In his book, Erik Hollnagel provides us with a few fundamentals that govern the ETTO principle, these are the “ETTO rules”, applicable to the working environment, that demonstrate that trade-off is more naturally leaning toward efficiency rather than toward safety ; as, in our own lives, the accident remain the exception and success an overarching rule.

These rules can be well summarized and illustrated by sentences such as “it looks good”, “that’s not important”, “there is no need to double-check, it should be fine as-is”, “it’s good enough”, “its is faster doing this way”, “there is no time doing this”, “this will be cross-checked by the next person in the loop”, “this has been already checked”, “usually, it works”, “it looks like …, so it must work as …”, “do not overdo”, “this needs to be completed”, “we need to be on time”, “if you don’t say anything, I will not speak up”, “I’m not the expert, this is your decision”.

There is also trade-offs of the ETTO type in organizations, one of the most interesting example for us in aviation is the frequent contradiction that may be observed between an explicit “safety first” policy and the actual underlying priority given by the organization to productivity.

Aviation Accidents and ETTO

Based on the analysis of aviation accidents, Erik Hollnagel takes examples to highlight that accident investigations reveal unambiguously that actors have acted differently from what they were expected to do. Could have they done otherwise ? Actually not really, since if people do ETTO’s this is simply because it is an efficient strategy, that is absolutely required under the circumstances. If all rules are applied by-the-book, nothing works, … and this does not enhance safety, this is largely demonstrated when a trade community goes on strike on a work-to-rule basis.

Admittedly, absolute safety cannot be achieved : what should be the speed limit to prevent any personal injury in road accidents, 20 mph ? 10 mph ?

As a matter of fact, the analysis of accidents often reveals a number of small non-compliance but – usually – very few intentional deviations or wilful misconduct. However, in many countries, the accident investigation is not solely intended to identify causes and contributing factors but is also
” criminalized ” in order to assign responsibility. This is a debatable objective, it would be certainly advisable to rather look into daily practices and identifies what makes the system to be up and running. Indeed, if ” success and failure have the same origin, only the outcome makes the difference ” ( Ernst Mach ). Likewise, the accident is the most visible side of a coin named activity.

Things may go wrong for the same reasons that they could go right, this is only the transient nature of things or the adverse stack-up of unexpected conditions that lead to undesired outcomes.

In a nutshell, almost any activity requires to adjust performance, through ETTO’s, as only a fully controlled environment – as in military parades – allows to work strictly in accordance with pre-established rules / procedures. Most activities cannot be fully laid out as they are subject to interruptions, to disturbing external factors / distractions, and to time pressure.  Such activities can hardly be fully covered by published procedures.

Examples of ETTO’s in Aviation

Here are a few examples of ETTO’s, intended to further illustrate the above discussion :

• During the walkaround inspection, a tear is observed on a tire. As the ground engineer just completed its walkaround without remarks, the pilot considers that this must be within acceptable tolerances,
• During the pre-departure briefing the entire crew solely focuses on the briefing ( this ETTO enhances safety … fortunately, this often is the case in aviation that claims to foster the highest level of safety ),
• The seasoned first officer has, for a long time, adopted a panel pattern for the cockpit preparation whereas the checklist calls for a less intuitive sequence of actions ; although a benign deviation, this is on the safe side in case of interruption or distraction,
• The first officer estimates the fuel on board to be marginal considering the weather forecast, however he/she does not share his/her concern with the Captain as he/she hesitates to challenge the Captain and to commit him/herself into such an inquiry,
• During the approach checklist, the controller assigns a given heading and airspeed; the flight crew interrupts the checklist, performs the necessary entries and resumes the checklist at the step where it was interrupted ( an ETTO toward efficiency dictated by time pressure, followed by an ETTO toward thoroughness ).

Lessons learned from ETTO

Let’s now review a few interesting lessons-learned, that we can draw from this book, and that fully apply to our pilot community :

• First of all, it must be recognized that flying an aircraft is an activity highly subject to facing the unexpected, therefore published procedures cannot encompass and describe every possible situation ; workarounds – ETTO’s – may be required. Published procedures should be simple and factual. Not only they should be simple but they also should make sense to the pilot
  ( paraphrasing Mr Colin, in his benchmark report on flight safety ). Pilots have the educated ability to adapt the published framework and make sound tradeoffs between efficiency and safety.
• As  line pilots, but also as instructors or check airmen, let’s aim at a satisfactory level of global performance, hence at maintaining the desired level of safety, rather than striving at a perfect performance in each and every detail. Let’s be thorough where and when it most matters, whenever the trade-off must enhance operating safety for obvious reasons and when thoroughness is truly needed.
• Let’s be and remain aware that timely anticipation and margins are most needed to mitigate the adverse combination of hazardous / unexpected / undesired conditions … in a nutshell, to mitigate rogue waves.
• We need to implement safety management systems ( SMS ) that effectively capture the lessons-learned from past events, not only at our level as front-line operators but also in enhancing training and company organization whenever necessary, thus protecting today’s operating safety in order to guarantee tomorrow’s efficiency.  Erik Hollnagel refers to such a process as a double-loop learning process whereby objectives must not be frozen but must be adapted  as a function of achievements ; this is what the concept of proactive safety is all about.

Happy landings