I think the most important single feature of alf5071h's message is the emphasis on risk management. I pondered if I had anything worthwhile to add. And I think I do: risk is the subject of half of my core class, and in my experience most people do not know about the technical meanings of the word until they encounter them in some such context.
Risk management is becoming part of the development and operations of most civil safety-critical systems nowadays, partly thanks to new international standards (in areas other than aviation) that countries are slowly getting around to adopting ("adopting" means not just saying "it's here, use it", but also enforcing its provisions).
However, ten years ago no one knew what risk management was except for a few experts. (Jim Reason's "Managing the Risks of Organisational Accidents" from 1997 was one of the first general-interest tomes on the topic.) Even nowadays, I suspect that few people at the pointy end (e.g., pilots, ATC) think of their critical jobs in such terms.
Framing the issues in terms of risk management changes the terms of debate. People often use success as the sole criterion: trying to decide "is this OK; is this not OK" along with the inference that if one succeeds, choosing to do it must have been OK. Risk management more often involves deciding how risks have changed; what risk factors are present/absent and in which quantity. Not whether you make it or not, but rather how your chances of success have improved or worsened in the given situation.
So, for example, one can succeed despite poor risk management: the Korean Air pilot who strayed into Russian airspace, refused the interception, was shot down, and put the airplane down successfully on a frozen lakebed without killing anybody. Success yes, but exceptionally poor risk management (and in other situations, in other professions,
grounds for firing or even, in some jurisdictions, criminal prosecution). And, on the other hand, one can also manage risks well, but fail to succeed: the Warsaw pilots who carried the then-allowed VRef + 20 onto the runway, expecting wind shear based on a wind report and a confirming pirep from the guy in front, but who ended up floating down most of the runway. If some of your biggest risks are unknown, as in this case, your judgement is likely to be inaccurate.
Risk management is, though, notoriously part of a "safety culture". If there is one thing on which almost all human- and social-factors people agree, it is that a risk-management approach to critical operations can only effectively be implemented top-down in an organisation, with a high (indeed, some say overriding) priority set by the highest management level. The reason, I suspect, is rather simple. I pointed out that success-oriented and risk-management methods can conflict, so if a company is predominantly success-oriented (as many are, because their most active managers are personally success-oriented and the company inherits the personal characteristics of its most successful managers), it is ipso facto unlikely to be risk-management oriented.
There is a sustained argument for risk management, from another sector, financial markets, in Nassim Nicholas Taleb's best-seller Fooled by Randomness (available in the U.K. from Penguin; I believe from Random House in the U.S.). He shows the pitfalls of success-orientation by recounting tale after tale of high-flying dealers who tank. It seems to be endemic in the financial sector.
One of the best arguments from risk management in commercial aviation that I have seen recently is in the Überlingen report's consideration of the risk management at Skyguide. The report leaves much to be desired in other areas, but their consideration of risk management on that fateful evening at Skyguide is exemplary.
TAM implicitly acknowledged there was a risk-management issue by changing their procedures for landing at Congonhas (changing procedures is one way to manage risks differently).
So I sympathise with alf's plea to reframe the terms of the debate, although I myself prefer to consider *all* aspects, including some that may be passe. I agree with alf that in the case of landing at Congonhas in weather, there is an argument to be made that the pertinent risks were indeed known but apparently misjudged (by many different people and organisations). It will be interesting to see if CENIPA takes this line in their report. One interesting feature of this form of framing is that it is very hard to disagree with a well-performed assessment of risk management, as one may notice while reading the Überlingen report.
PBL