1. Safety Culture Informed, Just and Fair
Patrick Hudson
ICAO/Leiden University
April 2006
ICAO Seminar Baku

2. Structure How safe is aviation? Safety culture
The elements of a safety culture
The need for a Just Culture
Why it is complicated?
What if it goes wrong?
Conclusion
April 2006
ICAO Seminar Baku

3. April 2006 ICAO Seminar Baku
This slide is intended to show that there are various ways of improving safety performance and that tackling technology and standards and safety systems usually comes first, but in order to continuously improve the softer behavioural stuff must be tackled too. This is what constitutes Culture, which addresses the ‘softer’ human issues, but also multiplies the effectiveness of the technology and management systems.
April 2006
ICAO Seminar Baku

4. How Safe is Aviation?
Hull losses are low, we are worrying about the effect of increased exposure at current levels of flight safety
But is the aviation industry safe or is it just safe for passengers?
April 2006
ICAO Seminar Baku

5. Aviation isn’t that safe US data — 1997
Lost Workday Incidents per 100 Employees in US 9 8 7 6 5 4 3 2 1
DuPont
Chem
Industry
Aircraft
& Parts
Mining
Construction
Logging
Steel
Foundry
Trans by
Air
0.03
1.1
5.3
8.4
Industry Average (2.1)
5.5
3.6
2.9
1.6
Frequency Rate
Shell LTIF = 0.7/m = 0.14 OSHA
Courtesy DuPont
April 2006
ICAO Seminar Baku

6. It doesn’t get better
April 2006
ICAO Seminar Baku

7. Safety Culture The Added Ingredient
Safety Management Systems provide a systematic approach to safety
Minimum standards can be defined but this is not the best way to obtain the extra benefits
A good safety culture fills in the gaps
“Sound systems, practices and procedures are not adequate if merely practised mechanically. They require an effective safety culture to flourish.”
So you need Safety Management Systems AND a Safety Culture
April 2006
ICAO Seminar Baku

8. Safety Culture indicators
chronic unease
safety seen as a profit centre
new ideas are welcomed
GENERATIVE
resources are available to fix things before an accident
management is open but still obsessed with statistics
procedures are “owned” by the workforce
PROACTIVE
we cracked it!
lots and lots of audits
HSE advisers chasing statistics
CALCULATIVE
we are serious, but why don’t they do what they’re told?
endless discussions to re-classify accidents
Safety is high on the agenda after an accident
REACTIVE
Safety Culture Ladder
well researched definitions
calibrated questions on laminated cards to assess status
can be used at all levels in the organisations
can be used to identify differences (perceptions) at various levels in the organisation
can be used to identify differences between parts of the organisation
can be used to assess progress over time: where were we, where are we, where do we want to be
Starting point for putting HSE improvement on the map.
Do tests (see last slide for meaning of background colours)
If you want to reach a higher level it is also necessary to assess the readiness to change.
PATHOLOGICAL
the lawyers said it was OK
of course we have accidents, it’s a dangerous business
sack the idiot who had the accident
April 2006
ICAO Seminar Baku

9. The Evolution of Safety Culture
GENERATIVE
safety is how we do business round here
Increasing Informedness
PROACTIVE
we work on the problems that we still find
CALCULATIVE
we have systems in place to manage all hazards
REACTIVE
Safety is important, we do a lot every time we have an accident
Increasing Trust & Accountability
PATHOLOGICAL
who cares as long as we’re not caught
April 2006
ICAO Seminar Baku

10. April 2006
ICAO Seminar Baku

11. Characteristics of a Safety Culture
Informed - managers know what is really going on
Reporting - the workforce is willing to report their own errors and near misses
Just - a ‘no blame’ culture, with a clear line between the acceptable and unacceptable
Wary - ready for the unexpected
Flexible - operates according to need
Learning - willing to adapt and implement necessary reforms
April 2006
ICAO Seminar Baku

12. How to create a Safety Culture
Depends on where you are starting from - unfortunately you can’t get to the end in one go, all the steps have to be traversed
Becoming a Safety Culture involves
acquiring a set of safety management skills
and then maintaining them
The two major factors are informedness and trust, and these have to be developed over time
Be systematic (Safety Management Systems are a start) and then learn to operate with the unknown as well
April 2006
ICAO Seminar Baku

13. Developing a Safety Culture: Informed and Learning
Agree on ways to analyse incidents to reveal both individual and system issues
Develop reporting systems that are easy to use (compact, open-ended, impersonal)
Encourage the workforce (air and ground) to realise that incidents are worth reporting
Practice management in wanting to know from near misses before they become accidents
April 2006
ICAO Seminar Baku

14. A Reporting Culture
In order to get the information we need, we need to be told
This often requires people to admit their own errors - this is personally difficult at best
The workforce will not tell what they have done if they are afraid of the consequences
Pathological and Reactive cultures “shoot the messenger”
Generative organisations train messengers!
April 2006
ICAO Seminar Baku

15. Developing a Safety Culture: Just
Get rid of the idea that blame is a useful concept (this is hard to do)
Define clear lines between the acceptable and the unacceptable
Have those involved draw up the guidelines, do not impose from above if you want them to be accepted
Have clear procedures about what to do with other forms of non-compliance
April 2006
ICAO Seminar Baku

16. Why is Blame so easy?
April 2006
ICAO Seminar Baku

17. Human Error - The Problem
If an accident happens people want to blame someone
Insurance - who pays?
Criminal responsibility - who goes to prison?
Technical failures are usually seen as less reprehensible
This often applies even with near misses
April 2006
ICAO Seminar Baku

18. Blame Blame is something that is attached to individuals
What about objects?
What about non-human entities?
Blame is associated with causality
People attribute cause to other people
Bad people have bad accidents
April 2006
ICAO Seminar Baku

19. Attribution Fundamental Attribution Error
Individuals attribute causes of their own actions to external causes
They attribute causes of the actions of others to personal factors in those individuals
There is a belief that The World is Just
This leads to the idea of accident proneness
Bad things happen to bad people
Also called Outcome bias
April 2006
ICAO Seminar Baku

20. Hindsight Bias Hindsight Bias (Fischhoff, 1975) One knew it all along
Known branches are over-estimated
We now know the outcome, we didn’t before
The scenario now seems easy to generate and therefore was easy before the event
In advance, bad outcomes are evaluated as less likely, especially if you feel you can control matters
If you knew the best options, and could have controlled for them, then selecting any other must be incompetent!
April 2006
ICAO Seminar Baku

21. The Illusion of Free will
People believe they have free will
They can always choose what they will do
They can foresee the consequences of their actions and act accordingly
They attribute this to others
They commit the fundamental attribution error
Hindsight bias makes the choices seem less and more obvious than at the time
They regard human failures as more avoidable than technical failures
April 2006
ICAO Seminar Baku

22. The Law - Prosecution
Prosecutors are tasked with finding one or more individuals to prosecute
Prosecutors will only proceed if there is a reasonable chance of success
The closer to the event the harder the evidence
The further from the event, the more doubt can be introduced about alternative causes
Any amount of specific evidence may be sufficient in a criminal case
April 2006
ICAO Seminar Baku

23. Corporate Manslaughter
Targeting company bosses is the new approach
Based on a duty of care concept - bosses have a duty to ensure safety
Lord Denning defined the Guiding Mind principle
This has proved hard to obtain prosecutions
The principle of Executive Authority makes it easier to prosecute (When the executive says jump, subordinates ask how high, not vice-versa)
April 2006
ICAO Seminar Baku

24. Who is convinced? Prosecutors Police Investigators Judges
Juries (in jury systems)
Colleagues
The accused themselves
April 2006
ICAO Seminar Baku

25. Thinking about a Just Culture
The need to have rules and procedures
The standard approach to non-compliance
Marx’ and Reason’s Just Culture
A new approach - Hearts and Minds
Types of violation - Managing Rule Breaking
Roles of those involved - Managers to Workers
Individuals - the reasons for non-compliance
Solutions - from praise to punishment
From Just Culture to Fair Culture
April 2006
ICAO Seminar Baku

26. The need for rules
Many hazards cannot be controlled by hardware or design
Other hazards are more easily controlled by administrative approaches
There are three levels of specification
Guidelines
Descriptions and sequences
Work instructions
Failure to follow procedures temporarily negates the control of the management system
The assumption is that all the rules will be followed
April 2006
ICAO Seminar Baku

27. The Simple View - How to manage non-compliance
Rules and procedures are there for a purpose
Personnel are expected to know them and are clearly expected to comply with all relevant procedures
Failures to comply represent a deliberate failure of an individual’s performance contract
Such failures cannot be tolerated, because the HSE-MS relies upon compliance
Non-compliance is best managed by making people aware of the personal consequences, from written warnings to dismissal
April 2006
ICAO Seminar Baku

28. Review of the Simple View
There is an assumption that all rules and procedures are optimal and not in need of improvement
The US Nuclear INPO studies found that 60% of procedural problems were due to incorrect procedures
The requirement is for unquestioning compliance by a worker
The INPO studies found that most people did follow procedures, even when they were incorrect
A weaker version of such requirements may require challenge
This is often based upon following the incorrect rule or procedure first, with subsequent challenge
April 2006
ICAO Seminar Baku

29. The Just Culture - Version 1
Originated by David Marx - a Boeing engineer and also a lawyer
Propagated by Prof James Reason
Starts with assumption of deliberate violation (e.g. sabotage) by individuals (Marx found about 10%)
Next employs the substitution test (would others have done the same?) to check for individual vs system blame
If there is no evidence that an individual was reckless and there is no history of previous non-compliance, then define non-compliance as blame-free
April 2006
ICAO Seminar Baku

30. April 2006
ICAO Seminar Baku

31. Review of Just Culture v.1
The model appears to assume individual guilt unless proven otherwise
The drawing, going from left to right, implies visually where priorities lie. The amount of space devoted to discipline does the same
There are only two points where management is required to remedy system problems identified, after the event. Most are concerned with distinguishing whether a worker should have more discipline or just be actively coached until they comply
April 2006
ICAO Seminar Baku

32. The Just Culture - Version 2
Empirical studies of non-compliance showed a complex picture
6 different types of violation
Managers and supervisors have a role as well as the violating worker
Individuals will be working with a variety of intentions, from the company’s interest to their personal gain
Solutions range from improving the system to ensuring compliance
April 2006
ICAO Seminar Baku

33. Example DAL 39 An example of what happens today in Western Europe
Criminal prosecution of three air traffic controllers
All 3 found guilty of a misdemeanor at Court of Appeal
No punishment because of the system failures, but no prosecution of management
April 2006
ICAO Seminar Baku

34. DAL 39
A Delta 767 aborted take-off at Amsterdam Schiphol on discovering a 747 being towed across the runway
Reduced visibility conditions (Phase - B)
The tower controller was in training, under the tower supervisor
There was another trainee and of the 11 people in the tower five were changing out to rest
The incident happened between the inbound and outbound morning peaks
April 2006
ICAO Seminar Baku

35. Runway Incursion (1998) April 2006 ICAO Seminar Baku
Beschrijving incident.
Lering: ZEER VEEL AANPASSINGEN:
Procedureel (O.A rol supervisor / coach scheiden)
Technisch (o.a. bedieningspaneel in de toren)
April 2006
ICAO Seminar Baku

36. The DAL 39 event scenario Pilots see 747 Tunnel brought into use
and abort
take-off
Tunnel brought into use
without briefings
Routine violation
of tow
procedures
Airport decides
to change
airport structure
Tower combining training
and operations
during difficult periods
Controller gives clearance without assurance of tow position
April 2006
ICAO Seminar Baku

37. Why did all this happen - 1?
Tow was in violation, but this appears to be routine
No clear protocols for ground vehicles and no hazard analysis
Different language for aircraft (English) and ground vehicles (Dutch)
Poor quality of ground radio
Clearances appeared to be unlimited once given
Tower supervisor was also OTJ trainer in the middle of the rush hour
Altered control box not introduced to ATC staff
April 2006
ICAO Seminar Baku

38. Why did all this happen - 2?
No briefings about alterations at Schiphol (It has been a building site for years)
Too many trainees in the tower in rush hour under low visibility conditions
Differences in definition of low visibility between aerodrome and ATC
No management apparent of the change in use of the S-Apron
No operational audits by LVNL or Schiphol, of practice as opposed to paper
Schiphol designed requiring crossing and the use of multiple runways for noise abatement reasons
April 2006
ICAO Seminar Baku

39. Could this have been known in advance?
Many problems are known in advance
If no one tells they will certainly happen again
If people fear prosecution and other consequences of admitting their errors, will they tell?
Without reporting, we are doomed to wait until we have an accident that everyone can see
April 2006
ICAO Seminar Baku

40. Learning from Errors requires Trust
International
oversight
Safety
improvements
National
Legislation
Analysis
Lessons
learned
Statistics
Incident
Reports
Trust
April 2006
ICAO Seminar Baku

41. What happens when prosecution takes place?
After the DAL-39 case, ATCOs reduced the number of reports about ATC errors
They continued to report pilot errors
They were no longer being prosecuted
April 2006
ICAO Seminar Baku

42. April 2006
ICAO Seminar Baku

43. What next? It became clear that a new approach was needed
The old model was even found to be the cause of a major accident!
All types of errors and violations need to be considered
Positive reporting should be rewarded
There are still actions that everyone agrees are unacceptable (Reckless, personal)
April 2006
ICAO Seminar Baku

44. Shell’s new model
Shell decided that the concept of the Just Culture needed to be extended
To cover rewards for good behaviours
To reflect the differences in types of violations and errors
To highlight the responsibilities of both individuals who break the rules and their managers who condone or do not want to know
April 2006
ICAO Seminar Baku

45. April 2006
ICAO Seminar Baku

46. Decision Flowchart
April 2006
ICAO Seminar Baku

47. Consequences All actions now have consequences
These apply both to the individual and their managers
Distinguishing different types of violation is essential
Everyone has to agree to the process and the consequences
April 2006
ICAO Seminar Baku

48. April 2006
ICAO Seminar Baku

49. Conclusion
Safety cultures make the difference between a mechanical application of SMS and full implementation that obtains the maximum benefits
A Just and Fair Culture is essential for reporting
Without reporting no one knows what is going on, until it is too late
April 2006
ICAO Seminar Baku