The Art of Balance: Using Upward Resilience Traits to Deal with Conflicting Goals
This chapter describes some of the processes involved in balancing conflicting goals (e.g., between safety and operation) in a change-intensive environment by using examples from civil aviation transport. The ability to handle multiple goals involves the use of both downward and upward resilience traits to address potential conflicts. By downward resilience, we mean that macro-level directions and solutions prepare for resilience through clear goal structures, infrastructure and procedures that handle the trade-offs between safety and efficiency. Upward resilience means that decisions made at the micro level in a system reflect a commitment to safety in case of goal conflicts. Changes, caused either by external or internal drivers, may alter these resilience traits by introducing loss of oversight. Changes made at the macro level of the system might have unintended consequences on the micro level, and vice versa. The chapter is based on studies conducted in the Norwegian civil aviation transport system.
Even though a range of incentives exists in our society to ensure that commercial aviation operates safely (e.g., public opinion, passenger lists, lawsuits), the importance of highlighting the balance between safety and production goals is still prevalent (Perrow, 1984). In a change-intensive environment with coexisting and conflicting pressures from macro- and micro-level actors, managers may set their priority on cost optimisation without having good aviation safety indicators to warn them about the erosion of safety margins (Rasmussen, 1997; Woods, 2005; Woods, 2006a, 2006b).
During the last decade, the civil aviation transport system has been exposed to several externally and internally motivated changes. Such changes have come in the form of new EU legislation and regulations, deregulation of the market, new business structures (e.g., mergers, restructurings, relocations) and new technologies. An increased focus on efficiency and cost reduction has been observed, leading to questions about whether this pressure has negative effects on the prioritisation of safety (Høyland and Aase, 2009; Aase et al., 2009). Historically, conflicting goals have been shown to be part of the causal explanations of several serious aviation accidents in Norway. Analysis of accident investigation reports has revealed that in the Skagerak accident (1989, 55 fatalities), pressure to uphold the flight programme due to a critical company economy was part of the accident picture. In the Namsos accident (1993; six fatalities), the investigation board recommended that the airline company’s board of directors and top management clarify their principles for safety priority versus regularity, timeliness and economy (Tjørhom and Aase, 2010).
In this chapter, we want to explore how the processes of balancing conflicting goals are handled in today’s aviation system and whether the balance between safety and production in a system becomes more complicated when changes, caused by either external or internal drivers, represent major elements of the context in which the system operates. The chapter uses empirical examples based on qualitative studies at different levels of the Norwegian aviation system (legislation, regulation, air traffic control, airport operation and airline maintenance). The main topics of the studies have been safety, management commitment to safety, change and safety prioritisation (Aase et al., 2009; Tjørhom and Aase, 2010, 2007; Høyland and Aase, 2009; Høyland et al., 2008; Pettersen and Aase, 2008; Pettersen, 2006, 2008; Hauland et al., 2007; Bjørnskau, 2005).
According to Reason (1990), ‘All organisations have to allocate resources to two distinct goals: production and safety.’ In his opinion, these goals are agreeable in the long term, but from a short-term perspective, given a lack of resources, it appears as though production takes precedence over safety. Hollnagel describes the process of balancing safety and efficiency by using the efficiency-thoroughness trade-off (ETTO) principle (2009b, 2004, 2002). In this perspective, people adjust their work according to current conditions. It is never possible to be completely thorough, or fully efficient in view of scant resources, such as time, workforce, and money. According to Hollnagel, every work situation calls for trade-offs between thoroughness and efficiency. The trade-off tendency or favouritism of either efficiency or safety is dependent upon the dominant concern within an organisation or a system. It follows from the ETTO principle that it is never possible to maximise both efficiency and safety.
The problems with trade-offs involving safety, resilience or thoroughness are reinforced by the difficulties associated with measuring safety. Gaba (2000) points to the fact that signals of safety are weaker than signals of production and further refers to the asymmetry regarding measuring of these two goals. Where economic performance has a history of measurement for anticipation, safety often comes up short due to lack of leading indicators, thus creating difficulties in stating the relationship between resources and gains regarding safety. The picture becomes even more blurred as a result of the focus placed on ‘best practice’ (Hubbard, 2009) during the last decade. By collecting examples from successful organisations, one seeks to adapt to best practice standards for operation. These standards might address both safety and operation, but as Woods (2006a) pinpoints, what if there are too many goals implemented within an organisation? What if the different ‘good’ solutions compete and thereby create tension, or even worse, make the system less resilient?
To ensure that a system is able to handle the balance of fundamental trade-offs such as safety versus production (efficiency-thoroughness, optimality-brittleness, acute-chronic goals), one must create knowledge of the state of the art regarding safety and the ability to handle uncertainties. Where are the system’s borders with regard to safety? The interactions of trade-offs create a need to consider sacrifice judgements or decisions where acute goals are sacrificed to put more emphasis/resources on achieving chronic goals like safety (Woods 2006a, 2006b). Sacrifice judgements involve the process of temporarily sacrificing acute production or efficiency related goals, or relaxing the pressure to achieve these goals, in order to reduce the risks of approaching too near safety boundaries (Woods 2006a: 32). Sacrifice judgements may occur when an approach to an airport is broken off during weather that increases the risks of wind shear, or when a take-off is delayed due to maintenance technicians’ suspicion of airplane-related technical faults (Pettersen, 2008). In other contexts, safety might get sacrificed at the expense of effectiveness due to double binds created by poor accountability and brittle strategies that exacerbate goal conflicts. An aviation example is when an aircraft is de-iced and then enters the queue for take-off. The effectiveness of the de-icing agent degrades with time. Delays in the queue may raise the risk of ice accumulation. There have been several airplane crashes where, in hindsight, crews accepted delays of too great a duration and ice contributed to a failed take-off (Woods et al., 1994).
Downward and Upward Resilience
Woods (2006a) uses the phrase cross-scale interactions to describe the interrelations within a system. Decisions made at the strategic, or macro level of the system, might impact decisions made at the operational level or micro level, and vice versa. Woods (2006a) further operationalises cross-scale interactions by using the concepts of downward and upward resilience to describe the interrelated processes of value to resilience within a system, such as the civil aviation transport system, where decisions made at one level might have implications for system functions elsewhere in the system. Downward resilience includes macro level directions and solutions preparing for resilience through clear goal structures, infrastructure, and procedures to handle tradeoffs. Upwards resilience includes decisions made at the micro level reflecting a commitment to safety in cases of goal conflicts (sacrifice judgements).
Downward resilience is of importance because the context and structures of a system either foster resilience or induce pressure towards resilient operations. For instance, will the ability of macro-level actors or ‘distant supervisors’ to communicate intent about goals, plans and procedures act as a downward resilience trait influencing how people at the micro level adapt to these governing tools? Local micro-level actors may use the distant macro level supervisors’ or authorities’ statements of intent behind goals, plans, and procedures in cases of unexpected events or changes (Shattuck and Woods, 1997; Woods and Shattuck, 2000). The absence of a clear goal structure, communication of intent behind the goals and a lack of willingness to implement adequate technology might create poor conditions for resilient operations and sacrifice judgements for front-line personnel. Safety goals should act as yardsticks meaning that deviations from the goals could appear as warning signals for operators and managers when operations exceed safety margins. Front-line operators may not be able to fully understand the consequences of a chosen deviation from prescribed rules because their actions or trade-offs are made in a specific contextual frame of reference – from their point of view in the organisation (Dekker, 2006). Repeated deviations from the prescribed design may, over time, become a new rule, which means that the design and the real operations become unequal (Snook, 2000; Vaughan, 1996, 2006). An accumulation of such deviations makes the system opaque and it becomes difficult to know if the decisions made regarding trade-offs are really sacrifice judgements
Upward resilience is of importance because local micro level actors might create resilience in a system using their experience, flexibility, and professionalism to handle the gap between rules and procedures, and the actions required to adapt to new circumstances (McDonald, 2006; Pettersen and Aase, 2008; Morel et al., 2008). These actions of the micro-level actors might be reflected in decisions made at the macro level as new strategic goals, elaboration of new procedures or implementation of new technology. The opposite, creating a threat to upward resilience is when operators and decision makers in the front line get stuck in a single problem frame and miss or misinterpret new information that should force re-evaluation and revision of the situation (Klein et al., 2005; Patterson and Woods, 2001). Research appears to indicate an emerging understanding of the gap between design, procedures and rules, and the work that is really going on in the front-line (Snook, 2000, McDonald, 2006; Pettersen, 2006; Pettersen and Aase, 2008). This gap can be described by hidden grey zones potentially inherent in design, procedures and rules that call for new ways to handle the operations (Pettersen and Aase, 2008). When situations appear that call for such flexibility, the operators and manager make sacrifice judgements (McDonald, 2006). These judgements are frequently based on experience and depend on professionalism among front-line operators. Professionalism means that within a system, there exists an ability to use experience and knowledge in addition or even instead of written procedures. In a study of professional sea-fishing skippers, Morel et al. (2008) found that they used multiple expert strategies to reduce risk without giving up on their fishing activity. They relied on a high level of adaptability, linked to an exposure to frequent and considerable risk. Such professionalism or craftsmanship serves as a buffer in situations of trade-offs between safety and production goals (Høyland and Aase 2009; Morel et al., 2008).
As we have seen, the ability to balance multiple goals involves using both upward and downward resilience traits and most importantly the interactions between them and across system levels. Changes caused by either external or internal drivers may alter these resilience traits by introducing loss of oversight or emerging risks. Let us now turn to some examples from real practice.
Traces of Balancing Within the Norwegian Aviation Transport System
During the last decade, the Norwegian aviation transport system has been influenced by numerous and extensive changes. These changes, along with the interconnectedness of the transport system, might impact the ability to handle multiple goals within the system. The complexity within the system is greater than ever, meaning that the risks associated with these interdependencies might be extensive and it could be useful to discuss them using the concepts of downward and upward resilience.
Methodology
To illustrate the issues of balancing, we will in the following use examples from different research studies undertaken within Norwegian civil aviation (Aase et al., 2009; Tjørhom and Aase, 2009, 2007; Høyland and Aase, 2009; Høyland et al., 2008; Pettersen and Aase, 2008; Pettersen, 2008; Hauland et al., 2007; Pettersen, 2006; Bjørnskau, 2005). The studies cover empirical data (collected over a period of four years, 2004–2007) from three cases that represent different levels of the aviation system.
• The legislation/regulation case consists of 26 interviews with inspectors, advisers and managers in the Norwegian Civil Aviation Authority (NCAA) and 12 interviews with employees in the Ministry of Transport and Communications. The objective of the study was to describe safety policies, perceptions of safety, safety practices and changes.
• The air traffic control (ATC)/airport operation case contains a study of five airports with 126 informants (interviews), aimed at diagnosing the safety culture as a means for improvement. The case also includes qualitative free text data concerning changes and safety aspects from a questionnaire survey, with 231 respondents (managers, planners, engineers, air traffic controllers) from ATC and airport operation.
• The maintenance case was carried out as an exploratory study of a line maintenance department, with participant observation, 15 interviews and a number of informal discussions. The goal was to gain insight into how safety is created and maintained through work practices at an individual/group level. The case also includes free text data from a questionnaire survey, with 283 respondents within maintenance (managers, planners, engineers, aviation technicians).
Using data from the different case studies in this study was done by searching the empirical material and the previous research publications for issues covering the topic of goal conflicts and for empirical examples on processes of balancing safety and production.
Downward Resilience?
There has been a transition towards deregulation of the aviation transport market, which has influenced the economic situation within the aviation business. Due to economic pressure, the structure of the companies has changed. Companies have been downsized, bought, and merged. Further, within the safety regulation framework, there has been a transition from national regulation towards a standardised EU framework for safety rules. The Norwegian Ministry of Transport and Communications states: ‘The Ministry is responsible for the framework conditions within aviation transport in Norway.’ This general and overall statement is handled by the Ministry’s subordinate agency, the Norwegian Civil Aviation Authority (NCAA), which is assigned responsibility for ensuring that civil aviation in Norway is operated safely and efficiently. This responsibility is made explicit in the NCAA’s vision: ‘NCAA should be an active initiator for safe and community-serving aviation services.’
The background for this vision influenced by the current Ministry is the knowledge that civil aviation plays a more important role in the transport pattern in Norway than it does in most European countries and that civil aviation makes an important contribution to maintaining settlement and employment throughout Norway. The result is a network of 46 state airports across the entire country (approximately 4.8 million inhabitants). The objective of being both ‘safe’ and ‘community-serving’ seems to contain potential goal conflicts according to an informant from NCAA:
Our goal is to be both community serving and contribute to an increased safety level within aviation. I do not agree with such double-edged goal, in my opinion our job should be to say NO to anything that may harm safety! But there are lots of difficult decisions regarding exemptions from rules and regulations that we have to deal with.
The Norwegian Aviation Act of 1993 is a so-called delegation act, which leaves to other institutional bodies the responsibility to elaborate on the details found in the body of rules. There are no clear statements from the Ministry on how potential conflicts should be handled by the NCAA in their activities related to supervising and ensuring compliance with regulations and conditions. The challenge of conflicting goals inherent in the statements of the Ministry and the NCAA might be even more prevalent because the political system in Norway is uncertain, consisting of many small political parties that form coalitions. In practice, this uncertain nature means a new political environment emerges every fourth year. Employees in the Ministry express the following about changes in government:
‘The department changes colour, quite a lot of the attitudes change. But from day to day, the jobs we do are the same.’
‘New government? Then we have to fling ourselves into the new government’s declaration.’
‘It often happens during preparation of different cases or elucidations that we become aware of the fact that what we prepare is against political decisions. It is important for us to act tidy on these issues.’
Changes in political climate might generate a change in the goals and statements of the Ministry of Transport and Communications, and consequently, the NCAA, that is, if a political party is especially focused on regional policy, the implication could be that when this party assumes power in the government, it might abandon existing plans for closing down some of the short takeoff and landing (STOL) airports in Norway that do not satisfy the demands for airports within the EU or follow the international body of rules.
Because the NCAA still holds the technical competence to license the operation of STOL airports, it becomes their task to decide whether exemptions from existing regulations must be granted in order to operate these STOL airports. In the absence of an overall defined trade-off, the decision to exempt or not becomes a struggle between professional considerations and current political composition. This struggle indicates a vulnerability regarding the commitment to safety (or not) among the employees in the NCAA. It also returns to the role of the Ministry of Transportation to demonstrate a commitment to safety. As one NCAA employee said: ‘We are the government’s instrument for both a safe and community-serving aviation. Viewing resilience as an interrelated system, it becomes important to know the Ministry’s opinion about commitment to safety.’
This lack of clear guidance from the Ministry on how to prioritise conflicting goals is what Grote (2004, 2008) denotes as a deficiency in rules management. She describes ‘rules management as a source for loose coupling in high-risk systems’ (2008: 91). Rules can function as glue within organisations, which makes the working operations consistent even when workers must adapt to unfamiliar events. If rules should be resources rather than determinants for action, we must distinguish between different specification levels of rules. We can differentiate rules for goals, processes, and actions (Hale and Swuste, 1998). These three types of rules could be viewed as following an axis, where goal rules are the most strategic of the three and action rules are the most detailed.
The lack of distinct goal rules worked out by the Ministry of Transport and Communications has created an inherent tension between the double-edged objective of both ‘safe’ and ‘community-serving’. None of the stated visions by the Ministry or the NCAA can serve as goal rules that give the organisation a common direction for making trade-offs between safety and production. Indeed, the visions of both organisations lack the dimension of giving direction for determining trade-offs between safety and efficiency. Decision makers then lack the directions that give them the power to make sacrifice judgements (Woods, 2006a). Without any clear or well-defined overall goal rules for safety from the macro level of the Norwegian aviation system, it is difficult to claim that the system has an inherent downward resilience.
Upward Resilience?
Within ATC/airport and operation, goal conflicts have been identified as being related to prioritisation between efficient traffic handling and safety. Differences between airports exist, in which some handle the possible conflicts by choosing safe work practices, some by addressing the conflict upwards in the hierarchical system, and some by providing the necessary resources for safe operations. The experience of other airports indicates that efficient traffic handling gets prioritised over safe operations, thus resulting in procedure violations (Høyland and Aase, 2008; Høyland et al., 2008). The examples show that when the operators experience a commitment to safety by their managers, they dare to make sacrifice decisions, as they do at the airports where they feel that commitment. The opposite is true at airports where the operators experience a lack of commitment from their management, and thereby tend to give efficiency precedence over safety. At the airports where economic pressure gets precedence towards safety, the employees expressed the situation as:
‘It is not possible to get support for safety by the managers.’
‘We feel pressure towards too much overtime work.’
‘Operative personnel might lack of time to [resolve] safety issues caused by continual pressure towards administrative work task[s].’
Within aviation maintenance, the technicians report that formal descriptions of work are part of their knowledge base. In addition to the written procedures, they must elaborate on their problem-solving procedures. These procedures are used when situations call for flexibility. The standard operating procedures are static tools that need to be justified to keep the system resilient. Such problem-solving procedures are ‘embedded in the heads and hands of the practitioners’ (Pettersen, 2006, 2008). The technicians report about intuitive feelings that guide their judgements, based on years of experience, which offer them a comprehensive view of their part of production in an appropriately safe manner. According to the technicians, their freedom to choose safety over efficiency has changed. They experience conflicting goals related to keeping the aircraft safe from technical faults while simultaneously getting the aircraft operational within the time limit of its planned schedule. They report that when they experience conflicts regarding making (in their view) good tradeoffs, they often resolve those conflicts by creating time spaces (‘delays due to technical reasons’) to ensure the airplane becomes technically airworthy (Pettersen and Aase, 2008). In the trade-off between punctuality and safety, the operating technicians were committed to making sacrifice judgements.
Due to the current change intensity of the Norwegian civil aviation system, many technicians have experienced increased demands for productivity. When they were asked about their perception of how the current changes affect safety, the following statements were frequent:
‘Economy gets precedence over safety.’
‘There is an odd mixture of safety and profit.’
‘Generally increased demands for improved efficiency.’
‘The trust in central management is considerably weakened caused by their onesided focus on economy.’
Their perception of an increased focus on production is a challenge when it comes to their commitment to safe work practices. According to Woods (2006a), the frames for making sacrifice judgements have then been altered. Lacking a framework for sacrificing judgements based on clear and common goal rules that create downward resilience, the technicians must make their own action rules (Grote, 2008), as exemplified by ‘delays due to technical reasons’ rooted in their technical competence.
In the Norwegian aviation transport system, different studies have shown that there is a lack of commitment to downward resilience at the macro level, due primarily to the tension inherent in the double-edged objective of being both safe and community-serving. The prioritisation of regional policy (community-serving) and an unwillingness to develop distinct goal rules for balancing safe and community-serving air transport, place downwards pressure on the aviation system. Despite deficiencies in the downward resilience, upward resilience traits at the micro level of the aviation system seem to counterbalance the picture by characteristics such as a clear commitment to safety, sacrificing decisions, and establishing resource buffers to handle safety in critical situations. The critical issue regarding resilience in the Norwegian aviation transport system seems to be the awareness towards vulnerability caused by the system’s dependency on upward resilience.
These findings have implications for different levels of the aviation transport system. We propose following actions to strengthen downward resilience.
• Development of clear safety goal rules at the governmental level.
• Downward resilience is threatened by the unwillingness to state clear goal rules at the strategic level. After years of changes within the aviation transport system, employees need clear statements that give them a framework to remain flexible and committed to safety despite economic pressure.
• The goal rules should be based on worst-case scenarios using input from the entire aviation transport system. The institutional level of the system must be responsible for collecting information regarding trends that threaten resilience.
• Development of guidelines and requirements for addressing cross-scale interactions.
• The training tools should include participants from different levels and professions.
We propose following to strengthen upward resilience.
• Foster perpetual awareness among operators.
• Without a constant unease about the way to handle an operation, one might become lost in routine and fail to notice variations. Even a seemingly insignificant variance in operation must be taken as a potential leading indicator regarding threats against resilience.
• Extend operators’ collaboration with other parts of the system.
• A strong focus on professional values might have some downsides (McDonald, 2006). Within a profession, self-confidence may evolve to the level of overconfidence. In a trade-off situation, this may result in over-reliance on the individual’s judgement – at the expense of cautious prudence. Technicians and airport operators might rely too heavily on experience and knowledge, thus taking unnecessary chances without fully embracing the body of rules. Interrelations necessitate an exchange of knowledge across professions.
The tension between downward and upward resilience in the aviation system that we have studied is balanced by a strong professionalism throughout the system, which functions as a buffer and makes safety goals prevalent over production goals. To uphold this art of balancing, it is in our opinion crucial to develop strong but flexible goal rules at the macro level to demonstrate a commitment to safety that micro level actors find trustworthy. At points of intensified production pressure and higher organisational tempo, extra investments in sources of resilience are required to keep production/safety trade-offs from sliding out-of-balance. In other words, safety investments are most important when least affordable (Woods, 2006b).