NAVIGATING SAFETY Necessary compromises and trade off René Amalberti

Transcription

1 NAVIGATING SAFETY Necessary compromises and trade off René Amalberti 2017-ATC Malmö

2 Risk in human activities Professional Fishing Cardiac Surgery Patient ASA 3-5 Fatal Iatrogenic adverse events Medical risk (total) Road Safety (France) Road Safety (UK) Blood transfusion Chartered Flight Civil Aviation Hymalaya mountaineering Microlight spreading activity Professional fishing Traders in the global marketplace Drilling Mining Construction industry Off shore Railways (Europe) Oil industry (total) Nuclear Industry Chemical Industry (total) No system beyond this point Very unsafe Unsafe Safe Ultra safe Fatal risk 2017-ATC Malmö 2

3 A first example Professional deep-sea fishing as practiced by 20 to 24-meter trawlers (vessels usually manned by five fishermen, for fishing tours of four to fourteen days) meters Studying the fishing skippers decision-making process by placing them in situations of conflict between Crevettierproduction and safety. Information : weather report, failures, damage to the fishing gear, occupational accidents, information on previous fishing tour, fax from colleagues on quantity of catch, selling price of prawn auction prices, localisation of colleagues, fixed expenses,... Ta What are the priorities considered by captains for making decision on continuing fishing Vs giving up in extreme fishing conditions? Morel, Chauvin, Safety Science 2007 Morel, Amalberti, Chauvin, Human Factors 2008 Morel, Amalberti, Chauvin, Safety Science, ATC Malmö 3

4 Same example.. continue Professional deep-sea fishing as practiced by 20 to 24-meter trawlers (vessels usually manned by five fishermen, for fishing tours of four to fourteen days) meters Crevettier Are fishermen insensitive to safety aspects? Ta NO of course they hope getting safer They ask for better tools for traffic collision avoidance (with cargos), and safer bridge working conditions for sailors (on trawlers) Morel, Amalberti, Chauvin, Human Factors 2008 Morel, Amalberti, Chauvin, Safety Science, ATC Malmö 4

5 Another example Civil aviation 1994, A310: YR-LCA, Tarom A310, lost control during final approach on Paris Orly airport. Flight 381 was approaching to Paris-Orly runway 26 and the captain was at the controls. He decided to perform an automatic approach and landing. Before lining up with the runway, the aircraft adopted an unusual position due to a crew s wrong comprehension of an order given to the autopilot. Recovery came two long minutes after the plane entered into quasi-loopings. 1995, A310 : Tarom flight ROT 371 took off from Bucharest-Otopeni runway 08R for a flight to Brussels. The crew was distracted and forgot monitoring aircraft attitude. The plane banked progressively, and when the crew realized the problem, they were unable to recover, 60 fatalities. What Que do you fait think l aviation the international civile en Authorities réponse? have decided afterwards? Amalberti, Piloter Navigating la sécurité, Safety, Springer, 2013 Springer ATC Malmö 5

6 A third model HRO High-Reliability Organisations Fire fighting Group Intelligence Give priority on team work, leadership and adaptation to unexpected conditions Lessons drawn from accident analyses are primarily about ways in which the situation has been managed and could be managed better in future. (Recovery rather than Prevention) Five characteristics of High Reliability Organizations responsible for the "mindfulness" that keeps them working well when facing unexpected situations. Preoccupation with failure Reluctance to simplify interpretations Sensitivity to operations Commitment to resilience Deference to expertise 2017-ATC Malmö 6

7 Three models of safety Avoiding risk: ultra ruled Risk is excluded as far as possible Procedures & supervisory systems Priority given to prevention: stop the system if all conditions are not met Strong regulatory control Training focused on rigorous procedures and management of workload Improvisation is prohibited 2017-ATC Malmö 7

8 Managing risk: ruled adaptive model Risk in not sought out but is inherent in the profession Much anticipation but a need for real time detection and adaptation Group intelligence and adaptation Mutual protection and control of team members. Training and safety focused on adaptability and flexibility of procedures 2017-ATC Malmö 8

9 Towards High reliability organizations Concern with failure: vulnerability awareness, actively searching for bad news Reluctance to simplify interpretations: distrust evidence, foster a diversity of viewpoints Sensitivity to operations: presence in the field, use of field expertise Commitment to resilience: develop professional skills; foster transverse interactions Deference to expertise: whatever the professional level, consult those who know best 2017-ATC Malmö 9

10 Embracing risk: ultra-adaptive Taking risks is the essence of the profession Working conditions are unstable and sometimes unforeseeable Cult of champions and heroes Success analysis more important than accident analysis Training is acquisition of expertise, understanding own limitations 2017-ATC Malmö 10

11 ULTRA ADAPTIVE & RESILIENT Embracing risk Context : Taking risks is the essence of the profession. Cultural trait: Fighter spirit, cult of champions and heroes Safety model : Power to experts Give me best chances and safest tools to survive in these adverse conditions and make exploits Success analysis more important than accident analysis Safety training: Experts talk to juniors, acquisition of expertise, understanding own limitations Hymalaya mountaineering Innovative medicine (grafts, oncology ) ICU Trauma centers Combat A/C, war time Medical risk (total) Finance-stock market Three Contrasted Safety models HRO model Managing risk Context : Risk is not sought out, but it is inherent in the profession. Cult of group intelligence and adaptation to changing situations. Safety model : Power to the group, Organization, roles, and procedures Mutual protection team members. Suspicion of simple explanations Priority to Recovery and mitigation Safety training: Training in teamwork Training and safety focused on adaptability and flexibility of procedures Scheduled surgery Chronic care Fire Fighting Drilling Industry Food Industry Chartered Flight Processing Industry ULTRA SAFE Excluding risk Context : Risk is excluded as far as possible. Cult of applying procedures and safety organized by an effective supervisory organization. Safety model : Power to the regulators of the system to avoid exposing front-line actors to unnecessary risks. Priority to prevention Safety Training in teamwork to apply procedures and apportion the work even if abnormal events occur. Training only inside the tube : training limited to what the Radiotherapy, organization considers the need for expected operations. Biology Anesthesiology Blood No improvisation ASA1 transfusion permitted. Civil Aviation Railways No system beyond this point Professional fishing Chemical Industry (total) Nuclear Industry ATC 10-4 Malmö Very unsafe Unsafe Safe Ultra safe Fatal risk 11

12 Take away BUT: One size cannot fit all No universal safety model. Each model entails strengths and limits. There is a continuous impulse to become safer The relevant safety model depends on the business model Within each «world», a potential of improvement of 1 to 10, but the maximum achievable level depends on the «world». Several models can coexist in an industrial group. Shifting from one world to another is not possible for one company taken separately: it would not stand competition. A whole industrial sector has to be involved ATC Malmö 12

13 Group discussion 1 What is your view for ATC? From your perspective, do you still need Exceptional Experts who are known to take freedom with rules to reach exceptional performance and solve rare situations? Give one example if relevant 5 minutes 2017-ATC Malmö

14 FOUR STEPS FOR EXECUTIVE MANAGEMENT OF SAFETY 2017-ATC Malmö 14

15 STEP 1 RISK MAPPING SETTING THE BARRIERS 2017-ATC Malmö 15

16 A system approach of safety LATENT ERRORS PATENT ERRORS IN-DEPTH DEFENSES ADVRSE EVENT Exemples Orgnization and design Work pressure Working conditions Fatigue Staff shortage The REASON s Swiss Cheese model, ATC Malmö 16

17 Risk Mapping and Risk analysis a great deal of methods Preliminary hazard analysis (PHA) Failure mode and effect analysis (FMEA) failure mode effect and criticality analysis (FMECA) Hazard and operability study (HAZOP) Hazard analysis and critical control point (HACCP) probabilistic risk assessment (PRA) 2017-ATC Malmö 17

18 Mitigation Recovery Prevention 2017-ATC Malmö 18

19 STEP 2 FACING THE REALITY GAP 2017-ATC Malmö 19

20 VERY UNSAFE SPACE System Migration to Boundaries INDIVIDUAL BENEFITS Illegal normal Real life standards Safety regs & good practices Certification/ accreditation standards Never never Illegal Illegal Space Never Sometimes ACCIDENT BTCUs Usual Space of Action Always sometimes Expected safe space of action as defined by professional standards Always always Market demand Technology Individual concerns Time on duty, Life quality,... PERFORMANCE 2017-ATC Malmö 20

21 Group discussion 1 What is your view for ATC? From your perspective, do you still need Exceptional Experts who are known to take freedom with rules to reach exceptional performance and solve rare situations? Give one example if relevant 5 minutes 2017-ATC Malmö

22 STEP 3 MANAGING INTERFACES WITH A SYSTEM AND ORGANIZATIONAL PERSPECTIVE 2017-ATC Malmö 22

23 Five system barriers to achieving ultra safe industry Amalberti,, Ann Intern Med. 2005;142, 9: No limit in performance Increasing safety margins Excessive autonomy of actors Becoming team player Cardiac Surgery Patient ASA 3-5 Hymalaya mountaineering Microlight or helicopters spreading activity Craftsman s attitude Fatal Iatrogenic adverse events Medical risk (total) Road Safety Chartered Flight Chemical Industry (total) Accepting to become equivalent actors Ego-centered safety protections, vertical conflicts Loss of visibility of risk, froozing actions Blood transfusion Anesthesiology ASA1 Civil Aviation Railways (France) Accepting to endorse residual risk at the executive level Nuclear Industry Accepting to question the success and change strategies No system beyond this point Very unsafe Fatal risk Ultra safe 2017-ATC Malmö 23

24 STEP 4 WHEN EVERYTHING HAS BEEN WELL DONE What about your resilience? 2017-ATC Malmö 24

25 Understanding resilience Resilience S t = S i +S m S t (Safety total) = S r (Safety imposed)+ S g ( Safety managed) Observed Safety NORMS / QUALITY + Error avoidance BBS/CBS/HRA Based on Technology Regulations Constraints RESILIENCE Surprises management Based on Human expertise Adaptive learning systems Amalberti, R. : Ashgate, 2006: Amalberti R., Springer ATC Malmö 25

26 Paradoxes of Resilience Significant safety improvements always detrimental to Sm Craftman industry S t = S i + S m Safety improvement Ultrasafe systems S t = S i + S m The next challenge : Preverving S m while Improving S i S t = S i + S m 2017-ATC Malmö 26

27 Part 2 Problems and promises of resilience: why safety needs to rethink its love/hate relationship with adaptation 2017-ATC Malmö 27

28 In my opinion Resilience is The Art to perceive, identify and face short, middle and long term threats escaping routinized solutions, The Art to expand knowledge and experience, exploring new avenues for a better future routinizing in turn the lessons learnt (progressive extension of the normal space of action) 2017-ATC Malmö 28

29 In my opinion Resilience is not (1/2) A new cognitive mechanism for adaptation to surprises and to the unknown: 50 years of literature in Cognitive psychology, no need for a new concept A new System adaptation to failures: 50 years of literature on normal and abnormal procedures to face system failures: i.e ECAM EICAS in Aviation 2017-ATC Malmö 29

30 In my opinion Resilience is not (2/2) A solution to risk reduction : resilience creates significant potential additional risks to cope with actual risk, seeking for something better than routinized solutions. Non standard solutions are necessarily at greater risk, although the result may be terrific Safety only: individuals and company may die for multiple reasons, e.i: finances, sales, production, social climate, and accidents. Resilience is a potential answer to all perceived crisis, not only to safety threats ATC Malmö 30

31 The result of resilience is multidimensional Self confidence, satisfaction, performance, safety Hence the judgement of benefits is always multidimensional, rarely positive on all dimensions, anymore than on near and long-term horizons For safety specifics, the benefits are more rarely immediate, but can be significant on the long term horizon (new knowledge, enhanced robustness) 2017-ATC Malmö 31

32 Risk of accident Begginners Experts Window of safe practice Novices Experts Amalberti, Navigating Safety, Springer, ATC Malmö 32

33 Accident rate Apprenants Accident rate Accident rate Novices Experts Greatest experts novvices Novices Learning process novvices Window of safe profesionalism Novices Experts Time 2017-ATC Malmö Novices Experts 33

34 Some remarkable examples of Resilience NASA Faster, Better, Cheaper: Policy, Strategic Planning, and Human Resource Alignment Managing interruptions while driving Chemotherapy Vs Radiotherapy 2017-ATC Malmö 34

35 Example: The problem with interruptions while driving A nostalgic blink to Erik s Safety Two Full agreement on the conclusion that distractions are causing numerous accidents Less agreement on the role and potential contribution of some distractors to road safety Less agreement on the solutions to suggest at national level «There is often a tendency in the field of safety, and in particular road safety, to seek to locate the origin of problems with the system user, considering that traffic accidents are the result of recklessness, incompetence and drivers' lack of skills (Gusfield, 2009), rather than seeking more profound causes» IFFSTAR ATC Malmö 35

36 VIEWING THE PROBLEM ANOTHER WAY Let s consider a provocative thought We live in a connected society We approach the problem with many biases How many interruptions while driving? We study pros and cons of using Mobiles and Keying info while driving in separate conferences, and separate scientific communities The ideal model: No distraction while driving?? Cognitive deprivation?? But what could be the effect of cognitive deprivation on cognition and safety? Risk control?? 2017-ATC Malmö

37 Why safety needs to rethink its love/hate relationship with adaptation (1/2) Industrial safety demo gives priority to short term requirements and performance. Optimum result should be demonstrated here and now Formal demonstration of short term safety requirement based on Certification processes Respect of procedures, Precedence, stability Past experience and known solutions Strong reluctance to change How should be done? Consequential for public reassurance 2017-ATC Malmö 37

38 Why safety needs to rethink its love/hate relationship with adaptation (2/2) Low research priority : studying human and system adaptation to problems: Hundred millions still existing Resilience exists for millennium and is recurrently acknowledged by exception to the standard But only the rare winners are welcome. The frequent looser reinforce the need for the actual formal system High research priority: how to incorporate resilience into industrial safety codes how to incorporate into normal safety prevention and evaluation How proving added value for standard system certification and public reassurance The answer could be no way, no additional gain 2017-ATC Malmö 38

39 Group discussion 2 Four steps for executive management of safety Step 1 Step 2 Step 3 Step 4 Risk mapping: Facing the reality Managing interfaces When everything Setting the barriers: Risk mapping and risks analysis gap: Deviances in safe systems System Migration to Boundaries with a system and organizational perspective Five system barriers to achieving ultra safe industry has been well done what about your resilience? S t = S i +S m Arbitration From your perspective, What is your balance today and how do you assess Safety Imposed vs Safety Managed? 2017-ATC Malmö 39

40 Free from download /cuidado-de-saúde-maisseguro-estratégias-parao-cotidiano-do-cuidado ATC Malmö 40