Safety Culture and Safety Management

1. Rail & Aviation Conference RAeS 21st May 2009 Safety Culture and Safety Management Jim Reason Professor Emeritus University of Manchester, UK

2. Overview • Organizational accidents • The two faces of safety • Safety culture • Proactive process measures • Error management

3. Hazards, losses & defences Defences Losses Hazards

4. The ‘Swiss cheese’ modelof system accidents Some holes due to active failures Hazards Other holes due to latent conditions (resident ‘pathogens’) Losses Successive layers of defences, barriers, & safeguards

5. Defences HOW? Losses Hazards Latent condition pathways Causes Unsafe acts Investigation Local workplace factors WHY? Organisational factors How and why defences fail

6. The two faces of safety • Negative face as revealed by accidents, incidents, near misses and the like. • Positive face = system’s intrinsic resistance to its operational hazards.

7. Vulnerable system Average system Intrinsic safety Resistant system

8. The safety space Increasing resistance Increasing vulnerability Organisations

9. Navigating the safety space Increasing resistance Increasing vulnerability Cultural drivers Target zone Commitment Cognizance Competence Navigational aids Reactive outcome measures Proactive process measures

10. Negative outcome measures • Exceedances (SPADs) • Near misses & incidents • Accidents

11. Proactive process measures • No single definitive measure. • Involves regular sampling of a subset of a much larger population of organisational processes (somewhere between 8-16). • Identify those 2-3 processes most in need of remediation. • Track progress of remedial measures. • Safety mgt. = long-term fitness programme (not a zero production game).

12. Tools & equipment Materials Supervision Working environment Staff attitudes Housekeeping Contractors Design Staff Communication Departmental comm’n Staffing & rostering Training Planning Rules Management Maintenance REVIEW:Railway Problem Factors

13. RAIT: Railway AccidentInvestigation Tool • What defences failed? • How did they fail? • Why did they fail? • Which of the RFTs was most implicated? • Errors and violations • Local situational factors

14. Three C’s: Excellence drivers • Commitment: In the face of ever-increasing production pressures, do you have the will to make your safety management tools work effectively? • Cognizance: Do you understand the nature of the ‘safety war’—particularly with regard to human and organisational factors? • Competence: Are your safety management techniques understood, appropriate and properly utilised?

15. Though it has the definitional precision of a cloud The importance of culture Only culture can reach all parts of the system. Only culture can exert a consistent influence, for good or ill.

16. Culture: A workable definition Shared values (what is important) and beliefs (how things work) that interact with an organization’s structure and control systems to produce behavioural norms (the way we do things around here).

17. Just culture Reporting culture Learning culture A safe culture: Interlocking elements

18. GENERATIVE Respects, anticipates and responds to risks. A just, learning, flexible, adaptive, prepared & informed culture. Strives for resilience. PROACTIVE Aware that ‘latent pathogens’ and ‘error traps’ lurk in system. Seeks to eliminate them beforehand. Listens to ‘sharp enders’. CALCULATIVE Systems to manage safety, often in response to external pressures. Data harvested rather than used. ‘By the book’. REACTIVE Safety given attention after an event. Concern about adverse publicity. Establishes an incident reporting system. PATHOLOGICAL Blame, denial and the blinkered pursuit of excellence (Vulnerable System Syndrome). Financial targets prevail: cheaper/faster. Cultural ‘strata’

19. Error Management (EM) • Three main elements: • Error reduction • Error containment • Management of EM • And the hardest of these is effective management.

20. More management hoops? • Quality management systems • Safety management systems • Error management: what’s new? • Need to sort out differences and overlaps

21. Quality Management System(industrial origins) • TQM had its origins in Statistical Process Control (1920s). Deming—Japan—USA • Quality measurements at point of origin • Quality assurance (QA) not quality control • QA documents the way things should be done and audits against these standards • Discrepancies are fed back  continuous improvement

22. Safety Management System(regulatory origins) • HSW Act 1974 (Robens). Piper Alpha, 1988, Cullen Report (1990). Safety Case. • Modelled on ISO 9000 quality assurance. • SMS includes a formal safety assessment of major hazards—steps documented • Hazard identification • Risk assessment • Defences and safeguards • Recovery

23. QMS & SMS: Common features • Neither quality nor safety can be ad hoc. Both need planning and management. • Both rely heavily on measuring, monitoring and documentation. • Both involve the whole organisation. • Both strive for small continuous improvements—kaizen not home runs.

24. QMS & SMS: Problems • A strong temptation to put form before substance—to believe that what’s on paper matches the reality. • ‘Quality-assured’ accidents • BAC One-Eleven (1990) • A320 (1993) • Boeing 737-400 (1995) • Neither driven by human factors knowledge; neither starts from the fact that human and organizational factors dominate the risks.

25. Why EM is necessary(Human Factors origins) • Effective EM derives more from a mindset than a set of ring binders. • EM is not a ‘system’ as such, though it should be systematic. • EM requires an understanding of the varieties of error and their provoking conditions. • EM takes Murphy’s Law as its starting point. Errors are inevitable.

26. More about EM • Effective EM needs an informed and wary culture—this depends on establishing: • A just culture • A reporting culture • A learning culture • EM must play a major part in both QM and SM systems. • QMS and SMS are top-down and normative. EM is bottom-up and descriptive. It says how the world is, not how it ought to be.

27. Some EM principles • The best people can make the worst errors. • Errors fall into recurrent patterns—error traps. • There is no one best way of doing EM. • EM is about system reform rather than local fixes—it’s about greater resilience.

28. Error can’t be eliminated, but it can be managed • Fallibility is part of the human condition. • We are not going to change the human condition. • But we can change the conditions under which people work.