Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
questioned as to why bad outcomes occurred, they attribute the The model distinguishes between underlying, systemic
causes to external factors rather than internal ones. problems, called latent conditions, such as failures in design,
procedures, organisational structures, and the active errors of
Figure 1. The Swiss Cheese model, including rteferences to its the individuals at the ‘sharp end’. The model has been
original version, as developed for Shell International Petroleum
portrayed as a series of slices of defence, or barriers with
Mij, as the ‘Pathogen Model’.
holes, hence the title the Swiss
Cheese model (See Fig. 1). Holes
Some holes due may appear, become larger or
to active failures smaller, depending on local
conditions. What the model
Hazards explains well is not how we have
accidents, but why we can have
so few even when so much seems
to be wrong and why the
combinations are so incredible. It
is necessary to have all the holes
to line up for the hazards to turn
Other holes due to into an actual accident.
Losses latent conditions The insight the Swiss Cheese
model brings to such incidents,
(resident ‘pathogens’) the reason why so many major
organisations have subscribed to
Successive layers of defences, barriers, & safeguards it, is the way it directs attention
to where the real problems are,
such as the initial design, rather
This interpretation may be called the individual as than continuing to accept that those forced to use bad designs
opposed to the systemic model of accident causation (Reason, may occasionally make minor slips and pay major
1997). The systemic model is based upon the insight that a consequences.
closer scrutiny of why the people acted, or failed to act, in the
way they did inevitably leads to the uncovering of more Local conditions
underlying causes that can be seen to have led to the This is not to say that individuals have no role to play in
behaviour. For instance, if people are not trained properly, causing accidents, but that those and many other individuals
inaccurate procedures or poor ergonomic design are accepted, together make up the system that, by failing, leads to an
or communication fails, then people at the end of the accident accident and, often, the loss of lives. Individuals are to be
chain become the recipients of those organisational failures. found at the end of the accident chain, but an understanding of
When such failures lie dormant in the organisation, we speak the reasons why accidents became more likely usually adds
of latent failures or conditions. A tool such as Tripod Delta perspective. Nevertheless there are a great many factors that
can serve to identify such failures proactively, accident lie under the control of the individual and only marginally
analysis techniques such as Tripod Beta allows their under the control of the organisation. If a driver wishes to
identification from the incident data. exceed the speed limit, there is little a manager can do to stop
him; if a worker sees a hazardous situation and fails to tell his
Figure 2. A variant of the original model. Here the different indi- supervisor, no amount of managerial commitment will remedy
vidual and systemic pathways to bad outcomes are more clearly the situation until an accident provides the information.
laid out (Reason, 1997).
An HSE Management
Defences System, if effective, can help
manage a considerable proportion of
HOW? the organisational issues that the
Losses systemic model describes. Such a
Hazards system, however, is too coarse
grained to trap and eradicate
individual actions. Attitudes do not
Latent Causes lend themselves easily to
condition Unsafe acts management and it appears that at
pathways Investigation this stage in the evolution of safety
in the oil and gas industry, attitudes
Local workplace factors lag behind the organised
WHY? management of the hazards
(Hudson, 2003). What is needed to
Organizational factors ensure that the individuals play their
part in ensuring their own and their
SPE 86595 3
colleagues’ safety is an advanced HSE culture. This is the goal environment impinges upon the individual within an
of the Hearts and Minds Program, to fill in the lacunae. organization. They may reflect the organisational HSE culture
and they may reflect the extent to which the organisation
HSE Culture provides the necessary systemic requirements for the exercise
An HSE Management System, no matter how well of good practice. Finally they are influenced by the immediate
implemented, can only provide a minimal guarantee of situations that people find themselves in. Figure 4 shows how
performance. It is necessary to have a culture within which the behaviour can be influenced by a wide variety of factors,
values of Health, Safety and the Environment are held high in including management and colleagues, but also a wide variety
order for that system to flourish, otherwise the implementation of personal influences as well as the immediate situation.
will remain at the level of the mechanical application. An We can distinguish three major components out of this
advanced HSE culture provides the environment in which an discussion:
HSE-MS can achieve its full effect. This will involve all in • Values
the organization delivering what they are capable of. • Beliefs
Managers and supervisors must create as safe a workplace as • Actions
they can, must train and equip the workforce to ensure that the
work is performed properly. But, this is a two-way street, and At the topmost level we have values, such as the HSE values
workers must also complete their part of the deal. They must we espouse, but there are other values as well, such as being
act safely, inform about hazardous conditions and apply profitable. These values are acquired primarily from society,
themselves. If they find this difficult, they may need to be family and friends and only marginally from the much later
helped. exposure to the particular values of an organisation. If our
values are in some way poor, it is unlikely that we will
normally behave in ways we call good practice. An
GENERATIVE individual whose values are not well aligned with those of
HSEis how we do business round
here
an organisation will, however, inevitably be discovered and
is rarely likely to last long. While values are often talked
about, they rarely form a real source of problems.
PROACTIVE
we work on the problems that we still The next level is that of belief, and it is here that many
find
Increasingly of the problems arise. Our attitudes are formed by the
informed combination of our values and beliefs and, if they are in
CALCULATIVE conflict, then we may have a problem. We may have good
we have systems in place to manage
all hazards values about HSE and about the necessity to make profits
and to produce, but these values are essentially unordered,
REACTIVE each one stands on its own and does not interfere with the
Safety is important, we do a lot every
time we have an accident others – People’s ability to hold conflicting values is
Increasing Trust remarkable but ever-present. What resolves and orders
Accepting Accountability these values is our beliefs, and it is here that most of the
PATHOLOGICAL
who cares as long as we
’re not caught attitudinal problems arise. If we hold safety and production
or profit both high, but simultaneously believe that safety
costs money, eroding profits, the safety may be given a
Figure 3. The HSE Culture maturity ladder. lower priority. If we believe that things won’t go wrong as
long as we are in control, a very common belief, then safety
The Hearts and Minds program is aimed at identifying and values can be put on the back burner while we achieve some
developing an advanced HSE culture. As part of the program a other goal that is driven by a different value. Therefore
number of tools have been developed to help individuals and holding exemplary values is not a guarantee that outcomes
teams to operate more effectively. These tools are intended to will always be perfect; beliefs can easily intervene to change
identify where systemic problems may still lie; for instance, priorities.
when rules are being broken, which procedures is it and are Finally circumstances may get in the way even if values
the problems due to the procedures or the people? and beliefs are well aligned. Our ability to act may be severely
The HSE maturity ladder (Fig. 3) has a mid-point, the curtailed by systemic and organisational problems. If
Calculative, at which systemic thinking dominates and the role equipment is impossible to work with, procedures are
of the individual is minimal. As the culture improves towards inaccurate, the time made available to perform the work
the Generative there is more latitude for individual initiative necessitates short cuts, then good practice may still be in
and, therefore, more need to support the individual to ensure jeopardy, despite our best attitudes.
that they can do their best.
Conclusion
Good practice We can now see how the systemic and the individual
All the models describe how good outcomes, the expression of approaches line up, and how programs such as Tripod and
good practice, can be generated and countered by a variety of Hearts and Minds are consistent with each other. Tripod, with
factors. These may be broadly cultural, as the total its concentration upon systemic issues, concentrates upon the
4 SPE 86595
References
Management
Colleagues
Slips &
Regulator
Lapses
Public
Outcome
NGO’s Intention Behaviour
Gap / plan / action
Family
Power
Friends
Neighbours
Religious leaders