the changing nature of risk

8/12/2019 The Changing Nature of Risk

1/26

Erik Hollnagel, 2010

The Changing nature of Risk

Professor & Industrial Safety ChairMINES Parise!h, C"CSo#hia $nti#olis, %ran!e

Professor IINNrondhei', Nor(ay

Erik Hollnagel

E)'ail* erik+hollnagel!r!+ens'#+fr


2/26


Ho( !an (e kno( that (e are safe-

$!!ident analysis

E.#laining andunderstanding (hat hasha##ened /a!tual !auses

"isk assess'ent

Predi!ting (hat'ayha##en/#ossile !onseuen!es

In order to a!hie3e freedo' fro' risks, 'odels, !on!e#ts and 'ethods 'ust e!o'#atile, and e ale to des!rie 4reality5 in an adeuatefashion+

Eli'ination orredu!tion of

attriuted !auses

Eli'ination or#re3ention of

#otential risks

Ho( !an (ekno( (hat did

go (rong-

Ho( !an (e#redi!t (hat

'aygo (rong-


3/26


hree ages of industrial safety

2000167016001870

1691Industriala!!ident

#re3ention

1869

"ailroad Safety$##lian!e $!t1:;6Industrial"e3olution

16;1%ault treeanalysis

$ge of te!hnology

Hale & Ho3den /1668

I"e3olution

Things canThings can

go ronggo rong

!ecause!ecause

technology failstechnology fails


4/26


?e!o'#osale, si'#lelinear 'odels

"isks as #ro#agation of failures

If a!!identsha##en like

this +++

+++ then risks!an e found

like this +++

he !ul'ination of a!hain of e3ents+

%ind the !o'#onent that failed y

reasoning a!k(ards fro' the final!onseuen!e+

Proaility of!o'#onent failures

%ind the #roaility that so'ething

reaksD, either alone or y si'#le,logi!al and fi.ed !o'inations+

Hu'an failure is treated at the !o'#onentD le3el+

inary ran!hing


5/26



2000167016001870


#re3ention

1869

"ailroad Safety$##lian!e $!t

1:;6Industrial"e3olution


$ge of te!hnology

I"e3olution

16:6hree Mile

Island

$ge of hu'an fa!tors

Things can go rong !ecauseThings can go rong !ecause

the human factor failsthe human factor fails


6/26


"isks as !o'inations of failures

?e!o'#osale,!o'#le. linear 'odels

Co'inations of a!ti3efailures and latent

!onditions+

Gook for ho( degraded arriers ordefen!es !o'ined (ith an a!ti3e/hu'an failure+

Gikelihood of (eakeneddefenses, !o'inations

Single failures !o'ined (ith latent!onditions, leading to degradation of

arriers and defen!es+

If a!!identsha##en like

this +++

+++ then risks!an e found

like this +++

Co'inations offailures and !onditions


7/26


I"e3olution


2000167016001870


#re3ention

1869

"ailroad Safety$##lian!e $!t

1:;6Industrial"e3olution


$ge of te!hnology

16:6hree Mile

Island

$ge of hu'an fa!tors

2009Colu'ia

$ge of safety 'anage'entThings can goThings can go

rong !ecauserong !ecause

Organisations failOrganisations fail

2006

$%


8/26


9/26


Ho( do (e kno( that so'ething is safe-

?esign #rin!i#les*$r!hite!ture and

!o'#onents*Models*

$nalysis 'ethods*

Mode of o#eration*Stru!tural staility*%un!tional staility*

Clear and e.#li!itAno(n

%or'al, e.#li!itStandardised,3alidatedBell)definedHigh /#er'anentHigh

ECHN>G>ECHN>G>

nkno(n, inferredMostly unkno(n

Mainly analogiesS#e!ulati3e,un#ro3enFaguely definedFarialesually reliale

HM$NSHM$NS

Progra''ati!Partly unkno(n

Se'i)for'al,$d ho!, un#ro3en

Goosely definedSe'i)staleood /lagging+

>"$NIS$I>NS>"$NIS$I>NS


10/26


Normal outcomes(things that go

right)

Serendipity

Fery highPredi!taility

"ange of e3ent out!o'es

>ut!o'e

Fery lo(

Pos

iti3

e

Negat

i3e

Neu

tra

l

Disasters

Near misses

Accidents

Incidents

Good luck

Mishaps


11/26



right)

Serendipity

Fery high Predi!taility

%reuen!y of e3ent out!o'es

>ut!o'e

Fery lo(

Pos

iti3

e

Nega

ti

3e

Neu

tra

l

Disasters

Accidents

Good luck

Mishaps

IncidentsNear misses

*+,

*+-*+.


12/26



right)

Serendipity

Fery high Predi!taility

eing safe 3ersus eing unsafe

>ut!o'e

Fery lo(

Pos

iti3

e

Nega

ti

3e

Neu

tra

l

Disasters

Accidents

Good luck

Mishaps

IncidentsNear misses

*+,

*+-*+.

afeafeFunctioningunctioning(invisible)invisible)

UnsafensafeFunctioningunctioning

(visible)visible)


13/26


Bhy only look at (hat goes (rong-

%o!us is on (hat goes(rong+ Gook for failuresand 'alfun!tions+ ry toeli'inate !auses andi'#ro3e arriers+

%o!us is on (hat goesright+ se that to

understand nor'al#erfor'an!e, to do

etter and to e safer+

Safety K "edu!ednu'er of ad3ersee3ents+

10)< *K 1 failure in10+000 e3ents

1 ) 10)< *K 6+666 non)failures in 10+000 e3ents

Safety and !oreusiness hel# ea!h other+

Gearning uses 'ost ofthe data a3ailale

Safety and !oreusiness !o'#ete for

resour!es+ Gearning onlyuses a fra!tion of thedata a3ailale

Safety K $ility tosu!!eed under 3arying!onditions+


14/26


%ailures or su!!esses-

Bho or (hat are res#onsilefor the re'aining 10)20L-

Bhen so'ething goes right,e+g+, 6+666 e3ents out of10+000, are hu'ans alsores#onsile in 80)60L of

the !ases-

Bhen so'ething goes (rong,e+g+, 1 e3ent out of 10+000

/10E)


15/26


$ll out!o'es /#ositi3eand negati3e are due to#erfor'an!e 3ariaility++

%ro' the negati3e to the #ositi3e

Negati3e out!o'es are!aused y failures and'alfun!tions+

Safety K "edu!ednu'er of ad3erse

e3ents+

Eli'inatefailuresand 'alfun!tions as

far as #ossile+

Safety K $ility tores#ond (hen

so'ething fails+

I'#ro3e aility tores#ondto ad3erse

e3ents+

Safety K $ility tosu!!eed under

3arying !onditions+

I'#ro3e resilien!e+


16/26


Prin!i#le of a##ro.i'ate adust'ents

Many so!io)te!hni!al syste's are intra!tale+ he!onditions of (ork therefore ne3er !o'#letely 'at!h(hat has een s#e!ified or #res!ried+

Syste's are so !o'#le. that (ork situations al(ays areunders#e!ified hen!e #artly un#redi!tale

%e( if any tasks !an su!!essfully e !arried outunless #ro!edures and tools are ada#ted to the situation+Perfor'an!e 3ariaility is oth nor'al and ne!essary+

?

Indi3iduals, grou#s, and organisations nor'allyadusttheir #erfor'an!e to 'eet e.isting !onditions/resour!es, de'ands, !onfli!ts, interru#tions+

e!ause resour!es /ti'e, 'an#o(er, infor'ation,et!+ al(ays are finite, su!h adust'ents (illin3arialy e a##ro.i'aterather than e.a!t+

Perfor'an!e3ariaility

Su!!ess

%ailure


17/26


If thoroughness do'inates,there 'ay e too little ti'e

to !arry out the a!tions+

If effi!ien!y do'inates,a!tions 'ay e adly

#re#ared or (rong

Negle!t #ending a!tionsMiss ne( e3ents

Miss #re)!onditionsGook for e.#e!ted results

horoughness* i'e to think"e!ognising situation+Choosing and #lanning+

Effi!ien!y* i'e to doI'#le'enting #lans+E.e!uting a!tions+

Effi!ien!y)horoughness rade)>ff

i'e & resour!es needed

i'e & resour!es a3ailale


18/26


No ti'e /or resour!es to do it no(

So'e E> heuristi!s

Gooks fineNot really i'#ortant

Nor'ally >A, no need to !he!k

Bill e !he!ked y so'eone else

Can5t re'e'er ho( to do itBe al(ays do it this (ay

Idiosyn!rati!/(ork related

Has een !he!ked y so'eone else

Cogniti3e/indi3idual

Oudge'ent underun!ertainty

Cogniti3e #ri'iti3es/SM %

"ea!tions toinfor'ation in#ut

o3erloadandunderload

Cogniti3e style

Colle!ti3e/organisation

Negati3e re#orting

"edu!eredundan!y

Meet #rodu!tionDtargets

"edu!eunne!essary !ost

?oule)ind

Be 'ust get this doneMust e ready in ti'e

Must not use too 'u!h of Q

I53e done it 'illions of ti'e efore

his (ay is 'u!h ui!ker

It looks like Q /so it #roaly is Q

"ee!t !onfli!ting

infor'ation

Confir'ation ias


19/26


Intended ta.i@takeoff #ath

$!tual ta.i@takeoff #ath


20/26


NS analysis and !on!lusions

+++ the #roale !ause of this a!!ident (as the flight !re('e'ers5 failureto usea3ailale !ues and aids to identify the air#lane5s lo!ationon the air#ort surfa!eduring ta.i and their failure to !ross)!he!kand 3erify that the air#lane (as onthe !orre!t run(ay efore takeoff+ Contriuting to the a!!ident (ere the flight!re(5s non#ertinent !on3ersation during ta.i, (hi!h resulted in a loss of#ositional a(areness, and the %ederal $3iation $d'inistration5s /%$$ failure toreuire that all run(ay !rossings e authoriJed only y s#e!ifi! air traffi! !ontrol/$C !learan!es+

/T012 3,++452 Atte#!ted takeoff fro# wrong runwa(6 Co#air Flight 7*8*6 1o#bardier CL%.++%,1*86/-9*CA6 Le'ington6 :entuck(6 August ,46 ,++. 3Aircraft Accident Re!ort /T01;AAR%+4;+752

/ational Trans!ortation 0afet( 1oard2

%or'al a!!ident in3estigations usually start (ith an assu'#tion that theo#erator 'ust ha3e failed, and if this attriution !an e 'ade, that is theend of serious inuiry+

(Perrow (1984). Normal Accidents)


21/26


%"$M analysis ste#s

Identify arriers for 3ariaility /da'#ing fa!tors and s#e!ify reuired#erfor'an!e 'onitoring+

?efine fun!tional resonan!e ased on #ossile de#enden!ies/!ou#lings a'ong fun!tions+

Chara!terise the /!onte.t de#endent #otential 3ariaility using a!he!klist+ Consider oth nor'al and (orst !ase 3ariaility+

Identify essential syste' fun!tionsR !hara!terise ea!h fun!tion y si.asi! #ara'eters+

?efine the #ur#ose of 'odelling and des!rie the situation einganalysed+ $n e3ent that has o!!urred /in!ident@a!!ident or a#ossile future s!enario /risk+

0


22/26


uilding the larger #i!ture

Perfor'ta.i

!he!klist

RP

I

T

O

C

AGEQ $C!learan!e

RP

I

T

O

C

AGEQ ta.iriefing

RP

I

T

O

C

Perfor'

eforetake)off!he!klist

RP

I

T

O

C

a.i torun(ay

RP

I

T

O

C

a.i ontorun(ay

RP

I

T

O

C


23/26


+++ the #roale!ause of this

a!!ident (as the

flight !re('e'ers5failure to usea3ailale !ues and

aids +++

NS !on!lusion*


24/26


25/26


Philoso#hi!al #role's of #redi!taility

Gife !an only e understood a!k(ards, ut it 'uste li3ed for(ards+

Sren Aierkegaard /1819)1877

he #resent is unlike the #ast, and thefuture is unlike the #resentNorert Biener /167;

Gi3et forstTs aglUns, 'en 'T le3es forlUns


26/26


$ny uestions-

the changing nature of risk

Documents