From SKYbrary Wiki
A Violation is an intentional action (or inaction) that results in noncompliance with known rules, policies, procedures or acceptable norms.
Deliberate sabotage is in theory a violation, however, that is another subject, and this Article is concerned only with day-to-day cases of deviation from rules etc.
The fundamental difference between errors and violations is that violations are deliberate, whereas errors are not. In other words, committing a violation is a conscious decision, whereas errors occur irrespective of one’s will to avoid them.
It is possible that someone unaware of a procedure will violate it, clearly without knowing. One could say, then, that this was not a deliberate act, despite it being a violation. Such scenarios do occur and the root cause is usually found within organisational factors rather than human.
James Reason states that the boundaries between errors and violations are not hard and fast, and he describes “system double-binds” that make violations inevitable, no matter how well-intentioned the operator may be.
Feedback from airline LOFT programmes show that violations occur regularly. Furthermore, one third of violations are mismanaged, and lead to further violations or errors. Such data comes from day-to-day routine operations where no negative consequences occurred. This is in contrast to accidents and incidents whose negative outcomes are too often linked with human error and procedural noncompliance (some examples of which are described below in this Article).
Some violations, therefore, do cause or contribute to negative consequences, but many do not. Although, from experience we know that the more unsafe acts that occur without negative consequences, there is an increased probability of negative consequences from some of them (Heinrich Pyramid). Because aviation workers mostly do not experience any direct cause-to-negative effect when they commit a violation, then the degree of risk can remain unconsidered. Furthermore, when violations result in positive outcomes, the possibility of any additional risk is not considered. There may seem to be no visible drawbacks to violating; instead, just positive reinforcement of the violating act.
Unless openly discussed during training (e.g. CRM and TRM) or debriefing normal operations, lessons may not be learnt from violations as they remain “taboo”. Ironically, violators may assume that other humans in the system are operating and performing normally (i.e. no other errors or violations): whereas, the possibility should always be considered as a potential threat.
Therefore, it is important to realise that when negative consequences do occur as a result of a violation (apart from sabotage), the person committing the violation did not intend the dramatic negative consequences. Instead they believed that the situation remained under control despite the violation. This is why violations mostly do not demand punishment.
Types of Violation
There are several different types of violations (NB: there are different categorisations in use):
Unintentional Violations arise from procedures that are impossible for people to follow, often because they are confusing, complex and ambiguous. An example might be where an air traffic controller exceeds the maximum number of work/duty hours after reaching an incorrect conclusion from a complicated duty-rest time planning tool. In this case, the violation is very similar to the class of error known as a “mistake”.
Routine Violations result from automatic and sometimes unconscious behaviour. They are habitual actions (strong, but wrong, habits) accepted by the particular work group as normal business, and are often tolerated by the organisation and/or governing body. Employees will usually consider routine violations as low-risk to themself and the task. For example, airside drivers may always drive 10km/hr above the mandatory speed limit.
Situational Violations are the result of organisational and environmental factors that make it difficult for employees not to commit violations. These factors include time pressure, lack of supervision, poor ambient conditions (e.g. light, noise, heat), insufficient resources, and a negative culture. Technicians may find themselves “signing-off” completed work on an aircraft without acquiring the necessary supervisory cross-check. Either because of a lack of supervisors, or because the process takes too long.
Optimising Violations occur when people try to make a task more exciting or interesting to impress others or to relieve boredom. These are common when people are involved in long periods of monotonous work, such as monitoring tasks, or when the rules are restrictive or outdated. This can be characterised by bored and fatigued pilots during a quiet long-haul flight - let’s see what happens when we push this button!
Exceptional Violations are rare occurrences that take place in very unusual circumstances (e.g. emergencies, equipment failure). They can be the result of a conscious decision to violate or an instinctive reaction to the situation. Conscious decisions may include landing with an excessive tailwind on a long runway following an hydraulic systems failure, rather than risk further consequences during the time it takes to re-position for the preferred runway. Instinctive reactions fall much closer to the caveat that pilots may violate rules if it is safer to do so – i.e. continuing with an unstable approach to land following an uncontained engine failure.
Using Rasmussen’s levels of performance it can be said that:
- Routine violations tend to occur at the skill-based level – they have become part of a person’s automated routine.
- Situational violations tend to occur at the rule-based level, where people take actions deemed necessary to get the job done.
- Exceptional violations tend to occur at the knowledge-based level as they are mostly occurring in unique and unfamiliar circumstances.
People Violate within Organisations
There are many reasons why people violate, and each case can be considered as unique; however, patterns of behaviour do emerge. James Reason describes two factors, in particular, that are important in facilitating habitual violations, namely:
- the natural human tendency to take the path of least resistance, and
- an indifferent environment, i.e. an organisation, or Industry, that rarely punishes violations or rewards compliance. One could add, an organisation that places greater value on getting the job done rather than how it is done.
Violators are not all fallible to the path of least resistance, they may also be very motivated, and trying to do things “better” for the Company. This makes management pilots (for example) more likely to violate, especially in small companies.
Often the conditions that induce violations are created, because the organisation cannot adapt fast enough to new circumstances. Processes, personnel, facilities, equipment, locations may all change, but unless procedures are adapted they may no longer be useful, putting pressure to work-around. Lack of leadership, finances, resources etc. can lead to workers making the most of what they have.
Acceptance of a non-compliant way of doing the job may have become part of the local working culture.
The Lethal Cocktail
These are known factors that increase the probability of people committing violations:
- An expectation exists that rules will have to be bent to get the work done.
- Feelings that having “higher” skills and experience justifies permission to deviate from standard procedures. Perhaps accompanied by the general view that “rules” are there to “capture the lowest common denominator”, and, of course, humans nearly always overestimate their own capabilities!
- Opportunities exist for short cuts and other ways of doing things that seem to be “a better way”.
- Poor planning, preparation and resourcing, such that people are put into situations where it is necessary to improvise and solve problems as they arise.
Ideally an organisation will have effective management systems whereby day-to-day operational data is collected and analysed and the results fed back into training, procedure design, management, resourcing etc. Within this data will be “evidence” of what violations are occurring, why, and in what context. Root causes can then be addressed at the organisational level. This does not mean carte blanche that dangerous and reckless behaviour should always be tolerated. If an effective Just Culture exists, backed up with policies and leadership, then workers will gladly take up their responsibilities knowing that they will be fairly protected whilst reckless colleagues will be addressed as is appropriate to each case.
An effective strategy for managing violations will include the establishment and maintenance of a effective management systems that ensures, at a minimum, the following:
- Good leadership, planning, training, and resourcing.
- Both management and employees are aware of their responsibilities and key risks related to their work and understand how violations reduce vital safety margins. *Channels are established to communicate difficulties and to discuss solutions. This facilitates learning about problems and adjusting planning accordingly to avoid strains, which could lead to violations.
- Existing violations are analysed to fully understand their causes and any contributing human and organisational factors. Use of a standard taxonomy and descriptors for the different types of violation can help with understanding as well as directing mitigating measures.
- A change management process is established such that pre-determined and unexpected changes are safety assessed to consider impact on human performance.
- Employees are invited and encouraged to participate in setting boundaries and limits, as appropriate, of what is acceptable and unacceptable.
- A defined and measurable programme for workplace culture improvement is undertaken, such that violations are not an acceptable option for employees.
- Appropriate communication and feedback systems are used to ensure all the above happens, and employees really “feel it”.
Accidents & Incidents
Events in the SKYbrary database which include violation as a contributory factor:
- A310 / B736, en-route, Southern Norway, 2001 (On 21 February 2001, a level bust 10 nm north of Oslo Airport by a climbing PIA A310 led to loss of separation with an SAS B736 in which response to a TCAS RA by the A310 not being in accordance with its likely activation (descend). The B736 received and correctly actioned a Climb RA.)
- A310, Vienna Austria, 2000 (On 12 July 2000, a Hapag Lloyd Airbus A310 was unable to retract the landing gear normally after take off from Chania for Hannover. The flight was continued towards the intended destination but the selection of an en route diversion due to higher fuel burn was misjudged and useable fuel was completely exhausted just prior to an intended landing at Vienna. The aeroplane sustained significant damage as it touched down unpowered inside the aerodrome perimeter but there were no injuries to the occupants and only minor injuries to a small number of them during the subsequent emergency evacuation.)
- A320 / CRJ2, Sofia Bulgaria, 2007 (On 13 April 2007 in day VMC, an Air France A320 departing Sofia lined up contrary to an ATC Instruction to remain at the holding point and be ready immediate. The controller did not immediately notice and after subsequently giving a landing clearance for the same runway, was obliged to cancel it send the approaching aircraft around. An Investigation attributed the incursion to both the incorrect terminology used by TWR and the failure to challenge the incomplete clearance read back by the A320 crew.)
- A320, Halifax NS Canada, 2015 (On 29 March 2015, an Airbus A320 crew mismanaged the descent during a night non-precision approach at Halifax and continued below MDA without the mandatory autopilot disconnection until, with inadequate visual reference, the aircraft impacted terrain and obstructions 225 metres short of the runway. The aircraft was destroyed but there were no fatalities. The Investigation found that the crew did not monitor their descent against the required vertical profile, as there was no SOP requiring them to do so, and did not recognise in time that a go around was appropriate.)
- A320, Hiroshima Japan, 2015 (On 14 April 2015, a night RNAV(GNSS) approach to Hiroshima by an Airbus A320 was continued below minima without the prescribed visual reference and subsequently touched down 325 metres before the runway after failing to transition to a go around initiated from a very low height. The aircraft hit a permitted ground installation, then slid onto the runway before veering off it and stopping. The aircraft sustained extensive damage and an emergency evacuation followed with 28 of the 81 occupants sustaining minor injuries. The Investigation noted the unchallenged gross violation of minima by the Captain.)
- A320, en-route, Denver CO USA, 2009 (On 21 October 2009, an Airbus 320-200 being operated by Northwest Airlines on a scheduled passenger flight from San Diego to Minneapolis-St Paul, with the Captain as PF, overflew its destination at cruise level in VMC at night by more than 100 nm, after the two pilots had become distracted in conversation and lost situational awareness. They failed to maintain radio communications with a series of successive ATC units for well over an hour. After a routine inquiry from the cabin crew as to the expected arrival time, the flight crew realised what had happened and re-established ATC contact after which the flight was completed without further incident.)
- A320, vicinity Perpignan France, 2008 (On 27 November 2008, the crew of an XL Airways A320 on an airworthiness function flight following aircraft repainting lost control of the aircraft after fail to take the action necessary to recover from a full stall which had resulted from their continued airspeed reduction during a low speed handling test when Stall Protection System (SPS) activation did nor occur at the likely airspeed because two of the three angle of attack sensors were blocked by ice formed by water ingress during preparation for the repainting. This condition rendered angle of attack protection in normal law inoperative.)
- A320, vicinity Sochi Russia, 2006 (On 3 May 2006, an Airbus 320 crew failed to correctly fly a night IMC go around at Sochi and the aircraft crashed into the sea and was destroyed. The Investigation found that the crew failed to reconfigure the aircraft for the go around and, after having difficulties with the performance of an auto go-around, had disconnected the autopilot. Inappropriate control inputs, including simultaneous (summed) sidestick inputs by both pilots were followed by an EGPWS PULL UP Warning. There was no recovery and about a minute into the go around, a steep descent into the sea at 285 knots occurred.)
- A321, vicinity Islamabad Pakistan, 2010 (On 28 July 2010, the crew of an Airbus A321 lost contact with the runway at Islamabad during a visual circling approach and continued in IMC outside the protected area and flying into terrain after repeatedly ignoring EGPWS Terrain Alerts and PULL UP Warnings. The Investigation concluded that the Captain had pre-planned a non-standard circuit which had been continued into IMC and had then failed to maintain situational awareness, control the aircraft through correct FMU inputs or respond to multiple EGPWS Warnings. The inexperienced First Officer appeared unwilling to take control in the absence of corrective action by the Captain.)
- A332, en-route, Atlantic Ocean, 2009 (On 1 June 2009, an Airbus A330-200 being operated by Air France on a scheduled passenger flight from Rio de Janeiro to Paris CDG as AF447 exited controlled flight and crashed into the sea with the loss of the aircraft and all 228 occupants. It was found that the loss of control followed an inappropriate response by the flight crew to a transient loss of airspeed indications in the cruise which resulted from the vulnerability of the pitot heads to ice crystal icing.)
- A343 / GLID, en-route, north of Waldshut-Tiengen southwest Germany, 2012 (On 11 August 2012, the augmenting crew member in the flight deck of an Airbus A340 about to join final approach to Zurich in Class 'C' airspace as cleared suddenly saw a glider on a collision course with the aircraft. The operating crew were alerted and immediately executed a "pronounced avoiding manoeuvre" and the two aircraft passed at approximately the same level with approximately 260 metres separation. The Investigation attributed the conflict to airspace incursion by the glider and issue of a clearance to below MRVA to the A340 and noted the absence of relevant safety nets.)
- A343, Toronto Canada, 2005 (On 2 August 2005, an Air France Airbus A340 attempted a daylight landing at destination on a rain-soaked runway during an active thunderstorm and overran for 300 metres ending up in a ravine from where, despite its destruction by fire, all occupants escaped. The Investigation recommendations focussed mainly on crew decision making in adverse weather conditions and issues related to the consequences of such an overrun on survivability.)