EUROCONTROL EXPERIMENTAL CENTRE · european organisation for the safety of air navigation...

EUROPEAN ORGANISATION FOR THE SAFETY OF AIR NAVIGATION

EUROCONTROL

EUROCONTROL EXPERIMENTAL CENTRE

CHANGES IN ATM SAFETY CULTURE DUE TO NEW TECHNOLOGY

EEC Note No. 13/05

Project C24/2004

Issued: June 2005

The information contained in this document is the property of the EUROCONTROL Agency and no part should be reproduced in any form without the Agency’s permission.

The views expressed herein do not necessarily reflect the official views or policy of the Agency.

REPORT DOCUMENTATION PAGE

Reference: EEC Note No. 13/05

Security Classification: Unclassified

Originator: EEC – SAS (Safety Analysis and Scientific)

Originator (Corporate Author) Name/Location: EUROCONTROL Experimental Centre Centre de Bois des Bordes B.P.15 F - 91222 Brétigny-sur-Orge Cedex FRANCE Telephone: +33 (0)1 69 88 75 00

Sponsor: EATMP (SSAP)

Sponsor (Contract Authority) Name/Location: EUROCONTROL Agency 96, Rue de la Fusée B-1130 Brussels Telephone: +32 2 729 90 11 WEB Site: www.eurocontrol.int

TITLE: CHANGES IN ATM SAFETY CULTURE DUE TO NEW TECHNOLOGY

Authors Jamie HENDERSON (HRA for ICON Consulting) Rachael GORDON, EEC

Date 06/2005

Pages x + 64

Figures 2

Tables 9

Annexes 2

References 39

EEC Contact Rachael GORDON

Project C24/2004

Task No. Sponsor

Period Sept-Dec 2004

Distribution Statement: (a) Controlled by: Head of SRT (b) Special Limitations (if any): None (c) Copy to NTIS: YES / NO

Descriptors (keywords): Changes in safety culture; future ATM technology

Abstract: This report describes a small-scale project about the impact that future ATM technologies may have on safety culture in ATM. The overall objectives of this project were to: i) gather evidence for the impact of recently introduced systems on safety culture and ii) examine the potential impact future ATM functions may have on safety culture that could potentially affect safety. This was undertaken in three stages: literature review; controller survey of how recent changes in ATM technology had affected safety culture and how future changes could affect safety culture; and interviews with system developers regarding future changes. The findings from the literature review helped to identify some of the relevant safety culture factors that were used in the controller survey. These were chosen on the basis of being relevant to safety culture at the operator-level as well as to changes in technology. Very little research has attempted to predict how safety culture may be affected with new technologies. The safety culture factors used in the survey were: team-work; communication; trust in people; trust in equipment; understanding of risk; understanding of competence of others; personal responsibility for safety; job pressure and job satisfaction. The interview survey was carried out with 33 controllers at four European ANSPs during October-December, 2004. Changes in safety culture were discussed with regard to recently introduced technologies (such as OLDI, STCA, Human-Machine Interface) and future technologies (such as MTCD (medium term conflict detection), CORA (conflict resolution assistant), datalink and ASAS (airborne separation assurance system). The main findings suggest that teamwork and communication appear to be particularly vulnerable to change, although controllers also indicated that there is high chance that their understanding of the risks and their job satisfaction may change with new technology. Controllers trust in equipment, personal responsibility for safety and job pressure were also predicted to change with the implementation of new technology. Two lines for future research in this area have been identified as: i) further investigation regarding the safety culture aspects in ATM and development of a tool or method to measure safety culture and ii) focus on aspects of the ATM 2012 at risk.

Change in ATM Safety Culture due to New Technology EUROCONTROL

Project C24/2004 - EEC Note No. 13/05 v

TABLE OF CONTENTS

LIST OF ANNEXES........................................................................................................... VI

LIST OF FIGURES ............................................................................................................ VI

LIST OF TABLES.............................................................................................................. VI

1. INTRODUCTION...........................................................................................................1

2. METHOD.......................................................................................................................4 2.1. LITERATURE REVIEW.................................................................................................. 4

2.1.1. Outline of Literature Review ..............................................................................4 2.1.2. Literature Review Outputs .................................................................................5

2.2. SURVEY OF ATCOS ..................................................................................................... 7 2.2.1. Summary of Past Changes Discussed at Interviews.........................................8 2.2.2. List of Principal Future Changes Discussed at Interviews.................................8

2.3. SURVEY OF TECHNOLOGY DEVELOPERS (AT EEC)............................................... 9

3. SAFETY CULTURE DIMENSIONS.............................................................................10 3.1. TEAMWORK ................................................................................................................ 10

3.1.1. Characterisation of Teamwork in ATC.............................................................10 3.1.2. Importance of Teamwork for Safety ................................................................11 3.1.3. Potential Vulnerability of Teamwork to New Technology ................................11

3.2. UNDERSTANDING OF COMPETENCE...................................................................... 13 3.2.1. Characterisation of Understanding of Competence in ATC.............................13 3.2.2. Importance of Understanding of Competence to Safety..................................14 3.2.3. Potential vulnerability of understanding of competence to new technology ....14

3.3. TRUST IN PEOPLE...................................................................................................... 15 3.3.1. Characterisation of Trust in People in ATC .....................................................15 3.3.2. Importance of Understanding of Trust in People to Safety..............................15 3.3.3. Potential Vulnerability of Trust in People to new Technology..........................16

3.4. TRUST IN EQUIPMENT............................................................................................... 17 3.4.1. Characterisation of Trust in Equipment in ATC ...............................................17 3.4.2. Importance of Trust in Equipment to Safety ....................................................17 3.4.3. Potential Vulnerability of Trust in Equipment to New Technology ...................17

3.5. UNDERSTANDING OF RISK....................................................................................... 19 3.5.1. Characterisation of Understanding of Risk in ATC ..........................................19 3.5.2. Importance of Understanding of Risk to Safety ...............................................19 3.5.3. Potential Vulnerability of Understanding of Risk to New Technology..............20

3.6. COMMUNICATION ...................................................................................................... 21 3.6.1. Characterisation of Communication in ATC ....................................................21 3.6.2. Importance of Communication for Safety ........................................................21 3.6.3. Potential Vulnerability of Communication to New Technology ........................22

3.7. PERSONAL RESPONSIBILITY FOR SAFETY............................................................ 24 3.7.1. Characterisation of Personal Responsibility for Safety in ATC........................24 3.7.2. Importance of Personal Responsibility for Safety to Safety.............................24 3.7.3. 24Potential Vulnerability of Personal Responsibility for Safety to new Technology

3.8. JOB PRESSURE.......................................................................................................... 25 3.8.1. Characterisation of Job Pressure in ATC ........................................................25

EUROCONTROL Change in ATM Safety Culture due to New Technology

vi Project C24/2004 - EEC Note No. 13/05

3.8.2. Importance of Job Pressure to Safety .............................................................26 3.8.3. Potential Vulnerability of Job Pressure to New Technology ............................26

3.9. JOB SATISFACTION ................................................................................................... 27 3.9.1. Characterisation of Job Satisfaction in ATC ....................................................27 3.9.2. Importance of Job Satisfaction to Safety .........................................................28 3.9.3. Potential Vulnerability of Job Satisfaction to New Technology........................28

4. CONCLUSIONS..........................................................................................................30 4.1. WHAT IS SAFETY CULTURE?.................................................................................... 30 4.2. DOES THE NATURE OF SAFETY CULTURE IN ATM DIFFER FROM SAFETY

CULTURE IN OTHER INDUSTRIES?.......................................................................... 31 4.3. HOW HAS SAFETY CULTURE BEEN AFFECTED BY THE INTRODUCTION OF NEW

TECHNOLOGY IN THE PAST? ................................................................................... 32 4.4. HOW MIGHT SAFETY CULTURE BE AFFECTED BY THE INTRODUCTION OF NEW

TECHNOLOGY IN THE FUTURE?.............................................................................. 33 4.5. ISSUES THAT CUT ACROSS THE SAFETY CULTURE FACTORS.......................... 33 4.6. SUMMARY ................................................................................................................... 35

LIST OF ANNEXES

ANNEX A - Literature review........................................................................................................... 39 ANNEX B - Overview of search strategy used for impact of new technology on safety culture ...... 64

LIST OF FIGURES Figure 1: Method for current project .............................................................................................. 4 Figure 2: Research process –past, current and potential future research in the

area of ATM safety culture ........................................................................................... 36

LIST OF TABLES Table 1: Classification of the level of importance of safety culture factors ................................. 31 Table 2: Summary table ............................................................................................................. 35 Table 3: Safety culture themes emerging from a review of the literature (adapted from

Clarke, 2000)................................................................................................................ 45 Table 4: Safety culture themes emerging from a review of the literature (adapted from

Wiegmann et al., 2002) ................................................................................................ 46 Table 5: Safety climate themes emerging from a review of the literature (adapted from Flin

et al., 2000) .................................................................................................................. 47 Table 6: Summary of safety culture themes identified by reviewers .......................................... 48 Table 7: Dimensions proposed by Ek et al. (2003b) for analysis of ATC safety culture............. 51 Table 8: A comparison of organisational attitudes of two US airlines (adapted from Helmreich

and Merritt, 1999) ......................................................................................................... 52 Table 9: Potential impacts on controllers’ tasks of introduction of new technology (from

Eurocontrol, 2001)........................................................................................................ 57


Project C24/2004 - EEC Note No. 13/05 vii

REFERENCES

[1] C-ATM (2004) C-ATM High-Level Operational Concept, Report, Version 1.0, 2004, 6th Framework).

[2] Clarke, S. (2000) Safety culture: under-specified and overrated? International Journal of Management Reviews Volume 2, Issue 1, 65-90.

[3] Cooper, M. D. (2000) Towards a model of safety culture. Safety Science. Vol. 36, 111-136.

[4] Edmondson, A.C. (2003) Speaking up in the operating room: how team leaders promote learning in interdisciplinary action teams. Journal of Management Studies. V.40. No.6.

[5] Ek, A. Aksellsson, W., Arvidsson, M. & Johansson, C. R. (2002) Safety culture in the Swedish air navigation services. Proceedings of the Fourth European Conference of the European Academy of Occupational Health Psychology. Vienna, Austria. 58-61.

[6] Ek, A. Aksellsson, W., Arvidsson, M. & Johansson, C. R. (2003a) Safety culture and organizational climate in air traffic control. Proceedings of the XVth Triennial Congress of the International Ergonomics Association, Seoul, Korea. Vol.5, Safety I.

[7] Ek, A., Arvidsson, M., Akselsson, R., Johansson, C.R., & Josefsson, B.. (2003b) Safety culture in air traffic management: air traffic control. Conference proceedings of the 5th. USA/Europe ATM 2003 R&D Seminar. June 23-27, Budapest, Hungary.

[8] EUROCONTROL (2001) An Operational Vision Document: Automated Support to the ATS programme. Draft 0.2.

[9] EUROCONTROL (2003a) Guidelines for Trust in Future ATM system: Measures. Edition 1.0 HRS/HSP-005-GUI-02, EUROCONTROL, Brussels, Belgium.

[10] EUROCONTROL (2003b) The Development of Situation Awareness Measures in ATM System. Edition 1.0 HRS/HSP-005-REP-01, EUROCONTROL, Brussels, Belgium.

[11] EUROCONTROL (2003c) EVP WP3 AMAN MAEVA Report, Bretigny, France.

[12] EUROCONTROL (2004a) A measure to assess the impact of automation on teamwork. Edition 0.3 HRS/HSP-005-REP-07, EUROCONTROL, Brussels, Belgium.

[13] EUROCONTROL (2004b) Age Experience and Automation in European Air Traffic Control – Survey in the ECAC Area. Edition 1.0 HRS/HSP-005-REP-05, EUROCONTROL, Brussels, Belgium.

[14] EUROCONTROL (2004c) Impact of Automation on Future Controller Skill Requirements and a Framework for their Prediction. Edition 1.0 HRS/HSP-005-REP-04, EUROCONTROL, Brussels, Belgium.

[15] EUROCONTROL (2004d) Managing System Disturbances in ATM: Background and Contextual Framework. Edition 1.0 HRS/HSP-005-REP-06, EUROCONTROL, Brussels, Belgium.

[16] EUROCONTROL (2004e) DOVE-2 Real Time Simulation EEC Report No. 390 Project AGC-Z-DO, Bretigny, France.


viii Project C24/2004 - EEC Note No. 13/05

[17] Flin, R., Mearns, K., O’Connor, P. & Bryden, R. (2000) Measuring safety climate: identifying the common features. Safety Science. V.34. 177-192.

[18] Gershon, R.M., Karkasian, C. D., Grosch, J.W., Murphy, L.R., Escamilla-Cejudo, A., Flanagan, P.A., Bernacki, E., Kasting, C. & Martin, L. (2000) Hospital safety climate and its relationships with safe work practices and workplace exposure incidents. American Journal of Infection control. 28, 211-221.

[19] Gill, G.K. & Shergill, G.S. (2004) Perceptions of safety management and safety culture in the aviation industry in New Zealand. Journal of Air Transport Management. V.10. 233-239.

[20] Guldenmund, F.W. (2000) The Nature of Safety Culture: a review of theory and research. Reliability Engineering and System Safety. Vol. 34, 215-257.

[21] Hale, A.R. (2000) Editorial: Culture’s confusions. Safety Science. V.34. 1-14.

[22] Hallier, J. (2004) Embellishing the past: middle manager identity and informality in the implementation of new technology. New Technology, Work and Employment, V.19, No. 1. 43-62(20).

[23] Helmreich, R.L., Merritt,A.C. (1998) Culture at Work in Aviation and Medicine. Ashgate: Aldershot.

[24] Helmreich, R.L. & Schaefer, H. G. (1994) Team performance in the operating room. In Human Error in Medicine. Edited by Bogner, M.S. Lawrence Erlbaum: New Jersey.

[25] Joyce, A. & Fassert, C. (2002) Automatic safety monitoring in air traffic control – achievements and perspectives. Workshop on Investigation and Reporting of Incidents and Accidents Ed. C.W. Johnson GIST Technical Report G2002-2 Department of Computing Science, University of Glasgow, Scotland.

[26] Perrow, C. (1984) Normal Accidents. Basic Books: New York.

[27] Reason, J. T. (1997) Managing the risks of organisational accidents. Aldershot: Ashgate.

[28] Reason, J. T. (2000) Human error: models and management. British Medical Journal. V.520. 768-770.

[29] Roberts, K. H. (1993) New Challenges to Understanding Organizations. MacMillan: New York.

[30] Roberts, K. H., Rousseau, D.M. & LaPorte, T.R. (1994) The culture of high reliability: quantitative and qualitative assessment aboard nuclear-powered submarines: The Journal of High Technology Management Research. V.5. No.1. 141-161.

[31] Singer, S. J., Gaba, D.M., Geppert, J.J., Sinaiko, A.D., Howard, S.K. and Park, K.C. (2003). The culture of safety: results of an organization-wide survey in 15 California hospitals.

[32] Sorensen, J. N. (2002) Safety Culture: a survey of the state of the art. Reliability Engineering and System Safety. Vol. 76, 189-204.

[33] Weeks, W.B. & Bagian, J.P. (2000) Developing a culture of safety in the Veterans Health Administration. Effective Clinical Practice. V.6 270-276.


Project C24/2004 - EEC Note No. 13/05 ix

[34] Weick, K. E. (1987) Organizational culture as a source of high reliability. California Management Review. V.14. No.2. Winter.

[35] Weick, K. E. & Sutcliffe, K.M. (2003) Hospitals as cultures of entrapment: a re-analysis of the Bristol Royal Infirmary. California Management Review. V.45. No.2. Winter.

[36] Wiegmann, D.A., Zhang, H., von Thaden, T., Sharma, G, Mitchell, A. (2002) A Synthesis of Safety Culture and Safety Climate Research. Institute of Aviation, University of Illinois. Technical Report ARL-02-3/FAA-02-2.

[37] Van Vuuren, W. (2000) Cultural influences on risks and risk management: six case studies. Safety Science. V.34. 31-45.

[38] Villiers, J. (2004). “Air Traffic Control Automation “ERASMUS” – Enroute Air traffic Soft Management for an Ultimate System” A friendly way for “breaking the capacity barrier” ITA: Paris.

[39] Wiener, E.L., Chute, R.D. & Moses, J.H. (1999) Transition to glass: pilot training for high –technology transport aircraft. Flight Safety Digest. Special issue. June-August.


x Project C24/2004 - EEC Note No. 13/05

Page intentionally left blank

Changes in ATM Safety Culture due to New Technology EUROCONTROL

Project C24/2004 - EEC Note No. 13/05 1

1. INTRODUCTION

This report is the final deliverable for project EEC TRS: C24/2004 Safety Culture in Future Air Traffic Management (ATM).

Over the last few decades, as technology has become more reliable and systems more complex, greater emphasis has been placed on the reliability of the human and organisational components of safety-critical, socio-technical systems within industries such as ATM, nuclear power plants and railways. This project focuses on the contribution that safety culture makes to system reliability.

The premise behind this work was that the existing safety culture in European ATM has, historically, made a considerable contribution to its excellent safety record. However, the nature of the work that ATCOs carry out has changed, and will continue to change, as new technology is introduced. This new technology is necessary to ensure that increasing traffic levels can be accommodated safely. The aim of this project, therefore, was to investigate the possibility that new technology might disrupt the existing safety culture.

A limited number of projects have been undertaken within the ATM to investigate the impact of automation on controller working practices, such as the RHEA project (Kirwan, 2001) and the SHAPE project (EUROCONTROL, 2003a,b, 2004a,b,c). In the European Commission IVth framework RHEA project, the role of the controller in future ATM was reviewed (Kirwan, 2001). In this study, 23 potential controller roles were identified (e.g. decision-maker, optimiser), and seven potential levels of automation were postulated (e.g. ‘controller monitors only and over-rides when necessary’; ‘machine carries out certain predictions and gives advice to the controller’). The study analysed the impacts of automation on the cognitive function (e.g. decision-making, situation awareness); performance shaping factors and the types of cognitive errors that could occur during future tasks. Most relevant to the current study are the 10 performance shaping factors that were proposed as possibly being impacted by future automation. The list below includes summary descriptions of the findings from the Kirwan (2001) study:

• Workload – the nature of the work may change, rather than a decrease in workload.

• Loss of the picture; out of the loop; disengagement – not able to build the picture and maintain it to the same level that is current today.

• Experience and de-skilling – many of the levels of automation were thought to lead to some de-skilling, although some new skills will be required. The main issue is if the system fails and the required skills have decayed, the controller may not be able to take over.

• Monotony, boredom, morale; motivation – motivation and morale may drop due to controller perceptions of their new role in the automated system.

• Trust – it is essential that the controllers trust the system if it is to survive and be used. System failure should only occur with some warning and build-up and ideally degrade slowly and be easy to recover from failure.

• Team resource management – automation could change the existing team structure, and the team may comprise the human and the machine, where the machine may give proposals to the controller.

• Intention awareness – where there is some automation, there is the potential for the controller to lose awareness of the current intentions of the system, or that they may have opposing intentions

EUROCONTROL Changes in ATM Safety Culture due to New Technology

2 Project C24/2004 - EEC Note No. 13/05

• Over and under confidence – over-confidence that the system will function, may result in system errors that are not detected, and the system outputs are not properly checked and evaluated

• Individual differences – there will be individual differences with respect to the preferred level of interaction with the system, and controllers will have different cognitive approaches and heuristics. The new systems could either homogenise controllers’ strategies according to best practice or be a flexible system that can accommodate a range of controller styles.

• Loss of controller flexibility – due to automation, controllers may be expected to become more rigid in their work patterns and solutions which may mean they cannot perform under novel or extreme situations and there may also be a shift from being proactive to anticipatory.

The summary findings from the cognitive error analysis were that the most automated level (“controller as supervisor”) was evaluated least favourably and the three “support” categories were evaluated as most promising. However, as described by the analyst, the evaluation approaches were exploratory and were based mainly on the judgment of one analyst.

The other project, SHAPE – ‘Solutions for Human-Automation Partnerships in European ATM’ (EUROCONTROL, 2003a,b,c,2004a,b,c), is a project dealing with a range of human factors issues raised by the increasing automation in European ATM. A set of guidelines that includes measures and methods to support the design of new automated system and the definition of training needs were developed. The seven issues covered include: trust (2003a), situation awareness (2003b), workload (2003c), teamwork (2004a), age and experience (2004b), skill set requirements (2004c); and managing system disturbances in ATM (2004d). The ‘trust’ and ‘teamwork’ sections are particularly relevant to the current study (safety culture dimensions) and these sections are described in more detail.

For the ‘trust’ dimension, a tool was developed for use by controllers during simulations to measure their feelings of trust towards a system under development called SATI (SHAPE ATM Trust Index). The SATI tool measures controllers’ level of trust by asking them to rate and rank ‘trust’ on 7 sub-dimensions: reliability; accuracy; understanding; faith; liking; familiarity; and robustness. The tool was evaluated while being used during the CORA2 simulation and they found that controllers had difficulty with the term ‘trust’ and that they either trusted and used the system or did not trust the system and did not use it (EUROCONTROL, 2003a). They found that perceived usefulness of the tool impacted on whether it was used or not; the lower levels of trust were related to the way in which the tool failed rather than the number of times it failed (for example, the controllers were less likely to trust the system if it missed a simple head-on conflict rather than if it missed a complex conflict). During the evaluation of the tool, the developers found various aspects of the tool and the analysis process that need to be improved, such as interpretation of the results, the relationship between trust of tools and trust of colleagues and pilots, and strategies to feedback the results to designers.

The ‘teamwork’ dimension, composes 3 components, which were measured with the help of three tools to be used during simulations: an observation tool, a questionnaire and a self-rating form. The components of teamwork included: ‘team co-operation’ – is a set of skills that is team-process oriented, such as the skills required to help a controller who has become too busy or the skills to ensure that a fellow team member understands your plan; ‘team co-ordination’ – is a set of skills that is ‘outcome’ or ‘product’ oriented, such as making a decision or information update and ‘attitudes towards teamwork’ – includes items such as the belief in the importance of team work; team spirit and team cohesion; shared vision and mutual trust in the team. Some of the items in the scale were validated during a simulation.



It is anticipated that the work described in the current report will add a different dimension to the previous work carried out in ATM on the impact of automation on controllers working behaviour, by including research on safety culture and including the perspectives of current air traffic controllers. Although some of the same topics have been covered, it is thought that the method of analysis (i.e. interviewing controllers) has provided a different perspective to the topic, adding a further legitimacy check. Furthermore, it is hoped that the research has brought the controllers closer to the research that is being carried out at EUROCONTROL on future ATM systems.

Objectives

To understand the potential impact of new technology upon safety culture in ATM, the following questions were considered:

• What is safety culture?

• Does the nature of safety culture in ATM differ from safety culture in other industries?

• How has safety culture been affected by the introduction of new technology in the past?

• How might safety culture be affected by the introduction of new technology in the future?

The overall objectives for this project were to: i) gather evidence for the impact of new systems on safety culture and ii) examine the potential impact future ATM functions may have on safety culture that could potentially affect safety.



2. METHOD

Three activities were undertaken to address the issues described in the previous section: A literature review; a survey of ATCOs; and a survey of individuals involved in the development of new technology for ATM.

LITERATURE REVIEW - Safety culture dimensions for survey

SURVEY DEVELOPMENT - Development of structured interview

- Selected 4 ANSPs - Organised site visits

REPORTS - Individual ANSP Reports

- Final Report

SURVEY - Survey of controllers at 4 ANSPs

- Survey of 4 technology developers (EEC)

Figure 1: Method for current project

These activities are described in more detail in the following sections.

2.1. LITERATURE REVIEW

2.1.1. Outline of Literature Review

The two main aims of the review were:

1. To review the research literature for models and taxonomies of safety culture that are likely to be most applicable in an ATM environment.

2. To review the research literature for evidence of the impact of the introduction of new technology upon safety culture.

It was not the aim of the literature review to cover the extensive material in this area exhaustively. Instead, an overview of the literature felt likely to provide insights into ATM was considered as an input to the design of the survey questionnaire.

Prior to the start of the review, it was anticipated that little literature would directly address the impact of new technology on safety culture. This expectation was borne out by the review. To circumvent this problem, the dimensions of safety culture identified in the first stage of the review were used to screen the literature on technological change during the latter part of the review.



2.1.2. Literature Review Outputs

The full literature review is included as Appendice A; a brief summary is included below.

Definition and characterisation of safety culture.

Most reviewers trace interest in the term safety culture back to a 1986 report published by the International Atomic Energy Agency (IAEA) into the Chernobyl disaster. The report noted the importance of management and organisational factors for safety. However, since this date, whilst there had been considerable research effort applied to these issues, many reviewers have lamented its fragmented nature. Issues that have been mentioned include the lack of an agreed definition; different conceptualisations by different research communities; the lack of an underpinning theoretical model; confusion over the relationship to other concepts (e.g. safety climate and organisational climate and culture) and disagreement over the dimensions of safety culture.

However, there is a broad agreement that safety culture has an impact upon safety performance. Therefore, organisations with a positive safety culture can be expected to have a good safety record. Secondly, there is consensus that safety culture is a stable, enduring characteristic of an organisation.

One group of researchers1, working in the context of aviation, reviewed the safety culture literature and proposed the following definition.

“Safety culture is the enduring value and priority placed on worker and public safety by everyone in every group at every level of an organisation. It refers to the extent to which individuals and groups will commit to personal responsibility for safety, act to preserve, enhance and communicate safety concerns, strive to actively learn adapt and modify (both individual and organisational) behaviour based on lessons learned from mistakes, and be rewarded in a manner consistent with these values.”

The assessment of safety culture

Most researchers in this field, particularly those with a background in organisational psychology, have used self-administered questionnaires to assess various dimensions of safety climate. This characterisation of safety culture as multi-dimensional construct brings it into line with other social scientific constructs such as intelligence, making it easier to measure and potentially manipulate.

However, some reviewers have questioned the ability of these methods to capture the emergent nature of safety culture (i.e. the degree to which it is derived from the interaction of the system parts and is not inherent in its individual components). Moreover, the questionnaire approach measures individual attitudes expressed at a given moment in time; the degree to which these instruments can identify the core values that people hold and their degree of commitment to these values is questionable. As a consequence, some researchers have supplemented questionnaires with other approaches such as observation.

1 Wiegmann, D.A., Zhang, H., von Thaden, T., Sharma, G, Mitchell, A. (2002) A Synthesis of Safety Culture and Safety Climate Research. Institute of Aviation, University of Illinois. Technical Report ARL-02-3/FAA-02-2



Implications for the survey

It was not considered within the scope the project to redefine the nature of safety culture or to develop new methods of inquiry. Therefore, a pragmatic approach was proposed based around the use of a structured interview questionnaire designed to cover dimensions of safety culture about which there was some degree of consensus in the literature2. This approach was adopted to allow interviewees time to discuss the issues, with the aim of identifying more potential issues during the discussion. It was also acknowledged that safety culture is only one aspect of an organisation’s culture, and other cultural influences (e.g. national culture) may influence, and may be influenced by, the introduction of new technology. However, these additional influences were felt to be beyond the scope of the current research.

The following dimensions were identified in the review of the general safety culture literature:

• Management attitudes (including work pressure). • Management actions. • Employee empowerment / personal responsibility. • Safety management systems / reporting systems. • Risk (attitudes to). • Reward systems. • Competence. • Procedures.

The reviews of research in specific industries provided support for the inclusion of possible other themes including:

• Teamwork. • Communication. • Training.

Following discussions within the project team it was decided that the focus of the project should be on operational level issues (e.g. teamwork, communication) and not on management level issues (e.g. reward systems, management attitudes). Whilst these issues were felt to be important, it was considered that they were currently being addressed in other EUROCONTROL studies. In addition, other factors, such as trust, were felt, by the project team, to be potentially important in an ATM environment and were also added.

As a consequence, the safety culture dimensions to be evaluated included: teamwork; understanding of competence; trust in people; trust in equipment; understanding of risk; communication; personal responsibility for safety; job pressure; and job satisfaction.

As factors collected from a range of sources, it was recognised by the project team that these factors might have some limitations. One issue identified at this early stage was the degree of overlap between the factors. Teamwork, for example, whilst included as a factor in its own right, is closely related to factors such as understanding of competence, trust in colleagues and communication.

2 This approach, one of renaming and regrouping dimensions used by individual researchers to “provide a small set of common denominators to classify dimensions under” was suggested by Guldenmund (2000) in The Nature of Safety Culture: a review of theory and research. Reliability Engineering and System Safety. Vol. 34, 215-257.



2.2. SURVEY OF ATCOS

Following the literature review, a survey questionnaire was developed and administered at four Air Navigation Service Providers (ANSPs) in Europe (Maastricht UAC (Upper Area Control), Shannon ACC (Area Control Centre), Lisbon ACC and Zürich ACC). The purpose of the survey was:

• To obtain controller feedback on the appropriateness of the safety culture dimensions for the ATC context.

• To survey controllers’ opinions about the impact of the introduction of previous technology upon these dimensions.

• To survey controllers’ opinions about the potential impact of future technology upon these dimensions.

The four ANSPs were selected on the basis of being sufficiently different in geographical location across Europe, their availability and willingness to participate in the survey and recent experience of changes in technology in the centre. Thirty-three individuals were interviewed across the four ANSPs. This included thirty controllers and three supervisors. The interviewees were chosen by the project contact at each individual ANSP, usually based on availability or interest in the project. The participants covered a wide range of experience levels.

At each ANSP every interviewee was read a brief introduction to the project and informed that their contribution would be treated confidentially. Interviewees were advised that the interview would last one hour. In practice, interviews lasted between 30-90 minutes depending upon the time the ATCO had available. Where time was short, questions were left out at the discretion of the interviewers, although an attempt was made to ensure that all of the questions were asked of at least some of the controllers.

The questionnaire included some general introductory questions and specific questions covering the ten selected safety culture dimensions. For each issue, the interviewees were asked the following questions:

• How important is this issue for safety? • How does this issue operate at this ANSP (e.g. what constitutes good teamwork here)? • How, if at all, was this issue affected by the changes experienced at this ANSP? • How might this issue be affected by potential future changes?

A list of potential future changes was described to the interviewees in outline form at the start of the interview.



2.2.1. Summary of Past Changes Discussed at Interviews

A range of different changes had been experienced in the recent past at the ANSPs that took part in the survey. These included:

• The introduction of new Human-Machine Interfaces (HMI).

• A new electronic depiction of unavailable airspace (e.g. when required for military use). Previously ATCOs were required to manually draw maps to indicate which areas were unusable.

• A change in control room location, coinciding with the introduction of a new Human-Machine Interface (HMI)

• The introduction of a Short Term Conflict Alert (STCA).

• A reorganisation of upper airspace to include an additional level.

• The introduction of an On-Line Data Interchange (OLDI) system for electronic communication of information between sectors.

• The introduction of a Verification And Resolution Advice (VERA) system to assist in conflict detection.

• The introduction of a Medium Term Conflict Detection (MTCD) system.

• The introduction of basic datalink system.

2.2.2. List of Principal Future Changes Discussed at Interviews

Interviewees at each of the four ANSPs surveyed were asked for their opinions about the following four potential innovations:

• Medium Term Conflict Detection (MTCD) – is a planning tool rather than an alerting tool. The idea of MTCD is that the planner controller can be more supportive to the tactical controller by: assisting the tactical controller; solving problems strategically; performing co-ordination; monitoring tactical workload and updating the system.

• Conflict Resolution Assistant (CORA) - the aim of CORA (Conflict Resolution Assistant) is to provide system defined resolution advice to air traffic controllers to support them in the identification, prioritisation and resolution of predicted conflicts in the form of computer-based assistance tools, including an associated evolution of ATC procedures, roles, tasks, and working methods (EEC external website)

• Datalink - will provide controllers with a second communication channel to pilots that can be managed either by the tactical or planning controller. (EUROCONTROL, 2004e).



• Airborne Separation Assurance System (ASAS) – is a new allocation of tasks between the controller and flight crew, where the flight crew can be tasked by the controller to maintain a spacing behind another aircraft. The key driver is the increase of controller availability through this reorganisation of tasks. The motivation is neither to “transfer problems” nor to “give more freedom” to flight crew, but really to identify a more effective task distribution beneficial to all parties (CoSpace website).

2.3. SURVEY OF TECHNOLOGY DEVELOPERS (AT EEC)

It proved difficult for interviewees in the ANSP survey to assess the potential impact of new technology of which they had no experience. The third project activity, the survey of technology developers, was designed to address this issue. Typically, these interviewees were ex-controllers currently involved in the development of new tools at EUROCONTROL. The tools included were based on the individual’s availability during the week in which the survey was conducted. They possessed an in-depth knowledge of the technical details of these projects and, in some cases, had participated in simulation exercises.

Four interviews were conducted for this activity. All of the interviews were attended by a single interviewer and interviewee, with the exception of the CORA interview where two interviewees and interviewers were present. As with the first survey, every interviewee was read a brief introduction to the project and interviews lasted between 30 - 90 minutes, depending upon the time that was available. Again, where time was short, questions were left out at the discretion of the interviewers. The technology developers were asked for their opinions about the potential implications of their tool for safety culture. The following tools and systems were discussed with these individuals:

• Conflict Resolution Assistant (CORA) – described above

• C-ATM - The objectives of this project are to improve today’s safety levels, to increase system capacity and improve efficiency and predictability of the European Air Transport System and to contribute to maximising airport operating capacity. This will be undertaken with co-operative systems and processes in order to: optimise task distribution between air and ground actors; improve decision making through sharing common data across the system; optimise system capacity through dynamic flow management and 4-D trajectories and contribute to a better situational awareness of air and ground actors. (C-ATM, 2004)

• Arrival Manager (AMAN) – provides controllers with support in managing inbound traffic, and is expected to provide the following benefits: more efficient distribution of delay; minimising deviations; optimal use of available ATC capacity; optimal use of available runway capacity; optimise overall controller workload; improved quality of information on accurate times of arrival to airport operators, aircraft operators and pilots; absorption of ground delay. (EUROCONTROL, 2003c)

• Datalink – described above

There are clear differences between the future tools that have been considered during this project. Some tools use alternative technology solutions to alter the mechanism by which tasks are executed (e.g. datalink). Other tools attempt to provide support for controllers to allow them to execute tasks more effectively, efficiently or safely (e.g. AMAN). Finally some tools (or concepts) redefine the nature of ATM and the way it is provided (e.g. C-ATM). One might anticipate that some of these tools will provide different challenges to acceptance, and have a different impact upon tasks (and safety culture) than previous technological innovations.



3. SAFETY CULTURE DIMENSIONS

The following sections contain a review of each of the safety culture dimensions, based on inputs from all of the three activities carried out during the project. They include issues that were consistently reported by interviewees, but also selected comments and anecdotes that the interviewers judged to be perceptive or interesting. Therefore, the following paragraphs, in particular the discussions at the end of each section, use the project work to identify potential pathways by which changes in technology may affect safety culture. They should be read in this spirit, as possible changes, rather than as issues that will definitely arise following a particular change.

The safety culture dimensions evaluated in this survey were:

• Teamwork. • Understanding of competence. • Trust in people. • Trust in equipment. • Understanding of risk. • Communication. • Personal responsibility for safety. • Job pressure. • Job satisfaction.

3.1. TEAMWORK

3.1.1. Characterisation of Teamwork in ATC

Most of the controllers were agreed that their immediate team consists of the planning and executive controller. This is supplemented by an extended team about which there was less agreement. Controllers variously mentioned neighbouring sector controllers, adjacent ANSPs, assistant controllers and technicians. At sites that operated in specific shift teams, the shift itself represented their main understanding of the team unit. Very few controllers mentioned pilots when discussing teammates, although they often discussed them when talking about other dimensions such as communication and trust in people.

Whilst there was some variation in the description of teamwork given by the controllers, the following factors were mentioned at regular intervals:

• Having the same technical understanding of the job.

• Having an ability to understand the way other people work and to be sensitive to different ways of working (one controller explained how they might introduce a new strategy or action to the executive controller by saying ‘would you like me to do this?’).

• The ability to put personal differences aside.

With regard to the acquisition of team skills, some interviewees felt that it was an important attribute to have prior to starting work, others felt that it was obtained during training and/or through experience. One controller had observed that newer controllers were receiving better training in teamwork skills than their predecessors; others stressed the value of Team Resource Management (TRM) training.

Some controllers mentioned the virtue of having a good supervisor who understands the relationships between controllers and pairs them accordingly.



ple, communication) which may be considered to be elements of teamwork.

logy

ATCO x

There a tion across the ANSPs in the controllers’ experience of the impact of new technology upon this dimension. Many of the comments involved specific issues, mentioned by on o colleagues. For example, one controller felt that tools like STCA had adversely affected teamwork because they made it easier to see other peoples’ errors. Anoth w trol room location could have adversely affected their relatio h ontrollers who were now more geographically remote.

However, some issues attracted agreement between controllers, and in some cases between two ANSPs that had recently received new HMIs, the controllers reported

in teamwork. The principle change had occurred in the working relationship between the planning and executive controllers. As a result of the change, they both, for the first

lly, this had resulted in some confusion about the precise roles each should undertake, but over time, it had led to greater discussion between the

ing change.

ATCO x

CORA pUnusuallit and sug rs to analyse. In this e The impression gained from the interviews was that soaction. particula

3.1.2. Importance of Teamwork for Safety

All of the interviewees felt that teamwork was critical to safety performance. Twenty-three out of the 33 controllers were asked to list the three that were most important to them (controllers from the first ANSP surveyed were not asked to make this list). Nineteen of the twenty-three controllers surveyed, felt that it was important enough to include in their top three dimensions (see Summary Table 2, page 41). This was by far the highest rating in the survey (the next most important was trust in equipment which received twelve votes). Its high rating may, in part be explained by the degree of overlap it has with some of the other dimensions (e.g. understanding of competence, trust in peo

3.1.3. Potential Vulnerability of Teamwork to New Techno

e perience of past changes.

w s considerable varia

e c ntroller but not by their

er as concerned that a move of conns ip with tower c

ANSPs. For example, atconsiderable changes

time, had access to the same information. Initia

two controllers about potential courses of action.

At another ANSP, a new OLDI system had significantly reduced the amount of time the controllers had to spend verbally communicating with other sectors. The ATCOs reported that this had improved teamwork between the planning and executive controllers, as they had more time to talk to each other. On the negative side, however, they reported that it was harder to develop a good working relationship with adjacent ANSPs.

A general issue, reported by several controllers, was a greater need for teamwork immediately following a change, whilst the controllers became accustomed to the alterations. In this sense, teamwork may be seen as an effective tool for facilitat

e pectations of future changes.

rompted some interesting responses from interviewees with regard to teamwork. y, in terms of new tools that controllers have experience of, CORA will take data, analyse gest solutions to its users, rather than simply providing data for the controlle

s nse, CORA will become part of their team. me controllers are sensitive about having suggestions made to them about courses of

For some, it is possible that this would be akin to having their competence questioned, rly when there are typically several different potential solutions to a problem.



CORA prompted a wide range of responses. Some controllers felt that it might reduce the amount of necessary teamwork, as the need for discussions about courses of action would be reduced. However, others took the opposite position, feeling that the CORA outputs might prompt more discussion. Some also indicated that it could lead to a greater consensus about the best way to control, as CORA would provide a standard against which to compare controllers’ actions. Several of the ATCOs explained that, for a tool such as CORA to be accepted, its suggestions would need to have high face validity. That is, its decisions should seem sensible to controllers and they should be able to interrogate the system for its reasoning.

Very few of the controllers discussed ASAS with regard to teamwork. However, two controllers felt that the change would require closer cooperation with pilots.

MTCD was generally discussed in conjunction with CORA, and many of the comments made about CORA were also applied to MTCD. One controller expressed the opinion, perhaps anticipating that these tools might ultimately lead to the merging of the planning and executive controller roles, that a pair of controllers working together would be better than relying on systems such as MTCD.

Several controllers, when making reference to datalink, a tool that they anticipated would reduce verbal communication, emphasised the importance of verbal communication to good teamwork.

Technology developers’ expectations

• CORA: The developers felt there would be some interesting teamwork implications arising from a tool such as CORA. The main anticipated change is that the planning controller will take on more tasks and have more of a troubleshooting role. However, the current time window for CORA is twenty minutes, which will mean that the planning controller will be required to share their situation awareness with the executive controller. One potential issue is that there may be fewer tasks for the executive controller to do, as a result of a general shift towards proactive traffic management and away from a reactive controlling style, which may affect the relationship between the two roles.

• C-ATM: This interviewee felt that there would be a significant shift in the role of the planning controller. Some ANSPs would choose to have a single multi-sector planner to replace several single-sector planners.

• AMAN: The developer was keen to stress that every new tool, whatever its purpose, would be adapted by each ANSP to suit their own local working environment. One specific change that AMAN might initiate is the creation of a new role called a sequence manager whose responsibility is to take an overall view and initiate back-coordination with other sectors.

• Datalink: the interviewee did not feel there would be many significant implications for teamwork arising from the tool. However, it was stressed that it would be important to develop procedures that described how tasks should be shared.

Discussion

Teamwork, and in particular the relationship between planning and executive controllers, is fundamental to effective air traffic control. The relationships that exist between different roles have typically developed over a long period of time. However, based on the discussion of past changes, it appears that teamwork is particularly sensitive to the introduction of new technology. For example, changes such as the introduction of a new HMI altered the information available to these individuals and, consequently, the teamwork dynamic.



continue to be affected by the introduction of future

rior to the introduction of a technological change will significantly assist in the implementation process.

e management of change process. At present there appears ollers to work together to help ensure the success of new

agreed that they adapted their working style to suit their colleagues. In the first instance, this understanding is developed with their immediate

One apparently important aspect, frequently mentioned by ATCOs, is the ability to understand a

erviews how the ATCOs developed these assessments of

The ATCOs anticipated that teamwork would technology. For example, decision support tools such as CORA and MTCD were thought likely to influence team relationships further. Some of the technology developers even talked in terms of creating new roles to support some of the new concepts, such as the creation of a multi-sector planning controller. These changes will result in significant changes in teamwork. However, the planning and implementation of these changes will largely determine the extent to which there is a net positive or negative impact upon teamwork.

Controllers at one ANSP described how confusion over the precise allocation of roles and responsibilities followed a significant reorganisation. Role analysis and role definition p

One interesting insight, provided by an interviewee, was the value of teamwork, not just for day-to-day operations, but for smoothing thto be a willingness amongst contrtechnology.

3.2. UNDERSTANDING OF COMPETENCE

3.2.1. Characterisation of Understanding of Competence in ATC

This dimension, as derived from the literature, addressed the understanding individuals have of the competence of their colleagues (i.e. not their individual competence, but their understanding of their colleagues’ competence). In the ATM environment, however, it became clear that a broader topic, understanding of colleagues (encompassing experience, age, confidence, competence and preferences of their teammates) was an important input to teamwork.

The vast majority of the interviewees in the survey

colleagues (usually the planning or executive controller they are working with). However, several of the interviewees explained that they extend this adaptation to the aircraft and other ANSPs with whom they interact. For the supervisor, an understanding of these qualities is thought to be an important input into the selection of individuals who work together.

wide range of personalities. Some individuals may not like to have suggestions made to them by colleagues, whereas others like the idea of ‘two pairs of eyes’ looking at the same area and welcome comments.

However, it was less clear from the inttheir teammates. Several talked generally about experience of working with individuals. However, at one ANSP, controllers were not organised into teams, therefore individuals, on any given day, could be paired with one of a hundred individuals. In these situations, other strategies must be necessary to develop an understanding.



nology

because of the visual indication the system provides when something has gone wrong.

extended amounts of information had made it easier to make assessments of their colleagues as a ble.

Howe rrequiring assess e

ATCO ex

Several omask thecontroller nally with the automation switched off, in order to maintain their competence.

Howeverprompt m tter understanding of their colleagues’ abilities.

Techn lo

• Cpc uently increase the confidence their colleagues have in their ability.

• Accolleagues. between TMA and

roach controller. Currently, the TMA controller may feel that the approach controller sequences in an inefficient manner, causing a backlog in TMA. With the introduction of

3.2.2. Importance of Understanding of Competence to Safety

Most of the interviewees stated that this was an important aspect of safety, however only two out of twenty-three individuals rated it in their top three most important safety culture dimensions (see Summary Table 2). This may have been due to its close relationship with teamwork, which was rated as a top three factor by nineteen of the twenty-three people asked.

3.2.3. Potential vulnerability of understanding of competence to new tech

Experience from past changes

In general, most of the interviewees felt that the changes they had experienced had made little difference to their ability to assess the qualities of their colleagues.

A few controllers felt that the STCA system had made it easier to judge the ability of a controller

One controller observed that the introduction of an enhanced HMI and its ability to provide

result of the extra time they had availa

ve , a supervisor felt that the HMI changes had led to a proliferation of extra information more collaborative work and discussion. This, in turn, had made it slightly harder to

xactly which controller was responsible for decisions over choices of action.

pectations of future technology

f the interviewees expressed the opinion that new technology like CORA and MTCD may competence of controllers. This was particularly mentioned with reference to new s. One suggestion was that controllers should be required to work occasio

, on the positive side, one controller felt that the information these tools provide might ore discussion between controllers, leading to a be

o gy developers’ expectations of future technology

ORA: The developers’ expectations for CORA was that it might extend the role of the lanning controller, allowing them to take more actions independently of the executive ontroller, and conseq

MAN: The interviewee felt that the AMAN technology should raise the general standard of ontrolling and increase its consistency, making it easier for ATCOs to understand their

This point was illustrated by a hypothetical relationshipApp

AMAN, the approach controller will receive greater support and the TMA controller a greater understanding of how the work is organised.



lved better presentation of information, or new ways of communicating information, whilst always leaving the decision-making to the controllers. The controllers’ concern was that,

s technology might mask who actually decided on the course of action, the technology or the controller. This was tied to a deeper concern regarding

y is unavailable. Several uired to practise with the

these differences in mind.

ible for the action.

3.3.2. Importance of Understanding of Trust in People to Safety

Most of the interviewees stated that the ability to trust people was an important factor in safety. However, only three out of twenty-three interviewees chose it as one of their top three factors for safety (see Summary Table 2). The consensus was that, whilst trust is important, it is a prerequisite for the job (i.e. controllers cannot operate unless they have trust in their colleagues).

• Datalink: the interviewee was of the opinion that the technology would force the use of consistent, standard messages, taking the variability out of the system and removing non-compliant messages. Thus incompetent instructions will be removed and differences between controllers will be reduced, making it easier to understand how people are likely to work.

Discussion

The consensus amongst the interviewees was that previous changes of technology have made little difference to their ability to understand the competence or preferences of colleagues. This might suggest that this dimension of safety culture is resistant to alteration through the introduction of new technology.

However, several interviewees anticipated that some of the future technology, such as CORA, might potentially mask the competence of a controller. CORA is different from most of the changes the interviewees have experienced in that it suggests courses of action. Previous changes had, for example, invo

particularly with newer controllers or trainees, thi

the ability of future controllers to cope when supporting technologcontrollers expressed the opinion that controllers should be reqtechnological support switched off, as a way of maintaining fundamental skills. An alternative, more positive view is that these tools will promote discussion between controllers about the reasons behind decisions, helping controllers understand each other and their technology.

The feedback from the interviews emphasised that controllers recognise their differences (e.g. in ability, in preferences) and, where possible, adjust their behaviour withThis appears to be an important element of teamwork. Previous technological changes have made little difference to this ability; however newer technology may have more of an impact.

3.3. TRUST IN PEOPLE

3.3.1. Characterisation of Trust in People in ATC

This topic, which was included as a dimension following project team discussions, is closely related to the understanding of competence, discussed in the previous section. Like understanding of competence, trust in people forms an element of teamwork.

As with the previous topic, understanding of competence, controllers explained how they adapt their behaviour to match the individual with whom they are working. For example, some controllers talked about not expecting older controllers to work in the same way as their younger colleagues. One controller described how, by assessing a situation outside of his direct control and deciding on a sensible course of action, he could increase redundancy in the system by matching his analysis with the intentions of the controller respons



logy

ever, this was not to do with the characteristics of the tools, more a reflection of the increased likelihood of errors as people

es

yet to be

attitudes to llers had indicated that they were less likely to trust a

suggestion originating from a tool such as CORA than a suggestion made by a colleague.

uggested that some controllers test each other, and their equipment, by letting situations

Discuss

The eintroducprerequ

Howevedifferento collethey had wo al trust facilitates efficient working. Therefore, experience of working with specific individuals may have an impact upon the degree of trust they feel. Therefore, if new technology, or the way work is organised, reduces the ability of controllers to develop the second level of trust, the efficiency with which work is carried out may be affected.

3.3.3. Potential Vulnerability of Trust in People to new Techno

ATCS experience of past changes

Most of the controllers felt that the changes they had experienced had made little or no difference to their ability to trust their colleagues. A few controllers mentioned that they were initially more wary of their colleagues’ actions following a change of technology. How

adapt to new ways of working.

ATCO expectations of future chang

Very few of the interviewees were able to anticipate changes in their ability to trust people as a result of future technology, beyond suggesting that any new technology would require a period of adjustment before controllers were fully competent in its use.

Some controllers mentioned datalink and ASAS, suggesting that these tools would require them to invest far greater trust in pilots, although whether this is a positive or negative change isdetermined. A suggestion for maximising the benefit of this interaction was to organise more joint seminars involving both controllers and pilots. With regard to CORA, one interviewee was concerned that it would be harder to tell how good a trainee controller was, potentially making it harder to establish trust in their ability.


• CORA: The developer explained that, in a previous survey of ATCOs’ automation and change, contro

• C-ATM: This developer made the point that younger controllers trained with new technology will be more likely to trust it than those that have been trained with current technology.

• AMAN: The AMAN developer observed that trust between controllers develops, not from the technology they use, but from the experience they have of working together. He sdevelop to see how well they will be handled.

• Datalink: the interviewee did not feel that datalink would have an impact upon issues of trust.

ion

fe dback from the interviews suggests that this dimension is unlikely to be affected by the tion of new technology. Controllers regard the ability to trust their fellow controllers as a isite for doing their jobs.

r, one controller explained that there were different levels of trust that they would apply to t colleagues. The basic level would apply to new colleagues, the second level would apply agues they had experience of working with and the final level would relate to colleagues

rked with and knew socially. It is possible that this addition



Som futhe actcontrollTrust in

T IN EQUIPMENT

ected this topic. Most of the controllers felt that a trust in equipment was a

ked to

of Trust in Equipment to New Technology

ATCOs experience of past changes.

period of familiarisation before they will

In general, controllers were keen to emphasise that they would trust new technology in the same ed.

e ture technology, such as ASAS or datalink, may require controllers to have greater trust in ions of pilots. Currently, based on the feedback from the interviews, the majority of ers do not consider pilots to be part of their team; this might need to change in the future. equipment

3.4. TRUS

3.4.1. Characterisation of Trust in Equipment in ATC

The project team selprerequisite for safe operation, particularly in terms of systems such as radio and radar. Several of the controllers explained that trust comes from reliable performance. However, they also explained that a system does not need to be perfect in order to be trusted. For example, if a system fails consistently in the same way then a controller can work around the problem. Therefore, a period of time where the controller tests a system out, learning its strengths, weaknesses and the assumptions it is based on is necessary before it will be fully accepted. Some controllers stated that they tried to maintain a sceptical attitude to any information that they were presented with by their equipment.

3.4.2. Importance of Trust in Equipment to Safety

Most of the controllers felt that trust in equipment was important to safety performance. It received the second highest number of mentions (twelve out of twenty-three), when ATCOs were asrank their top three safety culture dimensions (see Summary Table 2). However, like trust in people, understanding of risk and personal responsibility for safety, controllers view it as a prerequisite for working as a controller (i.e. they would not be able to work if they did not trust their equipment).

3.4.3. Potential Vulnerability

Most of the controllers emphasised that new tools require a be accepted. Factors that speeded up this process of acceptance included:

• Personal relationships with the development team. • Involvement in the development of the tool.

The controllers listed few examples where they had found it difficult to trust technology. One controller described trusting airspace representation (e.g. military zones) more now that it was produced electronically on the display. However, they explained that, in reality, it was no more accurate than the old method of drawing it manually, as it still had to be created by a person.

ATCOs expectations of future technology

way that they have trusted other new systems that have been introduc

In the past, new technology has tended to provide more information for controllers to assess and use in formulating courses of action. For example, STCA alerts a controller to a situation to which they must respond. However, CORA is different in that it takes information, processes it, and suggests potential resolutions to the ATCO.



rust. One explained that s. Another interviewee felt that its

the decisions they would make. Finally, there was some

ke it harder to be confident that pilots understand the requests

gy. A current concern is how to

xpectations of tools such as CORA and explained that initially controllers expressed a desire to have real-time explanations of the decisions

ights applied to CORA’s internal model. If the weighting is more in the

in gaining the trust of a controller will be the credibility of the solutions proposed by the system. Moreover, the solutions should be

• C-ATM: This developer felt that the biggest future trust issue is likely to be related to how ll the various proposed tools work with each other. With regard to the individual tools,

Some controllers felt that this system would require a different type of tthey would need to understand the reasoning behind its decisiondecisions would need to tally withconcern about the legal position of a controller who chooses to disregard the resolution suggested by CORA.

There were also some comments about datalink. Two ATCOs were concerned that, whilst the current process of readback for confirmation was very straightforward, using datalink as the communication channel may mamade by a controller.


• CORA: the developers felt that CORA would have several specific issues that might affect the trust the controllers have in the technoloprovide the best resolutions to controllers at all times. In particular, the situation where a controller looks at the resolutions some time (e.g. 15 minutes) before a conflict is due to occur, but decides not to implement a solution at that stage. A challenge is to update the resolution as time passes, so as not to irritate the controller with constantly changing resolutions, but still provide the best resolution when needed. They discussed at length their understanding of ATCOs e

CORA makes.

However, in practice, during simulations, controllers have found this type of information to be distracting, even to the point where they prefer the system to present them with a single suggestion.

The developers reported that controllers they had previously surveyed had expressed concern about the way the tool will be used by ANSPs, who will have the final decision about the wedirection of productivity than factors such as controller workload then ATCOs may be more reluctant to trust the suggestions CORA makes.

The developers felt that the most critical factor

conflict free and not create further problems for the controllers to manage.

weit was felt that the biggest single issue would be overconfidence in their abilities. The interviewee anticipated that tools that were based on effective trajectory prediction would quickly gain the trust of a controller.

• AMAN: For this interviewee, the most critical factor in gaining the trust of a controller was the credibility of the solutions proposed by a system. As an illustration of this, a trial of the AMAN system was described where controllers’ solutions had a high degree of agreement with those proposed by the AMAN system. This helped the controllers develop trust in the technology.

• Datalink: The interviewee felt that all changes would be easier for younger controllers to accept and trust.



eported effects were short term trust issues whilst controllers got used to the way the new technology worked. In order to accept new technology, the importance of positive

e ability to be involved in the development and implementation

be able to trust future technology in the same way that they trusted prior technological innovations. However, it is possible that technology

rd multiplied by the likelihood of its release. llers are well aware of the potential

er topics identified in the literature review, this concept was developed from reviews r relevance to

l of the interviewees, which is repeated right through their working day, is the assessment of the risks associated with a

ould be straightforward were safety the only issue. However,

ecessary. However it is an s

Risk to Safety

as a prerequisite ability

Discussion

Based on the comments from the interviewees during the interviews, trust in equipment appears to be one of the most stable safety culture dimensions in the face of the introduction of new technology. Most r

reports from other sites and thprocess were stressed.

The interviewees were equally confident that they would

such as CORA will require a type of trust that controllers have never had to display previously. Specifically, CORA will evaluate information and suggest decisions to controllers, something which previously controllers have always done. Therefore, whilst this dimension appears relatively stable it should be considered in the light of new types of technology.

3.5. UNDERSTANDING OF RISK

3.5.1. Characterisation of Understanding of Risk in ATC

Risk is normally described as the magnitude of a hazaATM is a high hazard industry, one where the controconsequences of an erroneous action. Controllers who were surveyed during this project supported this notion. However, several of the controllers emphasised that, in order to operate, it is necessary to put the hazards to the back of their mind. For example, they do not look at their radar screen and mentally calculate the number of people on each aircraft. Instead, they view the aircraft as ‘spots on the radar’.

As with the othof other industries such as construction and offshore oil and gas, and is of particulaATM. This is because one of the ATCOs’ main tasks, as described by severa

course of action. This assessment win an increasingly commercial environment, controllers have to choose safe, but also productive, courses of action. Clearly, the decision is strongly weighted towards safety, and the controllers have the option of reverting to a more defensive mode of operation where n

as essment that they have to make.

Several o nstitutes a risk to one controller might not constitute a risk to their colleague. This may be due to differences in ability or in interpretation of risk, but it is manifested in differing styles of control. One supervisor, explained how they did not need ‘top gun’ controllers, instead they wanted average controllers, following simple rules.

f the interviewees explained that what co

3.5.2. Importance of Understanding of

As discussed in the previous section, an understanding of the risks associated with actions is a critical part of a controller’s job. Most of the controllers considered that it wfor a controller to have, although their ability to make decisions would improve with experience. Four of the twenty-three ATCOs surveyed, included it in their most important three factors for safety (see Summary Table 2).



bility in the experiences of the controllers in different ANSPs. Several controllers were of the opinion that the changes had made no difference to their understanding of

ct on understanding of risk. However, STCA had recently been introduced ntrollers at these locations varied in their opinions about its

impact. Most of the ATCOs were keen to stress that, in practical terms, STCA had made no differe enot an odifference

He illustrmay nowfive-mile interviewalarm to impact uwas a powerful reminder of what could go wrong.

ATCOs e

Controlle e of opinions about future tools. From a general perspective, some were concerned that the more technology is introduced, the harder it might be for the controller to assess rianother s

With regaCORA mcontroller how easy controllers would find it to revert to old ways of working if the systems were not functioning.

In terms are an imthat these

Techn o

•

• neral terms about the controller’s understanding of risk. It was explained that whilst there are always rules, controllers develop their own

possible that new technology will provide a consistent set of rules that have to be followed, reducing the need for rules of thumb.

anding of risk.

3.5.3. Potential Vulnerability of Understanding of Risk to New Technology

ATCOs experience of past changes.

There was some varia

risk. However, there was a general appreciation that they had been more cautious in the immediate aftermath of the changes.

One might anticipate that tools designed to provide warnings to controllers, such as STCA, might have the greatest impaat two of the surveyed ANSPs and co

nc to the actions they carried out when doing their job. They regard it as a safety net and perational tool. However, one controller felt that tools such as STCA reduced the between conservative controllers and their more aggressive peers.

ated this by stating that controllers who habitually worked with eight miles of separation allow themselves to operate with six, whilst controllers who used to work closer to the limit may now have extended the separation, to avoid triggering the STCA. Another ee reported hearing stories of people working increasingly reactively (i.e. waiting for an sound before taking action). Two of the interviewees felt that STCA had had a positive pon controllers’ risk perception. Both felt that the use of warnings on the radar screens

xpectations of future changes

rs expressed a rang

sks. For example, one ATCO was concerned about over reliance on automation, whilst poke of ATC becoming ‘one big computer game’.

rd to specific tools, some controllers were of the opinion that tools such as MTCD and ight help ATCOs to review their understanding of acceptable actions. However, some s were concerned about over-reliance on such tools and

of training new controllers, one interviewee felt that the stories that older controllers tell portant method for transferring knowledge about risks. This respondent was concerned stories may become less relevant as new technology is introduced.

ol gy developers’ expectations

CORA: The CORA developers did not believe that the tool will have significant implications for controllers’ understanding of risk.

C-ATM: This interviewee talked in ge

practices, ‘their own rules of thumb’ that enable them to control flows of traffic efficiently. The main issue for controllers, faced with a new technology, is that they have to develop new practices as safe as those developed over a long period of time. This, it was believed, is one of the reasons why controllers have a reputation as conservative and resistant to change. However it is

• AMAN: the interviewee did not believe that the tool would have significant implications for controllers’ underst



However, as far as attitude to risk is concerned, it may lead to controllers feeling increasingly removed from the hazards. One

re experienced controllers were a valuable way for newer recruits to develop an understanding of the risks. It is possible that these stories will become less

rder for experienced controllers to

ntrollers operating in different sectors and between controller and

3.6.2. Importance of Communication for Safety

All of the controllers stressed the importance of communication for safety. Ten of the twenty-three

Discussion

New technology could have a potentially significant impact on a controller’s understanding of risk. Most of the proposed new technology is designed to allow controllers to work more productively whilst, at a minimum, maintaining existing levels of safety. However, as ATCOs recalibrate to the new technology, and the opportunities it affords, there may be a possibility of overestimating the abilities of the technology and resetting their working style at a riskier level.

In addition, there may be some issues related to the transfer of understanding of risk. Whilst most interviewees felt that controllers had a good understanding of risk prior to starting the job, several stressed the importance of experience, and in some cases negative experiences, in maintaining awareness of what can go wrong. It is possible that new technology will increasingly reduce the amount of these experiences.

Clearly, this will be of benefit to the overall safety of the system.

interviewee felt that the stories of mo

relevant as technology moves on, perhaps making it hacommunicate their experience to newer recruits.

3.6. COMMUNICATION

3.6.1. Characterisation of Communication in ATC

The interviewees discussed three main channels of communication: between planner and executive controllers, between copilots. For communication between controllers, the interviewees stressed the value of a shared understanding of the situation and of the critical information to be communicated. Some controllers felt that good communication was facilitated by experience of interacting with a person over a period of time. Others explained how different teams have different styles of communication that are developed over time. Currently, most communication is carried out verbally, however this is likely to change in the future.

For communication between controllers and pilots, the controllers emphasised the same issues but also tended to mention the value of brevity and of standard communication protocols.

However, in addition to the practical value of verbal communication, it also appears to have a social value. Several of the ATCOs mentioned the enjoyment that they derived from communicating with pilots. Finally, one ATCO observed that controllers learn a considerable amount of information about their job by talking with their peers about their experiences.

controllers included communication in their top three dimensions of safety culture (see Summary Table 2).



introduction, would find it as easy to develop a

e time for other tasks, whereas others

For example, a hesitant or

others felt it would

Techn o

• CORA: The CORA developer thought that the main change in communication arising

3.6.3. Potential Vulnerability of Communication to New Technology

ATCO experience of past changes

There was wide variation between the ANSPs in their experiences of changes to communication. Interviewees at two of the ANSPs had experienced little alteration in their communication patterns as a result of new technology. One of the ANSPs was using a version of datalink, about which one controller commented that it took too long to use when compared with verbal communication.

However, controllers at the other two ANSPs reported more significant changes. At the first ANSP a new HMI had been installed which, for the first time, gave both the planning and executive controller the same information. According to some of the controllers, this had a resulted in more discussion between the controllers about this shared information. In addition, controllers were now more physically separate in the control room (i.e. more space between sectors in the new control rooms), therefore communication that previously have taken place face-to-face now took place via telecommunications systems.

At the second ANSP, an OLDI system had been introduced; according to the ATCOs, this had had the effect of significantly reducing the amount of verbal communication that took place between adjacent sectors (in separate centres). Whilst several of the controllers mentioned how much they had enjoyed this interaction, and others felt that it had allowed them to develop a strong working relationship with neighbouring sectors, most concluded that the time savings the tool provided were even more beneficial. However, one of the controllers queried whether a new controller, without experience of working prior to the system’s working rapport with other sectors.

ATCO expectations of future changes

Most of the controllers felt that datalink was likely to have the most profound effect of all of the new tools upon their communication. Most associated it with less verbal communication. Some felt this was a positive change, as it would provide them with morexplained that the reduction in interaction with other people might make the job less appealing. On a more practical level, one ATCO wondered whether standardised communication protocols, such as those used by datalink, would ever be the most efficient form of communication in abnormal situations, where ‘shades of grey’ exist. Moreover, as another controller pointed out, verbal communication can carry information in addition to the basic message.confident response can help a controller comprehend a pilot’s understanding of a message.

MTCD and CORA prompted a mixed response from the interviewees. Some thought it would be llers would discuss its suggestions, whilstpositive for communication, as contro

reduce the need for communication.

ol gy developers’ expectations

from CORA would be an increase in communication problems between the planning and executive controllers (e.g. discussions between the controllers about the reasons for a planning controller choosing a particular resolution). They had also observed an increase in communication between adjacent sectors as controllers check with other sectors that the resolution they wish to pursue is acceptable. It was anticipated that resolutions could be uplinked (using datalink) to pilots.



ATM: This developer felt that there would be a continuing emphasis on minimising rbal communication. However, he was of the opinion that this would not matter to new

, as datalink does not easily support discussions. In addition, at

nsions to change as, like teamwork, some of the proposed technology has a direct impact on the way communication is carried out. Several ANSPs

in the way they carried out communication as a result of new technology. Some of the technology, for example OLDI, had directly affected the amount of verbal

ges, like the introduction of a new control their colleagues.

ce of a pilot. In the longer term, where an individual talks regularly

significant

ides the nfirming understanding. Datalink will certainly onfirmation of receipt. However, confirmation

or which remedial action will be required.

• C-vecontrollers who had never known anything different, however long-serving controllers, used to verbal communication, may find the transition difficult.

• AMAN: This interviewee did not feel that AMAN would have a significant bearing upon communication.

• Datalink: This tool is likely to have the largest effect on communication. The developer felt that some of the biggest implications would require a change in approach by the system’s users. For example, at the moment pilots are used to rapidly being able to query instructions. With datalink, they may have to be more willing to accept the first instruction they receivethe moment all communication is available as broadcast information to everybody tuned to the same frequency. Datalink is designed to communicate a message to a specific target and therefore the overall situation awareness may be lost.

Discussion

This is perhaps one of the most vulnerable dime

had experienced changes

communication they carried out. Whereas other chanroom, had influenced the way they communicated with

With regard to future technology, the consensus was that the proposed future technology was likely to have a significant impact upon communication. There was less agreement about whether the changes would have a positive or negative impact. However, it is clear that there is a trend for a reduction in the amount of verbal communication that takes place. One possible concern is that this reduction will reduce the opportunities for controllers to develop both short and long term rapports with individuals they interact with (e.g. other controllers and pilots). In the short term, verbal communication may provide information additional to the basic message, for example, information about the confidenwith, for example, a controller in another sector, the communication will help the individual develop a better understanding of that controller’s working style, preferences, strengths and weaknesses. The loss of this pathway for developing a mutual understanding, might not have aimpact in the short term, as, in many cases, this rapport will have already been established. Instead the next generation of controllers may have more problems understanding the issues facing the people with whom they communicate.

In addition, issues arise about the quality of communication. Aural communication provpossibility of both transmitting the message and cotransfer a message with more integrity and provide cof understanding is not inherent in the exchange. Advanced applications may well be able to transmit data on an aircraft's response to an instruction or its intentions, which can be used as a check. However, this will be after the event and there remains the possibility of erroneous responses f



for Safety in ATC

ical

se issues are particularly relevant. However, in ATM, where all

nsibility for Safety to Safety

Many of threspo ibexplainindespite th

Howeverwhere taserode the

3.7. PERSONAL RESPONSIBILITY FOR SAFETY

3.7.1. Characterisation of Personal Responsibility

This topic is perhaps the hardest of the safety culture topics reviewed in this report to translate to the ATM context. Several of the studies that mentioned this issue in the literature review took place in manufacturing, construction, chemical processing, offshore oil and gas and chemindustries. In these contexts, personal responsibility for safety was described as including an increased motivation to make a difference to safety and taking individual responsibility for one’s own safety.

It is possible that these concepts relate more easily to manufacturing, process and construction industries than to ATM. For example, in an industry such as construction, where individuals have discretion about the equipment they use and where individuals are most likely to harm themselves as a result of their actions, theATCOs are acutely aware that their actions affect the safety of thousands of people every day, all controllers take personal responsibility for their actions.

This hypothesis was supported by the responses of the interviewees who felt that personal responsibility for safety, whether acquired through training, selection or experience, was a prerequisite for all controllers. Some interviewees noted that, even if the personal feelings of responsibility that a controller feels diminish over time, they are constantly faced with reminders in the form of near misses and accidents.

3.7.2. Importance of Personal Respo

The vast majority of controllers surveyed were of the opinion that this is critical element of safety culture. However, they stressed that all controllers have this feeling of responsibility. Eight of the twenty-three controllers felt that this issue was important enough for safety to include in their top three safety culture dimensions (see Summary Table 2).

3.7.3. Potential Vulnerability of Personal Responsibility for Safety to new Technology

ATCO past experience of changes

Very few of the ATCOs surveyed could identify changes to personal responsibility for safety that had arisen as a result of the introduction of technology. Where STCA had been implemented, controllers emphasised that it had made no difference to the responsibility they felt for safety.


e controllers expressed the strong opinion that no new technology would affect the ns ility they feel for safety. One ATCO drew an analogy with pilots and the glass cockpit,

g that pilots have experienced considerable increases in the automation they use but that, is, they still feel ultimately responsible for their aircraft.

, some other controllers were of the opinion that systems such as ASAS and CORA, ks are delegated to other individuals or systems (e.g. to pilots or technology), may slowly responsibility that controllers feel.



Techn o

•

els are increased

•

• Datalink: The interviewee felt that the changes would not make a significant alteration to responsibility that individual controllers feel.

ve any impact.

ATCOs feel at work.

regulations, relations with managers, getting used to new ways of working).

• External factors (e.g. family problems).

ol gy developer’s expectations

CORA: The developers explained how CORA has been developed as a planning and advisory tool, deigned to support the controller as decision maker and responsible part of the system. However, they indicated a possible danger that if traffic levas a result of such tools and the tools fail, then it could be expected that controllers would have difficulty managing the increased traffic.

• C-ATM: This interviewee felt that the changes encompassed by C-ATM could have a major negative impact upon the responsibility that controllers feel. In particular, ATCOs will have less control over the system, will get bored and, ultimately, feel less responsibility. However, the developer was of the opinion that a different type of ATCO, more of a system manager than a controller, would be required in the future.

AMAN: The developer thought that AMAN would have no impact on the responsibility a controller feels for safety.

the

Discussion

The interviewees reported that previous technological changes had had no impact upon their feelings of responsibility for safety. This was also the general feeling about future technological change. The perception was that this dimension is such a fundamental part of a controller’s job, that it would be inconceivable that the introduction of technology would ha

However some controllers, and technology developers, were less certain about its stability in the face of technological change. Some voiced concerns that this feeling of responsibility may erode over time as more functions are undertaken by automation or distributed to others, such as pilots.

3.8. JOB PRESSURE

3.8.1. Characterisation of Job Pressure in ATC

This dimension of safety culture was obtained from the literature review. It overlaps with management issues, in particular the balance between safety and production required by managers, and is the controllers’ perception of the amount of pressure they feel under at work. Despite this link with management, it was decided to retain the dimension for the survey to try to establish the factors that contribute to the pressure

The interviewees described a wide range of factors that contribute to the pressure they feel at work. These included:

• Task factors (e.g. traffic complexity, traffic levels, weather conditions, confidence in the system, emergencies, requests form pilots).

• Organisational factors (e.g. complying with



the effects of pressure was emphasised by two ATCOs at one of the ANSPs, who described how the management response to controller

However, several controllers reported that some pressure was necessary in order to remain

the process of change that had increased the amount of pressure they felt.

ated that there had been a

duce pressure in the short term, in the longer term this reduction will be filled by an increased

ffic they should be able to manage.

tion with pilots that a tool such as ASAS would require might

uld not increase the amount of

The importance of management attitudes in mitigating

mistakes has a significant impact upon the pressure they feel.

focused whilst carrying out work. One controller explained that it was harder to take efficient action when disengaged from the process (for example, during a quiet period).

Finally, it was clear from the responses of the interviewees that the amount of pressure felt by controllers is very much an individual consideration.

3.8.2. Importance of Job Pressure to Safety

Most of the controllers expressed the opinion that job pressure could have a negative impact on safety performance. However, only one person, from the twenty-three surveyed, included it in their top three safety culture dimensions (see Summary Table 2).

3.8.3. Potential Vulnerability of Job Pressure to New Technology

ATCO experience of past changes

The typical response of the interviewees was that the changes themselves had not led to an increase in job pressure; instead, it was

Where OLDI and STCA had been introduced, some controllers indicsmall reduction in the pressure they felt. OLDI had led to more time to do tasks; STCA had given the controllers an extra layer of protection. However, several controllers indicated that any time savings were rapidly given over to dealing with more traffic.


Several controllers expressed the general opinion that, although new technology is likely to re

expectation about the amount of tra

With regard to specific tools, the general feeling was that tools such as MTCD and CORA, as long as they produce realistic practical information, would reduce the amount of pressure that a controller feels. However, some expressed the view that these tools might introduce a new pressure, as controllers have to discuss and justify their actions more. One controller expressedan opinion that the increased collaboraincrease the pressure that a controller feels.


• CORA: The interviewee felt that the CORA tool itself wopressure that the controllers feel. However, how the tool is used and the weightings of the parameters within the tool will be determined by its users. Therefore, there is a theoretical possibility that the way the tool is implemented may affect the pressure controllers feel.



of the opinion that most of the pressure felt by controllers comes from the complexity of the traffic with which they are required to deal. For

by controllers.

• he current

response times for the communication between pilots and controllers may make it difficult

Discussion

Tools suc rs can deal with traffic more efficiently. This, in the short term, leads to time savings and an associated reduction in pressure. However, it

rly in the busier ANSPs, these savings are rapidly translated into a to manage more traffic. One controller, when describing the discrepancy between the

raffic for

safety purpose, is to make them more productive. The response of the interviewees was evenly

lt that all change was designed to make the system safer and those who felt that productivity was the main driver of change.

sure that controllers feel. For example, it is

It was lejobs. othe controlle of factors:

• od service, responsibility for safety).

rking in a technical environment, the adrenalin associated with working during busy periods).

• C-ATM: This interviewee was

example, one of the busiest controllers in the world, in terms of numbers of aircraft,is the Heathrow tower controller; however, the work that this person carries out is not complex so they are likely to feel less pressure than someone who deals with very complex traffic patterns. Therefore, if concepts such as C-ATM can reduce the complexity of the traffic, this should reduce the amount of pressure felt

• AMAN: The AMAN developer felt that the tool would have no real impact on the amount of pressure experienced by ATCOs.

Datalink: The developer considered that datalink should reduce the workload experienced by controllers, and hence the pressure they feel. However, t

to use in busy approach situations.

h as OLDI and improved HMI mean that controlle

appears that, particularequirementpre-change and current volumes of traffic, explained that previously they would never have believed that they would be able to cope with so much traffic.

It is possible to anticipate some effects of these changes upon the amount of pressure felt by controllers. One effect might be an increase in pressure related simply to the volume of twhich a controller is responsible. Even if the tools facilitate the safe management of the traffic, ATCOs may wonder what would happen if the tools stopped working. However, to some extent, the ability to cope in these situations could be maintained through refresher training. Secondly, controllers may begin to perceive that the principal aim of the new tools, even tools with a stated

split between those who fe

New technology itself may also influence the prespossible that a controller may disagree with a suggested course of action proposed by a system such as CORA. This will then require additional cognitive effort as the controller attempts to resolve the conflict.

3.9. JOB SATISFACTION

3.9.1. Characterisation of Job Satisfaction in ATC

c ar from the survey that ATCOs are, on the whole, highly motivated and satisfied with their H wever, it was also apparent that the factors that give this satisfaction vary widely across

r population. When asked, ATCOs listed a range

Duty factors (e.g. providing a go

• Task factors (e.g. problem solving, wo



ect their job satisfaction

3.9.2. Importance of Job Satisfaction to Safety

rviewees about the importance of job satisfaction

able 2).

y

osmetic changes had made the working environment more appealing. One ols had facilitated solutions that are more elegant, these had

a change in the nature of eral of the controllers voiced concern that systems such as

ASAS, MTCD and CORA will employ them as system managers rather than controllers. Other

more concern to

ntrol aircraft. The developers expressed the opinion roller, as more decisions are made by technology

ure. They cited an example of an American system that had received bad reviews from its controllers. The controllers did not like it because it made it harder for the they woua succesbroader iof provid agement could compensate for any reduction in current levels of job satisfaction.

• Social factors (e.g. communication with pilots, working with motivated colleagues).

• Job benefits (e.g. short working hours, good salary, the ability to leave the job behind at the end of the day).

• Prestige factors (e.g. working in an unusual job, the opportunities for career progression).

In addition, some controllers talked about factors that can negatively affincluding a lack of support from supervisors.

There was a range of opinions amongst the intefor safety. However, the consensus amongst the ATCOs interviewed was that job satisfaction is not essential for safety, but that a satisfied workforce will be more focused and add an extra layer of protection to the system. Five of the twenty-three controllers surveyed included job satisfaction in their top three dimensions of safety culture (see Summary T

3.9.3. Potential Vulnerability of Job Satisfaction to New Technolog

ATCO Experience of past changes

Very few of the controllers surveyed for this project felt that the changes had had an impact upon their job satisfaction. One exception was the ANSP with a new control room; here controllers mentioned that the ccontroller explained that the new tobeen appreciated by the pilots and consequently improved job satisfaction.


The main threat to their job satisfaction anticipated by controllers is from the job to make it less interesting. Sev

controllers felt that tools like datalink would reduce verbal communication and consequently one of the most enjoyable aspects of the job. However, despite these concerns, most of the controllers feel, rightly or wrongly, that these changes are far enough in the future to be ofthe next generation of ATCOs.


CORA: These developers reported that a survey of present day controllers had indicated an anticipation that controller job satisfaction would be lower in future, with ATCOs increasingly expected to manage the system rather than cothat there would be no room for the artisan contand systems that can see a bigger pict

m to satisfy the demands of local traffic and suggested courses of action different from those ld normally follow. However, in objective traffic management terms the system has been s; the interviewees attributed this to the system making suggestions that were in the nterests of the overall system. However, the opinion of the developers was that new ways ing air traffic man



• ns to

• comments from the ANSP surveys, suggesting that

Discussio

Based on pears that past technological change has had little impact upon the job satisfaction of the controllers. However, several of the controllers and the

ology developers felt that the job was likely to be become less interesting for

be to reduce the opportunity for

• C-ATM: This interviewee characterised the movement towards automated systems as inevitable, suggesting that this will have a negative impact on job satisfaction. However, it was stressed that the next generation of controllers will be selected to operate in this environment. The implication was that the transition between these types of controller will prove to be one of the more important challenges.

AMAN: This interviewee was more positive about the potential impact of automation on job satisfaction, suggesting that it will help controllers to develop elegant solutioproblems.

Datalink: This developer echoed the the reduction in social contact may reduce job satisfaction.

n

the feedback from the survey, it ap

future techncontrollers in the future. The main reason given for this was that automation would ultimately reduce the amount of input required from ATCOs, requiring them to operate more as system managers and monitors. A second issue mentioned regularly, was that changes such as datalink would reduce the amount of verbal communication necessary. Some controllers were of the opinion that this would decrease their enjoyment in the job.

One possible negative impact of this type of change mightcontrollers to receive immediate positive feedback regarding their actions. Some controllers commented that it was clear from verbal interaction when pilots are happy with the way they are being managed by ATCOs. It is possible that this short term, positive feedback makes an important contribution to a controller’s job satisfaction.

More positively, it became apparent from the interviews that controllers enjoy developing and observing elegant solutions to traffic management problems. It is possible that new technology such as AMAN, MTCD or CORA will support controllers in the selection and execution of these strategies, increasing their satisfaction.



4. C N

In the tr

•

s with reference to the work conducted

itment of individuals has high face validity. This has meant that the term safety culture has rapidly entered use without an

re.

ty culture as a multi-dimensional construct. For the purposes review to identify factors that would be relevant to

a more direct impact ctors were identified in the literature:

• Teamwork.

ject team to be potentially important in an ATM context, were

O CLUSIONS

in oduction to this report the following question were posed:

What is safety culture? • Does the nature of safety culture in ATM differ from safety culture in other industries? • How has safety culture been affected by the introduction of new technology in the past? • How might safety culture be affected by the introduction of new technology in the future?

These questions are addressed in the following sectionthroughout the project.

4.1. WHAT IS SAFETY CULTURE?

Over the last twenty years, safety culture, as a concept, gained widespread acceptance before being properly defined. The notion that management and organisational factors make a contribution to safety performance by influencing the values and comm

underpinning theoretical model or a clear consensus about its precise natu

Most researchers have treated safeof this project it was decided to use the literaturethe ATM context. Many of the factors identified in the literature, focus on issues that could be considered to be part of, or an output of, a safety management system (e.g. management commitment to safety, reward systems, reporting systems, employee empowerment). However, it was decided that many of these issues are already being addressed by other EUROCONTROL projects, and that a more useful focus would be on those factors that haveupon safety performance. The following such fa

• Understanding of competence. • Understanding of risk. • Communication. • Personal responsibility for safety. • Job pressure.

The following factors, felt by the proalso added:

• Trust in people. • Trust in equipment. • Job satisfaction.

Taken together these factors represent inputs to the individual and team contribution to safety performance. Consequently, the concept of safety culture has been adapted to fit the demands of this project. However, whilst not dealt with directly here, management issues remain of critical importance. The quality of the factors listed above, and the degree to which they support individual and team performance, will be largely determined by the design and implementation of the organisational systems in which they operate. It is hoped that one output from this research will be an improved appreciation of how these factors operate, this will provide managers with a better understanding of how they can be supported and maintained, and how they may be threatened or enhanced by the introduction of new technology. One possible characterisation of these factors is as follows:



Table 1: Classification of the level of importance of safety culture factors

Level of Importance Dimensions

Prerequisite Trust in people Personal responsibility for safety Understanding of risk Trust in equipment

Fundamental Teamwork Communication

Important Job pressure Job satisfaction Understanding of competence

All of the factors were considered to be important by the controllers. However, there were subtle differences in how these dimensions were perceived. Trust in people, personal responsibility for safety; understanding of risk; and trust in equipment were considered by the controllers as prerequisites, and that without these factors they simply would not be able to operate. However, whilst they are prerequisites, they, like all of the other factors can be improved. For example, a controller requires a basic level of trust in all of their colleagues, but may be able to trust some colleagues more than others, perhaps because they have greater experience of working together.

ew was that very little research has been conducted on safety culture in ATM. Most existing research has taken place in industries such as construction, chemical processing and the offshore industries. Therefore, it is important to consider the reasons why so little research has been undertaken in ATM safety culture in comparison with other industries and the applicability of this research to an ATM context.

The controllers considered that all of the factors play an important role in safety performance. Therefore, in this sense, the factors did seem to transfer well to the ATM environment. However, it was clear from the interviews that, to the controllers, some of the identified factors were more applicable than others. Teamwork, understanding of risk and communication all appeared to translate relatively easily to the ATM domain. Trust in people, trust in equipment, and job satisfaction were factors added by the project team and therefore could not be compared with the safety culture literature. However, understanding of competence and personal responsibility for safety required more consideration to fit the ATM context although both appear to be important. Some specific issues related to these factors are discussed below.

These prerequisite factors are supported by fundamental factors (good teamwork and communication), where these factors are critical but are not necessarily in a good state when a controller is working. Finally, the other factors, whilst not essential, are important contributory factors in controlling safely and efficiently (job pressure, job satisfaction and understanding other’s competence).

4.2. DOES THE NATURE OF SAFETY CULTURE IN ATM DIFFER FROM SAFETY CULTURE IN OTHER INDUSTRIES?

One of the findings of the literature revi



petence of their colleagues, it is bas members adjust their behaviour to complement the competence level tinterv y under n , exper c

Several of the studies that mentioned this issue in the literature review took place in manufacturing, hore oil and gas and chemical industries. In these contexts, described as including an increased motivation to make a

on the part of the

4.3. ETY CULTURE BEEN AFFECTED BY THE INTRODUCTION OF NEW

The im a gy upon the safety culture factors was discussed in detail in Section 3. The evidence from the interviews suggests that the introduction of new technology has had an impact upon the safety culture factors, although this impact has varied depending on the type of new technology and the ANSP in question. Moreover, the impact can have either negative or

Of the fact appeared to be particularly vulnerable to both negative and positive change. This is possibly because new equipment or technology can have a direct impact upon these factors. For example, tools such as OLDI or datalink directly affect the way that unicate, but they may only indirectly affect other factors such as

Understanding of competence

This factor relates to the ability of individuals to understand the comed on the notion that team of heir colleagues (e.g. make things easier for a new controller). It was clear from the iews that this was the case. However, the topic was a broader one than simplsta ding of competence because, in addition, controllers try to understand the preferencesien e and effects of age when assessing their colleagues.

Personal responsibility for safety

construction, chemical processing, offspersonal responsibility for safety was difference to safety and taking individual responsibility for one’s own safety. This dimension appeared to be less of an issue in an industry such as ATM, where workers are in no doubt about their personal responsibility for safety. However, that is not to say that this dimension is immune to the effects of future technological changes. It may also be possible that controllers may feel some conflict where they are no longer directly responsible for an aspect of the system but continue to observe it in operation. If this occurs regularly this might lead to frustrationcontroller.

Other factors

The interviewees were asked to describe other factors that they felt made an important contribution to safety. Most declined to add any other factors. However, several ATCOs mentioned the value of procedures, clear instructions and rules for the controllers to follow. In addition, a few interviewees mentioned the value of training and individual competence.

HOW HAS SAFTECHNOLOGY IN THE PAST?

p ct of new technolo

positive impacts.

ors, teamwork and communication

controllers communderstanding of risk.

Trust in equipment received several mentions during the interviews as a dimension that had been affected by change. However, in most cases the interviewees were referring to their feelings in the immediate aftermath of a change, whilst they became accustomed to the new equipment.

Some controllers reported some very specific issues regarding understanding of risk. Most of these comments stemmed from the introduction of STCA where controllers felt that the new tool had altered their colleague's perception of risk.



Very few contro trust in people, personal responsibility for safety, job pressure or job satisfaction as a result of the introduction of new technology. According to the interviewees, all of these factors appeared to be relatively resistant to change in the minds of the interviewees. However, it should be stressed that, for a dimension such as personal responsibility f a controller to conceive of anything that would alter their feelings of res

4.4. HOW MIGHT SAFETY CULTURE BE AFFECTED BY THE INTRODUCTION OF NEW TECHNOL

Based on the feedback from the interviews trollers and the technology developers, it appears possible that future technology might have a different effect on the factors of safety culture than earlier technological innovations.

or controllers, possibly reducing their overall understanding of risk.

potential issues for these factors arising from the introduction of future technology. For job satisfaction, several controllers felt that their role was likely to become less interesting as a result

ver, the technology developers

ller. However, the general perception was that these changes would not happen quickly enough to significantly affect their jobs, and that the next generation of controllers would be selected and trained for this new role. If this assessment is accurate, then a significant challenge is likely to involve managing the transition between these two ways of operating, to ensure that older-style controllers are able to operate safely in the new way of working.

llers reported any changes to understanding of competence,

or safety, it may be hard forponsibility.

OGY IN THE FUTURE?

with the con

Teamwork and communication again appear to be particularly vulnerable to change. Once more, this is possibly because new equipment or technology can have a more direct impact upon these factors. For example, CORA may require a redefinition of the roles of executive and planning controller.

Trust in equipment, trust in people and understanding of competence were also judged to be unaffected by previous or future technological changes. This may be because teamwork and communication are fundamental factors that controllers perceive as essential. Therefore, they cannot conceive of any changes that might affect these factors.

However, another prerequisite factor, understanding of risk, appears to be more threatened by future technology. Some of the controllers felt that new technology such as CORA would make more decisions f

Personal responsibility for safety, job pressure and job satisfaction were all perceived to be largely unaffected by previous changes in technology. However, several of the interviewees identified

of increasing automation. This feeling was supported by the comments of the technology developers. Job pressure was also felt to be likely to be affected; however there was some disagreement between the interviewees about whether the impact was likely to be positive or negative. Finally, with regard to personal responsibility for safety, interviewees again indicated that this dimension was likely to be largely unaffected by change. Howewere of the opinion that the changes would ultimately have a negative effect on this dimension.

4.5. ISSUES THAT CUT ACROSS THE SAFETY CULTURE FACTORS

Some issues that cut across the individual factors have arisen during the course of the project. These are discussed below.

Several of the controllers that were interviewed predicted that, at some point in the future, the control of aircraft would be undertaken largely by automation. At this point, they felt, the human would be likely to become more of system manager than a contro



at small individual changes may have relatively small impacts upon

g the project appear to be important for safety performance.

age from the interviewees was that ATCOs like to feel in control of everything they do. re likely to have to use tools where it will be

understand the basis behind every action taken or recommendation provided. This

ely that new technology will have different impacts, create different issues and bring different benefits wherever it is

uch as org

ate the importance of managing the introduction and implementation of

Another possible scenario is ththe safety culture factors. However, these might become significant when combined with other changes. For example, the introduction of a system such as OLDI is likely to reduce the amount of verbal communication that a controller on a shift has. From a job satisfaction perspective, the controllers may have enjoyed this interaction, but will still have plenty of other opportunities to carry out such communication. However, several innovations later, controllers could find that they are hardly ever required to communicate verbally. At this point their satisfaction in the job may be significantly reduced.

All of the factors assessed durinTherefore, one approach to preserving their impact following the introduction of technology would be to develop a detailed individual understanding of how they function in an ATM context. For example, TRM training is already used to develop and maintain effective teamwork. Tools like this should be developed and used to address emerging cultural issues, such as generational differences in controlling style.

A specific issue, as automation begins to make suggestions to controllers about courses of action, is the liability of controllers who choose to deviate from these suggestions. Such legal liability issues will need to be addressed formally and communicated to controllers.

A clear messHowever, as in other industries, controllers aimpossible to transition will require careful management. A critical element in developing this trust will be the degree to which controllers have been involved in the development of such tools.

The interviewers observed that each of the ANSPs had quite different cultures. Whilst many of the values espoused by controllers were similar at all of the sites, it is highly lik

introduced. Therefore, any impact assessment should take into account the local conditions sanisation of work.

The privatisation of air traffic services and the associated focus on performance is a fact of the current situation and will be present for the foreseeable future. A potential danger of this condition is that safety margins will come under pressure as the importance of capacity issues increase. Given this prevailing climate, factors such as training and safety culture are already critical in maintaining safety performance and are likely to become more so in the future.

Finally, in the earlier discussions, the report has largely focused upon the potential negative impact of new technology. This served the stated aim of the project: to anticipate ways in which safety culture may be disrupted by new technology. However, it should be stressed that in many cases these negative effects will be more than compensated for by the positive impact of new technology.

All of these issues indictechnology. This topic was outside of the scope of this project, but was regularly mentioned during the interviews.



factors and that certain factors (e.g. understanding of risk, communication and teamwork) are both critical to safety performance and

The f ’s assessment of potential future changes based on the

able 2: Summary table

4.6. SUMMARY

Table 2 summarises the research findings for each of the safety culture factors. It indicates that, in the past, the introduction of technology has had a variable, but significant, impact upon the factors of safety culture assessed during this project. It also suggests that the introduction of future technology might have a differential impact upon the

potentially vulnerable to change.

inal column provides the project teaminformation gathered. It tells us that future changes are likely to have more impact on safety culture and in no case is there a reduction in the sensitivity of these factors.

T

Safety culture dimension

Origin

Transferability of concept from other industries

Type of dimension

(level of importance)

% of controllers who included the

dimension in their top 3 most

important factors for safety (n=23)

Variability across

ANSPs in expe-

rience of change

General sensiti-vity to past

changes

Poten-tial

sensiti-vity to future

changes

Teamwork Lit review High Fundamental 83% High High High

Understanding of competence

Lit review

Low (was extended) Important 9% Low Low Low

Trust in people Project team N/A Prerequisite 13% Low Low Low

Trust in equipment

Project team N/A Prerequisite 52% Low Low Med

Understanding of risk

Lit review High Prerequisite 17% Med Med High

Communication Lit review High Fundamental 43% High High High

Personal responsibility for safety

Lit review Low Prerequisite 35% Low Low Med

Job pressure Lit review High Important 4% Low Low Med

Job satisfaction Project team N/A Important 22% Low Low High

It should be remembered, however, that the table represents hypotheses about the future, rather than describing certain events. Moreover, whilst a dimension may be sensitive to the introduction of new technology, it is possible that the changes may have a beneficial, rather than negative, impact. For example, a new HMI may lead to greater communication and discussion between controllers, improving teamwork. Finally, the information, discussion and conclusions presented in this report are based primarily on the information supplied by ATCOs interviewed at four ANSPs. It should be borne in mind that other ANSPs, and other stakeholders, may have a different perception of the same issues.



ety culture issues that could be impacted by changes in ATM technology. It

be developed. Ultimately, ANSPs will be implementing new ct culture; therefore they require explicit guidance in the

vestigation of safety

Figure 2: Research process – past, current and potential future research in the area of ATM safety culture

Despite these concerns, the need to consider the likely impact of proposed new technology upon these factors is clear. Such a consideration should allow managers to reduce the potential negative impact of new technology, whilst simultaneously increasing its likelihood of acceptance and success. To this end, this report has indicated some ways in which technology has affected these factors in the past, and suggested some potential pathways by which future technology might have an impact. To progress from this point the following courses of action are possible:

A. Develop the concept of safety culture in ATM more fully. This was a small-scale project with the focus on safmay be important to consider the wider context of safety culture in ATM in order to confirm a full understanding of the concept. In addition, a more detailed understanding of each of the safety culture dimensions described in this paper would be of practical benefit, supported, where possible, by documentation of their individual components. Furthermore, a formal, generic process for screening new technology for its potential impact on safety culture dimensions couldtechnology in their own distinselection of strategies for reducing negative impacts and maximising potential benefits.

B. Use the information from this report, (as well as a more focused inculture dimensions and a safety culture measurement potentially undertaken in A), to examine future tools that are currently in development with the aim of identifying their potential impact upon safety culture factors.

PAST RESEARCH ON EFFECTS OF AUTOMATION ON HUMAN FACTORS &

SAFETY ATTITUDES: THEORIES AND FINDINGS

NEXT STEPS (A) MORE DETAILED

INVESTIGATION OF THE SAFETY CULTURE

DIMENSIONS RELEVANT TO ATM & METHOD DEVELOPMENT

CURRENT SURVEY METHOD: STRUCTURED INTERVIEWS: ON

SAFETY CULTURE AND NEW TECHNOLOGIES : ATCO EXPERT OPINIONS

SURVEY FINDINGS : NINE DIMENSIONS OF

SAFETY CULTURE IDENTIFIED; TWO ASPECTS OF SAFETY CULTURE MOST

LIKELY TO BE AFFECTED BY FUTURE TECHNOLOGIES: TEAMWORK AND

COMMUNICATION SOME INITIAL FINDINGS REGARDING ATM

2012 TOOLS AND SYSTEMS

NEXT STEPS (B) MORE DETAILED STUDY OF

THE SAFETY CULTURE ASPECTS AT RISK IN THE

ATM 2012 TOOLS & SYSTEMS



ANNEXES



blank

Page intentionally left



ANNEX A - LITERATURE REVIEW

1. INTRODUCTION.........................................................................................................41

2. INTRODUCTION TO SAFETY CULTURE..................................................................41 2.1. A DEFINITION OF SAFETY CULTURE....................................................................... 41 2.2. SAFETY CULTURE AND SAFETY PERFORMANCE................................................. 42 2.3. SAFETY CULTURE AND SAFETY CLIMATE ............................................................. 42 2.4. DIFFERENT CONCEPTUALISATIONS OF SAFETY CULTURE ................................ 43 2.5. DIMENSIONS OF SAFETY CULTURE........................................................................ 45

3. SAFETY CULTURE RESEARCH IN RELEVANT INDUSTRIES................................50 3.1. SAFETY CULTURE IN ATM ........................................................................................ 50 3.2. SAFETY CULTURE IN AVIATION ............................................................................... 52 3.3. SAFETY CULTURE IN HEALTH CARE....................................................................... 53

4. FUTURE ATM TECHNOLOGY AND DIMENSIONS OF TECHNOLOGICAL CHANGE.....................................................................................................................56

5. REPORTED EFFECTS OF TECHNOLOGICAL CHANGE ON SAFETY CULTURE .59 5.1. DIRECT RESEARCH ON THE IMPACT OF NEW TECHNOLOGY ON SAFETY

CULTURE .................................................................................................................... 59 5.2. INDIRECT RESEARCH ON THE IMPACT OF NEW TECHNOLOGY ON SAFETY

CULTURE .................................................................................................................... 59 5.2.1. Accounts of Technological Change in ATM.....................................................59 5.2.2. Accounts of Technological Change in Aviation ...............................................60 5.2.3. Accounts of Technological Change in Healthcare...........................................61 5.2.4. Summary of Technical Change Literature Review ..........................................61

6. SUMMARY OF IMPLICATIONS FOR SURVEY OF SAFETY CULTURE REVIEW...62



Page intentionally left blank



This literature review is the first deliverable for project EEC TRS: C24/2004 Safety Culture in

It isan o ew

Prio thaddressingrevi othe review were used to screen th

2. INTRODUCTION TO SAFETY CULTURE

s Inter naimp eet a 2

However, si2002) havementioned :research c irelationship to other concepts (e.g. safety climate and organisational climate and culture) and

ermit a full discussion of these issues, some have implications for the current project. Therefore, where relevant, these are discussed briefly in the following sections.

2.1. A DEFINITION OF SAFETY CULTURE

Since the first use of the term, a consensus regarding the definition of safety culture has proved elusive. Wiegmann et al. (2002), in a review of the literature, listed thirteen different definitions. Guldenmund (2000) identified eighteen different definitions, although some of these were definitions of safety climate (see later discussion).

Wiegmann et al. (2002) summarised the commonalities between the various definitions as follows:

1. Safety culture is a concept defined at the group level or higher, which refers to the shared values among all the group or organisation managers.

2. Safety culture is concerned with formal safety issues, and closely related to, but not restricted to, the management and supervisory systems.

3. Safety culture emphasises the contribution from everyone at every level of an organisation.

1. INTRODUCTION

Future ATM. The two main aims of the review are:

1. To review the research literature for models and taxonomies of safety culture that are likely to most applicable in an ATM environment.

2. To review the research literature for evidence of the impact of the introduction of new technology upon safety culture.

not the aim of this review to exhaustively review the extensive literature in this area. Instead, vervi of the literature likely to provide insights into ATM will be considered to inform the

design of the survey due to take place in WP2.

r to e start of the review it was anticipated that there would be little literature directly the impact of new technology on safety culture. This expectation was borne out by the

ew. T circumvent this problem the dimensions of safety culture identified in the first stage of e literature on technological change during the latter part of the

review.

Mo ew by the t revi ers trace interest in the term safety culture back to a 1986 report published natio l Atomic Energy Agency (IAEA) into the Chernobyl disaster; the report noted the

ann ortanc of management and organisational factors for safety (e.g. Sorenson, 2002; Wiegml., 200 ).

nce this date, many reviewers (e.g. Guldenmund, 2000; Clarke, 2000; Wiegmann et al., lamented the fragmented nature of safety culture research. Issues that have been include the lack of an agreed definition; different conceptualisations by different ommun ties; the lack of an underpinning theoretical model; confusion over the

disagreement over the dimensions of safety culture. Whilst the scope of this review does not p



4. The safety culture of an organisation has an impact on its members’ behaviour at work.

5. Safety culture is usually reflected in the linkage between reward systems and safety performance.

6. Safety culture is reflected in an organisation’s willingness to develop and learn from errors, incidents and accidents.

7. Safety culture is relatively enduring, stable and resistant to change.

n the basis of these commonalities they propose the following definition:

afety culture is the enduring value and priority placed on worker and public safety by everyone in very group at every level of an organisation. It refers to the extent to which individuals and roups will commit to personal responsibility for safety, act to preserve, enhance and communicate

safety concerns, strive to actively learn adapt and modify (both individual and organisational) ehaviour based on lessons learned from mistakes, and be rewarded in a manner consistent with

uldenmund (2000) reports that most definitions place an emphasis on the aggregation of erceptions, beliefs or attitudes, he suggests that this is reflected in the self-administered uestionnaire research paradigm used by most researchers. However, other researchers,

with an anthropological background, have used a broader conception that mphasises the importance of an organisation’s history, symbols, rites, myths and stories in the

t of culture (Weick, 1987; Helmreich and Merritt, 1999). Where this approach has een adopted investigators have tended to use more diverse investigation strategies. Typically,

this has involved supplementing q s and observations of behaviour (e.g. Roberts et al., 1994)3.

.2. SAFETY CULTURE AND SAFETY PERFORMANCE

Whilst there has been little consensus on many aspects of safety culture research, most investigations appear to suggest a positive relationship between safety culture and safety performance (see, for example, Clarke, 2000 for a summary). Sorenson (2002), however, reports that most of this work has involved correlating safety culture (or, more usually, the attributes chosen by the researcher) with safety of operations. Very few studies have tried to demonstrate that altering safety culture leads to a corresponding, predictable change in safety performance.

2.3. SAFETY CULTURE AND SAFETY CLIMATE

Lack of consensus over the relationship between terms such as safety culture and climate and related concepts, including organisational culture, have hampered research in this field. Indeed, some definitions of safety culture and safety climate are almost identical (Wiegmann et al., 2002).

Guldenmund (2000) describes that, in the more mature field of organisational research, the term organisational climate originally signified a broad concept imagined by researchers. However, over time, organisational climate came to be used only for research that focused on attitudinal aspects of organisational culture. Organisational culture replaced the term climate, taking on the latter’s broader meaning.

O

“Seg

bthese values.”

Gpqparticularly those edevelopmenb

uestionnaires with focus group

2

3 See Sections 2.4 Different conceptions of safety culture for a further discussion of these differences



from the theoretical background of organisational climate in the early 1980s (Clarke, 2000), the term safety culture, as previously discussed, arose

llowed researchers to attach existing research on safety syn

Where the terms have been differentiated, some similarities emerge in the definitions. Wiegman et al. differen ure.

Several recent papers have proposed retaining both terms, with culture being reserved for deep, states (Hale, 2000). Guldenmund (2000) has ishing between core, basic assumptions (i.e.

nt property of a system. This property is derived from the interaction of the system parts and is not inherent in its individual

o mething that can easily be developed or added to an organisation. Wiegmann et al. (2002) locates this perspective in a socio-anthropological

egy. Wiegmann et al. (2002) report that this is

Claess

Whilst the concept of safety climate was derived

from analyses of incidents such as Chernobyl, without reference to existing research. Clarke (2000) suggests that this atheoretical background a

climate to this new concept, perhaps explaining why the two terms are used onymously in some literature.

(2002) reviewed 12 definitions of safety climate and reported two important, recurring ces from definitions of safety cult

1. Safety climate is a psychological phenomenon, which is usually defined as the perceptions of the state of safety at a particular time.

2. Safety climate is a temporal phenomenon, a snapshot of safety culture, relatively unstable and subject to change.

In practice, much of the research that has taken place has examined safety climate as represented by these two components.

stable traits and climate for shallow, expressed sought to formalise these differences by distinguimplicit dimensions, obvious to the members of a culture, but invisible) that make up culture and stated values/attitudes (e.g. policies, procedures, job descriptions, posters, meetings) that comprise climate. However, as Hale (2000) points out, this makes culture, by definition, almost impossible to measure directly.

2.4. DIFFERENT CONCEPTUALISATIONS OF SAFETY CULTURE

One persistent debate in the safety culture literature concerns whether culture is something that an organisation is or something an organisation has (e.g. Reason, 1997; Cooper, 2000). Clarke (2000) labels these perspectives interpretive and functionalist respectively and discusses their differences.

The interpretive approach characterises safety culture as an emerge

comp nents. Therefore, safety culture is not so

tradition and suggests that, because safety culture is ‘more than the sum of its parts’, it is resistant to traditional analytical methods (e.g. self-administered questionnaires) and quick change.

The functionalist perspective, by contrast, holds that safety culture is amenable to management control as it is an expression of organisational stratthe approach taken by many organisational psychologists, who have sought to provide managers with the ability to improve safety through the manipulation of culture. Reason (1997, cited in

rke, 2000) describes how safety culture can be developed by “identifying and fabricating its ential components and then assembling them into a working whole”.



The fety cultof sidentific sessment of safety culture dimensions) that has been taken by most resack

For the purposes of this project, a to address this ten ch (i.e. to identify and

ore holistic aspects of

se different perspectives have implications for the research approach used to address saure. Guldenmund (2000) suggests that there is a tension between the holistic characterisation afety culture favoured by the interpretive perspective and the reductionist approach (i.e. the

ation and asearchers in this field. Clarke (2000) reports that pragmatic researchers have tended to nowledge the complex nature of safety culture whilst using simple assessment tools.

nd in the absence of well-defined analysis tools sion, it will be appropriate to adopt a pragmatic, functionalist approa

assess relevant dimensions of safety culture), whilst ensuring that the msafety culture are addressed by the use, where possible, of interactive approaches such as group discussions.



n et al. (2000) report that typically assessed features include:

Guldenmundimclassify achieving this are presented in the tables on the following pa

the literature (adapted from Clarke, 2000)

2.5. DIMENSIONS OF SAFETY CULTURE

Safety culture, like other social scientific constructs such as intelligence, has been largely characterised as multi-dimensional (Guldenmund, 2000). The number of dimensions used by researchers ranges from as few as two to as many as nineteen (e.g. Guldenmund, 2000; Clarke, 2000; Wiegmann et al. 2002). Fliworkforce perceptions of aspects of the organisation (e.g. the status of safety procedures), measures of individual dispositions (e.g. optimism), personality and self-reported behaviours (e.g. rule violations).

d (2000) suggests that a sensible approach might be to rename and regroup ensions used by individual researchers to “provide a small set of common denominators to

dimensions under”. Three attempts at ges.

Table 3: Safety culture themes emerging from a review of

Safety culture theme Components

Work task/ work environment (total = 20)

- Safety level (2) - Workpace/pressure (2) - Changes in demands/jobs (2) - Trust, relationships (3) - Group attitudes (1) - Design, hardware, equipment (4) - Work environment (2)

- Level of risk (4 studies)

Personal involvement - Aand responsibility

ppreciation / caution over risk (3) - Individual responsibility (3)

- Scepticism (2)

- Personal authority (2)

(total = 24) - Need / motivation for safety/ self safety - Personal involvement (4)

- Immunity (3) - Suggestions, speaking up (2) - Violations (1) - Accountability (1)

Management attitudes (total = 17)

- Management attitudes (8) - Appreciation/value (2) - Safety vs. production, conflict, priorities (6) - Blame (1)

Safety management system (Total = 25)

- Safety standards, goals, procedures, rules/regulations (6) - Safety system, management, measures, regulation, policy (8) - Training (6) - Safety committee/officer - Maintenance (1)

Management actions (Total = 8)

- Promotion, status, rewards (3) - Information, communication (3) - Management actions (2)

Notes: Derived from 16 safety climate/culture studies conducted in manufacturing, construction, chemical processing, aviation, offshore oil & gas production, nuclear, road administration and chemical industries. The numbers in brackets refer to the number of studies.



Table 4: Safety culture themes emerging from a review of the literature (adapted from Wiegmann et al., 2002)

Safety culture theme Summary of authors’ comments

Organisational commitment

- Identification by upper-level management of safety as a core value. - Demonstrable enduring, positive attitude to safety by managers. - Active, consistent promotion of safety across all levels. - Provision of adequate resources and support. - Routine evaluation and modification of every aspect of operations to improve safety.

Management involvement

- Day-to-day demonstration of concern for safety by upper and middle managers. - Managers’ presence at, and contribution to, safety seminars and training. - Good communications about safety up and down the hierarchy

Employee empowerment - Empowered employees who understand their critical role in promoting safety. - Employees with increased motivation to make a difference to safety. - Employees with a say in safety decisions. - Employees who hold themselves and others accountable for their actions. - Employees who take pride in the safety record of the organisation.

Reward systems - Consistent application of rewards or penalties for safe and unsafe behaviour. - Formal documentation and explanation of reward and penalty systems.

Reporting systems - An effective and systematic reporting system. - An organisation that is willing to learn and adapt its operations based on incidents and near misses. - Free and uninhibited reporting of safety issues (supported by a structured feedback system and no fear of reprisals).

Notes: Derived from a range of safety climate/ culture studies (exact number and industries not stated)



mes emerging from a review of ted from Flin et al., 2000)

Table 5: Safety climate thethe literature (adap

Safety culture theme Summary of authors’ comments

Management / Supervision (total = 17)

- Sometimes difficult to discern what level of management is being assessed.

- Four of the studies referred directly to supervision. - There have been few studies into the impact of managers’ behaviour

upon worker safety.

Safety system (total = 12)

- This included safety officials, safety committees, permit to work systems, safety policies and safety equipment.

- Many companies are already assessing this dimension using conventional safety auditing procedures.

- The authors suggest that where this is the case this dimbe excluded to allow more attention to be focuseda climate survey.

ension may on other factors in

Risk (total = 12)

- This dimension is frequently included but in several different ways g, perceptions of risk and attitudes

(e.g. fatalism, optimism) were included in some rs question the merit of this given a

accident involvement.

(e.g. self-reported risk takintowards risk).

- Personality variablessurveys, although the authohistorical failure to predict

Work pressure (total = 6) production and safety overlaps this theme and y recognised as a key component of

mportance including essing safety culture.

- Balance betweenmanagement and is now widelsafety culture.

- The authors suggest that this illustrates the iwork climate variables when ass

Competence (total = 6) n of the competence of their

een an increased emphasis in high reliability pon non-technical skills (e.g. leadership) usually

rce Management programmes.

- Essentially the workforce's perceptiocolleagues.

- There has borganisations utaught through Crew Resou

Procedures/ rules (2) in two studies, but considered important by so included by Flin et al., (2000).

- Only mentionedGuldemund (2000)

Notes: Derived from a review of 18 surveys of safety climate. 50% of the studies are from the ecto ects amount of research in this area. Other

cluded in the rev facturing, transport and construction, as well as one cross industry review.

energy/petrochemical sindustries in

r, which the authors state refliew were: nuclear, manu



The three reviews, prese like the papers that they review, they are prone to g a dimension in a sub-classification that another reviewer has concluded represents a theme. The following table summa tifie

Table 6: Su

nted above, contain many similarities. However, labelling similar concepts differently, or includin

ries the themes iden d in these reviews:

mmary of safety culture themes identified by reviewers

Reviewer Identified safety culture themes

Clarke (2 - Work task / - P- M- S- M

000) work environment ersonal involvement and responsibility anagement attitudes afety management system anagement actions

Wiegma - Organisati M

- E- R- R

nn et al. (2002) -

onal commitment anagement involvement mployee empowerment eward systems eporting systems

Flin et al. (2000) - M- S- Risk - W- C- P

anagement/ supervision afety system

ork pressure ompetence rocedures/rules

From these summaries the foll

• Management attitude

Where ces on safety. Several of the reviewers discuss this in re the balance that is struck between safety and efficiency/productivity and work pressure. In practice this theme may be difficult to differentiate from the next dimension.

• Management actions*

This theme represents the manifestation of management attitudes to safety. The reviews address this dimension in terms of the visible actions carried out by management and the degree to which they promote the value of safety (e.g. management attendance at safety meetings and training, management visits, provision of adequate resources/finance for safety programmes). For the purposes of this review, this theme will be treated as including organisational commitment and be taken to cover the actions of all layers of management.

• Employee empowerment/personal responsibility*

This theme includes several related elements. These include the involvement in safety decisions, taking pride in one’s work, taking responsibility for actions and willingness to speak-up. In practice, it may be useful to separate this dimension into two parts, one related to individual accountability and one covering the involvement of individuals in safety related activities and decisions.

owing safety culture themes emerge:

s (including work pressure)*

this theme has been used it appears to relate primarily to the value management plalation to



• Safety manag

This is a broad theme that regularly appears in assessments of safety culture and relates to the development and implementation of safety managements systems. However, the particular aspect of safe tems t ntly is the quality of organisational reportin ars ort safety events (closely related to the rev organisations to change and im porting systems (this component may be seen to overla

• es to)*

This the uently included in n used in different ways. It can include self-reported risk ta even aspects of personality such as fatalism.

• Reward systems*

This is ponent of safety cul e, but is include cipally because h to include in their definition of safety culture ribe it as the consistent application of rewards or penalties for safe and unsafe beh in that the inconsistent application of blam

•

Clarke (2000) includes this as a bro with in other themes, such a such as trust/relation

• Competence

Flyn et al (2000) are the only revie mponent of safety cultur

•

Again,

It is cle ral of the themes are closely related and, in some cases, hard to distinguish between. However, the themes marked * (i.e. management attitudes, management

ctions, employee empowerment/personal responsibility, safety management systems/reporting systems, risk and reward systems) appear consistently in the reviews and will be used in the second half of the literature search (see Section 5). Other potential themes to consider include competence, procedures and teamwork (which includes some of the issues covered by the task environment category).

ement systems/reporting systems*

ty management sys hat is mentioned most frequeg systems. This appe

p to have several components including freedom to repious theme), quality of feedback and the ability and willingness ofprove when faced with evidence from rep with the management actions theme).

Risk (attitud

me is freq safety culture assessments, but is ofteking, perceptions of risk, attitudes towards risk and

a comd here prin

ture that would fit in the safety management system themWiegmann et al. (2002) consider it important enoug. They desc

aviour. This theme is closely related to reporting systems,e is likely to threaten the success of such schemes.

Task environment

ad category, encompassing some items that have been dealts risk and workplace, and others that have not,

ships, quality of equipment, changes in jobs and group attitudes.

wers to directly refer to competence as a potential coe.

Procedures

this dimension was mentioned directly by just one reviewer.

ar, therefore, that seve

a



th the ATC operating environment.

Helmreich and Me l operating theatre environments and foun ss and outcome factors. For the purposes of this review, we s comparison to the ATC environment. Here, as in the cockpit and the operating theatre, individual actions directly influence the safety of p addition, in a individuals must work as teams, follow procedures, make decisio maintain situational awareness. However, Helmreich and Me spite many similarities, there are also differences between these environments. In particular, the operating theatre, with its many subgroups, is a more dynamic setting, with less clearly defined ultimate authority than in a cockpit. In addition, d g thea dividual, events. In aviation, an aircraft crash is widely publicised and subj .

However, given the potentia these operating environments and the amount of t this review w ure research that has been conducted in the following ind

• Air Traffic Managem• Aviation (particularly cockpit operations). • Health care.

Very le in ATM. One exception is a group of Swedish researchers who have recently started a programme of work with the aim of establishing

They have based their analysis on a systems model of safety culture that emphasises the importance of relationships between different organisational levels (e.g. managers, supervisors and operators). The dimensions they have chosen to assess are derived from the work of Reason

3. SAFETY CULTURE RESEARCH IN RELEVANT INDUSTRIES

Unfortunately, little research has been carried out on safety culture in ATC. It is therefore necessary to look to other industries for parallels wi

rritt (1998) discussed the aircraft cockpit and the medicad many conceptual similarities in terms of input, proce

can extend thi

eople. In ll of these environments, ns, communicate precisely and rritt caution that, de

eaths in the operatin tre are unfortunate, but inected to intense scrutiny

l similarities betweenime available,

ustries: ill focus on safety cult

ent (ATM).

3.1. SAFETY CULTURE IN ATM

litt research has been carried out on safety culture

the effects of organisational and technical change upon safety culture (Ek et al., 2002; 2003a; 2003b). They are conducting surveys and interviews at two Swedish air traffic control centres that are simultaneously undergoing modernisation and organisational restructuring.

(1997) and Guldenmund’s (2000) review of the safety culture literature and are listed in the following table:



r analysis of ATC safety culture Table 7: Dimensions proposed by Ek et al. (2003b) fo

Dimension Description

Learning culture The ability to learn from information and introduce changes where necessary

Reporting culture A willingness to report incidents and anomalies

Just culture A just approach to blame based on a definition of safe behaviour

Flexibility The ability to cope with changing demands

C work Clear, timely communications between individuals and ommunication in normal work groups

Safety-related behaviours Regular discussions about, and encouragement to improve, safety

Attitudes to safety Commitment to safety from both staff and managers

C d a

Inclusion of cooperation, support and appreciation in the working situation.

ooperation, support anppreciation

Risk perception The perceived risk of harming others or oneself and influencing safe working.

Gill & Shergill (2004) conducted a wide-ranging review of the perceptions of safety management and culture in New Zealand aviation employees. As part of their study they investigated the attitudes of 70 air traffic controllers. They reported a perception amongst air traffic controllers that the m t importance on personal responsibility for the maintenance of safety.

ir traffic controllers’ reliance on information provided to them by other people/equipment in order to make critical

sue has been discussed in the context of high reliability organisations. Over the last 20 year f social scientists based at the University of Michigan and Berkeley have inve ig ch high-risk systems as nuclear submarines, aircraft carriers and air traffic

Roberts et al., 1994).

Crucially, however, for a high reliability organisation to function in the flexible manner Weick (1987) describes, the right culture must be present. High reliability organisations operate using a conventional hierarchical management structure during normal operations but, under conditions of stress, they become decentralised and control shifts to local operators. Weick (1987) explains how this is made possible by set of core values, shared by all participants, that allow people to operate autonomously but in coordination with their colleagues. This ability is often attributed to the fact that high reliability organisations tend to either be military institutions, or employ large numbers of ex-military personnel (e.g. Reason, 2000).

ir e ployers place mosThis was rated higher than other factors such as positive safety practices, safety education and implementation of safety policies and procedures. This was by contrast with aviation maintenance engineers whose perception was that positive safety practices and safety education were the most important factors. The authors speculate that this may be a consequence of a

the quality ofdecisions.

It may also be due to the central importance of the individual controller in managing safety in these systems. This is

s a group ost ated why su

control centres perform so reliably (e.g. Weick, 1987; Roberts, 1993;

One suggested reason is the degree of direct engagement operators have with the system under their control. Weick (1987) describes how “…controllers are the technology, they don’t watch the technology”. He illustrates how, by organising aircraft in the space available to them, controllers develop their own system, one which they have intimate knowledge of and control over. He goes on to emphasise how important discretion, improvisation and the ability to build slack into the system are for reliability. Interestingly, from the perspective of this project, he views increased automation as a threat to these qualities.



colleagues

3.2. SAFETY CULTURE IN AVIATION

As with ATC operations there has been little direct research into safety culture in aviation, although there has been research into other cultural issues. For example, Helmreich and his have looked extensively at the broader issue of the impact of professional, organisational and, particularly, national culture upon the uptake of Crew Resource Management (CRM) training programmes on the flight deck (e.g. Helmreich and Merritt, 1999). However, in the course of this work, they have examined organisational culture and “…chose to confine our research to the elements of organisational culture which we believed affect performance and safety.” (Helmreich and Merritt, 1999). The following table describes the results of one of their surveys:

Table 8: A comparison of organisational attitudes of two US airlines (adapted from Helmreich and Merritt, 1999)

Item % agreement airline A

% agreement airline B

Organisational climate I like my job 98 79 I’m proud to work for this organisation 97 26 P ot morale is high il 87 3 W rking here is like being part of the family o 82 35

Management perceptions Management never compromises safety for profit 84 12 Satisfied with chief pilot availability 63 26 Management deals well with problem pilots 44 15 Flight operations listens and cares - 17 Senior management is doing a good job - 3 Management supports pilots 73 -

Safety norms and practices

I know the correct safety channels to direct enquiries 85 57 I’m encouraged to report unsafe conditions - 38 My safety suggestions would be acted upon 68 19 Fairness of checking 78 63 Crews I fly with adhere to Standard Operating Procedures 93 76

The categories, whilst not specifically labelled safety culture, address some of the same dimensions discussed in Section 2.5 (e.g. perceptions of management and reporting systems). Moreover, the authors draw the readers’ attention to the final item: ‘crews I fly with adhere to standard operating procedures’. They suggest that this item links attitudes with important safety behaviour and hence provides evidence that organisational climate does affect safety performance.

A more recent survey, addressing safety management and safety culture directly, has been carried out in New Zealand (Gill & Shergill, 2004). They developed a 52-item questionnaire on the basis of literature review and pilot study at a flight training facility. The questionnaire was split into two parts: organisations’ approach to safety management and safety management systems and safety culture in organisations, responses were received from 172 pilots.



Using a fac lves of the questionnaire. These are listed below:

• ’ approach to safe

Positive safety practic

Implementation of safety policies and procedures.

Individual’s safety res

• Safety culture in organisations:

onal dynam

ulator’s role.

safety.

agement, training and dIn the fir dents thought that to their employers in managing safety. However, low ratings were given to safety policies and

afety delivery system or the professional reality of working in a tightly coupled

ety by

has been in part prompted by a consideration of the

tor analysis, four factors were extracted for both the first and second ha

Organisations ty management:

es.

Safety education.

ponsibilities.

Organisati ics & positive safety practices.

Reg

Luck and

Safety manst area, respon

ecision-making individual safety responsibility was of most importance

positive safety practices. The authors speculate that the first result may be attributable to the wording of the questionnaire. However, they suggest that the latter result may arise because these factors are assumed by the employer to be part of the professional culture. They conclude that employers may not be doing enough to ensure safety at a strategic level.

In the second area, the highest ranked factor was, interestingly, luck and safety. This factor was derived from statements such as: ‘you believe accidents will happen no matter what anyone does’. This result is consistent with the high rating of individual safety responsibility in the first half of the questionnaire and, at face value, indicates a high degree of fatalism. However, the authors conclude that further research is needed to establish the extent to which this indicates a lack of confidence in the sinteractive system (Perrow, 1984).

The factor that received the lowest ranking was organisational dynamics and positive safety practices. The questionnaire items from which this factor was derived most closely resemble the safety culture themes discussed in Section 2.5 (e.g. reporting systems, management commitment, management attitudes). The authors conclude that organisations may be compromising safnot attaching sufficient value to these dimensions in ensuring safety.

3.3. SAFETY CULTURE IN HEALTH CARE

Like several other industries, health care has recently started to look at safety culture research as a way of improving safety and quality performance and employee satisfaction (Gershon et al., 2000). In the United States this interest causes and costs of human errors. The Veterans Health Administration (VHA) has adopted a systems approach to preventing human error (such as that advocated by Reason, 2000) that takes as a key component the “development of a culture of patient safety” (Weeks & Bagian, 2000). This interest has been supplemented by analyses of failures in the health care sector as failures of hospital culture (see for example, Weick & Sutcliffe’s, 2003, review of cultural issues at Bristol Royal Infirmary).



onship between hospital safety climate and safe work practices. They developed a questionnaire using focus groups, structured interviews and work site

The authors conclu yees’ compliance with safe work pr precludes the determination of causality.

Helmreich and Merritt (1999), whose research on culture in avia cr on 3.2, have adapt ment Attitudes Questionnaire (FMAQ) for use i setting as adapted for an extensive study of safety culture in 1 hospitals in Califor et al., 2003). The study attempted to measure attitudes to patient safety and organis the degree of variation between the various participating establi below are the 16 topics addressed by the survey:

• • Rewards and punishment for reporting. • nd shame. • • es in the perception of risks bet n senior management and

• nal auditing of patient safety inci nts. • • ty of various resources to tre patients safely. • level and quality of decision makers.• Organisational structure – general safety climate and communication infrastructure. • • • ed personnel to improve p• spital. • •

The re five factors, t e were:

cluded that the majority of participants responded in a way that indicated a culture hey found that clinicians gave more “problematic responses” than non-

Gershon et al. (2000) examined the relati

surveys that included 46 items relating to safety culture. The results of the survey were factor analysed and six separate factors were identified, these were:

• Demonstrable management support for safety programs. • The absence of hindrances to safe work practices. • Availability of personal protective and engineering control equipment. • Minimal conflict and good communication among staff members • Frequent safety related feedback/training by supervisors. • Cleanliness and orderliness of the work site.

ded that the safety climate measures correlated with emploactices. However, they caution that cross-sectional design

tion was des ibed in Sectin a health careed their Flight Manage

. This instrument w 5nia (Singerational culture and to establish

shments. Listed

Reporting of mistakes.

Feelings of blame aTeamwork. Risk perception – differenc weepractitioners. Process auditing – institutioProduction pressures.

de

Time and resources – availabili at Mitigating conditions –

Fatigue and stress. Quality of hospital operations. Redundancy – ability of experienc atient safety. Rules and procedures within the hoEmployee training. Culture.

sults of the survey were factor analysed, yielding hes

• Organisation. • Department. • Production. • Reporting/seeking help. • Shame/self awareness.

The authors conof safety. However, tclinicians, in particular senior managers.



aesthesia department, an Intensive Care Unit (ICU) and an accident and emergency department (A&E). He attributed 45% of the root causes to organ t etween departments and low levels of experience and knowledge of junior doctors. However, of the organisational root causes identified, the author stated d as failures of safety culture. Examples of these failures included: a perceived pressure not to contact senior members of staff during the night; taking x-rays as check the configuration of equipment when

Van Vuuren (2000) examined the organisational root causes of incidents in a range of medical settings. These settings included an an

isa ional factors such as strong interdependencies b

that 29% could be classifie

a matter of protocol only and failures to adequately attached to a patient.



sification of technological changes. introduction of new

techn g is proposed that technological chang pon the tasks people carry out.

The t d change, both of which descr d from the introduction of new techn g

ibes the types of change controllers may expect (Eurocontrol,

erpretations of information.

aker whilst supplying them with advice about

ting this with the new

ools that work and are used

In the same document the impact troller’s job is further assessed. The anticipated chang

4. FUTURE ATM TECHNOLOGY AND DIMENSIONS OF TECHNOLOGICAL CHANGE

In order to establish whether different types of technological change exert different types of influence upon safety culture, it is necessary to provide a clasThis classification must be meaningful in terms of the mechanism by which the

olo y is likely to influence safety culture. With this in mind, ites are described and classified in terms of their effect u

en er document for this project referred to two particular types ofibe changes to the way people work, anticipated to ariseolo y:

• Significant changes to the controllers’ tasks. • Significant changes to the responsibilities of the controller.

An operational vision document, describing the main tools that will be used in future ATM operations in Europe, further descr2001). These include the following anticipated changes:

• More advanced planning, potentially meaning a new controller role of predicting and managing traffic bunching.

• Increased look ahead time to provide controllers with more information to facilitate planning and to see the impact of their actions.

• A reduction in complexity by providing controllers with fast int

decision m• Retaining the controller as the ion. potential courses of act

• Better workload management enabling controllers to be proactive and prevent overload situations.

• Retaining the controller’s level of situation awareness and supportools.

• Enhancing collaboration across sectors by using planning tacross sectors.

on the cones are summarised in the table on the next page.

ges in ATM Safety Culture due to New Technology EUROCONTROL

ct C24/2004 - EEC Note No. 13/05 57

Table 9: Potential impacts on controllers’ tasks of introduction of new technology (from Eurocontrol, 2001)

Impact on controllers

Workload Situation Awareness

Error and Recovery Teamwork Responsibility Skills New

HardwareNew

SoftwareNew

Systems of work

DMAN (Departure manager)

Decrease Increase New methods Increased opportunity

No change, potential for improved service to aircraft.

Training in DMAN; need fogreater experience.

Yes r

? Yes

MSP (Multi-sector planning)

Decrease per unit in flight

Increase in forward view

Reduced potential

New position - teams are changed

Not defined Need for greateexperience

Yes r ? Yes

AMAN (Arrival manager)

Decrease Increase Reduced potential

Reduced interactions but an expected improvement in cross-sector interactions

No change No change Yes ? Yes

EMAN (En route manager)

Decease per unit in flight

Not defined Reduced potential

No change No change Need for training in EMAN

Yes ? Yes

MTCD (Medium term conflict detection)

Decreased for tactical controller; increase for planning controller

Increase Reduced potential; more redundancy

Increased opportunity especially cross-sector

More responsibility for planning controller

Need to develop and refine working methods

Yes ? Yes

CORA (Conflict resolution assistant)

Decreased for tactical controller; increase for planning controller

Increase Reduced potential

Reduced interactions but an expected improvement in cross-sector interactions

More responsibility for planning controller

No change Yes ? Yes

Chan

Proje



taxonomy of technological change. This taxonomy will be developed further following interaction It is proposed that the types of job impact listed above are used as the starting point for the

with controllers during the pilot phase of the survey. It is anticipated that the management of the change process, as opposed to the change itself, may also have some implications for safety culture. This will be reflected in the survey design.

Changes in ATM Safet Culture due to New Technology y EUROCONTROL

Project C24/2 04 - EEC 1 590 Note No. 3/05

5. REPORTED CTS OF TECHNOLOGICAL CHANGE ON SAFETY CULTURE

The second purpose of t is review is to review the research literature for evid e of the impact of the introduction o w chnology upon safety culture. As stated earlier, it was anticipated prior to the review that th would be little research on the impact of new technology upon safety culture. This expectation was borne out by the review.

5.1. CH ON IM OF NEW FETY CULTURE

A search was conducted thre nline databases felt to rovid r coverage of the available literature (Ingenta, International Bib Science Direct). In each database the s h ure published in the last te bases return hes for these terms.

5.2. C A ON THE IMPACT OF NEW TECHN OGY ON FETY RE

Whilst no pact of new technology on safety cu s felt that research was en place in the impact of new technology on the dimensions dimensions discussed s search terms in the thre . Th dimensions re:

Management attitudes luding k ssure) Management a ns Employee eSafety management systems / reporting systems Risk (attitudReward syst

However, again this search yielded little information relevant to the current project.

The final search strategy employed was a search of the literature for accounts of technological change in the three relevant industries. These accounts w hat might inform the A summa tput from this exercise is included in the followi

5.2.1.

Hallier (2004) provides the introdu new radar and work system in an air traffic c . The nical e involved the relocation of radar operations to a Manage nt Function (CMF). il the change, airport controllers had n the new organisation, howev radar approach contr rs would only carry out one of the tasks. This change was carried out with the aim of improvin d departure rates at two busy airports. During the implementat rs ed a numb f co about the ne environment. The operators’ perce their local managers largely dismissed these concerns. Hallier (2004) attributed this perception to a shift in expectations of middl by their superiors. A new commercial focus led to manager g ability to control budgets, increase traffic mo ents and reduce headcounts.

EFFE

f neh

teenc

ere

SEARDIRECT RE

INDIRECULTU

direct research on the im

• • • • • •

Accounts of Technological Change in ATM

er,

THE PACT TECHNOLOGY ON SA

of

terms new ten years. None of the data

e oliography of Social Sciences and chnology and safe

p

ty culture were used to search literated any matc

e b oad

earc

T RESE RCH

more likely to have tak

OL

lture was ob

in Section 2.5

SA

tained, it wa

were used ato

weof safety culture4. To test this, the

e databases ese

(inc

t / personal r

wor pre

esponsibility ctio

mpowermen

es to) ems

ere then reviewed for any insights try of later phases of this project. the ou

ng sections.

a detailedvironment between 1993 and 2001

carried out

case study of

new Centralboth tower and radar functions. I

ction of a

meontrol en tech chang

Unt

olleg landing an

ption was that ion, operato rais er o

s bein

ncerns

assessed in t

w operating

e managerserms of their

vem

rch strategy an4 An overview of the sea used is in ix A-1. d search terms cluded as Append



rs to rely to a great extent on the ability of operators to arrive at informal solutions to technical problems as they arose. In the new environment, with new technology, this was no longer feasible.

This case study illustrates one potential way that the introduction of new technology can affect employees’ perceptions of their managers’ attitudes. According to the earlier review of safety culture literature, management attitudes are a key component of safety culture. In this case, it is likely that operators would have considered that their managers were failing to adequately address safety issues.

Joyce and Fassert (2002) discussed the sociological implications of the introduction of an ATM Safety Monitoring Tool (ASMT) designed to automatically report safety events. The earlier literature review established that effective safety reporting systems are considered to be an important part of a safety culture. However, in this case, the reporting system was also the new technology. The authors of this paper considered issues that may hamper the uptake of such a system.

One issue was the danger of introducing a double bind where operators are required to work at the limit of required standards in order to maximise capacity, whilst facing the possibility that their working practices would be automatically reported as a safety event. A second concern was a potential infringement of professional privacy as data about their working practices is collected and assessed automatically by an external device, particularly in countries where there is legal liability for errors. The authors suggest that these issues can be addressed by defining the role of the new technology ensuring that this role is understood and acceptable to the operators.

5.2.2. Accounts of Technological Change in Aviation

In aviation, one significant, relatively recent, technological change was the introduction of glass cockpit technology, the colloquial term for Electronic Flight Instrument Systems (EFIS). These aircraft have flight management systems and instrument panels that consist of computer-based graphics. Wiener et al. (1999) conducted an extensive review and survey of the issues surrounding the implementation of this new technology.

Most of the research in this area has focused upon the cognitive issues arising from the new technology, such as mode confusion, which directly affect the tasks pilots carry out. However, in addition to the considerable research conducted on the impact of national culture on the success of CRM training programmes (Helmreich and Merritt, 1998), Wiener et al. (1999) mention other cultural influences on the introduction of this new technology.

One observation was that, despite the provision of procedures by aircraft manufacturers, every major airline in the USA develops their own procedures. Wiener et al (1999) suggest that the development of procedures is a way for an organisation to articulate its culture and philosophy, as well as reflect the history of the organisation.

They also suggest that the successful implementation of new, automated technology will be helped by the development of procedures that explain clearly how things operate, and how they can best be exploited, as well as how to operate them. From the perspective of this project, procedures and training programmes provide excellent opportunities for the management to demonstrate their commitment to safety.

From the managers’ point of view, attempting to solve employee grievances might result in their unit being viewed by senior managers as resistant to the new commercial environment, hence affecting their personal standing. In other words, it was in the managers’ personal interests, in an increasingly insecure job environment, to downplay the concerns of their staff. This was compounded by a historical tendency of manage



ted training programmes, to management support. They use the term “clean sheet of paper” to

Edmondson (2003) provides a detailed account of the introduction of a new technology for cardiac ment for

This new technology removed the requirement for the patient’s breastbone to be split, significantly

needed information that only other memb s le to speak up at critical moments and prese d Edmundson (2003) found that the most succe fu by creating a climate of psychological safety (e ach, discussing the importance of comm i mples, such as not being critical when a mistake was made during the procedure). This account illustrates how the introduction of new techn g rations to the existing culture in order to be successful (e.g. in this case

where it was n).

view

Wiener et al. (1999) attribute a large part of the success of glass cockpits, and their associa

illustrate a prevailing attitude where senior managers chose the best program manager and then provided all the support they required (particularly financial) to support the programme. This is consistent with the findings of the earlier safety culture review, which highlighted the importance of management attitudes and commitment.

Finally, Wiener et al. (1999) suggest the use of electronic flight data as a source of feedback for evaluating the effectiveness of training. However, from a cultural perspective, they stress that these data must not be used for enforcement.

5.2.3. Accounts of Technological Change in Healthcare

surgery. This account focuses on one particular effect of the change, an increased requireopen communication between relevant parties when using the new technology.

reducing the amount of pain and recovery time. However, interestingly from the perspective of this project, the change significantly increased the coordination required between the operating team members. Historically, the culture had been that the surgeon was never challenged during an operation. In the new mode of operation, however, the surgeon

er of the team could provide. This required peope to the prevailing culture. nte a significant challeng

ss l teams had leaders that facilitated speaking up .g. by being positive about the new approun cation to its success, and by providing positive exa

olo y can require altethe culture that the surgeon is always right, was challenged by the new situationsimpossible for the surgeon to always be correct as other people had critical informatio

Helmreich and Schaefer (1994) discuss how team processes can be optimised during organisational change. They suggest that interventions require the commitment and cooperation of all parts of an organisation and, like Edmundson (2003), conclude that this might require compromises in existing practices.

5.2.4. Summary of Technical Change Literature Re

In summary, therefore, there appears to be very little literature that directly addresses the impact of technological change on safety culture. Moreover, there is also very little literature discussing how a positive safety culture might facilitate the introduction of new technology. However, there are accounts of technological and organisational change that provide insights into some of the potential implications of technological change upon safety culture.



6. SUMMARY OF IMPLICATIONS FOR SURVEY OF SAFETY CULTURE REVIEW

The review of safety culture literature has several implications for the remainder of the project. These implications are summarised below.

Firstly, the consensus in the literature is that safety culture has an impact upon safety performance and that safety culture is a stable, enduring characteristic of an organisation.

Secondly, the concepts of safety culture and safety climate are the subject of some disagreement in the literature. For the purposes of this project it is proposed that safety culture is used to refer to stable, core dimensions and safety climate to the stated values and attitudes of stakeholders.

This is related to the next issue, the approach chosen to assess safety culture. Most researchers in this field, coming mainly from an organisational psychology tradition, have used self-administered questionnaires to assess various dimensions of safety climate. However, there is some discussion in the literature regarding the ability of this method to capture the emergent nature of safety culture. Nonetheless, it is not within the scope of the survey stage of this project to redefine the nature of safety culture or to develop new methods of inquiry. Therefore, a pragmatic approach is proposed based around the use of a structured questionnaire designed to cover dimensions of safety culture about which there is some degree of consensus. However, we shall remain aware of the potential limitations of this approach and, where possible, supplement the questionnaire with more open-ended interviews. This may have to be deferred to Workpackage 4 in view of the limited time likely to be available at the various ATC centres to be visited. An alternative approach may be to carry out more interactive group-based sessions, designed to elicit some of the more interactive aspects of safety culture, using the controllers that may be available on secondment at Bretigny. This possibility needs to be investigated.

The focus of the project will be on safety culture issues at the operational level and what changes new technologies may have on this level of safety culture (e.g. team work; communication; trust etc). The project will not focus on safety culture at the management (or regulatory) level or at how the introduction of new technologies was managed. This is not implying that these are unimportant issues, however, they are currently being investigated in other EUROCONTROL studies (references required).

In order to focus the interview structure and content, those safety culture issues which have focused on management (management attitudes and actions; management systems / reporting systems and reward systems) will not be considered in this current project. To summarise, this review has described several surveys of safety culture in a range of different industries. Section 2.5 summarised the results of several reviews, leading to the identification of the following safety culture themes:

• Management attitudes (including work pressure).** • Management actions.* • Employee empowerment / personal responsibility. • Safety management systems / reporting systems.* • Risk (attitudes to). • Reward systems.* • Competence. • Procedures.

* These safety culture themes will not be used in the interview stage of this project (focus is on operational level as opposed to management level)



lines for trust in ATM systems: a literature review.

s be complemented by further questions designed to examine the more affective

n.

The reviews of research in specific industries, provided support for the inclusion of possible other themes including:

• Teamwork. • Communication. • Training.

Trust in people/equipment – see EUROCONTROL (2003) Guide

It is proposed that these dimensions form one input to the design of the survey instrument. However, the survey design will be developed in conjunction with Eurocontrol and will be designed to focus on the particular requirements of the ATM environment. In addition, it is proposed that these dimensioncomponents of the introduction of new technology (e.g. how the employee feels about the introduction of new technology), as it is felt that these components may also influence the organisation’s safety culture. Finally, it should be acknowledged that safety culture is one aspect of an organisation’s culture, and other cultural influences (e.g. national culture), will influence, and be influenced by the introduction of new technology. Whilst these additional influences are outside the scope of the current research project, the project team will remain mindful of their potential contributio



the dimensions discussed in Section 2.5 were used as

• Management attitudes (including work pressure).

The following search terms were used:

Safety management systems/reporting systems

• “new technology” and “risk”

New technology (competence)

Literature discussing the impact of new technology • “new technology” and “air traffic” • “new technology” and “aviation” • “new technology” and “operating room” • “new technology” and operating theatre”

ANNEX B - OVERVIEW OF SEARCH STRATEGY USED FOR IMPACT OF NEW TECHNOLOGY ON SAFETY CULTURE

Whilst no direct research on the impact of new technology on safety culture was obtained, it was felt that research was more likely to have taken place into the impact of new technology on the dimensions of safety culture. To test this,search terms in three online databases felt to provide broad coverage of the available literature (Ingenta, International Bibliography of Social Sciences and Science Direct). These dimensions were:

• Management actions. • Employee empowerment/personal responsibility. • Safety management systems/reporting systems. • Risk (attitudes to). • Reward systems.

Management attitudes • “new technology” and “management attitudes” • “new technology” and “management attitude” • “new technology” and “work pressure”

Management actions • “new technology” and “management actions” • “new technology” and “management action” • “new technology” and “manager”

Employee empowerment/personal responsibility • “new technology” and “empowerment” • “new technology” and “personal responsibility”

• “new technology” and “safety management” • “new technology” and “reporting systems”

Risk (attitudes to)

• “new technology” and “risk perception”

• “new technology” and “competence” These searches yielded little relevant material for the current project. As a result a different search strategy was adopted which aimed to identify more general accounts of the introduction of new technology in three industries: air traffic management, aviation and healthcare. The search terms used were as follows:

EUROCONTROL EXPERIMENTAL CENTRE · european organisation for the safety of air navigation...

Documents

Transcript of EUROCONTROL EXPERIMENTAL CENTRE · european organisation for the safety of air navigation...