the organisational and cultural precursors to … or… · • heathrow natm tunnel collapse (uk,...

THE ORGANISATIONAL AND CULTURAL PRECURSORS

TO MAJOR EVENTS – REDUCING VULNERABILITY

Prof. Richard (Dick) Taylor

organisational and cultural precursors to events

• The twelve events studied

• Heathrow NATM tunnel collapse (UK, October, 1994)

• Hatfield railway accident (UK, October, 2000)

• Port of Ramsgate walkway collapse (UK, September, 1994)

• Longford gas plant explosion (Australia, September, 1998)

• Tokaimura criticality accident (Japan, September, 1999)

• Davis Besse RPV corrosion event (USA, February, 2002)

• Columbia Shuttle loss (USA, February, 2003)

• Texas City refinery explosion (USA, March, 2005)

• Paks fuel cleaning event (Hungary, April, 2003)

• THORP loss of containment event (UK, April, 2005)

• Buncefield Fuel Storage Explosion (UK, December 2005)

• Loss of Nimrod XV230 Aircraft (Afghanistan, September 2006)

Studies were based on published investigation reports


Davis Besse - Some of the organisational and cultural

precursors identified

• Insufficient management attention and questioning of

actual state of plant

• Did not use available learning

• Lack of rigour underpinned by a mindset that the plant

was acceptable (failure of risk assessment)

• Strained resources and possible production pressures

• Procedural compliance issues

• Symptoms addressed but not root causes

• Employee concerns not always addressed


Paks – Some of the organisational and cultural


• ‘Turned- over work to a contractor

• Failures in risk assessment and use of conservative

decision making

• Aggressive schedule to complete project

• Weaknesses in communication internally and with

contractor

• Inadequate oversight and underestimation of the safety

significance

• Weaknesses in training

• Inadequacies in procedures


THORP – some of the organisational and cultural


• Safety culture issues – procedural non-compliance,

failures in conservative decision making, lack of

questioning/challenge and mindset that the plant could not

fail

• Shortcomings in management oversight

• Failures in maintaining competence

• Weaknesses in communication e.g. between shifts

• Lack of clarity in roles and responsibilities

• Weaknesses in control and supervision

• Failures to learn from previous events

• Possible priority for production


Tokaimura – some of the organisational precursors

identified

• Inadequate oversight of process and procedures

• Major weaknesses in employee training and competence

• Weaknesses in safety review and risk assessment with

failure to maintain an adequate safety margin

• Safety culture inadequacies including a reliance on

administrative controls, failures to take account of human

error/actions and deviations from operating procedures

and review of them.

• Probable production pressures and issue of an ‘orphan

plant’

• Breakdown in management control of operations – issues

relating to leadership and importance of maintaining

nuclear safety standards


• CONCLUSION FROM EVENT ANALYSIS

1. Different technical causes/failures;

2. Different types of plant;

3. Different in context (e.g. short-term projects, operational

issues with long-term neglect/complacency)

4. Similar precursors/contributing organisational and cultural

factors.

‘Collective’ analysis of events may provide a broader, more

comprehensive picture of ‘precursors’

Will now look in greater detail at some of the key issues:


• KEY ISSUES

-Leadership;

-Operational attitudes and

behaviours (culture);

-Business environment;

-Competence;

-Risk assessment and

management;

Analysis of the findings from the 12 events studied have

been grouped under the following areas:

-Oversight and scrutiny;

-Organisational learning;

-Use of contractors;

-Communication; and

-Lessons for external

regulation.


• LEADERSHIP (I)

Did not demonstrate a real commitment that

nuclear/process safety a core value;

Values and ‘cultural’ norms not effectively 'lived' and

communicated – including questioning attitude, need for

sharing, learning and constructive challenge;

Leaders not always ‘in touch with reality’ – not ‘visible’ and

questioning – often obtained ‘filtered good news’;

Insufficient understanding to assess and manage key risks

and make process safety related decisions;

This is a key issue relevant to events. Leaders often did not

communicate expectations and lead by example.


• LEADERSHIP (II)

Lack of understanding about need to be ‘controlling mind’

(for example with contractors);

Failure to ensure an effective safety management system

which is understood and seen as relevant by users;

Accountabilities not clear – sometimes too complex;

Did not ensure an integrated and informed process to

provide scrutiny - including relevant KPIs;

Not an effective, layered communication process –

encouraging feedback and constructive challenge;

Did not consider impact of commercial pressures, need for

clear priorities, adequate resources and impact of change.


• OPERATIONAL ATTITUDES AND BEHAVIOURS (I)

Effective procedures not in place – ‘workarounds’ and

violations accepted (casual compliance);

Operators did not understand why procedures were

important to the risks being controlled;

Capability and presence of first line supervisors not always

a priority;

Individuals and teams (including contractors) not strongly

involved in improvement activities – commitment lost;

In many of the events, people no longer felt able or willing to

challenge poor practices - an atmosphere of complacency

with little ‘trust’ had developed over time.


• OPERATIONAL ATTITUDES AND BEHAVIOURS (II)

Insufficient encouragement of a questioning attitude – risks

‘normalised’;

Conservative decision making not visibly supported by

management;

Strong internal communication not the norm (e.g. at shift

change, between ‘ops’ and ‘engineering’, and with

contractors);

Lack of challenge by individuals and teams of poor

standards (e.g. equipment, procedures, working

environment);

Insufficient understanding and capability to deal with

abnormal events.


• BUSINESS ENVIRONMENT (I)

Insufficient understanding and challenge of potential impact

by policy makers, business leaders and managers;

Impact on safety of cost cutting and resource changes not

always thought through;

Poor management of consequent organisational change

(including incremental changes) and work patterns;

Commercial pressures and/or external pressures had been

allowed to impact nuclear/process safety – the 'balance' had

sometimes shifted too far towards production.


• BUSINESS ENVIRONMENT (II)

Overburdening of operators with (well-intentioned)

initiatives – need for priorities;

Insufficient understanding of potential impacts of

acquisitions and outsourcing;

Effect of ‘Perverse’ incentives not always considered;


• COMPETENCE

Gradual erosion of competence/loss of corporate memory;

Leaders and managers had insufficient understanding of

nuclear/process safety risks;

Competence/capability not regularly and systematically

reviewed – sometimes a ‘tick box’ approach based on IT;

Insufficient understanding/competence to deal with

abnormal conditions;

People-related, cultural and organisational issues not

getting sufficient attention in training and coaching.

Loss of competence at various organisational levels was a

precursor to nearly all of the events studied.


• RISK ASSESSMENT AND MANAGEMENT (I)

Overarching, systematic process to identify nuclear safety

risks not in place (‘no clear view of the radar screen');

In many cases important risks had been ‘normalised’ – a

‘drift’ into acceptance of risks – 'the gambler's dilemma'!;

Failure to respond to warning signs (alertness to weak

signals) and to prioritise effective responses;

Insufficient recognition of dangers of ‘organisational drift’

and of ‘orphan’ plant and processes.

Nuclear/process safety risks were usually not being given

sufficient attention. Often successful industrial safety risk

management gave false confidence.


• RISK ASSESSMENT AND MANAGEMENT (II)

Because of a lack of awareness and action at all levels,

specific issues (symptoms of the deeper cultural issues)

often became the norm and were accepted. For example:

- lack of clarity about the safety boundary;

- degraded safety cases;

- plant condition/maintenance backlogs;

- alarms and abnormal conditions;

- areas of vulnerability not addressed (e.g. from Hazops);

- important audit and review findings not acted upon.


• OVERSIGHT AND SCRUTINY (I)

Lack of a systematic, hierarchical process with sufficient

independence and checks on reality;

‘Good news culture’ not challenged. Complacency

developed from previous success (organisational drift);

Integration of information from audits/reviews,

investigations and suitable indicators failed to alert

decision makers to the real situation – issues ‘rolled up’ or

not questioned so that vulnerable areas not identified;

Often did not act as an effective ‘last line of defence’.

Opportunities to identify decline/loss of focus because of

poor systems, lack of information and failure to question.


• OVERSIGHT AND SCRUTINY (II)

Internal ‘regulators’ (e.g. safety departments) often lacked

resources and ‘teeth’;

'Arms length' approach to external regulators;

Audits failed to go beyond paper systems or look at

underlying deeper issues;

'Floods' of findings – so priorities and key issues not clear;

Those providing top-level scrutiny did not have sufficient

expertise to judge the importance of emerging issues and

integrate these into other business decision making.


• ORGANISATIONAL LEARNING (I)

Reporting and follow-up systems were deficient (lack of

trust, blame culture etc);

Failures to investigate previous events (precursors) and/

or to address real root causes;

Learning from previous events (internal or external) had

been ‘lost’ (corporate memory) or ineffectively

communicated and acted upon/followed up – need for

'frequently rocked boat';

Most events could have been avoided if learning

opportunities had been acted upon – failures to learn

recurrent.


• ORGANISATIONAL LEARNING (II)

The workforce were not aware of potential impact of poor

practices/failed equipment etc;

A ‘narrow’ view taken of learning opportunities (too easily

dismissed as ‘not relevant to us’);

Involvement in learning and improvement through team-

and self- reviews was not encouraged (peer review);

In many cases, organisational barriers (silos) inhibited

mutual learning.


• USE OF CONTRACTORS

Licensees/duty holders were no longer ‘the controlling

mind’ and often did not understand their role;

Contracting organisations lost competence to provide

control and oversight – lack of project focus/control;

Poor communication, lack of incentives and/or unclear

accountabilities led to a lack of awareness/action on

emerging issues;

Nuclear/process safety issues not always a prime

consideration in contractual arrangements.

Four of the events studied directly involved a failure to retain

control and/or effectively manage contractors.


• ASSESSING VULNERABILITY

Findings from the collective analysis have been developed

into expectations/objectives for ‘good performance’;

These have now been further developed into probing

questions to help regulators and operators assess

vulnerability;

Could be used in individual areas (e.g. leadership) or

collectively to assess overall picture;

This might also be useful in ensuring that the issues presented

here are properly looked at in investigations;

New tools and techniques are now being developed:


• MODELLING

In addition to ‘expectations’ and questions – work is

proceeding on developing a tool based on hierarchical

process modelling (HPM) – akin to a conventional engineering

fault tree to identify vulnerabilities systematically;

System dynamics modelling is also being used to understand

some of the complex (systems) issues involved so that

interactions can be better understood and better

understanding obtained of the effect of changes and

improvements.


• HIERARCHICAL MODELLING


• SYSTEM DYNAMICS MODELLING


• Summary

• Twelve events were studied to try to extract the

organisational and cultural ‘precursors’;

• They covered a wide range of technologies and

industries;

• Involved ‘projects’ and normal operation.

• Key areas identified as common to many of the

events – and many of the specific issues were similar.

• We are planning to work with industry and others to

raise awareness of the issues, and to develop

‘vulnerability assessment and remediation tools’.

the organisational and cultural precursors to … or… · • heathrow natm tunnel collapse (uk,...

Documents