Safety

Normalization
of Deviance
SOPs are not a suggestion La caída de Ícaro, óleo sobre lienzo
(Museo del Prado, Madrid)

By James AlbrighT james@code7700.com

M
ost pilots have probably heard the story from Greek Federal Aviation Regulations to the extent required if an in-
mythology about Icarus, the ancient aviator who flew flight emergency requires immediate action. What about other
too close to the sun and came crashing down into the deviations? Pilots may find themselves having to alter or skip a
sea. Since it was Daedalus, his father, who designed standard operating procedure (SOP) for safety reasons. Some-
and constructed those wings of bird feathers tied with string times they may make decisions that, at the time, seem prudent.
and wax, it can be said that not only was he the original aero- But on reflection, many of these decisions may have just been
nautical engineer, but he included a maximum cruise altitude laziness or an error in judgment. Aren’t we all human, after all?
in his design specifications. Fly too high, he warned his son, Yes, we do make mistakes and much of our training is de-
and the wax used to fasten the feathers would melt. It can also signed to prevent or mitigate those before they become harm-
be said that Icarus was the first pilot to deviate from design ful. As professionals, we train to minimize deviations and to
limitations. recover from those that do occur. All that is as it should be. If
Deviations in aviation are to be expected; in fact, regulations those deviations become frequent, however, there is a tendency
make allowances for them. Since aircraft designers and regula- to start accepting them as the new norm, to lower our stan-
tory authorities can’t think of every possible circumstance, 14 dards and blur the distinction between what is acceptable and
CFR 91.3 gives a pilot in command the authority to deviate from what is not. And thus the normalization of deviance.

40  Business & Commercial Aviation  |  January 2017 www.bcadigital.com

 Challenger’s Final Flight temperatures. In fact, Thiokol stated that O-ring temperatures
must be at least 53F at launch, or they would become brittle
The phrase “normalization of deviance” was coined by sociol- and would allow “extreme blow-by” of the gases. There was
ogy professor Diane Vaughn in her 1996 book, The Challenger also evidence that the O-rings could become cold soaked and
Launch Decision: Risky Technology, Culture and Deviance at their temperatures would take time to recover from prolonged
NASA, where she examines the tragedy of the 1986 launch of cold. But top-level NASA managers were unaware of the SRB
space shuttle Challenger. The corruption of the decision-mak- design limitations and the 53F threshold didn’t hold firm. For
ing process at NASA serves as a useful illustration on how very one launch the engineers said, “Condition is not desirable but
professional people can be seduced in to normalized deviance. is acceptable.”
The space shuttle’s solid rocket boosters (SRBs) were built Temperatures on the morning of Challenger’s final launch
by Morton Thiokol, which was quite literally the cheapest bid- were well below 53F. SRB engineers recommended a delay but
der. Each booster was 149 ft. long and 12 ft. in diameter, manu- NASA managers applied pressure on Thiokol management.
factured in six sections, and delivered to NASA in sets of two Nevertheless, the engineers refused to budge. So, they elected
that were joined at the factory. The three combined sections to make it a “management decision,” without the engineers,
were joined in the field with the help of two rubberlike O-rings and agreed to the launch. It was 36F at the moment of launch.
and an asbestos-filled putty. The 1/4–in. diameter O-rings sur- The O-rings on one of the field joints failed almost immedi-
rounding the rocket’s entire diameter were designed to keep ately. About a minute after launch a continuous, well-defined
the hot propellant gases inside the rocket and directed down- plume from the joint cut into the struts holding the SRB to the
ward toward the nozzles. The secondary O-ring was meant to main tank and the SRB swiveled free. The flame breached the
be redundant, a safety measure. main, which erupted into a ball of flame seconds later. The shut-
tle cabin remained in-
tact until impact with
the ocean, killing all
on board.
Much of the report-
ing after the event fo-
cused on the O-rings.
After the accident re-
port was published,
the focus turned to
NASA managers
breaking rules un-
der the pressure of
an overly aggressive
launch schedule. But
as Vaughn points out,
they weren’t break-
ing any rules at all. In
fact, they were follow-
ing the rules that al-
lowed launch criteria
Maiden launch of Challenger and other rules to be
and O-ring diagram. waived. The amount
NASA
of acceptable primary
But early on in the program there was evidence of some O-ring damage went incrementally from none, to a little, to
“blow-by” beyond the primary O-ring. Engineers determined complete burn through. Over the years the practice of reducing
an “acceptable” amount of erosion in the O-ring and for a while safety measures with waivers had become normalized.
these norms held up. Starting in 1984 the amount of damage By 1986, there had been 24 previous launches, each cement-
to the primary O-ring was increasing. Engineers were initially ing the soundness of the decision-making process. With thou-
alarmed but later became convinced that the damage was sands of highly qualified experts collaborating on many of the
slight enough and the time of exposure was short enough that decisions, it was easy to think, “We know what we are doing.”
the risk was acceptable. But this was rocket science. How about an example closer
In 1985, some of the SRBs returned with unprecedented to home?
damage, the majority came back with damage, and in one case
the secondary O-ring was also damaged. For one launch, there
was complete burn through of a primary O-ring. In each case,
The Final Flight of N121JM
the decision was to further increase the amount of damage Experts who have accumulated an enviable amount of experi-
deemed acceptable and press on. When it was no longer pos- ence and a strong sense of confidence are at risk of normalizing
sible to say the two O-rings were redundant, NASA decided to deviance unless they have sufficient oversight and a strong
waive the requirement. peer group. The crash of Gulfstream IV N121JM makes this
What also happened in 1985 was a series of launch decisions case.
in colder and colder temperatures. While the overall shuttle On May 31, 2014, the crew of the GIV started their engines
program was designed with a temperature range of 31F to 99F without running the engine start checklist and neglected one
as launch criteria, the SRBs were never tested at the lower of the steps that would have had them disengage the flight

www.bcadigital.com Business & Commercial Aviation  |  January 2017  41

Safety
the other guy.” And finally, as we see repeatedly in aviation, we
can become so experienced at our profession that complacency
displaces competency. No matter the cause, these factors can
combine to ensnare us into accepting deviance as our normal
behavior.
As with many things in life, it would be best to avoid the trap
altogether. But even if trapped, any pilot can claw their way out
with the right mindset and a few techniques.
▶▶Follow standard operating procedures (SOPs). We often find
ourselves having to adjust, reorder or even skip some SOPs
because they don’t exactly fit the situation at hand, they would
take more time than a widely accepted shortcut, or we think we
have a better method. There are several problems with this be-
havior, of course. Operating ad hoc, in the heat of the moment,
we risk not carefully considering all possible factors. If we skip
or reorder steps, we risk forgetting something important or
Gulfstream IV N121JM wreckage failing to consider any sequential priorities.

NTSB
If we adjust an SOP on our own, crew resource management
control gust lock. They then skipped the after starting engines (CRM) becomes more difficult as others will have to guess
checklist, which would have required the flight controls to be about our procedures and techniques. Further, once we’ve
checked; had they done this, they would have realized the flight violated the first SOP, it becomes easier to violate the second,
controls were locked. They also skipped the taxi and line up and the third. Before too long the culture of having SOPs will
checklists, as well as the requirement to check the elevator’s erode and when that happens, all SOPs become optional. And
freedom of movement at 60 kt. They were unable to set takeoff in a small flight department, there is a low likelihood of “being
thrust, realized this, but continued the takeoff anyway. The caught” or challenged.
rest, unfortunately, is history. Any pilot who is tempted to deviate from an SOP should first
As details gradually surfaced from the NTSB accident in- think about measures to formally change the SOP. There is a
vestigation, we in the aviation world were stunned. How could definite art to this. You need to carefully analyze the existing
two pilots have been so inept? But their airplane was outfitted SOP, try to understand why the SOP is constructed as it is, and
with a quick access recorder and we learned that this type of come up with an improved alternative solution. Then, gather
behavior was the norm for them. For example, the recorder support from peers, and advocate the change to those who have
revealed that they had skipped the full flight control check on the power to change things. Flight department leaders should
98% of their previous 175 takeoffs. work with crews to ensure that each SOP is pertinent, easily
These two pilots did not fly in a vacuum. They regularly un- understood, easily followed and consistent with other SOPs in
derwent formal (and not inexpensive) simulator training and the department and fleet. If adjustments are needed, select a
had even passed their Stage Two International Standard for well-respected team member to spearhead the effort, institute
Business Aircraft Operations (IS-BAO) safety management a test phase and obtain manufacturer comments, if possible.
system (SMS) certification. So, they were able to fool their ▶▶Train to a standard. Your training is only as good as your in-
instructors and auditors, and that served to reinforce the be- structor and if you are taught to cut corners and to ignore all
havior as normal. that has been learned over the years, you can be trained to
Why would two, highly experienced pilots give into the nor- deviate. This most often occurs when someone you respect or
malization of deviance? They had achieved an enviable place in someone in a position of authority assumes the role of instruc-
aviation, flying a prestigious aircraft that might represent the tor but has already given in to deviant behavior. It can also oc-
pinnacle of any pilot’s career. A psychologist would have a field cur when a professional training vendor has misguided ideas
day examining their ego-based complacency that had been re- of what should or should not be taught, or does not exercise
inforced by decades of successful operations without so much proper oversight of its instructors. Seasoned simulator instruc-
as a scratch to their expensive aircraft. tor pilots can give into the normalization of deviance, too, and
Unfortunately, there is compelling evidence that they were their preferred methods are not necessarily the right methods.
not alone in such reckless behavior. At the NTSB’s recom- Instructors and students alike should always be willing to re-
mendation, the NBAA conducted a review of data produced turn to the source documents. If an instructor’s technique vio-
by 144,000 flights involving 379 business aircraft from 2013 lates a manufacturer’s procedure, the instructor is duty-bound
through 2015 to determine adherence to required flight control to advocate the change with the people who built the airplane,
checks prior to takeoff. In nearly 16% of the takeoffs, the pilots not with those who are flying it.
did only a partial check. In 2% of the takeoffs, pilots failed to Training administrators should realize that some courses
perform any check of the flight controls at all. are merely square fillers that satisfy regulatory requirements
but do not teach meaningful information. Others can become
Preventing or Curing the Problem repetitive because most vendors seldom change their courses
from year to year. In either case, these courses will become
There are multiple paths to normalizing deviance. As in the boring and may actually become counterproductive. Admin-
space shuttle case study, we can become so focused on our mis- istrators should seek honest feedback about each course and
sion objectives that we can rationalize away safeguards and attempt to find alternate vendors, even for the good courses. A
common sense itself. We can also become convinced in our robust in-house training program can supplement these efforts
own greatness — we defy gravity for a living, after all — and and also serve to combat stagnation and complacency.
that breeds the conviction that rules and regulations are “for ▶▶Improve and broaden your peer group. Of course no professional

42  Business & Commercial Aviation  |  January 2017 www.bcadigital.com

pilot sets out to bend the rules on the margins or flagrantly dis- carefully with considerable thought and consideration. For-
obey all SOPs. But some end up doing just that. Good pilots can mal waivers may have been instituted in an effort to do it “just
be corrupted by poor peer groups. If everyone else has already right.”
normalized deviant behavior, it will seem an impossible task to Before too long, however, the envelope of what was consid-
hold true to SOPs without upsetting the status quo. Even a good ered a deviation and what was just “normal operating prac-
peer group can become so comfortable that it, too, will begin to tices” can start to merge. These decisions are rarely black and
accept deviance as normal. white and plainly labeled as “we are about to deviate from a
No matter the cause, all it takes is one pilot to bring the rest procedure we once considered sacred.”
of the group back into the fold. If just one pilot adheres to all A common problem in all types of professional aviation ac-
SOPs and best practices, the others will take notice. That alone tivities can be called “target fixation,” that is we become so fo-
may be enough to fix what is broken. cused on accomplishing a mission we can lose sight of the need
It may also be possible to demonstrate the efficacy of an SOP to do so safely. One way to keep a perspective of the organiza-
against a deviation and attempt to convince your peers to par- tion’s overall goal (i.e., moving people from Point A to Point B
ticipate. Years ago, as the newest pilot in a Gulfstream IV flight safely) is to always have in mind a backup plan (arrange alter-
department, I was alarmed that the pilots followed a Do-Verify nate transportation in the event of a maintenance or weather
method for the after-engine-start checklist and often missed problem, for example). By routinely briefing alternate plans,
critical steps. I convinced them to put their procedure against having to enact them may not seem too extreme a measure.
the required Challenge-Do-Verify method and time them. We A poorly kept secret in many aviation circles is that the
discovered that not only was CDV more accurate than DV, it “safety first” motto is often quoted, but rarely enforced. Mana-
was faster. gerial actions, such as frequent duty day waivers and calls to
It could very well be that a majority of pilots in your flight “hurry up” can undo any spoken assurances. If you are a chief
department have the same issues with some nonstandard pro- pilot and this alarms you, try to make a conspicuous show of it
cedures and a group meeting to discuss the issues can solve the the next time safety is indeed first.
problem. You should obtain leadership buy-in first. Leadership I once elected to scrub a trip because an aircraft stabilizer
may be surprised about the issue; you might be surprised how system was questionable. The manufacturer did not prohibit
open to change they can be. the flight but didn’t recommend it, either. So we missed our
But what if the lead deviant is the boss? Greek philosopher first trip in several years because we decided the flight was
Socrates taught conflict resolution through the use of probing too risky. I could have confined the matter to those directly in-
questions. If a senior member of the flight department insists volved but decided it was a good case study for everyone in the
on a non-standard procedure, ask for the reasons behind that department to consider. They had to know that we really would
“to better understand how to accomplish the procedure.” Hav- cancel trips when the risks became too high. Safety is first.
ing to verbalize the rationale may force a reexamination of the ▶▶Learn humility. When we assign the title of “expert” to a pilot,
entire thought process. we recognize that person for a technical skill gained from train-
When I first showed up in a Gulfstream V flight department, ing and experience. We also imply that the expert will be more
the pilots did not use any type of verification method prior to ex- objective than a non-expert and will be better armed against
ecuting a change to FMS programing. I asked how this method the normalization of deviance. Unfortunately, the opposite can
would prevent an entry error that could misdirect the aircraft. be true.
After some thought, they agreed they had no such verification An expert can believe his or her knowledge and experience
and were open to a new technique. gives license to deviate. With experience comes confidence —
It is easy to fall into nonstandard behavior without an oc- in some cases to the extreme. Over-confidence and arrogance
casional look from someone outside the flight department. If can be cojoined.
the entire organization normalizes deviance at about the same The antonym for arrogance is humility. A humble pilot real-
rate, no one will notice because they are all involved. It may be izes that even the best aviators make mistakes and that one’s
beneficial to request an outside look at the workings within, guard can never be lowered, even when the title of “expert”
such as a complete SMS audit that includes a flight observation. has been rightfully earned. The best way to keep humble is
However, keep in mind that some SMS auditors may make to research the all too many mishaps of very good pilots who
things easy in an effort to generate repeat business. If that hap- have given in to the normalization of deviance. They’re readily
pens, little is gained other than a piece of paper that says you available. Go to http://www.ntsb.gov, and select the “Investiga-
filled a square. You need to emphasize to your auditors that you tions” tab for full accident reports. Another great source is
want an honest assessment because your overriding goal is to http://www.baaa-acro.com, the Bureau d’Archives des Accidents
make a good flight department even better. d’Avions.
▶▶Make safety conspicuous. One of the profound lessons of the
Challenger tragedy is that decision makers believed they were
making the right, reasoned ones each step of the way. But in
Deviance is Not Normal
hindsight they would have to agree that many of those deci- As with many technical pursuits, deviations from the norm
sions were wrong. are a fact of life in aviation. Our SOPs cannot cover every situa-
Pilots in the “expert” class are in remarkably similar cir- tion. We make mistakes. If those procedures are found lacking,
cumstances. They are quite often under extreme pressure to it is up to us to change them. We must also design safeguards
minimize costs while expanding mission capabilities. Flight and redundancies to ensure we can effectively recover from any
department managers are often asked to spend less and less of those inevitable mistakes.
on maintenance, training and operating costs. At the same It is up to the Daedalus in each of us to ensure the equipment
time, their crews are expected to fly farther distances with cor- and procedures are well designed, and it is up to the Icarus in
respondingly longer duty days. Skipping maintenance checks, each of us to use the equipment as designed and adhere to those
training events and checklist steps are at first approached procedures. BCA

www.bcadigital.com Business & Commercial Aviation  |  September 2015  43