Moving from Safety-I to Safety-II Symposium on HF &E in Health Care 12 March 2013 Moving from Safety-I to Safety-II Robert L Wears, MD, MS, PhD University of Florida Imperial College London 20 minutes! + 10 for Q&A ?requisite variety of mental model???

motivation general agreement that we are not making progress on safety as fast as we would like we have not been ‘Protestant enough’ more rigour (eg, EBM) greater accountability two possibilities not enough rigour (EBM), not working hard or conscientiously enough (accountablity) interesting to think about what’s NOT being said

motivation general agreement that we are not making progress on safety as fast as we would like wrong mental model of safety “… enduring Enlightenment projects “… rationality can create a better, more controllable world “… taken for granted by safety researchers b/ it appears so ordinary, self-evident and commonsensical.”* two possibilities -- note this reprises the fundamental attribution fallacy – we attribute failings to individual attributes, not situational ones not enough rigour (EBM), not working hard or conscientiously enough (accountablity) *Dekker 2012

“A scientific paradigm suppresses the perception of data inconsistent with the paradigm, making it hard to perceive anomalies that might lead to scientific revolution.”

effect of mental models 11 year lag in discovery of Antarctic ozone hole Meadows, Meadows, Randar 1992

patient safety orthodoxy technocratic, instrumental, ‘measure-and-manage’ approach myopic – failing to question underlying nature of problems overly simplistic – transferring sol’ns from other sectors negligent of knock-on effects of change “glosses over the complexities of health care organisation and delivery”

view from safety-I accidents come from erratic acts by people (variability, mistakes, errors, violations) study, count accidents to understand safety (tend to look backwards) focus on components safety is acquired by constraining workers via: standardisation, guidelines, procedures, rules, interlocks, checklists, barriers Taylor, Deming, Shewhart Toyota sacred texts – and sacred myths

assumptions in safety-I our systems are well-designed and well-understood procedures correct and complete systems are basically safe, well-protected reliability = predictable, invariant variation is the enemy safety is an attribute (something a system has) conditions are well-anticipated, well-specified unarticulated assumptions anticipatory model – an adjective

view from safety-II accidents are prevented by people adapting to conditions study normal work to understand safety (tends to look forward) focus on inter-relations aim is to manage, not eliminate, the unexpected safety is enacted by enabling workers via: making hazards, constraints, goal conflicts visible enhancing repertoire of responses Rasmussen, Woods, Hollnagel Three Mile Island, Tenerife good example is NASA’s ‘scheduled hold’

assumptions in safety-II our designs are incomplete, procedures out-dated our systems are poorly understood systems are basically unsafe reliability = responsiveness variation is necessary safety is an activity (something a system does) possible failure modes have not been anticipated ‘continuing expectation of surprise’ a verb

safety-II healthcare STS intractable, underspecified, variable demands resources (time, people, material, information) limited, uncertain workers adjust to meet conditions creating variability adjustments always approximate (b/ resources limited) “Knowledge and error flow from the same mental source; only success can tell one from another.” Ernst Mach, 1905 approximate adjustments usually reach goals, make things go safely approximate adjustments sometimes fail, or make things go wrong

safety-I vs safety-II summary defined by its opposite - failure well designed & maintained, procedures correct & complete people (ought to) behave as expected & trained accidents come from variability in above therefore safety comes from limiting & constraining operators via standardization, procedures, rules, interlocks, barriers critical inquiry defined by its goal - success poorly understood, incomplete, underspecified people (ought to) adjust behaviour & interpret procedures accidents come from incomplete adaptation therefore safety comes from supporting operators via making boundaries, hazards, goal conflicts visible, enhancing repertoire of responses appreciative inquiry not either-or, rather both-and

philosophical bases safety-I safety-II linear, proportional, tractable behaviour explained by reduction positivist, Taylorist cause-effect simple, oneway controllable ‘the one best way’ values declarative, technical knowledge complicated problems techne, episteme non-linear, non-proportional, intractable behaviour explained by emergence constructivist, interpretivist cause-effect multiple, reciprocal influence-able equifinality, multifinality values practice, tacit wisdom ‘wicked problems’ mētis, phronesis program of technical rationality

why safety-II? “The real trouble with this world of ours is not that it is an unreasonable world, nor even that it is a reasonable one. The commonest kind of trouble is that it is nearly reasonable, but not quite. Life is not an illogicality; yet it is a trap for logicians. It looks just a little more mathematical and regular than it is; its exactitude is obvious, but its inexactitude is hidden; its wildness lies in wait.“ G K Chesterton, 1909

why safety-II?

better fit with modern theories of accidents why safety-II? better fit with modern theories of accidents 1940 1960 1980 2000 simple, linear, chain of events complicated, interdependent complex, nonlinear, coupling, resonance, emergence

why safety-II? resilience, ‘margin for maneuver’, buffers, tradeoffs all “hidden in the interstices of complex work” focus on how ordinary work goes right less likely to inadvertently damage these hidden resources

empirical support direct observations of CV surgery surgeons w/ best results had just as many untoward events as those w/ worst but they had better means of detection greater repertoire of responses de Leval 2000 de Leval, Carthey, et al 2000

fundamental ideas not new Ernst Mach (1903) Charles Perrow (1984) Jens Rasmussen (1990, 1997) Gary Klein (1989ff) Gene Rochlin (1987, 1999) Paul Schulman (1993, 2004) Amalberti (2001) Hollnagel et al (2006ff) Berwick (2003)

from st donald in fairness, other remarks in the piece suggest Berwick hasn’t fully adopted this position, or at least shrinks a bit from its full implications. But I think he would agree with me in saying that healthcare as overlearnt a particular epistemology to the exclusion of other more useful understandings. Berwick, 2003

what makes safety-I persist? not despite the fact that it’s wrong, but precisely because it is wrong, wrong in particularly useful ways simple explanations illusion of control, ontological security removes managers, organisations from line of fire fits positivist, biomedical model ‘the nurse failed to notice …’ failure comes from aberrant people / devices, so remove, control them refitting, reorganising expensive, so re-train instead Enlightenment ‘program of technical rationality’

why HFE is a good fit for safety-II multiple philosophies of science admissible expertise in unpacking the mundane judicious valuing of practice ‘requisite variety’ of views, tools work as imagined vs work as done

perceive the invisible Insp G: Is there any point to which you would wish to draw my attention? SH: To the curious incident of the dog in the night-time. Insp G: The dog did nothing in the night-time. SH: That was the curious incident … Inspector Gregory Laura, typicality Conan Doyle, 1893

what is needed to move forward? requisite variety mental models, theories, skills, people critical mass sustained co-presence

ACEP2007 complex, adaptive, joint cognitive system where information and work is shared across people and physical and social artefacts (tools, procedures). May not be as integrated as Hutchins’ JCS of a bridge navigation, where there is no ‘spot’ where the calculation occurs, but still very similar

contact information Robert L Wears, MD, MS, PhD wears@ufl.edu r.wears@imperial.ac.uk +1 904 244 4405

empirical support NSQIPS study hospitals w/ lowest mortality had just as many complications as those w/ worst but they had earlier recognition better responses Ghaferi 2009 de Leval, Carthey, et al 2000

“Any argument for the safety of a design that relies solely on pointing to what has worked successfully in the past is logically flawed.” John Roebling

sorting out the two views resilience vs orthodox approach exploration vs exploitation prescriptive vs adaptive guidance homo- vs hetero-geneous processes centralized vs distributed control organic, evolutionary vs engineered, managerial

when HF and healthcare meet