Resilience engineering Building a Culture of Resilience

Transcription

1 Resilience engineering Building a Culture of Resilience Erik Hollnagel Professor, University of Southern Denmark Chief Consultant Center for Quality, RSD (DK) hollnagel.erik@gmail.com

2 An insatiable need of explanations Accidents, incidents, breakdowns, disruptions, When something has happened, we try to find the cause. When the cause has been found, we try to eliminate it. Causes represent the dominant socio-technical characteristics of current society. Act Act of of god god Technical Technical failure failure Human Human factor factor Organisational Organisational failure failure Safety Safety culture(s) culture(s) But the understanding of how causes work has remained the same.

3 Simple, linear model (cause-effect chain) Simple linear models (cause-effect chains) If accidents are the culmination of a chain of events... then risks can be found as the probability of component failures Find the component that failed by reasoning backwards from the final consequence. Find the probability that something breaks, either alone or by simple, logical and fixed combinations.

4 Domino thinking everywhere

5 Combinatorial (complex) linear model Complex linear models If accidents happen as a combination of active failures and latent conditions... Look for how degraded barriers or defences combined with an active (human) failure. then risks are the likelihood of weakened defences in combination with active failures Combinations of single failures and latent conditions, leading to degradation of barriers and defences.

6 TRIPOD philosophy In TRIPOD, risks are associated with the failure of individual components, combined linearly. The TRIPOD structure is an oversimplified fault tree.

7 The causality credo (1) Adverse outcomes happen because something has gone wrong. (2)Adverse outcomes therefore have causes, which can be found and treated. (3) All accidents are preventable (zero harm principle). Accident investigation Find the component that failed by reasoning backwards from the final consequence. Accidents result from a combination of active failures (unsafe acts) and latent conditions (hazards). Risk analysis Find the probability that components break, either alone or in simple combinations. Look for combinations of failures and latent conditions that may constitute a risk.

8 Zero accidents: A company credo OUR PURPOSE To produce [X] safely, securely and profitably without harm to people or the environment. OUR BELIEFS and GUIDING PRINCIPLES 1.Safe production is our most important goal. 2.All injuries and environmental incidents are preventable. 3.Any task that can t be done safely without harm to the environment will not be done. 4.Each person is accountable for his or her own safety, the safety of their coworkers and protecting the environment. 5.Each person is expected to identify hazards and manage risks to people and the environment. 6.Each person must have the necessary skills to work safely and protect the environment. 7.Working safely with respect for people and the environment is a condition of employment.

9 Different process Function (work as imagined) different outcome Success (no adverse events) Acceptable outcomes Hypothesis of different causes: Things that go right and things that go wrong happen in different ways and have different causes Malfunction, non-compliance, error Failure (accidents, incidents) Unacceptable outcomes

10 Increasing safety by reducing failures Function (work as imagined) Success (no adverse events) Acceptable outcomes Identification and measurement of adverse events is central to safety. Malfunction, non-compliance, error Failure (accidents, incidents) Unacceptable outcomes Find-and-fix

11 Safety-I when nothing goes wrong Safety-I: Safety is the condition where the number of adverse outcomes (accidents / incidents / near misses) is as low as possible. Safety Safetyisisdefined definedby byits its opposite opposite by bythe thelack lackofofsafety safety (accidents, (accidents,incidents, incidents,risks). risks). We Wefocus focuson onthe theevents eventswhere where safety safetyisisabsent, absent,rather ratheron on those thosewhere wheresafety safetyisispresent. present. Safety-I requires the ability to prevent that something goes wrong. Safety-I is reactive, and assumes that safety can be achieved by first finding and then eliminating or weakening the causes of adverse events. Example: Root Cause Analysis (RCA).

12 Robustness according to Safety-I Negative outcomes are caused by failures and malfunctions. Things that go wrong, adverse outcomes Failures, malfunctions (Errors, violations) Safety = Reduced number of adverse events. Eliminate failures and malfunctions as far as possible. Find causes of failures eliminate, constrain Identify and Safety culture minimize risks (Robust organisation) Goal: Get away from a risky state

13 SMS according to Safety-I

14 Levels of safety culture (Westrum) Generative We are all involved in this together. Safety is part of our self image. Acceptance, responsibility We want you to get ahead of the game. Let us know when you have finished Delegate, specialise Calculative We calculate the odds based on what went wrong the last time Rational economic Reactive We are WORRIED about safety (but we don t do anything!) Management double-bind Who cares, as long as we are not caught (by the regulator), or have a serious accident? Laissez faire Proactive Pathological

15 Why only look at what goes wrong? Safety-I = Reduced number of adverse events := 1 failure in events Safety-II = Ability to succeed under varying conditions. Focus is on what goes wrong. Look for failures and malfunctions. Try to eliminate causes and improve barriers. Focus is on what goes right. Use that to understand everyday performance, to do better and to be safer. Safety and core business compete for resources. Learning only uses a fraction of the data available Safety and core business help each other. Learning uses most of the data available := nonfailures in events

16 Why only look at what goes wrong? Safety-I = Reduced number of adverse events := 1 failure in events Safety-II = Ability to succeed under varying conditions. Focus is on what goes wrong. Look for failures and malfunctions. Try to eliminate causes and improve barriers. Focus is on what goes right. Use that to understand everyday performance, to do better and to be safer. Safety and core business compete for resources. Learning only uses a fraction of the data available Safety and core business help each other. Learning uses most of the data available := nonfailures in events

17 Counting and understanding 1 How many events went wrong? What is the probability of failure? This is known (with some uncertainty) 7,000,000 Numerator 1 Denominator 20,000 How events went well? What is the probability of succeeding? This is usually disregarded and is mostly unknown Likelihood of being in a fatal accident on a commercial flight. Core Damage Frequency for a nuclear reactor (per reactor year). Likelihood of iatrogenic harm when admitted to a hospital. We count things that go wrong and try to understand them. But we do not count things that succeed, nor do we try to understand them

18 Why do things go right? Availability of resources (time, manpower, materials, information, etc.) may be limited and uncertain. People adjust what they do to match the situation. Performance variability is inevitable, ubiquitous, and necessary. Because of resource limitations, performance adjustments will always be approximate. Performance variability is the reason why everyday work is safe and effective. Performance variability is the reason why things sometimes go wrong.

19 Why do people vary in their work? AVOID anything that may have negative consequences for yourself, your group, or organisation COMPENSATE FOR MAINTAIN/CREATE Conditions that are necessary to do the work. Missing resources or conditions that make it difficult to do the work.

20 Same process different outcomes Function (work as imagined) Success (no adverse events) Acceptable outcomes Everyday work (performance variability) Malfunction, non-compliance, error Failure (accidents, Unacceptable outcomes incidents)

21 Increase safety by facilitating work Understanding the variability of everyday performance is the basis for safety. Function (work as imagined) Success (no adverse events) Acceptable outcomes Everyday work (performance variability) Malfunction, non-compliance, error Failure (accidents, Unacceptable outcomes incidents) Constraining performance variability to remove failures will also remove successful everyday work.

22 What should we be looking for? How likely or probable is this? When we notice something that has gone wrong In order to understand WHY this happened... How likely or probable is this? it is a safe bet that it has gone right many times before and that it will go right many times in the future. we need to understand HOW this happens!

23 Safety II when everything goes right Safety-II: Safety is a condition where the number of successful outcomes (meaning everyday work) is as high as possible. It is the ability to succeed under varying conditions. Safety-II is achieved by trying to make sure that things go right, rather than by preventing them from going wrong. Safety Safetyisisdefined definedby byits its presence. presence. Individuals and organisations must adjust everything they do to match the current conditions. Everyday performance must be variable in order for things to work. The Thefocus focusisison oneveryday everyday situations situationswhere wherethings thingsgo go right right as asthey theyshould. should. Acceptable outcomes Performance variability Unacceptable outcomes

24 From the negative to the positive Negative outcomes are caused by failures and malfunctions. All outcomes (positive and negative) are due to performance variability.. Safety = Reduced number of adverse events. Safety = Ability to respond when something fails. Safety = Ability to succeed under varying conditions. Eliminate failures and malfunctions as far as possible. Improve ability to respond to adverse events. Improve resilience.

25 Resilience and safety management Resilience is the intrinsic ability of a system to adjust its functioning prior to, during, or following changes and disturbances, so that it can sustain required operations under both expected and unexpected conditions. A practice of Resilience Engineering / Proactive Safety Management requires that all levels of the organisation are able to: Respond to actual (regular and irregular conditions) in an effective, flexible manner, Learn Learn from past events (factual), understand what happened and why Anticipate long-term threats and opportunities (potential) Respond Monitor Anticipate Monitor short-term developments and threats (critical); revise risk models

26 Four resilience abilities Knowing what to do, being capable of doing it. Imagining what to expect Respond Learn Knowing what has happened Monitor Anticipate Knowing what to look for (indicators)

27 Assessment of direct and indirect risks Direct risks Risks related to: products; processes and equipment; transportation; resources; people; environment. Indirect risks Safety Management, support functions (offshore + onshore) Risks related to: Ineffective teamwork; fragmented organisation; internal communication; safety feedback. Functional analysis of the four main resilience abilities (respond, monitor, learn, anticipate). Systematic (risk) assessment of what is needed for the abilities to succeed (preconditions, control, resources, time). Identify conditions where an ability may be unable to succeed, and propose ways to avoid that (e.g., KPI + interventions).

28 Integrated contractors/suppliers Advantages (short term): To maximize expertise and to reduce costs when supplier and operating company have parallel organisations. This requires total planning, cross-trained personnel and moving contractor tasks onshore. Contractors share information with the operator in real time, and have their own collaboration rooms used for daily communication with the operator, e.g. in morning meetings. Disadvantages (long term): Ability to respond. Trimming the organisation leads to loss of redundancy. Capacity is optimised for normal or usual conditions, but may be insufficient for conditions that are unusual or prolonged. Ability to learn. The focus real time information means that background information and experience are less important. Ability to anticipate: Anticipation cannot be regulated, but involves a flexible combination of ideas, insights, and experiences. It needs diversity and an organisational where management acknowledge the importance of looking ahead.

29 Effect on the four resilience abilities Responding: Knowing what to do, being capable of doing it. Anticipating: Finding out and knowing what to expect Actual Factual Learning: Knowing what has happened Critical Potential Monitoring: Knowing what to look for

30 Status: measuring resilience Ability Abilityto to respond respond (actual) (actual) Set of questions for ability to respond Rating scale + evaluation criteria Ability Abilityto to monitor monitor (critical) (critical) Set of questions for ability to monitor Rating scale + evaluation criteria Ability Abilityto to anticipate anticipate (potential) (potential) Set of questions for ability to anticipate Rating scale + evaluation criteria Ability Abilityto to learn learn (factual) (factual) Set of questions Rating scale + for ability to learn evaluation criteria

31 In this document, the key principles of holistic safety are arranged in seven categories called characteristics. Within each characteristic are attributes that more specifically outline the ways in which the key principles of holistic safety can be achieved. A Safe Organisation exhibits the key characteristics as described in these guidelines. The presence of these characteristics has been found to both increase organisations resistance to incidents and accidents while improving overall safety management and productivity. 1. Human aspects 2. Non-technical skills 3. Defence in depth 4. Management system 5. Resilience 6. Safety culture 7. Protective security and nuclear safety culture Holistic Safety Guidelines OPERATIONS SERVICES OS-LA-SUP-240U November 2012

32 Holistic Safety Sample Questions

33 Goal: When is an organisation resilient? Resilient Consummate Mindful Effective (frequency) Adequate Thorough Proactive Effective Adequate Adequate Inadequate Calculative (compliant) Adequate Stereotyped Limited (failure-based) Missing Reactive Acceptable Inadequate (binary) Missing Missing Pathological (basic) Inadequate Missing Missing Missing Ability to respond Ability to monitor Ability to learn Ability to anticipate

34 Process: Integrated planning (offshore) Learn Respond E S A U D M The integrated plan is continuously updated to reflect the varying needs of the installation. Active short-term plans are rescheduled when a certain threshold for risk on the activities are reached. If there are problems in execution of activities, the activities can be reprioritized and/or replaced. Our planners are experienced and understand the problems that may occur in the execution of activities. There is a well-functioning two-way communication between the offshore- and onshore organization during planning There is a well-functioning performance measurement system for how the integrated planning process works. We emphasize experience-and knowledge transfer among the people working in the company s integrated planning The integrated planning is being continuously improved.

35 Process: Roads to resilience There are no upper bounds on resilience: performance (abilities) can always be improved Respond + Learn People Resilient The development towards resilient performance takes place by improving the four abilities differentially but not independently! Dysfunctional Respond + Monitor + Anticipate Respond + Anticipate Dysfunctional Systems Resilient

36 Two opposing views Safety culture Safety-I Safety-II Culture of resilience Things that go wrong, adverse outcomes Things that go right, positive outcomes Non-compliance (Error or violation) Performance adjustments (ETTO) Find causes of noncompliance constrain Understand reasons for adjustments manage Identify and minimize risks Goal: Get away from a risky state Safety culture (Robust organisation) Manage (dampen, amplify) variability Resilient organisation Goal: Get closer to a safe state

37 Thank you for your attention