charles packer 20081 transport canada sms information session hilton toronto airport hotel 25...

Charles Packer 2008 1

TRANSPORT CANADA

SMS INFORMATION SESSION

Hilton Toronto Airport Hotel

25 September 2008

SAFETY CULTURE AND THE SMS

Cherrystone Management Inc.

CHARLES PACKER


THREE MAIN POINTS


• Control Ahead of Time through good MANAGEMENT SYSTEMS

• Control In Real Time through good BEHAVIOURS

• Respond well to Abnormal Situations through CAUTION

• Constantly LEARN AND IMPROVE

1. STRUCTURE OF SAFETY

2. FOCUS OF SAFETY

3. SAFETY CULTURE

• Safety Culture is “The way we do things around here” to ensure the STRUCTURE and FOCUS OF SAFETY.

• It is anchored in ASSUMPTIONS (Beliefs, Perceptions)

• To Keep the Physical Conditions within the DESIGN CONDITION AND THE DESIGN CONFIGURATION


THE STRUCTURE OF SAFETY


LEARNING AND IMPROVEMENT

OVEALL STRUCTURE OF GOOD SAFETY

CONTROL AHEAD OF TIME

Management Systems

STRUCTURE

CONTROL IN REAL TIME

Human Performance

BEHAVIOURS

RESPOND WELL TO THE

UNEXPECTED

CAUTION

UNEXPECTED EVENTS

ANTICIPATED EVENTS


WHY BE SYSTEMATIC ABOUT SAFETY?

Heights

Fire

Flying

Spiders

Thunderstorms

Driving

Being Driven

Comfort Level LOW HIGH

Typical responses


1. Everyone is different

2. Higher comfort when we are in control

3. Higher comfort with repetition

Our natural response to situations bears essential no correlation to real risk. We have no built-in sense of safety

WE NEED A SYSTEMATIC APPROACH: A SAFETY MANAGEMENT SYSTEM

WHY BE SYSTEMATIC ABOUT SAFETY?


WHY BE DISCIPLINED ABOUT BEHAVIOURS?

1. Typically, 70-80% of all events are caused by HUMAN ERROR

2. The “natural” human error rate is too high for our standards of safety, but special techniques can be used to reduce it substantially

WE NEED A “HUMAN PERFORMANCE PROGRAM”

(Communications Protocols, Cockpit Resource Management, Procedural Adherence, Self-Check, Verification, Simulator Testing, etc.)


WHY BE OBSERVANT & CAUTIOUS?

1. Major accidents are always unexpected.

2. They have a set of root causes that we should have noticed, but didn’t.

3. Our “last chance” to avoid an event is being observant and cautious

WE NEED TO RESPOND WELL TO UNEXPECTED OR ABNORMAL SITUATIONS

(Observant and Cautious)


WHY LEARN & IMPROVE?

WE NEED TO LEARN AND IMPROVE WITHOUT DELAY

1. Major accidents have a set of root causes that we should have noticed, but didn’t.

2. Major accidents always happen now. Never at some convenient point in the future when we have improved


THE FOCUS OF SAFETY


SAFETY IN TECHOLOGICAL ENDEAVOURS

Safety is only ensured by keeping the equipment within the DESIGN CONDITION

and the DESIGN CONFIGURATION

The “Safe Operating Envelope”

All of the MANAGEMENT SYSTEMS must connect to this goal

(For example, in aviation “Configuration” includes the aircraft operational state, environment, air traffic control etc. etc.)

And the required BEHAVIOURS must happen


SOCIETY

REGULATOR: REGULATIONS & LICENSING

APPROVED CONDITION & CONFIGURATION

OPERATING ORGANIZATIONS: SMS AND BEHAVIOURS

SAFETY ROLES

DESIGNERS

SAFETY ACTUAL CONDITION & CONFIGURATION


SAFETY CULTURE HISTORY


MAJOR NUCLEAR SAFETY EVENTS IN LAST DECADE

1. TOKAI MURA, JAPAN: Fuel Fabrication plant accident (Fatalities)

2. BNFL, ENGLAND: Falsification of fuel inspection records

3. DAMPIERRE, FRANCE: Labour relations threatened closure

4. DAVIS-BESSE, USA: Severe vessel head degradation

5. JAPAN: “Modified” inspection records (17 units shutdown)

6. PAKS, HUNGARY: Severe damage to 30 PWR fuel assemblies: Contractors cleaning fuel in a special vessel

7. JAPAN: Cover up of an inadvertent criticality event: Contractors withdrew rods with the vessel open – close to super-critical

8. KOZLODUY, BULGARIA: Control rods failed to drop: replacement clutches became welded over time due to a design flaw. Then an identical event happened in China 10 months later.


OTHER SAFETY EVENTS

1. Challenger and Columbia Space Shuttle disasters

2. Rail crashes in the UK

3. Oil platform fires (Brazil and others)

4. BP Refinery (Texas)

a) All of these major accidents have their roots “deep in the organizational culture”

b) Most events have happened in developed countries.

c) The root causes appear to have been established many years before the event, yet went undetected

d) The root causes are hard to fix: (e.g. in the case of the space shuttle there appears to be overlaps of causes with the Challenger disaster of 1986)


WHAT IS A SAFETY CULTURE?


1. Safety Culture is “THE WAY WE DO THINGS AROUND HERE”

2. A healthy Safety Culture ensures that the STRUCTURE and FOCUS OF SAFETY are achieved.

3. Safety Culture is anchored in ASSUMPTIONS (Beliefs, Perceptions)

SAFETY CULTURE


SOME RULES OF CULTURE

1. The culture is the set of patterns of behaviour that go on in the organization: “the way we do things around here”

2. Cultures are not good or bad, but they ARE good or bad at achieving certain outcomes

3. There is always a safety culture in your organization. But is it what you want?

4. Cultures are founded on assumptions (beliefs) about “reality” (usually unconsciously held)

5. The members of a culture are most comfortable when they conform to the patterns of shared behaviour. I.e. a culture represents the lowest level of anxiety for its members

6. Changing a culture requires behaviour change that will always cause anxiety and will always be resisted

7. Behaviour change coupled with good communications (2-way) will eventually establish new norms, new beliefs, and low anxiety. (Need to stay the course)


CULTURAL ASSUMPTIONS


“The plant is robust, it has some margin”

Initial training is focused on the design and how good it is

There is no mention of human performance & errors are tolerated

Often, when there is a problem the engineers recalculate the margins

When Chernobyl happens we say “It can’t happen here. The plants are robust.”

We criticize the regulator for being over-conservative. We resist structure and rigour. We think we know best

ASSUMPTIONS: How do they form?


ASSUMPTIONS: What do they do?


Lack of a sense of urgency about improving plant condition

Don’t complete all planned work in outages

Make occasional non-conservative operating decisions

Treat a lot of situations as “Special Cases” and don’t always follow procedures

Don’t report some apparently “minor” observations


EVENT

“LAST-CHANCE” Barrier

LEARNING Barrier

PEOPLE Barrier

PHYSICAL Barrier

HAZARD


Make non-conservative decisions or don’t follow procedures

Don’t report minor problems or unusual observations

Don’t follow all the procedures

Lack of a sense of urgency about fixing defective equipment


ALL BARRIERS ARE DEFEATED BY A SINGLE CAUSE (ASSUMPTION)

1. The assumption is held unconsciously

2. The assumption grows from experiencing what actually happens in the organization

3. Almost all members of the organization will therefore share the same assumption

4. Therefore no-one recognizes it or challenges it

The vulnerability will remain unless there is SIGNIFICANT PRESSURE FOR CHANGE through regulation, leadership, learning from others, recruiting outsiders, etc.


BEHAVIOURS


BEHAVIOURS

1. The safety culture is created out of OBSERVABLE BEHAVIOURS

2. Our behaviours are critical to keep us safe in any current situation

3. BUT they also matter more significantly in the long term…because they establish the patterns and the belief systems that ultimately determine our vulnerability to major events.

4. We need to be consistent in our behaviours and not to vary them based on our immediate perceptions of risk. I.e. managers must focus on establishing PATTERNS of behaviour

We all create the safety culture, by what we do, and by what we do not do

Every day


SAFETY CULTURE FRAMEWORK

SAFETY PRINCIPLES (Beliefs & Assumptions)

ORGANIZATIONAL LEARNING

LEADERSHIP BEHAVIOURS

SYSTEMATIC APPROACH

SHARED BEHAVIOURS

PHYSICAL CONDITIONS


SYMPTOMS OF A WEAKENING SAFETY CULTURE

1. A sense of invulnerability based on past performance

2. Assumptions that the equipment and/or the people are “robust”: that there is a significant margin of safety

3. Lack of pressure to change and improve: stagnation and complacency

4. Pushback on new ideas: “we don’t need that here”

5. Responding to accidents elsewhere by looking for “why it won’t happen here”

6. A collective (shared) perception of what “the real safety threat is”, and what the solution is; blindness to other ways that serious accidents could happen

7. Expecting safety to be the responsibility of the safety experts

8. Treating the regulator as a nuisance

9. Excessive occasions when operations are justified by “time at risk” arguments

10. Managers who are not intrusive into operational detail and not demanding of high standards

charles packer 20081 transport canada sms information session hilton toronto airport hotel 25...

Documents