07 Safety Culture Informed Just and Fair

April 2006 ICAO Seminar Baku
Safety Culture
Informed, Just and Fair
Patrick Hudson
ICAO/Leiden University
Structure
How safe is aviation?
Safety culture
The elements of a safety culture
The need for a Just Culture
Why it is complicated?
What if it goes wrong?
Conclusion
How Safe is Aviation?
Hull losses are low, we are worrying about
the effect of increased exposure at current
levels of flight safety
But is the aviation industry safe or is it just
safe for passengers?
Lost Workday Incidents per 100 Employees in US
F
r
e
q
u
e
n
c
y

R
a
t
e

9
8
7
6
5
4
3
2
1
0
DuPont
Chem
Industry
Aircraft
& Parts
Mining Construction Logging Steel
Foundry
Trans
by
Air
0.03
1.1
5.3
8.4
Industry Average (2.1)
5.5
3.6
2.9
1.6
Aviation isnt that safe
US data 1997
Courtesy DuPont
It doesnt get better - 2001
Safety Culture
The Added Ingredient
Safety Management Systems provide a systematic
approach to safety
Minimum standards can be defined but this is not the best
way to obtain the extra benefits
A good safety culture fills in the gaps
Sound systems, practices and procedures are not
adequate if merely practised mechanically. They require
an effective safety culture to flourish.
So you need Safety Management Systems AND a Safety
Culture
PATHOLOGICAL
REACTIVE
CALCULATIVE
PROACTIVE
GENERATIVE
Safety Culture indicators
chronic unease
safety seen as a profit centre
new ideas are welcomed
we are serious, but why dont they do what theyre told?
endless discussions to re-classify accidents
Safety is high on the agenda after an accident
the lawyers said it was OK
of course we have accidents, its a dangerous business
sack the idiot who had the accident
resources are available to fix things before an accident
management is open but still obsessed with statistics
procedures are owned by the workforce
we cracked it!
lots and lots of audits
HSE advisers chasing statistics
PATHOLOGICAL
who cares as long as were not
caught
REACTIVE
Safety is important, we do a lot
every time we have an accident
CALCULATIVE
we have systems in place to
manage all hazards
PROACTIVE
we work on the problems that
we still find
GENERATIVE
safety is how we do business
round here
Increasing
Trust &
Accountability
The Evolution of Safety Culture
Increasing
Informedness
Characteristics of a Safety Culture
Informed - managers know what is really going on
Reporting - the workforce is willing to report their
own errors and near misses
Just - a no blame culture, with a clear line between
the acceptable and unacceptable
Wary - ready for the unexpected
Flexible - operates according to need
Learning - willing to adapt and implement necessary
reforms
How to create a Safety Culture
Depends on where you are starting from -
unfortunately you cant get to the end in one go, all the
steps have to be traversed
Becoming a Safety Culture involves
acquiring a set of safety management skills
and then maintaining them
The two major factors are informedness and trust, and
these have to be developed over time
Be systematic (Safety Management Systems are a start)
and then learn to operate with the unknown as well

Developing a Safety Culture:
Informed and Learning
Agree on ways to analyse incidents to reveal both
individual and system issues
Develop reporting systems that are easy to use
(compact, open-ended, impersonal)
Encourage the workforce (air and ground) to realise
that incidents are worth reporting
Practice management in wanting to know from near
misses before they become accidents
A Reporting Culture
In order to get the information we need, we need
to be told
This often requires people to admit their own
errors - this is personally difficult at best
The workforce will not tell what they have done if
they are afraid of the consequences
Pathological and Reactive cultures shoot the
messenger
Generative organisations train messengers!
Developing a Safety Culture:
Just
1. Get rid of the idea that blame is a useful concept (this
is hard to do)
2. Define clear lines between the acceptable and the
unacceptable
3. Have those involved draw up the guidelines, do not
impose from above if you want them to be accepted
4. Have clear procedures about what to do with other
forms of non-compliance
Why is Blame so easy?

Human Error - The Problem
If an accident happens people want to blame
someone
Insurance - who pays?
Criminal responsibility - who goes to prison?
Technical failures are usually seen as less
reprehensible
This often applies even with near misses
Blame
Blame is something that is attached to
individuals
What about objects?
What about non-human entities?
Blame is associated with causality
People attribute cause to other people
Bad people have bad accidents
Attribution
Fundamental Attribution Error
Individuals attribute causes of their own actions to
external causes
They attribute causes of the actions of others to
personal factors in those individuals
There is a belief that The World is Just
This leads to the idea of accident proneness
Bad things happen to bad people
Also called Outcome bias
Hindsight Bias
Hindsight Bias (Fischhoff, 1975)
One knew it all along
Known branches are over-estimated
We now know the outcome, we didnt before
The scenario now seems easy to generate and
therefore was easy before the event
In advance, bad outcomes are evaluated as less likely,
especially if you feel you can control matters
If you knew the best options, and could have controlled
for them, then selecting any other must be incompetent!
The Illusion of Free will
People believe they have free will
They can always choose what they will do
They can foresee the consequences of their actions and
act accordingly
They attribute this to others
They commit the fundamental attribution error
Hindsight bias makes the choices seem less and more
obvious than at the time
They regard human failures as more avoidable
than technical failures
The Law - Prosecution
Prosecutors are tasked with finding one or more
individuals to prosecute
Prosecutors will only proceed if there is a
reasonable chance of success
The closer to the event the harder the evidence
The further from the event, the more doubt can
be introduced about alternative causes
Any amount of specific evidence may be
sufficient in a criminal case
Corporate Manslaughter
Targeting company bosses is the new approach
Based on a duty of care concept - bosses have a
duty to ensure safety
Lord Denning defined the Guiding Mind principle
This has proved hard to obtain prosecutions
The principle of Executive Authority makes it
easier to prosecute (When the executive says
jump, subordinates ask how high, not vice-versa)
Who is convinced?
Prosecutors
Police
Investigators
Judges
Juries (in jury systems)
Colleagues
The accused themselves
Thinking about a Just Culture
The need to have rules and procedures
The standard approach to non-compliance
Marx and Reasons Just Culture
A new approach - Hearts and Minds
Types of violation - Managing Rule Breaking
Roles of those involved - Managers to Workers
Individuals - the reasons for non-compliance
Solutions - from praise to punishment
From Just Culture to Fair Culture
The need for rules
Many hazards cannot be controlled by hardware or design
Other hazards are more easily controlled by administrative
approaches
There are three levels of specification
Guidelines
Descriptions and sequences
Work instructions
Failure to follow procedures temporarily negates the
control of the management system
The assumption is that all the rules will be followed
The Simple View -
How to manage non-compliance
Rules and procedures are there for a purpose
Personnel are expected to know them and are clearly
expected to comply with all relevant procedures
Failures to comply represent a deliberate failure of an
individuals performance contract
Such failures cannot be tolerated, because the HSE-MS
relies upon compliance
Non-compliance is best managed by making people aware
of the personal consequences, from written warnings to
dismissal
Review of the Simple View
There is an assumption that all rules and procedures are optimal
and not in need of improvement
The US Nuclear INPO studies found that 60% of procedural problems
were due to incorrect procedures
The requirement is for unquestioning compliance by a worker
The INPO studies found that most people did follow procedures, even
when they were incorrect
A weaker version of such requirements may require challenge
This is often based upon following the incorrect rule or procedure first,
with subsequent challenge
The Just Culture - Version 1
Originated by David Marx - a Boeing engineer and also a lawyer
Propagated by Prof James Reason
Starts with assumption of deliberate violation (e.g. sabotage) by
individuals (Marx found about 10%)
Next employs the substitution test (would others have done the
same?) to check for individual vs system blame
If there is no evidence that an individual was reckless and there is
no history of previous non-compliance, then define non-
compliance as blame-free
Review of Just Culture v.1
The model appears to assume individual guilt unless
proven otherwise
The drawing, going from left to right, implies visually
where priorities lie. The amount of space devoted to
discipline does the same
There are only two points where management is required
to remedy system problems identified, after the event.
Most are concerned with distinguishing whether a worker
should have more discipline or just be actively coached
until they comply
The Just Culture - Version 2
Empirical studies of non-compliance showed a complex
picture
6 different types of violation
Managers and supervisors have a role as well as the
violating worker
Individuals will be working with a variety of intentions,
from the companys interest to their personal gain
Solutions range from improving the system to ensuring
compliance
Example DAL 39
An example of what happens today in
Western Europe
Criminal prosecution of three air traffic
controllers
All 3 found guilty of a misdemeanor at
Court of Appeal
No punishment because of the system
failures, but no prosecution of management
DAL 39
A Delta 767 aborted take-off at Amsterdam
Schiphol on discovering a 747 being towed across
the runway
Reduced visibility conditions (Phase - B)
The tower controller was in training, under the
tower supervisor
There was another trainee and of the 11 people in
the tower five were changing out to rest
The incident happened between the inbound and
outbound morning peaks

Runway Incursion (1998)
The DAL 39 event scenario
Airport decides
to change
airport structure
Tunnel brought into use
without briefings
Tower combining training
and operations
during difficult periods
Pilots see 747
and abort
take-off
Controller gives clearance
without assurance of tow
position
Routine violation
of tow
procedures
Why did all this happen - 1?
Tow was in violation, but this appears to be routine
No clear protocols for ground vehicles and no hazard analysis
Different language for aircraft (English) and ground vehicles
(Dutch)
Poor quality of ground radio
Clearances appeared to be unlimited once given
Tower supervisor was also OTJ trainer in the middle of the
rush hour
Altered control box not introduced to ATC staff
Why did all this happen - 2?
No briefings about alterations at Schiphol (It has been a
building site for years)
Too many trainees in the tower in rush hour under low
visibility conditions
Differences in definition of low visibility between aerodrome
and ATC
No management apparent of the change in use of the S-Apron
No operational audits by LVNL or Schiphol, of practice as
opposed to paper
Schiphol designed requiring crossing and the use of multiple
runways for noise abatement reasons

Could this have been known in
advance?
Many problems are known in advance
If no one tells they will certainly happen again
If people fear prosecution and other consequences
of admitting their errors, will they tell?
Without reporting, we are doomed to wait until we
have an accident that everyone can see

Learning from Errors requires
Trust
Trust
Statistics
Incident
Reports
National
Legislation
Analysis
Lessons
learned
Safety
improvements
International
oversight
What happens when prosecution
takes place?
After the DAL-39 case, ATCOs reduced the
number of reports about ATC errors
They continued to report pilot errors
They were no longer being prosecuted
What next?
It became clear that a new approach was needed
The old model was even found to be the cause of a
major accident!
All types of errors and violations need to be
considered
Positive reporting should be rewarded
There are still actions that everyone agrees are
unacceptable (Reckless, personal)
Shells new model
Shell decided that the concept of the Just Culture
needed to be extended
To cover rewards for good behaviours
To reflect the differences in types of violations
and errors
To highlight the responsibilities of both
individuals who break the rules and their
managers who condone or do not want to know
Decision Flowchart

Consequences
All actions now have consequences
These apply both to the individual and their
managers
Distinguishing different types of violation is
essential
Everyone has to agree to the process and the
consequences


Conclusion
Safety cultures make the difference between
a mechanical application of SMS and full
implementation that obtains the maximum
benefits
A Just and Fair Culture is essential for
reporting
Without reporting no one knows what is
going on, until it is too late

07 Safety Culture Informed Just and Fair

Загружено:

Сведения о документе

Исходное описание:

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

07 Safety Culture Informed Just and Fair

Загружено:

Авторское право:

Доступные форматы

April 2006 ICAO Seminar Baku

Вам также может понравиться