M anaging the Risk of Organisational Accidents

1. International Railway Safety Conference 2007 Goa, India Managing the Risk of Organisational Accidents Peter CuffeChief Safety & Security OfficerIrish Railpeter.cuffe@irishrail.ie

2. Safety Professionals Railway Organisation Society

3. Individual Accidents • A specific persons • Agent and victim • Limited scope Organisational Accidents • Multiple causes • Many people • Devastating consequences • Often a product of technological innovation

4. Organisational Accidents are the result of highly complex coincidences which are rarely foreseen by those involved. They are unpredictable because of the large number of causes and the spread of information over all the participants

6. Cost of Protection greatly exceeds the dangers

7. Cost of Protection greatly exceeds the dangers Protection falls far shortof required level

8. Better defences convert to improved production

9. Better defences convert to improved production Post Accident response measures

10. Relaxation with further improved production Better defences convert to improved production Post Accident response measures

11. Catastrophic Disaster Relaxation with further improved production Better defences convert to improved production Post Accident response measures

12. Examples of Improved Production • Invention of the Davy Lamp • Extract coal from more dangerous areas • Mine accidents increased • Introduction of Marine Radar • Travel faster in fog or busy waters • Marine history littered with “radar assisted” collisions

13. Dangers of the Un-Rocked Boat A lengthy accident-free period • Steady erosion of protection Easy to “forget to fear” Increasing production, without extended defences, will erode safety margins

14. Production v Protection Partnership is rarely equal • Production creates the resources for protection Process managers have production skills Production information is: Direct, Continuous & Easily Understood

15. Production v Protection Partnership is rarely equal • Successful Protection shown by Absence of Negative Outcomes • Information is indirect or intermittent • Hard to interpret, often misleading • Awareness often driven by accident or near-miss

16. Defences Create Understanding & Awareness Give Clear Guidance on Safe Operation Alarms & Warnings of imminent danger Restore System to a Safe State Interpose Barriers between Hazards & Losses Contain & Eliminate Hazards Provide Means of Escape & Rescue

17. Defences Create Understanding & Awareness Give Clear Guidance on Safe Operation Alarms & Warnings of imminent danger Restore System to a Safe State Interpose Barriers between Hazards & Losses Contain & Eliminate Hazards Provide Means of Escape & Rescue Defences-in-depth, successive layers, specific sequence

21. Holes are continuously moving Defences can be deliberately removed:-Maintenance-Testing-During Failures

27. Latent Conditions Poor Design Gaps in Supervision Undetected Manufacturing Defects Maintenance Failures Unworkable Procedures Clumsy Automation Poor Training Inadequate Tools & Equipment

28. Immediate Effect Shortlived Effect Committed at the “sharp” end, at the human-system interface Lie Dormant No Impact until local interaction Spawned in the organisation Pervasive Active Failures v Latent Failures

29. In aviation, there are foreseeable hazards: Gravity,Weather, Mountains, and Human Fallibility

30. Human Error v Non-Compliance Error - an intrinsic part of the Human Condition Error - distraction Error – loss of situational awareness Error - deliberate We all learn by “trial and error” • Necessary to push limits to establish system characteristics

31. We cannot change the Human Condition, but we can change the Conditions under which Humans work.

32. Investigations • Who ? • What ? • Where ? • When ? • Why ?

33. PRISMA • Choose “Top Event” (Accident or Near-Miss) • Determine Direct Causes • Determine Preceding Causes • Stop when the Facts Stop • Stop at limits of Organisational Control

34. PRISMA – 23 Categories • 4 x Technical • 5 x Organisational • 3 x Staff, Knowledge based • 6 x Staff, Rule based • 2 x Staff, Skill based • 1 x Customers • 1 x Public • 1 x Unclassifiable

35. PRISMA – 23 Categories • 4 x Technical • 5 x Organisational • 3 x Staff, Knowledge based • 6 x Staff, Rule based • 2 x Staff, Skill based • 1 x Customers • 1 x Public • 1 x Unclassifiable Rasmussen’s SRK Model

36. Knowledge based Behaviour • Unexpected or new situations • High attention level • Problem identification and solving • Situational awareness • Understanding of Process • Analytical ability

37. Rule based Behaviour • Recognition of situation • Pattern identification • Medium attention demand • Training to ensure correct rule application

38. Skill based Behaviour • Reflex/automatic reactions • Long learning process • Low attention demand • Triggered by environmental signals • Unlearning very difficult • Stress resistant • Error prevention by environmental change, not by altered behaviour

39. Technical External Design (Ergonomics) Construction/Maint. Material (further research required) Organisational External Supervision Rules/Procedures Management Priorities Culture PRISMA – 23 Categories

40. Knowledge Based External Process Status/ Characteristics (eg current permits to work) Improper Goals (eg making up for lost time by speeding) Rule Based License/Certified Competency Incorrect Permits or other Safeguards Pre-work Status Check not done Work sequence incorrect or incomplete Failure to monitor other system characteristics Failure to use correct resources PRISMA – 23 Categories

41. Skill Based Intentional (eg typing error) Unintentional (eg leaning against controls) PRISMA – 23 Categories • Customer(eg Inebriated passenger) • Public(eg Suicide) • Unclassifiable(eg Act of God)

42. Causal Tree

43. Causal Tree

44. Causal Tree

45. Causal Tree

46. Causal Tree

47. Causal Tree

48. Causal Tree

49. Causal Tree

50. Causal Tree