1. 27 March 2017
16th Annual HPRCT Conference
June · Sheraton Baltimore Inner Harbor co-sponsored by Constellation Energy and INPO
Human Performance On the Horizon: HROs, Resilience Engineering, and Black Swans
Tony Muschara, CPT
January 25, 2010
The Certified Performance Technologist (CPT) designation is awarded by the International Society for Performance Improvement (ISPI) to experienced practitioners in the field of organizational performance improvement whose work meets both the performance-based Standards of Performance Technology and application requirements. For more information, visit

2. 27 March 2017
BP Deepwater Horizon

3. 27 March 2017

4. 27 March 2017

5. Key Points Black Swans are rare, unpredictable, very severe events.
27 March 2017
Key Points
Black Swans are rare, unpredictable, very severe events.
High Reliability Organizations (HRO) enhance safety through optimizing reliability.
Resilience Engineering (RE) improves safety by improving the occurrence of success.
Safety is what an organization does.
Reducing human failures is not the most efficient and effective way to improve human performance.
Recognize system health as a primary means to improving the safety state of an organization.

6. Black Swan* Rare outside the bounds of known likelihoods
27 March 2017
Black Swan*
Rare outside the bounds of known likelihoods
Unpredictable unable to anticipate
Severe unprecedented impact
Event good or bad
* Taleb, N. (2007), The Black Swan.

7. Notable Black Swan Disasters*
27 March 2017
Notable Black Swan Disasters*
Challenger (7) / Columbia (7)
Deepwater Horizon (11)
Texas City (15)
Chernobyl (>56)
United 232 (108)
Kansas City Hyatt (114)
Piper Alpha (167)
Herald of Free Enterprise (186)
Tenerife (583)
Bhopal (>2200)
* Numbers in parentheses denote number of fatalities on each occasion.

8. High Reliability Organization (HRO)
27 March 2017
High Reliability Organization (HRO)
HROs are “Organizations [that] operate under trying conditions yet perform relatively event-free over a long period of time, making consistently good decisions that result in high quality and reliable operations.”
-- Karlene Roberts
U.C. Berkeley
Roberts, K. (2003), “HRO has Prominent History,” Anesthesia Patient Safety Foundation Newsletter, Vol. 18, No. 1, pp.1-16.

9. Resilience Engineering (RE)*
Resilience – the ability to adjust its functioning to sustain operations during expected conditions and in the face of escalating demands, disturbances, and unforeseen circumstances
Resilience Engineering – the tools that promote resilience: anticipate, monitor, respond, learn
Erik Hollnagel Editor: Resilience Engineering Perspectives Volume 1: Remaining Sensitive to the Possibility of Failure
* Nemeth, C. et al. (2009), Resilience Engineering Perspectives, Volume 2: Preparation and Restoration, p.117.

10. Karl Weick Co-author: Managing the Unexpected
27 March 2017
Five HRO Principles*
Preoccupation with Failure
Reluctance to Simplify
Sensitivity to Operations
Commitment to Resilience
Deference to Expertise
Karl Weick Co-author: Managing the Unexpected
* Weick K. and Sutcliffe, K. (2007), Managing the Unexpected, 2nd ed. p.

11. 27 March 2017
RE Cornerstones*
Anticipate – knowing what to expect; long-term threats and opportunities
Monitor – knowing what to look for; near-term developments and threats (critical steps)
Respond – knowing what to do; capable of addressing expected and unexpected conditions
Learn – knowing what has happened (experience) and what to change (improvement)
* Source: Hollnagel, et al., Resilience Engineering, (2006), p.350, and Resilience Engineering Perspectives, Vol. 2, (2009), pp

12. 27 March 2017
Serendipity
Limitations of Six Sigma and Lean manufacturing processes to adequately address inherent human variability—random and often unpredictable
Difficulty in identifying and controlling the effects of social forces on information, its interpretation, knowledge, and action
The inability to specify all threats, combinations, and responses, and the occurrence of human failures in all phases of the plant’s life cycle
Multiple, concurrent human activities; dynamic, ambiguous environment; confounding number of system interdependencies
Incomplete or inaccurate knowledge about the state of the system and the uncertain nature of resources, information, and time
Impossible to chase and eliminate all latent weaknesses in a system.
Entropy – things wear out

13. Intangibles – Sources of Uncertainty
27 March 2017
Intangibles – Sources of Uncertainty
Trust Compassion Caring Dedication Fortitude Curiosity Honesty Wisdom Insight Courage Consensus Empathy Pride Interpretation Thoughts Motives Perceptions Feelings
Collaboration Passion Understanding Creativity Craftsmanship Values Forgiveness Unity Perseverance Initiative Follow-through Integrity Meaning Effort Assumptions Beliefs Interpretations Fears

14. Drift and Accumulation*
27 March 2017
Drift and Accumulation*
Expectations: Desired approach to work (as imagined) Hi
Practices: Work as actually performed (allowed by mgmt!)
Expectations
Drift
Violation
Current Practice
Safety
Real Margin for Error
Error
Accumulation Inconspicuous and seemingly harmless buildup of unusual conditions, hazards, threats, and system weaknesses without warning
Danger
Hidden hazards, threats, unusual conditions, & system weaknesses Lo
Time
* Adapted from Dekker, S. (2007), The Field Guide to Understanding Human Error.

15. Latent System Weaknesses Accumulate!
27 March 2017
Be Aggressive!
The causes of tomorrow’s events exist today!
Latent System Weaknesses Accumulate!

16. Safety Space – Where am I?*
27 March 2017
Safety Space – Where am I?*
Boundary: System Failure
Boundary: Economic Failure
Operating Point
Administrative Safety Limit
Boundary: Unacceptable Workload
* Rasmussen, J. (1997), “Risk Management in a Dynamic Society: A Modeling Problem,“ Safety Science, 27(2/3),

17. Studies on HROs and RE Commercial nuclear power Air traffic control
27 March 2017
Studies on HROs and RE
Commercial nuclear power
Air traffic control
Wildland fire fighting
Aircraft carrier operations
Healthcare
Armored military brigade
Space shuttle
Offshore platforms
Rail and train operations
Manufacturing
Submarine operations

18. Principal Features of an HRO*
27 March 2017
Principal Features of an HRO*
High-Hazard and Complex Activities
High Technical Competence
Hazard-Driven Adaptations
Positive Design-Based Redundancy
High Performance and Close Oversight
Constant Search for Improvement
High Pressures and Expectations for Reliability
No Substitutes for Reliability
Limitations on Trial-and-Error Learning
Culture of Reliability
Flexible Authority during Emergencies
Mindfulness
* Roe, E. and Schulman, P. (2008), High Reliability Management: Operating on the Edge, p

19. Principal Features of RE
27 March 2017
Principal Features of RE
Adaptability, Flexibility, and Capacity
Dynamic Nature of System and Multiple Interdependencies among Components
Dependency on Functioning of the Whole System
Preparation and Sustainability
Learning from Successes
Sustaining Normal Functioning, not just Preventing Failures
Resourcefulness and Redundancy
Safety more than Reliability of Individual Components
Safety – What an Organization Does
Minimizing the gap between work-as-imagined and work-as-done

20. Are there any REAL Differences between HRO and RE?
27 March 2017
Are there any REAL Differences between HRO and RE?
RE emphasizes adapting – to maintain success.
HRO emphasizes reliability – avoiding failure.
Fundamentally, the only difference is PERSPECTIVE!
There are advantages from both.

21. Surprise! Thanksgiving Turkey Benefits Days 200 400 800 600 1000
27 March 2017
Thanksgiving Turkey
200
400
800
600
1000
Days
Benefits
Surprise!

22. Drift and Accumulation*
27 March 2017
Drift and Accumulation*
Expectations: Desired approach to work (as imagined) Hi
Normal Practices: Work as actually performed (allowed by mgmt!)
Expectations
Drift
“Normal” Practice
Safety
Real Margin for Error
Accumulation Inconspicuous and seemingly harmless buildup of unusual conditions, hazards, threats, and system weaknesses without warning
Danger
Hidden hazards, threats, unusual conditions, & system weaknesses Lo
Time
* Adapted from Dekker, S. (2007), The Field Guide to Understanding Human Error.

23. Chronic Sense of Uneasiness
An attitude of mindfulness regarding one’s capacity to err and the presence of hidden threats; preoccupation with failure
--how you perceive, think, feel, and behave toward hazards--
“When you stop being scared, you start making mistakes.”
-- unknown

24. Efficiency/Thoroughness Trade-Off*
27 March 2017
Efficiency/Thoroughness Trade-Off*
People routinely make a choice between being efficient (productive / less effort) and being thorough (safe / reliable), since it is rarely possible to be both at the same time.
If demands for productivity are high, thoroughness is reduced until productivity goals are met.
If demands for safety are high, efficiency is reduced until the safety goals are met.
* Hollnagel. E. (2009), The ETTO Principle, Efficiency-Thoroughness Trade-Off.

25. Key Conclusions about HRO and RE
27 March 2017
Key Conclusions about HRO and RE
Performance conditions are always imperfect: resources and time are finite, training and procedures are incomplete, and planning is approximate.
The reliability of individual components or subsystems cannot always effectively predict how they combine to create novel pathways to failure.
Safety is what you do, not what you have (continuous adaptation to changes and disruptions—core business).
People create safety within inherently imperfect systems.
It is difficult to do safety and production at the same time (trade-offs between time to think vs. time to do).
Identifying and eliminating latent system weaknesses continuously offers the best route to improving system health.
Organizations cultivate a capacity to adapt – preserve capacity, flexibility, reserves, and options and reduce volatile work situations.

26. 27 March 2017
Suggestions
Make boundaries explicit, and build a “preoccupation with failure.”
Give people coping skills (adaptive capacities) at boundaries.
When introducing change, 1) avoid introduction of local factors that intensify volatility for the front-line worker, (control) and 2) preserve local factors that support flexibility in off normal conditions (adaptability).
Pay attention to: 1) avoiding human failures at critical steps, and 2) improving system health (arresting the accumulation of latent system weaknesses)
Expand Hu management perspective from a myopic operational focus to an organizational focus.
Monitor how you monitor system health and safety.
Learn continuously – learn from successes, not just failures.
Anticipate – Monitor – Respond – Learn

27. Multi-Tiered Approach – Finding LSWs
27 March 2017
Multi-Tiered Approach – Finding LSWs
Reporting
Observation and Coaching
Self-Assessment and Trending
Operating Experience and Benchmarking
Causal Analyses
“Eliminating latent [system weaknesses] is the most effective way to manage human error.”
--Jop Groeneweg
Author: Controlling the Controllable

28. Improving System Health (RE)
27 March 2017
Improving System Health (RE)
Internal Methods
External Methods
Field Observations
Post-job Reviews
Reporting
Self-Assessments
Metrics and Trending
Common Factor Analysis
Surveys & Questionnaires
Cause Analysis
Effectiveness Reviews
Operating Experience
Benchmarking
Independent Oversight

29. Local Factors (drivers)
27 March 2017
“Human Performance is its goal and its test.”
--Peter Drucker
“Management: Tasks, Responsibilities, Practices”
Organization
Management Systems
Leadership Practices
“We cannot change the human condition, but we can change the conditions under which people work.”
--James Reason
“Managing the Risks of Organizational Accidents”
Local Factors (drivers)
Human Performance

30. Effort vs. Importance* Effort Expended Importance Currently Actual
27 March 2017
Effort vs. Importance*
Effort Expended
Importance
Latent System Weaknesses
Human Failure
Equipment Failure
Currently
Actual
* Adapted from Kletz, T. (2001), An Engineer’s View of Human Error (3rd ed.); p.127..

31. Avoiding the Black Swan
27 March 2017
Avoiding the Black Swan
Be skeptical about confirmatory data.
Worry less about small failures, and more about large, potentially terminal ones.
Worry more about matters that lie outside beyond our consciousness.
Worry about matters you can do something about.
Be very conservative when exposed to the threat of a negative Black Swan.
“It is more difficult to be a loser in a game you set up yourself. …this means that you are exposed to the improbable only if you let it control you. You always control what you do.”
--Nassim Taleb
Author: The Black Swan

32. Questions and Comments
27 March 2017
Questions and Comments
4724 Outlook Way
Marietta, Georgia 30066