TRANSPORT CANADA SMS INFORMATION SESSION Hilton Toronto Airport Hotel 25 September 2008

1. SAFETY CULTURE AND THE SMS TRANSPORT CANADA SMS INFORMATION SESSION Hilton Toronto Airport Hotel 25 September 2008 CHARLES PACKER CherrystoneManagement Inc. Charles Packer 2008

2. THREE MAIN POINTS Charles Packer 2008

3. 1. STRUCTURE OF SAFETY • Control Ahead of Time through good MANAGEMENT SYSTEMS • Control In Real Time through good BEHAVIOURS • Respond well to Abnormal Situations through CAUTION • Constantly LEARN AND IMPROVE 2. FOCUS OF SAFETY • To Keep the Physical Conditions within the DESIGN CONDITION AND THE DESIGN CONFIGURATION 3. SAFETY CULTURE • Safety Culture is “The way we do things around here” to ensure the STRUCTURE and FOCUS OF SAFETY. • It is anchored in ASSUMPTIONS (Beliefs, Perceptions) Charles Packer 2008

4. THE STRUCTURE OF SAFETY Charles Packer 2008

5. OVEALL STRUCTURE OF GOOD SAFETY RESPOND WELL TO THE UNEXPECTED CAUTION CONTROL AHEAD OF TIME Management Systems STRUCTURE CONTROL IN REAL TIME Human Performance BEHAVIOURS ANTICIPATED EVENTS UNEXPECTED EVENTS LEARNING AND IMPROVEMENT Charles Packer 2008

6. WHY BE SYSTEMATIC ABOUT SAFETY? Comfort Level LOW HIGH Heights Fire Flying Spiders Thunderstorms Driving Being Driven Typical responses Charles Packer 2008

7. WHY BE SYSTEMATIC ABOUT SAFETY? • Everyone is different • Higher comfort when we are in control • Higher comfort with repetition • Our natural response to situations bears essential no correlation to real risk. We have no built-in sense of safety WE NEED A SYSTEMATIC APPROACH: A SAFETY MANAGEMENT SYSTEM Charles Packer 2008

8. WHY BE DISCIPLINED ABOUT BEHAVIOURS? • Typically, 70-80% of all events are caused by HUMAN ERROR • The “natural” human error rate is too high for our standards of safety, but special techniques can be used to reduce it substantially WE NEED A “HUMAN PERFORMANCE PROGRAM” (Communications Protocols, Cockpit Resource Management, Procedural Adherence, Self-Check, Verification, Simulator Testing, etc.) Charles Packer 2008

9. WHY BE OBSERVANT & CAUTIOUS? • Major accidents are always unexpected. • They have a set of root causes that we should have noticed, but didn’t. • Our “last chance” to avoid an event is being observant and cautious WE NEED TO RESPOND WELL TO UNEXPECTED OR ABNORMAL SITUATIONS (Observant and Cautious) Charles Packer 2008

10. WHY LEARN & IMPROVE? • Major accidents have a set of root causes that we should have noticed, but didn’t. • Major accidents always happen now. Never at some convenient point in the future when we have improved WE NEED TO LEARN AND IMPROVE WITHOUT DELAY Charles Packer 2008

11. THE FOCUS OF SAFETY Charles Packer 2008

12. SAFETY IN TECHOLOGICAL ENDEAVOURS Safety is only ensured by keeping the equipment within the DESIGN CONDITION and the DESIGN CONFIGURATION The “Safe Operating Envelope” (For example, in aviation “Configuration” includes the aircraft operational state, environment, air traffic control etc. etc.) All of the MANAGEMENT SYSTEMS must connect to this goal And the required BEHAVIOURS must happen Charles Packer 2008

13. SAFETY ROLES SOCIETY REGULATOR: REGULATIONS & LICENSING APPROVED CONDITION & CONFIGURATION DESIGNERS OPERATING ORGANIZATIONS: SMS AND BEHAVIOURS SAFETY ACTUAL CONDITION & CONFIGURATION Charles Packer 2008

14. SAFETY CULTURE HISTORY Charles Packer 2008

15. MAJOR NUCLEAR SAFETY EVENTS IN LAST DECADE • TOKAI MURA, JAPAN: Fuel Fabrication plant accident (Fatalities) • BNFL, ENGLAND: Falsification of fuel inspection records • DAMPIERRE, FRANCE: Labour relations threatened closure • DAVIS-BESSE, USA: Severe vessel head degradation • JAPAN: “Modified” inspection records (17 units shutdown) • PAKS, HUNGARY: Severe damage to 30 PWR fuel assemblies: Contractors cleaning fuel in a special vessel • JAPAN: Cover up of an inadvertent criticality event: Contractors withdrew rods with the vessel open – close to super-critical • KOZLODUY, BULGARIA: Control rods failed to drop: replacement clutches became welded over time due to a design flaw. Then an identical event happened in China 10 months later. Charles Packer 2008

16. OTHER SAFETY EVENTS • Challenger and Columbia Space Shuttle disasters • Rail crashes in the UK • Oil platform fires (Brazil and others) • BP Refinery (Texas) • All of these major accidents have their roots “deep in the organizational culture” • Most events have happened in developed countries. • The root causes appear to have been established many years before the event, yet went undetected • The root causes are hard to fix: (e.g. in the case of the space shuttle there appears to be overlaps of causes with the Challenger disaster of 1986) Charles Packer 2008

17. WHAT IS A SAFETY CULTURE? Charles Packer 2008

18. SAFETY CULTURE • Safety Culture is “THE WAY WE DO THINGS AROUND HERE” • A healthy Safety Culture ensures that the STRUCTURE and FOCUS OF SAFETY are achieved. • Safety Culture is anchored in ASSUMPTIONS (Beliefs, Perceptions) Charles Packer 2008

19. SOME RULES OF CULTURE • The culture is the set of patterns of behaviour that go on in the organization: “the way we do things around here” • Cultures are not good or bad, but they ARE good or bad at achieving certain outcomes • There is always a safety culture in your organization. But is it what you want? • Cultures are founded on assumptions (beliefs) about “reality” (usually unconsciously held) • The members of a culture are most comfortable when they conform to the patterns of shared behaviour. I.e. a culture represents the lowest level of anxiety for its members • Changing a culture requires behaviour change that will always cause anxiety and will always be resisted • Behaviour change coupled with good communications (2-way) will eventually establish new norms, new beliefs, and low anxiety. (Need to stay the course) Charles Packer 2008

20. CULTURAL ASSUMPTIONS Charles Packer 2008

21. ASSUMPTIONS: How do they form? We criticize the regulator for being over-conservative. We resist structure and rigour. We think we know best When Chernobyl happens we say “It can’t happen here. The plants are robust.” There is no mention of human performance & errors are tolerated Initial training is focused on the design and how good it is Often, when there is a problem the engineers recalculate the margins “The plant is robust, it has some margin” Charles Packer 2008

22. ASSUMPTIONS: What do they do? Don’t report some apparently “minor” observations Don’t complete all planned work in outages Treat a lot of situations as “Special Cases” and don’t always follow procedures Lack of a sense of urgency about improving plant condition Make occasional non-conservative operating decisions “The plant is robust, it has some margin” Charles Packer 2008

23. HAZARD Lack of a sense of urgency about fixing defective equipment PHYSICAL Barrier Don’t follow all the procedures PEOPLE Barrier Don’t report minor problems or unusual observations LEARNING Barrier Make non-conservative decisions or don’t follow procedures “LAST-CHANCE” Barrier “The plant is robust, it has some margin” EVENT Charles Packer 2008

24. ALL BARRIERS ARE DEFEATED BY A SINGLE CAUSE (ASSUMPTION) • The assumption is held unconsciously • The assumption grows from experiencing what actually happens in the organization • Almost all members of the organization will therefore share the same assumption • Therefore no-one recognizes it or challenges it The vulnerability will remain unless there is SIGNIFICANT PRESSURE FOR CHANGE through regulation, leadership, learning from others, recruiting outsiders, etc. Charles Packer 2008

25. BEHAVIOURS Charles Packer 2008

26. BEHAVIOURS • The safety culture is created out of OBSERVABLE BEHAVIOURS • Our behaviours are critical to keep us safe in any current situation • BUT they also matter more significantly in the long term…because they establish the patterns and the belief systems that ultimately determine our vulnerability to major events. • We need to be consistent in our behaviours and not to vary them based on our immediate perceptions of risk. I.e. managers must focus on establishing PATTERNS of behaviour We all create the safety culture, by what we do, and by what we do not do Every day Charles Packer 2008

27. SAFETY CULTURE FRAMEWORK PHYSICAL CONDITIONS SHARED BEHAVIOURS SYSTEMATIC APPROACH ORGANIZATIONAL LEARNING LEADERSHIP BEHAVIOURS SAFETY PRINCIPLES (Beliefs & Assumptions) Charles Packer 2008

28. SYMPTOMS OF A WEAKENING SAFETY CULTURE • A sense of invulnerability based on past performance • Assumptions that the equipment and/or the people are “robust”: that there is a significant margin of safety • Lack of pressure to change and improve: stagnation and complacency • Pushback on new ideas: “we don’t need that here” • Responding to accidents elsewhere by looking for “why it won’t happen here” • A collective (shared) perception of what “the real safety threat is”, and what the solution is; blindness to other ways that serious accidents could happen • Expecting safety to be the responsibility of the safety experts • Treating the regulator as a nuisance • Excessive occasions when operations are justified by “time at risk” arguments • Managers who are not intrusive into operational detail and not demanding of high standards Charles Packer 2008