THE PARADOX OF RULES: PROCEDURAL DRIFT IN COMMERCIAL AVIATION

Captain Neil Johnston ( anjhnstn@tcd.ie )Aviation Psychology Research Group

Trinity College Dublin, Dublin 2, Ireland

This paper considers the inescapable tendency for procedures and remedial rule-based interventions in organisationsto “drift” in a fashion that is often inconsistent with the intentions of those responsible for original system design.Taking Snook’s (2000) notion of Practical Drift as a point of departure, the paper discusses a range of examplesfrom commercial aviation, with a view to establishing the potential implications for safe and efficient socio-technical systems. The paper argues for a programme of research into the nature of such drift and its driving forces.

Background

The notion of “Practical Drift” (Snook, 2000)originates in the search to establish why formal safetyprocedures may not assure system safety. This papertakes as its point of departure Snook’s book FriendlyFire: The Accidental Shootdown of U.S. Black HawksOver Northern Iraq. Snook’s idea of Practical Drifthas been renamed Procedural Drift here as this termseems better suited to aviation. Maurino, Reason,Johnston & Lee (1995) document the potentiallyadverse impact of hidden latent organisationalfailures on aviation safety. Readers are invited toconsider the role of Procedural Drift in the genesis ofsuch latent failures within complex socio-technicalsystems. Moreover, the thrust of the argument belowis supported by recent findings from Line OperationsSafety Audits (LOSA). The objective here is todocument examples and issues relating to aviationProcedural Drift preparatory to a programme ofresearch into its origins, significance and impact.

Introduction

For the purposes of this paper, Snook’s basicargument can be modified and recast as follows:

• Systems development, procedures for new aircraft,etc. are typically derived from a global or formalperspective. The consequent rules are abstract andnormative, and generally pay minimal attention toapplied realities or operational demands. Thisdominant analytic framework tends to beestablished at the system design phase. This setsthe framework against which various types of“drift” subsequently occur.

• New management teams, if modifying a system,take for granted their assumptions and the outcomeof management debate to be “obvious”. Theyconsequently tend to assume that their local, orparticular, consensus has all the characteristics of arational, universal or generic system response. Thisis all the more so where a management consensushas been hard fought for. By virtue of such putative

“obviousness” management rarely explains ordocuments the rationale, objectives or assumptionsunderlying their new procedural interventions.

• The rationale, justification and history for themanagement consensus are often unclear tosuccessors, who interpret - rather than learn - theintentions behind foundational des ign assumptions.Such (mis-)interpretation of the foundationalrationale and justification is a recurring theme.

• The authors of remedial intervent ions, unlessexperienced, tend to over-design. They do notalways have to work within the system, nor willthey bear the impediment of burdensome orimpractical rules. Moreover, designers andmodifiers do not wish to be retrospectively blamedfor deficient procedural design. For designers,detailed procedural specification is thus preferred.The very fact of comprehensive proceduralisationcan thus become its own justification. Thisunderlies a general management pred ispositiontowards ever more self-defeating proceduralisationas a response to perceived system risk.

• Within every system a contingent daily logic ofwork practice emerges, supported by a socialnexus which evolves in parallel. Locally developednorms emerge over time as operational practicerepeatedly drifts towards acceptable (pragmatic)day-to-day work practices.

• Over time there is further Procedural Drift due tochanges of senior personnel, new managementphilosophies and the input of different supervisorysub-groups. This drift is accentuated when newpersonnel are unaware of the underlying rationaleand assumptions in original system development.As a result, and as is evidenced below, actions indirect contradiction of the original designphilosophy can actually be incorporated into thesystem by well-meaning supervisors.

• There is also an impetus to Procedural Driftoccasioned by the impact of different cycles ofrecruitment, training and organisational change, as

630

well as the distinctive internal political andbureaucratic processes that typify a wide range oforganisational cultures.

• Procedural Drift can also be seen to issue from aloss of global focus, from failures of leadership orfrom confusion regarding the relative importanceof different organisational production goals – suchas operational, safety and efficiency goals. Forexample, procedures introduced for safety reasonsmay give rise to disproportionate operationalinefficiencies (and vice versa).

• Procedural Drift has two primary organizationalfoci: one is the operational “front line”, while theother is within the management “front line”,namely independent supervisory sub-units havingdistinct commercial, efficiency or safety goals.Both foci can be considered as “local” in relationto the global or strategic design intentions thatunderlie original system design and objectives.

Snook (2000, P 197) observes that:

The net effect of this practical drift is a generalloosening of globally defined rationality. Goneis the tightly logical and synchronized rationalethat governed system design and rule productionat birth. In its place are multiple incrementallyemergent sets of procedures, each born out ofunique subunit logics grounded in the separateday-to-day pragmatics of loosely coupledworlds. Gone is the single rationally designed"engineered world" governed by intricate sets ofglobal rules. In its place is an "applied" worldwhere locally pragmatic responses to theintimate demands of the task dictate action. Suchapplied solutions to real-world demands steadilydrive out what appear to local practitioners asill-conceived design deficiencies. Over time, theglobally engineered, standardized organizationis replaced by a series of locally adaptivesubunit logics, each justifying their own versionof "the rules". [Emphasis added].

The Challenge

The foregoing presents the challenge for those whodesign procedures, checklists and other formal meansof system protection. Trade-offs between operationalrealities, procedural content and consistency areinevitable. The best design comes from those with aglobal understanding of foundational system designand the weakness to be addressed through proceduresbut who, by virtue of having a good understanding ofthe realities of applied circumstances, can optimisesolutions that will address incompatible demands.

Such practitioners find solutions that are not alwaysfully consistent at the margin. The best practitionersin this domain therefore practice an art rather than afully specified and rational “procedural science”.

At a more mundane level any management teamfaced with the conflicts discussed here will readilytestify as to the difficulties and long debatesassociated with procedural development andimplementation. Few doubt the sincerity and well-intentioned efforts of management in complex socio-technical organisations. It nonetheless remains a factthat procedural change is frequently problematic andthat front-line personnel can find the justification andrationale behind procedural change hard to reconcilewith their day-to-day operational experience. Thisstatement is not intended to take any particularposition as to whether front-line personnel are eitherright or wrong in their perceptions - given thatoperational inertia and conservatism provide as muchgrounds for resistance to change as does rationalargument. In other words resistance to change itselftells us nothing. Indeed, it too merits careful scrutiny.

Arguments for and against procedural change arenot, in practice, easy to assess, particularly in theabsence of a clear understanding of core strategicsystem objectives. Even a cursory familiar ity withprocedural design will testify that this is an areaneeding much more study. Notwithstanding thepresence of common terminology, there are widevariations between airlines and especially betweendifferent regions of the world. Surprisingly, the word“procedures” even has different meanings and uses,depending upon the airline or geographical region.Moreover, distinctions are often made betweenvariants such as Standard Operating Procedures,Recommended Operating Procedures and NormalOperating Procedures. Some air lines aspire tomandatory, highly detailed and inflexible procedureswhile others are satisfied with a minimal core ofinflexible procedures that are only changed after longdeliberation. A def initive treatment is beyond thescope of this paper. Readers are cautioned toconsider the following examples as illustrative of thecomplexity of Procedural Drift and not as definitive.They aim to demonstrate why we must betterunderstand the phenomenon and its diversemanifestations, as well as its unpredictable genesis.

Selected Examples of Procedural Drift

1. Verbal Augmentation of Checklist Responses. Byway of introduction, consider the following replies(adapted from actual responses) to the item “Flaps”in an aircraft Taxi Checklist. The first of these

631

responses is that nominated in the aircraft checklist.

• Flap 6

• 6 selected and indicated• 6 selected, indicated, leading edge

• 6 selected, indicated, in the detent, leading edge• 6 selected, indicated and in the detent, leading

edge, greens overhead

• 6 selected, indicated and in the detent, leadingedge, 2&5 greens overhead

• 6 selected, in the FMC, indicated, in the detent,leading edge, 2&5 greens overhead

• 6 selected, in the FMC, indicated, in the detent,leading edge, 2&5 greens overhead, performance 6

The last response confirms that Flap 6 is selected, isentered in the flight management computer and thatthe Flap Lever is in the correct flap detent; that lightsfor the leading edge devices are illuminated; that flap6 is indicated on the gauge and that green lights forthe leading edge devices are as expected for the flapsetting. The pilot f inally states that runway take-offperformance calculations are based on Flap 6.

Clearly there is Procedural Drift here, in the form ofsequential additions to the formal checklist response.An extended discussion as to the merits of differentresponses is superfluous here. However, is it notappropriate to ask if the “proper” response (the firston the list) is actually inadequate? Or should oneconsider that a long and detailed response is, in itself,a good thing? How and where does one draw theline? Does it just represent a failure of standards orquality control? Or is this a more complex matter?

2. Reforming Zeal. Few pilots have not fe lt that theycould radically improve some aspect of their airline’sprocedures. If they become managers and have anopportunity to do so, realities come to bear and theyinvariably face unanticipated practical objections andconsidered opposition from colleagues. However,from time to time an individual management pilotcan successfully pursue a strongly held, but ill-advised point of view, against all objections.

For example, some years ago a safety reportingsystem received reports from pilots complainingabout the unwillingness of air line management tolisten to the chorus of adverse pilot reaction to a newLanding Checklist. Pilots appealed for action to betaken in response to the dangers of the new checklist,and management inflexibility. A management pilothad observed that the Landing Checklist on thisaircraft type was, in actual practice, completed in a

manner that approximated to three distinct phases.S/he decided that it would be better to formally splitthe Landing Checklist into three parts and moveitems that could be completed early into the first part,whilst late completion items such as flaps could beleft in the third part. Judged in the abstract the logicof this approach, and the objective of ensuring thateach part was fully completed as a single unit ofcockpit activity, is not as unreasonable as this briefsummary may make it appear. Certainly the managerwas not trying to make things worse. S/he wasmerely seeking consistency and closure. But s/he didso in pursuit of a narrow goal that did not takecognisance of traditional/manufacturer checklistdesign, the previous operational experience of mostpilots and established industry practice.

Pilots complained that the ensuing operational realitywas far from that intended. They reported instancesof confusion as to their position in the checklist andoccasions on which items on the checklist wereimproperly completed or unintentionally omitted. Inessence, an established routine of air line pilotpractice had been discommoded so decisively thatmanifest risk had been introduced in the system. Thiswas the paradoxical outcome of an act actuallyintended to reduce the risk of an uncompletedchecklist. The consequences of Practical Drift arerarely seen in such sharp relief.

3. Seeking Excessive Consistency. Inter-fleetconsistency is a highly desirable objective withinair lines, for important and valid reasons. However,striving for consistency can have unintentional anddisproportionate effects when consistency itselfbecomes the driving objective. The fo llowingexample illustrates the consequences of failing totake a strategic and balanced view of proceduralchange, particularly to the extent that consistencyover-rides other considerations – to the extent thatpractical drift is unintentionally encouraged.

Consider an airline with aircraft from three differentmanufacturers and generations, each with differencesin operating philosophy. If two of these are relativelymodern then the after take-off check willaccomplished sometime after take-off by the non-flying pilot. The non-flying pilot will verbalise thecheck, but s/he alone will verify the completion ofrelevant items. Typically the check ends with bothpilots checking their altimeters, this being the oneitem that is jointly verbalised and crosschecked. Theoverall objective here is to reduce opportunities fordistraction and manage the flying pilot’s workload.However, there is also an older generation aircrafttype which has a “challenge and response” after take-

632

off checklist. The checklist thus requires the activeinvolvement of both pilots. In an attempt to achieveinter-fleet consistency, it is determined that a ll fleetsshould follow the challenge and response checklistphilosophy. However, the requirement for a“challenge and response” checklist on the other twotypes runs contrary to the design philosophy andchecklists produced by the two manufacturers. Moreimportantly, the new philosophy is now introducedon types with a much higher level of aircraftperformance (rate of climb, acceleration, etc). Theeffect of the new standardisation is thus to introducean avoidable source of distraction and workload onthe high performance aircraft types.

In operational practice line pilots periodicallyencounter operational distractions, as identified bythe original research that first suggested the need fornon-challenge and response after-take off checks.Moreover, since these aircraft were first operated formany years using a silent checklist, it is no surprisethat further Procedural Drift occurs (simply by pilotsreverting to previous behaviour and co-pilotsresponding flexibly to variable captain practices).

This is a point of departure for a “dual reality” inwhich pilots sometimes have a performance standardfor normal operations and another for formal eventssuch as checks. It was partly in response to the issuesraised by such dual realities that Degani and Weiner(1994) added a forth “P”, Practices, to their “3Ps”,Philosophy, Policy, Procedures. Degani and Weineracknowledged the need for a two-way assessment ofprocedural non-compliance, noting that both linepractices and operational procedures merit attention.

4. Procedural Drift and Management Decisions. Thefollowing exemplifies how interpretations by pilotscan err if pilots do not understand the underlyingassumptions, intentions and objectives. In somecircumstances terrain or obstacles can affect aircraftperformance after an engine failure in the take-offphase. Procedures vary from airline to air line, buttypically involved a mandatory turn to avoid theobstacle. In the following example superfluous detailhas been removed so as to capture the essentials.

Typically the kind of information provided to pilotsis as outlined in the first four lines of the box at thetop of the next column. As part of training for newpilots it was suggested that a line be added to theprocedure, namely: For Information: Sector SafetyHeight 2,300 Feet. The objective of this change wasto encourage trainees to immediately consider safetyheights after non-normal events. In the belief that itwas inappropriate to expect pilots to consult a second

ENGINE FAILURE ON TAKE-OFFMaintain Runway Heading for 90 secondsTurn left heading 160 o

Minimum Clean Up Height 600 FeetClimb to 1,500 Feet: contact ATCFor Information: Sector Safety Height 2,300 Ft

chart at a time of high stress/workload, all relevantinformation was now provided on a single page.

The foregoing explains the thinking behind thisinitiative. Management assessed the proposal and,unexpectedly, approved the change for both trainingand normal operational documentation. Howeverthey changed the wording in an apparently innocuousway, removing the words “For Information”. It waspointed out that the addition of “Sector Safety HeightXXXX feet” without explanation would generatequestions from pilots (and answers from instructors).It was also noted that thus would introduce the riskthat instructors would interpret what was meant andthat this information might take on a life of its ownand be reified into a procedural requirement to climbto the safety height. This point of view was rejected,but within five years the climb had indeed become a“requirement” in the minds of most pilots. A new“procedure”, and allied training, had thus beenintroduced in circumstances where no explicitdecision to do so had been taken by anyone.Furthermore, not all pilots and instructors shared thesame conception of this procedure. This outcome isnot as unique as it may appear - it just happens to bea particularly good example of processes thatunderlie a particular type of Procedural Drift.

When the information first appeared some pilotsasked instructors and Check Airmen if this nowmeant that they should climb to their Sector SafetyHeight. Few instructors knew of the rationale andsome replied in the negative, while some interpretedthe information to mean that a climb to the SafetyHeight was now required once all dr ills had beencompleted. Over time a consensus developed,without any written guidance ever being issued, andmany instructors conformed to this new consensus. Inactual training practice nothing much changed, sincepractice drills in the simulator never got to the stageof actually climbing to the Sector Safety Height.

This is an appropriate example of Procedural Driftgiven that th is matter is, in the grand scale of things,insignificant. Yet, in exceptional circumstances itcould lead to an unfortunate event. The subsequentinvestigation might ident ify the Procedural Drift

633

discussed above. Someone putatively “caused” thiserror, but to what, or to whom, would one addressresponsibility and a “Probable Cause” finding? Thepossible answers to this question would at leastsuggest some different focus points for research.

Concluding Examples

This sec tion briefly examples of Procedural Driftidentified dur ing research for this paper, but whichcannot be discussed in detail due to space constraints.

1. Modifying Established Systems. It was rapidlyunderstood in the early days of aviation that pilotsmight pass all formal competency checks but beunable to conduct acceptable operations on normalpassenger flights. It was in this context that the ideaof a “Line Check” gained acceptance. The purpose ofthis annual check is to verify that all normal lineoperations are conducted in an acceptable manner. Itis thus a “low key” quality check of “normality”.

However it occasionally happens that Check Airmenbecome rather disillusioned with observing an oftenboring and uneventful normal day-to-day operation.They are also conscious of the fact that some flightsare particularly undemanding, given the absenceoperational challenges. In this context some CheckAirmen may choose to introduce an artificial“challenge” into the Line Check. For the purposes ofthe current discussion the issue of note is that a well-established air line practice is being changed here tothe extent that an avoidable measure of risk - a latentfailure - is being intentionally introduced. This servesto emphasise that the very evaluation of the merits ofsuch actions can become, or reflect, the problematic.It also shows that what is considered by supervisoryand check pilots in one organisation to be wise andsensible may be considered differently elsewhere.

2. Procedural over-specification. Crew briefingswere originally introduced to assure crew co-ordination and shared expectations. Over time formalcrew briefing requirements have grown considerably.For example, an arrival briefing might well have toaddress more than forty different items. There is aconsequent danger that talking can itself becomemore important than crew coordination and thecommunication of essential information. Certainlythe degree of required briefing detail variesconsiderably from airline to air line. There isinsufficient space here to explore Procedural Drift inthis domain beyond making some general comments.It is well identif ied that front-line employees tend toignore, or modify, what they perceive to be over-specified, unwieldy or impractical procedures.

Clearly, the longer the list of “mandatory” items to becompleted the greater the likelihood of ProceduralDrift. Drift also appears to be more common inrepetitive short-haul operations than in long-hauloperations. The evidence also suggests that a range ofdifferent considerations now drive the “growth” inbriefing requirements and it is evident that the manyjustifications for this trend merit explicit evaluation.

3. Written Records. The requirement for writtenrecords seems to be another area in which ProceduralDrift and confusion as to objectives can occur. Itwould appear that when “writing down” becomesmore important than the information itself, counter-intuitive anomalies arise. For example, is it moreimportant to write down a new transponder code, or anew ATC frequency, than to dial it up on the relevantavionics equipment? Arguments, and their underlyingassumptions, as to the correct priorities here areinstructive. At a minimum it seems to have beenforgotten that the dual-frequency selector box thatpreserves the current frequency, whilst permitting thesimultaneous tuning of the next frequency, wasintroduced to address the workload demandassociated with writing down the frequency. Thisexample is again tr ivial, but it provides a point ofentry to clarifying the range of thinking behindair line procedures and pilot operational behaviours.

Issues and Implications

The examples above summarise the problem ofProcedural Drift - which is the fact that apparentlyminor matters become latent systemic failures, evenif they might only impact adversely by becoming partof a unique constellation of improbable events.However, this cannot be an argument for inaction.The fact that management and front line personnelactively create and deal with numerous latent failurescannot be simply ignored in a system that is strivingfor a quantum reduction in system vulnerability.

But there is more to this phenomenon. Just as LOSAreports suggest that checklist protocol deviations area major issue in flight operations, when we look at awider canvas it is clear that for as long as studieshave been conducted, various types of non-compliance have been repetitively identified acrossa range of high-risk activities, from aviation tomedicine. For example, in respect of aviationmaintenance, McDonald et al (2000) conclude that:

One of the starkest conclusions from thisresearch is that in fundamentally importantrespects the systems for ensuring safety andreliability in aircraft maintenance do not work

634

as they are supposed to do. In so far as they dowork as effective systems, this appears to bebecause of unoff icial and informal mechanismswhich are neither recognised nor valued in theway in which the systems are commonlyunderstood by those responsible for them. Inmany ways these informal mechanisms rundirectly counter to the expressed goals andvalues of such systems …Violations of the formalprocedures of work are admitted to occur in …one third of maintenance tasks. While it ispossible to show that violations of proceduresare involved in many safety events, manyviolations of procedures are not, and indeedsome violations (strictly interpreted) appear torepresent more effective ways of working.

People who are careless or incompetent do notcreate this dual reality. On the contrary, the researchsuggests that the best-motivated workers frequentlyfeel obliged to resolve the tension between practicaltask demands and procedural inconsistency. In fact,resolving the tension between formal proceduresand actual work practices seems to occur across awide range of work tasks involving both complexityand socio-technical systems.

Conclusion

It is unclear how significant Procedural Drift is toaviation safety. As the examples illustrate, it is easyto consider Procedural Drift as a manifestation ofmanagement’s failure to manage, or of a failure byfront-line employees to adhere to job requirements.It could be argued that the consequences are trivial.There is, however, enough evidence to suggest thatperhaps there is more to this phenomenon than meretriviality. It certainly merits a program of research.

The issue of management control, assessment andmonitoring of procedural change will be relevant tosuch research. In this regard the relative stability ofprocedures in larger carriers bears comparison withthe more regular procedural change in some smallercarriers. Nonetheless, it is equally clear that somelong-established carriers tend to have a more “turgid”and inflexible operation than the new generation of“low cost” carriers. What is at question here areissues relating to management’s global focus, controland balance in assessing the inevitable trade-offbetween competing safety, efficiency and otherdemands. There is also a paradox to be resolved, tothe extent that the very rules intended to reducevariability often create unexpected variability. Thisis accentuated by responses to complexity that resultin adding yet more complexity, whether in the form

of more rules, procedures or layers of control. These,paradoxically, may reduce rather than contribute tosystem safety. Such paradoxes may be resolved bycareful consideration of differences betweenstandardisation, proceduralisation and obligatoryrules, particularly as these relate to both tightly andloosely coupled operational systems (Lintern, 2003).

At a more philosophical level we face the challengeof coming to a better contextual understanding ofwhat words such as “violation” and “error” mean. Toproperly understand Procedural Drift we also need aprincipled method of examining actions, intentionsand understanding as “meaning-making in context”.

Such considerations provide the research challenge.Solutions are likely (a) to successfully align globalrationality and local rationality in some principledway, and (b) to do this in explicit recognition that nosystem, not to mention socio-technical systems, isfully specifiable (Lintern, op. cit.). Developingprocedural design principles, or basic “rules ofthumb” for managers, including methods of qualitycontrol would be advantageous. Moreover, managerswill manifestly benefit from research that providesboth practical guidance and training guidelines.

References

Degani, A. & Wiener, E.L. (1994). Philosophy,Policies, Procedures, and Practices: The Four "P"s ofFlight-Deck Operations. In Johnston, A.N.,McDonald, N.J. and Fuller, R.G., (Eds.). AviationPsychology in Practice. London: Ashgate

Lintern, G. (2003). Tyranny in Rules, Autonomyin Maps: Closing the Safety Management Loop. InR. Jensen, (Ed), Proceedings of the TwelfthInternational Symposium on Aviation Psychology,April 14-17, 2003, Dayton, Ohio [CD-ROM].

Maurino, D.E., Reason, J., Johnston, N. & Lee, R.(1995). Beyond aviation human factors: Safety inhigh technology systems. Aldershot, UK: Avebury

McDonald, N., Corrigan, S. & Ward, M. (2002).Cultural and Organizational factors in system safety:Good people in bad systems. Proceedings of the 2002International Conference on Human-ComputerInteraction in Aeronautics (HCI-Aero 2002) p 205-209. Menlo Park, CA: American Association forArtificial Intelligence Press.

Snook, S.A. (2000). Friendly Fire: The AccidentalShootdown of U.S. Black Hawks Over NorthernIraq. Princeton U.P. New Jersey.

635