nonstandard
control shapes, locations, and directions of movement will not create antecedents to
errors. However, operators interacting with comparable equipment that have different
controls and displays could, out of habit, move a control incorrectly or direct the wrong
control when alternating between equipment types. If operators repeatedly reach one
location to access a control, or move it in a certain direction to accomplish an action, they
will likely continue these movements on different equipment, even if the movements
produce unintended consequences.
Some years ago, the National Transportation Safety Board found that the rate at
which pilots failed to extend the landing gear before landing was higher among pilots of
aircraft that had been designed and built by one manufacturer than with pilots of
comparable aircraft of other manufacturers (National Transportation Safety Board, 1980).
The NTSB attributed this difference to the location of the landing gear and flap controls.
Controls in the cockpits of the airplanes with the higher gear up accident rates were
located in different locations than were controls on most other aircraft. Investigators
concluded that pilots who had operated other aircraft would inadvertently reach for and
select the “wrong” controls occasionally, actions that would have been appropriate on
those aircraft.
Unfortunately, there is no short-term solution for a lack of standardized controls
and displays. Designers could reduce the role of this antecedent to error by adhering to a
common control and display design standard. However, a transition period would be
needed to implement a standard to prevent operators from being confused by what may
be a new design. Equipment already in service will likely continue to remain in service
until it is no longer economically feasible to do so. In order to standardize comparable
controls and displays, the time needed to introduce new or redesigned equipment into
complex systems and to train operators to use the new designs may be considerable.
Unless regulators require standardizing the controls and displays in the systems they
oversee, standardization will be unlikely.
In older systems, operators often needed to exert considerable physical force to
manipulate controls. Today, however, systems use keyboard controls, either with the
familiar QWERTY format derived from the typewriter keyboard, a variant, or graphic
interfaces on screens to actuate system controls. Operators using keyboard controls are
physically able to control the system without error, so long as they don’t inadvertently
strike the wrong key. Without effective feedback from the system, operators may
incorrectly believe that they have actuated the correct keyboard controls even if they have
not. Highly automated systems largely rely on keyboards with well separated keys that
minimize slips when operators manipulate them by touch alone, and place the keyboards
in a location that minimizes fatigue over extended use.
In addition, in contemporary systems graphic user interfaces and touch screens
have increasingly been implemented as system controls. These are less likely to lead to
inadvertent operator errors than are keyboards, as operators must visually determine the
selections they make through a display on the screen.
d. Physiological Factors
Operator-related antecedents can be categorized into one of two general classes:
physiological or behavioral. Each includes antecedents with which most of us are
familiar, having likely observed their effects in our own experiences, and each can affect
operator performance over both the short and long term. Physiological antecedents can
temporarily or permanently degrade operator performance by impairing the operator or
otherwise degrading his performance. The number of potential physiological antecedents
that can influence operator error is sizeable, and numerous medical and physiological
texts, journals, and articles have examined them. The major ways that physiological
antecedents can degrade operator performance and lead to error will be reviewed, and
data needed to determine if a relationship between the two exists suggested, but a full
discussion of these antecedents is beyond the scope of this text.
Because operators must interpret data, recognize situations, anticipate system
performance, and make decisions to effectively oversee system operations, any condition
that degrades their cognitive skills could serve as an antecedent to error. Physiological
antecedents can increase reaction times, interfere with cognition, and limit recall ability,
among other impairing effects.
An operator is impaired when the quality of his or her performance has been
degraded to a level below that needed to function effectively and safely. Operators are
expected to notify their superiors when they are unfit for duty so that others can be found
to serve in their place. However, many do not recognize the subtle effects of degrading
factors on their performance and will report to work when they are ill or otherwise unfit
for duty. They remove themselves from system operations only when their illness or
discomfort is self-evidently impairing, without realizing the adverse effects of subtle
impairment from the illness on their performance and on safety.
Researchers have found that even mild illness and discomfort, well below what
many consider impairing, may still degrade performance and create antecedents to error.
Smith (1990) examined the effects of two fairly minor illnesses, colds and influenza, on
performance, ailments that account for what he termed a substantial proportion of all
consultations in general medical practice. He measured cognitive skills and reaction times
of volunteers who had been infected with a cold or influenza virus, and compared them
with those who had been given a placebo. Those who were infected demonstrated
significantly poorer cognitive performance and reaction times than those who were not
infected, and many of those demonstrating degraded performance were in the incubation
periods of their illnesses and thus, asymptomatic.
The potential effects of both prescribed and over-the-counter medications on
operators vary according to the potency of the drug, the amount taken, the time since
taking the drug, the rate at which the drug is metabolized, the presence of other drugs in
the operators’ systems, and individual variation in response to the drugs in question. The
side effects of many drugs in and of themselves may adversely affect performance. For
example, sedating antihistamines, found in many over-the-counter cold and allergy
medications, slow reaction time and cause drowsiness. Their effects on operator
performance can last hours after being consumed. Weiler et@al. (2000) found that the
performance of automobile drivers in a driving simulator was as adversely affected by an
antihistamine, diphenhydramine, found in over the-counter cold medications, as it was by
alcohol.
In 1998, a commercial bus ran off of the road and struck a parked truck, after the
bus driver had fallen asleep, killing him and six of the passengers (National
Transportation Safety Board, 2000a). Toxicological analysis of specimens from the body
of the driver revealed the presence of diphenhydramine and two other drugs, all contained
in an over-the-counter preparation marketed for the treatment of colds and allergies. The
amount of the drugs and their rates of metabolism indicated that the driver had likely
taken the medication several hours before the accident. Investigators concluded that the
drug exacerbated effects of two additional antecedents, an irregular sleep-work cycle, and
the time of day, to cause the driver to fall asleep while driving.
In a retrospective study, the National Transportation Safety Board examined fatal
accidents in a variety of transportation modes in the United States (National
Transportation Safety Board, 2000b). Prescription medications were found in the bodies
of over 21% of the general aviation pilots killed in aircraft accidents in 1 year, and in
many of the bodies of operators killed in accidents in other transportation modes as well.
Investigators concluded that both prescription and over-the-counter medications had
impaired the operators and led to the accidents.
Operators whose performance was adversely affected by prescribed medications
may have ingested multiple medications. In that case, there may be difficulty determining
whether the effects of the medications were additive, where the effects of each
medication added to those of the other medications taken, or interactive, where the
influence of the medications on performance may have differed from more typical side
effects because of the influence of the other medications in the person’s system. While
many prescribed medications, such as blood pressure drugs, have little effect on cognitive
performance, others, particularly opiate pain drugs and antianxiety medications, known
as benzodiazepines (e.g., Xanax, Prozac), have been demonstrated to adversely affect
cognitive performance (e.g., Allen et@al., 2003; Zacny, 2003). Potentially adverse effects
of drugs on performance can be found in such references as the Physicians’ Desk
Reference, Internet information that manufacturers have made available, or published
research.
Many over-the-counter medications carry generalized warnings on their labels
about the hazards of driving or operating heavy machinery after use, but these warnings
are often written in small font, and many users neither read the warnings nor recognize
the need to apply them to their own situations. The extensive promotion of these drugs,
their widespread availability and use, and the frequent lack of awareness of their side
effects, increase the likelihood that operators will use them without recognizing their
potential to impair and degrade performance. Prescription medications, which are
required to have adverse effects listed and provided to patients, also may have their side
effects ignored by users. Further, when the medications are dispensed, the physicians
prescribing the medications and the pharmacists dispensing them may not inform users of
potential adverse effects. Often people need to determine medication effects on their own,
either by reading the information provided by the pharmacy or through internet sources.
Many may be unaware of the effects on performance of the medications they are taking.
This may be an issue in the performance of operators in industries where few operators
are aware of medication side effects or the need to attend to them, or in industries in
which use of medications may be prohibited, and hence their use can lead to job loss. In
those instances, operators may keep their medication use, and/or medical condition
hidden from their employers. Investigators should also recognize that medication use,
whether prescribed or over the counter, may indicate an underlying medical condition
that itself could be impairing. In those instances, medical records from the prescribing
physicians are likely to be helpful to explain the nature of the condition that led to the
medication use.
The effects of few, if any drugs, have been studied as much as those of alcohol.
Even small amounts of alcohol can impair performance in a variety of cognitive and
motor tasks (e.g., Ross and Mundt, 1988; McFadden, 1997). A@direct relationship has
been established between the amount of alcohol in the bloodstream, measured by blood
alcohol content or BAC, and the extent of impairment. The higher the BAC, the more
impaired the person. In most of the United States, 8% BAC is considered impairing for
automobile drivers, but lower levels, typically 5% BAC is considered impairing by
medical researchers. Unusually high BAC concentrations, say 20% BAC or higher in an
individual who is still able to function at some level, may indicate alcohol dependency or
addiction.
Those addicted to alcohol or other substances may experience withdrawal after a
period of abstinence of even a few hours, withdrawal that can also impair performance
(Tiffany, 1999). For example, cocaine, a highly addictive drug (National Institute on
Drug Abuse, 1999), is a stimulant. After its effects have worn off cocaine users will
likely be fatigued, particularly if they had taken the drug at a time when they would
ordinarily have been asleep. Because fatigue impairs cognitive performance, the effects
of withdrawal from sustained use of cocaine—effects that include mood alteration in
addition to sleep disruption—can create antecedents to error.
Investigators determined that the pilot of a regional aircraft that crashed on
approach to Durango, Colorado, had been fatigued after ingesting cocaine the night
before the accident (National Transportation Safety Board, 1989). He and the first officer
were flying a challenging approach through the Rocky Mountains and were about to land
when they struck the ground several miles from the runway. Postmortem toxicological
analysis of specimens from the captain’s body found benzoylecgonine, cocaine’s
principle metabolite. Given the amount of the drug and its metabolite that were found,
and the rate of cocaine metabolism, investigators determined that he had consumed the
drug between 12 and 18 hours before the accident. Because the accident occurred at 6:20
p.m. local time, he would likely have consumed the cocaine the night before, at a time
when he would ordinarily have been asleep, thus disrupting his normal sleep pattern.
Further, after taking the cocaine, he would have had been expected to have encountered
difficulty sleeping until the effects of the drug had worn off.
Investigators concluded that the captain’s piloting skills “were likely degraded
from his use of the drug before the accident” and that he was likely experiencing the
effects of withdrawal, including, “significant mood alteration and degradation, craving
for the drug, and post-cocaine-induced fatigue” (p. 29). The findings demonstrate that
even hours after someone has consumed drugs and the drugs subsequently metabolized,
performance can be degraded. Other accidents have also shown the adverse effects of
illegal drug consumption on operator performance.
As with alcohol, high levels of a drug or its metabolites may indicate that the
operator is a drug abuser, that is, a long-term user of a drug, or is a drug addict. If an
operator is suspected of abusing medications, pharmacy records of prescribed
medications may reveal a pattern of use over time. The operator may have approached
several physicians and obtained prescriptions from each. The operator also may not have
informed his or her employer of either the medication use, or the condition for which the
medications were prescribed. Other information, such as records of convictions for
driving while under the influence of alcohol or drugs, may also suggest a pattern of
substance abuse. In the United States, the Federal Aviation Administration requires pilots
to report such infractions, and reviews the driving records of all pilots to learn of such
offenses, regardless of their selfreports (McFadden, 1997). A substance abuse specialist
evaluates all pilots with two or more convictions (and some with one), to determine
whether they are chemically dependent. Only after these specialists have reviewed the
operator’s history and concluded that he or she would likely refrain from future drug or
chemical use, does it grant the medical certificate needed to serve as a pilot.
Company-maintained personnel records may contain information reflecting an
operator’s history of substance use. Prolonged absences, or absences at the beginning and
end of work weeks or work periods, may indicate chemical use. Performance appraisals
may also show marked changes in work habits or work performance—another indicator
of chemical dependency. Depending on the industry, regulators may require operators to
provide the results of regular medical examinations and their medication use. These
records should provide investigators with considerable information regarding medical
and pharmaceutical antecedents to error.
e. Behavioral Antecedents
Behavioral antecedents, which develop from the operator’s near- or long-term
experiences, can adversely affect performance. They can, for example, follow profoundly
stressful events; such as the loss of an immediate family member. The grief and stress of
people in these situations, and the effects of that stress on their performance, are
understandable. Many have encountered the effects of behavioral antecedents at one time
or another and can attest to their adverse influence. The effects they exert on the
performance of an operator in question, however, may be different from that on another’s
performance. Two behavioral antecedents, fatigue and stress, are of particular interest to
error investigators. Others, that are company influenced, may also be important in terms
of focusing on operator antecedents.
Because of the role of the company in the conduct of its operations, antecedents
that may appear to be related to the operator may be more correctly attributed to the
company. Operators may commit errors because of skill or knowledge deficiencies, and
these deficiencies may serve as the antecedents to the errors in question. But companies
that employ the operators establish minimum qualification levels, hire applicants whom
they believe will meet those qualifications, and train and certify them as qualified to
safely operate their systems. Consequently, because of a company’s role in overseeing its
operations, company antecedents and not operator antecedents may influence errors that
result from a lack of operator knowledge or skills. Companies may also be considered to
have influenced operator performance if company-established work schedules led to
operator fatigue. If, however, operators engaged in personal activities that led to their
fatigue, then the company would not be considered the source of the fatigue and the
antecedent to error.
For our purposes, fatigue results from operator-related antecedents or
organization- or regulator-related antecedents. Medical conditions that the operator is
aware of but does not report to his or her company or the regulator, if required to do so,
are an example of a type of operator-related antecedent. However, if the company or the
regulator is aware (or should be aware) of the adverse influence of fatigue on cognitive
performance and does not require operators with sleep apnea or other medical condition
to be diagnosed and treated for the condition, then the antecedent would be considered
company or regulator-related. As information about the deleterious effects of fatigue and
fatiguing medical conditions has increased, companies and regulators have increased
their role in requiring those in safety-sensitive positions with these conditions to be
diagnosed and treated for the conditions.
Otherwise, operators who, for example, are fatigued because they remained
awake longer than they had planned to before going on duty, would be considered to be
responsible for the antecedents. If they did so in order to watch a film or an event on
television, for example, this would almost be considered a violation rather than an error
antecedent. However, if they had insufficient sleep for reasons that had little to do with
their volition, such as infant care or brief illness, they deserve more consideration, but
nevertheless, must be considered to be the source of the antecedent if they were fatigued
as a result of their situations, and did not alert their supervisors to that effect.
Companies and organizations can be responsible for the antecedents of an
operator’s fatigue if, as noted, they did not require their operators to be treated for
fatigue-inducing medical conditions, prohibit their use of impairing over-the-counter and
prescribed medications, or if they created fatiguing work schedules. As Fletcher et@al.
(2015) note, the nature of complex systems today calls for 24-hour operations. These
systems are simply too expensive, and the societal costs of their nonoperation is too high,
to allow them to cease operations for any length of time. Internationally operating aircraft
and vessels, nuclear power stations, and chemical refineries, for example, cannot avoid
nighttime operations without causing significant disruption to themselves and to society
in general.
Unlike medical conditions, where medical records describe diagnoses, or alcohol-
related impairment, where blood alcohol level provides evidence of the degree of
intoxication, fatigue is a particularly challenging metric to assess. As Price and Coury
observe, “Historically, fatigue has been notoriously difficult to define and operationalize”
(2015, p. 86). Because no physical measure of fatigue can be taken, investigators must
assess the degree of fatigue indirectly. They do this by assessing evidence for fatigue,
relating it@to the type of error the operator committed, and determining the likelihood of
other antecedents accounting for the error (Price and Coury, 2015; Strauch, 2015).
Investigators determine that an operator’s error was the result of fatigue by first
establishing that the operator was fatigued. Medical records that demonstrate that an
operator has an untreated, fatigue-producing medical condition, would be sufficient to
establish that he or she was fatigued. Similarly, evidence of the use of a sedating
medication would also be sufficient. Absent such evidence, investigators establish the
presence of fatigue by examining the quantity, regularity, and quality of the operator’s
sleep in the period before the accident. Ideally, a week’s worth of sleep/awake times
would establish beyond question the quantity and regularity of someone’s sleep, but most
people have difficulty remembering more than a few days previously what times they
went to bed and what time they arose. Therefore, investigators typically ask operators to
note their sleep/wake times for 72–96 hours before an accident. This record will establish
whether an operator was subject to circadian disruption, and whether he or she got the
desired 8 hours, plus or minus 1 hour, of sleep. Irregularity in sleep schedules, and sleep
times less than the person’s regular sleep hours serve as evidence of fatigue. Obviously,
the greater the deficit from 8 hours, the greater the irregularity in sleep/wake times, and
the greater the cumulative deficit over time, the more likely the operator was fatigued. In
addition, Price and Coury (2015) highlight the importance of documenting sleep quality.
An operator who has accrued sufficient sleep (i.e., around 8 hours), with regularity in the
time before an accident, but whose sleep was diminished by noise, interruptions, high
temperature, and so on, will be considered to have received insufficient quality sleep and
hence, to have been fatigued.
f. Hiring
On February 12, 2009, a Bombardier DHC-8-400, on a flight from Newark, New
Jersey, to Buffalo, New York, crashed into a residence near Buffalo, while the airplane
was on its final approach to the airport. All 49 passengers and crew onboard the airplane
and one person on the ground were killed in the accident (National Transportation Safety
Board, 2010). Night visual meteorological conditions prevailed at the time and nothing
untoward was found wrong with the airplane. Investigators concluded that the captain
had inappropriately responded to a stick shaker alert, which occurs when an airplane is
about to stall. Rather than lowering the nose and advancing power, as he had been trained
to do, he pulled the nose back and the airplane entered a stall, from which neither the
captain nor the first officer were able to recover. Investigators found that neither the
captain nor first officer had effectively monitored the airspeed before the stick shaker had
alerted them.
The error in failing to react appropriately to a stick shaker is one that is not wholly
consistent with fatigue, given the training that the pilots receive. That is, all pilots are
trained and are required to demonstrate their recognition of, and appropriate response to a
stall. The stick shaker alert, in which the control column rapidly moves forward and aft
and is accompanied by a unique sound, is designed to minimize the time pilots need to
recognize the impending stall. Both auditory and tactile cues that are unique to this
impending aerodynamic condition are provided and both are readily identifiable. The
criticality of rapid recognition and the need for an effective crew response to the
warnings of an impending stall led to the requirement for a unique and quickly
recognized alert. Consequently, little, if any, diagnosis is needed to recognize the nature
of a stick shaker alert. However, allowing the airplane to approach a stall by failing to
monitor the airspeed is an error consistent with fatigue because a proper approach to
landing calls for pilots to rapidly shift their monitoring among parameters of airspeed,
descent speed, engine power, and lateral and vertical flight paths. However, shifting
attention, vigilance, and monitoring are cognitive skills that have been demonstrated to be
adversely affected by fatigue.
Neither pilot resided in the city from which the flight originated, nor both had
“commuted” or flew as a passenger from their residence to Newark. The captain arrived
at Newark 3 days before the day of the accident, arriving there in the evening, at 20:05,
and began a 2-day trip of flights the next morning. He spent the night before the 2-day
trip in the crew room at the airport and awoke before he was required to report for duty at
05:30 the next morning and again the following morning, the day of the accident. In
between, he spent the night at a company-paid hotel. The night before the accident, with a
21-hour and 16-minute rest period upon completion of his 2-day trip, he spent the night in
the crew room at the airport. Investigators found that 03:10 and again at 07:26 on the
morning of the accident he had logged onto the airline’s computer. He reported for duty
the day of the accident at 13:30.
The first officer flew from her home on the west coast of the United States to
Newark, changing planes in Memphis. The flight originated in Seattle at 19:51 local
(Pacific) time or 22:51 eastern time and arrived in Memphis at 23:30 Pacific time or
02:30 eastern time. She then took a flight that left Memphis at 04:18 eastern time and
arrived at Newark about 06:23, Eastern Time. She then rested in the crew room from
about 07:32 to about 13:05 when she sent a text message from her computer. The flight
crews of the flights on which she flew to Newark reported that she slept about 90 minutes
on the first flight and for the duration of the second.
Airport crew rooms are provided to pilots and flight attendants to enable them to
relax before their flights. Little privacy is available and, while couches may be provided,
these are not designed for crew sleeping because the room lights are typically bright and
there is little effort to soften the volume of noise. Crewmembers meet each other and
typically converse before their flights. Therefore, pilots who spend the night in airport
crew rooms may obtain sufficient sleep to be considered rested, but the quality of sleep
obtained would negate potential benefits of sufficient hours of sleep, if it were possible
for crewmembers to sleep the entirety of their stays in crew rooms. As a result,
investigators concluded, “the captain had experienced chronic sleep loss, and both he and
the first officer had experienced interrupted and poor-quality sleep during the 24@hours
before the accident” (National Transportation Safety Board, 2010, p.@106).
Crew rooms do not charge crewmembers fees for their use, unlike hotel rooms.
Regional air pilots, especially first officers, may not earn enough compensation to be able
to afford hotel rooms. Moreover, while regulator hours of service dictate the number of
hours and rest pilots much obtain while on duty, the rules do not apply to hours served off
duty, as the captain and first officer were on the night before the accident.
g. Procedures
Companies face a fundamental dilemma in developing and implementing
procedures. Procedures should be sufficiently specific and unambiguous to guide
operators in responding to most situations, yet not so specific that operators may feel
unable to respond to unexpected situations for which applicable procedures have not yet
been developed. As Flach and Rasmussen (2000) note, “it is impossible to have
conventions for unconventional events” (p. 170).
System safety depends on operators following procedures, yet the operators must
still possess the authority to bypass procedures if, given their experience and expertise,
they believe that the circumstances so warrant. Explicit procedures provide the guidance
operators need to operate systems as intended and ensure that different operators control
the system similarly. However, overly restrictive procedures can work against safety.
Reason (1997) argues that these may actually encourage operators to develop their own
shortcuts, circumventing the intent of the procedures. Overly restrictive or comprehensive
procedures also need extensive management oversight to ensure that operators comply
with them. Most companies recognize that it is impossible to develop procedures for
responses to all possible circumstances. Ideally, procedures companies develop and
implement will be both comprehensive and specific, applying to as many potential
circumstances as possible.
h. Oversight
Oversight is a critical element of a company’s responsibility for the safety of the
system it operates. It is intended to both ensure that operators adhere to the operating
procedures, and to inform companies of critical aspects of system operations in need of
modification. Oversight serves both to inform operators how to operate the system, and to
inform companies how effectively operators are carrying out their procedures, as well as
of procedural changes that may be needed to ensure continued operational safety.
Effective oversight requires obtaining sufficient operator performance data, through
frequent and thorough acts of data gathering and inspection, to recognize how well the
system is being operated, and to identify changes that may be needed to enhance
operational safety.
Oversight data should describe employee performance quality in a variety of
operating conditions. Many large companies, with thousands of operators, have too large
a span of supervision to allow effective oversight of all operators, and they depend on
operator performance data for effective oversight. Effective oversight informs companies
about all critical aspects of their operations. Well-informed companies can quickly
respond to operational difficulties as they emerge, and thus help to reduce the likelihood
that these difficulties can become opportunities for error.
The quality of oversight varies according to the system, the operating conditions,
the operators, and the severity of the consequences of operator error. Since continuous
oversight of operators is unfeasible, companies must maximize the quality of their
oversight, through as many of the operating cycles as reasonable, to provide them with
sufficient information for a realistic portrayal of the quality of operator performance and
procedural quality. Done properly, operational oversight can be effectively carried out by
monitoring, recording, and sampling data that is representative of performance in the
various system operating phases. For example, to determine the extent of taxpayer
compliance with the tax code in the United States, the federal government inspects or
audits the tax returns of fewer than 5% of taxpayers in a given year. Yet, this sampling of
taxpayers reveals that the overwhelming majority of taxpayers comply with the tax laws,
despite the low probability that an individual’s returns will be audited. Most taxpayers
know that they will receive stiff penalties if convicted of evading tax laws and they are
unwilling to face the penalties, irrespective of the low risk of being caught. By sampling
a few tax returns the federal government can maintain realistic oversight of taxpayer
compliance with tax laws.
Companies need to respond to operator performance deficiencies before their
performance can jeopardize system safety. Consequently, operators with manifestly
deficient performance are rarely encountered in complex systems; companies tend to
address the issue before safety is jeopardized. Organizations that fail to deal with
deficient performance can create antecedents to error and investigators may occasionally
encounter operators with histories of performance deficiencies.
Many companies place new operators in probationary periods that give them full
discretion to evaluate operator performance, and retain or discharge operators in these
periods. Effective oversight requires companies to identify and address performance
shortcomings that their operators may demonstrate at any time during their employment,
but companies should pay especial attention to employees who may have difficulty
mastering skills during their probationary period because of the relative ease with which
companies can deal with probationary employees compared to employees retained
beyond their probationary periods.
Some experienced operators can present different types of safety challenges to
companies. They may perform satisfactorily during routine or expected situations but
perform unacceptably when encountering no routine or emergency situations. Effective
oversight should enable companies to identify those operators whose ability to respond to
nonroutine situations is uncertain. Investigators, to the extent possible, should obtain
company records of operator performance during both routine and no routine operating
periods, as well as records of company responses to operator performance deficiencies.
Some operators may also knowingly violate company procedures when they are
confident that company managers will not detect their actions, thereby endangering
system safety. Here too companies must identify and respond to such safety hazards.
Because of the need to ensure that operators are following necessary procedures,
companies that take little or no action in response to unjustified violations of procedures
create antecedents to error by effectively communicating to operators that procedural
noncompliance will not be addressed. Ultimately, companies may have to remove from
safety-sensitive positions operators who have disregarded operating procedures.
Investigators observed the outcome of such an operator in their investigation of a
1993 aircraft accident, involving a pilot whom peers had reported as ignoring critical
procedures (National Transportation Safety Board, 1994). The airplane, owned and
operated by the Federal Aviation Administration, struck the side of a mountain, killing
him and two of his peers onboard, before air traffic controllers could clear the plane to
climb through clouds to a higher altitude and safely depart the area. The pilot chose not to
delay takeoff to wait on the ground for air traffic controllers’ authorization to proceed to
his destination, most likely in the belief that he could obtain it more readily once
airborne.
i. Formal Oversight System
Since Reason (1990, 1997) offered suggestions to enhance system safety,
researchers have examined and regulators and companies have developed and
implemented specific techniques to this end. For example, Helmreich and his colleagues
studied techniques to expand crew resource management (CRM) practices to include
error management (e.g., Klinect, Wilhelm, and Helmreich, 1999) and Guldenmund’s
(2010) and Grote’s (2012) studies of corporate safety culture suggest techniques that
companies can use to enhance safety. Today, international and domestic regulators have
endorsed concepts to proactively enhance safety and have published manuals to assist
companies to develop and implement them (International Civil Aviation Organization,
2002, 2013).
Flight Operations Quality Assurance (FOQA), as LOSA, was developed initially
in aviation but has since been implemented in other complex systems as well. FOQA uses
software to analyze system recorder data, such as data on flight data recorders, not for
accident investigation purposes for which they were developed, but to monitor operator
performance of the systems in question (Federal Aviation Administration, 2004). Flight
data recorders, which had recorded five parameters in the analog era (heading, altitude,
airspeed, vertical acceleration, and microphone keying), now record hundreds of digital
aircraft system and flight parameters that give precise indications of the airplane, it’s state
in the minutes before the accident, and pilot interactions with aircraft controls and major
systems. Reading out flight data recorders proactively enables airlines, as with LOSA, to
monitor operator performance in certain maneuvers at particular airports, for example,
and to determine whether additional training and/or procedural modifications are needed.
FOQA provides airline information, in the absence of an accident or incident, about
operator and aircraft performance in real time, with multiple pilot crews and aircraft,
allowing them to learn of potential safety issues in the absence of an accident or incident,
or in the absence of operator or management recognition of potential safety issues. Since
airlines have begun implementing FOQA, other industries with onboard system
recorders, such as companies operating oceangoing vessels that are required to be
equipped with voyage data recorders, have begun similar initiatives as well.
j. Company Errors
Researchers have examined differences between errors that can be attributed to an
individual operator and those attributed to a company and its operations. That is, for an
error to be organizational and not individual, more than one individual had to have been
involved in acting or deciding, in a manner considered to be furthering an organization’s
goals, in ways that would lead to adverse consequences.
Strauch (2015), expanding on this concept, adds that to identify company
antecedents, one of three conditions have to be met. Investigators must be able to
demonstrate that company officials (1) acted or made decisions in the face of information
alerting them to the need for different actions or decisions, (2) acted or decided in the
face of self-evident information of the need for corrective action, or (3) took no action or
made no decision when an action and/or decision was warranted.
Information on the need for corrective action can include a history of similar
accidents or incidents in a relatively brief period, operator or manager reports of safety
deficiencies, FOQA, LOSA, and SMS data, regulator-cited infractions, patterns of
failures on operator examinations of proficiency, and patterns of maintenance
deficiencies. In the face of such evidence, company action to address the information
provided is warranted and inaction should be considered a company antecedent to error.
Illustrations of self-evident data include work schedules that are fatigue-inducing,
punitive oversight programs, and publicly berating operators who commit errors.
Unfortunately, illustrations of organizational accidents are not common in the
investigation literature; identifying them as such is a relatively recent phenomenon.
Whether it is not acting on indications of safety shortcomings, deciding not to improve
training when data calling for such improvement is manifest, or tolerating bullying
management, investigators have come to recognize and describe companies’ roles in
accidents.
k. What Regulators Do
Regulators primarily perform two functions that are critical to system safety. They
establish rules ensuring the safety of system operation and equipment design, and they
enforce compliance with those rules. The rules are designed to provide a minimum level
of safety to the systems they oversee. Organizations that operate at that level would be
expected to operate safely. Of course, exceeding those levels of safety would be
encouraged, but not required, by the regulator. Regulator antecedents are either a function
of inadequate rules, poor oversight, or both, or investigators must examine whether
regulatory oversight, in either capacity, led to errors that caused accidents.
Regulators are expected to establish sufficiently rigorous rules, methods, and
standards to provide a minimally acceptable standard of public safety. Yet, at the same
time, overly restrictive regulations may inhibit operations and thus a company’s ability to
operate profitably. As a result, regulators face pressures unlike those of other system
elements. They are asked to oversee the safety of systems with potentially catastrophic
consequences to system malfunction, without restricting the freedom of companies to
operate their systems profitably.
Reason (1997) refers to “the regulators’ unhappy lot,” in which they are caught
between demands for absolute system safety, resistance to what may be considered
excessive oversight, and a public that is often unwilling to provide regulators the
resources necessary to enable them to carry out their missions effectively. As a result,
regulators, whose work is effective with continued system safety, rarely attract public
attention. Reason (1997) points out that the public may consequently become unwilling
to provide the resources regulators need to enable them to conduct the oversight needed
to effectively monitor the safety of the systems that they are tasked with overseeing.
Since the benefits of effective regulatory oversight are mainly seen in their absence, such
as after an accident has occurred, reducing the funding of regulators may appear to be a
relatively painless way to reduce the expenditure of public funds while at the same time
not inhibiting perceptible levels of public safety.
Given the two functions of regulators, enacting rules and enforcing those rules,
regulator antecedents to error fall into one of those categories. As with other antecedents,
investigators must work backward from the error through the system to identify the
regulator antecedents to error. The nature of the antecedent determines the resultant error.
There tend to be fewer antecedents from regulator shortcomings in the rules that
govern the industry than in those related to rule enforcement, because over time, as
regulatory shortcomings become recognized, often through accidents, regulators tend to
correct the shortcomings rectified by enacting rules that address particular deficiencies.
For example, in the 1970s and 1980s, as aviation accidents involving well-designed and
well-maintained aircraft due to crew error continued to occur, regulators recognized that
pilots needed to be trained in CRM. In response, in 1998, the U.S. Federal Aviation
Administration required pilots of air transport aircraft to complete CRM training (Federal
Aviation Administration, 2004).
This type of regulatory defiency could be seen in a ferry accident that occurred in
New York City in 2003 (National Transportation Safety Board, 2005). The vessel
operator experienced what investigators termed an “unexplained incapacitation” as he
was about to dock the vessel. As a result, he did not slow the vessel as it neared the dock
and it crashed into the dock, killing 11 passengers. The investigation found that the
operator had been taking a prescribed pain medication, one of its side effects included
seizures, a possible factor in explaining his incapacitation. Yet, the Coast Guard, the
federal agency that regulates U.S. Marine operations, had no prohibition in place to warn
mariners against using the medication. Nonetheless, fearing suspension of his license, the
mariner did not report using the medication to the Coast Guard. As a result, investigators
identified shortcomings in the Coast Guard’s medical oversight system, but they did not
consider those to have played a part in the accident. Investigators identified these
shortcomings as safety concerns in their report and recommended that the Coast Guard
upgrade its system of medical oversight of mariners to bring it in line with the medical
oversight that other federal transportation regulators (such as the Federal Aviation
Administration) conducted. To its credit, the Coast Guard agreed and over several years
considerably upgraded its system of medical oversight of mariners to a level considered
equivalent to that of other transportation regulators.
In some systems, such as aviation and marine, both domestic and international
regulators establish rules governing system operations, through agencies that are entities
of the United Nations. In aviation, this is carried out by the ICOA and in marine, by the
IMO. In both transportation modes, their rules, once adopted, are enforced by countries
on behalf of the international regulators, which have no enforcement authority
themselves.
