Safety Culture and Safety Culture and Safety ManagementSafety Management

Jim ReasonJim Reason

Professor EmeritusProfessor Emeritus

University of Manchester, UKUniversity of Manchester, UK

Rail & Aviation Rail & Aviation ConferenceConference

RAeS 21RAeS 21stst May 2009 May 2009

OverviewOverview

Organizational accidentsOrganizational accidents The two faces of safetyThe two faces of safety Safety cultureSafety culture Proactive process measuresProactive process measures Error managementError management

Hazards, losses & Hazards, losses & defencesdefences

LossesHazards

Defences

The ‘Swiss cheese’ modelThe ‘Swiss cheese’ modelof system accidentsof system accidents

Some holes dueto active failures

Other holes due tolatent conditions

(resident ‘pathogens’)

Successive layers of defences, barriers, & safeguards

Hazards

Losses

How and why defences failHow and why defences fail

LossesHazards

Defences

HOW?

Unsafe acts

Local workplace factors

Organisational factors

Latentconditionpathway

s

Causes

Investigation

WHY?

The two faces of safetyThe two faces of safety

Negative face as revealed by Negative face as revealed by accidents, incidents, near misses accidents, incidents, near misses and the like.and the like.

Positive face = system’s intrinsic Positive face = system’s intrinsic resistance to its operational hazards.resistance to its operational hazards.

Intrinsic safetyIntrinsic safety

Vulnerable system

Average system

Resistant

system

The safety spaceThe safety space

Increasing vulnerabilityIncreasing resistance

Organisations

Navigating the safety Navigating the safety spacespace

Increasing vulnerabilityIncreasing resistance

Cultural drivers

CommitmentCognizanceCompetence

Navigational aids

Reactiveoutcomemeasures

Proactiveprocess

measures

Target zone

Negative outcome Negative outcome measuresmeasures

Exceedances (SPADs) Exceedances (SPADs) Near misses & incidentsNear misses & incidents AccidentsAccidents

Proactive process Proactive process measuresmeasures

No single definitive measure.No single definitive measure. Involves regular sampling of a subset of a Involves regular sampling of a subset of a

much larger population of organisational much larger population of organisational processes (somewhere between 8-16).processes (somewhere between 8-16).

Identify those 2-3 processes most in need of Identify those 2-3 processes most in need of remediation.remediation.

Track progress of remedial measures.Track progress of remedial measures. Safety mgt. = long-term fitness programme Safety mgt. = long-term fitness programme

(not a zero production game).(not a zero production game).

REVIEW:REVIEW:Railway Problem FactorsRailway Problem Factors

Tools & equipmentTools & equipment MaterialsMaterials SupervisionSupervision Working environmentWorking environment Staff attitudesStaff attitudes HousekeepingHousekeeping ContractorsContractors DesignDesign

Staff CommunicationStaff Communication Departmental comm’nDepartmental comm’n Staffing & rosteringStaffing & rostering TrainingTraining PlanningPlanning RulesRules ManagementManagement MaintenanceMaintenance

RAIT: Railway AccidentRAIT: Railway AccidentInvestigation Tool Investigation Tool

What defences failed?What defences failed? How did they fail?How did they fail? Why did they fail?Why did they fail? Which of the RFTs was most Which of the RFTs was most

implicated?implicated? Errors and violationsErrors and violations Local situational factorsLocal situational factors

Three C’s: Excellence Three C’s: Excellence driversdrivers

CommitmentCommitment: In the face of ever-increasing : In the face of ever-increasing production pressures, do you have the will production pressures, do you have the will to make your safety management tools to make your safety management tools work effectively? work effectively?

CognizanceCognizance: Do you understand the nature : Do you understand the nature of the ‘safety war’—particularly with regard of the ‘safety war’—particularly with regard to human and organisational factors?to human and organisational factors?

CompetenceCompetence: Are your safety management : Are your safety management techniques understood, appropriate and techniques understood, appropriate and properly utilised?properly utilised?

The importance of cultureThe importance of culture

Only culture can reach all parts of the system.Only culture can exert a consistent influence,

for good or ill.

Though it has the definitional precisionof a cloud

Culture: A workable Culture: A workable definitiondefinition

Shared values (Shared values (what is importantwhat is important) and) andbeliefs (beliefs (how things workhow things work) that interact) that interactwith an organization’s structure and with an organization’s structure and control systems to produce behaviouralcontrol systems to produce behaviouralnorms (norms (the way we do things around herethe way we do things around here).).

A safe culture: Interlocking A safe culture: Interlocking elementselements

Learningculture

Justculture

Reportingculture

Cultural ‘strata’ Cultural ‘strata’

PATHOLOGICALBlame, denial and the blinkered pursuit ofexcellence (Vulnerable System Syndrome).Financial targets prevail: cheaper/faster.

REACTIVESafety given attention after an event.Concern about adverse publicity. Establishes an incident reporting system.

CALCULATIVESystems to manage safety, often in response to external pressures. Dataharvested rather than used. ‘By the book’.

PROACTIVEAware that ‘latent pathogens’ and ‘error traps’ lurk in system. Seeks to eliminatethem beforehand. Listens to ‘sharp enders’.

GENERATIVERespects, anticipates and responds to risks.A just, learning, flexible, adaptive, prepared& informed culture. Strives for resilience.

Error Management (EM)Error Management (EM)

Three main elements:Three main elements:• Error reduction• Error containment• Management of EM

And the hardest of these is And the hardest of these is effective management.effective management.

More management hoops?More management hoops?

Quality management systemsQuality management systems Safety management systemsSafety management systems Error management: what’s Error management: what’s

new?new? Need to sort out differences Need to sort out differences

and overlapsand overlaps

Quality Management Quality Management SystemSystem

(industrial origins)(industrial origins)

TQM had its origins in Statistical Process TQM had its origins in Statistical Process Control (1920s). Deming—Japan—USA Control (1920s). Deming—Japan—USA

Quality measurements at point of originQuality measurements at point of origin Quality assurance (QA) not quality controlQuality assurance (QA) not quality control QA documents the way things should be QA documents the way things should be

done and audits against these standardsdone and audits against these standards Discrepancies are fed back Discrepancies are fed back continuous continuous

improvementimprovement

Safety Management Safety Management SystemSystem

(regulatory origins)(regulatory origins) HSW Act 1974 (Robens). HSW Act 1974 (Robens). Piper Alpha, Piper Alpha, 19881988, ,

Cullen Report (1990). Safety Case.Cullen Report (1990). Safety Case. Modelled on ISO 9000 quality assurance.Modelled on ISO 9000 quality assurance. SMS includes a formal safety assessment of SMS includes a formal safety assessment of

major hazards—steps documentedmajor hazards—steps documented• Hazard identification• Risk assessment• Defences and safeguards• Recovery

QMS & SMS: Common QMS & SMS: Common featuresfeatures

Neither quality nor safety can be ad hoc. Neither quality nor safety can be ad hoc. Both need planning and management.Both need planning and management.

Both rely heavily on measuring, monitoring Both rely heavily on measuring, monitoring and documentation.and documentation.

Both involve the whole organisation.Both involve the whole organisation. Both strive for small continuous Both strive for small continuous

improvements—kaizen not home runs.improvements—kaizen not home runs.

QMS & SMS: ProblemsQMS & SMS: Problems

A strong temptation to put form before A strong temptation to put form before substance—to believe that what’s on paper substance—to believe that what’s on paper matches the reality.matches the reality.

‘‘Quality-assured’ accidentsQuality-assured’ accidents• BAC One-Eleven (1990)• A320 (1993)• Boeing 737-400 (1995)

Neither driven by human factors knowledge; Neither driven by human factors knowledge; neither starts from the fact that human and neither starts from the fact that human and organizational factors dominate the risks.organizational factors dominate the risks.

Why EM is necessaryWhy EM is necessary(Human Factors origins)(Human Factors origins)

Effective EM derives more from a Effective EM derives more from a mindset than a set of ring binders. mindset than a set of ring binders.

EM is not a ‘system’ as such, though it EM is not a ‘system’ as such, though it should be systematic.should be systematic.

EM requires an understanding of the EM requires an understanding of the varieties of error and their provoking varieties of error and their provoking conditions. conditions.

EM takes Murphy’s Law as its starting EM takes Murphy’s Law as its starting point. Errors are inevitable. point. Errors are inevitable.

More about EMMore about EM

Effective EM needs an informed and wary Effective EM needs an informed and wary culture—this depends on establishing:culture—this depends on establishing:• A just culture• A reporting culture• A learning culture

EM must play a major part in both QM and SM EM must play a major part in both QM and SM systems.systems.

QMS and SMS are top-down and normative. QMS and SMS are top-down and normative. EM is bottom-up and descriptive. It says how EM is bottom-up and descriptive. It says how the world is, not how it ought to be.the world is, not how it ought to be.

Some EM principlesSome EM principles

The best people can make the worst The best people can make the worst errors.errors.

Errors fall into recurrent patterns—error Errors fall into recurrent patterns—error traps.traps.

There is no one best way of doing EM.There is no one best way of doing EM. EM is about system reform rather than EM is about system reform rather than

local fixes—it’s about greater resilience.local fixes—it’s about greater resilience.

Error can’t be Error can’t be eliminated, but it can be eliminated, but it can be

managedmanaged Fallibility is part of the human Fallibility is part of the human

condition.condition. We are not going to change the We are not going to change the

human condition.human condition. But we can change the conditions But we can change the conditions

under which people work.under which people work.