**1. Introduction**

Accidents and serious incidents continue to occur in the field of aviation and no further emphasis is required on the requirement to abate potential hazards in aviation systems. Though the probability of accidents has come down over the years, the severity of the consequences of an aviation accident can be catastrophic, as seen in the case of the two Boeing 737 MAX aircraft disasters at Indonesia and Ethiopia in October 2018 and March 2019, respectively, that resulted in the tragic deaths of 346 people. This has brought about a renewed focus on safety as the paramount cause of concern in both civil and military aviation, and an important knowledge field for study and action.

The concept of safety has evolved over the years, from the technical era to the human-factors era and the organizational era, and finally to the present era of systems-thinking [1–9]. In order to account for the nuances of safety concepts in the context of the modern complex aerospace systems, a "seven-principles-framework of system safety principles" has been developed by the authors. This proposed framework is built upon the five system safety principles (comprising of fail-safe, safety-margin, ungraduated-response, defence-in-depth and observability-in-depth principles) conceptualized by Saleh et al. [6], with the addition of the 'human-factors principle' as the 6th system safety principle, and a newly developed concept called "integration-in-totality principle" as the 7th system safety principle. Thus, in the remaining sections of this article, the authors will discuss the new safety concepts of the '*integration-in-totality principle*', as well as the '*seven-principles-framework of system safety principles*' to which it belongs. These new concepts are meant to enhance the understanding on safety-critical socio-technical systems in their entirety, incorporating the key tenets of systems thinking.

Before getting into the details of the '*integration-in-totality principle*', it is worthwhile to present a brief background, and the need to have a fresh outlook and an augmentation of the existing concepts. It is a well-established fact that there exist multiple root causes and failure modes in real life complex systems that could complement each other. According to Latino [4], the three basic types of causes are: (i) Technical/physical: the actual physical mechanism of the failure; (ii) Human: the human practices that allowed the physical root causes to exist; and (iii) Latent: the way a facility is managed and/or designed that creates the human root causes. Often the physical roots lead to the multiple human and latent roots, and hence it is important to truly understand the physical roots of a failure to find the larger causes. This has been pointed out by the authors [1,2] among other researchers [3,4]. According to Hulme et al. [5], "there is a need to update our understanding of the different viewpoints of the systems-thinking approach, upgrade the accident analysis methodologies to a unified one, and further explore the opportunities towards development of a novel comprehensive accident analysis approach". The development of the 'integration-in-totality principle' is a forward step in that direction.

Even though the five system safety principles suggested by Saleh et al. [6,7] are effective in illuminating the technical/technological/physical aspects of accident causation and understanding the preventive measures thereof, they are not addressing the human-factors and organizational aspects of system safety to capture the human and latent root causes. Hence the authors have included the 'human-factors principle' popularized by International Civil Aviation Organization (ICAO) [8,9] as the 6th system safety principle, in addition to the five basic/technical system safety principles of Saleh et al. The importance of the human factors principle as one of the cardinal principles of system safety needs no further emphasis, and especially in aviation activities one should adopt and train their personnel in the human factors principle. Furthermore, the authors felt the need to include one more system safety principle to suitably address the latent root causes based on systems thinking and systems engineering, in order to make the principles more comprehensive. Hence the new system safety principle of 'integration-in-totality principle' has been propounded as the 7th system safety principle, to take care of the systems-theoretic aspects of accident analysis and prevention. Before proceeding to the details of the new concepts, an overview of the organization of this paper is presented below to give a broader perspective of the discussions.

At the outset, in Section 2, an elaborate discussion on the proposed framework called the '*Seven-Principles-Framework of System Safety Principles*' is provided. Having discussed the broad framework, the '*Integration-in-Totality Principle*', the 7th system safety principle newly introduced by the authors, is explained in detail in Section 3. The 'integration-in-totality principle' is illustrated and elucidated in this Section with the help of the simile of a "Rubik's cube model" having three orthogonal axes, viz. "axis of perspective", "axis of perception", and "axis of performance". The two properties of this model called the "continuum approach" and the "bidirectional synthesis" along the three axes are also discussed in Section 3. Now it is required to discuss the connection and linkage of the integration-in-totality principle with the system thinking domain, and the same has been taken up in Section 4. The authors identified "five key tenets of systems-thinking" and mapped them against the present set of system safety principles, which revealed and amplified the need to add not only the 'human-factors principle' to take care of the human aspects, but also the 'integration-in-totality principle' to take care of the key systems thinking tenet of "vertical and horizontal integration".

The 'theoretical foundation' of the 'integration-in-totality principle' is presented in Section 5. It is comprised of three foundational concepts of systems thinking, viz. the 'abstraction hierarchy' proposed by Rasmussen [10–14], the 'design-control-practice (DCP) diagram' of Stoop [15–18], and the 'mental models in systems-theoretic framework' described by Leveson [19–21], which are related to the 'axis of perspective', 'axis of performance' and 'axis of perception', respectively.

Having elaborated the integration-in-totality principle from a theoretical angle, it is pertinent to present a few case studies chosen to demonstrate how it could be implemented, and the same has been taken up in subsequent sections. Section 6 further elaborates on the "macro-meso-micro levels of vertical integration" along the 'axis of perspective' and provides a case study on the application of the concept in defect investigation and failure analysis of an aero-engine component. Section 7 is devoted to elucidating the significance of perception and mental models in aviation safety, which has not been explored in the safety literature to the fullest extent. Analysis and understanding of an accident or a safety event along the 'axis of perception' of the 'integration-in-totality principle' can remove the distortions in perceptions, and thus help find the truth in any given situation. The recent aviation twin disasters of Boeing 737 MAX aircraft have been analyzed as a case study to illustrate the application of the understanding along the path of "intent-execution-manifestation" in the 'axis of perception'.

Section 8 is meant for explaining the usefulness of 'bi-directional synthesis' along the "design-manufacture-operation" life-cycle continuum. A case study based on the analysis of the test data of 200 aero-engines along the reverse path of test-assembly-manufacture helped improving the engine performance and safety, by working back on the assembly procedures of the compressor modules and manufacturing practices of the compressor blades.

A model on 'quality-reliability-risk-safety paradigm' is presented in Section 9 to highlight the relationship between these four aspects so fundamental to the aerospace and aviation field. Section 10 presents a very interesting analysis of the 'V-model of systems engineering' mapped with respect to the axes of perspective, perception and performance of the 'integration-in-totality principle', thus establishing the applicability of the 'integration-in-totality principle' in the field of reliability analysis and airworthiness certification. Section 11 narrates the suitability of the 'integration-in-totality principle' in risk management.

Finally, Section 12 establishes the linkage between two emerging and parallel fields of knowledge, viz. 'systems thinking and system safety principles', and 'strategic quality management'. It is diagrammatically shown how the 'integration-in-totality principle', developed by the authors as the 7th system safety principle based on 'systems thinking in safety', can be used as a pivotal concept in 'strategic quality management'. The technical discussion is concluded in Section 13.

### **2. System Safety Principles and the Seven-Principles-Framework**

System safety principles are general, high-level, domain-independent and technologically-agnostic principles, adoptable as detailed safety measures for dealing with various safety hazards. Once incorporated, the system safety principles are expected to vastly improve the safety of sociotechnical systems. The five basic/technical system safety principles, originally formalized by Saleh et al., and built upon the notion of the level of hazard and its escalation along the path of accident causation [6,7], are described below:


In order to have a comprehensive set of safety principles, a "seven-principles-framework of system safety principles" has been developed by the authors, which is shown in Figure 1.

**Figure 1.** The Seven-Principles-Framework of System Safety Principles.

Here, two additional system safety principles have been added over and above the aforementioned "basic/technical five", covering the human and systemic aspects of system safety. These "additional two" included in the 'seven-principles-framework of system safety principles' are:


There are different ways to comprehend and appreciate integration as a systems requirement. In general, one can select any one of the three basic approaches or their combinations towards achieving integration in a system. The first approach is the "interface approach" in accordance with the 'SHELL model' [8], which endeavors perfect interface and smooth interaction between the 'liveware' (meaning human-beings) and the remaining workplace elements/components of software, hardware, environment, and other liveware. The second approach is the "resource approach" as per the '5M model' [9], based on the interplay between various resources viz. man, machine, medium, mission and management. These two approaches form part of the 'human factors principle', which is propounded by the International Civil Aviation Organization (ICAO) as part of the safety managemen<sup>t</sup> system, as elaborated in the ICAO Safety Management Manual [8].

However, in the current context, the authors are focusing on a third and perhaps the most important approach, which can be called the "continuum approach", which has not been adequately captured in the safety literature. The details of the 'integration-in-totality principle', developed based on the continuum approach of systems thinking in aerospace Safety, is further elaborated in the next section.

### **3. Integration-In-Totality Principle and the Rubik's Cube Model**

The "integration-in-totality principle" proposed by the authors calls for viewing, analyzing and understanding socio-technical systems bi-directionally along three axes, viz. (i) the axis of performance, (ii) the axis of perception, and (iii) the axis of perspective. Though conceptually appealing, the integration of these diverse dimensions needs further illustration and elucidation.

In order to illustrate and illuminate the 'integration-in-totality principle' wherein three dimensions of organizational continuum along three axes have been integrated together, the authors have developed a "Rubik's cube model of integration-in-totality principle", as shown in Figure 2.

The first dimension of continuum, the "axis of perspective", represent the "macro-meso-micro" levels of systems thinking in the conventional 'vertical integration' approach, which can have many different interpretations depending upon the context. They could include the continuum permeating the echelons of regulatory command to managemen<sup>t</sup> control to operator compliance (command-control-compliance), the purpose-function-equipment comprehension, or a system-subsystems-components level understanding. It allows one to migrate from, and bi-directionally navigate between, a bird's eye-view of wider and general understanding to a worm's eye-view of closer and detailed look.

**Figure 2.** The Rubik's Cube Model of Integration-in-Totality Principle.

The second dimension of continuum, the "axis of perception", consists of the "intent-execution-manifestation" pathway which the authors propose here in this article as a novel concept of "horizontal integration" in systems thinking, in addition to the 'vertical integration'. The axis of perception reflects the perceptions and mental models being maintained by di fferent participants in the system.

Finally, the third dimension of continuum, the "axis of performance", comprises of the major stages in the product life cycle, viz. design, manufacture and operation. This can further be telescopically expanded, as the need arises, into a design-development-manufacture-assembly-testing-operation-

modification continuum. The 'axis of performance' provides an additional orthogonal element of "horizontal integration" in systems thinking.

Thus, the 'integration-in-totality principle' captures the essence of an integrated "continuum approach" along the three axes of perspective (macro-meso-micro), perception (intent-executionmanifestation), and performance (design-manufacture-operation). The integration-in-totality principle is proposed as a stand-alone principle, along with the five basic/technical system safety principles proposed by Saleh et al. [6], and the human factors principle popularized by ICAO [8], within the 'seven-principles-framework of system safety principles'.

The traversal from the highest level to the lowest level and then back to the highest level, like that from the bird's eye-view to the worm's eye-view and vice-versa, can be called "bi-directional synthesis", which is in fact applicable along each of the three axes, viz. 'axes of perspective, perception, and performance'. This property reinforces the dynamics of the 'continuum approach'. The 'bi-directional synthesis' is represented by the bi-directional arrows shown along each of the continuum axes in the 'Rubik's cube model of integration-in-totality principle'.

The bidirectional interplay between the three axes of continuum, viz. the 'axis of perspective' providing the vertical integration, and the two orthogonal 'axes of perception and performance' giving the horizontal integration, is at the core of the dynamics of the 'integration-in-totality principle'. 'Integration-in-totality principle' can be particularly useful in the realm of safety investigations, since the analysis along the 'axis of perspective' of vertical integration can take care of the factors that are typically found at the higher echelons of a socio-technical system, like the command and policies of the regulatory agencies, and the control and practices of the company management, which are not fully captured by the present set of accident analysis models. Furthermore, the analysis along the 'axis of perception' and 'axis of performance', the two orthogonal axes of horizontal integration, can provide a more comprehensive and insightful analysis with a lot of flexibility, for understanding and analyzing a safety-critical socio-technical system in its entirety and instituting necessary preventive interventions early on.

### **4. Vertical and Horizontal Integration—A Key Tenet of Systems-Thinking**

### *4.1. The Five Key Tenets of Systems Thinking*

Grant et al. [29] tried to capture the spirit of systems thinking by synthesizing the core features of contemporary accident causation models, as a basis to develop a formal methodology for anticipating and preventing accident causation and occurrence. They identified a set of 15 basic systems thinking tenets across the di fferent accident causation models. It was found that, despite considerable variation in the di fferent philosophical approaches towards accident causation, these tenets are universally supported. The authors analyzed the 15 basic systems thinking tenets suggested by Grant et al. It was found that the 15 tenets can further be consolidated into the "five key tenets of systems thinking", in order to have a simplified and focused understanding. This e ffort in consolidation helped in correlating the 'systems thinking tenets' to the 'system safety principles'. It also revealed the inadequacy of the present set of the five basic/technical system safety principles in covering the complete set of systems thinking tenets. A comparative matrix prepared by the authors showing the 'five key tenets of systems thinking' mapped against the relevant 'system safety principles' is presented in Table 1.


### **Table 1.** The Five Key Tenets of Systems Thinking and the Correlated System Safety Principles.

It was found from the analysis that the 'human factors principle' should be added as a 6th system safety principle to the set of five basic/technical system safety principles, since all the key tenets (except probably for the 'complex and unruly technologies' tenet) are directly influenced by human factors. The analysis also revealed that the 'integration-in-totality principle' is required to be introduced as the 7th system safety principle to completely take care of the need for embracing the conventional systems thinking tenet of 'vertical integration', which in fact requires further integration with the two dimensions of 'horizontal integration' presented in this article.

### *4.2. Need for Both Vertical and Horizontal Integration—The Case for Integration-In-Totality*

"Systems thinking is all about relationships and integration", said Sydney Dekker in his seminal works on Systems thinking concepts and tenets [30,31]. 'Vertical integration' is only one part of the totality of integration. Even though Grant et al. listed 'vertical integration' as one among the fifteen basic systems thinking tenets, the authors felt that 'integration-in-totality' is achieved only through a holistic "vertical and horizontal integration". Hence the authors, in their compilation of the "five key tenets of systems thinking", substituted the tenet of 'vertical integration' with 'vertical and horizontal integration' to reflect the need of complete integration in the true spirit of systems thinking. The next section is devoted to narrate how a combination of vertical integration and horizontal integration is created to generate the "integration-in-totality principle", with strong theoretical foundation from three important foundational concepts from the field of "systems thinking".

### **5. Integration-In-Totality Principle—Three Concepts Constituting the Theoretical Foundation**

### *5.1. The Axis of Perspective—Abstraction Hierarchy and the Macro-Meso-Micro Levels of Vertical Integration*

In his pioneering Systems thinking concept of "abstraction hierarchy", Rasmussen [10–14] proposed five top-down hierarchical levels of abstraction, viz. functional purpose, abstract function, generalized functions, physical functions, and physical form, shown in Figure 3.

**Figure 3.** The Levels of Abstraction Hierarchy by Rasmussen (source: [10]).

The concept of abstraction hierarchy can nevertheless be simplified into the three levels of purpose, function, and physical-form. These levels of abstraction hierarchy are the basis for the "macro-meso-micro" levels of 'vertical integration' in the integration-in-totality principle. In the systems analogy, these three levels could be related to the system (having a purpose), sub-systems (having their own functions), and components/equipment (having the physical-form). This understanding calls for a vertical integration of the system, the sub-systems and the equipment so as to capture the entirety of the system. However, the macro-meso-micro levels have di fferent connotations in di fferent system contexts, as explained in subsequent sections. The 'bidirectional synthesis' with 'continuum approach' along the di fferent levels of vertical integration is ingrained in the abstraction hierarchy, as evidenced by the bi-directional arrows shown in the diagram.

### *5.2. The Axis of Performance—The Design-Control-Practice (DCP) Diagram*

The "design-control-practice (DCP) diagram", shown in Figure 4, was proposed by Stoop [15–18]. The DCP diagram is constructed of three sets of bi-directional arrows representing three axes. The macro-meso-micro levels of the vertical axis here represent the control levels of governanceoversight, management-control and operator-compliance respectively. The diagonal axis indicates the engineering design cycle of goal-function-form. It can be seen that both the vertical and diagonal axes of the DCP diagram have a one-to-one correspondence with the macro-meso-micro levels of 'vertical integration' derived from the concept of abstraction hierarchy (which in fact have di fferent connotations in di fferent system contexts), and represented by the 'axis of perspective' in the 'Rubik's cube model of integration-in-totality Principle'.

The horizontal axis of the DCP diagram represents a 'design-develop-construct-operate-adapt' bi-directional continuum which additionally provides 'horizontal integration', which has been taken as the basis for the 'axis of performance' of 'design-manufacture-operation' continuum in the 'Rubik's cube model of integration-in-totality principle'. The need for adopting the concepts of 'continuum approach' and the 'bidirectional synthesis' in safety-related analyses is evident from the three bi-directional arrows used in the construction of the DCP diagram.

**Figure 4.** The Design-Control-Practice (DCP) Diagram by Stoop (Source: [16]).

### *5.3. The Axis of Perception—The Role of Mental Models in Systems-Theoretic*

The 'horizontal integration' cannot be limited to the life-cycle continuum of design-manufactureoperation. Perception and mental models play an important role in understanding a socio-technical system in its entirety. That is the reason why one more horizontal axis orthogonal to the other two axes is provided in the form of 'axis of perception' in the 'Rubik's cube model of integration-in-totality principle', having an 'intent-execution-manifestation' pathway along its length. The 'axis of perception' is meant to capture the possible variances in the realms of design-manufacture-operation in the life-cycle continuum, and also between the macro-meso-micro levels.

The 'axis of perception' has been conceived in accordance with the 'role of mental models in systems-theoretic framework', suggested by Leveson [19–21] who opined that the human behavior within a system-theoretic framework is based on the three elements of (i) the designer's model, (ii) the actual system model, and (iii) the operator's mental model, as shown in Figure 5. The bi-hexagonal arrows in the figure have been added by the authors to indicate the need and scope for the 'bi-hexagonal synthesis' with the 'continuum approach' along the path.

The designer deals with idealized description which is generally known as the "intent". The actual system is a result of the "execution" as per the specifications. The operators continually test their mental model of the process against the reality, which results in the "manifestation". Thus, the authors have defined the "axis of perception" of the integration-in-totality principle as an 'intent-execution-manifestation' continuum, deriving from the aforementioned concept of 'mental models of system-theoretic framework' from Leveson [19–21].

**Figure 5.** The Role of Mental Models in Systems-theoretic Framework (Adapted from [19]).

The 'axis of perception' of the integration-in-totality principle, with its horizontal integration along the orthogonal axis of 'intent-execution-manifestation', takes care of the perceptive mental models involved in understanding and analyzing a socio-technical system. This is adding up to the horizontal integration provided by the 'axis of performance' along the 'design-manufacture-operation' continuum. Hence it can be seen that the systems safety principle of 'integration-in-totality' is perfectly in alignment with the key systems thinking tenet of 'vertical and horizontal integration', with the three axes of performance, perception and perspective providing the pathways for analyzing any socio-technical system by applying the concepts of the 'continuum approach' to ensure the necessary system integration, and the 'bidirectional synthesis' for comprehensive analysis along the integrated pathways.

Thus we can see that three important concepts of "systems thinking" by three prominent thinkers in the field of safety have been combined by the authors in this article to conceptualize the 'Rubik's cube model' having the 'continuum approach' and the 'bi-directional synthesis', in order to develop the 'integration-in-totality principle' as the "7th system safety principle".

### **6. The Axis of Perspective in Integration-In-Totality Principle, and the Macro-Meso-Micro Levels**

### *6.1. Skill-Rule-Knowledge Framework and Macro-Meso-Micro Perspective Levels*

The "skill-rule-knowledge (SRK) framework" developed by Rasmussen in 1983 has been a pioneering work on systems thinking, along with the abstraction hierarchy proposed by him the same year [10–12]. The SRK framework posits that the human behavior is a reflection of complexity of the environment; and is basically 'teleological', i.e., driven by purposive goals; and is shaped by signals, signs and symbols in the environment. It gives a description of the abstraction hierarchy, explaining the operational aspect of the functional properties of a system, relating it to the various levels of the operator's cognitive processing at three levels based on skills, rules and knowledge. It provides an integrated approach to the design of human-machine systems, combining the concepts of control engineering and psychology [13,14].

The authors further innovated and reframed the 'SRK framework' in the form of a "FRAMED-IN-FRAM® diagram" to bring in better clarity on how it is a reflection of the 'axis of perspective' of 'vertical integration' which is fundamental to the 'integration-in-totality principle'. The FRAMED-IN-FRAM® diagram is an improved version of the functional resonance analysis method (FRAM) diagram [32], developed by the authors. Interested readers are referred to Thomas, et al. [1,2] for further information on the FRAMED-IN-FRAM® diagram. The FRAMED-IN-FRAM® diagram for the SRK framework, presented in Figure 6, shows how the behaviour and control, based on the three levels of skill, rule and knowledge, works through signals, signs and symbols of perceptual, conceptual and explicit nature respectively. It also illuminates how they work at the three organizational levels, viz. strategic, tactical, and operational levels, which correspond to the 'macro-meso-macro' levels respectively of the 'Rubik's cube model of integration-in-totality principle'.

**Figure 6.** Skill-Rule-Knowledge Framework of Rasmussen, Interpreted using the FRAMED-IN-FRAM® Diagram.

### *6.2. Macro-Meso-Micro Perspectives in Di*ff*erent Contexts*

The macro-meso-micro levels of vertical integration in the axis of perspective of the integration-in-totality principle can be understood/interpreted in many different ways depending upon the context in which they exist. From a systems-theoretic point of view, it could be the system-subsystem-component levels of understanding and analyzing the entity being examined. The vertical integration achieved along the axis of perspective in integration-in-totality principle at the macro-meso-micro levels in different contexts is presented in Figure 7.

In terms of the abstraction hierarchy, the macro-meso-micro levels correspond to the purposefunction-equipment levels, as explained in the previous section. In an organizational situation, the macro-meso-micro levels could be the echelons of regulatory agency, company managemen<sup>t</sup> and operating personnel, with the corresponding restraint actions of command, control, and compliance & care, respectively, as envisaged by Stoop in the DCP diagram [15–18].

As per the SRK framework proposed by Rasmussen, explained earlier with the help of a FRAMED-IN-FRAM® diagram, the macro-meso-micro levels have knowledge, rule and skill as the basis of behavior, with corresponding actions being strategic, tactical and operational, respectively.

### *6.3. The Micro-Meso-Macro Levels of the Axis of Perspective in a Typical Case Study*

The case study presented in an earlier technical article by the authors [1] can be shown as an example of the application of the concept of macro-meso-micro levels for detailed analysis. The case study pertains to the crack developed at the shear neck of the drive shaft of the oil cooling system (OCS shaft) of a turbo-shaft engine. Three major influencing sources were identified for occurrence of the crack (which happened because of excitation of 'backward whirl' phenomenon in the OCS shaft as shown alongside). Interestingly, the three influencing sources were at the three macro-meso-micro levels from the systemic viewpoint, viz. the aircraft (system), aero engine (sub-system) and the OCS shaft (component), as shown in Figure 8.

**Figure 8.** The Micro-Meso-Macro Levels of Component, Aero-engine and Aircraft; (**a**) Progression of Events Leading to Crack and Rupture, and (**b**) the Influencing Sources of Crack and Rupture. (Source: Thomas, Davis & Samuel [1]).

### **7. Axis of Perception—The Intent-Execution-Manifestation Pathway**

### *7.1. The World of Perspectives and Perceptions*

A good starting point for further discussions on the need for integration-in-totality could be the illustrations by the authors on the di fferent facets of perspective, based on the ideas from a Deloitte pamphlet [33], given in Figure 9. The illustrations show that perceptions vary depending upon the perspective or the viewpoint.

The 'big picture', shifting from a worm's eye-view to a man's eye-view to a bird's eye-view and vice versa, is in fact the 'macro-meso-micro' level viewpoints along the 'axis of perspective' of the 'vertical integration' concept of integration-in-totality principle. As we go higher up in the ladder, things become smaller, but the field of vision become larger and wider to have a totally di fferent perspective. The 'flip side' calls for looking from the exactly opposite direction to ge<sup>t</sup> a totally di fferent understanding of the same thing, just as the rotation of an object understood to be clockwise when looking from above is perceived as an anti-clockwise rotation when looked from below, as illustrated. This is in fact the property of 'bi-directional synthesis' ingrained in the integration-in-totality principle. 'Looking through others eyes' and 'view from the future' provide entirely new perspectives and perceptions. The 'analogous angle' and the 'unexpected answer' provide new options to be considered and selected from in any given situation. Other than the facet of 'big picture' which belong to the 'axis of perspective', all the other facets are captured by the 'axis of perception' of integration-in-totality principle.

**Figure9.**TheDifferentFacets of Perspective,Illustrated.

### *7.2. The Axis of Perception—Perceptions Vary*

The role of perception in understanding the truth and reality is best exemplified by the story of "The Blind Men and the Elephant" from Indian folklore, wherein the same elephant was variedly interpreted to be a snake, spear, fan, tree, wall, and rope by the six blind men who touched the trunk, tusk, ear, leg, side and tail respectively. "Our perception of truth depends on our point of view", writes Losmilzo [34] as a caption to the illustration shown in Figure 10, wherein "truth" is shown as a

three-dimensional object which has shadows of square, circular and triangular shapes when projected in the three orthogonal directions, all of which are perceived as "true".

**Figure 10.** "Our perception of Truth depends on our viewpoint" (Adapted from [34]).

The 'axis of perception' in the integration-in-totality principle captures the variance in perception due to the difference in viewpoint by different stakeholders at different levels depending upon their own field of endeavour like design, manufacture, or operation. This variance can be clarified through the 'bi-directional synthesis' with 'continuum approach' along the 'axis of perception' of 'intent-execution-manifestation' in the integration-in-totality principle.

### *7.3. The Intent-Execution-Manifestation Continuum of the Axis of Perception in a Typical Case Study*

The inadequacy of the five basic/technical system safety principles [6] in facilitating complete understanding, analysis and interpretation of aviation accidents and safety events was earlier highlighted by the authors. The human factors principle, and the human-factor-focused accident analysis methods like human factors analysis and classification system (HFACS) also fail to fully achieve this objective, due to a disconnect with the technical aspects of the present-day aerospace systems which are basically complex, software-driven and automated. In such a situation, integration-in-totality principle with its ability to provide multi-dimensional interpretations can provide multifarious insights into the specific problem.

It would be interesting to see how the integration-in-totality principle could be applied to analyze the twin disasters of Boeing 737 MAX aircraft [35,36] mentioned in the Introduction. During the upgrade to Boeing 737 MAX aircraft with bigger engines, the engines were moved up the wing to ge<sup>t</sup> sufficient ground clearance, causing the aircraft nose to lift up higher during take-off. This increased the possibility of aircraft stall due to a higher angle of attack (AoA). The maneuvering characteristics augmentation system (MCAS) was introduced by the designers as a software solution to overcome the problem. The 'design intent' was to achieve an automatic "aircraft nose down (AND)" by means of a stabilizer trim input actuated by the MCAS when the 'critical angle of attack' is reached or exceeded.

However, in both the disaster cases, one of the two AoA sensors installed on the aircraft became faulty, indicating an AoA value higher than the actual value. The feedback from the sensor on the higher angle of attack (~20◦ in the Indonesian aircraft case, and ~57◦ in the Ethiopian aircraft one) resulted in the stabilizer trim input actuation by the MCAS, making the aircraft automatically and uncontrollably pitch down. The pilot applied the manual "aircraft nose up (ANU)" electric trim to counter the 'AND' as and when it was encountered, but the faulty AoA sensor kept sending the wrong signal triggering the MCAS to cause automatic aircraft nose down repeatedly. The erroneous reading by the faulty AoA sensor threw up multiple and confusing signals to the aircrew in the cockpit, and the pilots were not trained to handle such an automation surprise.

This vicious cycle of the automatic 'AND' by the MCAS and the manual 'ANU' by the pilot continued many times, and finally the pilot had to give up the control to the MCAS automation under duress, causing the aircraft to plunge downwards and crash in both the disaster cases, as shown in the "FRAMED-IN-FRAM® diagram" (Thomas et al. [1,2]), given in Figure 11.

**Figure 11.** Intent-Execution-Manifestation Continuum—Case Study on Boeing 737 MAX Disasters.

The case study shows the disconnect between the 'intent' of the designers, the 'execution' by the MCAS and the pilot, and finally the 'manifestation' of the disasters due to the disconnect. Had such possibilities been anticipated as a mental model, necessary checks and controls could have been instituted in the design stage itself so as to obviate the fatal disasters.

The traditional accident analysis methods like AcciMap [13] would have tried to understand the event along the macro-meso-micro levels of vertical integration, which can be captured by the "axis of perspective' of the integration-in-totality principle. The design-related aspects of the MCAS and its integration into the aircraft system and its testing and certification could be captured by the 'axis of performance'. However, the 'axis of perception' provides a powerful tool for understanding and analysis in the form of an intuitional mental model along the 'intent-execution-manifestation' continuum as shown in the case study, highlighting the applicability of integration-in-totality principle in general and the axis of perception in particular in safety investigations.

### **8. Axis of Performance—The Design-Manufacture-Operation Continuum**

### *8.1. The Axis of Performance—The Pathway for Improvement Processes*

The continuum of design-development-manufacturing-assembly-test-operation along the axis of performance in the integration-in-totality principle is the real pathway for improvement processes in a system, applying the intent-execution-manifestation mental models of the axis of perception, and the macro-meso-micro levels of the axis of perspective simultaneously, and hence the Rubik's cube simile for the integration-in-totality principle.

The analysis along the continuum of the 'axis of performance' has to happen bi-directionally. Normally, the flow of information and the consequent action, if any, happen uni-directionally along the forward direction only. But there is a need to have a bi-directional flow of information and action in the value chain of production/overhaul of an aircraft or aero engine between all the stages and sub-stages. For example, the expected acceptance test parameters of an aero-engine are made available with the assembly personnel and the expected assembly acceptance criteria of the manufactured components are taken care by the people involved in manufacture/overhaul of the aero-engine, as shown in Figure 12.

**Figure12.**Bi-directionalSynthesis alongtheAxisofPerformance.
