Safety Culture - BacktotheBasics - Version 2008.06

Safety Culture — Back to the Basics, Version 2008.
06, 11/11/2008
Safety Culture — Back to the Basics

William R. Corcoran, PhD, PE
Nuclear Safety Review Concepts Corporation
William.R.Corcoran@1959.USNA.com
ABSTRACT
This paper addresses culture in the anthropological sense and treats safety culture as a subset of culture.
Descriptions, examples, and other devices are used to illustrate and emphasize the concepts. Improving safety
culture is addressed.
Page 1 of 53 © 2008 William R. Corcoran, NSRC Corporation. Funding support from the
following is appreciated: NSRC Corporation.
Safety Culture — Back to the Basics, Version 2008.06, 11/11/2008
CONTENTS
ABSTRACT .................................................................................................................................................................1
CONTENTS .................................................................................................................................................................2
INTRODUCTION .......................................................................................................................................................4
What is Culture? .......................................................................................................................................................4
Examples and Experiments .......................................................................................................................................6
DESCRIPTION OF CULTURE ................................................................................................................................6

Shared Mental Content .............................................................................................................................................8
Norms........................................................................................................................................................................8
Institutions ..............................................................................................................................................................11
Characteristic Physical Items .................................................................................................................................11
The Importance of Culture......................................................................................................................................12
Acculturation ..........................................................................................................................................................13
DESCRIPTION OF SAFETY CULTURE..............................................................................................................13

Safety Culture .........................................................................................................................................................13
Safety Culture vs. a Culture of Safety .....................................................................................................................14
Shared Mental Content ...........................................................................................................................................15
Norms......................................................................................................................................................................15
Institutions ..............................................................................................................................................................16
Characteristic Physical Items .................................................................................................................................17
The Results of Good Safety Culture ........................................................................................................................17
Default vs. Managed Safety Culture .......................................................................................................................18
What Drives Safety Culture? ..................................................................................................................................18
Dysfunctional Safety Culture Not a Root Cause .....................................................................................................19
Safety Culture and Compliance ..............................................................................................................................19
Measuring and Describing a Safety Culture ...........................................................................................................20

Testing Observations for Safety Culture.................................................................................................................20
A Small Slice of Safety Culture ...............................................................................................................................20
Going from a Root Cause Analysis to Safety Culture .............................................................................................21
THE KEY ATTRIBUTES OF FUNCTIONAL SAFETY CULTURE .................................................................22
OTHER VIEWS OF CULTURE AND SAFETY CULTURE...............................................................................23

International Atomic Energy Agency (IAEA)..........................................................................................................23
Institute of Nuclear Power Operations (INPO) ......................................................................................................23

Dr. Thomas E. Murley ............................................................................................................................................24
Professor James Reason .........................................................................................................................................24
Professor Edgar Schein ..........................................................................................................................................25
The U. S. Nuclear Regulatory Commission ............................................................................................................25
The Center for Chemical Process Safety ................................................................................................................26
APPLICATIONS OF SAFETY CULTURE CONCEPTS.....................................................................................26

USNRC....................................................................................................................................................................26
WALKING THE TALK ...........................................................................................................................................28
IMPROVING SAFETY CULTURE........................................................................................................................28

Assessing Your Own Safety Culture........................................................................................................................28
Improving a Good Safety Culture ...........................................................................................................................28
Establishing a Good Safety Culture........................................................................................................................29
LOW HANGING FRUIT..........................................................................................................................................29
PRELIMINARY CONCLUSIONS ..........................................................................................................................29
Appendix A.................................................................................................................................................................31
Conflicts Between Observed/ Inferred Cultural Attributes and Functional Safety Culture....................................31
INTRODUCTION
"When mores (cultural norms) are sufficient, laws are unnecessary, but when mores are insufficient, rules
are unenforceable 1 ."-Sociologist Emile Durkheim
Durkheim certainly rings true here.
“We are what we repeatedly do. Excellence, therefore, is not an act but a habit.”-Attributed to Aristotle
A habit is to an individual as culture is to a group.
The views in this article are based on logic and on the anthropological notion of "culture 2 ." This is not intended to
be creating anything new, but merely developing existing ideas. The reader should expect to see in this discussion a
description of culture, a description of safety culture as a part of culture, some ideas on the importance of culture,
and some ideas on determining what the safety culture is in a defined group. Also we have a section on other views
of culture and safety culture.
The reader should be aware that this article relates primarily to the safety culture of large organizations in the high
hazard industries, e.g., power production, extraction, refining, transportation, health care, law enforcement,
construction… References to other types of organizations are for analogy only.
What is Culture?
The American Heritage Dictionary defines “culture” as the “totality of socially transmitted behavior patterns, arts,
beliefs, institutions, and all other products of human work and thought,” and also as the “predominating attitudes
and behavior that characterize the functioning of a group or organization.”
A minor problem with this definition is that it implies the obligation to determine what is socially transmitted and
what is transmitted by other channels, e.g., genetics. In this work we do not distinguish culture from non-culture by
how it came to be.
The classic view of culture is that it includes

1. Values
2. Norms
3. Institutions
4. Artifacts 3 (things people make and use, e.g., structures, equipment, forms, procedures, signs, equipment,
etc.)
In a nutshell the set of culture differences is that which distinguishes one group from another.
 Culture is to a group as character is to an individual.

 A single observation in a group is to its culture as one weather observation is to climate.
 A single observation in a group is to its culture as one play of a baseball team is to the team’s season.
 An observation is what one gets, but the culture is what an insider expects.
1
Quoted by Stephen Covey in “The SPEED of Trust: Why Trust Is the Ultimate Determinant of Success or Failure
in Your…” Free Press, New York, NY (2006)
2
http://en.wikipedia.org/wiki/Culture
3
Schein uses this term in his monumental work: E. G. Schein, “Organizational Culture and Leadership”, Third
Edition, John Wiley and Son, San Francisco (2004)
Thus a broader point of view would offer that culture is made up of

1. Shared mental content
2. Norms
3. Institutions 4
4. Characteristic physical items 5 ( e.g., structures, equipment, forms, procedures, signs, equipment, etc.)
Figure 1 The Elements (or Components) of Culture
One might ask if the broader view is compatible with the dictionary definition. To explore this we present a table
(matrix) correlating the terms from the dictionary definition to the anthropologically derived elements of culture.
The table can be read focusing on the terms from the dictionary definition, i.e., asking for each dictionary definition
term what culture elements relate. The table can also be read the other way around, i.e., asking for each element
what dictionary definition terms relate. Both methods show the expected reconciliation.
The broader view is fully reconciled with the dictionary definitions as shown in the following table. In particular:
 Behavior patterns are norms.
 Arts involve physical items as well as the institutional aspects of how they are produced.
 Beliefs belong to one class of mental content.
 Products of work include physical items.
 Products of thought are mental content until reified when they become physical items.
4
The term “institution” has many meanings. In this article it refers to internal institutions such as regular meetings,
programs, committees, functional organizational units, task forces, and the like.
5
From now on we’ll often just call these “physical items,” but we mean “physical items (objects) that are
characteristic of the organization.”
 Predominating attitudes are a class of mental content.

 Predominating behaviors are norms.
Thus the broader view is shown to be reconciled with the dictionary definition.
Dictionary Definition vs. Broader View

DICTIONARY BROADER VIEW
Term 1. Mental 2. Norm 3. Institutions 4. Physical Comment
Content Items
Behavior Patterns Match Reconciled
Arts Match Match Reconciled
Beliefs Match Reconciled
Institutions Match Reconciled
Products of Work Match Reconciled
Products of Match Match Reconciled
Thought
Predominating Match Match Reconciled
Attitudes
Predominating Match Reconciled
Behaviors
Examples and Experiments
Example 1: If an organization routinely did extensive pre-job briefs with all members of the work team that would
be a norm. But if a work team did a short perfunctory pre-job brief with a member missing in order to catch up on
the schedule that would be an aberration. (But it might be the norm when schedule pressure is part of the situation.)
Example 2: If observers spend twenty-four continuous hours in a facility control room and note that most of the time
when an alarm annunciates an operator consults the appropriate alarm response card, then using alarm response
cards is part of the culture (a norm).
Example 3: A large government organization that has a good safety record, but a poor quality record starts every
meeting with a safety discussion, but does not start meeting with a quality discussion. The safety discussion at the
start of every meeting is a norm. And short-changing quality is also a part of their culture.
Experiment 1: Think about two commercial companies that you have done business with, say U.S. Airways and
Southwest Airlines. Write down the differences in categories 2, 3, and 4 above. (Category 1 will be troublesome
because it is much less accessible that the other three.)
Experiment 2: Think about two distinctive cultures that you participate in; for example, that of your family of origin
and your spouse’s family of origin. Write down the differences in categories 2, 3, and 4 above. (Category 1 will be
troublesome because it is much less accessible that the other three.)
In the last few decades the term “organizational culture” has become widespread. A collection of material is
available 6 . As will be seen, the safety culture of an organization is a subset of the organizational culture.
DESCRIPTION OF CULTURE
6
http://www.new-paradigm.co.uk/Culture.htm
This section provides a descriptive grounding in how to recognize what makes up culture. It separately deals with
mental content, norms, institutions, and physical items. Of course, each of the four affects the other three. For
example, the norms are affected by the reward system, which is an institution and the reward system itself was
affected by mental content, e.g., beliefs about what people should be rewarded for.
Formal and Informal Parts of Culture

Formal Informal Characterization
Name
Mental How we think around here.
Content
Norms What we do around here.
Institutions How things get done around here.
Physical What one runs into around here.
Items
The following matrix indicates some of the interactions among the parts of culture. This matrix is
to provide an idea of the richness of the interaction.
Cultural Inter-relations Among Elements

(The Element in the Left Hand Column affects the Element in the Other Columns as shown in
the Cell.)
Affecting Element Mental Content Norms Institutions Physical Items (PI)
(MC)
Mental Content Stabilizes and Drives norms. Drives norms. Affects the
(MC) narrows MC. behavior that
produces and
maintains PI.
Norms Shape MC by Stabilize and Drive the norms Affect the
modeling narrow norms. of the behavior that
acceptable MC. institutions. produces and
maintains PI.
Institutions Shape MC by Stabilize and Stabilize and Affect the
modeling and narrow norms. narrow behavior that
reinforcing it. institutions, e.g., produces and
themselves. maintains PI.
Physical Items (PI) Shape MC and Stabilize and Affect the Affect the
indicate the narrow norms. selection and behavior that
espoused MC. operation of produces and
institutions. maintains PI.
Shared Mental Content
Shared Mental Content consists, in part, of beliefs, values, cognitive models, unwritten rules, attitudes, prejudices,
mental short-cuts, rules-of-thumb, skills, accepted fallacies, tribal knowledge, paradigms 7 , heuristics 8 , etc. It is all of
those identifiable mental items that are generally shared by the members of the group.
For example, some communities share a belief in "the Golden Rule." This would be shared mental content.
Another mental content example would be “The customer is always right.” This was at one time prevalent in
handling customer complaints. When put into practice this would be a norm. If it were written down in an employee
training course it would also be a physical item.
Another example of shared mental content would be the industrial operations mantra of “Stop-Think-Act-Review”
(STAR) that is a model for what one might hope is a prevalent mental approach to conducting operational
manipulations.
One potential intuitive definition of a very robust culture might be the synchronized mental content of a group. It
appears that the more robust a culture the more completely synchronized the mental content of the individual
members.
One of the functions of culture is to synchronize the shared mental content. One of the ways of synchronizing the
shared mental content is by punishing, even rejecting (firing, excommunicating, ostracizing, deporting, exiling)
members who do not synchronize their mental content with the shared mental content of the culture.
In system dynamics the term "mental model" is often used. Its implications would are useful here. “Mental model”
goes to a shared understanding of the dynamics of safety culture, including all the ways one's actions can impact on
safety culture over time from an overall systems perspective. By including these dynamics in mental content, people
would not only share beliefs, but would have a common basis for knowing what actions to take to manage safety
culture and what to expect from those actions 9 .
Norms
In this context a "norm" is the behavior that is usually encountered in a specified situation. The above example of
doing pre-job briefs is a norm. Norms can be observed and recorded. Most of them can be either videotaped or
audiotaped. On the other hand mental content cannot be observed directly and there is not always a one-to-one
mapping of mental content to observable effect.
Anecdotal evidence suggests that mental content is a strong influence on norms. The psychology pioneer William
James has been quoted as saying “Thinking is for doing.” The psychotherapy pioneer Fritz Perls has been quoted as
saying “Thinking is rehearsing.” But the norms themselves are what are available for observation. But the mental
content is not available for observation.
Norms are the behaviors normally and usually encountered in identifiable situations, e.g.
Situation: Before starting a job
Behavior: Conducting a pre-job brief
Norms include language, traditions, rituals, customs, traits 10 , and the like. These can be characteristic of an
individual of a group. When they are characteristic of an group they are referred to as the culture.
7
For an explanation see http://en.wikipedia.org/wiki/Paradigm
8
For an explanation see http://en.wikipedia.org/wiki/Heuristic
9
Cudlin, R., Private communication March 9, 2008
10
The subject of “Trait Theory” is a complementary view of culture. See http://en.wikipedia.org/wiki/Trait_theory
Language
It may well be that a common language is a foundation norm for a culture, since language is a key medium for
transmitting mental content, norms, institutional processes, and written physical items.
The language of a large city hospital will sound very strange to a new patient who has not previously spent time in
one. But, I am told, the language of one large city hospital in the United States is pretty much like any other. What
would it say about the safety culture of a hospital whose language norms were different from other similar hospitals?
Language includes vocabulary, formality, uniformity, lingo, jargon, and the like.
It would be easy to argue that the use of a particular language would be both mental content and a norm. When the
language is written it is revealed as a physical item.
Norms and Morality
Recent research in the field of “Moral Psychology 11 ” has reactivated interest in the views of sociologist Emile
Durkheim that morality binds and builds; it constrains individuals and ties them to each other to create groups that
are emergent entities with new properties.
“A moral community has a set of shared norms about how members ought to behave, combined with the means for
imposing costs on violators and/or channeling benefits to cooperators.”
Even the “means for imposing costs and/or channeling benefits” can be norms, as people who grew up in large
families or tight neighborhoods may have observed. In this sense the norms are self-reinforcing. In the extreme these
norms can include ostracizing individuals whose behavior is at odds with the norms.
The following table gives an introduction to the work in this area. The columns are labeled with what are sometimes
called “The Five Pillars of Morality.”
11
Haidt, Jonathan, “The New Synthesis in Moral Psychology,” SCIENCE, Vol. 316, 998-1001
One of the research challenges is to explore how one pillar trumps another. For example, under what circumstances
does “Ingroup/ Loyalty” orientation tend to keep members who know of wrongdoing or safety infractions in the
organization from reporting it in accordance with their commitment to “Harm/ Care” and “Fairness/ Reciprocity”
concerns? Recent personnel inattentiveness issues and record falsification issues at nuclear power plants makes this
of more than academic interest.
Other Norms
The STAR (Stop-Think-Act-Review) approach, if done with self-narration and/or gesturing, would be an observable
norm.
In the communications in the aircraft flight deck and between the aircraft and flight controllers the NATO Phonetic
Alphabet (Alpha, Bravo, Charlie…) is used. This is an observable norm. This norm is not observed consistently by
non-pilot airline employees, not even by those who could reduce error rates by doing so.
In certain non-public schools the students stand up when a faculty member enters the classroom, but this is not
generally done in other schools. This is an observable norm.
In some organizations there is a strong norm of being in the classroom ready to learn at the designated time, but in
others students show up late or not at all.
In some cultures men and women eat in different rooms, but in the contemporary American culture men and women
eat together. This is an observable norm.
Some norms are hierarchical or rank-based, i.e., they apply to some levels of the organization, but not others, e.g.,
executives eat in a special dining room. Some norms are classification-based, e.g., salaried professionals do not
punch a time clock.
Institutions
This article deals mainly with the cultures of large organizations. In this context, institutions are the sub-
organizations and processes by which a group does its activities. For example, the Plains Indians in the early
nineteenth century in the U. S. West harvested North American bison (buffalo) by the institution called the "hunting
party."
As another example, medieval cities controlled craft training and quality by an institution called “the Guild.” In
colonial America immigration and labor supply were supported by an institution called “indentured servitude.”
The government of the United States collects much of its taxes by an institution called the "Internal Revenue
Service." In New England many communities still make important decisions by means of an institution called the
“Town Meeting”, whose name has been “borrowed” for less formal purposes and to romanticize political gatherings.
Some parts of the high hazard industries have “Corrective Action Programs” for formally processing problems and
improvement opportunities. These programs are institutions that are part of the culture.
Some organizations that have Corrective Action Programs also have other institutions called “Corrective Action
Review Boards” tasked to supervise the Corrective Action Program. Since the members of the Corrective Action
Review Boards (CARBs) are often managers whose budgets must absorb corrective actions they sometimes tend to
hold the output of the Corrective Action Programs to modest standards of effectiveness. One of the effects of a
CARB is to narrow the range of what is acceptable by the CARB itself. Those who appear before the CARB soon
learn “what will fly” and what will be rejected.
In high hazard industry organizations there are hundreds of institutions that are recognized as “programs.” Each of
these is a separate institution. Some of these are: configuration management, drawing update, plant labeling,
industrial hygiene, hearing protection, employee concerns, employee assistance, maintenance expert panels…
In summary, it is fair to include at least the following in “institutions”:

 Named subgroups, e.g., town council, capital project review committee, CARB
 Named processes, e.g., land use review hearing, wedding, operational readiness review
 Named gatherings, e.g., post-event stand down meeting, plan-of-the-day meeting
 Named programs, e.g., in-service inspection program, quality assurance program, operational experience
program
 Named positions, e.g., town manager, chief engineer, certified safety professional, root cause team leader,
radiation safety officer
Characteristic Physical Items
Characteristic physical items are those tangible entities that are found in a culture. These items have a variety of
origins and purposes, but all are characteristic of the culture. For example, most of the known Native American
tribes produced stone arrowheads. As another example, Meso-American Indians had sacrifice altars, but North
American Native Americans did not.
An important subset of physical items is signs, symbols, totems, and the like. For example, since late 2001 most
American politicians wear lapel pins in the form of a U.S. flag. Submarine sailors wear their dolphins. Aviators
wear their wings.
In many high hazard industry organizations employees wear laminated cards with information and slogans related to
safety and organizational standards. Sometimes personnel will be observed to have as many as six such cards,
prompting such irreverent terms as “Management by Lamination.” These cards are characteristic physical items. But
the wearing of them would be a norm.
In modern U. S. culture we encounter tattoos, facial jewelry, cellular telephones and iPods. Of course, other modern
cultures share those characteristic physical items, but cultures that share them are different from those that don't.
In modern U. S. culture most public meeting rooms have the American flag on the left and the state flag or the flag
of the organization on the right. These are characteristic physical items.
Physical items affect behaviors and thereby affect norms. For example, if pre-job briefs are conducted in hot, noisy,
dusty rooms the pre-job briefs will be short and probably incomplete. If management wants to reduce the time spent
on pre-job briefs they can accomplish this by changing the physical situation.
A favorite characteristic physical item from oriental cultures is “chop sticks.” Their use is a norm. The hibachi meal
could be considered to be an institution.
Other physical items that affect norms are speed bumps and rumble strips. They tend to generate norms consistent
with safe driving. This is consistent with Senge’s insight that structure influences behavior 12 .
The Importance of Culture
One of the important effects of culture is its use to encourage (sometimes coerce) conformity of its members.
Culture enables members of the culture to differentiate themselves from non-members. Culture can create a bonding
(or binding) of members of the culture.
Persons within a culture who deviate from it are called renegades, outlaws, heretics, apostates, "weirdoes,"
aberrants, and the like. Some cultures include within the culture the harsh treatment of those who deviate from the
culture. These persons are often called “aberrants.”
For several centuries certain aberrants were treated with severe harshness in both Europe and America. In Europe
this was done by an institution called “The Holy Inquisition” and in America this was most famously illustrated by
the institution now known as the Salem Witch Trials.
A famous aberrant was Henry David Thoreau, who was jailed for not paying a tax to support government policies he
objected to. Another was the abolitionist John Brown. A widely admired aberrant was John Chapman (aka Johnny
Appleseed). President Teddy Roosevelt was a celebrated aberrant with many emulators. A less admired aberrant was
Dr. Timothy Leary.
In cultures that put loyalty above other values “whistleblowers” are treated as aberrants. They are called “rats,”
“snitches,” “dime droppers,” and the like. The revulsion of this type of aberrant is probably related to the moral
strictures of loyalty as an overriding value, as discussed by Haidt, in the article mentioned above. Apparently,
wrong-doers and corner-cutters exploit this moral stricture.
Strong cultures have strong compliance effects on their members. In the U. S. naval submarine service peer pressure
to comply with the cultural norms is reported by some to have had a beneficial effect on the performance of the
crew.
One might observe that the stronger a culture the less aberration, i.e., the less deviation from the culture. This goes
both ways. If an observer notes a beneficial activity in a strong culture they can safely conjecture that it is
widespread. On the other hand, if the observer notes a dysfunctional activity, they can also safety conjecture that it is
widespread if the culture is strong. The power of culture to suppress aberration can also suppress innovation.
12
Peter M. Senge, The Fifth Discipline: The Art & Practice of The Learning Organization (New York: Currency
Doubleday, 1990), 371 p.
Individuals must assimilate (adopt and conform to the culture) to "get ahead" in a culture. Refusal to assimilate or
being unable to assimilate the culture is almost certain to be a "career limiting" trait. One suspects that many
conscientious whistleblowers are not assimilated. Daniel Ellsberg comes to mind.
Strong culture will either coerce compliance or will reject the aberrant. Read Hawthorne's novel "The Scarlet Letter"
for example. Other good examples are the lives of Roger Williams, Anne Hutchinson, Martin Luther, Martin Luther
King, Jr., and Hyman G. Rickover, to name a few. Those who do not adopt the culture can succeed by understanding
it and exploiting its idiosyncrasies, if they are not ostracized by those who do adopt the culture.
Acculturation
Acculturation is the process of converting a non-member of the culture to being a member of the culture. We are not
born with the mental content and norms of a member of our parents' culture. We are acculturated by our parents’
child rearing processes and by our contact with schools, faith communities, sports teams, etc.
Similarly people who are introduced to an organization from the outside must be acculturated in some way. The
armed services have basic training (boot camp) for this purpose. Some schools and colleges have “orientation
week.” Most high hazard industry organizations have “general employee training” for this purpose. Some
occupations do this by apprenticeships and internships.
Interestingly, the acculturation process of a culture is part of the culture. It is one of the "institutions." When
observing a culture one of the lines of inquiry would be how the culture acculturates new members.
A problem in parts of the high hazard industries is the use of contractors within the facility since the contractors
have not been acculturated. Sometimes contractors are given work that would be slowed down if done by the facility
workers with their careful safety culture.
When a culture has been condemned, e.g., by OSHA 13 or the CSB 14 , the whole organization must be re-
acculturated. This is often done by bringing in new leadership from the outside. This new leadership has not been
habituated to the previous culture and therefore is expected to be able to see its dysfunctionality more clearly.
DESCRIPTION OF SAFETY CULTURE

Safety Culture
Simply put, safety culture is that part of culture that relates to safety. It is the subsets of the following that relate to
safety:
1. Shared mental content
2. Norms
3. Institutions
4. Characteristic physical items (i.e., things people make, have, use, or respond to, e.g., forms, procedures,
signs, equipment, etc.)
A Venn Diagram of culture would have a totally enclosed smaller area labeled “safety culture.”
13
U. S. Occupational Safety and Health Administration
14
U. S. Chemical Safety and Hazard Board
Figure 2. Safety Culture is part of Culture
Notice that, logically speaking, an element of safety culture can be either functional, i.e., supporting and reinforcing
the function called “safety” or dysfunctional, i.e., undermining and discouraging safety 15 . As long as a part of the
culture affects safety it is part of the safety culture.
All organizations have cultures and all have subsets that make up safety cultures 16 . There is as much variety in
safety cultures as there is in cultures. Near the ends of the spectrum are the safety cultures of street gangs and the
safety cultures of nuclear aircraft carriers.
Recently safety culture has been illuminated by high level reviews such as the Baker Panel review of BP refineries
after the Texas City explosion 17 . The Baker Panel emphasized the “shared” aspects of safety culture.
Safety Culture vs. a Culture of Safety
15
An even tempered explanation is given by Andrew Hopkins in: Hopkins, Andrew, “Safety Culture, Mindfulness
and Safe Behavior: converging ideas?”, Working Paper 7, Australian Research Centre for OHS Regulation,
December 2002.
16
Even faith communities have a part of their culture related to the safety of at least some members and some
physical assets.
17
http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pdfs/Baker_panel_report.
pdf
At the risk of seeming to quibble, we distinguish between “a safety culture,” that every group has, for better or for
worse, and “a culture of safety 18 ,” which is achieved only by the admired few organizations. “Safety Culture,” as
used in this paper is a subset of culture, but “a culture of safety” is a culture in which the shared mental content, the
norms, the institutions, and the physical objects all aim appropriately at safety.
Shared Mental Content
The shared mental content is inherently inaccessible. Some of it can be inferred from behaviors (including speech
and writing), institutions, and physical items.
There is much effort to measure shared mental content by taking opinion surveys. The results of these should be
taken with extreme skepticism for a variety of good reasons. This is not to say that all opinion surveys are useless or
misleading.
The first reason to suspect opinion survey results is that the respondents may not be candid. All but the simple-
minded know what the “right” answers are. The opinion survey does not measure what people have in their heads it
measures what they put down on paper. They only put down what they are willing to put down. The common sense
legal principle of “best evidence 19 ” motivates against relying on opinion surveys when field observations are
available.
The survey respondents that wish to support management give the right answers to help management, perhaps by
helping "get the keys back" from the government regulator. The respondents that do not support management might
know that they can "get back at management" by giving answers that indicate a dysfunctional safety culture.
This lack of candor may not be entirely voluntary. Could peers give suggestions as to how the survey questions
should be answered? How about immediate supervisors or bargaining unit leadership?
Common organizational phenomena 20 affect survey responses as well as other organizational attributes. Some of the
ones that can affect the validity of survey results are Cognitive Dissonance Reduction, “Frog Boiling,”
Normalization of Deviance, Habituation of Risk, Risk Homeostasis, “The Unrocked Boat,” conflicts of interest, and
the like.
Another factor that is thought to affect culture survey results is the recentness of management initiatives affecting
the work force. These include downsizings, mergers, acquisitions, reorganizations, management shufflings, benefit
changes, and the like. When a culture survey is taken just after a severe safety event or a severe regulatory
intervention the culture survey results can be skewed by the respondents feelings of guilt, remorse, and atonement.
It is far more reliable to back out the mental content from observations of behaviors, institutions, and physical items.
In addition, when the observations of behaviors, institutions, and physical items are inconsistent with the culture
survey results, the survey results should be suspected first. Survey results not corroborated by observations of
behaviors, institutions, and physical items are on shaky ground at best.
Another concern with safety culture surveys is that they are interpreted as elections, i.e., whatever is chosen by a
majority is taken to be the culture. For example, even a small number of people who say that they do not report
safety concerns would not be tolerated in a strong safety culture. Similarly, having a small number of employees
who say that their supervisor tolerates unsafe acts to meet schedules would be unacceptable.
Norms
18
Hopkins, Andrew, “Safety culture, Mindfulness and Safe Behavior: converging ideas?”, Working Paper 7,
Australian Research Centre for OHS Regulation, December 2002.
19
http://en.wikipedia.org/wiki/Best_evidence_rule
20
If you do not recognize these just “Google” the term.
The part of culture that is of extreme importance to safety is the set of normally encountered behaviors in defined
situations. This is what strongly affects the actual achievement of systems, structures, and components (SSC) to
"perform satisfactorily in service 21 ", i.e. to do what they are supposed to do under the conditions that they need to do
it in and to prevent subjecting them to challenges for which they are not suited.
An observer can find out what this part of the safety culture is at a nuclear power plant (NPP) by watching for
identifiable situations and noting the normally encountered behavior.
For example, the uniform use of the (NATO) phonetic alphabet 22 to avoid communication mix-ups would be a
safety culture norm. Another common safety culture norm is the use of repeat-backs and confirmations known as
“three part communication 23 .”
As an example of a dysfunctional norm related to safety culture there was a two-unit nuclear power station at which
the norm in discussing components was to leave off the unit designation. This was discovered during the
investigation of a wrong unit mix-up.
Also, at the same station there was a dysfunctional safety culture norm of not reporting non-consequential wrong
unit mix-ups. In other words, if personnel intended to act on one unit, but found themselves in the other unit, they
would not report the mix-up unless it resulted in a self-revealing event.
Every dysfunctional behavior identified in the investigation of an event can be either part of the culture or an
aberration. The investigators cannot tell without determining the extent of the behavior. If it is ubiquitous or nearly
so it is part of the culture. It is a nom. Otherwise it is an aberration, i.e., an island of inconsistency.
Institutions
As part of safety culture, institutions include the sub-organizations, programs, and processes by which a group does
its activities involved with safety. These include procedure writing, procedure upgrading, work planning, work
scheduling, etc. Also included are the condition screening function, the root cause analysis function, the condition
tracking function, etc.
The safety culture institutions also include oversight institutions. These include the corrective action review board,
the plant operations review committee, the quality assurance function, the offsite safety review committee, the
operator training program review group, etc.
With respect to safety culture a given institution can be functional or dysfunctional. For example, in the years
before the 2002 Davis-Besse Reactor Vessel Head Degradation near miss loss of coolant accident all of the
previously mentioned institutions, both individually and jointly, failed to “connect the dots” to see that a serious
safety threat was developing.
Sitting through the meetings of some of these institutions or those of its overseers can yield insights into the safety
culture. Do they promote and reinforce good safety culture in the overseen functions? Do they focus on achieving
safety or on being "bullet-proof?"
Especially Important Institutions
Some of the institutions are especially important in that they not only reflect the safety culture, but they also
influence what it is. These include the selection-promotion-succession system, the reward-punishment system, the
training program, the new employee orientation program, and the corrective action program, to name a few.
21
10CFR50, Appendix B, Quality Assurance Criteria (Introduction)
22
http://en.wikipedia.org/wiki/NATO_phonetic_alphabet
23
For example, see http://www.hss.energy.gov/NuclearSafety/techstds/standard/std1031/s1031cn.pdf
The Selection-Promotion-Succession System
The selection-promotion-succession system determines what types of persons are in positions of all kinds, including
those whose activities are part of the safety culture and those whose activities influence the safety culture. This
system is expected to deliver into each position a person who shares the safety culture of the organization. Thus the
selection-promotion-succession system, in electronic terminology, is a positive feedback system. It uses its outputs
to amplifies its own inputs. It is possibly the most leveraged institution. In most instances it results in management
becoming a group of like-minded individuals who will see or not see anomalies in the same way and, if they see the
anomalies, they will evaluate them in the same way, producing situations like Bhopal, Three Mile Island, and Davis-
Besse.
Infrastructure
Infrastructure includes the interface between institutions and physical items. (Physical items are addressed next.) As
Bob Cudlin has pointed 24 out good infrastructure inherently reinforces good safety culture and poor infrastructure
increases the challenges to safety culture. Readers who have struggled with awkward corrective action program
software will recognize this immediately.
Characteristic Physical Items
Characteristic physical items of safety culture are those tangible entities involving safety that are found in a culture.
These items have a variety of origins and purposes, but all are characteristic of the culture.
These include condition report forms, condition reports, root cause analysis guidelines, etc. They also include all
varieties of instructions, procedures, and drawings that relate to safety. In addition they involve physical systems,
structures, and components whose performance can involve safety. Furthermore they include personal protective
equipment (PPE), safety tags, and the whole arsenal of safety equipment and devices.
The Results of Good Safety Culture
"By their fruits you shall know them 25 " is not a new idea. Other things being equal, good safety culture results in:
1. Events and challenges being more rare than they otherwise would be.
2. Events and challenges being more mild than they otherwise would be.
3. Operation being further within safe limits than it otherwise would be.
4. Safety and back-up equipment being more known to be in better readiness than it otherwise would be.
5. Personnel being more known to be in better readiness to respond than they otherwise would be.
6. Management having more accurate knowledge of the state of the safety culture.
Reflection on egregious adverse events shows that the above results were not achieved. Whenever a situation occurs
in which any of the above six results are not achieved there is an opportunity to improve the safety culture.
The table below gives some examples of the results of a good safety culture.
24
Cudlin, R., Private communication March 9, 2008
25
Matthew 7:20
Default vs. Managed Safety Culture
Cultures, hence safety cultures, are of two classes: default culture that "just happens" and managed culture that is the
result of deliberate management actions in performance shaping and reinforcement. Two of the many examples of
managed cultures are those of the United States Marine Corps and the United States Navy Submarine Force.
In managed cultures leaders are aware of the cultures they want and relentlessly drive the achievement of it.
Unnecessary islands of inconsistency are sought out and eliminated. Subordinate leaders know that they cannot be
aberrant and survive. Paradoxically, part of managed functional culture is the openness to realize that the culture
must adapt.
Unfortunately there are many examples of default cultures in local, state, and federal government agencies. Some of
these are due to the reluctance of appointed officials to impose their ideas on the organization for fear of being
accused of meddling or discrimination.
Does management understand that their job is to shape the safety culture? Do they realize that their every action
sends a signal affecting the safety culture? Do they know that when bad things happen one of the factors is the safety
culture?
What Drives Safety Culture?
From one perspective safety culture can be regarded as a cause, in that behaviors and conditions consistent with a
given safety culture can be part of the causation of adverse safety events. On the contrary, safety culture can be
regarded as an effect, in that it is produced, shaped, driven, refined, reinforced…by deeper factors.
Best professional friends part ways on what drives culture in general, and on what drives safety culture in particular,
but what we do know is that the laws of behavioral technology have not been suspended. Here we scratch the
surface.
 We know that people do what they’ve done before, so that inertia has a strong influence on culture.
 We also know that what gets rewarded gets repeated, so that the actual incentive schedule is a strong
cultural determinate.
 We also know that null consequences tend to extinguish functional behavior, so that the failure to reinforce
behaviors tends to eliminate it.
 We do know that people tend to imitate admired others, so that behavioral modeling is a strong cultural
determinant.
 We do know that structure, in every sense of the word, influences behavior.
Dysfunctional Safety Culture Not a Root Cause
It is probably a serious logical error to believe that dysfunctional safety culture is a root cause of any adverse safety
consequence. Doing so would lead investigators to stop probing the factors that resulted in the dysfunctional safety
culture. Since few see value in digging deeper than “the root causes” it becomes important to avoid calling a weak
safety culture a root cause.
Once a root cause analysis effort concludes that dysfunctional safety culture is a cause of an adverse safety
consequence, the next question is, “What were the factors that resulted in the nature, the magnitude, the location,
and the timing of the dysfunctional safety culture?” This question would drive the investigators into the topic
introduced above, namely, the performance shaping factors that drive safety culture.
An investigation that concludes that dysfunctional safety culture is a root cause is flawed if it stops going deeper
than that root cause. On the other hand, if it concludes that dysfunctional safety culture is a root cause and it goes
deeper it is contradicting its own conclusion by going deeper than a root cause.
Safety Culture and Compliance
In the nuclear power industry in the United States, it so happens that there is a document that describes on a results
basis, rather than on a behavioral basis, what good safety culture is. This is 10CFR50, Appendix B, Quality
Assurance Criteria.
My observations of departures from good safety culture that have resulted in serious incidents at nuclear plants is
that every departure from good safety culture that has resulted in those serious incidents also turns out to be a
departure from one or more of the 90-odd sentences in Appendix B. So far, all of the serious incidents at nuclear
plants that I have been aware of were the result of specific manifestations of dysfunctional safety culture that happen
to be also departures from Appendix B.
Unfortunately, most of the nuclear plant personnel that I have interviewed have only the most cursory knowledge of
what is in Appendix B. Strangely, knowledge of Appendix B is not a high priority even though not acting as if
Appendix B is understood is always a characteristic of the behaviors and conditions that lead to serious nuclear
power plant events. Part of the safety culture of the Nuclear Regulatory Commission is its struggle to recognize and
address this issue.
(I am still seeking an equivalent document that applies outside the nuclear industry. The OSHA requirements for
process safety management are close.)
Measuring and Describing a Safety Culture
The safety culture of an organization can be measured and described simply by recording observations of norms,
institutions, and characteristic physical items. Observing mental content is a problem because it cannot be observed
directly.
Mental content can be somewhat unreliably measured by “culture surveys.” It can be more reliably accessed by
inference from behaviors, institutional functioning, and characteristic physical items. The results of safety culture
surveys are often dismissed when they deviate from management’s intuitive feelings about the safety culture.
Sometimes the managers are on solid ground and sometimes not.
Norms cannot be observed directly either. What can be observed is behavior. It is a separate activity to determine the
extent to which a given observed behavior is an instance of a norm. For example, in some organizations members
exhibit espoused behaviors when they know they are being observed, but revert to the actual norm when the
observer is absent.
Testing Observations for Safety Culture
All observations will be samples of the culture or they will be aberrations. If it is usual, normally encountered,
widespread …, it is culture. Otherwise it is an aberration.
If the observation is part of the culture and it involves safety in some way it is part of the safety culture. Otherwise,
it is part of the larger culture, but not part of the safety culture.
If it promotes, supports, or reinforces safety it is part of the functional safety culture. If it doesn’t it is part of the
dysfunctional safety culture.
Since safety cultures are not uniform across large organizations, observations must be made at various times and of
various situations as well as of various personnel. This may reveal important islands of inconsistency, sometimes
called sub-cultures. For example, in some organizations training personnel almost never report safety anomalies, not
because they don’t see them, but just because it is “not what they do.”
A Small Slice of Safety Culture
Culture Element Category Comment/ 10CFR50 App. B

The ability to detect deviations from safe Shared Mental Content If this exists in an organization it
behaviors and from safe conditions. would be considered to be part of
functional safety culture./ Criterion
XVI, Sentence 1.
Training to instill the ability to detect deviations Institution If this exists in an organization it
from safe behaviors and from safe conditions. would be considered to be part of
II, Sentence 8.
Detecting deviations from safe behaviors and from Norm If this happens in an organization it
safe conditions. would be considered to be part of
XVI, Sentence 1.
Reporting detected deviations from safe behaviors Norm If this happens in an organization it
and from safe conditions. would be considered to be part of
functional safety culture. ./ Criterion
XVI, Sentence 1.
Culture Element Category Comment/ 10CFR50 App. B

Forms for reporting detected deviations from safe Physical Item If these are available in an
behaviors and from safe conditions. organization and they are well
designed it would be considered to
be part of functional safety culture. ./
Criterion XVII, Sentence 1.
Process for handling forms for reporting detected Institution If this exists in an organization and it
deviations from safe behaviors and from safe works well it would be considered to
conditions. be part of functional safety culture. ./
Criterion XVI, Sentence 1.
Process for investigating the factors that resulted Institution If this exists in an organization and it
in reported deviations from safe behaviors and works well it would be considered to
from safe conditions. be part of functional safety culture. ./
Criterion XVI, Sentence 1.
Process for investigating the factors that resulted Institution If this exists in an organization and it
in reported deviations from safe behaviors and works well it would be considered to
from safe conditions and/or their causes not being be part of functional safety culture. ./
reported earlier. Criterion XVI, Sentence 1.
Going from a Root Cause Analysis to Safety Culture
Performing a root cause analysis of a safety event is discovering the factors that resulted in the nature, the
magnitude, and the timing of an important consequence. These factors are behaviors and conditions. Often they
involve norms, institutions and physical items.
Recent root cause analyses include extent of condition and extent of cause. When the extent of a behavior is
sufficiently broad it may be called a norm.
For example, the root cause analysis of a nuclear power plant mix-up event mentioned earlier revealed the following
norms:
1. Personnel were not expected to check the unit designation of their work orders and other work instructions
against the unit designations on doors, rooms, and components they encountered in the process of a job.
2. Personnel did not usually mention the unit designation when they were discussing components.
3. Personnel accompanying job leaders were not expected to observe the self-checking behaviors of the job
leader.
4. Pre-job briefs did not include discussion of measures to avoid and detect mix-ups.
Interestingly enough, the above was revealed as a result of “out-of-the-box” thinking by the root cause team, not as a
result of following the station’s root cause analysis processes (an institution). Ironically, the investigation also
revealed that the station’s forms, procedures, labels, and signs were models of unit designation markings (physical
items).
Thus a root cause analysis can provide information about the safety culture by providing information about norms,
institutions, and physical items. However a root cause analysis cannot provide explicit safety culture information
unless extent is taken seriously and the root cause analysis team knows what safety culture is.
Up until quite recently safety culture was mentioned in high level event investigation reports, but not in others. For
example, it was mentioned in the Baker Panel report 26 on BP, but not in the initial BP report that preceded it 27 .
Safety culture has rarely been mentioned in a nuclear industry Licensee Event Report.
26
http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/SP/STAGING/local_assets/assets/pdfs/Bak
er_panel_report.pdf
Safety culture has generally not been mentioned in NRC Inspection Reports until quite recently.
THE KEY ATTRIBUTES OF FUNCTIONAL SAFETY CULTURE
This section is a very cursory collection of the key attributes of functional safety culture. It is derived mainly from
recollections of the analyses of events in which dysfunctional safety culture was retrospectively revealed.
ATTRIBUTE CATEGORY Comment/ 10CFR50 App. B

Transparency: We do business in such a way that Mental Content, i.e., a For optimal effectiveness this needs
it is easy for participants and others to see what’s principal or a value. to be applied to norms, institutions,
wrong. Manifested in norms, and physical items.// This supports
by the functioning of Criterion XVI, Sentence 1. It is a
institutions, and in key ingredient of “measures to
physical objects, i.e., assure that conditions adverse to
documents. quality are promptly detected.”
Integrity: We can prove that what we say and Mental Content, i.e., a For optimal effectiveness this needs
write is the truth, the whole truth, and nothing but principal or a value. to be applied to norms, institutions,
the truth. Manifested in norms, and physical items.// This supports
by the functioning of Criterion XVII, Sentence 1. It is a
institutions, and in key ingredient of “sufficient records
physical objects, i.e., to furnish evidence of activities…”
documents.
Competency: We only assign people to activities Mental Content, i.e., a For optimal effectiveness this needs
affecting safety who are actually qualified to principal or a value. to be applied to norms, institutions,
perform them. Manifested in norms, and physical items.// This supports
by the functioning of Criterion II, Sentence 8. It is a key
institutions, and in ingredient of “to assure that …
physical objects, i.e., proficiency is achieved…”
documents.
Positive Control: What happens is what we intend Mental Content, i.e., a For optimal effectiveness this needs
to happen and that’s all that happens. When principal or a value. to be applied to norms, institutions,
positive control is lost we re-establish it before Manifested in norms, and physical items.// This supports
going on. by the functioning of Criterion II, Sentence 5. It is a key
institutions, and in ingredient of “under suitably
physical objects, i.e., controlled conditions.”
documents.
Prompt Problem Identification: We find our own Mental Content, i.e., a Management can judge this one by
problems at the first opportunity. Downstream principal or a value. the monotonic decrease in the
identified adverse conditions get immediate frequency and severity of
investigation to refine our problem identification. downstream identified adverse
conditions.// This supports Criterion
XVI, Sentence 1. It is a key
ingredient of “measures to assure
that conditions adverse to quality are
promptly detected.”
27
For example,
http://www.bp.com/liveassets/bp_internet/us/bp_us_english/STAGING/local_assets/downloads/t/texas_city_interim
_report.pdf
OTHER VIEWS OF CULTURE AND SAFETY CULTURE
An internet search on “Culture” or “Safety Culture” will quickly inform the reader that a variety of views exists.
Patrick O’Hara gives a fine starting point list of links on his web site 28 . A collection of papers on nuclear power
plant safety culture is available in book form 29 . The U. S. Department of Energy has provided a sampling of “Safety
culture Resources” on their web site 30 . The rest of this section is a non-exhaustive sampling of views.
International Atomic Energy Agency (IAEA)
After Chernobyl IAEA surfaced the term “Safety Culture.” Their definition 31 , which has been copied many times
over is:
Safety culture is that assembly of characteristics and attitudes in organizations and individuals which
establishes that, as an overriding priority, nuclear plant safety issues receive the attention warranted
by their significance.
As it turns out this has been the foundation of much work on safety culture. The reader of the safety culture
literature will see this and variations of it over and over again. Since it comes from such a prestigious source later
thinkers have struggled to make it useable.
Comments:
1. It purports to define “Safety Culture” as applying only to “nuclear plant safety issues.” Safety culture
clearly applies more broadly, as has been rediscovered recently by the U.S. Chemical Hazard and Safety
Board (CSB) 32 .
2. It creates the needs to define what is meant by “characteristics.” If it means everything in my definitions
above except attitudes, then I am in closer agreement.
3. Safety culture is defined in such a way that there cannot be a dysfunctional safety culture. This could be
patched up by either starting the definition with the words “Good safety culture” or replacing the words
“establishes that” with the words “results in the extent that.”
4. It does not explicitly recognize a) mental content, norms, institutions, and physical items as being elements
of safety culture.
5. The IAEA definition would be less problematic if it began with “A culture of nuclear safety is…” rather
than “Safety culture is…”
Institute of Nuclear Power Operations (INPO)
In a presentation 33 , the President and CEO of INPO said that “safety culture” is “An organization’s values and
behaviors—modeled by its leaders and internalized by its members—that serve to make nuclear safety the
overriding priority.” This definition shares attributes with the IAEA definition reported above.
Mr. Ellis concludes:

• It is not possible to develop a comprehensive safety culture indicator.
• Safety culture is not a broad umbrella under which all things fall.
• Nuclear safety is the responsibility of those who own and operate the plants.
28
http://nuclearsafetyculture.freeyellow.com/page7.html
29
Wilpert, B. and Naosuke, I.,”Safety Culture in Nuclear Power Operations,” some of which is available online at
http://books.google.com/books?id=9ozvPd5UlEIC&dq=bernhard+wilpert+and+naosuke+itoigawa&printsec=frontc
over&source=web&ots=rQOhTRgeYa&sig=o5_L_CaUGP18UYD-b62OroWjRUE#PPP1,M1
30
http://www.hss.energy.gov/HealthSafety/ism/safetyculture.asp
31
IAEA, Safety Series, INSAG-4 at www.doeism.org/SafetyCulture/rptSeries-IAEA-1991.pdf
32
http://www.csb.gov/index.cfm?folder=news_releases&page=news&NEWS_ID=355
33
http://www.hss.energy.gov/HealthSafety/ism/SafetyCulture/OperatorsPerspective_JimEllis_05.pdf
Dr. Thomas E. Murley
Dr. Murley, a pioneer in safety culture thinking, and a former Regional Administrator for the USNRC has done
important work in this area for the Nuclear Energy Agency. Here we only sample his contributions.
Murley points out the need for the regulator as well as the operating organization to have a good safety culture34 .
Naturally, a regulatory that espouses good safety culture without exhibiting it is in danger of appearing hypocritical
and losing credibility. In Murley’s words “In promoting safety culture, a regulatory body should set a good example
in its own performance.”
Comment: Murley’s line of thinking would imply, among other things, that regulators should establish measures to
assure that conditions adverse to safety in their own organization should be promptly identified and corrected as the
regulator expects from the operating organization. This would be better stated as a sort of “reverse Golden Rule,”
viz, “Do unto yourself what you demand from your licensee.”
Professor James Reason
Professor James Reason of the U.K, a well-known safety scholar has had much to say about safety culture. For
purposes of this paper it is noteworthy that he breaks safety culture into five subsidiary cultures 35 :
1. “Informed Culture”
2. “Reporting Culture”
3. “Flexible Culture”
4. “Just Culture”
5. “Learning Culture”
34
www.nea.fr/html/nsd/reports/nea1547-Murley.pdf
35
http://www.coloradofirecamp.com/just-culture/definitions-principles.htm
Figure 3 James Reasons Five Cultures of Safety Culture
Professor Edgar Schein
Professor Edgar Schein of the MIT Sloan School of Management, a well-known business culture scholar says, "The
culture of a group can now be defined as: A pattern of shared basic assumptions that the group learned as it solved
its problems of external adaptation and internal integration, that has worked well enough to be considered valid and
therefore, to be taught to new members as the correct way to perceive, think, and feel in relation to those problems."
Comment: It leaves out norms, institutions, and characteristic physical items.
The U. S. Nuclear Regulatory Commission 36
The Commission’s “Policy Statement on the Conduct of Nuclear Power Plant Operations,” Federal Register notice,
January 24, 1989, refers to safety culture as “the necessary full attention to safety matters” and the “personal
dedication and accountability of all individuals engaged in any activity which has a bearing on the safety of nuclear
power plants. A strong safety culture is one that has a strong safety-first focus.”
The Commission has referenced the International Nuclear Safety Advisory Group's (INSAG) definition of safety
culture as follows: “Safety Culture is that assembly of characteristics and attitudes in organizations and individuals
which establishes that, as an overriding priority, nuclear plant safety issues receive the attention warranted by their
significance.”
36
http://www.nrc.gov/about-nrc/regulatory/enforcement/safety-culture.html
Comment: 1) The definition excludes dysfunctional safety culture by defining safety culture as a good thing. 2) It
leaves out norms, institutions, and characteristic physical items. 3) It is not clear what is meant by “characteristics.”
4) It does not seem easily translated into guidance for agency employees.
The Center for Chemical Process Safety 37
The Center for Chemical Process Safety (CCPS) devotes a full chapter of their twenty-four chapter guidelines to
“Process Safety Culture,” which is apparently regarded as a subset of safety culture. CCPS describes Process Safety
Culture as follows:
Process safety culture has been defined as “the combination of group values and behaviors that determine
the manner in which process safety is managed. More succinct definitions include: “How we do things
around here,” “What we expect here,” and “How we behave when no one is watching.”
CCPS provides the following “essential feature” of process safety culture:

 Maintain a sense of vulnerability.
 Empower individuals to successfully fulfill their safety responsibilities.
 Defer to expertise.
 Ensure open and effective communications.
 Establish a questioning/ leaning environment.
 Foster mutual trust.
 Provide timely response to process safety issues and concerns.
APPLICATIONS OF SAFETY CULTURE CONCEPTS
USNRC
The reports of applications of the concepts of safety culture are rare. One available in the open literature is that of
the U. S. Nuclear Regulatory Commission (NRC) in its Reactor Oversight Program (ROP). A recent summary of the
NRC’s approach 38 mentions the “components” in the following table.
COMPONENT CATEGORY Comments

(1) decision-making Mental Content Decision-making consistent with
Norms functional safety culture will have
Institutions the results described above under
Physical Items “The Results of Good Safety
Culture.“
(2) resources Norms The signs of inadequate resources
Institutions are the same as the signs of
Physical Items inadequately deployed resources:
downstream identified adverse
conditions, growing backlogs,
growing workaround lists, items left
out of backlogs, etc.
37
Center for Chemical Process Safety, “Guidelines for Risk Based Process Safety,” John Wiley& Sons, Inc.,
Hoboken, NJ (2007)
38
USNRC, NRC Regulatory Issue Summary 2006-13, “Information On The Changes Made To The
Reactor Oversight Process To More Fully Address Safety Culture” July 31, 2006

(3) work control Norms The signs of inadequate work
Institutions control include events involving
Physical Items simultaneous conduct of mutually
incompatible activities, e.g., testing
one channel of RPS while another is
in “bypass” for maintenance.
(4) work practices Mental Content The signs of inadequate work
Norms practices include excessive,
Institutions increasing, and concealed rework.
Physical Items
(5) corrective action program Mental Content Observations of actual corrective
Norms action program activities may well
Institutions be the clearest picture window into
Physical Items the safety culture.
(6) operating experience Mental Content The nuclear industry has struggled
Norms with this one since the Kemeny
Institutions Commission Report. As an industry
Physical Items matures there will be fewer and
fewer new problems. After a half-
century the vast majority of
problems are manifestations of not
having learned from previous
problems.
(7) self- and independent assessments Mental Content The heart of safety culture is people
Norms finding their own problems at the
Institutions first opportunity.
Physical Items
(8) environment for raising safety concerns Mental Content It does no good for people to find
Norms problems if they are not free to raise
Institutions them up. And the freedom to raise
Physical Items issues does no good unless personnel
know how to recognize them.
(9) preventing, detecting, and mitigating Mental Content One wonders if this should include
perceptions of retaliation Norms harassment, intimidation, and
Institutions discrimination.
Physical Items
(10) accountability Mental Content Signs of inadequate accountability
Norms would include events involving
Institutions incomplete work or delays in
Physical Items corrective actions from previous
events.
(11) continuous learning environment Mental Content Signs of inadequate continuous
Norms learning environment would include
Institutions events involving repeat causal
Physical Items factors or causal factors that could
have been eliminated based on
operational experience.
(12) organizational change management Mental Content Organization change management
Norms could be viewed as a sub-component
Institutions of “decision-making,” since it
Physical Items involves decisions about changes.

(13) safety policies Mental Content Safety policy provisions could cover
Norms any or all of the other components.
Institutions
Physical Items
It is clear that these “components” are not mutually exclusive. If the components were mutually exclusive every
mental content item, norm, institution, and physical item of safety culture that did fit in a component would only fit
in one. This would facilitate trending. As it is, a particular safety culture observation by an inspector could be
binned in more than one “component,” creating a database integrity issue that is sure to baffle both staff and
licensees until it gets sorted out.
What is less clear is the extent they are not jointly exhaustive. Jointly exhaustive safety culture components would
cover all of safety culture. One might expect that as the NRC uses these components in their Reactor Oversight
Program it will find the missing components. This may arise as the staff finds problems that are clearly safety
culture issues, yet don’t readily fall into any of the existing components. One that comes to mind is inadequate
reward structure, e.g., people not being reinforced for exhibiting functional safety culture. Another one is
“transparency,” i.e., doing business in such a way that it is easy to see what’s wrong.
WALKING THE TALK
In the near future as the awareness of safety culture increases one might expect to see examples of dysfunctional
safety culture behaviors from those espousing safety culture. In popular language this is called “not walking the
talk” or “not eating one’s own cooking.”
When this occurs it will reverse the progress toward more functional safety cultures. To avoid this it will be
necessary for leaders to be very familiar with what is and what is not functional safety culture. The first leadership
exhibition of dysfunctional safety culture will be taken as a signal that leadership is not serious about safety culture.
This goes for regulators as well. It will be especially challenging for regulators who have been reluctant to admit
mistakes to be credible in encouraging their stakeholders to be forthcoming about identifying and reporting errors.
Similarly, it will be challenging for organizations that have been secretive to be credible in encouraging their
stakeholders to be transparent.
IMPROVING SAFETY CULTURE
Several critics of this paper offered the opinion that unless the paper included some ideas on how to improve safety
culture the paper was useless to them. For those and others the following are offered.
Assessing Your Own Safety Culture
Use Appendix A, “Conflicts Between Observed/ Inferred Cultural Attributes and Functional Safety Culture” to
assess your safety culture. Prioritize the discrepancies and fix them.
Improving a Good Safety Culture
If the safety culture is already good, one improvement strategy is that of ISO 9001-2000 39 , in international quality
system standard. In this approach 40 the organization would be directed to:
39
For a summary see http://www.praxiom.com/iso-9001.htm
1. Say what you do (that is part of the good safety culture).

2. Do what you say. This means to make the above consistent.
3. Prove it. This means to furnish evidence of the safety culture.
4. Improve it. This means to use experience to refine the safety culture.
Establishing a Good Safety Culture
If the safety culture needs more than incremental improvement, one strategy is sometimes called “Gap Closure” or
something like that. Roughly it goes like this:
1. Describe the current safety culture. (Mental content, norms, institutions, physical items.)
2. Describe the desired future safety culture.
3. Itemize the differences between the above. (This is called “The Gap.”)
4. Prioritize the parts of the Gap to be closed.
5. Create and implement plans for Gap closure.
6. Create a progress reporting plan to show how the Gap is being closed.
7. Create Recovery Plans for when the Gap is not responding as planned to the Gap Closure plans.
There are other strategies, but these will do for the time being.
LOW HANGING FRUIT
Most famous underperforming safety cultures seemed to have had the following cultural dysfunctionalities:
1. They found their problems in expensive, embarrassing, and unsafe ways, i.e., by events, gross rework, and
regulatory hits.
2. They did not use the events, rework, and regulatory hits as opportunities to improve the way they found problems
and causes.
3. The above dysfunctionalities were not even recognized as something to work on.
Thus the low hanging fruit of safety culture improvement is that:

1. They should do a Missed Opportunity Investigation 41 of every problem that involves a fatality or an expense of
more than $1.0 E+6 (honestly calculated).
2. This investigation should find and fix all processes that could have found the problem or its causes at an earlier,
cheaper, safer time.
3. They should have a non-facility officer as the investigation team leader for each of these Missed Opportunity
Investigations.
4. They should not tolerate problems being found downstream, i.e., they should have a highly visible initiative to
eliminate downstream identified adverse conditions.
The sooner and more aggressively they do the above the sooner they will stop the hemorrhaging.
The above will address only the limiting weakness of the safety culture.
When they do the above they will surface the problems they have been in denial over.
PRELIMINARY CONCLUSIONS
The concept of safety culture is a powerful one for saving lives, pain, assets, and careers. The understanding of
safety culture has been advanced greatly in the last few years, but still can benefit from more research and reflection.
40
http://www.extension.iastate.edu/agdm/articles/others/ClaJuly01.htm
41
This would be an ordinary Root Cause Analysis that focused on identifying all of the earlier, better, cheaper, safer
ways of identifying the problem and/or the factors that resulted in it.
Using the concept of safety culture to include mental content, norms, institutions , and physical items rather than
restricting it to attitudes and characteristics is likely to enhance both the understanding of safety culture and its
application in the high hazard industries.
Acknowledgments:
Thanks to Bob Cudlin, Larry Pearlman, Terry Sullivan, Steve Marrs, Joe Braun, and Malcolm Patterson for their
kind inputs to this work.
Please send Bill Corcoran your comments and suggestions for improvement.
William.R.Corcoran@1959.USNA.com
Appendix A
Conflicts Between Observed/ Inferred Cultural Attributes and Functional Safety Culture
In the left hand column (Column 1) the reader will find a description of behavior/ condition attribute that has been observed or inferred from results in high
hazard installations and organizations. The second column contains a functional alternative to the Column 1 entry. Column 3 contains the direct result of the
observed/inferred attribute, while Column 4 captures the more remote effects. Finally, the last column is a place to record the significance of the observed/
inferred attribute, its membership in the four elements of culture, instances of its appearance, and notes.
The reader will notice the apparent ubiquity of safety culture attributes in the high hazard industries. Almost every organizational and individual attribute bears
on safety culture to some degree. It might seem that every behavior and condition either promotes good safety culture or interferes with it.
The reader is invited to use this table as a self-reflection tool to assess the presence of latent organizational safety culture weaknesses in their own organizations
and in their provider organizations.
Conflicts Between Observed/ Inferred Cultural Attributes and

Functional Safety Culture
Observed/ Inferred Functional Direct Result of Observed/ Downstream Result of Significance of Observed/
(Not so good) (Better) Inferred Observed/ Inferred Inferred
(Mental Content/
Norm/Institution/Physical Item)
Managers do not recognize Managers have a clear picture Safety culture is not The results of dysfunctional
the examples of dysfunctional of what functional safety deliberately managed. safety culture show up as Mental Content/ Norms/
safety culture in the work culture looks like and consequential events, near Institutions/ Physical Items
activities they observe. systematically drive out misses, compromises, and
dysfunctional safety culture. infractions/ deviations.
Contractors are not expected There is one safety culture It is perceived to be cheaper Contractor dysfunctional Mental Content/ Norms/
to maintain the same safety standard that applies to all to outsource to contractors safety culture attributes show Institutions
culture as employees. personnel who could affect who are allowed to up as causal factors of
safety at the facility. “streamline” on safety adverse events.
culture.
Page 31 of 53 © 2008 William R. Corcoran, NSRC Corporation. Funding support from the following is appreciated: NSRC
Corporation.

(Mental Content/
Management safety Management safety bonuses Purchase orders to contractors Contractor dysfunctional
achievement bonuses are not are tied to overall facility do not impose facility safety safety culture attributes show Mental Content/ Norms/
affected by contractor safety including the safety of behavioral requirements that up as causal factors of Institutions
accidents. contractors. employees are required to adverse events.
work to. Note: This is (inadvertently?)
facilitated by OSHA
expectations.
Personnel Safety is Safety Culture is observably Process safety and Vulnerabilities for process Results in situations like BP
observably emphasized. emphasized. environmental protection are upsets and environmental Texas City.
de-emphasized. insults are not addressed. “If you emphasize the letter
“A” you automatically de-
emphasize twenty-five other
letters.”
Norm
Schedule adherence is Safety adherence is part of Decisions are tilted toward Safety drifts toward the edge The reward structure becomes
rewarded, but safety the “Most Rewarded List.” schedule and away from of the radar screen. part of the “organizational
adherence is taken for safety. DNA,” including root cause
granted. analysis.
Norm
Management sends the Management sends the The received message is that Dysfunctional safety Rash of minor safety events
message that increased message that increased safety should be sacrificed to behaviors and conditions and near misses following
productivity is needed to productivity is needed to achieve productivity goals. show up as causal factors of management exhortation on
achieve organizational goals, achieve organizational goals, adverse events. productivity. 2007
but means for increasing and the means for increasing (Organizational Identification
productivity are not productivity without withheld)
discussed. sacrificing safety are
discussed.
Corporation.

(Mental Content/
Pre-job Briefs become Managers assure that Pre-job Problems are found during Problems missed in PJBs are Pre-job Briefs are part of Pre-
perfunctory. briefs (PJB) are taken the job that could have been found as a result of emptive Self-assessment,
seriously. found at the PJB. downstream events. activities intended to find
problems that are still latent,
thereby pre-empting
consequences.
Norm/ Institution
Problems found during Pre- Problems found during PJBs The factors that resulted in Problems missed in PJBs are Investigations are part of
job Briefs (PJBs) are merely are investigated to find and the problems continue to found as a result of Reactive Self-assessment,
corrected. fix the problem, the processes exist. Self-assessment downstream events. activities intended to find
that created the problem, and effectiveness deteriorates. problems in reaction to an
the processes that should More problems are found in observed stimulus. Reactive
have found the problem and PJBs. Self-assessment is done to
its causes before the PJB. prevent wasting mistakes.
Norm/ Institution
Post-job/evolution Debriefs Managers assure that Post- Problems are found during Problems missed in Post- Post-job/evolution Debriefs
become perfunctory or are job/evolution Debriefs are the next job/evolution that job/evolution Debriefs are are part of Reactive Self-
not done at all. taken seriously. could have been reported at found as a result of later assessment, activities
the Post-job/evolution downstream events. intended to react or problem
Debriefs. occurrences and thereby
prevent problems that have
already been experienced.
Norm/ Institution
Problems found during Post- Problems found during Post- The factors that resulted in Problems missed in Post- Investigations are part of
job/evolution Debriefs are job/evolution Debriefs are the problems continue to job/evolution Debriefs are Reactive Self-assessment,
merely corrected. investigated to find and fix exist. Self-assessment found as a result of later activities intended to find
the problem, the processes effectiveness deteriorates. downstream events. problems in reaction to an
that created the problem, and More problems are found in observed stimulus. Reactive
the processes that should Post-job/evolution Debriefs. Self-assessment is done to
have found the problem and prevent wasting mistakes.
its causes before the PJB. Norm/ Institution
Corporation.

(Mental Content/
Operational Readiness Managers assure that Problems are found during Problems missed in ORRs are Operational Readiness
Reviews (ORRs) become Operational Readiness start-up or operation that found as a result of Reviews (ORRs) are part of
perfunctory. Reviews (ORRs) are taken could have been found at the downstream events. Pre-emptive Self-assessment,
seriously. ORR. activities intended to find
problems that are still latent,
thereby pre-empting
consequences.
Norm/ Institution
Problems found during Managers assure that The factors that resulted in Problems missed in ORRs are Investigations are part of
Operational Readiness problems found during ORRs the problems continue to found as a result of Reactive Self-assessment,
Reviews (ORRs) are merely are investigated to find and exist. Self-assessment downstream events. activities intended to find
corrected. fix the problem, the processes effectiveness deteriorates. problems in reaction to an
that created the problem, and More problems are found in observed stimulus. Reactive
the processes that should ORRs. Self-assessment is done to
have found the problem and prevent wasting mistakes.
its causes before the PJB. Norm
Transparency is not part of Transparency is an espoused Errors, omissions, and other Problems that could have Transparency facilitates
the vocabulary. value. Transparency is latent problems are not been found earlier are found Routine Self-assessment,
defined as doing activities in identified as early as they as the result of downstream ordinary activities intended to
such a way that it is easy to could be. events. find adverse conditions.
tell what’s wrong.
Transparency surfaces the
effects of imperfect
Management of Change
(MoC).
Norm
Corporation.

(Mental Content/
Managers openly state that Managers forcefully establish Problem identification gets a Problems that could have
their jobs do not include the expectation that workers lower priority than been found earlier are found Norm/ Institution
doing the jobs of oversight, find their own problems production. as the result of downstream
i.e., the QA Department, the before oversight finds them events.
Safety Department, or they are revealed by
regulators, and the like. events.
Workers assume that all Management articulates the Workers do not trust Safety problems that could be When workers do not know
management decisions are safety considerations for management’s espoused reported by workers are how management makes
made to support production decisions. commitment to safety. found as the result of decisions they are unable to
and profit. downstream events. use management’s rationales
in making their own safety-
related decisions.
Operators are expected to do All calculations that can be Mental calculations Problems that could have Mental calculations are a
calculations in their heads eliminated, done off-line or occasionally are in error. The been found earlier, e.g., by prima facie infraction of the
and then apply the results to automated are removed from causal factors of the errors the operator or the peer requirement that “measures
plant manipulations. operator duties. All (other than the obvious) are reviewer, are found as the be established to assure that
calculations done by not identified. result of downstream events. conditions adverse…shall be
operators are done on pre- promptly identified…” or the
designed transparent forms like.
and are checked by a person Norm/ Institution/ Physical
other than the one who did Items
the calculation. The forms are
retained in records.
Terms such as “engineering Decisions affecting safety Knowledge-based-errors Problems that could have The terms in the first column
judgment,” “skill-of-the- that are not controlled by (KBE) are not identified by been found earlier, e.g., by are equivalent to “because
craft,” “experience,” written procedures have decision makers or peer the decision maker or the peer I’m the boss.”
“professional opinion”and the documented bases that can be reviewers. reviewer, are found as the Norm
like are accepted as the bases independently reviewed. result of downstream events.
for decisions affecting safety.
Corporation.

(Mental Content/
Operations personnel request Operations personnel request Engineering personnel do not Problems with inadequate
and receive engineering and receive engineering hold themselves accountable engineering are surfaced by Norm/ Institution/ Physical
advice without any formal advice by means of formal for the quality of the advice adverse events. Item
documentation. engineering service requests given. The investigation of
and responses. events involving non-rigorous
engineering are difficult to
investigate.
The organization sends The organization sends open The regulator’s technical staff The problem or an associated Davis-Besse 2001-2002.
lawyers to deal with a minded engineers, could be intimidated into problem is left to fester and Amoco/ BP Texas City 1992-
regulator that is having quality/safety professionals, backing down on the become involved in a serious 2005.
problems with the facility. and managers to deal with a problem. event. Norm
regulator that is having
problems with the facility.
After it “wins” disputes with The organization investigates Important latent issues that The problem or an associated Davis-Besse 2001-2002.
the regulator it does not all concerns expressed by the regulator has been unable problem is left to fester and Amoco/ BP Texas City 1992-
seriously address the regulators with the thought in to express cogently are become involved in a serious 2005.
regulator’s concern. mind that there may be some ignored. event. Norm
important latent issues that
the regulator has been unable
to express cogently.
Management makes it an Management makes it a Many personnel, process, The problem or an associated Human Behavior Technology
unpleasant experience for pleasant experience for and/or environmental safety problem is left to fester and principle: People avoid doing
workers to submit personnel, workers to submit personnel, concerns are not reported, become involved in a serious unpleasant activities.
process, and/or environmental process, and/or environmental event. Norm/ Institution/ Physical
safety concerns. safety concerns. Items
Corporation.

(Mental Content/
Management does not Management informs workers Many subsequent personnel, The problem or an associated Human Behavior Technology
provide feedback to workers who submit personnel, process, and/or environmental problem is left to fester and principle: Null consequences
who submit personnel, process, and/or environmental safety concerns are not become involved in a serious punish functional behavior.
process, and/or environmental safety concerns of every step reported, event. (When a desire behavior
safety concerns. in the processing of their results in nothing the worker
concern. stops doing it.)
Norm/ Institution/ Physical
Items
Often workers use the process Management insists that the The problem reporting The problems reporting Norm/ Institution
for reporting personnel, problem reporting processes processes are perceived as processes are used less and
process, and/or environmental be focused on behaviors and petty and political. less.
safety concerns for blaming conditions. Workers are
other people. reinforced for reporting their
own problems.
There is no budget for There are specific budget line 1. Problem investigation Investigations omit important Notes:
problem investigation and items and charge numbers for and resolution causes, extent of  This feeds the cycle of
resolution activities. problem investigation and assignments are avoided. conditions/causes, and degrading performance.
resolution activities. 2. Problem investigation corrective actions are  This is easy to fix, yet
Measures are in place to and resolution minimal. stays as is.
assure that the normal work assignments are given
of line personnel involved in short shrift by line Norm/ Institution/ Physical
problem investigation and personnel. Items
resolution get done while 3. The normal work of line
those people are dedicated to personnel does not get
problem investigation and done while they are
resolution. dedicated to Problem
investigation and
resolution assignments.
Corporation.

(Mental Content/
Employees say that they can’t Management makes it People have a built-in excuse The effects of inadequate Norm/ Institution
do what’s right for safety abundantly clear that when for sacrificing safety. funding of activities affecting
because of the budget. budgets get in the way of safety show up in
what is right for safety the consequential events.
budget will be what’s
changed.
Budgets are established by The process of establishing Activities affecting safety are The effects of inadequate Texas City 2005
higher level groups that have budgets has strong input from inadequately funded. funding of activities affecting Challenger ?
no personal knowledge of individuals knowledgeable safety show up in Columbia ?
safety impact. about the safety impact of consequential events. Davis-Besse 2002?
budgets.
Norm/ Institutions/ Physical
Items
At the same organizational At the same organizational The message goes out that Decisions involving safety
level managers whose titles level managers whose titles safety is not as important as and other functions are biased
mention safety, quality, mention safety, quality, other functions. toward the other functions. Norm/ Instituiton/ Physical
environment and the like environment and the like The imprudent decisions Items
have lower level job titles have the same level of job show up as causal factors of
than managers whose titles title as their peers reporting at adverse events.
mention other functions. the same level.
Some groups of professional Managers assure that all Many problems do not get Problems not reported by The tolerance of unnecessary
staff seldom or never report groups of professional staff reported. cognizant professionals are islands of inconsistency is a
conditions adverse to report conditions adverse to found as a result of hallmark of a dysfunctional
personnel, process, or personnel, process, or downstream events. safety culture.
environmental safety. environmental safety that Norm/ Institution/ Physical
they encounter and there is Items
objective data to support
uniformity of reporting
behavior.
Corporation.

(Mental Content/
There are no participation Metrics clearly show which Non-participation is tolerated. Problems not reported by The tolerance of unnecessary
metrics by which islands of parts of the organization are Many problems do not get cognizant professionals are islands of inconsistency is a
non-participation or non- lagging in their support of reported. found as a result of hallmark of a dysfunctional
support are identified. functional safety culture and downstream events. safety culture.
continuous improvement. Norm/ Institution/ Physical
Items
Individual contributors are Individual contributors are Many regulatory Regulatory infractions are Davis-Besse 2001-2002.
not trained in regulatory trained in regulatory requirements are ignorantly discovered by regulators. Amoco/ BP Texas City 1992-
requirements because requirements so that they are infracted. 2005.
management maintains that if able to understand the Norm/ Institution/ Physical
they adhere to facility regulatory bases for the Items
procedures they will facility procedures.
automatically adhere to
regulatory requirements.
Event investigation reports Managers assure that event The victim organization does 1. Regulatory infractions Davis-Besse 2001-2002.
seldom, if ever, mention the investigation reports include not find out that if it had are discovered by Amoco/ BP Texas City 1992-
regulatory requirements all factors affecting the adhered to the requirements regulators. 2005.
whose adherence would have consequences and assess the the consequences would have 2. Minimalist adherence to Norm/ Institution/ Physical
reduced the consequences. factors for regulatory been reduced. requirements continues. Items
infractions. 3. Defects in the regulatory
requirements are not
identified.
Staff is trained to work the Staff is trained in 1) how to The staff has self-concocted Defective cognitive models Davis-Besse 2001-2002.
plant. work the plant and 2) how the mental models of how the result in defect operations. Amoco/ BP Texas City 1992-
plant works. plant works. 2005.
Mental Content/ Institution/
Physical Items
Training is done to satisfy Training is one of the top line The staff loses respect for Ineffective training results in Mental Content/ Norms/
regulators and accreditors. management accountabilities. training. ineffective field performance. Institution/ Physical Items
Corporation.

(Mental Content/
Training emphasizes the Training emphasizes the Trainees pass exams, but fail Events result from or are Events such as the TMI-2
ability to pass examinations acquisition of skills and in the field. exacerbated by dysfunctional accident and the chemistry
rather than the acquisition of knowledge identified by the field behaviors. excursions at Duane Arnold
skills and knowledge Systematic Approach to and other BWRs.
identified by the Systematic Training and, incidentally, the
Approach to Training. ability to pass examinations.
Investigations of training Investigations of training Corrective actions emphasize Trainees are posted into field Events result from or are
failures do not consider that a failures consider that a the ability to pass exams, not positions with inadequate exacerbated by dysfunctional
training failure is a precursor training failure is a precursor the ability to perform in the training. field behaviors.
of failure in the field. of failure in the field and field.
have the effects of filed
failures as potential
consequences of training
weaknesses.
Ineffective field behaviors are Training management and Fundamental weaknesses in Trainees are posted into field Events result from or are
not considered to be the staff do missed opportunity training programs persist. positions with inadequate exacerbated by dysfunctional
downstream effects of analyses of all events and training. field behaviors.
fundamental training near misses resulting from
weaknesses. ineffective field behavior.
Vague training actions are Event investigators dig Ineffective field behavior Eventually a serious event Davis-Besse 2001-2002.
accepted as corrective actions deeply into the factors identified in one event occurs that brings the Amoco/ BP Texas City 1992-
for ineffective field behavior resulting in ineffective field investigation shows up in organization to its knees. 2005.
identified in event behavior identified in event later event investigations. Mental Content/ Norms/
investigations. investigations. Institution/ Physical Items
Oversight personnel (process Oversight personnel (event 1. Oversight is not Latent problems not reported Mental Content/ Norms/
safety, personnel safety, investigation, process safety, respected and is not by oversight professionals are Institution/ Physical Items
quality, compliance, personnel safety, quality, effective. found as a result of
environment…) are selected compliance, environment…) 2. The line usually wins downstream events.
from personnel who are not are selected from personnel disputes with oversight.
expected to be valuable in who have demonstrated their 3. Oversight learns how to
line roles. competence in line roles. avoid disputes.
Corporation.

(Mental Content/
Oversight personnel are Oversight personnel are 1. Staff gets the message Latent problems not reported Mental Content/ Norms/
encouraged to “volunteer” for augmented by experienced that oversight is only for by oversight professionals are Institution/ Physical Items
temporary line assignments outside oversight personnel “business as usual.” found as a result of
during labor intensive during labor intensive 2. Labor intensive periods downstream events.
periods. periods. with higher challenges
get less oversight.
Oversight organizations When oversight organizations Both oversight and the line Eventually a serious event Norm
consider it to be a success find a serious adverse fail to see that when oversight occurs that brings the
when they find a serious condition they: finds a serious adverse organization to its knees.
adverse condition. 1. Launch a Missed condition it is a sure sign that
Opportunity self-assessment needs work.
Investigation to find out
how they could have
found it earlier.
2. The “write-up” the line
organization for not
having found it before
oversight.
Event investigations are only There is a graded approach to The organization does not Eventually a serious event Texas City 2005
done for major consequential event investigations. Event learn from indications of occurs that brings the
events. investigations are based on latent weaknesses and organization to its knees. Norm/ Institution/ Physical
significance, not just adverse conditions. Item
consequences. Near misses
are treated as gifts from
above.
Corporation.

(Mental Content/
Corrective actions emerging Corrective actions emerging Many vulnerabilities that Eventually a serious event
from event investigations from event investigations could have been corrected are occurs that brings the Norm/ Institution/ Physical
address the root causes. address all causal factors left to become involved in organization to its knees. Item
including the self-assessment causing future events.
weaknesses that allowed the
causal factors to remain
unidentified and/ or not
addressed before the event.
The extents of causes and the
extents of adverse conditions
are also addressed.
Event investigations are Management demands that The organization does not Eventually a serious event Davis-Besse 2002
allowed to languish or be the talent applied to difficult learn from indications of occurs that brings the (Investigations of radiation
terminated before important investigations is escalated as latent weaknesses and organization to its knees. monitor filter clogging and of
causal factors are understood. the difficulty shows up in adverse conditions. containment air cooler
investigative delays. fouling.)
Norm/ Institution/
Event investigations seldom The possible ineffectiveness The organization does not Eventually a serious event 1996 LaSalle Sealant
mention the ineffectiveness of of earlier investigations as a learn from indications of occurs that brings the Intrusion (See NRC AIT
earlier investigations as a causal factor for the latent weaknesses and organization to its knees. Report)
causal factor for the consequences of the current adverse conditions in
consequences of the current investigation is always a line previous investigations. The Davis-Besse 2002
investigation. of inquiry. investigation process does not (Investigations of radiation
improve. monitor filter clogging and of
containment air cooler
fouling.)
Corporation.

(Mental Content/
Event investigation reports Event investigation reports The organization does not Eventually a serious event Davis-Besse 2002
seldom, if ever, mention the always address the learn from indications of occurs that brings the (Investigations of radiation
words “safety culture.” involvement of safety culture latent weaknesses and organization to its knees. monitor filter clogging and of
in the event being adverse conditions. containment air cooler
investigated. fouling.)

Item
Operating experience reports Operating experience reports The members of the Eventually a serious event OSHA
by operating organizations by operating organizations organization and the members occurs that brings the EPA
and regulators focus on and regulators blend their of the regulatory bodies never organization to its knees. NRC
technical aspects of events. focus to address technical and realize that the safety culture GAO
cultural aspects of events. is an important driver of
latent weaknesses. To its credit CSB does
mention safety culture,
however ineffectively.
Norm/ Institution/
Information given to safety Information given to safety Regulators are given false Regulatory decisions Davis-Besse 2001
regulators is not subjected to regulators is rigorously and misleading information. exacerbate the consequences
the rigorous verification that verified before submission of safety problems. Davis-Besse Insurance Claim
financial information gets. and later detected errors are 2007
thoroughly investigated.
Item
Corporation.

(Mental Content/
Work is done that is outside All deviations from work The work is less safe or the Personnel and/or equipment Davis-Besse 2001
the written scope of work scopes are subjected to safety plant is less safe after job harm results.
instructions and/or work in reviews as part of termination. Norm/ Institution/ Physical
the written scope is omitted Management of Change. Item
or incomplete.
Work is done on “live” or Procedures in actual use are The work is less safe or the Personnel and/or equipment 10CFR50, App B, Criterion
operating systems or appropriate to the plant is less safe after. harm results. V
components using circumstances. Limerick “Light Bulb
procedures that were written Scram”
for “dead” or outage
conditions without
accommodating the
differences.
Instrumentation required to Instrumentation required to Instrumentation redundancy, Accidents occur that could Texas City 2005
be used by a procedure is be used by a procedure is “analytic redundancy”, and/or have been averted by using
allowed to remain inoperable restored to operability before corroboration is reduced or the instrumentation. Norm/ Physical Item
without amending the running the procedure or the operators learn to “fly blind.”
procedure to avoid needing to procedure is amended to
use the instrumentation. eliminate the need for the
instrument.
Steps in procedures and other All steps in procedures and Performers move forward Texas City 2005
work instructions often lack other work instructions without satisfying acceptance Davis-Besse 2002
qualitative and/or qualitative include clear, explicit or criteria and/or without
acceptance criteria for implicit qualitative and/or knowing that they are
determining that the action qualitative acceptance criteria standing into danger.
has been satisfactorily for determining that the
accomplished. action has been satisfactorily
accomplished.
Corporation.

(Mental Content/
Steps in procedures and other All steps in procedures and When criteria are not satisfied
work instructions that do other work instructions that performers are thrown into
qualitative and/or qualitative include clear, explicit or the Knowledge-based Mode,
acceptance criteria for implicit qualitative and/or which has a high error
determining that the action qualitative acceptance criteria frequency.
has been satisfactorily for determining that the
accomplished do not include action has been satisfactorily
contingency actions to be accomplished also give the
taken if the criteria are not performers instructions for
satisfied. the contingency actions to be
taken if the criteria are not
satisfied.
Safety programs, such as There is open commitment to Lessons to be learned that Accidents occur that could Texas City 2005
industrial safety, process an integrated safety emerge from one type of have been averted by cross-
safety, environment safety, management system that mishap are not applied to all disciplinary learning. Norms/ Institutions
and radiological safety are covers the appropriate activities to which they apply.
“siloed,” thus concealing the spectrum of hazards Achievements in one safety
fact that much of safety associated with specific discipline are assumed to be
culture applies across activities. indicators of the soundness of
organizational boundaries. other safety disciplines.
Corporation.

(Mental Content/
Vulnerabilities are Designs avoid vulnerabilities, The safety of the design Eventually there is a situation Texas City Elbow Mix-up
incorporated in a design but when they are depends on the effectiveness in which the latent factors are and Failure (2006)
without imposing controls on unavoidable life cycle of weak, ineffective, or non- activated.
the vulnerabilities. measures are established to existent administrative Davis-Besse Control Rod
control the effects of the controls. Drive Nozzle Design (2002)
vulnerability.
Texas City ISOM Tower
Vulnerabilities are identified Blowdown (2005)
by the designer and are
independently identified in Boeing 747 Central Fuel
Failure Modes and Effects Tank (TWA-800)
Analyses (FMEAs) and
hazard analyses. Challenger O-ring
Embrittlement
Columbia Foam Separations
U.S. Army Air Support GPS

that defaults target location to
observer location.

Item
Corporation.

(Mental Content/
In meetings no one disagrees Differing opinions are Safety concerns are Problems that could have This dysfunctional cultural
with a person of higher frequently and respectfully repressed. been averted by attention to attribute is almost certain to
perceived rank, even when offered and are given due and differing opinions are found result in spectacular failures.
the higher ranking person respectful consideration. as a result of downstream For information on related
asks for other opinions. events. phenomena search on
“GroupThink” or “Trip to
Abilene.”
Norm
Official event investigation Investigation resources are The organization does not High consequence events This dysfunctional cultural
report requirements do not allocated based on the learn from non-consequential reveal the causal factors that attribute is almost certain to
address near misses, significance of the or low consequence events. could have been identified by result in spectacular failures.
compromises, or occurrence, not the actual investigations of lower For information on related
infractions/deviations. consequences. consequence events. phenomena search on
“Denial.”
Norm/ Institution
Fitness-for-duty programs Fitness-for-duty (FFD) FFD degradations not The results of degraded FFD Most government programs
satisfy government programs have some covered by government are revealed in adverse do not require worker training
requirements, which, by-and- scientific basis and include programs go undetected. events. in how to identify and
large, are non-science-based measures to promote self- respond to FFD degradations
compromises resulting from identification and peer whose causes are allowed by
adversarial processes. identification of FFD lax government rules.
degradation and the onset of
aberrant behavior. Norm/ Institution
Corporation.

(Mental Content/
A significant fraction of the Management disincentivizes Macho behavior increases The results of dysfunctional Norm
work force expresses dysfunctional “macho” risk. macho behaviors are revealed
admiration for “macho” behavior and openly in adverse events.
behaviors such as working discusses it as a problem
long hours, “winging it”, when it is a problem.
inventing new work arounds,
skirting requirements, “pencil
whipping” problems, cleverly
interpreting rules, exploiting
loop holes, and the like.
Senior operational Senior operational Senior managers make The safety robustness of the Senior managers must be able
management have risen management are required to suggestions for and approve plant is allowed to degrade. to knowledgeably reinforce
through positions that did not be familiar with the actions that infringe on safety This degradation is revealed actions to preserve the
require a familiarity with the deterministic and/or margins. by events outside the design validity of the hazards
deterministic and/or probabilistic hazards analyses basis or by events not analyses.
probabilistic hazards analyses that support the safe considered in the hazard
that support the safe operation of the facility. analyses. Norm/ Institution
operation of the facility. There is a refresher training
program that they attend.
Important event investigation The assignment of Investigation teams flounder, Eventually the flawed Norm/ Institution
teams are lead by personnel investigation team leaders are allowing evidence to be lost, investigative processes leave
who can be easily spared assigned in accordance with a slipping investigation important safety
from their normal duties. written policy that makes schedules, losing team vulnerabilities uncorrected to
personnel, process, and members, and being generally be found in the investigation
environmental safety ineffective. of consequential events.
significance a high priority.
Corporation.

(Mental Content/
Investigation reports are When an investigation report Flawed investigative Eventually the flawed Norm/ Institution/ Physical
rejected by review boards / is rejected the following are processes are perpetuated. investigative processes leave Item
committees or independent fixed: important safety
oversight (QA) without 1. The report vulnerabilities uncorrected to
investigating the process 2. The processes that be found in the investigation
flaws that resulted in created the report of consequential events.
producing flawed 3. The processes that
investigations. should have caught the
flaws earlier
Rework on rejected All rework is quantified and Flawed investigative Eventually the flawed Norm/ Institution/ Physical
investigation reports is not investigated for reduction or processes are perpetuated. investigative processes leave Item
treated as rework. elimination commensurate Investigations are shorted due important safety
with its financial and resource to resource limitations. vulnerabilities uncorrected to
impact. be found in the investigation
of consequential events.
The planning of on-line The planning of on-line This sends the message that Other decisions are made that Norm/ Institution/ Physical
maintenance involving safety maintenance involving safety risk-minimization is not result in unnecessarily Item
devices and safety-related devices and safety-related important. elevated risk.
instrumentation does not instrumentation includes
include minimizing the out- minimizing the out-of-service
of-service time of the safety- time of the safety-related
related items. items.
“Cheater bars” and other Work arounds are strictly Actual risk is greater than Accidents are more frequent Norm/ Institution
time-consuming work controlled and are only previously approved. or more severe than
arounds are allowed for allowed if they fall within the previously envisioned.
equipment whose operation is assumptions of deterministic
needed to prevent or mitigate and probabilistic safety
accidents. analyses.
Corporation.

(Mental Content/
Oversight organizations do Oversight organizations Oversight organizations do Eventually the flawed Davis-Besse (before 2002,
not conduct formal missed conduct formal missed not act as if they are investigative processes leave after 2002?)
opportunity root cause opportunity root cause accountable for surfacing the important safety
analysis investigations after analysis investigations after causal factors of events vulnerabilities uncorrected to Exelon Tritium Releases to
major line organization major line organization before they happen. be found in the investigation Drinking Water Sources
adverse conditions and/or adverse conditions and/or of consequential events. (2005-2006)
behaviors are surfaced. behaviors are surfaced. These
investigations focus on Norm/ Institution/ Physical
oversight shortfalls, not line Item
shortfalls.
Oversight organizations Oversight organizations “eat Oversight effectiveness does Eventually the flawed Davis-Besse (before 2002,
seldom, if ever, report their their own cooking,” i.e., they not improve. oversight processes leave after 2002?)
own safety and process model the behavior that they important safety
weaknesses. expect from the line vulnerabilities uncorrected to OSHA?, NRC?, CSB?
organizations. be found in the investigation
of consequential events. Norm/ Institution/ Physical
Item
Testing is conducted in order Testing is conducted in order Anomalies, inconsistencies, Eventually the flawed testing “B” EDG Overload at nuclear
to create a record showing to find out what is wrong and deviations are not processes leave important plant 2007
that the equipment functions with the equipment. pursued. safety vulnerabilities
acceptably. uncorrected to be found in the Norm/ Institution/ Physical
investigation of consequential Item
events.
Corporation.

(Mental Content/
Operation continues even When process parameters do Anomalies, inconsistencies, Eventually the flawed testing “B” EDG Overload at nuclear
when operators observe that not respond as expected to and deviations are not processes leave important plant 2007
controls are not having the control actions the evolution pursued. safety vulnerabilities
intended effect on process is terminated until positive uncorrected to be found in the Norm/ Institution/ Physical
parameters. control is re-established. investigation of consequential Item
events.
There is no policy or There are clear procedures for Work continues even when Continuation of work results Norm/ Institution/ Physical
procedure covering Stop imposing and lifting Stop there is an inadequate basis in harm. Item
Work Orders for safety or Work Orders. for believing that it will be
quality. safe and that it will produce a
quality result.
Managers exercise the Managers behave in All workers perceive that Espoused values are eroded. Inferred from: Operators
retained right to behave in the accordance with espoused they have the right to deviate exceed abort criterion without
best interests of the values even when they from espoused values. scramming. Seabrook 1989
organization even when such perceive that this is not in (INPO SER 24-89)
behaviors deviate from accordance with the
espoused values. immediate interests of the
organization.
Safety concerns are submitted Safety concerns are submitted It is not possible to interview Problems that could have Although having an
anonymously. through open channels. the concerned individual to been averted by knowing anonymous channel is a good
find out more about the more about the concern, practice, its actual use
concern, including causation, including causation, extent of indicates that some staff have
extent of condition and extent condition and extent of cause. not been convinced that
of cause. are found as a result of problem reporting is a career-
downstream events. enhancing activity.
Corporation.

(Mental Content/
At an “all-hands” meeting the Use the submittal of an Fewer anonymous concerns Problems that could have Norm (or possibly an
submitter of an anonymous anonymous concern to are submitted. been averted by knowing aberration)
concern was requested by the investigate what it is about more about unreported
senior executive to come the safety culture that induces concerns, including See speech of NRC
forward to discuss the personnel to maintain causation, extent of condition Commissioner Gregory
concern. anonymity. and extent of cause. are found Jaczko, February 13, 2007
as a result of downstream
events.
Work on an energized circuit Work on an energized circuit Work on energized circuits Eventually personnel harm Norm/ Institution
is done without a job-specific is not done without a job- becomes a way to maintain and equipment damage
hazards analysis and a specific hazards analysis and production despite design results.
hazard-benefit analysis. a hazard-benefit analysis. vulnerabilities.
Authority to do such work is Approval for such work
relatively informal and at a includes high level signatures
low organizational level. and independent safety
review.
Design problems revealed by Design problems revealed by The design philosophy and Later events have even more Norm/ Institution
events are corrected. events are used as windows process are not improved. serious consequences.
into the entire design process See power uprate events in
including design reviews and the nuclear power industry.
pre-turnover testing.
Even when a root cause When a root cause analysis is Punishment before root cause Root cause analysis loses its Norm/ Institution
analysis is expected industrial expected industrial discipline analysis puts pressure on the credibility. Workers stop
discipline is meted out before is not imposed unless it is root cause analysis team to cooperating with root cause
the root cause analysis is consistent with the findings have findings consistent with analysis teams. Root cause
hardly started. of the root cause analysis. the punishment. This turns analyses become less
the root cause analysis into a effective.
prosecution tool rather than a
search for truth.
Corporation.

(Mental Content/
Industrial discipline Industrial discipline Punishment is sometimes not A climate of fear permeates Norm/ Institution
(punishment) is frequently (punishment) is controlled by fair or just. The wrong people the work place.
applied without formal formal safeguards against get punished for behaviors
safeguards against injustice. injustice. that their bosses and/or the
culture set them up for.
Corporation.

Safety Culture - BacktotheBasics - Version 2008.06

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Safety Culture - BacktotheBasics - Version 2008.06

Caricato da

Copyright:

Formati disponibili

Safety Culture — Back to the Basics, Version 2008.

Safety Culture — Back to the Basics

DESCRIPTION OF CULTURE ................................................................................................................................6

DESCRIPTION OF SAFETY CULTURE..............................................................................................................13

Measuring and Describing a Safety Culture ...........................................................................................................20

THE KEY ATTRIBUTES OF FUNCTIONAL SAFETY CULTURE .................................................................22

OTHER VIEWS OF CULTURE AND SAFETY CULTURE...............................................................................23

Institute of Nuclear Power Operations (INPO) ......................................................................................................23

APPLICATIONS OF SAFETY CULTURE CONCEPTS.....................................................................................26

WALKING THE TALK ...........................................................................................................................................28

IMPROVING SAFETY CULTURE........................................................................................................................28

LOW HANGING FRUIT..........................................................................................................................................29

PRELIMINARY CONCLUSIONS ..........................................................................................................................29

Durkheim certainly rings true here.

A habit is to an individual as culture is to a group.

The classic view of culture is that it includes

 Culture is to a group as character is to an individual.

Thus a broader point of view would offer that culture is made up of

Figure 1 The Elements (or Components) of Culture

 Predominating attitudes are a class of mental content.

Dictionary Definition vs. Broader View

Examples and Experiments

Formal and Informal Parts of Culture

Cultural Inter-relations Among Elements

Shared Mental Content

Norms and Morality

In summary, it is fair to include at least the following in “institutions”:

Characteristic Physical Items

The Importance of Culture

DESCRIPTION OF SAFETY CULTURE

Figure 2. Safety Culture is part of Culture

Safety Culture vs. a Culture of Safety

Shared Mental Content

Especially Important Institutions

The Selection-Promotion-Succession System

Characteristic Physical Items

The Results of Good Safety Culture

Default vs. Managed Safety Culture

What Drives Safety Culture?

Dysfunctional Safety Culture Not a Root Cause

Safety Culture and Compliance

Measuring and Describing a Safety Culture

Testing Observations for Safety Culture

A Small Slice of Safety Culture

Culture Element Category Comment/ 10CFR50 App. B

Culture Element Category Comment/ 10CFR50 App. B

Going from a Root Cause Analysis to Safety Culture

THE KEY ATTRIBUTES OF FUNCTIONAL SAFETY CULTURE

ATTRIBUTE CATEGORY Comment/ 10CFR50 App. B

OTHER VIEWS OF CULTURE AND SAFETY CULTURE

International Atomic Energy Agency (IAEA)

Institute of Nuclear Power Operations (INPO)

Mr. Ellis concludes:

Dr. Thomas E. Murley

Professor James Reason

Figure 3 James Reasons Five Cultures of Safety Culture

Professor Edgar Schein

Comment: It leaves out norms, institutions, and characteristic physical items.

The U. S. Nuclear Regulatory Commission 36

The Center for Chemical Process Safety 37

CCPS provides the following “essential feature” of process safety culture:

APPLICATIONS OF SAFETY CULTURE CONCEPTS

COMPONENT CATEGORY Comments