High Reliability Operations

High Reliability Operations
4 Hour Professional Development Seminar HPRCT Workshop, Baltimore Maryland June 21, 2010 Richard S. Hartley, Ph.D., P.E. Janice N. Tolk, Ph.D., P.E. This presentation was produced under contract number DE-AC04-00AL66620 with

What is a High Reliability Organization?
An organization that repeatedly accomplishes its mission while avoiding catastrophic events, despite significant hazards, dynamic tasks, time constraints, and complex technologies A key attribute of being an HRO is to learn from the organization’s mistakes A.K.A. a learning organization

Examples of High Reliability Organizations or Not?
Nuclear Navy Commercial nuclear power Aircraft carrier operations Hospital patient care Military nuclear deterrent Forest service Aviation Nuclear weapons assembly and disassembly

Business Case for High Reliability
Is it right for you?

Contractor ISM deployed
Does a Systems Approach Make Sense? Department of Energy Safety Improvement from Contractor ISM deployed This slide is to illustrate that steady progress is possible by focusing on HRO fundamentals. Since ISM was started in DOE, the injury rates have steadily declined. While some may be due to increased scrutiny (and perceived pressures not to report), DOE is clearly a safer place to work today than 20 years ago. Over the last 10 years, DOE has cut its reported injury/illness rates in half. Today’s industry leaders demonstrate that DOE can still make more dramatic improvements over the next decade. Data as of 7/7/2009 DOE injury rates have come down significantly since Integrated Safety Management (ISM) was adopted 5

Does a Systems Approach Make Sense. U. S
Does a Systems Approach Make Sense? U.S. Nuclear Industry Performance Capacity Factor (% up) Cost (¢/kwh) Rx Trips/ Scrams Significant Events/Unit This slide is a further illustration of the improvements possible in safety and performance by using HRO approaches in the commercial nuclear power industry. Nuclear Energy Institute (NEI) Data 6

The Alternate to the HRO
The Normal Accident Organization

Feeling Comfortable with a Good Safety Stats?
As Columbia and Davis-Besse have demonstrated, great safety stats don’t equal real, tangible organizational safety. The tendency for normal people when confronted with a continuous series of positive “stats” is to become comfortable with good news and not be sensitive to the possibility of failure. “Normal people” routinely experience failure by believing their own press (or statistics).

NASA & Columbia Jan 16, 2003 When NASA lost 7 astronauts, the organization's TRC rate was 600% better than the DOE complex. And yet, on launch day 3,233 Criticality 1/1R* hazards had been waived. CAIB: “The unexpected became the expected, which became the accepted.” * Criticality 1/1R component failures result in loss of the orbiter and crew.

Davis-Besse 2002 Had some performance “hard spots” in the 80's
Had become a world-class performer in the next 15 years Preceding initiating events of mid 90's Frequently benchmarked by other organizations While a serious corrosion event was taking place Complete core melt near miss in 2002

SYSTEM ACCIDENT TIMELINE
What is Next? Who is Next? Three Mile Island 1984 – Bhopal India 1986 – NASA Challenger 1986 – Chernobyl 1989 – Exxon Valdez 1996 – Millstone 2001 – World Trade Center 2005 – BP Texas City 2007 – Air Force B-52 2008 – Stock Market Crash

How do Organizations Get Themselves into System Accident Space?
Attempts to Understand & Prevent System Accidents

(High Reliability vs. Normal Accident Theory)
Attempts to Understand & Prevent System Accidents (High Reliability vs. Normal Accident Theory)

The Cure for Organization Blindness
"Most ailing organizations have developed a functional blindness to their own defects. They are not suffering because they cannot resolve their problems, but because they cannot see their problems.“ John Gardner Weak Signals

What is the Focus of an HRO?
Individual Accidents OR Systems Accidents?

Individual Accident An accident occurs wherein the worker is not protected from the plant and is injured (e.g. radiation exposure, trips, slips, falls, industrial accident, etc.) Focus: Protect the worker from the plant Plant (hazard) Human Errors (receptor)

Systems Accident An accident wherein the system fails allowing a threat (human errors) to release hazard and as a result many people are adversely affected Workers, Enterprise, Surrounding Community, Country Plant (hazard) Human Errors (threat) Focus: Protect the plant from the worker The emphasis on the system accident in no way degrades the importance of individual safety , it is a pre-requisite of an HRO

System Accident vs. System Event
System accident - an occurrence that is unplanned and unforeseen that results in serious consequences and causes total system disruption (i.e. death, dose, dollars, delays etc.). System event - any unplanned, unforeseen occurrence that results in the failure of the system that does not result in catastrophic consequences -- indicates a breakdown in the system vital to the well-being of many people and the survivability of the organization! System accident - an occurrence that is unplanned and unforeseen that results in serious consequences and causes total system disruption (i.e. death, dose, dollars, delays etc.). System event - any unplanned, unforeseen occurrence that results in the failure of the system that does not result in catastrophic consequences -- indicates a breakdown in the system vital to the well-being of many people and the survivability of the organization!

Why Is Being an HRO So Important?
Some types of system failures are so punishing that they must be avoided at almost any cost. These classes of events are seen as so harmful that they disable the organization, radically limiting its capacity to pursue its goal, and could lead to its own destruction. Laporte and Consolini, 1991 Some types of system failures are so punishing that they must be avoided at almost any cost. These classes of events are seen as so harmful that they disable the organization, radically limiting its capacity to pursue its goal, and could lead to its own destruction. Laporte and Consolini, 1991 Some types of system failures are so punishing that they must be avoided at almost any cost. These classes of events are seen as so harmful that they disable the organization, radically limiting its capacity to pursue its goal, and could lead to its own destruction. Laporte and Consolini, 1991

HROs vs. NAT Organizations
Comparing & Contrasting High Reliability Theory with Normal Accident Theory HROs vs. NAT Organizations

High Risk or High Consequence?
R = C x P Risk = Consequence x Probability If we are truly working with high-risk operations, ethically and morally we should not be in business!

High Reliability Organization (HRO) vs. Normal Accident Theory (NAT)
Belief of HRO Accidents can be avoided by organizational design and management i.e. Risk = C x P is manageable Dr. Karlene Roberts Dr. Charles Perrow Belief of NAT Accidents are inevitable in complex and tightly coupled operations i.e. Risk = C x P is too high

High Reliability Organization (HRO) vs. Normal Accident Theory (NAT)
Belief of HRO Accidents can be avoided by organizational design and management i.e. Risk = C x P is manageable Belief of NAT Accidents are inevitable in complex and tightly coupled operations i.e. Risk = C x P is too high Control of Risk DOE reduces “C” by: minimizing the hazard and/or mitigating the consequence DOE reduces “P” - human performance improvement human performance error precursors barriers

Complex vs. Linear Interactions
Expected & familiar production or maintenance sequences Visible, even if unplanned Simple -- readily comprehensible Complex interactions One component can react with others outside normal production sequence Nonlinear Unfamiliar sequences, or unplanned and unexpected sequences not visible nor immediately comprehensible

Complex vs. Linear Interactions
For linear interactions 4 events lead to 4 interactions. 1 2 3 4 Complex Interactions 1 2 3 4 5 6 7 8 9 10 11 12 Complex Interactions For complex interactions, 4 events lead to 12 possible interactions. Greatly amplifies difficulty in determining and responding to the problem. 1 2 3 4 5 6 1 2 3 1 2 3 4 5 6 7 8 9

Complex Interactions Alone Insufficient
Complex interactions not necessarily high-risk systems with catastrophic potential, examples: Universities R&D Federal Government Also takes another key ingredient Tight coupling

Loose vs. Tight Coupling
Super Glue Loose vs. Tight Coupling Loosely coupled systems: Delays possible; processes can remain in standby mode Spur-of-the-moment redundancies and substitutions can be found Fortuitous recovery aids possible Failures can be patched more easily, temporary rig can be set up Tightly coupled systems: Time-dependent processes: they can’t wait or standby Reactions in chemical plants – instantaneous, can’t be delayed or extended Sequences invariant Only one way to reach production goal Little slack; quantities must be precise, resources can’t be substituted Buffers and redundancies must be designed in, thought of in advance Ever done this?

Example of Loose vs. Tight Coupling
Loose Coupling Tight Coupling

Interaction/Coupling Chart
(Adapted from Fig 9.1 Perrow) Loose < Coupling Tight Visible Interactions < Interactions > Hidden Interactions More time to act <------Coupling ----Less time to act 1 2 3 4 Nuclear Power Weapon Accidents Aircraft DNA Chem Plant Space Grids Marine transport Airways Dams Rail Assembly line production Trade Schools Most Mfg. Plants Junior College Single goal agencies Motor vehicle, post office Mining Military Universities R&D Firms Multi goal agencies DOE, OMB Early warning More likely to have system accident (Increases escalation to full-blown event) (Decreases the probability of dangerous incident) (Increases the probability of (Can put in standby mode) Less likely to have system accident Linear < Interactions > Complex HROs must neutralize bad effects here Normal Accidents –Living with High-Risk Technologies, Perrow Loose < Coupling Tight Visible Interactions < Interactions > Hidden Interactions More time to act <------Coupling ----Less time to act 1 2 3 4 Nuclear Power Weapon Accidents Aircraft DNA Chem Plant Space Grids Marine transport Airways Dams Rail Assembly line production Trade Schools Most Mfg. Plants Junior College Single goal agencies Motor vehicle, post office Mining Military Universities R&D Firms Multi goal agencies DOE, OMB Early warning (Increases escalation to full-blown event) (Decreases the probability of dangerous incident) (Increases the probability of (Can put in standby mode) Less likely to have system accident Linear < Interactions > Complex More likely to have system accident Visible Interactions < Interactions > Hidden Interactions 1 2 3 4 (Decreases the probability of dangerous incident) (Increases the probability of Linear < Interactions > Complex Loose < Coupling Tight More time to act <------Coupling ----Less time to act 1 2 3 4 (Increases escalation to full-blown event) (Can put in standby mode) Your Organization? Your Organization? Normal Accidents –Living with High-Risk Technologies, Perrow

Effect of Complex vs. Linear Interactions
According to Perrow: Interactiveness increases the magnitude of accident because of unrecognized connections between systems Tight coupling increases the probability of initiating the accident Together they are the makings of a normal accident

Interactive Complexity & Coupling Lets Discuss
Provide examples In your own organization In other organizations In other places throughout the world Where is today’s world going with regards complexity and coupling? Is this good or bad?

High Reliability or Accident Waiting to Happen?
HRO Accidents can be avoided by organizational design and management NAT Accidents are inevitable in tightly coupled and complex operations. Better technologies 1 2 Better organizational processes Dr. Charles Perrow The two columns labeled HRO and NAT represent all the foundational material that has been presented and discussed in the seminar series (Seminars #1, #2, & #3). These columns represents the HRO vs. NAT matrix in which we attempted to first understand the theory of both HRO and NATs then find practical examples/applications of the traits of both HROs and NATs at Pantex (note these “applications” are just figments of the managers’ imaginations until they are proven to exist with facts). The KEY take-away after the matrix has been fully developed (and hopefully understood) is the theory of HRO: Accidents can be avoided by organizational design and organizational management (it takes good design but it also takes effective management because it does not work if you don’t implement and monitor). The better organizational processes must counter the problems associated with tightly coupled and complex hazardous operations in order to address the two key issues contributing to systems’ accidents according to Perrow. The theory will become the key to understanding the application of HPI to achieve HRO state and the CFA program which is being developed to understand “reality” so that we can evaluate how well Pantex is executing HPI and how effective it is as an HRO. Perrow provides two ways that organizations move from NAT to HRO space (note he says both of these fail but the nugget of truth is the 1) better technology movement and 2) the better organizational processes movement). We will focus on the “Better Organizational Process” part. We attempt to develop the link between HRO  HPI  CFA  HRO Effectiveness: Link #1 HPI  HRO: HPI is a systematic process to become an HRO with the focus of protecting the Plant from the worker. Note: Rick’s theory - HPI was developed to strengthen good characteristics of HROs and negate bad characteristics of NATs. Link #2 CFA  Reality: If we are successful, our CFA process will provide us a clear glimpse of “reality” in terms of what happened and why it happened. Link #3 Reality  HRO Effectiveness: If we can really see what happened and why it happened, we can start using the worker’s response as a way of testing our HRO system to evaluate our effectiveness as an HRO. Perrow states that there are two primary ways that organizations try to counter interactive complexity (NAT)

Accidents can be avoided by organizational design and management
High Reliability or Accident Waiting to Happen? HRO Accidents can be avoided by organizational design and management Dr. Scott Sagan HROs use the rational-closed system construct to accomplish their goal by: Maintaining safety as a leadership objective Using redundant systems Focusing on three operational and management factors decentralization, culture, and continuity Being a learning organization The two columns labeled HRO and NAT represent all the foundational material that has been presented and discussed in the seminar series (Seminars #1, #2, & #3). These columns represents the HRO vs. NAT matrix in which we attempted to first understand the theory of both HRO and NATs then find practical examples/applications of the traits of both HROs and NATs at Pantex (note these “applications” are just figments of the managers’ imaginations until they are proven to exist with facts). The KEY take-away after the matrix has been fully developed (and hopefully understood) is the theory of HRO: Accidents can be avoided by organizational design and organizational management (it takes good design but it also takes effective management because it does not work if you don’t implement and monitor). The better organizational processes must counter the problems associated with tightly coupled and complex hazardous operations in order to address the two key issues contributing to systems’ accidents according to Perrow. The theory will become the key to understanding the application of HPI to achieve HRO state and the CFA program which is being developed to understand “reality” so that we can evaluate how well Pantex is executing HPI and how effective it is as an HRO. Perrow provides two ways that organizations move from NAT to HRO space (note he says both of these fail but the nugget of truth is the 1) better technology movement and 2) the better organizational processes movement). We will focus on the “Better Organizational Process” part. We attempt to develop the link between HRO  HPI  CFA  HRO Effectiveness: Link #1 HPI  HRO: HPI is a systematic process to become an HRO with the focus of protecting the Plant from the worker. Note: Rick’s theory - HPI was developed to strengthen good characteristics of HROs and negate bad characteristics of NATs. Link #2 CFA  Reality: If we are successful, our CFA process will provide us a clear glimpse of “reality” in terms of what happened and why it happened. Link #3 Reality  HRO Effectiveness: If we can really see what happened and why it happened, we can start using the worker’s response as a way of testing our HRO system to evaluate our effectiveness as an HRO. The Limits of Safety, Scott Sagan

Accidents can be avoided by organizational design and management
High Reliability or Accident Waiting to Happen? HRO Accidents can be avoided by organizational design and management Without leadership, safety is but a facade. Multiple & Independent Barriers HROs use the rational-closed system construct to accomplish their goal by: HROs use the rational-closed system construct to accomplish their goal by: Maintaining safety as a leadership objective Using redundant systems Focusing on three operational and management factors decentralization, culture, and continuity Being a learning organization Workers have to call the shots. Leaders want workers to call the shots as they would. Want workers to call the shots based on experience – keep the plant open. The two columns labeled HRO and NAT represent all the foundational material that has been presented and discussed in the seminar series (Seminars #1, #2, & #3). These columns represents the HRO vs. NAT matrix in which we attempted to first understand the theory of both HRO and NATs then find practical examples/applications of the traits of both HROs and NATs at Pantex (note these “applications” are just figments of the managers’ imaginations until they are proven to exist with facts). The KEY take-away after the matrix has been fully developed (and hopefully understood) is the theory of HRO: Accidents can be avoided by organizational design and organizational management (it takes good design but it also takes effective management because it does not work if you don’t implement and monitor). The better organizational processes must counter the problems associated with tightly coupled and complex hazardous operations in order to address the two key issues contributing to systems’ accidents according to Perrow. The theory will become the key to understanding the application of HPI to achieve HRO state and the CFA program which is being developed to understand “reality” so that we can evaluate how well Pantex is executing HPI and how effective it is as an HRO. Perrow provides two ways that organizations move from NAT to HRO space (note he says both of these fail but the nugget of truth is the 1) better technology movement and 2) the better organizational processes movement). We will focus on the “Better Organizational Process” part. We attempt to develop the link between HRO  HPI  CFA  HRO Effectiveness: Link #1 HPI  HRO: HPI is a systematic process to become an HRO with the focus of protecting the Plant from the worker. Note: Rick’s theory - HPI was developed to strengthen good characteristics of HROs and negate bad characteristics of NATs. Link #2 CFA  Reality: If we are successful, our CFA process will provide us a clear glimpse of “reality” in terms of what happened and why it happened. Link #3 Reality  HRO Effectiveness: If we can really see what happened and why it happened, we can start using the worker’s response as a way of testing our HRO system to evaluate our effectiveness as an HRO. Learn from small mistakes – information-rich events! The Limits of Safety, Scott Sagan

NAT Accidents are inevitable in tightly coupled and complex operations. Signs of Natural Actors No clear consistent goals Mgt at different levels have conflicting goals Unclear technology – organizations don’t understand their own processes NATs believe the natural-open organizational system prevails because: NATs believe the natural-open organizational system prevails because: Conflicting leadership objective prevail There are perils in redundant systems There is no effective management of decentralization, culture, or continuity Organizational learning is restricted Signs of Open Organizations Decision-makers come and go Some pay attention, others don’t Key meetings dominated by biased, uninformed, uninterested personnel The two columns labeled HRO and NAT represent all the foundational material that has been presented and discussed in the seminar series (Seminars #1, #2, & #3). These columns represents the HRO vs. NAT matrix in which we attempted to first understand the theory of both HRO and NATs then find practical examples/applications of the traits of both HROs and NATs at Pantex (note these “applications” are just figments of the managers’ imaginations until they are proven to exist with facts). The KEY take-away after the matrix has been fully developed (and hopefully understood) is the theory of HRO: Accidents can be avoided by organizational design and organizational management (it takes good design but it also takes effective management because it does not work if you don’t implement and monitor). The better organizational processes must counter the problems associated with tightly coupled and complex hazardous operations in order to address the two key issues contributing to systems’ accidents according to Perrow. The theory will become the key to understanding the application of HPI to achieve HRO state and the CFA program which is being developed to understand “reality” so that we can evaluate how well Pantex is executing HPI and how effective it is as an HRO. Perrow provides two ways that organizations move from NAT to HRO space (note he says both of these fail but the nugget of truth is the 1) better technology movement and 2) the better organizational processes movement). We will focus on the “Better Organizational Process” part. We attempt to develop the link between HRO  HPI  CFA  HRO Effectiveness: Link #1 HPI  HRO: HPI is a systematic process to become an HRO with the focus of protecting the Plant from the worker. Note: Rick’s theory - HPI was developed to strengthen good characteristics of HROs and negate bad characteristics of NATs. Link #2 CFA  Reality: If we are successful, our CFA process will provide us a clear glimpse of “reality” in terms of what happened and why it happened. Link #3 Reality  HRO Effectiveness: If we can really see what happened and why it happened, we can start using the worker’s response as a way of testing our HRO system to evaluate our effectiveness as an HRO. The Limits of Safety, Scott Sagan

Accidents are inevitable in tightly coupled and complex operations.
High Reliability or Accident Waiting to Happen? Pressure to maintain production only slightly modified by increased interests in safety. NAT Accidents are inevitable in tightly coupled and complex operations. Redundant barriers, not independent. Redundancy makes system opaque. Redundancy falsely makes system appear more safe. NATs believe the natural-open organizational system prevails because: NATs believe the natural-open organizational system prevails because: Conflicting leadership objective prevail There are perils in redundant systems There is no effective management of decentralization, culture, or continuity Organizational learning is restricted Not enough time to improvise – tightly coupled. Leaders don’t know enough about their operations to evaluate whether workers are responding correctly or not. The two columns labeled HRO and NAT represent all the foundational material that has been presented and discussed in the seminar series (Seminars #1, #2, & #3). These columns represents the HRO vs. NAT matrix in which we attempted to first understand the theory of both HRO and NATs then find practical examples/applications of the traits of both HROs and NATs at Pantex (note these “applications” are just figments of the managers’ imaginations until they are proven to exist with facts). The KEY take-away after the matrix has been fully developed (and hopefully understood) is the theory of HRO: Accidents can be avoided by organizational design and organizational management (it takes good design but it also takes effective management because it does not work if you don’t implement and monitor). The better organizational processes must counter the problems associated with tightly coupled and complex hazardous operations in order to address the two key issues contributing to systems’ accidents according to Perrow. The theory will become the key to understanding the application of HPI to achieve HRO state and the CFA program which is being developed to understand “reality” so that we can evaluate how well Pantex is executing HPI and how effective it is as an HRO. Perrow provides two ways that organizations move from NAT to HRO space (note he says both of these fail but the nugget of truth is the 1) better technology movement and 2) the better organizational processes movement). We will focus on the “Better Organizational Process” part. We attempt to develop the link between HRO  HPI  CFA  HRO Effectiveness: Link #1 HPI  HRO: HPI is a systematic process to become an HRO with the focus of protecting the Plant from the worker. Note: Rick’s theory - HPI was developed to strengthen good characteristics of HROs and negate bad characteristics of NATs. Link #2 CFA  Reality: If we are successful, our CFA process will provide us a clear glimpse of “reality” in terms of what happened and why it happened. Link #3 Reality  HRO Effectiveness: If we can really see what happened and why it happened, we can start using the worker’s response as a way of testing our HRO system to evaluate our effectiveness as an HRO. Causes of accidents and near-misses unclear –hard to learn. Incentives to fabricate positive records abound. The Limits of Safety, Scott Sagan

Attributes of HROs and NATs HRO Accidents can be avoided by organizational design and management NAT Accidents are inevitable in tightly coupled and complex operations. HROs use the rational-closed system construct to accomplish their goal by: HROs use the rational-closed system construct to accomplish their goal by: NATs believe the natural-open organizational system prevails because: NATs believe the natural-open organizational system prevails because: Maintaining safety as a leadership objective Using redundant systems Focusing on three operational and management factors decentralization, culture, and continuity Being a learning organization Conflicting leadership objective prevail There are perils in redundant systems There is no effective management of decentralization, culture, or continuity Organizational learning is restricted The two columns labeled HRO and NAT represent all the foundational material that has been presented and discussed in the seminar series (Seminars #1, #2, & #3). These columns represents the HRO vs. NAT matrix in which we attempted to first understand the theory of both HRO and NATs then find practical examples/applications of the traits of both HROs and NATs at Pantex (note these “applications” are just figments of the managers’ imaginations until they are proven to exist with facts). The KEY take-away after the matrix has been fully developed (and hopefully understood) is the theory of HRO: Accidents can be avoided by organizational design and organizational management (it takes good design but it also takes effective management because it does not work if you don’t implement and monitor). The better organizational processes must counter the problems associated with tightly coupled and complex hazardous operations in order to address the two key issues contributing to systems’ accidents according to Perrow. The theory will become the key to understanding the application of HPI to achieve HRO state and the CFA program which is being developed to understand “reality” so that we can evaluate how well Pantex is executing HPI and how effective it is as an HRO. Perrow provides two ways that organizations move from NAT to HRO space (note he says both of these fail but the nugget of truth is the 1) better technology movement and 2) the better organizational processes movement). We will focus on the “Better Organizational Process” part. We attempt to develop the link between HRO  HPI  CFA  HRO Effectiveness: Link #1 HPI  HRO: HPI is a systematic process to become an HRO with the focus of protecting the Plant from the worker. Note: Rick’s theory - HPI was developed to strengthen good characteristics of HROs and negate bad characteristics of NATs. Link #2 CFA  Reality: If we are successful, our CFA process will provide us a clear glimpse of “reality” in terms of what happened and why it happened. Link #3 Reality  HRO Effectiveness: If we can really see what happened and why it happened, we can start using the worker’s response as a way of testing our HRO system to evaluate our effectiveness as an HRO. Good Bad The Limits of Safety, Scott Sagan

These are attributes of HROs and NATs.
High Reliability or Accident Waiting to Happen? Attributes of HROs and NATs HRO Accidents can be avoided by organizational design and management NAT Accidents are inevitable in tightly coupled and complex operations. These are attributes of HROs and NATs. The literature is silent on how they are achieved or avoided. HROs use the rational-closed system construct to accomplish their goal by: HROs use the rational-closed system construct to accomplish their goal by: NATs believe the natural-open organizational system prevails because: NATs believe the natural-open organizational system prevails because: Maintaining safety as a leadership objective Using redundant systems Focusing on three operational and management factors decentralization, culture, and continuity Being a learning organization Conflicting leadership objective prevail There are perils in redundant systems There is no effective management of decentralization, culture, or continuity Organizational learning is restricted The two columns labeled HRO and NAT represent all the foundational material that has been presented and discussed in the seminar series (Seminars #1, #2, & #3). These columns represents the HRO vs. NAT matrix in which we attempted to first understand the theory of both HRO and NATs then find practical examples/applications of the traits of both HROs and NATs at Pantex (note these “applications” are just figments of the managers’ imaginations until they are proven to exist with facts). The KEY take-away after the matrix has been fully developed (and hopefully understood) is the theory of HRO: Accidents can be avoided by organizational design and organizational management (it takes good design but it also takes effective management because it does not work if you don’t implement and monitor). The better organizational processes must counter the problems associated with tightly coupled and complex hazardous operations in order to address the two key issues contributing to systems’ accidents according to Perrow. The theory will become the key to understanding the application of HPI to achieve HRO state and the CFA program which is being developed to understand “reality” so that we can evaluate how well Pantex is executing HPI and how effective it is as an HRO. Perrow provides two ways that organizations move from NAT to HRO space (note he says both of these fail but the nugget of truth is the 1) better technology movement and 2) the better organizational processes movement). We will focus on the “Better Organizational Process” part. We attempt to develop the link between HRO  HPI  CFA  HRO Effectiveness: Link #1 HPI  HRO: HPI is a systematic process to become an HRO with the focus of protecting the Plant from the worker. Note: Rick’s theory - HPI was developed to strengthen good characteristics of HROs and negate bad characteristics of NATs. Link #2 CFA  Reality: If we are successful, our CFA process will provide us a clear glimpse of “reality” in terms of what happened and why it happened. Link #3 Reality  HRO Effectiveness: If we can really see what happened and why it happened, we can start using the worker’s response as a way of testing our HRO system to evaluate our effectiveness as an HRO. Good Bad The Limits of Safety, Scott Sagan

Don’t Dismiss the Normal Accident
NAT theorists take their case to the extreme but don’t dismiss their warnings “Normal” implies it is likely to happen with “normal” organizations It is “normal” to be human We all relax if things go right We all know we cut corners when we get busy We all do what we have done before We do what we see others do The lack of negative response reinforces our belief that perhaps the rules were too strenuous so we start cutting more corners more often Those dealing with high consequence operations never have the luxury of being “normal”

Fundamentals of Systems Approach
Reality Engineering Understanding Socio-Technical Systems to Improve Bottom-Line

Logical, Defensible Way to Think Based on Logic & Science
Central Theme of an HRO Not a New Initiative Logical, Defensible Way to Think Based on Logic & Science Logic & Science are Time and New Initiative Invariant The most important thing, is to keep the most important thing, the most important thing. Steven Covey, 8th Habit Focus on what is important Measure what is important

HROs Think and Act Differently
Take a physics-based system approach Measure gaps relative to physics-based system Explicitly account for people People are not the problem, they are the solution People are not robots, pounding won’t improve performance People provide safety, quality, security, science etc. Sustain behavior – account for culture Improve long-term safety, security, quality

Spectrum of Safety Spectrum of Safety Hard Core Safety Physics
Physics invariant Prevent flow of unwanted energy Delta function As Engineers Write Squishy People Part of Safety Average IQ of the organization It is a systems approach Gaussian curve As People Do

Compliance-based safety
Spectrum of Safety Spectrum of Safety Hard Core Safety Physics Physics invariant Prevent flow of unwanted energy Delta function Squishy People Part of Safety Average IQ of the organization It is a systems approach Gaussian curve Old Mind-Set Compliance-based safety High Reliability Organization Explicitly consider human error Take into account org. culture Maximize delivery of procedures Improve system safety

A Systems Approach to Safety
Construct of an HRO A Systems Approach to Safety

Remember if it is the System Accident
Human Errors (threat) Plant (hazard) If a systems approach is required to ensure we don’t have to rely on every individual having a perfect day every day to avoid the catastrophic accident, then we had better take the best approach to implementing that system!

Construct of the HRO Systems Approach to Avoid Catastrophic Accidents
We used Deming’s Theory of Profound Knowledge to develop a process to attain those HRO attributes identified by the High Reliability Theorists Deming’s Theory of Profound Knowledge (TPK) provides a foundation for the systems approach W. Edwards Deming

Construct of the HRO Systems Approach to Avoid Catastrophic Accidents
Organizations are systems that interact within their internal and external environments Statistical process control is the foundation of process optimization Knowledge of Systems Knowledge of Variation Deming’s Theory of Profound Knowledge (TPK) used to provide foundation for the systems approach Knowledge of Knowledge Knowledge of Psychology Theory, prediction, and feedback as the basis of learning Organizations have cultures that influence the system and desired outcome

Fundamental HRO Practices HRO Practices Cross-Walked to Deming TPK
Manage the System, Not the Parts HRO Practice #1 Knowledge of Systems Reduce Variability in HRO System HRO Practice #2 Knowledge of Variation Foster a Strong Culture of Reliability HRO Practice #3 Knowledge of Psychology Learn & Adapt as an Organization HRO Practice #4 Knowledge of Knowledge Knowledge of Systems Knowledge of Variation Knowledge of Knowledge Knowledge of Psychology

Fundamental HRO Practices Actions Associated with Each HRO Practice
Manage the System, Not the Parts HRO Practice #1 Knowledge of Systems Reduce Variability in HRO System HRO Practice #2 Knowledge of Variation Foster a Strong Culture of Reliability HRO Practice #3 Knowledge of Psychology Learn & Adapt as an Organization HRO Practice #4 Knowledge of Knowledge

Fundamental HRO Practices Actions Associated with Each HRO Practice
Manage the System, Not the Parts HRO Practice #1 Ensure system provides safety Manage system, evaluate variability Foster culture of reliability Model organizational learning Reduce Variability in HRO System HRO Practice #2 Deploy system Evaluate operations – meas. variability Adjust processes Foster a Strong Culture of Reliability HRO Practice #3 Provide capability to make conservative decisions Make judgments based on reality Openly question & verify system Learn & Adapt as an Organization HRO Practice #4 Generate decision-making info Tiered approach Refine HRO system

Fundamental HRO Practices HRO Practice #2
Manage the System, Not the Parts HRO Practice #1 Ensure system provides safety Manage system, evaluate variability Foster culture of reliability Model organizational learning Reduce Variability in HRO System HRO Practice #2 Knowledge of Variation Foster a Strong Culture of Reliability HRO Practice #3 Learn & Adapt as an Organization HRO Practice #4 Generate decision-making info Tiered approach Refine HRO system

Manage the System, Not the Parts HRO Practice #1 Ensure system provides safety Manage system, evaluate variability Foster culture of reliability Model organizational learning Reduce Variability in HRO System HRO Practice #2 Deploy system Evaluate operations – meas. variability Adjust processes Foster a Strong Culture of Reliability HRO Practice #3 Learn & Adapt as an Organization HRO Practice #4 Generate decision-making info Tiered approach Refine HRO system

Breaking the Chain Between Threat and Hazard

Break-the-Chain Framework
“Break the Chain” at Any Point & Stop the System Accident STEP 6 –learn from small errors to prevent BIG ones STEP 5 Foster a culture of reliability Hazard to Protect & to Minimize Hazard to Protect & to Minimize Human Performance Error Precursors Human Performance Error Precursors System Accident To Avoid Threat From Individual Errors STEP 3 RECOGNIZE threat posed by human error – Error precursors STEP 4 manage defenses STep 2 recognize & Minimize hazard Step 1 focus ON the consequences

Organizational Culture
Evaluating the HRO

Manage the System, Not the Parts HRO Practice #1 Reduce Variability in HRO System HRO Practice #2 Foster a Strong Culture of Reliability HRO Practice #3 Provide capability to make conservative decisions Make judgments based on reality Openly question & verify system Learn & Adapt as an Organization HRO Practice #4 Generate decision-making info Tiered approach Refine HRO system

Why is Culture Important to an HRO?
Spectrum of Safety Hard Core Safety Physics Physics invariant Prevent flow of unwanted energy Delta function Squishy People Part of Safety Average IQ of the plant It is a systems approach Gaussian curve High Reliability Organization Explicitly consider human error Take into account org. culture Maximize delivery of procedures Improve system safety

Organization’s Culture Provides Sustainability or 2. Inhibitors
What does Culture to for You? Organization’s Culture Provides Sustainability or 2. Inhibitors

Definition of Safety Culture
An organization’s values and behaviors, modeled by its leaders and internalized by its members, which serve to make safe performance of work the overriding priority to protect the public, workers, and the environment. EFCOG Safety Culture Task Group, 2008

Basics of Culture Dr. Edgar Schein
Most of the content of this section is adapted from Schein, Organizational Culture and Leadership, 2004

What if the external environment changes?
Leadership’s Challenge with Culture (new organization, e.g. new start-up company) Culture begins when leadership imposes its values and assumptions on a group If the group is successful because they use the leader’s values and assumptions likely these assumptions will be taken for granted and as a result you then have a culture defined for later generations What if the external environment changes? Schein, Organizational Culture and Leadership, 2004

Leadership’s Challenge with Culture
(existing organization, e.g. organization needing change) Environment changes Group runs into adaptive difficulties Some assumptions are no longer valid Leadership needs to step up once again Leadership needs to step outside culture the leader created and start evolutionary change to adapt to new environment. Ability to perceive limitations of one’s own culture and to evolve culture adaptively is the essence and ultimate challenge of leadership! Schein, Organizational Culture and Leadership, 2004

Culture -- An Empirically Based Abstraction
Culture refers to: Customs and rituals Practices organization develops around their handling of people Espoused values and credo of an organization Culture (good, bad, functionally effective) depends: not only on the culture alone (internal integration), but on the relationship of the culture to environment in which it exists (external adaptation and survival) Schein, Organizational Culture and Leadership, 2004

Culture points us to phenomena below surface Powerful in their impact but Invisible and, to a considerable degree, unconscious Just as our personality and character guide and constrain our behavior, so does culture guide and constrain behavior of members of a group through the shared norms that are held in that group Culture is to a group what personality is to an individual Schein, Organizational Culture and Leadership, 2004

The organization’s culture is its comfort zone while adapting to survive its external environment Personal examples of difficulties getting out of comfort zones: Diets Exercise Other examples? Changes in culture require us to: resurrect, reexamine, and possibly change some of the more stable portions of our cognitive structure Adapted from Schein, Organizational Culture and Leadership, 2004

Schein Levels of Culture
Easy to Observe – Difficult to Decipher Includes what one sees, hears, feels when one encounters a new group Includes visible products, architecture, language, technology, clothing Climate – organizational processes, charters, org charts, etc. Artifacts and Behaviors What “ought to be” versus what “is” Leader poses a solution to a problem  not yet a shared basis Group takes joint action and observes outcome If outcome successful perceived value is transformed to shared values or beliefs Espoused value = what “ought to be” vice what “is” Espoused Beliefs and Values Below the surface Basic assumptions: non-confrontable; non-debatable; hard to change Changes intrinsically difficult -- release large quantities of anxiety Rather than tolerate anxiety, we tend to distort, deny, or falsify what is going on Must decipher underlying assumptions if hope to interpret and act on artifacts Underlying Assumptions Schein, Organizational Culture and Leadership, 2004

Perspectives from Schein’s Levels of Culture
What You Do Artifacts and Behaviors What You Say You’re Going To Do Espoused Values and Beliefs What You Really Feel You Should Do Underlying Assumptions Schein, Organizational Culture and Leadership, 2004

The next level of safety improvement will be the most challenging
Healthy Organizational Culture Artifacts and Behaviors Balance and alignment between espoused values and artifacts or behaviors indicates employees buying-into safety culture The next level of safety improvement will be the most challenging Its what I do, not what I say. Becoming an HRO Espoused Beliefs and Values Balance and alignment between underlying assumptions and espoused values indicates leaders walking-the-talk Desire to be an HRO Underlying Assumptions Adapted from Schein, Organizational Culture and Leadership, 2004

Assessing Health of an Organization’s Culture
Determine by observing work Artifacts and Behaviors Misalignment hints at deeper underlying assumptions keeping the organization from attaining its desired balance between production and safety Determine by interviewing leadership Espoused Beliefs and Values Below the surface Underlying Assumptions Underlying assumptions must be understood to properly interpret artifacts and to create change Schein, Organizational Culture and Leadership, 2004

Healthy Organizational Culture
This cultural alignment is influenced by the way the organization: Artifacts and Behaviors Adapts and survives to its external environment Integrates internally to adapt as an organization Becoming an HRO Espoused Beliefs and Values Desire to be an HRO Underlying Assumptions

Steps in External Adaptation and Survival
Correction Measurement Means Goals Mission & Strategy Remember culture concepts: Leader imposes values and assumptions (what he/she thinks will work) Organization struggles to use the leader’s values to adapt to its external environment If the organization is successful, leaders values are accepted as their values and the culture has changed Schein, Organizational Culture and Leadership, 2004

Leader establishes a shared understanding of core mission, primary task, and manifest and latent functions Correction Measurement Means Goals Mission & Strategy Leader may provide strategies tie the mission to the goals Leader develops consensus on goals, as derived from the core mission Leader develops consensus on means used to attain goals, such as organization structure, division of labor, reward system, and authority system Leader develops consensus on criteria used to measure how well group fulfils its goals Leader develops consensus on the appropriate remedial or repair strategies to be used if goals are not being met Schein, Organizational Culture and Leadership, 2004

Leader establishes a shared understanding of core mission, primary task, and manifest and latent functions Correction Measurement Means Goals Mission & Strategy Leader may provide strategies tie the mission to the goals This is just management 101 but perhaps now you have a better understanding of the “why” behind the “what” of your organization’s behavior. Leader develops consensus on goals, as derived from the core mission Leader develops consensus on means used to attain goals, such as organization structure, division of labor, reward system, and authority system Leader develops consensus on criteria used to measure how well group fulfils its goals Leader develops consensus on the appropriate remedial or repair strategies to be used if goals are not being met Schein, Organizational Culture and Leadership, 2004

Leader establishes a shared understanding of core mission, primary task, and manifest and latent functions Correction Measurement Means Goals Mission & Strategy Leader may provide strategies tie the mission to the goals Now lets see how the organization aligns itself and integrates its internal functions to be successful adapting to their external environment. Leader develops consensus on goals, as derived from the core mission Leader develops consensus on means used to attain goals, such as organization structure, division of labor, reward system, and authority system Leader develops consensus on criteria used to measure how well group fulfils its goals Leader develops consensus on the appropriate remedial or repair strategies to be used if goals are not being met Schein, Organizational Culture and Leadership, 2004

Steps in Internal Integration
Explaining the Unexplainable Allocating Rewards & Punishments Developing Norms of Intimacy Distributing Power & Status Defining Group Boundaries Creating Common Language Group members create common language to communicate Group defines itself with respect to who is in, and who is out and by what criteria membership determined Group determines its pecking order, how members get, retain, and lose power Group works out its rules for peer relationships, for relationships between sexes, in the context of managing the organizations tasks  how the organization deals with subcultures Group defines what is heroic and sinful -- rewards and punishment Group that faces unexplainable events develops meaning so that members can respond to them Schein, Organizational Culture and Leadership, 2004

Sustainable Culture External adaptation survival Internal integration Correction Measurement Means Goals Mission & Strategy Explaining the Unexplainable Allocating Rewards & Punishments Developing Norms of Intimacy Distributing Power & Status Defining Group Boundaries Creating Common Language We have seen what it takes to get the various levels of culture aligned to attain a healthy culture. Now lets see what is required to sustain this alignment and balance.

Sustainable Culture (subcultures align)
Contractor Local Customer Head Office The most relevant model to describe the formation of culture is what the organization does to: Survive its adaptation to its external environment Adapted from Schein, Organizational Culture and Leadership, 2004

Production schedules are exciting events.
Sustainable Culture (subcultures align) Contractor Local Customer Head Office The most relevant model to describe the formation of culture is what the organization does to: Safety is a non-event. Production schedules are exciting events. The next level of safety improvement – sustainment - will be the most challenging Its what we do, not what we say. Survive its adaptation to its external environment Integrate its internal processes to ensure the capacity to continue to survive and adapt Adapted from Schein, Organizational Culture and Leadership, 2004

Organizational Challenges of Subcultures
Operator Culture No matter how good the engineering is, we have to deal with unpredictable contingencies Success of organization depends on us We have to learn and operate as a team Engineering Culture Nature can and should be mastered Operations should be based on science and technology People are problem – design out of system Executive Culture Without financial survival and growth, no service to shareholders Economic environment perpetually competitive Because of size of organization it becomes depersonalized and must be run by rules, routines, and rituals Schein, Organizational Culture and Leadership, 2004

Organizational Challenges of Subcultures
External to Plant Contractor Management Site Office Unions Internal to Plant Support Functions Manufacturing Maintenance Fire Dept Security Day Shift Night Shift Adapted from Schein, Organizational Culture and Leadership, 2004

Stages of Culture Maturity
Stage #1 - Organization sees safety as an external requirement and not as an aspect of conduct that will help the organization to succeed Accident Rates for Individual Accidents Susceptibility for Systems Accidents or Stage #2 Stage #2 - Management perceives safety performance as important even in the absence of regulatory pressure. Over the last 60 years or so: Stage #1: industry first reduced accident rates by improving: hardware (effective guards, safer equipment); Stage #2: then improved employee performance (selection and training, incentives and reward schemes) and, then Stage #3: changed the way they manage and organize – especially, by introducing safety management systems. Stage #4?: Does the next wave improvement come from organizational learning and safety culture improvement through HROs Our company has a good safety culture because: • Managers regularly visit the workplace and discuss safety matters with the workforce • The company gives regular, clear information on safety matters • We can raise a safety concern, knowing the company take it seriously and they will tell us what they are doing about it • Safety is always the company’s top priority, we can stop a job if we don’t feel safe • The company investigates all accidents and near misses, does something about it and gives feedback • The company keeps up to date with new ideas on safety • We can get safety equipment and training if needed – the budget for this seems about right • Everyone is included in decisions affecting safety and are regularly asked for input • It’s rare for anyone here to take shortcuts or unnecessary risks • We can be open and honest about safety: the company doesn’t simply find someone to blame • Morale is generally high Stage #3 Stage #3 - Organization has adopted idea of continuous improvement and applied the concept to safety performance. Murphy Margin Health and Safety Executive (HSE) Human Factors Briefing Note No. 7 “Safety Culture.” Safety Culture Maturity Model. ISBN

Organizational Learning
Work-as-Imagined vs. Work-as-Done

Manage the System, Not the Parts HRO Practice #1 Reduce Variability in HRO System HRO Practice #2 Foster a Strong Culture of Reliability HRO Practice #3 Learn & Adapt as an Organization HRO Practice #4 Knowledge of Knowledge

Manage the System, Not the Parts HRO Practice #1 Reduce Variability in HRO System HRO Practice #2 Foster a Strong Culture of Reliability HRO Practice #3 Learn & Adapt as an Organization HRO Practice #4 Generate decision-making info Tiered approach Refine HRO system

HRO Practices CFA Systems accidents can be avoided by proper
organizational design and management Manage the System, Not the Parts Reduce Variability in HRO System Foster a Culture of Reliability Learn and Adapt as an Organization CFA 95

The most important thing, is to keep the most important thing,
Central Theme of an HRO The most important thing, is to keep the most important thing, the most important thing. Steven Covey, 8th Habit Focus on what is important Measure what is important

Work-as-Imagined vs. Work-as-Done

Compliance-Based Performance
Gaps (∆) Provide Indication of Human Variability “What” Spectrum of Safety Hard Core Safety Physics Squishy People Part of Safety HRO “Engine” Break-the-Chain Framework Work-as-imagined Work-as-done ∆

Cultural-Based Assessments
Gap Provides Indication of Organizational Issues “Why” Determine by observing work Artifacts and Behaviors Misalignment hints at deeper underlying assumptions keeping the organization from attaining its desired balance between production and safety Work-as-done Determine by interviewing leadership Espoused Beliefs and Values Gap(∆) Work-as-imagined Below the surface Underlying Assumptions Underlying assumptions must be understood to properly interpret artifacts and to create change Schein, Organizational Culture and Leadership, 2004

Compliance-Based = “what” Cultural-Based = “why” Together = “organizational learning”

Five Tiers to Organizational Learning
Mechanics or “What” Did Not Work Right

Learn and Adapt as an Organization (5 Tiers of Organizational Learning)
Tier 4: Learn From Others’ Mistakes Tier 3: Causal Factors Analysis Tier 2: Tracking & Trending Tier 1: Daily Supervisor-Worker Interactions Tier 0: Startup HRO “Engine” Break-the-Chain Framework

Learn and Adapt as an Organization (Tier 0: Startup of New Processes)

Learn and Adapt as an Organization (Tier 1: Daily Supervisor-Worker Interactions)

Learn and Adapt as an Organization (Tier 2: Tracking and Trending)

Learn and Adapt as an Organization (Tier 3: Causal Factors Analysis)

Learn and Adapt as an Organization (Tier 4: Learn from Other’s Mistakes)
Tier 3: Causal Factors Analysis Tier 2: Tracking & Trending Tier 1: Daily Supervisor-Worker Interactions Tier 0: Startup HRO “Engine” Break-the-Chain Framework

Methods to Evaluate Organizational Culture
(A Measure of Effectiveness of the HRO Practices “Why” things are the way they are

Before Beginning to Assess Culture of Reliability
Organizational culture can be studied in a variety of ways The method one chooses should be determined by one’s purpose Just assessing culture is as vague as assessing personality or character in an individual Think of the assessment in terms of the problem you want to correct – start with the end in mind! Use the tools to get the information required to fix problem, not necessarily to fix the culture

Methods of Assessing Culture of Reliability
Direct observations of work place behavior Causal Factors Analyses or Root Cause Analyses Surveys Face-to-face interviews Review of key safety culture related processes Performance indicators VPP assessments Adapted from EFCOG Task Group on Safety Culture, 2008

Chronic Unease Dr. James Reason “If the price of peace is eternal vigilance, then the price of safety is chronic unease.” James Reason Managing the Risks of Organizational Accidents, James Reason

High Reliability Organization! Can your organization afford any less?
Some organizations have no choice except to be a High Reliability Organization! Can your organization afford any less? Back Next Previous Gallery Gallery 2

Should Your Business Be A High Reliability Organization?
Simply put, if your organization cannot recover from the consequences of a system accident in your operations, then consider learning and applying the concepts and practical application of high reliability.

Resources on High Reliability Organizations

High Reliability Operations Guide
Integrated organizational concepts of high reliability with proven science-based safety to produce a practical guide to become an HRO to protect Contains: Background on High Reliability Bad Signs of Normal Accidents Logical Safety Framework How Organizational Accidents Occur and How to Investigate Basis for Conducting CFAs Investigations Authors: Hartley, Tolk, Swaim Available through GPO

Causal Factors Analysis Handbook
An Approach for Organizational Learning Learn from Information Rich Events Folded high reliability concepts with systematic root cause investigation techniques to unveil underlying organizational contributors to prevent significant events Contains: Investigative Tools Step-by-Step Process Examples and Templates Method to Interpret Results and Provide Feedback to HRO Outline for Consistency Criteria for Quality Authors: Hartley, Swaim, Corcoran Available through GPO 116

Recommended Reading Material
The Limits of Safety, Scott D. Sagan Normal Accidents – Living with High-Risk Technologies, Charles Perrow Managing the Unexpected, Karl E. Weick & Kathleen M. Sutcliffe Managing the Risks of Organizational Accidents, James Reason Organizational Culture and Leadership, 3rd ed., Edgar Schein Field Guide to Human Error Investigations, Sidney Dekker The 8th Habit, From Effectiveness to Greatness, Stephen Covey Pantex High Reliability Operations Guide Pantex Causal Factors Analysis Handbook

QUESTIONS?

Want to learn more? Richard S. Hartley, Ph.D., P.E. Principal Engineer
B&W Pantex P.O. Box 30020 Amarillo, TX Janice N. Tolk, Ph.D., P.E. Manager, Applied Technology & R&D B&W Pantex P.O. Box 30020 Amarillo, TX

High Reliability Operations

Similar presentations

Presentation on theme: "High Reliability Operations"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

High Reliability Operations

Similar presentations

Presentation on theme: "High Reliability Operations"— Presentation transcript:

Similar presentations

About project

Feedback