27 March 2017 16th Annual HPRCT Conference June 21-25 · Sheraton Baltimore Inner Harbor co-sponsored by Constellation Energy and INPO Human Performance On the Horizon: HROs, Resilience Engineering, and Black Swans Tony Muschara, CPT January 25, 2010 The Certified Performance Technologist (CPT) designation is awarded by the International Society for Performance Improvement (ISPI) to experienced practitioners in the field of organizational performance improvement whose work meets both the performance-based Standards of Performance Technology and application requirements. For more information, visit www.certifiedpt.org

27 March 2017 BP Deepwater Horizon

27 March 2017

27 March 2017

Key Points Black Swans are rare, unpredictable, very severe events. 27 March 2017 Key Points Black Swans are rare, unpredictable, very severe events. High Reliability Organizations (HRO) enhance safety through optimizing reliability. Resilience Engineering (RE) improves safety by improving the occurrence of success. Safety is what an organization does. Reducing human failures is not the most efficient and effective way to improve human performance. Recognize system health as a primary means to improving the safety state of an organization.

Black Swan* Rare outside the bounds of known likelihoods 27 March 2017 Black Swan* Rare outside the bounds of known likelihoods Unpredictable unable to anticipate Severe unprecedented impact Event good or bad * Taleb, N. (2007), The Black Swan.

Notable Black Swan Disasters* 27 March 2017 Notable Black Swan Disasters* Challenger (7) / Columbia (7) Deepwater Horizon (11) Texas City (15) Chernobyl (>56) United 232 (108) Kansas City Hyatt (114) Piper Alpha (167) Herald of Free Enterprise (186) Tenerife (583) Bhopal (>2200) * Numbers in parentheses denote number of fatalities on each occasion.

High Reliability Organization (HRO) 27 March 2017 High Reliability Organization (HRO) HROs are “Organizations [that] operate under trying conditions yet perform relatively event-free over a long period of time, making consistently good decisions that result in high quality and reliable operations.” -- Karlene Roberts U.C. Berkeley Roberts, K. (2003), “HRO has Prominent History,” Anesthesia Patient Safety Foundation Newsletter, Vol. 18, No. 1, pp.1-16.

Resilience Engineering (RE)* Resilience – the ability to adjust its functioning to sustain operations during expected conditions and in the face of escalating demands, disturbances, and unforeseen circumstances Resilience Engineering – the tools that promote resilience: anticipate, monitor, respond, learn Erik Hollnagel Editor: Resilience Engineering Perspectives Volume 1: Remaining Sensitive to the Possibility of Failure * Nemeth, C. et al. (2009), Resilience Engineering Perspectives, Volume 2: Preparation and Restoration, p.117.

Karl Weick Co-author: Managing the Unexpected 27 March 2017 Five HRO Principles* Preoccupation with Failure Reluctance to Simplify Sensitivity to Operations Commitment to Resilience Deference to Expertise Karl Weick Co-author: Managing the Unexpected * Weick K. and Sutcliffe, K. (2007), Managing the Unexpected, 2nd ed. p.

27 March 2017 RE Cornerstones* Anticipate – knowing what to expect; long-term threats and opportunities Monitor – knowing what to look for; near-term developments and threats (critical steps) Respond – knowing what to do; capable of addressing expected and unexpected conditions Learn – knowing what has happened (experience) and what to change (improvement) * Source: Hollnagel, et al., Resilience Engineering, (2006), p.350, and Resilience Engineering Perspectives, Vol. 2, (2009), pp.117-133.

27 March 2017 Serendipity Limitations of Six Sigma and Lean manufacturing processes to adequately address inherent human variability—random and often unpredictable Difficulty in identifying and controlling the effects of social forces on information, its interpretation, knowledge, and action The inability to specify all threats, combinations, and responses, and the occurrence of human failures in all phases of the plant’s life cycle Multiple, concurrent human activities; dynamic, ambiguous environment; confounding number of system interdependencies Incomplete or inaccurate knowledge about the state of the system and the uncertain nature of resources, information, and time Impossible to chase and eliminate all latent weaknesses in a system. Entropy – things wear out

Intangibles – Sources of Uncertainty 27 March 2017 Intangibles – Sources of Uncertainty Trust Compassion Caring Dedication Fortitude Curiosity Honesty Wisdom Insight Courage Consensus Empathy Pride Interpretation Thoughts Motives Perceptions Feelings Collaboration Passion Understanding Creativity Craftsmanship Values Forgiveness Unity Perseverance Initiative Follow-through Integrity Meaning Effort Assumptions Beliefs Interpretations Fears

Drift and Accumulation* 27 March 2017 Drift and Accumulation* Expectations: Desired approach to work (as imagined) Hi Practices: Work as actually performed (allowed by mgmt!) Expectations Drift Violation Current Practice Safety Real Margin for Error Error Accumulation Inconspicuous and seemingly harmless buildup of unusual conditions, hazards, threats, and system weaknesses without warning Danger Hidden hazards, threats, unusual conditions, & system weaknesses Lo Time * Adapted from Dekker, S. (2007), The Field Guide to Understanding Human Error.

Latent System Weaknesses Accumulate! 27 March 2017 Be Aggressive! The causes of tomorrow’s events exist today! Latent System Weaknesses Accumulate!

Safety Space – Where am I?* 27 March 2017 Safety Space – Where am I?* Boundary: System Failure Boundary: Economic Failure Operating Point Administrative Safety Limit Boundary: Unacceptable Workload * Rasmussen, J. (1997), “Risk Management in a Dynamic Society: A Modeling Problem,“ Safety Science, 27(2/3), 183-213.

Studies on HROs and RE Commercial nuclear power Air traffic control 27 March 2017 Studies on HROs and RE Commercial nuclear power Air traffic control Wildland fire fighting Aircraft carrier operations Healthcare Armored military brigade Space shuttle Offshore platforms Rail and train operations Manufacturing Submarine operations

Principal Features of an HRO* 27 March 2017 Principal Features of an HRO* High-Hazard and Complex Activities High Technical Competence Hazard-Driven Adaptations Positive Design-Based Redundancy High Performance and Close Oversight Constant Search for Improvement High Pressures and Expectations for Reliability No Substitutes for Reliability Limitations on Trial-and-Error Learning Culture of Reliability Flexible Authority during Emergencies Mindfulness * Roe, E. and Schulman, P. (2008), High Reliability Management: Operating on the Edge, p.228-233.

Principal Features of RE 27 March 2017 Principal Features of RE Adaptability, Flexibility, and Capacity Dynamic Nature of System and Multiple Interdependencies among Components Dependency on Functioning of the Whole System Preparation and Sustainability Learning from Successes Sustaining Normal Functioning, not just Preventing Failures Resourcefulness and Redundancy Safety more than Reliability of Individual Components Safety – What an Organization Does Minimizing the gap between work-as-imagined and work-as-done

Are there any REAL Differences between HRO and RE? 27 March 2017 Are there any REAL Differences between HRO and RE? RE emphasizes adapting – to maintain success. HRO emphasizes reliability – avoiding failure. Fundamentally, the only difference is PERSPECTIVE! There are advantages from both.

Surprise! Thanksgiving Turkey Benefits Days 200 400 800 600 1000 27 March 2017 Thanksgiving Turkey 200 400 800 600 1000 Days Benefits Surprise!

Drift and Accumulation* 27 March 2017 Drift and Accumulation* Expectations: Desired approach to work (as imagined) Hi Normal Practices: Work as actually performed (allowed by mgmt!) Expectations Drift “Normal” Practice Safety Real Margin for Error Accumulation Inconspicuous and seemingly harmless buildup of unusual conditions, hazards, threats, and system weaknesses without warning Danger Hidden hazards, threats, unusual conditions, & system weaknesses Lo Time * Adapted from Dekker, S. (2007), The Field Guide to Understanding Human Error.

Chronic Sense of Uneasiness An attitude of mindfulness regarding one’s capacity to err and the presence of hidden threats; preoccupation with failure --how you perceive, think, feel, and behave toward hazards-- “When you stop being scared, you start making mistakes.” -- unknown

Efficiency/Thoroughness Trade-Off* 27 March 2017 Efficiency/Thoroughness Trade-Off* People routinely make a choice between being efficient (productive / less effort) and being thorough (safe / reliable), since it is rarely possible to be both at the same time. If demands for productivity are high, thoroughness is reduced until productivity goals are met. If demands for safety are high, efficiency is reduced until the safety goals are met. * Hollnagel. E. (2009), The ETTO Principle, Efficiency-Thoroughness Trade-Off.

Key Conclusions about HRO and RE 27 March 2017 Key Conclusions about HRO and RE Performance conditions are always imperfect: resources and time are finite, training and procedures are incomplete, and planning is approximate. The reliability of individual components or subsystems cannot always effectively predict how they combine to create novel pathways to failure. Safety is what you do, not what you have (continuous adaptation to changes and disruptions—core business). People create safety within inherently imperfect systems. It is difficult to do safety and production at the same time (trade-offs between time to think vs. time to do). Identifying and eliminating latent system weaknesses continuously offers the best route to improving system health. Organizations cultivate a capacity to adapt – preserve capacity, flexibility, reserves, and options and reduce volatile work situations.

27 March 2017 Suggestions Make boundaries explicit, and build a “preoccupation with failure.” Give people coping skills (adaptive capacities) at boundaries. When introducing change, 1) avoid introduction of local factors that intensify volatility for the front-line worker, (control) and 2) preserve local factors that support flexibility in off normal conditions (adaptability). Pay attention to: 1) avoiding human failures at critical steps, and 2) improving system health (arresting the accumulation of latent system weaknesses) Expand Hu management perspective from a myopic operational focus to an organizational focus. Monitor how you monitor system health and safety. Learn continuously – learn from successes, not just failures. Anticipate – Monitor – Respond – Learn

Multi-Tiered Approach – Finding LSWs 27 March 2017 Multi-Tiered Approach – Finding LSWs Reporting Observation and Coaching Self-Assessment and Trending Operating Experience and Benchmarking Causal Analyses “Eliminating latent [system weaknesses] is the most effective way to manage human error.” --Jop Groeneweg Author: Controlling the Controllable

Improving System Health (RE) 27 March 2017 Improving System Health (RE) Internal Methods External Methods Field Observations Post-job Reviews Reporting Self-Assessments Metrics and Trending Common Factor Analysis Surveys & Questionnaires Cause Analysis Effectiveness Reviews Operating Experience Benchmarking Independent Oversight

Local Factors (drivers) 27 March 2017 “Human Performance is its goal and its test.” --Peter Drucker “Management: Tasks, Responsibilities, Practices” Organization Management Systems Leadership Practices “We cannot change the human condition, but we can change the conditions under which people work.” --James Reason “Managing the Risks of Organizational Accidents” Local Factors (drivers) Human Performance

Effort vs. Importance* Effort Expended Importance Currently Actual 27 March 2017 Effort vs. Importance* Effort Expended Importance Latent System Weaknesses Human Failure Equipment Failure Currently Actual * Adapted from Kletz, T. (2001), An Engineer’s View of Human Error (3rd ed.); p.127..

Avoiding the Black Swan 27 March 2017 Avoiding the Black Swan Be skeptical about confirmatory data. Worry less about small failures, and more about large, potentially terminal ones. Worry more about matters that lie outside beyond our consciousness. Worry about matters you can do something about. Be very conservative when exposed to the threat of a negative Black Swan. “It is more difficult to be a loser in a game you set up yourself. …this means that you are exposed to the improbable only if you let it control you. You always control what you do.” --Nassim Taleb Author: The Black Swan

Questions and Comments 27 March 2017 Questions and Comments 4724 Outlook Way Marietta, Georgia 30066 678-665-2095 tmuschara@muschara.com http://www.muschara.com