Safety Culture Informed, Just and Fair

April 2006 ICAO Seminar Baku

Safety CultureInformed, Just and

FairPatrick Hudson

ICAO/Leiden University


StructureStructure

• How safe is aviation?• Safety culture• The elements of a safety culture• The need for a Just Culture• Why it is complicated?• What if it goes wrong?• Conclusion


How Safe is Aviation?How Safe is Aviation?

• Hull losses are low, we are worrying about the effect of increased exposure at current levels of flight safety

• But is the aviation industry safe or is it just safe for passengers?


Lost Workday Incidents per 100 Employees in US

Fre

qu

ency

Rat

e

9

8

7

6

5

4

3

2

1

0DuPont Chem

IndustryAircraft& Parts

Mining ConstructionLogging SteelFoundry

TransbyAir

0.03

1.1

5.3

8.4

Industry Average (2.1)

5.5

3.6

2.9

1.6

Aviation isn’t that safeAviation isn’t that safeUS data — 1997US data — 1997

Courtesy DuPont


It doesn’t get better It doesn’t get better - 2001- 2001

* U.S. Bureau of Labor Statistics, 2001 Data

4.74.95.25.3

9.7

32.62.31.90.30

24681012

DuPontChemicalsMiningRepair ServicesPulp & Paper

Transportation Equip.Primary Metal IndustriesFood & Kindred Prod.Lumber & Wood ProductsTransportation by Air

IndustryAverage (2.6)

Lost Workday Cases per 100 Employees*


Safety CultureSafety CultureThe Added IngredientThe Added Ingredient

• Safety Management Systems provide a systematic approach to safety

• Minimum standards can be defined but this is not the best way to obtain the extra benefits

• A good safety culture fills in the gaps• “Sound systems, practices and procedures are not adequate if merely practised mechanically. They require an effective safety culture to flourish.”

• So you need Safety Management Systems AND a Safety Culture


PATHOLOGICAL

REACTIVE

CALCULATIVE

PROACTIVE

GENERATIVE

Safety Culture Safety Culture indicators indicators

chronic uneasesafety seen as a profit centrenew ideas are welcomed

we are serious, but why don’t they do what they’re told?endless discussions to re-classify accidentsSafety is high on the agenda after an accident

the lawyers said it was OKof course we have accidents, it’s a dangerous businesssack the idiot who had the accident

resources are available to fix things before an accidentmanagement is open but still obsessed with statisticsprocedures are “owned” by the workforce

we cracked it!lots and lots of auditsHSE advisers chasing statistics


PATHOLOGICALwho cares as long as we’re not

caught

REACTIVESafety is important, we do a lot every time we have an accident

CALCULATIVEwe have systems in place to

manage all hazards

PROACTIVEwe work on the problems that

we still find

GENERATIVEsafety is how we do business

round here

Increasing Trust &

Accountability

The Evolution of The Evolution of Safety CultureSafety Culture

Increasing

Informedness


Characteristics of a Characteristics of a Safety CultureSafety Culture

• Informed - managers know what is really going on

• Reporting - the workforce is willing to report their own errors and near misses

• Just - a ‘no blame’ culture, with a clear line between the acceptable and unacceptable

• Wary - ready for the unexpected• Flexible - operates according to need• Learning - willing to adapt and implement necessary reforms


How to create a Safety How to create a Safety CultureCulture

• Depends on where you are starting from - unfortunately you can’t get to the end in one go, all the steps have to be traversed

• Becoming a Safety Culture involves – acquiring a set of safety management skills– and then maintaining them

• The two major factors are informedness and trust, and these have to be developed over time

• Be systematic (Safety Management Systems are a start) and then learn to operate with the unknown as well


Developing a Safety Developing a Safety Culture:Culture:

Informed and LearningInformed and Learning• Agree on ways to analyse incidents to reveal both individual and system issues

• Develop reporting systems that are easy to use (compact, open-ended, impersonal)

• Encourage the workforce (air and ground) to realise that incidents are worth reporting

• Practice management in wanting to know from near misses before they become accidents


A Reporting CultureA Reporting Culture• In order to get the information we need, we need to be told

• This often requires people to admit their own errors - this is personally difficult at best

• The workforce will not tell what they have done if they are afraid of the consequences

• Pathological and Reactive cultures “shoot the messenger”

• Generative organisations train messengers!


Developing a Safety Developing a Safety Culture:Culture:

JustJust1. Get rid of the idea that blame is a

useful concept (this is hard to do)2. Define clear lines between the

acceptable and the unacceptable3. Have those involved draw up the

guidelines, do not impose from above if you want them to be accepted

4. Have clear procedures about what to do with other forms of non-compliance


Why is Blame so easy?Why is Blame so easy?


Human Error - The Human Error - The ProblemProblem

• If an accident happens people want to blame someone– Insurance - who pays?– Criminal responsibility - who goes to prison?

• Technical failures are usually seen as less reprehensible

• This often applies even with near misses


BlameBlame

• Blame is something that is attached to individuals– What about objects?– What about non-human entities?

• Blame is associated with causality

• People attribute cause to other people

• Bad people have bad accidents


AttributionAttribution

• Fundamental Attribution Error– Individuals attribute causes of their own actions to external causes

– They attribute causes of the actions of others to personal factors in those individuals

• There is a belief that The World is Just– This leads to the idea of accident proneness

• Bad things happen to bad people– Also called Outcome bias


Hindsight BiasHindsight Bias• Hindsight Bias (Fischhoff, 1975)• One knew it all along• Known branches are over-estimated

– We now know the outcome, we didn’t before– The scenario now seems easy to generate and therefore was easy before the event

• In advance, bad outcomes are evaluated as less likely, especially if you feel you can control matters

• If you knew the best options, and could have controlled for them, then selecting any other must be incompetent!


The Illusion of Free The Illusion of Free willwill

• People believe they have free will– They can always choose what they will do– They can foresee the consequences of their actions and act accordingly

• They attribute this to others– They commit the fundamental attribution error

– Hindsight bias makes the choices seem less and more obvious than at the time

• They regard human failures as more avoidable than technical failures


The Law - ProsecutionThe Law - Prosecution

• Prosecutors are tasked with finding one or more individuals to prosecute

• Prosecutors will only proceed if there is a reasonable chance of success– The closer to the event the harder the evidence

– The further from the event, the more doubt can be introduced about alternative causes

• Any amount of specific evidence may be sufficient in a criminal case


Corporate ManslaughterCorporate Manslaughter

• Targeting company bosses is the new approach• Based on a duty of care concept - bosses have a duty to ensure safety

• Lord Denning defined the Guiding Mind principle

• This has proved hard to obtain prosecutions• The principle of Executive Authority makes it easier to prosecute (When the executive says jump, subordinates ask how high, not vice-versa)


Who is convinced?Who is convinced?

• Prosecutors• Police• Investigators • Judges• Juries (in jury systems)• Colleagues• The accused themselves


Thinking about a Just Thinking about a Just CultureCulture

• The need to have rules and procedures• The standard approach to non-compliance• Marx’ and Reason’s Just Culture• A new approach - Hearts and Minds

– Types of violation - Managing Rule Breaking– Roles of those involved - Managers to Workers

– Individuals - the reasons for non-compliance– Solutions - from praise to punishment

• From Just Culture to Fair Culture


The need for rulesThe need for rules• Many hazards cannot be controlled by hardware or design

• Other hazards are more easily controlled by administrative approaches

• There are three levels of specification– Guidelines– Descriptions and sequences– Work instructions

• Failure to follow procedures temporarily negates the control of the management system– The assumption is that all the rules will be followed


The Simple View -The Simple View -How to manage non-How to manage non-

compliancecompliance• Rules and procedures are there for a purpose

• Personnel are expected to know them and are clearly expected to comply with all relevant procedures

• Failures to comply represent a deliberate failure of an individual’s performance contract

• Such failures cannot be tolerated, because the HSE-MS relies upon compliance

• Non-compliance is best managed by making people aware of the personal consequences, from written warnings to dismissal


Review of the Simple Review of the Simple ViewView

• There is an assumption that all rules and procedures are optimal and not in need of improvement– The US Nuclear INPO studies found that 60% of procedural problems were due to incorrect procedures

• The requirement is for unquestioning compliance by a worker– The INPO studies found that most people did follow procedures, even when they were incorrect

• A weaker version of such requirements may require challenge– This is often based upon following the incorrect rule or procedure first, with subsequent challenge


The Just Culture - The Just Culture - Version 1Version 1

• Originated by David Marx - a Boeing engineer and also a lawyer

• Propagated by Prof James Reason• Starts with assumption of deliberate violation (e.g. sabotage) by individuals (Marx found about 10%)

• Next employs the substitution test (would others have done the same?) to check for individual vs system blame

• If there is no evidence that an individual was reckless and there is no history of previous non-compliance, then define non-compliance as blame-free


Review of Just Culture Review of Just Culture v.1v.1

• The model appears to assume individual guilt unless proven otherwise

• The drawing, going from left to right, implies visually where priorities lie. The amount of space devoted to discipline does the same

• There are only two points where management is required to remedy system problems identified, after the event. Most are concerned with distinguishing whether a worker should have more discipline or just be actively coached until they comply


The Just Culture - The Just Culture - Version 2Version 2• Empirical studies of non-compliance showed a

complex picture• 6 different types of violation• Managers and supervisors have a role as well as the violating worker

• Individuals will be working with a variety of intentions, from the company’s interest to their personal gain

• Solutions range from improving the system to ensuring compliance


Example DAL 39Example DAL 39

• An example of what happens today in Western Europe

• Criminal prosecution of three air traffic controllers

• All 3 found guilty of a misdemeanor at Court of Appeal

• No punishment because of the system failures, but no prosecution of management


DAL 39DAL 39• A Delta 767 aborted take-off at Amsterdam Schiphol on discovering a 747 being towed across the runway

• Reduced visibility conditions (Phase - B)

• The tower controller was in training, under the tower supervisor

• There was another trainee and of the 11 people in the tower five were changing out to rest

• The incident happened between the inbound and outbound morning peaks


Runway Incursion Runway Incursion (1998)(1998)

http://www.airliners.net/open.file?id=406653&WxsIERv=Qm9laW5nIDc0Ny00MDZN&WdsYXMg=S0xNIEFzaWE%3D&QtODMg=QW1zdGVyZGFtIC0gU2NoaXBob2wgKEFNUyAvIEVIQU0p&ERDLTkt=TmV0aGVybGFuZHM%3D&ktODMp=QXVndXN0IDE2LCAyMDAz&BP=1&WNEb25u=S2FyLWxvayBXb25n&xsIERvdWdsY=UEgtQkZN&MgTUQ

http://www.airliners.net/open.file?id=447067&WxsIERv=Qm9laW5nIDc2Ny0yMzI%3D&WdsYXMg=RGVsdGEgQWlyIExpbmVz&QtODMg=TWlhbWkgLSBJbnRlcm5hdGlvbmFsIChNSUEgLyBLTUlBKQ%3D%3D&ERDLTkt=VVNBIC0gRmxvcmlkYQ%3D%3D&ktODMp=T2N0b2JlciAyMSwgMjAwMw%3D%3D&BP=1&WNEb25u=UnlhbiBLYXNrZ


The DAL 39 event The DAL 39 event scenarioscenario

Airport decides to change

airport structure

Tunnel brought into use without briefings

Tower combining training and operations

during difficult periods

Pilots see 747and abort take-off

Controller gives clearance without assurance of tow

position

Routine violation of tow

procedures


Why did all this Why did all this happen - 1?happen - 1?

• Tow was in violation, but this appears to be routine

• No clear protocols for ground vehicles and no hazard analysis

• Different language for aircraft (English) and ground vehicles (Dutch)

• Poor quality of ground radio• Clearances appeared to be unlimited once given• Tower supervisor was also OTJ trainer in the middle of the rush hour

• Altered control box not introduced to ATC staff


Why did all this Why did all this happen - 2?happen - 2?

• No briefings about alterations at Schiphol (It has been a building site for years)

• Too many trainees in the tower in rush hour under low visibility conditions

• Differences in definition of low visibility between aerodrome and ATC

• No management apparent of the change in use of the S-Apron

• No operational audits by LVNL or Schiphol, of practice as opposed to paper

• Schiphol designed requiring crossing and the use of multiple runways for noise abatement reasons


Could this have been Could this have been known in advance?known in advance?

• Many problems are known in advance• If no one tells they will certainly happen again

• If people fear prosecution and other consequences of admitting their errors, will they tell?

• Without reporting, we are doomed to wait until we have an accident that everyone can see


Learning from Errors Learning from Errors requires Trustrequires Trust

Trust

StatisticsIncidentReports

NationalLegislation Analysis

Lessonslearned

Safetyimprovements

Internationaloversight


What happens when What happens when prosecution takes prosecution takes

place?place?• After the DAL-39 case, ATCOs reduced the number of reports about ATC errors

• They continued to report pilot errors

• They were no longer being prosecuted


Number of incidents reported as ATC errors

0

5

10

15

20

25

30

35

40

45

50

2000 2001 2002 2003 2004

Year


What next?What next?• It became clear that a new approach was needed

• The old model was even found to be the cause of a major accident!

• All types of errors and violations need to be considered

• Positive reporting should be rewarded• There are still actions that everyone agrees are unacceptable (Reckless, personal)


Shell’s new modelShell’s new model

• Shell decided that the concept of the Just Culture needed to be extended

• To cover rewards for good behaviours• To reflect the differences in types of violations and errors

• To highlight the responsibilities of both individuals who break the rules and their managers who condone or do not want to know


Decision FlowchartDecision Flowchart


ConsequencesConsequences

• All actions now have consequences

• These apply both to the individual and their managers

• Distinguishing different types of violation is essential

• Everyone has to agree to the process and the consequences


ConclusionConclusion

• Safety cultures make the difference between a mechanical application of SMS and full implementation that obtains the maximum benefits

• A Just and Fair Culture is essential for reporting

• Without reporting no one knows what is going on, until it is too late

Safety Culture Informed, Just and Fair

Documents

Transcript of Safety Culture Informed, Just and Fair