Safety Culture
Informed, Just and Fair
Patrick Hudson
ICAO/Leiden University
April 2006
ICAO Seminar Baku
Structure
•
•
•
•
•
•
•
How safe is aviation?
Safety culture
The elements of a safety culture
The need for a Just Culture
Why it is complicated?
What if it goes wrong?
Conclusion
April 2006
ICAO Seminar Baku
April 2006
ICAO Seminar Baku
How Safe is Aviation?
• Hull losses are low, we are worrying about
the effect of increased exposure at current
levels of flight safety
• But is the aviation industry safe or is it just
safe for passengers?
April 2006
ICAO Seminar Baku
Aviation isn’t that safe
US data — 1997
Lost Workday Incidents per 100 Employees in US
9
8.4
Frequency Rate
8
7
6
5.3
5.5
5
3.6
4
3
Industry Average (2.1)
2
1.1
1
0
2.9
1.6
0.03
DuPont
Chem
Industry
Aircraft
& Parts
Mining ConstructionLogging
Courtesy DuPont
April 2006
ICAO Seminar Baku
Steel
Foundry
Trans
by
Air
It doesn’t get better - 2001
April 2006
ICAO Seminar Baku
Safety Culture
The Added Ingredient
• Safety Management Systems provide a systematic
approach to safety
• Minimum standards can be defined but this is not the best
way to obtain the extra benefits
• A good safety culture fills in the gaps
• “Sound systems, practices and procedures are not
adequate if merely practised mechanically. They require
an effective safety culture to flourish.”
• So you need Safety Management Systems AND a Safety
Culture
April 2006
ICAO Seminar Baku
Safety Culture indicators
GENERATIVE
chronic unease
safety seen as a profit centre
new ideas are welcomed
PROACTIVE
resources are available to fix things before an accident
management is open but still obsessed with statistics
procedures are “owned” by the workforce
CALCULATIVE
REACTIVE
PATHOLOGICAL
April 2006
we cracked it!
lots and lots of audits
HSE advisers chasing statistics
we are serious, but why don’t they do what they’re told?
endless discussions to re-classify accidents
Safety is high on the agenda after an accident
the lawyers said it was OK
of course we have accidents, it’s a dangerous business
sack the idiot who had the accident
ICAO Seminar Baku
The Evolution of Safety Culture
GENERATIVE
Increasing
Informedness
safety is how we do business
round here
PROACTIVE
we work on the problems that
we still find
CALCULATIVE
we have systems in place to
manage all hazards
REACTIVE
Safety is important, we do a lot
every time we have an accident
PATHOLOGICAL
who cares as long as we’re not
caught
April 2006
ICAO Seminar Baku
Increasing
Trust &
Accountability
April 2006
ICAO Seminar Baku
Characteristics of a Safety Culture
• Informed - managers know what is really going on
• Reporting - the workforce is willing to report their
own errors and near misses
• Just - a ‘no blame’ culture, with a clear line between
the acceptable and unacceptable
• Wary - ready for the unexpected
• Flexible - operates according to need
• Learning - willing to adapt and implement necessary
reforms
April 2006
ICAO Seminar Baku
How to create a Safety Culture
• Depends on where you are starting from unfortunately you can’t get to the end in one go, all the
steps have to be traversed
• Becoming a Safety Culture involves
– acquiring a set of safety management skills
– and then maintaining them
• The two major factors are informedness and trust, and
these have to be developed over time
• Be systematic (Safety Management Systems are a start)
and then learn to operate with the unknown as well
April 2006
ICAO Seminar Baku
Developing a Safety Culture:
Informed and Learning
• Agree on ways to analyse incidents to reveal both
individual and system issues
• Develop reporting systems that are easy to use
(compact, open-ended, impersonal)
• Encourage the workforce (air and ground) to realise
that incidents are worth reporting
• Practice management in wanting to know from near
misses before they become accidents
April 2006
ICAO Seminar Baku
A Reporting Culture
• In order to get the information we need, we need
to be told
• This often requires people to admit their own
errors - this is personally difficult at best
• The workforce will not tell what they have done if
they are afraid of the consequences
• Pathological and Reactive cultures “shoot the
messenger”
• Generative organisations train messengers!
April 2006
ICAO Seminar Baku
Developing a Safety Culture:
Just
1. Get rid of the idea that blame is a useful concept (this
is hard to do)
2. Define clear lines between the acceptable and the
unacceptable
3. Have those involved draw up the guidelines, do not
impose from above if you want them to be accepted
4. Have clear procedures about what to do with other
forms of non-compliance
April 2006
ICAO Seminar Baku
Why is Blame so easy?
April 2006
ICAO Seminar Baku
Human Error - The Problem
• If an accident happens people want to blame
someone
– Insurance - who pays?
– Criminal responsibility - who goes to prison?
• Technical failures are usually seen as less
reprehensible
• This often applies even with near misses
April 2006
ICAO Seminar Baku
Blame
• Blame is something that is attached to
individuals
– What about objects?
– What about non-human entities?
• Blame is associated with causality
• People attribute cause to other people
• Bad people have bad accidents
April 2006
ICAO Seminar Baku
Attribution
• Fundamental Attribution Error
– Individuals attribute causes of their own actions to
external causes
– They attribute causes of the actions of others to
personal factors in those individuals
• There is a belief that The World is Just
– This leads to the idea of accident proneness
• Bad things happen to bad people
– Also called Outcome bias
April 2006
ICAO Seminar Baku
Hindsight Bias
• Hindsight Bias (Fischhoff, 1975)
• One knew it all along
• Known branches are over-estimated
– We now know the outcome, we didn’t before
– The scenario now seems easy to generate and
therefore was easy before the event
• In advance, bad outcomes are evaluated as less likely,
especially if you feel you can control matters
• If you knew the best options, and could have controlled
for them, then selecting any other must be incompetent!
April 2006
ICAO Seminar Baku
The Illusion of Free will
• People believe they have free will
– They can always choose what they will do
– They can foresee the consequences of their actions and
act accordingly
• They attribute this to others
– They commit the fundamental attribution error
– Hindsight bias makes the choices seem less and more
obvious than at the time
• They regard human failures as more avoidable
than technical failures
April 2006
ICAO Seminar Baku
The Law - Prosecution
• Prosecutors are tasked with finding one or more
individuals to prosecute
• Prosecutors will only proceed if there is a
reasonable chance of success
– The closer to the event the harder the evidence
– The further from the event, the more doubt can
be introduced about alternative causes
• Any amount of specific evidence may be sufficient
in a criminal case
April 2006
ICAO Seminar Baku
Corporate Manslaughter
• Targeting company bosses is the new approach
• Based on a duty of care concept - bosses have a
duty to ensure safety
• Lord Denning defined the Guiding Mind principle
• This has proved hard to obtain prosecutions
• The principle of Executive Authority makes it
easier to prosecute (When the executive says
jump, subordinates ask how high, not vice-versa)
April 2006
ICAO Seminar Baku
Who is convinced?
•
•
•
•
•
•
•
Prosecutors
Police
Investigators
Judges
Juries (in jury systems)
Colleagues
The accused themselves
April 2006
ICAO Seminar Baku
Thinking about a Just Culture
•
•
•
•
The need to have rules and procedures
The standard approach to non-compliance
Marx’ and Reason’s Just Culture
A new approach - Hearts and Minds
–
–
–
–
Types of violation - Managing Rule Breaking
Roles of those involved - Managers to Workers
Individuals - the reasons for non-compliance
Solutions - from praise to punishment
• From Just Culture to Fair Culture
April 2006
ICAO Seminar Baku
The need for rules
• Many hazards cannot be controlled by hardware or design
• Other hazards are more easily controlled by administrative
approaches
• There are three levels of specification
– Guidelines
– Descriptions and sequences
– Work instructions
• Failure to follow procedures temporarily negates the
control of the management system
– The assumption is that all the rules will be followed
April 2006
ICAO Seminar Baku
The Simple View How to manage non-compliance
• Rules and procedures are there for a purpose
• Personnel are expected to know them and are clearly
expected to comply with all relevant procedures
• Failures to comply represent a deliberate failure of an
individual’s performance contract
• Such failures cannot be tolerated, because the HSE-MS
relies upon compliance
• Non-compliance is best managed by making people aware
of the personal consequences, from written warnings to
dismissal
April 2006
ICAO Seminar Baku
Review of the Simple View
• There is an assumption that all rules and procedures are optimal
and not in need of improvement
– The US Nuclear INPO studies found that 60% of procedural problems
were due to incorrect procedures
• The requirement is for unquestioning compliance by a worker
– The INPO studies found that most people did follow procedures, even
when they were incorrect
• A weaker version of such requirements may require challenge
– This is often based upon following the incorrect rule or procedure first,
with subsequent challenge
April 2006
ICAO Seminar Baku
The Just Culture - Version 1
• Originated by David Marx - a Boeing engineer and also a lawyer
• Propagated by Prof James Reason
• Starts with assumption of deliberate violation (e.g. sabotage) by
individuals (Marx found about 10%)
• Next employs the substitution test (would others have done the
same?) to check for individual vs system blame
• If there is no evidence that an individual was reckless and there is
no history of previous non-compliance, then define noncompliance as blame-free
April 2006
ICAO Seminar Baku
April 2006
ICAO Seminar Baku
Review of Just Culture v.1
• The model appears to assume individual guilt unless
proven otherwise
• The drawing, going from left to right, implies visually
where priorities lie. The amount of space devoted to
discipline does the same
• There are only two points where management is required
to remedy system problems identified, after the event.
Most are concerned with distinguishing whether a worker
should have more discipline or just be actively coached
until they comply
April 2006
ICAO Seminar Baku
The Just Culture - Version 2
• Empirical studies of non-compliance showed a complex
picture
• 6 different types of violation
• Managers and supervisors have a role as well as the
violating worker
• Individuals will be working with a variety of intentions,
from the company’s interest to their personal gain
• Solutions range from improving the system to ensuring
compliance
April 2006
ICAO Seminar Baku
Example DAL 39
• An example of what happens today in
Western Europe
• Criminal prosecution of three air traffic
controllers
• All 3 found guilty of a misdemeanor at
Court of Appeal
• No punishment because of the system
failures, but no prosecution of management
April 2006
ICAO Seminar Baku
DAL 39
• A Delta 767 aborted take-off at Amsterdam
Schiphol on discovering a 747 being towed across
the runway
• Reduced visibility conditions (Phase - B)
• The tower controller was in training, under the
tower supervisor
• There was another trainee and of the 11 people in
the tower five were changing out to rest
• The incident happened between the inbound and
outbound morning peaks
April 2006
ICAO Seminar Baku
Runway Incursion (1998)
April 2006
ICAO Seminar Baku
The DAL 39 event scenario
Pilots see 747
and abort Routine violation
of tow
take-off
procedures
Tunnel brought into use
without briefings
Airport decides
to change
airport structure
Controller gives clearance Tower combining training
and operations
without assurance of
tow
April 2006
ICAO
Seminar Baku
during difficult periods
position
Why did all this happen - 1?
• Tow was in violation, but this appears to be routine
• No clear protocols for ground vehicles and no hazard analysis
• Different language for aircraft (English) and ground vehicles
(Dutch)
• Poor quality of ground radio
• Clearances appeared to be unlimited once given
• Tower supervisor was also OTJ trainer in the middle of the
rush hour
• Altered control box not introduced to ATC staff
April 2006
ICAO Seminar Baku
Why did all this happen - 2?
• No briefings about alterations at Schiphol (It has been a
building site for years)
• Too many trainees in the tower in rush hour under low
visibility conditions
• Differences in definition of low visibility between aerodrome
and ATC
• No management apparent of the change in use of the S-Apron
• No operational audits by LVNL or Schiphol, of practice as
opposed to paper
• Schiphol designed requiring crossing and the use of multiple
runways for noise abatement reasons
April 2006
ICAO Seminar Baku
Could this have been known in
advance?
• Many problems are known in advance
• If no one tells they will certainly happen again
• If people fear prosecution and other consequences
of admitting their errors, will they tell?
• Without reporting, we are doomed to wait until we
have an accident that everyone can see
April 2006
ICAO Seminar Baku
Learning from Errors requires Trust
International
oversight
National
Legislation
Safety
improvements
Analysis
Statistics
Lessons
learned
Incident
Reports
Trust
April 2006
ICAO Seminar Baku
What happens when prosecution
takes place?
• After the DAL-39 case, ATCOs reduced the
number of reports about ATC errors
• They continued to report pilot errors
• They were no longer being prosecuted
April 2006
ICAO Seminar Baku
April 2006
ICAO Seminar Baku
What next?
• It became clear that a new approach was needed
• The old model was even found to be the cause of a
major accident!
• All types of errors and violations need to be
considered
• Positive reporting should be rewarded
• There are still actions that everyone agrees are
unacceptable (Reckless, personal)
April 2006
ICAO Seminar Baku
Shell’s new model
• Shell decided that the concept of the Just Culture
needed to be extended
• To cover rewards for good behaviours
• To reflect the differences in types of violations and
errors
• To highlight the responsibilities of both
individuals who break the rules and their
managers who condone or do not want to know
April 2006
ICAO Seminar Baku
April 2006
ICAO Seminar Baku
Decision Flowchart
April 2006
ICAO Seminar Baku
Consequences
• All actions now have consequences
• These apply both to the individual and their
managers
• Distinguishing different types of violation is
essential
• Everyone has to agree to the process and the
consequences
April 2006
ICAO Seminar Baku
April 2006
ICAO Seminar Baku
Conclusion
• Safety cultures make the difference between
a mechanical application of SMS and full
implementation that obtains the maximum
benefits
• A Just and Fair Culture is essential for
reporting
• Without reporting no one knows what is
going on, until it is too late
April 2006
ICAO Seminar Baku