1. Moving from Safety-I to Safety-II
Symposium on HF &E in Health Care
12 March 2013
Moving from Safety-I to Safety-II
Robert L Wears, MD, MS, PhD
University of Florida
Imperial College London
20 minutes! for Q&A
?requisite variety of mental model???

2. motivation
general agreement that we are not making progress on safety as fast as we would like
we have not been ‘Protestant enough’
more rigour (eg, EBM)
greater accountability
two possibilities
not enough rigour (EBM), not working hard or conscientiously enough (accountablity)
interesting to think about what’s NOT being said

3. motivation
general agreement that we are not making progress on safety as fast as we would like
wrong mental model of safety
“… enduring Enlightenment projects
“… rationality can create a better, more controllable world
“… taken for granted by safety researchers b/ it appears so ordinary, self-evident and commonsensical.”*
two possibilities -- note this reprises the fundamental attribution fallacy – we attribute failings to individual attributes, not situational ones
not enough rigour (EBM), not working hard or conscientiously enough (accountablity)
*Dekker 2012

4. “A scientific paradigm suppresses the perception of data inconsistent with the paradigm, making it hard to perceive anomalies that might lead to scientific revolution.”

5. effect of mental models
11 year lag in discovery of Antarctic ozone hole
Meadows, Meadows, Randar 1992

6. patient safety orthodoxy
technocratic, instrumental, ‘measure-and-manage’ approach
myopic – failing to question underlying nature of problems
overly simplistic – transferring sol’ns from other sectors
negligent of knock-on effects of change
“glosses over the complexities of health care organisation and delivery”

7. view from safety-I accidents come from erratic acts by people
(variability, mistakes, errors, violations)
study, count accidents to understand safety
(tend to look backwards)
focus on components
safety is acquired by constraining workers via:
standardisation, guidelines, procedures, rules, interlocks, checklists, barriers
Taylor, Deming, Shewhart
Toyota
sacred texts – and sacred myths

8. assumptions in safety-I
our systems are well-designed and well-understood
procedures correct and complete
systems are basically safe, well-protected
reliability = predictable, invariant
variation is the enemy
safety is an attribute
(something a system has)
conditions are well-anticipated, well-specified
unarticulated assumptions
anticipatory model – an adjective

10. view from safety-II
accidents are prevented by people adapting to conditions
study normal work to understand safety
(tends to look forward)
focus on inter-relations
aim is to manage, not eliminate, the unexpected
safety is enacted by enabling workers via:
making hazards, constraints, goal conflicts visible
enhancing repertoire of responses
Rasmussen, Woods, Hollnagel
Three Mile Island, Tenerife
good example is NASA’s ‘scheduled hold’

11. assumptions in safety-II
our designs are incomplete, procedures out-dated
our systems are poorly understood
systems are basically unsafe
reliability = responsiveness
variation is necessary
safety is an activity
(something a system does)
possible failure modes have not been anticipated
‘continuing expectation of surprise’
a verb

12. safety-II healthcare STS intractable, underspecified, variable demands
resources (time, people, material, information) limited, uncertain
workers adjust to meet conditions creating variability
adjustments always approximate (b/ resources limited)
“Knowledge and error flow from the same mental source; only success can tell one from another.”
Ernst Mach, 1905
approximate adjustments usually reach goals, make things go safely
approximate adjustments sometimes fail, or make things go wrong

13. safety-I vs safety-II summary
defined by its opposite - failure
well designed & maintained, procedures correct & complete
people (ought to) behave as expected & trained
accidents
come from variability in above
therefore
safety comes from limiting & constraining operators via
standardization, procedures, rules, interlocks, barriers
critical inquiry
defined by its goal - success
poorly understood, incomplete, underspecified
people (ought to) adjust behaviour & interpret procedures
accidents
come from incomplete adaptation
therefore
safety comes from supporting operators via
making boundaries, hazards, goal conflicts visible, enhancing repertoire of responses
appreciative inquiry
not either-or, rather both-and

14. philosophical bases safety-I safety-II
linear, proportional, tractable behaviour explained by reduction positivist, Taylorist cause-effect simple, oneway controllable ‘the one best way’ values declarative, technical knowledge complicated problems techne, episteme
non-linear, non-proportional, intractable behaviour explained by emergence constructivist, interpretivist cause-effect multiple, reciprocal influence-able equifinality, multifinality values practice, tacit wisdom ‘wicked problems’ mētis, phronesis
program of technical rationality

15. why safety-II?
“The real trouble with this world of ours is not that it is an unreasonable world, nor even that it is a reasonable one. The commonest kind of trouble is that it is nearly reasonable, but not quite. Life is not an illogicality; yet it is a trap for logicians. It looks just a little more mathematical and regular than it is; its exactitude is obvious, but its inexactitude is hidden; its wildness lies in wait.“
G K Chesterton, 1909

16. why safety-II?

17. better fit with modern theories of accidents
why safety-II?
better fit with modern theories of accidents
simple, linear, chain of events
complicated, interdependent
complex, nonlinear, coupling, resonance, emergence

18. why safety-II?
resilience, ‘margin for maneuver’, buffers, tradeoffs all “hidden in the interstices of complex work” focus on how ordinary work goes right less likely to inadvertently damage these hidden resources

19. empirical support direct observations of CV surgery
surgeons w/ best results
had just as many untoward events as those w/ worst
but they had
better means of detection
greater repertoire of responses
de Leval 2000
de Leval, Carthey, et al 2000

20. fundamental ideas not new
Ernst Mach (1903) Charles Perrow (1984) Jens Rasmussen (1990, 1997) Gary Klein (1989ff) Gene Rochlin (1987, 1999) Paul Schulman (1993, 2004) Amalberti (2001) Hollnagel et al (2006ff) Berwick (2003)

21. from st donald
in fairness, other remarks in the piece suggest Berwick hasn’t fully adopted this position, or at least shrinks a bit from its full implications. But I think he would agree with me in saying that healthcare as overlearnt a particular epistemology to the exclusion of other more useful understandings.
Berwick, 2003

22. what makes safety-I persist?
not despite the fact that it’s wrong, but precisely because it is wrong, wrong in particularly useful ways
simple explanations illusion of control, ontological security removes managers, organisations from line of fire fits positivist, biomedical model
‘the nurse failed to notice …’ failure comes from aberrant people / devices, so remove, control them refitting, reorganising expensive, so re-train instead Enlightenment ‘program of technical rationality’

23. why HFE is a good fit for safety-II
multiple philosophies of science admissible
expertise in unpacking the mundane
judicious valuing of practice
‘requisite variety’ of views, tools
work as imagined vs work as done

24. perceive the invisible
Insp G: Is there any point to which you would wish to draw my attention? SH: To the curious incident of the dog in the night-time. Insp G: The dog did nothing in the night-time. SH: That was the curious incident …
Inspector Gregory
Laura, typicality
Conan Doyle, 1893

25. what is needed to move forward?
requisite variety
mental models, theories, skills, people
critical mass
sustained co-presence

26. ACEP2007
complex, adaptive, joint cognitive system where information and work is shared across people and physical and social artefacts (tools, procedures). May not be as integrated as Hutchins’ JCS of a bridge navigation, where there is no ‘spot’ where the calculation occurs, but still very similar

27. contact information
Robert L Wears, MD, MS, PhD

28. empirical support NSQIPS study hospitals w/ lowest mortality
had just as many complications as those w/ worst
but they had
earlier recognition
better responses
Ghaferi 2009
de Leval, Carthey, et al 2000

29. “Any argument for the safety of a design that relies solely on pointing to what has worked successfully in the past is logically flawed.”
John Roebling

30. sorting out the two views
resilience vs orthodox approach exploration vs exploitation prescriptive vs adaptive guidance homo- vs hetero-geneous processes centralized vs distributed control organic, evolutionary vs engineered, managerial

31. when HF and healthcare meet