We have considered how the International Aeronautical and Maritime Search and Rescue (IAMSAR) Manual expounds extensively on the benefits of States sharing assets and cooperating at every level of service. The recent rewrite of ICAO Annex 12 established these principles still more strongly. This is in recognition that many States within a geographic region are markedly diverse in their topography, responsibilities and resources.  Some have special challenges particularly difficult to meet, not least being the lack of adequate financial and human resources.    

Regionalisation provides for standardised services, avoidance of duplication, access to shared, more plentiful assets and wider service coverage at contributory cost.  These advantages are readily apparent and well understood.  There are, however, more abstract benefits to regional organisation, the need for which has recently been highlighted by findings of the ICAO Universal Safety and Oversight and Audit programmeand extensive evaluatiopns of SAR systems in Africa. 

It might be remarked that these shortcomings and deficiencies are of a generic nature and not necessarily of particular application to the matter of SAR services organization.  But there is a close similarity in the conclusions of the SOA teams, the findings of the Pacific SAR Special Implementation Project conducted by the ICAO Technical Cooperation Bureau in 1992/93 and the technical assistance project presently being conducted throughout Africa.  In essence the most outstanding State SAR needs throughout all nine regions  were found to be in air law, civil aviation regulations, operational documents, committees of management, letters of agreement (internal and external), equipment, experienced and qualified staff, training and any oversight authority or  regulation.

The imbalance in the dispositions of national SAR system disallows a consistency of SAR response across the globe and therefore compels us to take the approach of organizing on a regional basis.  While improved technology has resulted in a shrinking world for SAR and the feasibility of organising regionally is beyond doubt, there is a risk that some of the legitimate interests of those States most hard pressed to provide a SAR service might be paid too little regard by taking this approach.  Some States might be diffident about surrendering authority, allowing contiguous States rights of access and forfeiting incremental service provision that might be a benefit of their own national SAR service.  It is vital that in taking a regional approach, we take full account of the needs of those States presently most disadvantaged.  Enlightenment, sensitivity and humility must be the cornerstones of global SAR development.   It makes no sense for the any public service to be improved regionally only for some participating States’ quality of life to be prejudiced in its provision.  The challenge in this regard is to provide for minimum regional system requirements while ensuring that equally important matters of national identity, sovereignty and cultural distinction are not in any way compromised. 

This matter of sensitivity to culture and sovereignty requires more than an simple acknowledgement.  The basis of operational co-ordination and communication is human-to-human interaction and within these interpersonal interactions, culture plays a decisive part.   Culture affects communication. One’s beliefs and attitudes affect one’s interaction with others, that is, how we talk to them, how we delegate and how we accept orders, how we negotiate differences of opinion, how decisions are made, how risks are evaluated and other aviation-related  issues.  

I will not be addressing standardized training in detail in these presentations but let me say in this context that to design an effective SAR operations training course for worldwide application requires the development of a communication training course and that communication course, in turn, must include a segment - a comprehensive one - on inter-cultural communication.  A  thorough understanding of cultural differences and cross-cultural influences is essential if projects to strengthen SAR along regional lines are to succeed.  Understanding the pervasive, yet seemingly unconscious effects of culture upon attitude and behaviour is a necessary pre-requisite to successful interaction and operational communication and co-ordination across the globe.

SAR does not stand alone and without precedent in confronting the need for organizational change.  Now that the high profile nature of airspace and airport congestion have become a political issue within Europe, ministers from various European States are regularly meeting to discuss future plans for a regional air traffic control system.  The concept is dependent on the adoption of new technologies and new operating procedures and practices.  The evolution of the concept will see a radical change in the way that the human participates in the system as the level of automation rises.  Just how effectively the human participates in the system - and how effective the system itself will become - will be dependent on nothing as much as the way in which humans and machines are planned to interact.   

It is essential that a combination of these strategies be utilised but the process might be best begun by first recognising human sovereignty in the RCC.  This is to establish, as fundamental policy, that the provision of SAR services is a humanitarian discipline, performed by human beings for human beings. Automated aids can be designed from a technology-centred perspective or from a human-centred perspective.  A technology-centred approach automates whatever functions it is possible to automate and leaves the humans to do the rest.   

This places the operator in the role of custodian to the automation; the human becomes responsible for the “care and feeding” of the computer.  In contrast, a human-centred approach provides the operator with automated assistance that saves time and effort; the operator’s task is supported, not managed, by computing machinery. 

The overall safety and efficiency of the aviation system depends on human operators as the ultimate integrators of the numerous system elements.  Experts consider that this dependence is unlikely to decrease and may even increase in unanticipated ways as additional advanced technology is implemented.  To a greater extent than ever before, understanding and accounting for the role of humans will be important to maintaining and improving safety while improving efficiency. 

Regionalisation will introduce issues of an institutional and legal nature including the use of third party systems, particularly satellite communication and navigation constellations.  In this respect, SAR is already somewhat ahead of the game by way of the highly effective, consensual arrangements set in place by the Parties and Participants to the Cospas-Sarsat system.

On the human front, SAR is undergoing radical change in job functions and responsibilities.  In simple terms, technology has changed the role of workers from “hands on” makers and doers to more remote thinkers and controllers.  New scope for errors has been introduced at the work face; these are the inevitable active failures that are an inevitable outworking of the human condition.  This new realm for error is one in which cause and effect are much more difficult to find out. These issues have been well documented and widely discussed.  There is, however, another less publicised source of error in complex systems such as SAR;  that is the organisational structure itself.  I wish to discuss how the organization of the service can itself be a source of latent conditions that can set the scene for active failures to penetrate the SAR system’s safety barriers.  

In simple terms, there are two kinds of accidents: individual accidents - by the far the greater in number - and organizational accidents - these are rare, but in complex industries and those that demand high reliability, they are often catastrophic.  Organizational accidents are a recently identified phenomenon; they are commonly the product of technological innovations that have radically altered the relationship between humans and their operating systems. 

The events that can combine to form an organizational accident chain are difficult to discern ahead of time, let alone control. They are frequently obscured by time, tradition and the common-place.  But human factors specialists are insistent that there is a logic in them and that the safety of complex systems can be greatly enhanced by timely adjustments to certain precursory circumstances.  Many of you will be familiar with the simple (yet profound) model proposed by Professor James Reason that  describes the organizational accident process and that aptly applies to the low-risk, high-consequence aviation industry.

Figure 1.1 The relationship between hazards, defences and losses

All organizational accidents entail the breaching of the barriers and safeguards, (we can call them ‘defences’ collectively), that are set up to separate potentially damaging hazards from vulnerable people and assets, (we can call them victims or ‘losses’). 

Delegates may not be as familiar with another model presented by Professor Reason that illustrates the interaction between the outputs of organizations: protection and production.  It is equally pertinent.

Figure 1.2: Outline of the relationship between Prod Protection

All technical organizations produce something; in our case, we produce SAR services. At the same time, all productive organizations require various forms of protection to safeguard the safety of their operators and their equipment.  Ideally, the level of protection should be established and remain appropriate to the level of hazards involved in the productive operations; this can be portrayed as a ‘parity zone’. These quotients will change with time and circumstance but in simple terms, the parity zone can be sufficiently accommodating to allow low hazard operations to be conducted with relatively low protection while requiring high hazard operations to be conducted with greater protection, but all the time ensuring that all operations are contained within the zone.

Outside the zone, lie extreme areas that represent danger.  In the top LH corner there is portrayed a situation in which protection far exceeds the dangers posed by the productive hazards.  Because protection requires resources such as people, money and materials - resources that could be otherwise expended in producing goods or services - that situation of over-protection suggests eventual bankruptcy or collapse.  In the bottom RH corner, there is portrayed an area in which the level of protection is insufficient to cover productive hazards and organizations operating within this area are at risk of a catastrophic accident - which would likely also lead to the collapse of the organization, possibly at the cost of lost lives.  These two extremes are generally avoided: shareholders, directors and regulators generally ensure that is so. Our concern needs to be in how organizations navigate the space bounded by these two extremes.  

There would be few managers who would not agree with the need for a level of protection in keeping with the risks of production but there are equally few who do not, daily, need to respond to opportunities to cut corners to meet deadlines, whether of time or dollars.  We find ourselves more driven to produce than to protect; generally we have more productive skills than protective.  There is more in it for us, personally, if we produce and the process of production is more amenable to our professional natures. The possible (and not incredible) outcome of prevailing attitudes and daily practices can be illustrated by the following figure. 

Figure 1.3: The lifespan of a hypothetical organization throgh the production-protection space

In the bottom left there is depicted an organization starting out with a reasonably satisfactory safety margin; as time passes, that safety margin is steadily reduced until a minor accident occurs.  After a consequential improvement in protection, that surplus is eventually traded off for a gain in production and the margin reduces again until another, more serious accident occurs. Again, the level of production is increased after a long incident-free period but again that greater buffer surrenders to a reallocation of resources in due course.  The life history of the organization ends with a catastrophic accident. 

Let us focus now on the layers of defences that can be erected to guard against hazards becoming organisational accidents.  While these barriers or safeguards will vary in nature according to the purpose of the organization and the type of its services or goods, there are ways in which they can be generically described.  Professor Reason explains how they are all designed to serve the following functions:

• to create understanding and awareness of the local hazards,

• to give clear guidance on how to operate safely,

• to provide alarms and warnings when danger is imminent,

• to restore the system to a safe state in an off-normal situation,

• to interpose safety barriers between the hazards and the potential losses

• to contain and eliminate the hazards should they escape this barrier,

• to provide the means of escape and rescue should hazard containment fail.

There is a mix of two types of defensive functions listed here.  We might call them ‘hard applications’ (those technical devices of a physical nature) and ‘soft applications’ (those that are most relevant to SAR mission co-ordination).  The soft applications rely upon a combination of paper and people and include legislation, regulatory surveillance, rules and procedures, training, drills and briefings, administrative controls, licensing, certification, supervisory oversight and the front line work force. 

There is another key feature of the above list of defensive functions.  It describes successive layers of protection, each guarding against the breakdown of the defence preceding it, so when understanding and awareness fail to guard against the forward movement of a hazard, alarms and warnings may do so.  Should all the defences fail, escape and rescue provisions might save the day.  

There is a close parallel to be drawn between this list and those lists of shortcomings and deficiencies compiled recently by the ICAO SOA team, the PACSARSIP of 1992/93 and the African findings of 2004/5.   

The conclusion to be drawn from our discussion thus far is two-fold.  Firstly, whereas a number of States have, for a long time, had difficulties in establishing a viable SAR system, an arrangement of several regional organisations, prudently and sensitively introduced into areas of demographic suitability, could input to the SAR service essential elements of system that may be beyond the capacity of some individual States.  In aggregate, these regional organizations could greatly improve the effectiveness of the global SAR plan to which the policies of ICAO and IMO are directed.  Secondly, in organising regionally, it is imperative that the barriers and safeguards that make for a safe system are set in place and that they be comprehensive and mutually supportive  For the regional system to be any less would be to establish a latent condition that may prejudice the SAR organization’s survival when as they will, the pressures of circumstance, whether industrial, political, economic or operational, will put the safety, regularity and efficiency of the SAR system under test.  

There is something almost delusive about latent conditions and the way they can so dangerously contribute to accident potential. Professor Reason likens them to resident  pathogens in the human body.  They may be present for many years and be of no concern until they combine with local systems and active failures at the front line to penetrate a system’s layers of defence.  They may be far removed from the time and place of both the active failure and the accident;  “out of sight and out of mind” indeed.  Latent failures may be matters of imprecise procedures, shortfalls in training, inadequate equipment, bad strategic decisions by regulators, organizational managers or international organizations.  For a long time, they may seem innocuous and benign.  In that time, they may well be absorbed into corporate culture and give it its recognisable, even comfortable form.  Still, they can insidiously pave the way for an error producing circumstance that time and chance may exploit. 

Perhaps the saddest and most tragic example of a latent condition culminating in catastrophe is the Chernobyl nuclear reactor disaster of 1986. At an international conference on this accident in Vienna in September of that year, the chief investigator into the disaster, the academician Valeri Legaslov, put the blame for the accident squarely on the errors and violations of the front line operators.  Later, Mr Legaslov confided to friends that he had told the truth in Vienna but not the whole truth.  In April, 1988, two years to the day after the disaster, he hanged himself from the balustrade of his apartment.  He had left his profound convictions on a tape recorder, saying: “After being at Chernobyl, I drew the unequivocal conclusion that the accident was ...the summit of all the incorrect running of the economy which had been going on in our country for many years.”

Of course, the factors of accident causation can only be traced back so far - scarcely as far back as the 1917 Russian Revolution - and national economic and societal conditions can hardly be directly targeted in the search for safety enhancement.  But the story demonstrates arrestingly both how far removed from an event the latent conditions that precipitate it might be and just how consequential those conditions can be.

 This paper has established a set of concepts that addresses the prevention of organizational accidents.  The first concept provides a framework for understanding the process of an accident chain: hazards, defences and losses.  The second proposes that the tension between protection and production within organizations is critical and that the relationship, when mis-managed, can lead to the penetration of defence layers.  A list of effective safety barriers was presented.  The parallel between these and the recent findings of the ICAO SOA team and repeated technical assistance missions were noted and the conclusion drawn that in advancing the rationale of regionalised SAR services, close attention needs to be paid to legislation, regulatory surveillance, rules and procedures, documentation, training, administrative controls (committees of management and letters of agreement), operator proficiency standards and supervisory oversight.  

Organizational accidents are unacceptable in terms of their human, environmental and commercial costs.   We cannot change the human condition - active failures will continue to occur; we can, however, change the conditions under which people work - and thereby be instrumental in reducing latent failures and thereby make some lengthy strides down the road of a safe and effective SAR system throughout Asia and the world.