DRAWING OUT THE ISSUES

Analysis of these events and the others which the authors have reviewed allow some common underlying factors to be identified. Although the details are obviously different from one event to another, the authors were struck during the analysis by the strong similarities (and thus opportunities for broader learning) which emerge.

In this section of the paper, therefore, some of these common findings are presented, and in Section 5 the more difficult task is attempted of trying to identify some common remedial actions as enablers to minimize the risk of such events in future.

TAYLOR and RYCRAFT

144

Common factors can be grouped in a variety of ways, but the analysis presented here has found about eight issues which seem to span nearly all of the events (including those not explicitly presented in the paper). It would be easy to expand the list to try to cover every recognizable factor in the incidents studied, but this would be unhelpful in trying to develop potential priority areas for improvement. Equally, providing a few very general issues would be similarly unhelpful. A compromise has been sought using an element of judgement, and these eight major common factors have been identified and presented broadly in line with the sequence of ‘layers’ discussed above.

A number of events in the nuclear industry have occurred which are highly relevant to this discussion. Recent examples include the events at Paks and Davis Besse, as well as other events providing learning opportunities.

Unlike the Tokaimura JCO accident, these fortunately did not lead to loss of life or disaster but for several of them, issues discussed below also appear to be highly pertinent.

In this study, we note that, in several instances, the organizations involved had generally good safety records (e.g. in industrial safety). This seems to illustrate the fact that, important though it is, dealing with industrial safety alone does not always substantially mitigate the risks of these complex, organizational accidents. The ‘Swiss cheese’ model allows this at least partly to be understood.

Finally, in drawing out the issues below, it is also important to realize that none of the individuals involved — from people involved in safety policy, to the plant supervisor or operator — had any intention through their actions to be part of a chain of ‘failed’ judgements which led to disaster. It seems important, therefore, to try to understand better the ‘drivers’ which condition thinking at all levels. This may involve issues relating to competence, a questioning attitude and a range of other pressures. Understanding these factors better may provide further clues on how to minimize the occurrence of complex, organizational accidents.

4.1. Maintaining competence

It is striking that almost all of the incidents involve a lack of competence on the part of operators and/or supervisors and decision makers. Shortfalls also exist in the systems to recognize the need for training and to check that competence is maintained (particularly during periods of substantial change).

Within organizations, certain activities sometimes become the ‘poor relation’: unresourced, unskilled and often the ‘dumping ground’ for those who are not deemed to meet the standards required elsewhere in the company. Such unloved, orphaned parts of the organizations are potential breeding grounds for disaster.

TOPICAL ISSUE 2

145 4.2. Application of standards

Inappropriate and poorly applied safety standards — particularly in respect of procedures, risk assessments and safety cases — are very often apparent in the events studied. This appears to arise not only from a lack of training, but also from poor awareness of their importance. A lack of ownership and involvement in the development and application of procedures by those who have the responsibility to use them in practice, not surprisingly, can lead to short cuts and violations.

4.3. Questioning attitude

This is sometimes referred to, or associated with, the term ‘conservative decision making’. It has been widely accepted as one of the prerequisites of a strong safety culture (see, for example, Ref. [10]). The issue highlights the need for those involved in safety related activities at all levels to try to avoid mindsets that justify actions by assuming that what has been apparently safe before will be so again, and the impact of ‘group think’. It emphasizes the fundamental need to ask what if? questions and to encourage minority views. It ties in strongly with some of the issues discussed below relating to the need to enable and respond to the questioning attitude of others.

4.4. Organizational complacency and loss of focus

Organizational complacency and creeping isolation are factors underlying many of the events. Often, organizations appear to ‘rest on their laurels’ following earlier success or strong performance in a particular aspect of safety (e.g. industrial safety) and fail to recognize the early warning signs of deterioration in other vital areas of safety. The overconfidence is sometimes accompanied by a belief that success means that there is little reason to continue to learn from others and share improvement opportunities. The deterioration can be manifested in a variety of forms, including a failure to communicate difficult issues, listen to messages from the workforce (particu-larly when these are unwelcome), continue to insist on high standards and be prepared to recognize early warning signs, such as the buildup of maintenance backlogs, increases in near hits, etc. [11].

4.5. Poor communication

Poor communication is a factor influencing almost all failures, because it is rare that somebody in an organization does not recognize a shortcoming or

TAYLOR and RYCRAFT

146

an emerging problem. If only they had been heard, the event would not have occurred. It can take many forms, such as:

— A failure of leadership to communicate their standards and expectations (and be seen to act them out personally).

— A failure to welcome ‘bad news’. If messengers are shot, or as a minimum ignored, it is unlikely that messages will get through.

— The development of silos or divisions are allowed to develop between teams, between shifts or between staff and contractors such that messages are not transmitted and rarely welcomed and acted upon.

4.6. Loss of oversight

An important element of ensuring safety is the extra defence in depth provided by independent oversight and scrutiny. This can be at several levels.

Firstly, within an operating unit, there is a need for managers to ensure that they are getting more than one view of performance. Important inputs to this may be through listening, respecting and acting on the views of the workforce as the people who know best what is actually happening at plant level, welcoming advice through, for example, audits and peer reviews and encouraging reviewers to present things as they are (rather than as the manager would prefer them to be). Particularly important is the need for leaders to be personally visible and available to listen to feedback on safety issues. Secondly, within an organization, there is a need for effective oversight from those outside the line. This may again be informed by the results of audits, monitoring of KPIs and events and scrutiny of safety cases and other similar requirements.

Thirdly, oversight is provided by effective external regulation. This requires a difficult balance to be struck between permissioning, the exercise of regulatory authority and the input of advice. It is noticeable that in many of the events discussed, two or more of these ‘layers’ were either missing or clearly ineffective.

4.7. Management of change

It is perhaps hardly surprising that many of the events occurred after major organizational change or during periods of non-standard activity (e.g.

major overhauls of the plant). It has become increasingly recognized that, in addition to controlling engineering change as part of a structured process which assesses the inherent risks, it is vitally important to do so for organizational and structural changes. These can be at the plant level (e.g. the staffing levels for a shift), the company level (e.g. adequate provision of engineering support or

TOPICAL ISSUE 2

147 safety oversight) or at the industry level where major restructuring can have profound and often unrecognized impacts on accountabilities, resources and the maintenance of skills and effective control.

4.8. External pressures

Nobody knowingly sets up an organization or an industry in such a way that safety is degraded, let alone in a way that enables disasters or other major events to occur. However, the seeds of disasters are often sown through the unrecognized consequences of such top level decisions and the associated lack of control of the changes. In particular, an understandable drive by an organi-zation or government to inject a greater commercial ethos into an industry through privatization and/or ‘contractorization’ needs to be managed carefully from the point of view of safety. This is particularly true if a climate is created in which safety begins to be perceived by the workforce as a lower priority.