14 th Annual Human Factors in Aviation Maintenance Symposium 13.

0 The Benefits

13.0 Managing Human Error within a Safety Management

Environment: “Successes and Failures”
Mr. Clifford J. Edwards,
Quality & Safety Development Manager,
Shell Aircraft Limited, England

MANAGING HUMAN FACTORS THROUGH SAFETY MANAGEMENT

“SUCCESSES AND FAILURES”
SYNOPSIS OF THE PAPER
This paper addresses the steps taken to develop an effective human factors programme for
an aircraft operator as a part of a systematic safety management programme. The paper
focuses on engineering human factors, but could be equally applicable to operational issues
or any other element of the business that has safety connotations. In outline, descriptive
passages are included for Safety Management Systems, Safety Cases and Hazard
Management processes; this was necessary to give an explanation of the methodology
used. In principle it is a systematic methodology in which the major hazards that the
aircraft operator faces are identified, analysed, and controlled as far as is reasonably
practicable.
At the core of the work done by Shell Aircraft, and the contributing companies, has been
the development of a generic hazard model and an assessment of the potential causes of
harm from those hazards based on qualitative risk assessments. Safety Management
Systems build on the principles of Quality Assurance and therefore can easily be
integrated with existing systems of management currently found in aviation companies. A
key point for the success of any system such as QA, SMS or financial control is that it
must actually be the system by which the management runs the company.
A Safety Management System ensures that acceptable status and attention is given to
safety as to any other business imperative. Embedded in the SMS, Human Factors
programmes help to reduce the impact from the most prolific causation factors found in
accidents and incidents that affect the aviation industry.
BACKGROUND
Shell Aircraft is required by the Shell Group to ensure that the aviation support
requirements for its operations meet or exceed established international and Group
standards with the aim of reducing and managing the risks of such operations. Due to the
nature of oil company business, aviation operations in support of the Shell Group are
often carried out in hostile conditions and/or difficult locations. To achieve the task both
helicopters and fixed wing aircraft are required and this covers a wide range of types of
operation, including offshore, seismic survey, mountain and corporate flying.
Shell Aircraft’s approach, through its commitment to improve safety within the aviation
support activities, is to ensure that effective systems are in place to identify and manage

edwards.doc 1
14 th Annual Human Factors in Aviation Maintenance Symposium 13.0 The Benefits

the risks. Over the years this has required a significant amount of effort in working with
contractors, and our own in-house operations, to enhance standards by participating in or
developing new initiatives, or research projects and through audit. The demonstrable
decrease in the Shell Group’s accident rate over the last ten years is, at least in part, a
result of this effort.
This paper covers the work done in the related subjects of Engineering Human Factors and
Safety Management, both of which have attracted ongoing activity in Shell Aircraft.
Engineering human factors is an area of the aviation industry which, as yet, is not well
covered, albeit much has been written and talked about it for some time. Only recently
has there been any real evidence of training or action aimed at addressing human error and
then only in a limited number of aircraft operators. This is disappointing when
considering that aircraft maintenance engineering has a worsening record of airworthiness
through maintenance related human error leading to accidents and incidents. Currently
world-wide industry statistics puts the figures for maintenance related error between 12%
to 14% of the causal factors of accidents attributed to human error. This is not an
insignificant figure, particularly when considering that, as yet, many countries, or aircraft
operators, are not specifically reporting maintenance human error as a causal factor.
THE HUMAN FACTORS PROGRAMME
The purpose of this paper is to cover the management of human factors through a safety
management programme that Shell Aircraft has developed, together with elements of the
aviation industry, the UK Human Factors Combined Action Group (UKHFCAG), UK
Flight Safety Committee and UK CAA. The UKHFCAG has now become the
UKSMSCAG to emphasise the focus on Safety Management Systems within engineering
and maintenance. It previously put together a human factors programme that draws from
world-wide studies and initiatives to issue a workable package that can be implement by
small or large aircraft operators. This package fully supports the IFA Engineering Human
Factors training video package made by TVC, one version of which was additionally
funded for helicopter operators by the European Helicopters Operators Committee and
Shell Aircraft. In addition to these human factors initiatives, which were supplied to all
the Shell Group contracted operators, the Shell Aircraft programme includes guidance to
operators on the development and introduction of broader programmes such as Safety
Management Systems.
Top Management support for SMS is essential as they are responsible for establishing
and maintaining the safety culture of the company which, if we truly want to improve the
industry’s accident record, needs to be a supportive, learning and above all a just culture.
Human Factors training is an essential element to initiate any error reduction programme,
if the management, staff and contractors are to have an understanding of the causes of
human error. Armed with the knowledge gained by training, by use of methodologies to
aid in the management of the causal factors of human error, and a supportive culture, they
can do much to reduce the likelihood of common errors re-occurring.
Any human factors programme must be driven by and actively involve the management of
the company. Shell Aircraft believes the most practical way of addressing engineering
human factors, which is only one of many challenges facing top management in today’s
airline businesses, is to embed the programme into a Safety Management System (SMS).

edwards.doc 2
14 th Annual Human Factors in Aviation Maintenance Symposium 13.0 The Benefits

If applied effectively, an SMS can addresses all the issues of risk confronting the aviation
industry.
Through the use of Safety Management Systems, it is possible to analyse the
hazards/risks of the business, and put measures in place to control those risks effectively.
The key risks are analysed and prioritised in a Safety Case to allow top management the
opportunity to focus their valued and limited resources on the risks that are most likely to
impact on the company; indeed accidents today can threaten the very being of an airline.
The paper sets out the various elements of an SMS and shows how it can be used to
manage human error.
SAFETY MANAGEMENT SYSTEMS
A Safety Management System is defined as a systematic and explicit approach to
managing risk. It specifies how the company intends to manage safety as an integral part
of its overall business with explicit priorities established, as in any other business
imperative such as financial or commercial management. Safety Management Systems
address all aspects of safety in the operation and should deal with all levels of risk. By
comparison, a Safety Case focuses on specific parts of an operation and addresses only
the major hazards, such as those with the potential to cause fatal accidents.
The actual structure of an SMS will be dependent upon each company’s management
culture, business style and needs. Fundamentally, there are three key pre-requisites for an
SMS, namely a “comprehensive corporate approach to managing safety”, an “effective
organisation for delivering safety” and “robust systems for assuring safety”. To aid in the
understanding of Safety Management, guidance documentation has been developed. In
support of this, an analysis of the potential elements that should be built into an SMS,
together with explanatory texts have been formed into a “toolkit for safety management”.
This toolkit is as comprehensive as possible, but it is realised that the elements that
already exist in any organisation should be strengthened in a stepwise progression towards
a fully effective SMS, because of the practicalities of staffing and managing too much
change in the company.
Key features of an SMS are Safety Case(s), Hazard Management, Risk Assessment, and
Interface control documents with third parties, where appropriate, when a risk or hazard
is shared. Finally and perhaps most important of all, are defined accountabilities,
leadership, communication, involvement of the staff, and established competency
standards. The competency standards identify the training needs of the organisation to
develop and maintain skills and ability, both managerial and technical skills. Through this
focussed approach, part of which is an understanding of human factors, the staff can act
appropriately to operate safely and to predetermined standards.
THE SAFETY CASE
A Safety Case is the “systematic and structured demonstration by a Company to provide
assurance, through comprehensive evidence and argument, that the aircraft operator has an
adequately safe operation”. A company who produces its own safety case will have
identified and assessed the major hazards and safety risks and be able to demonstrate that
they can manage them to levels which are As Low as Reasonably Practicable (ALARP).

edwards.doc 3
14 th Annual Human Factors in Aviation Maintenance Symposium 13.0 The Benefits

The Safety Cases of an organisation are subordinate to the Corporate Safety Management
System, but interactive with it. There may be any number of safety cases, and they may
address any discrete but definable part of the business; examples would be: a base, aircraft
operations or engineering, ground based operations, or the introduction of an new type of
aircraft. The end result must be that however many, or whatever style of safety case is
employed, they must cover all the safety critical activities carried out by the company.
The prime requirement of a safety case is the identification of the major hazards, their
control and the reduction of risk. The safety case makes it clear to the management what
needs to be improved and how, so that they may make appropriate decisions to manage
the business, reduce the potential for loss and therefore enhance the actual profit of being
in the business.
The Safety Case draws from the corporate safety objectives and safety policy, which
must make safety an explicit priority and at least equal to any other business imperative.
It requires corporate decisions as to what level safety is to be managed, with hazards
identified, risks assessed and appropriate controls in place. This will require a change in
culture, not necessarily found in many aviation companies, and will require a willingness
to learn and improve. A systematic approach to safety is very much in line with the
Quality Assurance approach of ISO 9000 or similar systems to quality systems.
Therefore, although possibly not as robust, the quality systems of JAR-145 and JAR Ops
are naturally supportive of an SMS and Safety Case(s). Indeed in some enlightened
companies the quality and safety departments are brought together under a single director
or manager, whose prime goal should be target-led continuous improvement towards safer
operations.
Line Managers manage the Safety Case, in day to day operations. These line managers are
expected to ensure that the requirements of their accountabilities for safety in the
organisation are met. Therefore, safety accountabilities need to be robustly stated and
well understood, and this should be cascaded down through the organisation at least to the
Captain or Certifying Engineer levels.
Safety Management System and Safety Case are linked in many ways. The prime linkage
that needs to be in place is through the hazard management processes where all hazards are
covered by the SMS but only safety significant hazards are included in the safety case.
HAZARD MANAGEMENT
A structured approach taken to identify, assess and control the hazards is known as
“hazard management” and results in the development of a Hazard Register. The focus of
Shell Aircraft work with the collaborating airlines and aircraft operators has been to build a
generic hazard register (hazard model) which, with customisation to suit each company,
can be adapted to suit most operators. The process of hazard analysis enables the
company to ensure that the limited resources available are targeted at the areas of greatest
risk. In practice as part of the risk assessment process used, the risks were ranked in
order of potential priority to be addressed in the hazard management process.
The justification for identifying hazards and managing them, apart from being a
requirement in some cases, makes good business sense. No well run company would
consider operating without taking into account the financial risks it faces, and making

edwards.doc 4
14 th Annual Human Factors in Aviation Maintenance Symposium 13.0 The Benefits

adequate provisions in the planning to cater for the likely outcomes. In the same way,
given the high cost impact on assets, people and reputation that an accident can have, it
makes perfect business sense to control the potential for accidents and serious incidents.
In today’s world no manager, pilot or engineer deliberately risks an accident. However, at
the same time most companies have developed their systems reactively based on
experience from accidents. Hazard management is more systematic and considers
everything that could go wrong, its likelihood of occurrence and the practical controls
needed to manage it effectively. It is the difference of “knowing” that you are safe (as
safe as is reasonably practicable), as opposed to “believing” it.
The hazard model was based on the use of a bow-tie tool used extensively in other
industries. This tool considers that the primary hazards can be released by threats, which
need to be controlled. However, these threat controls sometimes fail due to the effects of
escalation factors, which in turn also need to be controlled. If these escalation controls
fail, the hazard will be released and a hazardous event will occur, which if not returned to a
safe state by the use of recovery measures will result in a potentially serious consequence.
As in the threat controls, recovery measures can also fail and therefore these need to have
effective secondary controls in place. This reduces the likelihood of the release of a hazard
resulting in a consequence. Finally should the operator suffer an accident or incident they
should protect themselves and their customers by having effective mitigation measures in
place that will minimise, as far as is possible, the effect of the occurrence. An example of
this process might be as follows:
A fatigued engineer, working late at night makes a mistake, such as incorrectly
routing an armoured hydraulic hose too close to a generator’s output terminals. In
this case, although there were limits to the planned working period, these had been
exceeded due to staff shortages. No guidance from the management had limited the
engineer from being rostered for a double shift by his supervisor, nor was any
supervision or monitoring of the work carried out done by the supervisor, or even
specified, as this was a qualified engineer doing the work. The routing of a
hydraulic pipe, where it passed close to the main termination of the generator
output cables, was unprotected because the insulation caps were not in place. Due
to the pressure of work, simplicity of the task and fatigue, the Maintenance
Manual was not used for guidance and the cautionary notes covering this routing
problem were missed.
Although apparently complete, the aircraft was unairworthy and a lack of any
quality or supervisory checks of the completed task allows it to be released for
service. Engine ground runs were deemed unnecessary as motorising the hydraulic
pump covered the leak check requirement and therefore any possible recovery
measures are bypassed. During a subsequent flight there is arcing across the gap
between the hose shielding and the terminal, which eventually burns through the
hydraulic hose casing and the resulting pinhole leak sprays a fine mist of hydraulic
oil onto the arc; this in turn then ignites. The fire in flight now requires the crew to
carry out emergency procedures, which as a minimum will result in a serious
incident, but may result in a major fire and subsequent loss of the aircraft.

edwards.doc 5
14 th Annual Human Factors in Aviation Maintenance Symposium 13.0 The Benefits

The controls that should be in place for such occurrences are perhaps obvious, but in the
real world of engineering, where resources are tight, the controls that are required are often
found to be missing.
The minimum set of preventative controls needed in this case are :
• Detailed accountabilities for managers, supervisors and certifying engineers
• Adequate supervision
• Limitations to engineers working time
• Management involvement in working routines
• Task focussed competency profiles that match skill, ability and knowledge
against work requirements.
• Resource planning to cover the likely levels of work requirements to prevent
excessive working periods or workload
• Identification of known risks pertaining to specific tasks embedded into the
task cards
• Effective use of procedures and task cards by the staff
• Workplace monitoring of practices employed to complete tasks
• Adequate post maintenance inspection and testing
• Quality Assurance checks relevant to the working day, “when tasks are
actually being carried out”.
Although, it could be concluded in this case that the engineer caused the incident, was it
really his error? Or were the company’s systems of working, in part, at fault. If the latter
is true then management should share the responsibility for the incident and be
establishing effective working systems to prevent further such occurrences. In reality, this
should not be done at the individual task level, but from one step back looking at the
broader issues of how work is conducted and how robust are the systems to cope with an
error or circumnavigation of the required practices. Due to the nature of people, error and
well-intentioned violation is predictable and in some measure, unavoidable. Therefore, it is
clear that the controls that need to be in place should be identified and that awareness of
such potential problems must be raised with the staff and all levels of management.
To identify the generic hazards of aviation, Shell Aircraft set up two groups of
workshops, one covering fixed-wing airline type operations and the other rotary-wing
offshore operations. The workshops were led and facilitated by the author and his team.
Pilots and engineers from a number of airlines and aircraft operators formed the “expert
panels” who populated each workshop.
When considering human factors the “hazard” is in fact the “people” operating or working
on the aircraft or indeed involved with it. People meet the defined criteria for hazards,
which requires that they have energy and the potential to cause harm, although, in reality,
it is the “threats” of errors and inappropriate actions, that release the hazards of operating
and maintaining aircraft. It follows naturally that the management of human error will be a
key feature of any SMS.

edwards.doc 6
14 th Annual Human Factors in Aviation Maintenance Symposium 13.0 The Benefits

A central part of any Safety Case is the management of hazards. Clearly, without a robust
list of hazards and potential hazardous events that require management and an
understanding of the activities that will be occurring when the hazards might be released,
management will not be able to assure itself that they have established effective controls.
Although, in many cases workplace HSE has legal ramifications and, of course, is essential
to the safety of the staff, the hazard model developed is primarily focussed on the hazards
that could result in the worst case, as in a crashed aircraft. It is this type of accident that
threatens the corporate well being and also has the largest effect on the customer. For this
reason it was considered important to consider flight safety, in the broadest sense
including airworthiness, as being the prime target for Safety Management Systems to
address.
The risk assessments carried out also supported this point of view, and when the
potential hazardous events were ranked, they highlighted that “release of an unairworthy
aircraft” as the number one risk faced today by the companies involved. The next two
high potential events were “aircraft deviates from an intended flight path”, and “loss of
containment of dangerous goods”, typically collision with another aircraft, controlled flight
into terrain (CFIT) and accidents such as occurred to Value-Jet.
HUMAN FACTORS
Human error is undoubtedly the most significant problem faced by our industry today and
perhaps the least easy to manage. It is often not the will of the individual to do wrong
that is at fault, but a combination of company systems and cognitive shortfalls, coupled
with real or perceived pressures, that underlie the majority of occurrences. New ways of
working in some ways are attempting to address this issue, but to date, the culture in
aviation does not support sensitive management of human error; nor, as yet, is there much
high level support for such measures.
If SMS is to make the difference that is required to reduce the level of accidents and
incidents currently experienced, it will need the commitment of management not only to
put effective controls in place, but to have a culture to support its “just” stance when
accidents and incidents occur. It is all to easy to fall back on old style punitive
approaches and blame someone for the accident/incident. This is all the more likely when,
as is the norm after an accident, the media is looking for an admission of whom is
responsible! Understandably, the regulator will be looking at the Accountable Manager to
take positive corrective and preventive action, which may limit their perceived ability to
sustain the just culture at such stressful times.
The company management will need to deal sensitively with those responsible, unless
they used reckless or wilful behaviour, in which case disciplinary action would be
appropriate. To pull all this together it will be essential for all staff, including top
management, to undergo training to understand what Safety Management and Human
Factors is about and the extent of the corporate commitment to its safety programme.
The approach taken, in hazard management terms in a safety management system, is to
identify the missing and ineffective controls that are employed and raise these as remedial
actions. These remedial actions are then reviewed and assessed by line management for
their potential benefits and the ramifications of change, and if appropriate implemented.

edwards.doc 7
14 th Annual Human Factors in Aviation Maintenance Symposium 13.0 The Benefits

The other remedial actions, documented as they are, are written up to show the decisions
that led to deferring or refusing action. Although, it might seem strange to log negative
decisions it is worth considering that in today’s litigious world, ignorance of a requirement
is no excuse in law and as such it is deemed to be negligent. A justifiable negative decision
shows management to be managing the business to ALARP principles. Although,
subsequently that decision may prove to have been fallible, management would not be
deemed to have been negligent.
A strength of having a Safety Management System is that it is capable of systematically
reviewing the business and identifying the problems that the company faces. The
systematic review gives the management the opportunity to address the most significant
issues, before they become tomorrow’s accident. It is supported by a structure of internal
audits, safety meetings, toolbox (pre-job) briefings and, importantly, keeping
airworthiness as a priority for the engineers’ focus.
Typically, the human factor initiators that require control and are identified in the generic
hazard model include:
• Incapacitation of ground based staff from fatigue, illness, or drug and alcohol abuse.
• The actions of third parties which may influence the airworthiness of aircraft.
• Inadequate recording, poor quality, under-informative paperwork from the aircrew or
maintainers.
• Non compliant practice in the completion of tasks, either by not following the
procedures, or using personal practices to get the job done.
• Poor planning, by failing to take into account the requirements of the job in hand,
resources, equipment, information, facilities and spare parts.
• Inadequate handover, failing to document adequately, explain, and show the
subsequent task recipient the status of the job in hand.
• Lack of personal competence and skill of the person allocated for the task.
• Mistakes, errors & violations: doing the right thing at the wrong time, the wrong thing
at the right time, or choosing to achieve the task using alternate and unapproved
methods, albeit usually as well intentioned actions.
• Inadequate workplace environment: is it suitable for the work being carried out, does it
and its systems help or hinder the achievement of quality work? The workplace
environment includes: working conditions, systems of work, weather, lighting,
equipment and tooling.
• The workload of staff: do people work under excessive pressure, are there adequate
numbers of people available to ensure the quality of work required?
• Procedures: are they effective, clear, easily understood by the workforce, readily
available and actually achievable, as written? Often the sheer number of procedures is
the problem, and vital information can be missed because there is just to much to read.
• Lack of supervisory oversight: in today’s cost focussed aviation industry has effective
supervision gone by the board? In many cases little or no supervision is done; this is

edwards.doc 8
14 th Annual Human Factors in Aviation Maintenance Symposium 13.0 The Benefits

especially true of certifying engineers, yet those engineers are subsequently implicated
in most maintenance-induced accidents as being causal.
• Time Pressures, real or perceived encourage mistakes, yet does the planning take this
into account?
• Night working is endemic in aviation and therefore cannot be avoided, but fatigue,
disturbed work patterns and circadian rhythm problems all need to be considered as
threats to the production of error free work.
• Shortfalls in resources such as tooling, equipment and spares are all triggers that
encourage inappropriate maintenance actions; how is this taken into account and
managed?
• Inadequate training: how are competencies developed or maintained, is there any
recurrent training, does the training plan include management and supervisory training
and is there a Maintenance Resource Management (MRM) training programme to
cover human factor awareness?
• Motivation of the staff through effective leadership: is this in place, is the staff aware
of the management’s commitment to safety? Are the safety policy and business
objectives known and understood by the staff?
• Is communication effective, is there a two-way flow of information up and down, are
the staff listened to when they raise concerns, is management open or closed in its
communication with the workforce?
Each of these initiators needs to be taken into account, and it is likely that in many of the
activities being undertaken, these potential problems abound. The generic hazard model
lists suitable controls to deal with each of these, and in analysing each of the hazardous
events, these controls need to be identified and, if appropriate, implemented.
SUCCESSES AND FAILURES
As already stated, some safety benefits have been derived from the overall safety
programme Shell Aircraft employs. However, it is far too soon to say that any early
benefit has been achieved from the introduction of Safety Management Systems or Safety
Cases. That said, the first two companies that have addressed the hazard management
programme have found that more than the estimated 15% of missing controls were indeed
not in place, or at least relied on personal standards of individuals to assure continuing safe
operations rather than being embedded in the company systems.
To date the generic hazard model has been challenged for robustness on several occasions
and has stood up very well to those challenges. The model continues to be improved, as it
becomes better understood from trying to implement it. The methodology of addressing
human factors as a number of the threats to safety and using safety management systems
to control and manage them appears to be the right approach.
Those that have used the UKHFCAG’s human factors programme, “People, Practices and
Procedures in Aviation Engineering and Maintenance”, have found it to be practical and
useful. This is especially true if the engineering and maintenance staff is given human

edwards.doc 9
14 th Annual Human Factors in Aviation Maintenance Symposium 13.0 The Benefits

factors training from the outset. The systematic structure of the SMS allows for support
of a human factors programme as an effective control against the threat of human error.
There have been no major failures as such to date, but it has been extremely difficult to
convince top management of most companies approached that the potential benefits
outweigh the additional effort required to introduce Safety Management or engineering
human factors programmes. To provide support, we developed an SMS introductory
video package to explain, inform and assist the executives of the companies that we
contract with.
It is true to say that every attempt that was made to make the hazard analysis less labour
intensive has been frustrated by the complexity of the business of maintaining and
operating aircraft. Although, through brainstorming and combining similar hazards and
threats’ a reduction of the number of hazardous events to a minimum was achieved.
Methodologies were developed to assess and rank the hazardous events so that they can
be addressed sequentially in a measured programme.
A defined “toolkit” of the elements that make up a Safety Management System has been
produced, which will enable companies to chose the elements that most suit its current
business needs to address its potential problems. Nevertheless, any company which sets
out to improve its safety performance through using an SMS is going to need a
considerable amount of time and effort, and a lot of commitment to realise the benefits.
CONCLUSION
To further improve safety in aviation, a step jump in the approach taken is needed and
this can be achieved by the introduction of an SMS. Indeed the introduction of such
systems is perhaps the only meaningful way to address the safety issues that face the
industry, if we intend to significantly reduce the current accident rate. Other industries
have seen significant safety performance improvement from introducing SMS techniques.
It is recognised that aviation is fundamentally a safety oriented industry, and that much of
what can be done has already been done to make it one of the safest modes of
transportation; therefore, it is unlikely to see safety benefits in orders of magnitude.
Nevertheless, it could halve the accident or incident rate seen today; provided it is applied
meaningfully with the right leadership and commitment to sustain it.
A key part of any Safety Management System relates to the management of human
factors issues. As the most significant causal factor in accidents and incidents in aviation
today, this is a prime area for benefits to be gained. Safety Management for aviation is at
best embryonic and as yet SMS standards are ill defined. The work done in the UK by
the Civil Aviation Authority, UK Flight Safety Committee, UKSMSCAG and Shell
Aircraft is helping to raise that definition and establish tools that will aid understanding
and implementation.
However, there should be no attempt to underestimate the effort that a Safety
Management System will require and, in particular, the commitment and leadership from
top managers who will have to get involved in managing safety. The training requirements
that must be included in such a programme to build understanding and confidence in new
ways of managing safety will also be a burden to be faced. However, this can be justified
when considering the potential gains of reducing losses from accidents and incidents. To

edwards.doc 10
14 th Annual Human Factors in Aviation Maintenance Symposium 13.0 The Benefits

support this, each company and the industry in general needs to build the business case
by identifying and recording the true full cost of errors that are occurring every day.
Utilising an SMS to manage human error can be the tool that makes the difference to the
safety performance of the airline industry in the future. It can take it from a position of
“believing it is safe” to one of “knowing that safety is managed and as far as possible
assured”.

edwards.doc 11