SpringerBriefs in Applied Sciences and Technology

For further volumes:

http://www.springer.com/series/8884
Ren Amalberti
1 3
Navigating Safety
Necessary Compromises and Trade-Offs -
Theory and Practice
Ren Amalberti
Haute Autorit de Sant
Saint Denis-La Plaine
France
The Author(s) 2013
This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part
of the material is concerned, specically the rights of translation, reprinting, reuse of illustrations,
recitation, broadcasting, reproduction on microlms or in any other physical way, and transmission or
information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar
methodology now known or hereafter developed. Exempted from this legal reservation are brief excerpts
in connection with reviews or scholarly analysis or material supplied specically for the purpose of
being entered and executed on a computer system, for exclusive use by the purchaser of the work.
Duplication of this publication or parts thereof is permitted only under the provisions of the Copyright
Law of the Publisher's location, in its current version, and permission for use must always be obtained
from Springer. Permissions for use may be obtained through RightsLink at the Copyright Clearance
Center. Violations are liable to prosecution under the respective Copyright Law.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication
does not imply, even in the absence of a specic statement, that such names are exempt from the relevant
protective laws and regulations and therefore free for general use.
While the advice and information in this book are believed to be true and accurate at the date of
publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for
any errors or omissions that may be made. The publisher makes no warranty, express or implied, with
respect to the material contained herein.
Printed on acid-free paper
Springer is part of Springer Science+Business Media (www.springer.com)
ISSN 2191-530X ISSN 2191-5318 (electronic)
ISBN 978-94-007-6548-1 ISBN 978-94-007-6549-8 (eBook)
DOI 10.1007/978-94-007-6549-8
Springer Dordrecht Heidelberg New York London
Library of Congress Control Number: 2013933588
v
Fifteen Years Have Passed Since the Publication of La conduite des systmes
risques [1, 2]
The safety of complex systems has lost none of its currency; indeed the opposite is
true. To cite a few examples, we could mention the twenty or so aviation disasters
that still happen in the world every year, the chemical disasters which are almost
as frequent but have longer lasting impacts, the explosion at the Total AZF plant at
Toulouse in 2001, the sinking of the tanker Prestige causing an unprecedented oil
slick on the French and Spanish coasts in 2002, the explosion at the BP oil renery
in Texas in 2005, the explosion at the Bunceeld oil terminal in 2005, the drilling
error by the Indonesian oil company which caused a mud volcano that has been
owing uninterruptedly in Sidoarjo since 2006, the explosion of the BP platform
in the Gulf of Mexico in 2009 causing an oil slick that covered the whole South
Coast of the USA and the rare but catastrophic nuclear disasters (Chernobyl in
1986; Fukushima in 2011), not forgetting the problems affecting public services:
the thousands of deaths every day caused by an unsafe medical system or the thou-
sands of dangerous trades made by bankers that were revealed by the international
subprime crisis in 2008 and the renewed European debt crisis in 2011 (involv-
ing the disappearance of perhaps USD 25 trillion). The list is simply too long to
attempt an exhaustive summary. Even more importantly than the deathsnumbers
of which are tending to fall in proportionate termsone is struck by the diversity
of contexts involved and the increasing seriousness of the disasters and the huge
economic repercussions that they entail.
This reveals all the foundations of a system that is maintaining a fragile balance
on a global scale: producing more, using more complex tools, in more difcult
places, inevitably resulting in greater risks; asking science to control this growing
risk by seeking a magical alchemy to optimise control over the multiple trade-offs
between contradictory risks: access to innovation and the emergence of new risks,
competitive markets, free enterprise and the limitation of legal constraints, safe-
guarding property and human safety, immediate safety and long-term safety, the
problem of waste etc.
I have spent my life studying these risks and seeking out this mysterious
alchemy that would make it possible to bail out a boat that seems determined to
Foreword
Foreword vi
take on more water. Above all, safety is a paradox: people demand safety once
they have already taken risks.
Along the way I have often found myself pondering the problem of how to
improve safety and risk management. This book is last in a trilogy that reects
this personal journey, which has been made up of three complementary aspects:
understanding and improving the individual management of risks in the work-
place in high-risk industries (management of high-risk systems [3]);
changing perspectives and improving systematic risk management in business
(the series of books co-edited with the MSH-CNRS in Grenoble on the seminars
entitled Risks, errors and breakdowns, 2001, 2002, 2003 and a series of articles
[48]);
and nally, to help to control high-risk systems by providing an integrated
model for the management of trade-offs in the area of safety (this book).
These three complementary aspects have emerged naturally from three succes-
sive but quite separate periods in my professional life.
The rst was a period of academic research. Although I was trained as a doctor,
this period of academic life really began with my second course in cognitive
psychology and my posting in 1982 to a permanent job as a researcher in a mili-
tary laboratory (the Institut de Mdecine Arospatiale). I immediately came face
to face with aviation accidents and focused my attention on human error. This
approach fed into my theory of individual risk management and established the
basis for cognitive compromise.
The second was a period of interdisciplinary activity. In the late 1980s I
had the opportunity to work closely with Airbus, Air France and the ICAO
(International Civil Aviation Organisation) on the development and global dis-
semination of the rst CRM (Crew-Resources Management) courses. Due to the
resulting knowledge of the aviation sector I was seconded to the European JAA
(Joint Aviation Authorities), where I worked as head of safety and human fac-
tors until 1999. In this position, I learned that safety is essentially interdiscipli-
nary in nature but that it is understood in different and sometimes contradictory
ways by each discipline. Above all I was able to see for myself and conrm
that the idea that it was possible to reducing all these differences was an illu-
sion. This is because they are based on deeply rooted models, each of which has
its own reasoned approach which is in conict with the other approaches (eco-
nomic, political, human, technical and even cultural, with differences between
the United States and Europe in terms of attitudes to regulation). I drew from
this a way of conceiving regulations and approaches to safety and I was able to
test these and apply them together with my American partners when building
the common platform for regulation of human factors in civil aviation.
The third period was one of action in the area of governance. Since the late
1990s my multiple advisory roles (on environmental risks, energy and safety in
health care) and the experience of directing research programmes in the area
of safety (energy and transport) allowed me to understand the view of safety
Foreword vii
as a severe crisis surrounded by a lack of theoretical understanding, like an
object blazing in the midst of an empty ocean. Business leaders, under pressure
from the media and maintain a focus on the short term, are often too optimistic
about their results, convinced that simply pursuing a policy of tighter controls
and stiffer penalties for front-line operators will provide the ultimate solution
to their problems. Meanwhile, evidence continues to accumulate that it is pre-
cisely this policy that is generating the crises feared by those same politicians
and business leaders. This work is about that paradox, those consequences and
the models that are available to navigate the risks.
Evolution or Revolution? Compromise and Adequacy
For a number of geopolitical reasons, the world is changing quite rapidly as we
enter the twenty-rst century; the new era that is beginning strongly favours those
with ideas about radical change in the area of safety at both individual and organi-
sational levels. In the area of safety, the time of traditional human factors based on
human limitations and human performance is coming to an end. It is giving way to
models containing dynamic linkages (Joint-Cognitive Systems) and systemic mod-
els. We are only now beginning to perceive the effects of this radical change in the
area of risk management.
Tomorrows accident, which will be rare but no doubt even more disastrous,
will be an accident where the regulations were in place to prevent the problem,
or perhaps where no-one actually made an identiable error and no system truly
broke down but all the components had been weakened by erosion; the degree
of variation within the operating conditions will one day prove enough to exceed
the tolerable linkage thresholds. Paradoxically, the safety of the system will have
staked everything on reassuring procedures. With support from these it will have
progressed, gained condence, and then become weakened over time by eroded
defences, increased tolerances and loss of the expertise required to manage dif-
cult situations. The new idea of resilience must be understood in these terms: the
increase in controlled safety which is imposed by regulations necessarily takes
place at the cost of increased rigidity, a desire for tremendous standardisation of
both technologies and human beings, ultimately resulting in operators who are less
capable of adapting to surprises (this has a negative impact on managed safety,
which is based on the expertise of operators and can be linked to the idea of resil-
ience). The art of successful intervention in safety involves controlling the com-
promise and the trade-offs between the benets accruing from controlled safety
and the resulting losses in terms of managed safety.
The idea of compromise underlies the entire theoretical and practical struc-
ture set out in this book. Compromise is two things. It is the necessary cognitive
or intellectual micro-centered compromise that the worker must constantly
regulate, between external demands, his own know how, competing tasks and
motivations and his own physiological state of fatigue and stress. It is also the
macro-centred compromise of control, which models more or less conscious
Foreword viii
trade-offs between performance and safety at the level of the management of com-
plex systems.
The rst compromise, which is described as micro-centered, takes place at the
level of the operator. It brings us back to one of the last and hugely misunder-
stood points of human psychology, since it mobilises the system of intellectual
control and is of course variable and subject to revision, making it largely inac-
cessible to the methods of study used in traditional psychology, which postu-
late a degree of stability in order to capture and measure a baseline in terms of
intellectual ability (memory, attention, vigilance etc.). Having said this, consid-
erable progress has been made in psychology, and although it is not possible
to characterise the control of cognitive compromise on a moment-by-moment
basis, it is now possible to characterise the variables that modulate it almost in
real time. All the work that has been done in the past on the operation of high-
risk systems was focused on this modelling process and the very signicant
consequences in terms of designing safe operator assistance systems. These are
included in this book in the form of a summary.
The second compromise, which is referred to as macro-centric, forms the inno-
vative heart of this book. It concerns the trade-offs that take place between per-
formance and safety when navigating risks at the level of company management.
Sometimes these are described in terms of deciding to make specic sacrices.
Outrage over compromises of this type represents the daily grist of the tabloid
press. This book offers the keys to those trade-offs and the sacrices that are
required. Almost all the keys to this compromise are surprising and at rst sight
they may at times seem politically incorrect, but in the end they are easily under-
stood on further reection. Some of the most paradoxical results that the reader
will discover include the idea that the institutionalisation of safety is an emergent
property of systems that are already safe, and that strategies for intervention should
make use of methods and tools that differ signicantly depending on how safe the
enterprise is, while these should impose increasing burdens as safety improves. In
fact the level of safety has the surprising property that it is never adequate and it
actually generates societal demand which increases in parallel with the progress
that is made. It is a variable with no maximum, and all improvements result in
increasingly severe judgements by outsiders on the small number of safety failures
that still occur. The reader will also discover that choosing an inappropriate safety
strategy, especially one that is too ambitious, ultimately causes safety failures.
There is a surprisingly high degree of continuity between the models of the two
types of compromise at the micro and macro levels or at the individual and organi-
sational level, as if the same models perhaps form part of a fractal perspective. The
psychological performance of operators under real everyday conditions, the level
of attention that they maintain and the relevance of their choices, always appear
imperfect to the observer and almost disappointing in terms of what they believe
these people are capable of doing and even in terms of what they have seen for
themselves during training. The performance of enterprises in terms of safety is
almost always disappointing too, and always lower than what one would expect
from the debate and when considering the organisations themselves.
Foreword ix
The judgements made in both of these cases would be hasty and imprecise. Of
course what is achieved does not represent maximal performance, but it is still
adequate in terms of the demands of working standards. For example, a driver is
not required to drive exactly in the centre of his trafc lane (although this would
appear to be ideal); on the contrary, his environment is constructed in such a
way that he can drive within a wider space, even making use of a degree of addi-
tional tolerance if he does not see anyone approaching him. This structure, which
is shared, conceived and created both through technical consensus (decisions on
road width and road ergonomics) and by social consensus (verbal instructions
given to the police on behaviours that should and should result in a reprimand)
makes it possible to come up with a reasonable response to the demand for safety.
This comes back to the idea of adequacy: The drivers social contract is to stay
on his side of the road. No more is demanded of him, that is adequate and he
will not be given a penalty as long as he achieves that. This perspective is applied
throughout the world of work, and paradoxically it serves to promote rather than
reducing safety, as one might expect from the laxity that it suggests: in fact the
wider the road, the less the driver is required to concentrate on driving, the less
fatigued he becomes and the greater the margins available to him to recover from
an unexpected event or surprise (building adequacy also builds safety).
The suboptimal nature of this situation makes it possible to compromise, work
in parallel on other aims (private thoughts, other areas of interest etc.) or even save
oneself and avoid unnecessary effort, storing up energy to enhance other dimen-
sions of performance, improve staying-power (allowing a person to be just as
effective when leaving work to go on holiday as he was when returning to work
in the morning), or to be able to respond to challenges and setbacks. In short, it
makes it possible to live in symbiosis with a wider range of demands from soci-
ety, which can never be simply summarised in a SINGLE unique objective such
as immediate safety. That is because safety has never made an enterprise survive;
lack of safety can kill it, but safety can never be presented as the only goal worth
pursuing. This concept of ADEQUACY naturally complements the concept of
COMPROMISE and it will be set out explicitly and debated in several places in
this book in order to understand its denition and above all its implications when
it comes to building regulations and auditing enterprises. How is it possible to
successfully create this alchemy: a technical and social consensus on what is ade-
quate when dening and interpreting standards?
As always, a work is never achieved by a single person, and I must begin by
thanking those who have accompanied me on this long path for their ongoing
contributions to this debate; in France: Jean-Michel Hoc, Jean Paris, Maurice de
Montmollin and Jacques Leplat, and internationally: Jens Rasmussen, Jim Reason
and Eric Hollnagel. They have all continued to be close contacts and a source of
both criticism and inspiration for my work. Next I must mention all my doctoral
students, who carried out a signicant proportion of the eld work (with special
thanks to Gal Morel and his work on professional deep-sea shing). I cannot
mention all my other international friends from all the academic and industrial
contexts in which I have spent my time and whose experience and models have
made an impression on me. In particular I must mention my involvement, right
Foreword x
from the outset, in the Institute and then the Foundation for an Industrial Safety
Culture (ICSI/FOCSI) which has allowed me not only to penetrate more deeply
into the secrets of major industries and the safety challenges facing them but per-
haps more importantly to work alongside people with a wealth of experience; in
particular I am thinking of Ren Deleuze and Ivan Boissires.
One of the most valuable aspects of that experience is no doubt the wide range
of different inuences and environments, ranging from research in the French-
speaking and Anglo-saxon traditions to political governance, aviation, health
care, road safety, professional shing and major industries. In the end science is
often simply about creating a synthesis. Perhaps the greatest contribution of this
work is precisely that it creates a way of reecting that brings together different
approaches and contexts which normally do not interact, which caricature each
other and each of which considers its own case to be so special that it cannot learn
from the others, while an outsider's eye can perceive common theories and proper-
ties emerging from the whole.
Another effect of the age of this book is that its potential readership has grown
and it will be available in three languages: French, English and Spanish.
In short, this book seeks to provide the keys to safety in high-risk systems in the
twenty-rst century, making the models as accessible as possible while maintain-
ing an adequate degree of scientic precision, for an intended readership including
teachers, consultants or industrialists who may be able to make use of the models.
The theoretical path may never reach its end, but it has at least been marked
out, as has the vision encompassing the transverse links across the different trends
in the world. The reader will also nd a list and critical reading of a very large
number of references.
The practical path to intervention in safety has also been marked out but it has
been intentionally limited to general principles and a toolkit has not been included.
I will leave the work of developing such tools to my colleagues. Maintaining a
distance from structured assessment kits in this way is not yet another scientists
strategy to avoid the problems on the ground; without minimising their impor-
tance, the refusal to emphasise them makes it possible to place the emphasis else-
where instead: specically on the political decision-making process that occurs
prior to their use. Success in this area of risk management is above all about high-
level strategic choices rather than measurement tools or questionnaires which are
easy to use but often mask the most important aspects.
So fasten your seatbelts, dear reader: you are about to learn many things that
are counterintuitive, some of them disturbing and others reassuring, but all essen-
tial to successful risk management. I hope you will enjoy reading it, and criticisms
and discussion are always welcome.
Ren Amalberti
Foreword xi
References
1. Amalberti R (2001) La conduite des systmes risques, 2nd edn. (trans into
Spanish). PUF, Paris
2. Amalberti R (2009) El control de los sistemas de alto riesgo. Modus Laborandi,
Madrid
3. Amalberti R (2001) La conduite des systmes risques, 2nd edn. PUF, Paris
4. Amalberti R, Fuchs C, Gilbert C (2001) Risques, erreurs et dfaillances, Vol 1.
MSH, Grenoble
5. Amalberti R, Fuchs C, Gilbert C (2002) Conditions et mcanismes de produc-
tion des dfaillances, accidents, et crises, Vol 2. MSH-CNRS, Grenoble
6. Amalberti R, Fuchs C, Gilbert C (2003) La mesure des dfaillances et du
risque, Vol 3. MSH-CNRS, Grenoble
7. Amalberti R. (2001) The paradoxes of almost totally safe transportation sys-
tems. Saf Sci 37:10926
8. Gilbert C, Amalberti R, Laroche H, Paris J (2007) Toward a new paradigm for
error and failures. J Risk Res 10:95975
xiii
1 The Demand for Safety and Its Paradoxes . . . . . . . . . . . . . . . . . . . . . . . 1
A World Demanding Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Question of Perimeter: Which Systems are Involved
and for Which Safety Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
There is No Shortage of Common-Sense Solutions to Make
Complex Systems Safer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Life-Cycles of Socio-Technical Systems and the Paradoxical
Positioning of Safety in Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
An Initial Creative Phase, Often Unseen by the General Public . . . . 6
An Optimisation and Economic Benet Stage, by Far
the Longest, Known as the Quality Period . . . . . . . . . . . . . . . . . . . 6
A Final Optimisation Phase, Known as the Safety Period . . . . . . . 8
The End of the Cycle and Death . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
At the End of the Cycle, Accidents are Often More Severe, More
Intolerable and More Expensive to Remedy Legally . . . . . . . . . . . . . . . . . 12
Alongside the Common Features, of Which There are Many in the
Field of Safety, a Number of Macro-Scale Cultural and Strategic
Differences Still Remain in Terms of Safety Interventions . . . . . . . . . . . . . 14
What Lessons Can Be Drawn From This? . . . . . . . . . . . . . . . . . . . . . . . . . 17
References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2 Human Error at the Centre of the Debate on Safety . . . . . . . . . . . . . . . 19
Human Errors, Major Steps Towards Building Knowledge . . . . . . . . . . . . 19
The Initial Contribution from Gestalt Theory was that Failure
Makes it Possible to Achieve Understanding . . . . . . . . . . . . . . . . . . . 20
The First Works on Error: The Essential Role of the Control
of Cognitive Activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
The Contribution Made by Rasmussen: The SRK Model . . . . . . . . . 23
The Summary by James Reason . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Work on Detection and Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Three Recurrent Biases in Relation to Human Error . . . . . . . . . . . . . . . . . 30
Hindsight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Contents
Contents xiv
Attributing all the Blame to the Last Person Who Carried Out
the Action Causing the Disaster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Confounding the Error and the Accident . . . . . . . . . . . . . . . . . . . . . . 32
The Concept of Adequacy as a Cognitive Tool for Management
of Contradictory Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Adequacy in Mental Representation and Planning . . . . . . . . . . . . . . 34
Adequacy in Decision-Making . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Adequacy in the Areas of Control and Implementation . . . . . . . . . . . 35
Two Levels of Supervision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Using Time to Control Adequacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Summary: A Model of Individual Safety Based on Constantly
Building Compromises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Consequence: Following Procedures Means Being Able
to Deviate from them About an Average Point. . . . . . . . . . . . . . . . . . 43
The Complex Links Between Safety and Competencies:
An Inverted U Curve . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
What Lessons Can Be Drawn From This? . . . . . . . . . . . . . . . . . . . . . . . . . 48
What are the Consequences of Improving Safety on this
Individual Scale? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
3 The Keys to a Successful Systemic Approach to Risk Management . . . 53
On Safety, Systems, Complexity and the Structure of this Chapter . . . . 53
The Swiss Cheese Model as the Archetype for Systemic Models
and Its Current Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Controlling Systemic Safety: Four Key Steps for Building Safety
in a Complex System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Three Models of Balanced Safety Rather Than Just One . . . . . . . . . . . . . . 80
Three Very Different Strategies in Terms of Exposure to Risk . . . . . 80
Three Authentic Models of Safety Rather Than Only One . . . . . . . . 85
A Few Additional Rules When it Comes to Taking Action . . . . . . . . . . . . . 93
Thinking in the Future Rather Than the Past . . . . . . . . . . . . . . . . . . . 97
And Where is the Safety Culture in All This? . . . . . . . . . . . . . . . . . . . . . . . 99
Cultures and Climates (of Change, Effectiveness and Safety),
Multiple Areas of Ambiguity and Confusion . . . . . . . . . . . . . . . . . . . 99
References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
4 Human and Organisational Factors (HOFs): Signicantly
Growing Challenges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
The Productive Worker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
The Safe Factory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
The Safe Product, Safety Challenges Raised by Design and Use . . . . . . . . 112
The End of the Impossible Dream of Safety . . . . . . . . . . . . . . . . . . . . . . . . 114
Uncertainty as a Future Risk: Future Risks as a Central Feature
of the Present . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Contents xv
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
5 Conclusion: The Golden Rules in Relation to Systemic Safety . . . . . . . 119
The Enterprise is a System Incorporating Contradictory Tensions
and Requiring Trade-Offs in the Area of Safety . . . . . . . . . . . . . . . . . . . . . 119
The Dimensions of Compromise and Offsetting Risks Within
the Safety Division . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
The Three Essential Dimensions of Compromise
and Offsetting in the Area of Safety . . . . . . . . . . . . . . . . . . . . . . . . . 121
10 Golden Rules to Make an Intervention in Systematic
Safety a Success . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
131 131
I
Institutional resilience, 79
J
Just culture, 65, 101
K
Knowledge-based errors, 26
L
Leadership, 93, 94, 101, 124
Level of safety , 4, 17, 49, 5658, 65, 7578,
84, 89, 118, 122
Life-cycle of systems, 5
M
Managed safety, 77
Mental model, 34, 35
Mental representation, 34
Metacognition (role of), 33, 37, 44, 48, 49
Middle management, 93, 127
Migration of practices, 72, 74
P
Precautionary principle, 117
R
Reason models (critique), 54
Reasons slices model (denition), 54
Resilience model of safety, 55, 57, 80, 90
Index
A
Adequacy, 3436, 38, 42
Automation, 67, 113
Awareness of the situation, 39, 82
B
Big one, 12
C
Compromises, 17, 18, 20, 27, 28, 32, 41, 50,
54, 57, 76, 119, 121, 122
Controlled safety, 77
CRM (Crew Resources Management), 15, 16,
113
D
Defences, 28, 54, 56, 57, 69, 70, 93, 97
Deviation, 4, 31, 33, 35, 43, 44, 47, 67, 72, 74,
76, 86, 113
E
Error detection, 19, 26
Error management, 29, 40, 126
Error recovery, 26, 27
H
HRO safety model, 90
Human and organisational factors
(HOFs), 56, 101, 109, 111,
113, 114, 116118
Human errors, 19, 20, 25, 30, 101
R. Amalberti, Navigating Safety, SpringerBriefs in Applied Sciences and Technology,
DOI: 10.1007/978-94-007-6549-8, The Author(s) 2013
Index 132 132
T
Taylorism, 109, 110
The Making of Safety, 43
Time (role of), 5, 8, 9, 15, 18, 27, 29, 33,
34, 3742, 58, 63, 68, 73, 74, 96, 99,
100, 102, 104, 114, 120, 127
Trade-offs, 2, 11, 37, 42, 54, 57, 6264,
75, 76, 80, 93, 95, 104, 115117,
119123, 127, 128
U
Ultra-safe safety model, 87
V
Violations, 4, 31, 65, 7173, 122, 128
Voluntary reporting, 6567
W
Weak signals, 70, 71, 94
Risk analysis, 59, 62, 63, 96, 128
Risk decision-making matrix, 70
Risk management, 4, 7, 14, 26, 33, 46,
48, 53, 54, 61, 64, 66, 86, 97,
99, 119, 127
Risk map, 57, 67, 69, 80, 96, 97,
114, 126128
Risk reduction, 63
Routine errors, 19, 24, 25, 27, 32, 47
Routines (role of), 1928, 30, 3537,
42, 44, 45, 4850, 85
Rule-based errors, 26, 28
S
Safety climate, 99, 100, 103, 104
Safety culture , 57, 65, 66, 99103,
105, 113
Safety management, 2, 38, 99, 109, 121
SRK model (by Rasmussen), 23, 25
Systemic, 2, 12, 32, 54, 56, 57, 63, 73, 75,
104, 105, 119, 121, 126
Chapter 1
The Demand for Safety and Its Paradoxes
Abstract The world demands ever-increasing saf* That demd, h m r , va-
les from one system to moVler as ,u lifbcycle pmgresses. The prcJsUre m safety
oftenreaches nu maximum a ~ l e end ofthe cycle, whxh 8s psradorrauy ~ 1 e lime
whenthe system more a less reaches if apogee)" t a ms of thfh111d of ffmY.
A World Demanding Safety
ROblFms svlm"n&ngsafny m nyrnynynyty hhhh h h e " soW,dcIY &,"Id. It is
maso much b e number of ace~dens but rsths LC" d m t e , high medm pmfilc
thmughnyt b e world mat t h h 5 f f ,"to the he8m of f f az- m "Eh rauruer who
hannrrything to1ovin temofthemu~ofmeirmmfrm, kdbmd " d m
Woae still, Ulere are a growing number of prophets of dwm (or whirfle blow-
ers) de Kenasdove [I], who recnve InlenJlve medla atenuon as fhey bmadoasr
forecase of wm and confusmn, wi n g every accident--pculady whrn lhcse
have mulrltanond tau-s rympmms of a soelety that has last as vlsdom and
sclfsonml (mdustrial h d s , ma r d drrssms, forms of "~uicidd"hehaumur in
society such as smoking, alcaho1 or road deatha, c"om""c uphcavds) I t is hardly
$up",,"l lh,, ,u:h , ,,ru.A,J, h*, WmrJ Ihn ,*uc lnl" an ~neaaplble \m.b,e
u"t.hrr rgu.nnp prr;ucr p"b.,:pol,:) rndcl at rml 4mprrumrr
MI Xbodlcq J Vlr Mnonal and lnlcrnatlonsl CIcl b e rropondcd lo bl r nola
loll uy meam88 aw~#:,ci, ne* l.d#onue< iu J mcrr &dr-J l o r d t ~ , B r ~ D d -
I.. how p r u l n.,nrruu\ 1rvr and lum\ n 5d.t) red&" lvnrlng I,& n0v.d
rapxlly ~ n u . m t ~ ~ ~ ~ ( r r < c h runJ#nd #n lnlr acr ~n Wcrlcm. unmr\ h*.#n.x*rJ
b) al mm ?im * ,,n* OW? Th. ,am. ,nfln,hmrq Icndcn.) I, icm ,n Unncr,l,,
i~ld<,nnnumgarrune .JWS, uinlr mull m - ~ mar m- , r a rntmmo and i c e
E13Y E~SYI ~M~ES m,h. ", <he of safety inwmn.on and rmsv1raum are bl com~
ing mn r numnous (+12 % m Vlr UnlM Slam k w n 1985 and MW) s mcn
the uponrnnd dcmsnd hr avVlls snd nsk sr~esrnmf repom (+430 % m 10 pn)
If is &is cmmzencc of be mncr ~t of '"safny''whch has finally srven sclmnafir.
crrdcnce to a su&cn WUE~ was lobg m r c d imply as a &acelated w i ~ l
f shni cd developmen,.
R i \ m . ~ n , . N ~ v l g m ~ ~ , ~ ~ . Sp"~crBnebmAppl,ulSElmEiandT~hndo~,
WI 10 1 W ~ W I - 6 W - k I . 8 W A u h ~ B 2 0 1 1
NO, e v w aspccr of this publr awareness 3s kneficul, however: the marker
t h a has k e n cnlucd is no, only l usnve bur i t also has a pol mcnl sm& and
sau ruffrrsfmm snumberbef ""LInmbihBes
L, m y =axes syst em ace begimmg to 0- at tVtV tvpcedr. 0" the one UI&
Uxw is a n a ~ t i y virmouaappraa~h taqualltyand~afe'y, o p t i n g fmmacom-
frmnble. mcoonedenvimnmentin iLr new ofnces, bvrrtingwithce"ainlies abautmc
<r mwnw Uul mu* be iipopod up" Ihe IheYYrn. On Ihe IhethUI, is is pandpandtii iys-
Bm pnJJunJed by a markeb m whrh h FBC al e ( Fas~~~~Be~Cheapa) ' l s the
only way of ensuring e o mr c d survlvnl and success rn modclhng Of den,m"-
mahog on samfrcer and the m-gme~t ~nt uf a~es the arr needed m &ulate
Vadc-ofh be-n smt y- daM and p ~ d d d I ~ n - d a t d "dual al male of thth 1 1 ,
wel l - kmn as- of safcty manapmcnf. Itmu8l k ncagnlxd that Ulc cconamic
death of an aganindm, is still an accident and U1aantilheoi3 between fmmnl safety
and a n o m sulvivnl ispnhapsnot sognat as mghtk w m d . C~ci dl y, how
ever, Uxre is no nenafic, gidnlmsysremic Fpe ni v c on bs,ssuc.
L s ho s we have made rapld p mws on Ur &mls (Ux rm*s ma&) and
c nn fasler pmgress on ~l mpl e i dus and local safety measurement Bystems (whch
can k wnml k d and mar*eted) but we rill have nlmont no model at al l which m
able Conewe as aframewcck for Ul e~~mf egi i mi i i gmc", of f f f ef ~.
~ a v e we gone too far wlUlovr wi ng mnm r wu n t t h ~ llmlxauans imposed by
the m m " m e we pmgns~ed too fast? 1s the lhmr of imposvble levels of
Qoenhoo of Perimeter: Which Systems am lwolved
and for Which Sdety Pmeers
This book de ds wllhsafny (fuhrer) m ma,orwno&hmcnl systems ( e n w sup-
ply, pubhe *aorpmt aod newrces such as banlong and d i e me ) The safety of
there systems is an ,sue thal has lost noneof its ~rrrncy-rnndezd thc opposlle rs
,m*
The 1831 ~f llwrlrrr I S tx l J" l to I l r mpl r rcpl..J":r It In Ull, uvrL E v n
more man ~hc nvmrr of dca~l r .u h r h arc acruall) rcnanp to fcducr m pmpof-
loonal nm?,. II 17 the u~dc mope ol dRcccnt conllxlr ~mohr d and the pmu~np
,CIC,,l, Of Lhr dlrsrlClr 11181 ..p,urcr Ulc 111 dgll,al,>n
Chapter 2
Human Error at the Centre of the Debate
on Safety
Ab8tRct This chaplerfocuses on fhe di xaery of the Pafew mode1 fha, in used by
lndlvldua~s 1" order tocar, our~lar won W~UIUIUI~ t t t i d m t ~ ~ ~ ~ ~ ~ ~ d ~ n u . II
a mlcro-~evei pcrspcoo~ 00 onmy. me mwri ri i hare ii i i i i w o f f book L
fhr management of hl gh-nt systems pcbliJhd in 1996, wrfh addlsod inslghs
fmm fhehelatest workonEommonfmsof has mcrmrana1ysis nndthcrmpawnEc
of meEonrrpcsof adcquacy, comprormsc, ,.&oaa"d fhecenwl roleof ","rims.
H-o Ermrs, Major Steps Towards Building Koowkdge
Human krngs do not uek lo work wlfhaut &ng mars, bey seek lo aclueve
a satisfactory n ~ u l r while minhiaing ncgatin costa (time uasrcd incidcN8). A
peaon's key objedve is to make progress , . , wads fhe goal while lemmaining cog-
nxnvdy m conrml of fhe simaoon. hen an two aspcs m m s typ of comluve
supm,sion: one mon,torJ Ule p m w s made towards the god, Whllechmng fhe
results of what has bee" done, vlulc the olhrr 3s f0C"Jcd on LFepnng the
cost of fhe cozn,tive rrrfomncr of me work down ,a a reasonable l wr l ifntizue.
to what arr called twhnical crma (breakdow"3) or organisatianal c m (manag*
ment decisions, nocidclimate). I W s of accident3 acfual1y have direct or indirect
EsUseJ aswrsaud wxUl human factors
o b s d consequences are much l owe than would be prethrled fmm the mor
frequency, (3) they me arelnhrrml ln cogelllve fuhrhrt~o~, pani i i l ~l y when h I 1% mu-
om, and they thereforecannot be cllminated Elmpt by *minsung human bongs,
(4). rxccssl"r--and cnonrou~sl m~l l hcat ron of the 1i"k Wwren m r s and
sdq hns motmuy resalvcdthequestio.ri orsafrty
S~sfenu that are dsi med on the bas#$ ofconm&cflmn and busit on reaL sci-
enofic roundauons do not allow openton lo engage with fhem mectively. They
result m a vlclou circle, simply shlffing mom ekwhere and makhg them more
dlfricvlt m conml and manage Pursving tha rluhnak of eovm leads to the
inmductnon of more ~ompvluisauon m ordm to (finally) ohm rmc rellabnllry
This lnvolvcs pmng human rehabnl~ry wrist technical rcllabrl~ry, whch rervln
in utlcr fallvn to achieve nvnueicn or 9ummativc cffccts bc,."ccn the two The
. -
resue are inevilsb1y worse than fhpecfed.
A more aoomoriate aoomach would be lo andwe this lxnk b n w n the mor
and ,he accideq'to pakj uough w m r , see &ugh Ulc operator., eye8 and
undersfand that the maoak-emma ofinth~ldual risk 3s based on Elemel" sooh$-
, .
""at4 mowledge ofcompmrmscn and overall c or n1 ofthe srtuatlon. The erm
i-11 nr ve caum the n ~ k of an accident, i t ra l wmg conml. lming awareness of
the mmpmmiscs between acccpfable ri sk3 and losing the abiltty fo manage the
slluatxon that can vayqusckly lead tov)v)v)dddI.
Thru 0s why thrJ chapter on enors and the management of lndlvidual " S b
inmrporstrs quite a sohd theorebed framframwfram& He, even more than m sub*
quent chnpta, fhere are same false('goad ideas" that nred a be comsted.
It w.5 ml) r c md ) 8n mr 1170. Ihsr Inc \rul) #>I humr" cmn oamlr m
<'bJCLL , r 'epl",? ..,cn,9: rlvdl f., p.,:hrl.g,,,r h", ,u Ih,,, ~ 8 t h mc c. xp
,om 21 Ulr Gr<#alai,. m w dm, hl l f of the zhncmrur), no uc,e run ,r lvrl
one of &c ml nl o c l f o mc c vo~cr 10 the hccw~lmcnW ~opor ch lo oh>slrl. or
Tbc birinl Conm'b"fio* fmm GcsloU Tbeory wos fhaf Faare
Makes it Possi6le lo Achieve Underslonding
nl c nnt \,go ,,,.lull vnr1 an cnnn,,noa ipc.,ncal1, on ljlllvrc urr Jollc betole
the xa# tlulmd mr p md lnlln 1910 ul I*, mJ l~:lr~.lrncJ v d r r (ir\kt t hr
on rr thr anam u I rm\ Thts lhrun 15. m.#.lcrcd lwbc Ihr raund.lmn of mad-
emcognitivepsycholagy
me oesra~oslr ( m a m l e r uld wnlhuma) wae p r i ~ a i ~ y ~nl a~st ed in
the heomsatlon of the asual envhmmnt that ww our bnim m & what I
sommes m c m r pqmd in-moOns ofCM"PII Ifem (Bmblgwu dqe).
Everyone has come aems thEse mmp1ex rhaper that grvc rire to illurhnr Of
inlcrprelatlon
Oor asnpl edsnhi md~r pr pt s6mdr scn~byt hr ca* l l t l * bm~hi
v-t of Ule MUellPr-Lyer l l l v~i on uses W m w r Whm add to -pare the
Chapter 3
The Keys to a Successful Systemic Approach
to Risk Management
Abstmt It is univaral1y admitted chat an approach to Eafeg applied to our
~ o m l r r lndusmcs (nuclear, chemical. consvvction and sLilled wades) and ser-
v l u ~ (medicme, banlung and finance, public and pnvsle I r ans w) , can no long=
be 1m11ed to findnng loed tshnicsl solutions, a absolutely must be systemic and
global How should fhese concepts be ticshed aut? TI"% chapter seeks ,a answrr
fhrr ques"an fmm vanour dltfcrrntprrspcctnu. uslng uamplcs taken fmm many
con8astingsrcas. br el i ngdwn Mas a d prejudice a d offcdng practical kcla.
On Safety, Sy*rns, Complexity ... and tbe Structure
of this Chapter
me management of nsk m an enterpose s nor only =bar avofhng or reducsng
aecldem (affrcting the system or tho* who woh m 8, ) It also mneemr every-
fhmg bat m y compmmrsr survival, whether the t h mr s emnomic, pollocal,
or damage ta the i mgc of the entcrposc panicularly fallow,ngan ="idant
I" mdcr to ""dostad a nynamatic approach, am mu9, accept thaf d l m a g +
ment mv a r all fhe rinks Ulsl could '%Ill" the enfemnne, whether they ue socU,
WheKd ortinancul.
m reductJon of nsrs 8" a sacio-&ssonsl nslysem 1% therefref ref I m p l a I".
eept whch esn be defined differently depending on which penpsuue 3% adopted
fmvm indust~al madol e, fewer accrdentx &mg thc hcmsmllauon, frwrr nsks of
hann m soua1 w"d,tions and OpcrabOns (no rrdundanclep. p m d n g carem) or
few- d l 3 to fhe busmcri mode1 (debC pmtita, economic ""Inprabihtiel)
Al l t h e dlmenslonr are 1sg,nmate. cvrn though they of en conn,ct with each
0th" the cmnomic rvrvlvalof Ihe b"",nr"~ nalpl often inm1vcs lncrraued expl*
sw a t h e r l l o f an accident. which is mansgcdmoreor less rabonally and cffcc-
ttvely afferamtbrck (F"lv~hlmais theexmmeexampie of this).
This r ut endorses the pperspectlves of lndusmal safely and safe m i c e pmi -
slon (reducnon ofsccldcnls, paumtsafny in mdlcmel by shounng how the hlera-
ture and erpenrnee on the gmvnd are now mb n g a posJlblF 8 b l l d a IYSfLm"
appmach whch Is effemvc "0he-t and mntains "onvol of the compmmises
t ha ace ma&~nrelation t o t t h u ~ ~ ~ a u of rhkwitlun thcenterpdne
Thc Ley lo thc success of the s~sfemic mraach can be nummariscd bv thne
~~~~~n~ by mnvollmng i e fovr of U.
are always present m bullding the safety smnvre of a complex sysrem, (2) dong
well wwh one h a drclded to do, and *oow*oowng and mnmlhng what one has
ds~ded not lo do. (31 future t h i k n r mfher Ulan mst Uu h r
The Swiss Cheese Model as the Archetype for Systemic
Model s ... andIts Current Lirnitatioos
Whol s p b n g about the systsrmc modrl of n t management, cveryone mmedi-
ately thinh ofthc &ces model setout by Reaum in the 1980s [I. 21
This model, based on thnc tcnlcl, ia simple and tell9 "9 (I1 thar one mno,
completely eliminate (psuenf) mrrby people who ne directly engaged in work,
(2) that deep defenccs are neded to avoxd the pmplgalon of Ulese e m as far au
an arci&ng and (3) mantis ncccssivy to be aware of orgmsriond and manage
mrnt m r s (Istent e m s ) whleh, wlthavt heng the l d l l u c urum ofaendenu,
in-%? the ""krab,llty of Ihe ,"d~",d"al~ and &fences dlxctly engaged in the
work by not givmg thrmau L L L L L bey " ~ d a hc ef f c c t ~~.
Thin model h always r hcundc me, and its author, whom I count Is bath n
teacher and a friend m y desrvcs hxs repvfauon and h a global p1acc m Ule pan-
tnronor thac uhonncconmout dt wauds<~~, i t r n~r t du, k dm.ncd, hou
c\ rr llrn Ullr nlo&l 8s ,lo, "a ru1firla.l lo <,cat a <)ilc"ll< appm.1 Ulal ran
.1,1rr :ffat,\r err,, n. .n,pl.xp#~f.\.,",,~l ..n\un I, nar f ."# "8") r hl.%tr
. if rrnecta 8 h ~ a r modr1 of the acc~de", which ix b a d 0" the pmpngati0n of
fa8l"rps in Ule nrmctwes and compncnt3 making up thc model. m thin scnae i t
Chapter 4
Human and Organisational Factors (HOFs):
Significantly Growing Challenges
Abatmct Al fhaul Ihis bmk wn-Wtep an Ihr d e ( v of mmol u rvstcms. n
. . .
~cemed to me that if would be useful to finish wnUl a pnwnlation of Ux majar
hlstmical dlsconnnuitia andthe swes.ive prinopies lhat h a v c g u w humnand
organlsauonal faclor (HOD p a s e s in enrerpn~es.
Based an my vlcw ofthe blstory of mdusloalrsauon, I "an rdenafy five rmpnanc
succersivc sfages in fhe managmmt of HOFs This d i r a f i m endche8 and will
innifably mdulsuefhe smfcgy forry3fcmafic d a y management.
The Productive Worlrer
The hrnf nfcp was faken nn Ule late I Ww l y 20Ul century, with in-sing pow~~wr
of mnfcnsive mdustnalxoation. It incornorated Ulre fundunentd concern fhsl were
intended to "&Wn ma r pmducuve workms".
The first of Ul rr~ was Taylonsm [I] wlueh s e h to lnercasc pmducuvnty by
&ng be= acmvnl of (eswnadly physled) human charactcnstlm and the
demands af Ihr wak that ha8 to be dddd Knowledxe of here two -8 make8 ~t
possibk to =hicvcfhc besf compmmhe in Cnna of prductivify in every woding
s,t"ation (mainly involving repetitive, phys1c.l work) to maximireefficiency u i a -
out reducing or unmessanly degradmg Ule workrs' abllllies m the long term.
The ndra of a srnmafic way of organrslng work Uul cao be bebedped, laugh# and
gs nwl l s d, is mndsputsbly Ule p n mq bistoded god ofHOFs!
nyl onsm was adapted but dld nor d i s a p p , pamcvlarly m manual a~ovluep
(a ia not so carily applicabk to rntellectud acuvities by its namn). Onc m five
' Fd"" ula mt wry ts. rmm T a Y I I nnd *td. f f f Uu Uu PPd " lmolKd p"*lnl
sYlndvdlaulm c0Ur uuanuon h e Focd mdun,on IhM .nd"rrn,mMrnn% WChh loloUuUu
by pyl l yUumi l hl Cs. l uy( ' L~dol baday' ) .
R, i \ m. ~m. N~ul gm~~, ~~, Sp" ~c r Bn~bmAppl , dSEl ~r s ~ndT~hndo~, 10
WI 1 0 I w l ~ ~ l - 6 W- k l . B ~ A u * u U l s ) 2 0 1 1
worken sflU work under modem f f f ffTayloriorim. TheToyoI Wwy2t t t ged in
Be llUc 1970s and 1s merely a modem re-wdsng of Ulr eoncepe put forward by
Taylor Wallty mnm1 was placed st Be c e n e o f b s gst rm and perronm1 wu e
belt= mtemfed, the m s of workba m mtaana s h i i was made umverd,
e& ~ &r i ~ h e d (fi r example rnakh&rn leas &notonoua on Be pmductlon
lincn, uith sucassive vehiclc~ mquiring diffprenl actions al Be name paeitian on
Ule line f or di f f ml fini~hedprcducfs), and 6 e line also allowed a lifle mme lime
for pemnal adlvsunenn (cawh-up tome erc.) wbsle ~ W I wohlng wobn collecuve
"me mvelopes Ultimately, however, the emtral ~h war still rst~ond~nuhn of
Be l me & lo do the work The sudden rise nn b e m c ~ h a of RSI (mus~ulo-
s kl cai pmbluns or Rcpcliave Strain Injudcs) m Be late 19905 [Z] s b m the
crfcnl to which somc of Ulc m3ndnlcv undcrlvinz Tavlmiam have alnadv bcen
h r g 0 ~ " . when there rhould'hm been retainedam an integral puf of our aca-
demic knowledge. No doubt Ule intense h u mx s t i ~ pol-cs of the 1980s went r
brig way mwardr ,he condemauun Of Taylor. which was no doubt nnnnive, but
it war Be huge vehnieal snd me6adological drfncvlty of transfemng Tny1onrm
to the wmplrx ~ntellesloal mr k o f our ma&m soc~rcies hat finally hued off this
appmach in uniuasiticn, and panicularly in University cour~es in crgonmics.
The sffimd step 6t h alas & during Ihb carly pcriod war definhly lsldng
convxt md moenmon mm r r o v n ~ and \pc:,ficall) 6 c pr):holopral contc~e of
~ a k Tnc r or l ot Mayo I3l.ti~Uesp~e 141 vlvrh wluch r u r m d out a w m
1927 BI Y I912 81 UT Haumont !n.t>o l a 1 Be bul det l o~b !or ULIS a p p wl .
\la).>'. tnn, mlenrnvun ul . 8" m .*\crn"l, p1mt . I Br wc\sm Elr",.
Compm) un8.h o\?~ntblr*l r s l l ~ q~opmcnt,, ~ 8 t h psulum#an Itnc? prrldmo-
nanll) mpl,),ng l r ml c w k n , I, dcmd",,ra,d mc ImprY 2" pdr:m, , ) of
lur,.rn# uxl l np ;mJ,,,mr I f :,ralrd 2" rxpcnmcnm1 uukmvp urlh bnlrr
io&l ~ l d bervr uorllnp mndlumr Rodlroon onrrc4ed hlaso rclumid lo thlr
Gl ory a few m0n.s lam, mto Be same workshop, and .sud qulle an around-
indy clever idea: m the exmmmt a1 work,bo~, he r n d Be hrmnmvemme
mmts whlch sllll have cunency loday.
T h e w SLe. to be mken d d e BlLh LhIY ocriocrid dad the flmmn Of se1ectlon.
- ..
At a very early stage, seleclhn by means of d e w or psycbologlcal tesu I&-
ing f a pamcular *us was found to be a 6l . d promising route, which fomrd a
oaeral mmplcmcnf fa Winingandorganirafim in mducing thc nafunl variability
of subiffits and allowine better adaohlon to Ule mrk. includine Belr resoonsen
t op& wndluon~. Th e ~ c ~ u u n mU1916 by 0. Scanley Hall, lohn ~.Ux;B.ard
and Ludwig Ranhold Ge~s l er of the lovmd of Appbed Rychology, winch war
me mNu,my w..a ,wed by awme, ohlo 0" UImyTq prd"e"0" rms, d ,* w"
e m be uwd m cmof 6- rn m s e a zem hD, . rmpw, m *"L
mdr l l yr .
Chapter 5
Conclusion: The Golden Rules in Relation
to Systemic Safety
Abst mt I n thecomplex interplay bdweenopposingforces and lheir infLractions,
derailed knowledge of .U *e chsllenges faana Ihe S Y Y D ~ (bofh ssfssfty and andand-
rnmlal chdhges) md *nwkdge of of- hslhsl'~, 'Y ' Y U~ m adad to chsn hsn s f c
eoune and make ressonsble eampmmlscs and &-off% k ~s not ~ d i y posslblr
to "lake gmd densons II~Y om" than based on the EYYIrriO" of ovenl1 me/
The Enterprise is e System Incorporadog Contradictory
Tensions nnd Requiring Trade-Ofls in the A m of Safety
Whcn mansgnng an enemre, ongomg tsnshns must be managed m order to rur-
", , e = - m " " c d l y m mLerpririri ","Sf g o d iBClf *",st ~WT"*S
. not eaninz the mutract
- Having no saleable pmducfm, compeliflo", innovUion
- Difficulty making sales, madequare dismbuuon, economc masi ons
. inability Lo produce i n tLm+ Lo IhoPxPOEBd qualily and st the expeded Cmf
- Q""I,IY of the produsllon cham ,mugs of thcentsrprlse
- Qualsy of maintenance
- G o d lndustnal rclatlonr
. failure to control the financia, supponavailablefor the burine.r plan i n n o
amas ofmnovafion, pmducllon and sales
- The burlnels model and the cho~cc of company form
- Cash, llquldltl booowlng, debt and lnvellment
- Paflnsmhhpr, alhancer and dspsndenasr
. inability b mntrol the nf f t t yaf pmduction or of tho pmducf heng ml d
- Human dxra9,ers. the Image of (he enterprise
- Elmsure to penrlucs ~mposet by egulrtors
The management of lhssr rlrkl 13 d~slrlbvfed bstwvn d~ffsrrnt dlvls>ons som-
mrrcaal, mrcarch. pmduct~on and rafcty
E S C ~ (hero dlvlqlonl me. to qotlmlro as own mad onen to the dem-
me", o, the other dlvnlon\ (chrllenge of re5"urce .hmng) and ,usufie. a. dew
SlO"S On Ihe bT917 Of .lSkS that conslltule a threat Lo shontern or medlvm~tem
S"r"l"r1
I n thhs process of ~nlemal mtcrast~on, we know that Imds-off3 whll ~pontans-
ourly t&r place ascodlnp to thres constants
. Ulo t h o thatwill elapse hdom the benefit or risk a p ~ a r s
- PrlonIy IS glven lo lmrnedcae benehu over hypolhelcd bog tern benefit3
- Long~lFrm nsks are accepted I" return forconwol over shorlfern rtsks
. frrqueney renus re"erily
- Control over hypothsl~cal rsvsr>ty 13 racnficed m rsturn for control over fre-
quent. pmvon problem7
. ss1itncr and unergcncr versus rstiona1rty
- lnfcmal trade 0% are pnonused I" mranse lo thrertcnlng crlcrnrl p d g ~
ments (pmn. mgul~tor&, murkt, finnnie&l
tho t mo t hat r i l l elapse bdam the benefit or risk a p p a n
- Pnor,ty i. gwen to immedlse benefit7 over hypotheteal long-tern benefit5
- Long~erm nsk~ are accepted fn return forconvol over l hor l er n rcrke
On 1,s own, rhls pmcesr ofmrklng fradcoffs does not lend topmmos safe solv~
Lion, thsx would reduce potentla1 nskb thilt am not ~mmed~~te, xlth quhte high
cortr (somst~rner due lo thsu own costs, panlcularly ID psnonnsl term. toms ovcr-
hmdr for teaming. and would onon 51ow down pmdun~on duo to more pocedmi
an* adrnm,.uauon,. Ihe be?, advocate5 for Ihe.e .ol"tlon\ m no doubt acc,denr\
that have already acuned. . and (he external regulaom (cf (hese enst1 dernandlng