Charles Packer 2008 1
TRANSPORT CANADA
SMS INFORMATION SESSION
Hilton Toronto Airport Hotel
25 September 2008
SAFETY CULTURE AND THE SMS
Cherrystone Management Inc.
CHARLES PACKER
Charles Packer 2008 2
THREE MAIN POINTS
Charles Packer 2008 3
• Control Ahead of Time through good MANAGEMENT SYSTEMS
• Control In Real Time through good BEHAVIOURS
• Respond well to Abnormal Situations through CAUTION
• Constantly LEARN AND IMPROVE
1. STRUCTURE OF SAFETY
2. FOCUS OF SAFETY
3. SAFETY CULTURE
• Safety Culture is “The way we do things around here” to ensure the STRUCTURE and FOCUS OF SAFETY.
• It is anchored in ASSUMPTIONS (Beliefs, Perceptions)
• To Keep the Physical Conditions within the DESIGN CONDITION AND THE DESIGN CONFIGURATION
Charles Packer 2008 4
THE STRUCTURE OF SAFETY
Charles Packer 2008 5
LEARNING AND IMPROVEMENT
OVEALL STRUCTURE OF GOOD SAFETY
CONTROL AHEAD OF TIME
Management Systems
STRUCTURE
CONTROL IN REAL TIME
Human Performance
BEHAVIOURS
RESPOND WELL TO THE
UNEXPECTED
CAUTION
UNEXPECTED EVENTS
ANTICIPATED EVENTS
Charles Packer 2008 6
WHY BE SYSTEMATIC ABOUT SAFETY?
Heights
Fire
Flying
Spiders
Thunderstorms
Driving
Being Driven
Comfort Level LOW HIGH
Typical responses
Charles Packer 2008 7
1. Everyone is different
2. Higher comfort when we are in control
3. Higher comfort with repetition
Our natural response to situations bears essential no correlation to real risk. We have no built-in sense of safety
WE NEED A SYSTEMATIC APPROACH: A SAFETY MANAGEMENT SYSTEM
WHY BE SYSTEMATIC ABOUT SAFETY?
Charles Packer 2008 8
WHY BE DISCIPLINED ABOUT BEHAVIOURS?
1. Typically, 70-80% of all events are caused by HUMAN ERROR
2. The “natural” human error rate is too high for our standards of safety, but special techniques can be used to reduce it substantially
WE NEED A “HUMAN PERFORMANCE PROGRAM”
(Communications Protocols, Cockpit Resource Management, Procedural Adherence, Self-Check, Verification, Simulator Testing, etc.)
Charles Packer 2008 9
WHY BE OBSERVANT & CAUTIOUS?
1. Major accidents are always unexpected.
2. They have a set of root causes that we should have noticed, but didn’t.
3. Our “last chance” to avoid an event is being observant and cautious
WE NEED TO RESPOND WELL TO UNEXPECTED OR ABNORMAL SITUATIONS
(Observant and Cautious)
Charles Packer 2008 10
WHY LEARN & IMPROVE?
WE NEED TO LEARN AND IMPROVE WITHOUT DELAY
1. Major accidents have a set of root causes that we should have noticed, but didn’t.
2. Major accidents always happen now. Never at some convenient point in the future when we have improved
Charles Packer 2008 11
THE FOCUS OF SAFETY
Charles Packer 2008 12
SAFETY IN TECHOLOGICAL ENDEAVOURS
Safety is only ensured by keeping the equipment within the DESIGN CONDITION
and the DESIGN CONFIGURATION
The “Safe Operating Envelope”
All of the MANAGEMENT SYSTEMS must connect to this goal
(For example, in aviation “Configuration” includes the aircraft operational state, environment, air traffic control etc. etc.)
And the required BEHAVIOURS must happen
Charles Packer 2008 13
SOCIETY
REGULATOR: REGULATIONS & LICENSING
APPROVED CONDITION & CONFIGURATION
OPERATING ORGANIZATIONS: SMS AND BEHAVIOURS
SAFETY ROLES
DESIGNERS
SAFETY ACTUAL CONDITION & CONFIGURATION
Charles Packer 2008 14
SAFETY CULTURE HISTORY
Charles Packer 2008 15
MAJOR NUCLEAR SAFETY EVENTS IN LAST DECADE
1. TOKAI MURA, JAPAN: Fuel Fabrication plant accident (Fatalities)
2. BNFL, ENGLAND: Falsification of fuel inspection records
3. DAMPIERRE, FRANCE: Labour relations threatened closure
4. DAVIS-BESSE, USA: Severe vessel head degradation
5. JAPAN: “Modified” inspection records (17 units shutdown)
6. PAKS, HUNGARY: Severe damage to 30 PWR fuel assemblies: Contractors cleaning fuel in a special vessel
7. JAPAN: Cover up of an inadvertent criticality event: Contractors withdrew rods with the vessel open – close to super-critical
8. KOZLODUY, BULGARIA: Control rods failed to drop: replacement clutches became welded over time due to a design flaw. Then an identical event happened in China 10 months later.
Charles Packer 2008 16
OTHER SAFETY EVENTS
1. Challenger and Columbia Space Shuttle disasters
2. Rail crashes in the UK
3. Oil platform fires (Brazil and others)
4. BP Refinery (Texas)
a) All of these major accidents have their roots “deep in the organizational culture”
b) Most events have happened in developed countries.
c) The root causes appear to have been established many years before the event, yet went undetected
d) The root causes are hard to fix: (e.g. in the case of the space shuttle there appears to be overlaps of causes with the Challenger disaster of 1986)
Charles Packer 2008 17
WHAT IS A SAFETY CULTURE?
Charles Packer 2008 18
1. Safety Culture is “THE WAY WE DO THINGS AROUND HERE”
2. A healthy Safety Culture ensures that the STRUCTURE and FOCUS OF SAFETY are achieved.
3. Safety Culture is anchored in ASSUMPTIONS (Beliefs, Perceptions)
SAFETY CULTURE
Charles Packer 2008 19
SOME RULES OF CULTURE
1. The culture is the set of patterns of behaviour that go on in the organization: “the way we do things around here”
2. Cultures are not good or bad, but they ARE good or bad at achieving certain outcomes
3. There is always a safety culture in your organization. But is it what you want?
4. Cultures are founded on assumptions (beliefs) about “reality” (usually unconsciously held)
5. The members of a culture are most comfortable when they conform to the patterns of shared behaviour. I.e. a culture represents the lowest level of anxiety for its members
6. Changing a culture requires behaviour change that will always cause anxiety and will always be resisted
7. Behaviour change coupled with good communications (2-way) will eventually establish new norms, new beliefs, and low anxiety. (Need to stay the course)
Charles Packer 2008 20
CULTURAL ASSUMPTIONS
Charles Packer 2008 21
“The plant is robust, it has some margin”
Initial training is focused on the design and how good it is
There is no mention of human performance & errors are tolerated
Often, when there is a problem the engineers recalculate the margins
When Chernobyl happens we say “It can’t happen here. The plants are robust.”
We criticize the regulator for being over-conservative. We resist structure and rigour. We think we know best
ASSUMPTIONS: How do they form?
Charles Packer 2008 22
ASSUMPTIONS: What do they do?
“The plant is robust, it has some margin”
Lack of a sense of urgency about improving plant condition
Don’t complete all planned work in outages
Make occasional non-conservative operating decisions
Treat a lot of situations as “Special Cases” and don’t always follow procedures
Don’t report some apparently “minor” observations
Charles Packer 2008 23
EVENT
“LAST-CHANCE” Barrier
LEARNING Barrier
PEOPLE Barrier
PHYSICAL Barrier
HAZARD
“The plant is robust, it has some margin”
Make non-conservative decisions or don’t follow procedures
Don’t report minor problems or unusual observations
Don’t follow all the procedures
Lack of a sense of urgency about fixing defective equipment
Charles Packer 2008 24
ALL BARRIERS ARE DEFEATED BY A SINGLE CAUSE (ASSUMPTION)
1. The assumption is held unconsciously
2. The assumption grows from experiencing what actually happens in the organization
3. Almost all members of the organization will therefore share the same assumption
4. Therefore no-one recognizes it or challenges it
The vulnerability will remain unless there is SIGNIFICANT PRESSURE FOR CHANGE through regulation, leadership, learning from others, recruiting outsiders, etc.
Charles Packer 2008 25
BEHAVIOURS
Charles Packer 2008 26
BEHAVIOURS
1. The safety culture is created out of OBSERVABLE BEHAVIOURS
2. Our behaviours are critical to keep us safe in any current situation
3. BUT they also matter more significantly in the long term…because they establish the patterns and the belief systems that ultimately determine our vulnerability to major events.
4. We need to be consistent in our behaviours and not to vary them based on our immediate perceptions of risk. I.e. managers must focus on establishing PATTERNS of behaviour
We all create the safety culture, by what we do, and by what we do not do
Every day
Charles Packer 2008 27
SAFETY CULTURE FRAMEWORK
SAFETY PRINCIPLES (Beliefs & Assumptions)
ORGANIZATIONAL LEARNING
LEADERSHIP BEHAVIOURS
SYSTEMATIC APPROACH
SHARED BEHAVIOURS
PHYSICAL CONDITIONS
Charles Packer 2008 28
SYMPTOMS OF A WEAKENING SAFETY CULTURE
1. A sense of invulnerability based on past performance
2. Assumptions that the equipment and/or the people are “robust”: that there is a significant margin of safety
3. Lack of pressure to change and improve: stagnation and complacency
4. Pushback on new ideas: “we don’t need that here”
5. Responding to accidents elsewhere by looking for “why it won’t happen here”
6. A collective (shared) perception of what “the real safety threat is”, and what the solution is; blindness to other ways that serious accidents could happen
7. Expecting safety to be the responsibility of the safety experts
8. Treating the regulator as a nuisance
9. Excessive occasions when operations are justified by “time at risk” arguments
10. Managers who are not intrusive into operational detail and not demanding of high standards