Postcards from the Edge

Normal Accident Theory (NAT) states that in large systems, which are highly complex and tightly coupled with interactions that are impossible to predict, accidents are inevitable and even considered normal. A few examples he gave were nuclear incidents such as Three Mile Island and Chernobyl, the Space Shuttle Challenger and Columbia accidents.

What is a High Reliability Organization? He explained that a HRO is an organization operating in an environment of high intrinsic hazards that, by applying a systematic approach to safety are able to achieve a safety record far better than would be expected. A few examples of these are nuclear aircraft carrier flight decks, nuclear submarines, nuclear power plants and FAA air traffic control centers. A specific example would be the deck of the USS Nimitz, described as the world's most dangerous 4½ acres. One is confronted with jet blast, jet intakes, water and oil, live ordinance. And when you consider that kids run the whole thing you wonder, so how they pull it off.

The answer isn't really that complex. These “kids” develop a high level of expertise due to intensive training. Procedures are established, which are followed to the letter since this is a dynamic environment where there is the constant threat of the unexpected.

Hudson went on to discuss models of accident causation. Three elements can be identified: the person, the system and engineering.

Do people make mistakes? Yes they do. And, in many cases the reaction is to identify that person, so that blame may be fixed and then retrain the individual or if that isn't possible they may be replaced with another deemed more appropriate (until they make a mistake).

Is the system vulnerable and could it possibly be at fault? What is the psychology behind the Vulnerable System Syndrome (VSS)? We go back to blaming the operator, “Who did this?” since we are in denial about the infallibility of our system. After all, our policies and procedures are clear. We may be guilty of excessive pursuit of the wrong kind of excellence. The illusion of perfection isn't perfection and may get us into trouble.

There may be several different reasons for failure such as fundamental attribution error. Remember, as the “boss” says, “When you fail it's due to internal factors. You just can't handle the job but if I fail it's due to external factors. It's not my fault.” Or maybe it's just that bad things happen to bad people. In some cases, if we look back in hindsight, we say that anybody should be able to see this was bound to fail from the start.

But maybe, just maybe, it was the engineering model that was at fault. But, how could that be? After all the safety was designed into the system. Reliability was beyond reproach, redundant systems were built in, we anticipated everything that could possibly go wrong and it was designed in such a way that no matter how hard the operator tried it was impossible to make an operational error (mess up).

But is it really possible to design something that is foolproof? Can we really anticipate every conceivable system failure? Sometimes all redundancy does is to increase the possibility of failure and people defeat systems. Remember how, as a kid no matter how hard your mother tried to hide the cookie jar, I'll bet you got your cookies.

Hudson told a very telling story about the philosophy of the HRO. It seems a young mechanic working on the flight deck of a carrier realized he was missing a wrench.

Did he keep his mouth shut hoping the wrench would be found before it did any damage? After all this is what many people would do since we are often taught that if we make such a mistake it's so long, Charlie, been nice knowing you.

No, he spoke up and told his supervisor who moved the information quickly up the chain of command and within minutes of his discovering the wrench was missing the entire flight deck was shut down. Aircraft orbiting, waiting to land, were refueled and sent to shore bases. The crew was assembled and the entire flight deck was searched until the missing tool was found.

And what happened to the young seaman? Was he reprimanded? No! Was an example made of him? Most certainly, at a Captain's Mast he was given an award. This was done to set an example for the other crewmembers. This young man spoke up and possibly saved thousands of dollars and maybe even several lives. Will he be more careful in the future? Probably so but this is the kind of things people have done for since the beginning of time. People are people and they make mistakes. A HRO is successful because even though it can't always predict the specific mistake a person may make or how a piece of equipment may fail, it is prepared for those mistakes and failures. It is prepared to act quickly to mitigate the situation and prevent a minor incident from getting out of control and becoming a catastrophic disaster.

A close call isn't good news but it can be used as a learning tool. By examination of the chain of events leading up to the close call and noting where and how the chain was broken we can possibly design procedures to prevent another “close call.”

The HRO is preoccupied with failure and are aware that everyday could be the day that accident could happen. They are constantly on the lookout for what is out of place and looking for that surprise. Just because an engine is in the legal numbers on run up doesn't mean it's right.

Hudson gave the example of an incident he encountered with one of his airplanes. On run up he would always get a drop of 50 rpm on each mag, but on this day one dropped 50 rpm and the other mag dropped 125 rpm. According to the “book” he was good to go but he chose to taxi back. Upon inspection, it was found a cylinder was damaged and about to fail. The numbers may have been legal, but they weren't right. Something had changed and the red flag flew in his face. The chain had been broken.

HRO's are reluctant to simplify their procedures. Many items on a long checklist were placed there after an incident. They are sensitive to operations, walking the front line with their “ears to the ground” and encouraging communication. They listen to the entire crew from the bottom up.

One of the most important aspects of the HRO organization is the concept of experience taking precedence over rank. In other words, it doesn't matter how many stripes you have on your sleeve. The question is are you the best qualified to do the job?

Lastly, how can YOU become a HRO? Adopt the system model. Seek leading indicators and weak signals. Maintain a healthy preoccupation with potential failure. Beware of complacency. Plan for resilience.

References

• Clarke L. (1993). The disqualification heuristic: when do organizations misperceive risk? Journal of Research and Public Policy
• Perrow. J. (1999). Normal accidents
• Reason, J. (1997). Managing the risks of organizational accidents
• Reason, J., Carthey J. & de Leval M. (2001). Diagnosing "vulnerable system syndrome”: an essential prerequisite to effective risk management. Quality in Health Care, 10(Suppl II), 21-25
• Roberts, K., Ed. (1993). New challenges to understanding organizations.
• Weick, K. & Sutcliffe, K. (2001) Managing the unexpected.
• Wilson, G. (1986). Supercarrier

For more information, contact Gene Hudson.

080529