Safety Culture_BacktotheBasics _Version 2008.06

8/14/2019 Safety Culture_BacktotheBasics _Version 2008.06

1/53

Safety Culture Back to the Basics, Version 2008.06, 11/11/2008

Safety Culture Back to the BasicsWilliam R. Corcoran, PhD, PE

Nuclear Safety Review Concepts [email protected]

ABSTRACT

This paper addresses culture in the anthropological sense and treats safety culture as a subset of culture.

Descriptions, examples, and other devices are used to illustrate and emphasize the concepts. Improving safety

culture is addressed.
mailto:[email protected]:[email protected]:[email protected]


2/53


CONTENTS

ABSTRACT .................................................................................................................................................................1

CONTENTS.................................................................................................................................................................2

INTRODUCTION .......................................................................................................................................................4

What is Culture? .......................................................................................................................................................4

Examples and Experiments.......................................................................................................................................6

DESCRIPTION OF CULTURE ................................................................................................................................6

Shared Mental Content .............................................................................................................................................8

Norms........................................................................................................................................................................8

Institutions ..............................................................................................................................................................11

Characteristic Physical Items.................................................................................................................................11

The Importance of Culture......................................................................................................................................12

Acculturation ..........................................................................................................................................................13

DESCRIPTION OF SAFETY CULTURE..............................................................................................................13

Safety Culture .........................................................................................................................................................13

Safety Culture vs. a Culture of Safety .......... ........... .......... ........... ........... .......... ........... ........... .......... .......... ........... .14

Shared Mental Content ...........................................................................................................................................15

Norms......................................................................................................................................................................15

Institutions ..............................................................................................................................................................16

Characteristic Physical Items.................................................................................................................................17

The Results of Good Safety Culture ......... ........... ........... .......... ........... ........... .......... ........... .......... ........... .......... .....17

Default vs. Managed Safety Culture .......... .......... ........... ........... ........... .......... ........... ........... .......... ........... .......... ...18

What Drives Safety Culture? ..................................................................................................................................18

Dysfunctional Safety Culture Not a Root Cause .......... ........... .......... ........... .......... ........... ........... .......... ........... ......19

Safety Culture and Compliance ..............................................................................................................................19

Measuring and Describing a Safety Culture ...........................................................................................................20

Testing Observations for Safety Culture.................................................................................................................20


3/53


Institute of Nuclear Power Operations (INPO) .......... .......... ........... ........... .......... ........... .......... .......... ........... ........23

Dr. Thomas E. Murley ............................................................................................................................................24 Professor James Reason.........................................................................................................................................24

Professor Edgar Schein ..........................................................................................................................................25

The U. S. Nuclear Regulatory Commission ............................................................................................................25

The Center for Chemical Process Safety ................................................................................................................26

APPLICATIONS OF SAFETY CULTURE CONCEPTS.....................................................................................26

USNRC....................................................................................................................................................................26

WALKING THE TALK ...........................................................................................................................................28

IMPROVING SAFETY CULTURE........................................................................................................................28

Assessing Your Own Safety Culture........................................................................................................................28

Improving a Good Safety Culture ...........................................................................................................................28

Establishing a Good Safety Culture........................................................................................................................29

LOW HANGING FRUIT..........................................................................................................................................29

PRELIMINARY CONCLUSIONS..........................................................................................................................29

Appendix A.................................................................................................................................................................31

Conflicts Between Observed/ Inferred Cultural Attributes and Functional Safety Culture....................................31


4/53


a

INTRODUCTION

"When mores (cultural norms) are sufficient, laws are unnecessary, but when mores are insufficient, rulesare unenforceable1."-Sociologist Emile Durkheim

Durkheim certainly rings true here.

We are what we repeatedly do. Excellence, therefore, is not an act but a habit.-Attributed to Aristotle

A habit is to an individual as culture is to a group.

The views in this article are based on logic and on the anthropological notion of "culture2." This is not intended tobe creating anything new, but merely developing existing ideas. The reader should expect to see in this discussiondescription of culture, a description of safety culture as a part of culture, some ideas on the importance of culture,and some ideas on determining what the safety culture is in a defined group. Also we have a section on other viewsof culture and safety culture.

The reader should be aware that this article relates primarily to the safety culture of large organizations in the high

hazard industries, e.g., power production, extraction, refining, transportation, health care, law enforcement,construction References to other types of organizations are for analogy only.

What is Culture?

TheAmerican Heritage Dictionary defines culture as the totality of socially transmitted behavior patterns, arts,beliefs, institutions, and all other products of human work and thought, and also as the predominating attitudesand behavior that characterize the functioning of a group or organization.

A minor problem with this definition is that it implies the obligation to determine what is socially transmitted andwhat is transmitted by other channels, e.g., genetics. In this work we do not distinguish culture from non-culture byhow it came to be.

The classic view of culture is that it includes1. Values2. Norms3. Institutions

4. Artifacts

3

(things people make and use, e.g., structures, equipment, forms, procedures, signs, equipment,etc.)

In a nutshell the set of culture differences is that which distinguishes one group from another.

Culture is to a group as character is to an individual.

A single observation in a group is to its culture as one weather observation is to climate.


5/53


Thus a broader point of view would offer that culture is made up of1. Shared mental content

2. Norms3. Institutions44. Characteristic physical items5 ( e.g., structures, equipment, forms, procedures, signs, equipment, etc.)

Figure 1 The Elements (or Components) of Culture

One might ask if the broader view is compatible with the dictionary definition. To explore this we present a table(matrix) correlating the terms from the dictionary definition to the anthropologically derived elements of culture.The table can be read focusing on the terms from the dictionary definition, i.e., asking for each dictionary definitionterm what culture elements relate. The table can also be read the other way around, i.e., asking for each elementwhat dictionary definition terms relate. Both methods show the expected reconciliation.

The broader view is fully reconciled with the dictionary definitions as shown in the following table. In particular:

Behavior patterns are norms.

A t i l h i l it ll th i tit ti l t f h th d d


6/53


Predominating attitudes are a class of mental content.

Predominating behaviors are norms.

Thus the broader view is shown to be reconciled with the dictionary definition.

Dictionary Definition vs. Broader View

DICTIONARY BROADER VIEW

Term 1. MentalContent

2. Norm 3. Institutions 4. PhysicalItems

Comment

Behavior Patterns Match ReconciledArts Match Match ReconciledBeliefs Match ReconciledInstitutions Match ReconciledProducts of Work Match ReconciledProducts ofThought

Match Match Reconciled

PredominatingAttitudes

Match Match Reconciled

PredominatingBehaviors

Match Reconciled

Examples and Experiments

Example 1: If an organization routinely did extensive pre-job briefs with all members of the work team that wouldbe a norm. But if a work team did a short perfunctory pre-job brief with a member missing in order to catch up onthe schedule that would be an aberration. (But it might be the norm when schedule pressure is part of the situation.)

Example 2: If observers spend twenty-four continuous hours in a facility control room and note that most of the timewhen an alarm annunciates an operator consults the appropriate alarm response card, then using alarm responsecards is part of the culture (a norm).

Example 3: A large government organization that has a good safety record, but a poor quality record starts everymeeting with a safety discussion, but does not start meeting with a quality discussion. The safety discussion at thestart of every meeting is a norm. And short-changing quality is also a part of their culture.

Experiment 1: Think about two commercial companies that you have done business with, say U.S. Airways and

Southwest Airlines. Write down the differences in categories 2, 3, and 4 above. (Category 1 will be troublesomebecause it is much less accessible that the other three.)

Experiment 2: Think about two distinctive cultures that you participate in; for example, that of your family of originand your spouses family of origin. Write down the differences in categories 2, 3, and 4 above. (Category 1 will betroublesome because it is much less accessible that the other three.)


7/53


This section provides a descriptive grounding in how to recognize what makes up culture. It separately deals withmental content, norms, institutions, and physical items. Of course, each of the four affects the other three. For

example, the norms are affected by the reward system, which is an institution and the reward system itself wasaffected by mental content, e.g., beliefs about what people should be rewarded for.

Formal and Informal Parts of Culture

Formal

Name

Informal Characterization

MentalContent

How we think around here.

Norms What we do around here.

Institutions How things get done around here.Physical

Items

What one runs into around here.

The following matrix indicates some of the interactions among the parts of culture. This matrix isto provide an idea of the richness of the interaction.

Cultural Inter-relations Among Elements

(The Element in the Left Hand Column affects the Element in the Other Columns as shown inthe Cell.)

Affecting Element Mental Content

(MC)

Norms Institutions Physical Items (PI)

Mental Content

(MC)Stabilizes andnarrows MC.

Drives norms. Drives norms. Affects thebehavior thatproduces andmaintains PI.

Norms Shape MC bymodelingacceptable MC.

Stabilize andnarrow norms.

Drive the normsof theinstitutions.

Affect thebehavior thatproduces and

maintains PI.Institutions Shape MC by

modeling andreinforcing it.

Stabilize andnarrow norms.

Stabilize andnarrowinstitutions, e.g.,themselves.

Affect thebehavior thatproduces andmaintains PI.

Physical Items (PI) Shape MC and Stabilize and Affect the Affect the


8/53


Shared Mental Content

Shared Mental Content consists, in part, of beliefs, values, cognitive models, unwritten rules, attitudes, prejudices,mental short-cuts, rules-of-thumb, skills, accepted fallacies, tribal knowledge, paradigms7, heuristics8, etc. It is all ofthose identifiable mental items that are generally shared by the members of the group.

For example, some communities share a belief in "the Golden Rule." This would be shared mental content.

Another mental content example would be The customer is always right. This was at one time prevalent inhandling customer complaints. When put into practice this would be a norm. If it were written down in an employeetraining course it would also be a physical item.

Another example of shared mental content would be the industrial operations mantra of Stop-Think-Act-Review(STAR) that is a model for what one might hope is a prevalent mental approach to conducting operationalmanipulations.

One potential intuitive definition of a very robust culture might be the synchronized mental content of a group. Itappears that the more robust a culture the more completely synchronized the mental content of the individualmembers.

One of the functions of culture is to synchronize the shared mental content. One of the ways of synchronizing theshared mental content is by punishing, even rejecting (firing, excommunicating, ostracizing, deporting, exiling)members who do not synchronize their mental content with the shared mental content of the culture.

In system dynamics the term "mental model" is often used. Its implications would are useful here. Mental modelgoes to a shared understanding of the dynamics of safety culture, including all the ways one's actions can impact onsafety culture over time from an overall systems perspective. By including these dynamics in mental content, peoplewould not only share beliefs, but would have a common basis for knowing what actions to take to manage safetyculture and what to expect from those actions9.

Norms

In this context a "norm" is the behavior that is usually encountered in a specified situation. The above example ofdoing pre-job briefs is a norm. Norms can be observed and recorded. Most of them can be either videotaped oraudiotaped. On the other hand mental content cannot be observed directly and there is not always a one-to-onemapping of mental content to observable effect.

Anecdotal evidence suggests that mental content is a strong influence on norms. The psychology pioneer WilliamJames has been quoted as saying Thinking is for doing. The psychotherapy pioneer Fritz Perls has been quoted assaying Thinking is rehearsing. But the norms themselves are what are available for observation. But the mentalcontent is not available for observation.

Norms are the behaviors normally and usually encountered in identifiable situations, e.g.Situation: Before starting a jobBehavior: Conducting a pre-job brief


9/53


Language

It may well be that a common language is a foundation norm for a culture, since language is a key medium fortransmitting mental content, norms, institutional processes, and written physical items.

The language of a large city hospital will sound very strange to a new patient who has not previously spent time inone. But, I am told, the language of one large city hospital in the United States is pretty much like any other. Whatwould it say about the safety culture of a hospital whose language norms were different from other similar hospitals?

Language includes vocabulary, formality, uniformity, lingo, jargon, and the like.

It would be easy to argue that the use of a particular language would be both mental content and a norm. When thelanguage is written it is revealed as a physical item.

Norms and Morality

Recent research in the field of Moral Psychology11 has reactivated interest in the views of sociologist EmileDurkheim that morality binds and builds; it constrains individuals and ties them to each other to create groups thatare emergent entities with new properties.

A moral community has a set of shared norms about how members ought to behave, combined with the means for

imposing costs on violators and/or channeling benefits to cooperators.

Even the means for imposing costs and/or channeling benefits can be norms, as people who grew up in largefamilies or tight neighborhoods may have observed. In this sense the norms are self-reinforcing. In the extreme thesenorms can include ostracizing individuals whose behavior is at odds with the norms.

The following table gives an introduction to the work in this area. The columns are labeled with what are sometimescalled The Five Pillars of Morality.


10/53


One of the research challenges is to explore how one pillar trumps another. For example, under what circumstancesdoes Ingroup/ Loyalty orientation tend to keep members who know of wrongdoing or safety infractions in theorganization from reporting it in accordance with their commitment to Harm/ Care and Fairness/ Reciprocityconcerns? Recent personnel inattentiveness issues and record falsification issues at nuclear power plants makes thisof more than academic interest.

Other Norms

The STAR (Stop-Think-Act-Review) approach, if done with self-narration and/or gesturing, would be an observablenorm.

In the communications in the aircraft flight deck and between the aircraft and flight controllers the NATO PhoneticAlphabet (Alpha, Bravo, Charlie) is used. This is an observable norm. This norm is not observed consistently bynon-pilot airline employees, not even by those who could reduce error rates by doing so.


11/53


Some norms are hierarchical or rank-based, i.e., they apply to some levels of the organization, but not others, e.g.,executives eat in a special dining room. Some norms are classification-based, e.g., salaried professionals do not

punch a time clock.

Institutions

This article deals mainly with the cultures of large organizations. In this context, institutions are the sub-organizations and processes by which a group does its activities. For example, the Plains Indians in the earlynineteenth century in the U. S. West harvested North American bison (buffalo) by the institution called the "huntingparty."

As another example, medieval cities controlled craft training and quality by an institution called the Guild. Incolonial America immigration and labor supply were supported by an institution called indentured servitude.

The government of the United States collects much of its taxes by an institution called the "Internal RevenueService." In New England many communities still make important decisions by means of an institution called theTown Meeting, whose name has been borrowed for less formal purposes and to romanticize political gatherings.

Some parts of the high hazard industries have Corrective Action Programs for formally processing problems andimprovement opportunities. These programs are institutions that are part of the culture.

Some organizations that have Corrective Action Programs also have other institutions called Corrective ActionReview Boards tasked to supervise the Corrective Action Program. Since the members of the Corrective ActionReview Boards (CARBs) are often managers whose budgets must absorb corrective actions they sometimes tend tohold the output of the Corrective Action Programs to modest standards of effectiveness. One of the effects of aCARB is to narrow the range of what is acceptable by the CARB itself. Those who appear before the CARB soonlearn what will fly and what will be rejected.

In high hazard industry organizations there are hundreds of institutions that are recognized as programs. Each ofthese is a separate institution. Some of these are: configuration management, drawing update, plant labeling,

industrial hygiene, hearing protection, employee concerns, employee assistance, maintenance expert panels

In summary, it is fair to include at least the following in institutions:

Named subgroups, e.g., town council, capital project review committee, CARB

Named processes, e.g., land use review hearing, wedding, operational readiness review

Named gatherings, e.g., post-event stand down meeting, plan-of-the-day meeting

Named programs, e.g., in-service inspection program, quality assurance program, operational experienceprogram

Named positions, e.g., town manager, chief engineer, certified safety professional, root cause team leader,

radiation safety officer

Characteristic Physical Items

Characteristic physical items are those tangible entities that are found in a culture. These items have a variety oforigins and purposes, but all are characteristic of the culture. For example, most of the known Native American


12/53


prompting such irreverent terms as Management by Lamination. These cards are characteristic physical items. Butthe wearing of them would be a norm.

In modern U. S. culture we encounter tattoos, facial jewelry, cellular telephones and iPods. Of course, other moderncultures share those characteristic physical items, but cultures that share them are different from those that don't.

In modern U. S. culture most public meeting rooms have the American flag on the left and the state flag or the flagof the organization on the right. These are characteristic physical items.

Physical items affect behaviors and thereby affect norms. For example, if pre-job briefs are conducted in hot, noisy,dusty rooms the pre-job briefs will be short and probably incomplete. If management wants to reduce the time spenton pre-job briefs they can accomplish this by changing the physical situation.

A favorite characteristic physical item from oriental cultures is chop sticks. Their use is a norm. The hibachi mealcould be considered to be an institution.

Other physical items that affect norms are speed bumps and rumble strips. They tend to generate norms consistentwith safe driving. This is consistent with Senges insight that structure influences behavior12.

The Importance of Culture

One of the important effects of culture is its use to encourage (sometimes coerce) conformity of its members.Culture enables members of the culture to differentiate themselves from non-members. Culture can create a bonding(or binding) of members of the culture.

Persons within a culture who deviate from it are called renegades, outlaws, heretics, apostates, "weirdoes,"aberrants, and the like. Some cultures include within the culture the harsh treatment of those who deviate from theculture. These persons are often called aberrants.

For several centuries certain aberrants were treated with severe harshness in both Europe and America. In Europe

this was done by an institution called The Holy Inquisition and in America this was most famously illustrated bythe institution now known as the Salem Witch Trials.

A famous aberrant was Henry David Thoreau, who was jailed for not paying a tax to support government policies heobjected to. Another was the abolitionist John Brown. A widely admired aberrant was John Chapman (aka JohnnyAppleseed). President Teddy Roosevelt was a celebrated aberrant with many emulators. A less admired aberrant wasDr. Timothy Leary.

In cultures that put loyalty above other values whistleblowers are treated as aberrants. They are called rats,

snitches, dime droppers, and the like. The revulsion of this type of aberrant is probably related to the moralstrictures of loyalty as an overriding value, as discussed by Haidt, in the article mentioned above. Apparently,wrong-doers and corner-cutters exploit this moral stricture.

Strong cultures have strong compliance effects on their members. In the U. S. naval submarine service peer pressureto comply with the cultural norms is reported by some to have had a beneficial effect on the performance of thecrew.


13/53


ore clearly.

Individuals must assimilate (adopt and conform to the culture) to "get ahead" in a culture. Refusal to assimilate orbeing unable to assimilate the culture is almost certain to be a "career limiting" trait. One suspects that many

conscientious whistleblowers are not assimilated. Daniel Ellsberg comes to mind.

Strong culture will either coerce compliance or will reject the aberrant. Read Hawthorne's novel "The Scarlet Letter"for example. Other good examples are the lives of Roger Williams, Anne Hutchinson, Martin Luther, Martin LutherKing, Jr., and Hyman G. Rickover, to name a few. Those who do not adopt the culture can succeed by understandingit and exploiting its idiosyncrasies, if they are not ostracized by those who do adopt the culture.

Acculturation

Acculturation is the process of converting a non-member of the culture to being a member of the culture. We are notborn with the mental content and norms of a member of our parents' culture. We are acculturated by our parentschild rearing processes and by our contact with schools, faith communities, sports teams, etc.

Similarly people who are introduced to an organization from the outside must be acculturated in some way. Thearmed services have basic training (boot camp) for this purpose. Some schools and colleges have orientationweek. Most high hazard industry organizations have general employee training for this purpose. Someoccupations do this by apprenticeships and internships.

Interestingly, the acculturation process of a culture is part of the culture. It is one of the "institutions." Whenobserving a culture one of the lines of inquiry would be how the culture acculturates new members.

A problem in parts of the high hazard industries is the use of contractors within the facility since the contractorshave not been acculturated. Sometimes contractors are given work that would be slowed down if done by the facilityworkers with their careful safety culture.

When a culture has been condemned, e.g., by OSHA 13 or the CSB14, the whole organization must be re-acculturated. This is often done by bringing in new leadership from the outside. This new leadership has not beenhabituated to the previous culture and therefore is expected to be able to see its dysfunctionality m

DESCRIPTION OF SAFETY CULTURE

Safety Culture

Simply put, safety culture is that part of culture that relates to safety. It is the subsets of the following that relate tosafety:

1. Shared mental content2. Norms3. Institutions4. Characteristic physical items (i.e., things people make, have, use, or respond to, e.g., forms, procedures,signs, equipment, etc.)

A Venn Diagram of culture would have a totally enclosed smaller area labeled safety culture.


14/53


Figure 2. Safety Culture is part of Culture

Notice that, logically speaking, an element of safety culture can be either functional, i.e., supporting and reinforcingthe function called safety or dysfunctional, i.e., undermining and discouraging safety15. As long as a part of theculture affects safety it is part of the safety culture.

All organizations have cultures and all have subsets that make up safety cultures16. There is as much variety insafety cultures as there is in cultures. Near the ends of the spectrum are the safety cultures of street gangs and thesafety cultures of nuclear aircraft carriers.

Recently safety culture has been illuminated by high level reviews such as the Baker Panel review of BP refineriesafter the Texas City explosion17. The Baker Panel emphasized the shared aspects of safety culture.

Safety Culture vs. a Culture of Safety


15/53


At the risk of seeming to quibble, we distinguish between a safety culture, that every group has, for better or forworse, and a culture of safety18, which is achieved only by the admired few organizations. Safety Culture, as

used in this paper is a subset of culture, but a culture of safety is a culture in which the shared mental content, thenorms, the institutions, and the physical objects all aim appropriately at safety.

Shared Mental Content

The shared mental content is inherently inaccessible. Some of it can be inferred from behaviors (including speechand writing), institutions, and physical items.

There is much effort to measure shared mental content by taking opinion surveys. The results of these should be

taken with extreme skepticism for a variety of good reasons. This is not to say that all opinion surveys are useless ormisleading.

The first reason to suspect opinion survey results is that the respondents may not be candid. All but the simple-minded know what the right answers are. The opinion survey does not measure what people have in their heads itmeasures what they put down on paper. They only put down what they are willing to put down. The common senselegal principle of best evidence19 motivates against relying on opinion surveys when field observations areavailable.

The survey respondents that wish to support management give the right answers to help management, perhaps byhelping "get the keys back" from the government regulator. The respondents that do not support management mightknow that they can "get back at management" by giving answers that indicate a dysfunctional safety culture.

This lack of candor may not be entirely voluntary. Could peers give suggestions as to how the survey questionsshould be answered? How about immediate supervisors or bargaining unit leadership?

Common organizational phenomena20 affect survey responses as well as other organizational attributes. Some of theones that can affect the validity of survey results are Cognitive Dissonance Reduction, Frog Boiling,Normalization of Deviance, Habituation of Risk, Risk Homeostasis, The Unrocked Boat, conflicts of interest, and

the like.

Another factor that is thought to affect culture survey results is the recentness of management initiatives affectingthe work force. These include downsizings, mergers, acquisitions, reorganizations, management shufflings, benefitchanges, and the like. When a culture survey is taken just after a severe safety event or a severe regulatoryintervention the culture survey results can be skewed by the respondents feelings of guilt, remorse, and atonement.

It is far more reliable to back out the mental content from observations of behaviors, institutions, and physical items.In addition, when the observations of behaviors, institutions, and physical items are inconsistent with the culture

survey results, the survey results should be suspected first. Survey results not corroborated by observations ofbehaviors, institutions, and physical items are on shaky ground at best.

Another concern with safety culture surveys is that they are interpreted as elections, i.e., whatever is chosen by amajority is taken to be the culture. For example, even a small number of people who say that they do not reportsafety concerns would not be tolerated in a strong safety culture. Similarly, having a small number of employeeswho say that their supervisor tolerates unsafe acts to meet schedules would be unacceptable.


16/53


The part of culture that is of extreme importance to safety is the set of normally encountered behaviors in definedsituations. This is what strongly affects the actual achievement of systems, structures, and components (SSC) to

"perform satisfactorily in service21

", i.e. to do what they are supposed to do under the conditions that they need to doit in and to prevent subjecting them to challenges for which they are not suited.

An observer can find out what this part of the safety culture is at a nuclear power plant (NPP) by watching foridentifiable situations and noting the normally encountered behavior.

For example, the uniform use of the (NATO) phonetic alphabet22 to avoid communication mix-ups would be asafety culture norm. Another common safety culture norm is the use of repeat-backs and confirmations known asthree part communication23.

As an example of a dysfunctional norm related to safety culture there was a two-unit nuclear power station at whichthe norm in discussing components was to leave off the unit designation. This was discovered during theinvestigation of a wrong unit mix-up.

Also, at the same station there was a dysfunctional safety culture norm of not reporting non-consequential wrongunit mix-ups. In other words, if personnel intended to act on one unit, but found themselves in the other unit, theywould not report the mix-up unless it resulted in a self-revealing event.

Every dysfunctional behavior identified in the investigation of an event can be either part of the culture or an

aberration. The investigators cannot tell without determining the extent of the behavior. If it is ubiquitous or nearlyso it is part of the culture. It is a nom. Otherwise it is an aberration, i.e., an island of inconsistency.

Institutions

As part of safety culture, institutions include the sub-organizations, programs, and processes by which a group doesits activities involved with safety. These include procedure writing, procedure upgrading, work planning, workscheduling, etc. Also included are the condition screening function, the root cause analysis function, the conditiontracking function, etc.

The safety culture institutions also include oversight institutions. These include the corrective action review board,the plant operations review committee, the quality assurance function, the offsite safety review committee, theoperator training program review group, etc.

With respect to safety culture a given institution can be functional or dysfunctional. For example, in the yearsbefore the 2002 Davis-Besse Reactor Vessel Head Degradation near miss loss of coolant accident all of thepreviously mentioned institutions, both individually and jointly, failed to connect the dots to see that a serioussafety threat was developing.

Sitting through the meetings of some of these institutions or those of its overseers can yield insights into the safetyculture. Do they promote and reinforce good safety culture in the overseen functions? Do they focus on achievingsafety or on being "bullet-proof?"

Especially Important Institutions


17/53


The Selection-Promotion-Succession System

The selection-promotion-succession system determines what types of persons are in positions of all kinds, includingthose whose activities are part of the safety culture and those whose activities influence the safety culture. Thissystem is expected to deliver into each position a person who shares the safety culture of the organization. Thus theselection-promotion-succession system, in electronic terminology, is a positive feedback system. It uses its outputsto amplifies its own inputs. It is possibly the most leveraged institution. In most instances it results in managementbecoming a group of like-minded individuals who will see or not see anomalies in the same way and, if they see theanomalies, they will evaluate them in the same way, producing situations like Bhopal, Three Mile Island, and Davis-Besse.

Infrastructure

Infrastructure includes the interface between institutions and physical items. (Physical items are addressed next.) AsBob Cudlin has pointed24 out good infrastructure inherently reinforces good safety culture and poor infrastructureincreases the challenges to safety culture. Readers who have struggled with awkward corrective action programsoftware will recognize this immediately.

Characteristic Physical Items

Characteristic physical items of safety culture are those tangible entities involving safety that are found in a culture.These items have a variety of origins and purposes, but all are characteristic of the culture.

These include condition report forms, condition reports, root cause analysis guidelines, etc. They also include allvarieties of instructions, procedures, and drawings that relate to safety. In addition they involve physical systems,structures, and components whose performance can involve safety. Furthermore they include personal protectiveequipment (PPE), safety tags, and the whole arsenal of safety equipment and devices.

The Results of Good Safety Culture

"By their fruits you shall know them25" is not a new idea. Other things being equal, good safety culture results in:

1. Events and challenges being more rare than they otherwise would be.2. Events and challenges being more mild than they otherwise would be.3. Operation being further within safe limits than it otherwise would be.4. Safety and back-up equipment being more known to be in better readiness than it otherwise would be.5. Personnel being more known to be in better readiness to respond than they otherwise would be.6. Management having more accurate knowledge of the state of the safety culture.

Reflection on egregious adverse events shows that the above results were not achieved. Whenever a situation occursin which any of the above six results are not achieved there is an opportunity to improve the safety culture.

The table below gives some examples of the results of a good safety culture.


18/53


Default vs. Managed Safety Culture

Cultures, hence safety cultures, are of two classes: default culture that "just happens" and managed culture that is theresult of deliberate management actions in performance shaping and reinforcement. Two of the many examples ofmanaged cultures are those of the United States Marine Corps and the United States Navy Submarine Force.

In managed cultures leaders are aware of the cultures they want and relentlessly drive the achievement of it.Unnecessary islands of inconsistency are sought out and eliminated. Subordinate leaders know that they cannot beaberrant and survive. Paradoxically, part of managed functional culture is the openness to realize that the culturemust adapt.

Unfortunately there are many examples of default cultures in local, state, and federal government agencies. Some ofh d h l f i d ffi i l i h i id h i i f f f b i


19/53


From one perspective safety culture can be regarded as a cause, in that behaviors and conditions consistent with agiven safety culture can be part of the causation of adverse safety events. On the contrary, safety culture can be

regarded as an effect, in that it is produced, shaped, driven, refined, reinforcedby deeper factors.

Best professional friends part ways on what drives culture in general, and on what drives safety culture in particular,but what we do know is that the laws of behavioral technology have not been suspended. Here we scratch thesurface.

We know that people do what theyve done before, so that inertia has a strong influence on culture.

We also know that what gets rewarded gets repeated, so that the actual incentive schedule is a strongcultural determinate.

We also know that null consequences tend to extinguish functional behavior, so that the failure to reinforcebehaviors tends to eliminate it.

We do know that people tend to imitate admired others, so that behavioral modeling is a strong culturaldeterminant.

We do know that structure, in every sense of the word, influences behavior.

Dysfunctional Safety Culture Not a Root Cause

It is probably a serious logical error to believe that dysfunctional safety culture is a root cause of any adverse safety

consequence. Doing so would lead investigators to stop probing the factors that resulted in the dysfunctional safetyculture. Since few see value in digging deeper than the root causes it becomes important to avoid calling a weaksafety culture a root cause.

Once a root cause analysis effort concludes that dysfunctional safety culture is a cause of an adverse safetyconsequence, the next question is, What were the factors that resulted in the nature, the magnitude, the location,and the timing of the dysfunctional safety culture? This question would drive the investigators into the topicintroduced above, namely, the performance shaping factors that drive safety culture.

An investigation that concludes that dysfunctional safety culture is a root cause is flawed if it stops going deeperthan that root cause. On the other hand, if it concludes that dysfunctional safety culture is a root cause and it goesdeeper it is contradicting its own conclusion by going deeper than a root cause.

Safety Culture and Compliance

In the nuclear power industry in the United States, it so happens that there is a document that describes on a resultsbasis, rather than on a behavioral basis, what good safety culture is. This is 10CFR50, Appendix B, QualityAssurance Criteria.

My observations of departures from good safety culture that have resulted in serious incidents at nuclear plants isthat every departure from good safety culture that has resulted in those serious incidents also turns out to be adeparture from one or more of the 90-odd sentences in Appendix B. So far, all of the serious incidents at nuclearplants that I have been aware of were the result of specific manifestations of dysfunctional safety culture that happento be also departures from Appendix B.


20/53


Measuring and Describing a Safety Culture

The safety culture of an organization can be measured and described simply by recording observations of norms,institutions, and characteristic physical items. Observing mental content is a problem because it cannot be observeddirectly.

Mental content can be somewhat unreliably measured by culture surveys. It can be more reliably accessed byinference from behaviors, institutional functioning, and characteristic physical items. The results of safety culturesurveys are often dismissed when they deviate from managements intuitive feelings about the safety culture.Sometimes the managers are on solid ground and sometimes not.

Norms cannot be observed directly either. What can be observed is behavior. It is a separate activity to determine theextent to which a given observed behavior is an instance of a norm. For example, in some organizations membersexhibit espoused behaviors when they know they are being observed, but revert to the actual norm when theobserver is absent.

Testing Observations for Safety Culture

All observations will be samples of the culture or they will be aberrations. If it is usual, normally encountered,widespread , it is culture. Otherwise it is an aberration.

If the observation is part of the culture and it involves safety in some way it is part of the safety culture. Otherwise,it is part of the larger culture, but not part of the safety culture.

If it promotes, supports, or reinforces safety it is part of the functional safety culture. If it doesnt it is part of thedysfunctional safety culture.

Since safety cultures are not uniform across large organizations, observations must be made at various times and ofvarious situations as well as of various personnel. This may reveal important islands of inconsistency, sometimescalled sub-cultures. For example, in some organizations training personnel almost never report safety anomalies, notbecause they dont see them, but just because it is not what they do.

A Small Slice of Safety Culture

Culture Element Category Comment/ 10CFR50 App. BThe ability to detect deviations from safebehaviors and from safe conditions.

Shared Mental Content If this exists in an organization itwould be considered to be part offunctional safety culture./ Criterion

XVI, Sentence 1.Training to instill the ability to detect deviationsfrom safe behaviors and from safe conditions.

Institution If this exists in an organization itwould be considered to be part offunctional safety culture./ CriterionII, Sentence 8.

Detecting deviations from safe behaviors and fromsafe conditions.

Norm If this happens in an organization itwould be considered to be part of


21/53


Culture Element Category Comment/ 10CFR50 App. B

Forms for reporting detected deviations from safe

behaviors and from safe conditions.

Physical Item If these are available in an

organization and they are welldesigned it would be considered tobe part of functional safety culture. ./Criterion XVII, Sentence 1.

Process for handling forms for reporting detecteddeviations from safe behaviors and from safeconditions.

Institution If this exists in an organization and itworks well it would be considered tobe part of functional safety culture. ./Criterion XVI, Sentence 1.

Process for investigating the factors that resultedin reported deviations from safe behaviors andfrom safe conditions.


Process for investigating the factors that resultedin reported deviations from safe behaviors andfrom safe conditions and/or their causes not beingreported earlier.


Going from a Root Cause Analysis to Safety Culture

Performing a root cause analysis of a safety event is discovering the factors that resulted in the nature, themagnitude, and the timing of an important consequence. These factors are behaviors and conditions. Often theyinvolve norms, institutions and physical items.

Recent root cause analyses include extent of condition and extent of cause. When the extent of a behavior issufficiently broad it may be called a norm.

For example, the root cause analysis of a nuclear power plant mix-up event mentioned earlier revealed the following

norms:1. Personnel were not expected to check the unit designation of their work orders and other work instructions

against the unit designations on doors, rooms, and components they encountered in the process of a job.2. Personnel did not usually mention the unit designation when they were discussing components.3. Personnel accompanying job leaders were not expected to observe the self-checking behaviors of the job

leader.4. Pre-job briefs did not include discussion of measures to avoid and detect mix-ups.

Interestingly enough, the above was revealed as a result of out-of-the-box thinking by the root cause team, not as a

result of following the stations root cause analysis processes (an institution). Ironically, the investigation alsorevealed that the stations forms, procedures, labels, and signs were models of unit designation markings (physicalitems).

Thus a root cause analysis can provide information about the safety culture by providing information about norms,institutions, and physical items. However a root cause analysis cannot provide explicit safety culture informationunless extent is taken seriously and the root cause analysis team knows what safety culture is


22/53


Safety culture has generally not been mentioned in NRC Inspection Reports until quite recently.

THE KEY ATTRIBUTES OF FUNCTIONAL SAFETY CULTURE

This section is a very cursory collection of the key attributes of functional safety culture. It is derived mainly fromrecollections of the analyses of events in which dysfunctional safety culture was retrospectively revealed.

ATTRIBUTE CATEGORY Comment/ 10CFR50 App. B

Transparency: We do business in such a way that

it is easy for participants and others to see whatswrong.

Mental Content, i.e., a

principal or a value.Manifested in norms,by the functioning ofinstitutions, and inphysical objects, i.e.,documents.

For optimal effectiveness this needs

to be applied to norms, institutions,and physical items.// This supportsCriterion XVI, Sentence 1. It is akey ingredient of measures toassure that conditions adverse toquality are promptly detected.

Integrity: We can prove that what we say andwrite is the truth, the whole truth, and nothing butthe truth.

Mental Content, i.e., aprincipal or a value.Manifested in norms,

by the functioning ofinstitutions, and inphysical objects, i.e.,documents.

For optimal effectiveness this needsto be applied to norms, institutions,and physical items.// This supports

Criterion XVII, Sentence 1. It is akey ingredient of sufficient recordsto furnish evidence of activities

Competency: We only assign people to activitiesaffecting safety who are actually qualified toperform them.

Mental Content, i.e., aprincipal or a value.Manifested in norms,by the functioning ofinstitutions, and inphysical objects, i.e.,

documents.

For optimal effectiveness this needsto be applied to norms, institutions,and physical items.// This supportsCriterion II, Sentence 8. It is a keyingredient of to assure that proficiency is achieved

Positive Control: What happens is what we intendto happen and thats all that happens. Whenpositive control is lost we re-establish it beforegoing on.

Mental Content, i.e., aprincipal or a value.Manifested in norms,by the functioning ofinstitutions, and inphysical objects, i.e.,documents.

For optimal effectiveness this needsto be applied to norms, institutions,and physical items.// This supportsCriterion II, Sentence 5. It is a keyingredient of under suitablycontrolled conditions.

Prompt Problem Identification: We find our own

problems at the first opportunity. Downstreamidentified adverse conditions get immediateinvestigation to refine our problem identification.

Mental Content, i.e., a

principal or a value.

Management can judge this one by

the monotonic decrease in thefrequency and severity ofdownstream identified adverseconditions.// This supports CriterionXVI, Sentence 1. It is a keyingredient of measures to assurethat conditions adverse to quality are


23/53


OTHER VIEWS OF CULTURE AND SAFETY CULTURE

An internet search on Culture or Safety Culture will quickly inform the reader that a variety of views exists.Patrick OHara gives a fine starting point list of links on his web site28. A collection of papers on nuclear powerplant safety culture is available in book form29. The U. S. Department of Energy has provided a sampling of Safetyculture Resources on their web site30. The rest of this section is a non-exhaustive sampling of views.

International Atomic Energy Agency (IAEA)

After Chernobyl IAEA surfaced the term Safety Culture. Their definition31, which has been copied many timesover is:

Safety culture is that assembly of characteristics and attitudes in organizations and individuals whichestablishes that, as an overriding priority, nuclear plant safety issues receive the attention warranted

by their significance.

As it turns out this has been the foundation of much work on safety culture. The reader of the safety cultureliterature will see this and variations of it over and over again. Since it comes from such a prestigious source laterthinkers have struggled to make it useable.

Comments:

1. It purports to define Safety Culture as applying only to nuclear plant safety issues. Safety cultureclearly applies more broadly, as has been rediscovered recently by the U.S. Chemical Hazard and SafetyBoard (CSB)32.

2. It creates the needs to define what is meant by characteristics. If it means everything in my definitionsabove except attitudes, then I am in closer agreement.

3. Safety culture is defined in such a way that there cannot be a dysfunctional safety culture. This could bepatched up by either starting the definition with the words Good safety culture or replacing the wordsestablishes that with the words results in the extent that.

4. It does not explicitly recognize a) mental content, norms, institutions, and physical items as being elementsof safety culture.

5. The IAEA definition would be less problematic if it began with A culture of nuclear safety is ratherthan Safety culture is

Institute of Nuclear Power Operations (INPO)

In a presentation33, the President and CEO of INPO said that safety culture is An organizations values andbehaviorsmodeled by its leaders and internalized by its membersthat serve to make nuclear safety theoverriding priority. This definition shares attributes with the IAEA definition reported above.

Mr. Ellis concludes: It is not possible to develop a comprehensive safety culture indicator. Safety culture is not a broad umbrella under which all things fall. Nuclear safety is the responsibility of those who own and operate the plants.


24/53


Dr. Thomas E. Murley

Dr. Murley, a pioneer in safety culture thinking, and a former Regional Administrator for the USNRC has doneimportant work in this area for the Nuclear Energy Agency. Here we only sample his contributions.

Murley points out the need for the regulator as well as the operating organization to have a good safety culture34.Naturally, a regulatory that espouses good safety culture without exhibiting it is in danger of appearing hypocriticaland losing credibility. In Murleys words In promoting safety culture, a regulatory body should set a good examplein its own performance.

Comment: Murleys line of thinking would imply, among other things, that regulators should establish measures to

assure that conditions adverse to safety in their own organization should be promptly identified and corrected as theregulator expects from the operating organization. This would be better stated as a sort of reverse Golden Rule,viz, Do unto yourself what you demand from your licensee.

Professor James Reason

Professor James Reason of the U.K, a well-known safety scholar has had much to say about safety culture. Forpurposes of this paper it is noteworthy that he breaks safety culture into five subsidiary cultures35:

1. Informed Culture

2. Reporting Culture3. Flexible Culture4. Just Culture5. Learning Culture


25/53


Figure 3 James Reasons Five Cultures of Safety Culture

Professor Edgar Schein

Professor Edgar Schein of the MIT Sloan School of Management, a well-known business culture scholar says, "Theculture of a group can now be defined as: A pattern of shared basic assumptions that the group learned as it solvedits problems of external adaptation and internal integration, that has worked well enough to be considered valid andtherefore, to be taught to new members as the correct way to perceive, think, and feel in relation to those problems."

Comment: It leaves out norms, institutions, and characteristic physical items.

The U. S. Nuclear Regulatory Commission36

The Commissions Policy Statement on the Conduct of Nuclear Power Plant Operations, Federal Registernotice,January 24, 1989, refers to safety culture as the necessary full attention to safety matters and the personald di i d bili f ll i di id l d i i i hi h h b i h f f l
http://www.nrc.gov/about-nrc/regulatory/enforcement/54fr3424.pdfhttp://www.nrc.gov/about-nrc/regulatory/enforcement/54fr3424.pdf


26/53


Comment: 1) The definition excludes dysfunctional safety culture by defining safety culture as a good thing. 2) Itleaves out norms, institutions, and characteristic physical items. 3) It is not clear what is meant by characteristics.4) It does not seem easily translated into guidance for agency employees.

The Center for Chemical Process Safety37

The Center for Chemical Process Safety (CCPS) devotes a full chapter of their twenty-four chapter guidelines toProcess Safety Culture, which is apparently regarded as a subset of safety culture. CCPS describes Process SafetyCulture as follows:

Process safety culture has been defined as the combination of group values and behaviors that determine

the manner in which process safety is managed. More succinct definitions include: How we do things

around here, What we expect here, and How we behave when no one is watching.

CCPS provides the following essential feature of process safety culture:

Maintain a sense of vulnerability.

Empower individuals to successfully fulfill their safety responsibilities.

Defer to expertise.

Ensure open and effective communications.

Establish a questioning/ leaning environment.

Foster mutual trust.

Provide timely response to process safety issues and concerns.

APPLICATIONS OF SAFETY CULTURE CONCEPTS

USNRC

The reports of applications of the concepts of safety culture are rare. One available in the open literature is that ofthe U. S. Nuclear Regulatory Commission (NRC) in its Reactor Oversight Program (ROP). A recent summary of theNRCs approach38 mentions the components in the following table.

COMPONENT CATEGORY Comments(1) decision-making Mental Content

NormsInstitutionsPhysical Items

Decision-making consistent withfunctional safety culture will havethe results described above underThe Results of Good SafetyCulture.

(2) resources NormsInstitutions

Physical Items

The signs of inadequate resourcesare the same as the signs of

inadequately deployed resources:downstream identified adverseconditions, growing backlogs,growing workaround lists, items leftout of backlogs, etc.


27/53


COMPONENT CATEGORY Comments(3) work control Norms

InstitutionsPhysical Items

The signs of inadequate work

control include events involvingsimultaneous conduct of mutuallyincompatible activities, e.g., testingone channel of RPS while another isin bypass for maintenance.

(4) work practices Mental ContentNormsInstitutionsPhysical Items

The signs of inadequate workpractices include excessive,increasing, and concealed rework.

(5) corrective action program Mental Content


Observations of actual corrective

action program activities may wellbe the clearest picture window intothe safety culture.

(6) operating experience Mental ContentNormsInstitutionsPhysical Items

The nuclear industry has struggledwith this one since the KemenyCommission Report. As an industrymatures there will be fewer andfewer new problems. After a half-century the vast majority of

problems are manifestations of nothaving learned from previousproblems.

(7) self- and independent assessments Mental ContentNormsInstitutionsPhysical Items

The heart of safety culture is peoplefinding their own problems at thefirst opportunity.

(8) environment for raising safety concerns Mental ContentNorms

InstitutionsPhysical Items

It does no good for people to findproblems if they are not free to raise

them up. And the freedom to raiseissues does no good unless personnelknow how to recognize them.

(9) preventing, detecting, and mitigatingperceptions of retaliation

Mental ContentNormsInstitutionsPhysical Items

One wonders if this should includeharassment, intimidation, anddiscrimination.

(10) accountability Mental ContentNormsInstitutions

Physical Items

Signs of inadequate accountabilitywould include events involvingincomplete work or delays in

corrective actions from previousevents.

(11) continuous learning environment Mental ContentNormsInstitutionsPhysical Items

Signs of inadequate continuouslearning environment would includeevents involving repeat causalfactors or causal factors that could


28/53


COMPONENT CATEGORY Comments(13) safety policies Mental Content


Safety policy provisions could cover

any or all of the other components.

It is clear that these components are not mutually exclusive. If the components were mutually exclusive everymental content item, norm, institution, and physical item of safety culture that did fit in a component would only fitin one. This would facilitate trending. As it is, a particular safety culture observation by an inspector could bebinned in more than one component, creating a database integrity issue that is sure to baffle both staff andlicensees until it gets sorted out.

What is less clear is the extent they are not jointly exhaustive. Jointly exhaustive safety culture components wouldcover all of safety culture. One might expect that as the NRC uses these components in their Reactor OversightProgram it will find the missing components. This may arise as the staff finds problems that are clearly safetyculture issues, yet dont readily fall into any of the existing components. One that comes to mind is inadequatereward structure, e.g., people not being reinforced for exhibiting functional safety culture. Another one istransparency, i.e., doing business in such a way that it is easy to see whats wrong.

WALKING THE TALK

In the near future as the awareness of safety culture increases one might expect to see examples of dysfunctionalsafety culture behaviors from those espousing safety culture. In popular language this is called not walking thetalk or not eating ones own cooking.

When this occurs it will reverse the progress toward more functional safety cultures. To avoid this it will benecessary for leaders to be very familiar with what is and what is not functional safety culture. The first leadershipexhibition of dysfunctional safety culture will be taken as a signal that leadership is not serious about safety culture.

This goes for regulators as well. It will be especially challenging for regulators who have been reluctant to admitmistakes to be credible in encouraging their stakeholders to be forthcoming about identifying and reporting errors.

Similarly, it will be challenging for organizations that have been secretive to be credible in encouraging theirstakeholders to be transparent.

IMPROVING SAFETY CULTURE

Several critics of this paper offered the opinion that unless the paper included some ideas on how to improve safetyculture the paper was useless to them. For those and others the following are offered.

Assessing Your Own Safety Culture

Use Appendix A Conflicts Between Observed/ Inferred Cultural Attributes and Functional Safety Culture to

S f C l B k h B i V i 2008 06 11/11/2008


29/53


1. Say what you do (that is part of the good safety culture).2. Do what you say. This means to make the above consistent.3. Prove it. This means to furnish evidence of the safety culture.4. Improve it. This means to use experience to refine the safety culture.

Establishing a Good Safety Culture

If the safety culture needs more than incremental improvement, one strategy is sometimes called Gap Closure orsomething like that. Roughly it goes like this:

1. Describe the current safety culture. (Mental content, norms, institutions, physical items.)2. Describe the desired future safety culture.3. Itemize the differences between the above. (This is called The Gap.)4. Prioritize the parts of the Gap to be closed.5. Create and implement plans for Gap closure.6. Create a progress reporting plan to show how the Gap is being closed.7. Create Recovery Plans for when the Gap is not responding as planned to the Gap Closure plans.

There are other strategies, but these will do for the time being.

LOW HANGING FRUIT

Most famous underperforming safety cultures seemed to have had the following cultural dysfunctionalities:1. They found their problems in expensive, embarrassing, and unsafe ways, i.e., by events, gross rework, andregulatory hits.2. They did not use the events, rework, and regulatory hits as opportunities to improve the way they found problemsand causes.3. The above dysfunctionalities were not even recognized as something to work on.

Thus the low hanging fruit of safety culture improvement is that:1. They should do a Missed Opportunity Investigation41 of every problem that involves a fatality or an expense ofmore than $1.0 E+6 (honestly calculated).2. This investigation should find and fix all processes that could have found the problem or its causes at an earlier,cheaper, safer time.3. They should have a non-facility officer as the investigation team leader for each of these Missed OpportunityInvestigations.4. They should not tolerate problems being found downstream, i.e., they should have a highly visible initiative toeliminate downstream identified adverse conditions.

The sooner and more aggressively they do the above the sooner they will stop the hemorrhaging.

The above will address only the limiting weakness of the safety culture.

When they do the above they will surface the problems they have been in denial over.

PRELIMINARY CONCLUSIONS

S f t C lt B k t th B i V i 2008 06 11/11/2008


30/53


Using the concept of safety culture to include mental content, norms, institutions , and physical items rather thanrestricting it to attitudes and characteristics is likely to enhance both the understanding of safety culture and itsapplication in the high hazard industries.

Acknowledgments:

Thanks to Bob Cudlin, Larry Pearlman, Terry Sullivan, Steve Marrs, Joe Braun, and Malcolm Patterson for theirkind inputs to this work.

Please send Bill Corcoran your comments and suggestions for [email protected]
mailto:[email protected]:[email protected]:[email protected]


31/53

Safety Culture Back to the Basics Version 2008 06 11/11/2008


32/53


Conflicts Between Observed/ Inferred Cultural Attributes and

Functional Safety Culture

Observed/ Inferred Functional(Not so good) (Better)

Direct Result of Observed/Inferred

Downstream Result ofObserved/ Inferred

Significance of Observed/Inferred

(Mental Content/

Norm/Institution/Physical Item)

Management safetyachievement bonuses are notaffected by contractoraccidents.

Management safety bonusesare tied to overall facilitysafety including the safety ofcontractors.

Purchase orders to contractorsdo not impose facility safetybehavioral requirements thatemployees are required towork to.

Contractor dysfunctionalsafety culture attributes showup as causal factors ofadverse events.

Mental Content/ Norms/Institutions

Note: This is (inadvertently?)facilitated by OSHA

expectations.

Personnel Safety isobservably emphasized.

Safety Culture is observablyemphasized.

Process safety andenvironmental protection arede-emphasized.

Vulnerabilities for processupsets and environmentalinsults are not addressed.

Results in situations like BPTexas City.If you emphasize the letterA you automatically de-emphasize twenty-five otherletters.Norm

Schedule adherence isrewarded, but safetyadherence is taken forgranted.

Safety adherence is part ofthe Most Rewarded List.

Decisions are tilted towardschedule and away fromsafety.

Safety drifts toward the edgeof the radar screen.

The reward structure becomespart of the organizationalDNA, including root causeanalysis.Norm

Management sends themessage that increasedproductivity is needed toachieve organizational goals,

but means for increasingproductivity are notdiscussed.

Management sends themessage that increasedproductivity is needed toachieve organizational goals,

and the means for increasingproductivity withoutsacrificing safety arediscussed.

The received message is thatsafety should be sacrificed toachieve productivity goals.

Dysfunctional safetybehaviors and conditionsshow up as causal factors ofadverse events.

Rash of minor safety eventsand near misses followingmanagement exhortation onproductivity. 2007(Organizational Identificationwithheld)

Page 32 of 53 2008 William R. Corcoran, NSRC Corporation. Funding support from the following is appreciated: NSRCCorporation.


33/53



34/53

y , ,







(Mental Content/


Operational ReadinessReviews (ORRs) becomeperfunctory.

Managers assure thatOperational ReadinessReviews (ORRs) are takenseriously.

Problems are found duringstart-up or operation thatcould have been found at theORR.

Problems missed in ORRs arefound as a result ofdownstream events.

Operational ReadinessReviews (ORRs) are part ofPre-emptive Self-assessment,activities intended to findproblems that are still latent,thereby pre-emptingconsequences.Norm/ Institution

Problems found duringOperational ReadinessReviews (ORRs) are merelycorrected.

Managers assure thatproblems found during ORRsare investigated to find andfix the problem, the processesthat created the problem, andthe processes that should

have found the problem andits causes before the PJB.

The factors that resulted inthe problems continue toexist. Self-assessmenteffectiveness deteriorates.More problems are found inORRs.

Problems missed in ORRs arefound as a result ofdownstream events.

Investigations are part ofReactive Self-assessment,activities intended to findproblems in reaction to anobserved stimulus. ReactiveSelf-assessment is done to

prevent wasting mistakes.Norm

Transparency is not part ofthe vocabulary.

Transparency is an espousedvalue. Transparency isdefined as doing activities insuch a way that it is easy totell whats wrong.

Errors, omissions, and otherlatent problems are notidentified as early as theycould be.

Problems that could havebeen found earlier are foundas the result of downstreamevents.

Transparency facilitatesRoutine Self-assessment,ordinary activities intended tofind adverse conditions.

Transparency surfaces the

effects of imperfectManagement of Change(MoC).Norm



35/53


36/53



37/53







(Mental Content/


Management does notprovide feedback to workerswho submit personnel,process, and/or environmentalsafety concerns.

Management informs workerswho submit personnel,process, and/or environmentalsafety concerns of every stepin the processing of theirconcern.

Many subsequent personnel,process, and/or environmentalsafety concerns are notreported,

The problem or an associatedproblem is left to fester andbecome involved in a seriousevent.

Human Behavior Technologyprinciple: Null consequencespunish functional behavior.(When a desire behaviorresults in nothing the workerstops doing it.)

Norm/ Institution/ PhysicalItems

Often workers use the processfor reporting personnel,process, and/or environmentalsafety concerns for blamingother people.

Management insists that theproblem reporting processesbe focused on behaviors andconditions. Workers arereinforced for reporting theirown problems.

The problem reportingprocesses are perceived aspetty and political.

The problems reportingprocesses are used less andless.

Norm/ Institution

There is no budget forproblem investigation andresolution activities.

There are specific budget lineitems and charge numbers forproblem investigation andresolution activities.Measures are in place toassure that the normal workof line personnel involved inproblem investigation andresolution get done while

those people are dedicated toproblem investigation andresolution.

1. Problem investigationand resolutionassignments are avoided.

2. Problem investigationand resolutionassignments are givenshort shrift by linepersonnel.

3. The normal work of line

personnel does not getdone while they arededicated to Probleminvestigation andresolution assignments.

Investigations omit importantcauses, extent ofconditions/causes, andcorrective actions areminimal.

Notes:

This feeds the cycle ofdegrading performance.

This is easy to fix, yetstays as is.

Norm/ Institution/ PhysicalItems



38/53


39/53


40/53



41/53




r Downstream Result of Observed/ Inferred


(Mental Content/


Di ect Result of Observed/Inferred

Oversight personnel areencouraged to volunteer fortemporary line assignmentsduring labor intensiveperiods.

Oversight personnel areaugmented by experiencedoutside oversight personnelduring labor intensiveperiods.

1. Staff gets the messagethat oversight is only forbusiness as usual.

2. Labor intensive periodswith higher challengesget less oversight.

Latent problems not reportedby oversight professionals arefound as a result ofdownstream events.

Mental Content/ Norms/Institution/ Physical Items

Oversight organizationsconsider it to be a successwhen they find a seriousadverse condition.

When oversight organizationsfind a serious adversecondition they:1. Launch a Missed

OpportunityInvestigation to find outhow they could havefound it earlier.

2. The write-up the line

organization for nothaving found it beforeoversight.

Both oversight and the linefail to see that when oversightfinds a serious adversecondition it is a sure sign thatself-assessment needs work.

Eventually a serious eventoccurs that brings theorganization to its knees.

Norm

Event investigations are onlydone for major consequentialevents.

There is a graded approach toevent investigations. Eventinvestigations are based onsignificance, not justconsequences. Near misses

are treated as gifts fromabove.

The organization does notlearn from indications oflatent weaknesses andadverse conditions.


Texas City 2005

Norm/ Institution/ PhysicalItem




42/53







(Mental Content/


Corrective actions emergingfrom event investigationsaddress the root causes.

Corrective actions emergingfrom event investigationsaddress all causal factorsincluding the self-assessmentweaknesses that allowed thecausal factors to remain

unidentified and/ or notaddressed before the event.The extents of causes and theextents of adverse conditionsare also addressed.

Many vulnerabilities thatcould have been corrected areleft to become involved incausing future events.



Event investigations areallowed to languish or beterminated before importantcausal factors are understood.

Management demands thatthe talent applied to difficultinvestigations is escalated asthe difficulty shows up in

investigative delays.



Davis-Besse 2002(Investigations of radiationmonitor filter clogging and ofcontainment air cooler

fouling.)

Norm/ Institution/

Event investigations seldommention the ineffectiveness ofearlier investigations as acausal factor for theconsequences of the currentinvestigation.

The possible ineffectivenessof earlier investigations as acausal factor for theconsequences of the currentinvestigation is always a lineof inquiry.

The organization does notlearn from indications oflatent weaknesses andadverse conditions inprevious investigations. Theinvestigation process does not

improve.


1996 LaSalle SealantIntrusion (See NRC AITReport)

Davis-Besse 2002(Investigations of radiation

monitor filter clogging and ofcontainment air coolerfouling.)




43/53







(Mental Content/


Event investigation reportsseldom, if ever, mention thewords safety culture.

Event investigation reportsalways address theinvolvement of safety culturein the event beinginvestigated.



Davis-Besse 2002(Investigations of radiationmonitor filter clogging and ofcontainment air coolerfouling.)


Operating experience reportsby operating organizationsand regulators focus ontechnical aspects of events.

Operating experience reportsby operating organizationsand regulators blend theirfocus to address technical andcultural aspects of events.

The members of theorganization and the membersof the regulatory bodies neverrealize that the safety cultureis an important driver oflatent weaknesses.


OSHAEPANRCGAO

To its credit CSB doesmention safety culture,

however ineffectively.

Norm/ Institution/

Information given to safetyregulators is not subjected tothe rigorous verification thatfinancial information gets.

Information given to safetyregulators is rigorouslyverified before submissionand later detected errors are

thoroughly investigated.

Regulators are given falseand misleading information.

Regulatory decisionsexacerbate the consequencesof safety problems.

Davis-Besse 2001

Davis-Besse Insurance Claim2007





44/53







(Mental Content/


Work is done that is outsidethe written scope of workinstructions and/or work inthe written scope is omittedor incomplete.

All deviations from workscopes are subjected to safetyreviews as part ofManagement of Change.

The work is less safe or theplant is less safe after jobtermination.

Personnel and/or equipmentharm results.

Davis-Besse 2001


Work is done on live or

operating systems orcomponents usingpr

Safety Culture_BacktotheBasics _Version 2008.06

Documents

Transcript of Safety Culture_BacktotheBasics _Version 2008.06