20
Sensemaking in Safety Critical and Complex Situations
As can be seen, safety constraints are both components of system safety ( they are
part of the hardware and software when the system is designed) and at a higher level
of control, they are embedded in the safety management system of the organisation.
ACCIDENTS AS FAILURES OF SAFETY CONSTRAINTS
Following Leveson, if safety is a matter of control through the operation of safety
constraints, accidents can be understood as a failure in the operation of one or more
safety constraints, as in the following examples:
• A safety constraint( s) was missing: a worker repairing a factory roof slips
and falls to his death because he was not wearing a safety harness.
• A safety constraint( s) was misapplied: A ‘ STOP’ sign on the road at a busy
intersection is misspelled ‘ SOTP’. A driver is distracted by the spelling mistake, overshoots the intersection resulting in a collision
• A safety constraint( s) was not applied: The ferry Herald of Free Enterprise
sank in 1989 after leaving Zeebrugge resulting in the deaths of 189 people.
The bow doors had not been closed before departure resulting in flooding
of the lower decks.
• A safety constraint( s) could not be activated: At one point during the nuclear
incident at the Three Mile Island nuclear power station in 1979, a pressure
relief valve was stuck open, whereas a light on the control panel indicated
that the valve was closed. In fact, the light did not indicate the position of
the valve, only the status of the solenoid being powered or not, thus giving
false evidence of a closed valve. As a result, the operators did not correctly
diagnose the problem for several hours.
• A safety constraint( s) was applied too late. Gould et al. ( 2006) report that a
Norwegian offshore patrol vessel hit a submerged rock after an inexperienced
navigator lost control over his exact position. Failing to observe a waypoint, the
vessel was late turning and hit a submerged rock. This was a knowledge-based
error caused by a lack of training in the identification of waypoints.
• A safety constraint( s) was removed too soon or applied for too long:
On October 31, 2014, at 1007:32 Pacific daylight time, Virgin Galactic’s
SpaceShipTwo ( SS2) operated by Scaled Composites LLC, broke up into
multiple pieces during a r ocket-powered test flight. SS2 had been released
from its launch vehicle, White Knight Two ( WK2), N348MS, about 13
seconds before the structural breakup. Scaled was operating SS2 under an
experimental permit issued by the Federal Aviation Administration’s ( FAA)
Office of Commercial Space Transportation. After release from WK2 at an
altitude of about 46,400 ft, SS2 entered the boost phase of flight. Although
the co-pilot made the required 0.8 Mach callout at the correct point in the
flight, he incorrectly unlocked the feather immediately afterwards instead
of waiting until Space Ship Two reached the required speed of 1.4 Mach
• A safety constraint( s) was unsafe. A Norwegian coastguard vessel grounded
when the retractable sonar dome was damaged when the vessel entered
shallow waters ( Gould et al. 2006). The sonar indicator was only visible
Sensemaking in Safety Critical and Complex Situations
As can be seen, safety constraints are both components of system safety ( they are
part of the hardware and software when the system is designed) and at a higher level
of control, they are embedded in the safety management system of the organisation.
ACCIDENTS AS FAILURES OF SAFETY CONSTRAINTS
Following Leveson, if safety is a matter of control through the operation of safety
constraints, accidents can be understood as a failure in the operation of one or more
safety constraints, as in the following examples:
• A safety constraint( s) was missing: a worker repairing a factory roof slips
and falls to his death because he was not wearing a safety harness.
• A safety constraint( s) was misapplied: A ‘ STOP’ sign on the road at a busy
intersection is misspelled ‘ SOTP’. A driver is distracted by the spelling mistake, overshoots the intersection resulting in a collision
• A safety constraint( s) was not applied: The ferry Herald of Free Enterprise
sank in 1989 after leaving Zeebrugge resulting in the deaths of 189 people.
The bow doors had not been closed before departure resulting in flooding
of the lower decks.
• A safety constraint( s) could not be activated: At one point during the nuclear
incident at the Three Mile Island nuclear power station in 1979, a pressure
relief valve was stuck open, whereas a light on the control panel indicated
that the valve was closed. In fact, the light did not indicate the position of
the valve, only the status of the solenoid being powered or not, thus giving
false evidence of a closed valve. As a result, the operators did not correctly
diagnose the problem for several hours.
• A safety constraint( s) was applied too late. Gould et al. ( 2006) report that a
Norwegian offshore patrol vessel hit a submerged rock after an inexperienced
navigator lost control over his exact position. Failing to observe a waypoint, the
vessel was late turning and hit a submerged rock. This was a knowledge-based
error caused by a lack of training in the identification of waypoints.
• A safety constraint( s) was removed too soon or applied for too long:
On October 31, 2014, at 1007:32 Pacific daylight time, Virgin Galactic’s
SpaceShipTwo ( SS2) operated by Scaled Composites LLC, broke up into
multiple pieces during a r ocket-powered test flight. SS2 had been released
from its launch vehicle, White Knight Two ( WK2), N348MS, about 13
seconds before the structural breakup. Scaled was operating SS2 under an
experimental permit issued by the Federal Aviation Administration’s ( FAA)
Office of Commercial Space Transportation. After release from WK2 at an
altitude of about 46,400 ft, SS2 entered the boost phase of flight. Although
the co-pilot made the required 0.8 Mach callout at the correct point in the
flight, he incorrectly unlocked the feather immediately afterwards instead
of waiting until Space Ship Two reached the required speed of 1.4 Mach
• A safety constraint( s) was unsafe. A Norwegian coastguard vessel grounded
when the retractable sonar dome was damaged when the vessel entered
shallow waters ( Gould et al. 2006). The sonar indicator was only visible