“Overpursuit” of Goals

We return to a favorite subject, the impact of goals and incentives on safety culture and performance. Interestingly this subject comes up in an essay by Oliver Burkeman, “The Power of Negative Thinking,”* which may seem unusual as most people think of goals and achievement of goals as the product of a positive approach. Traditional business thinking is to set hard, quantitative goals, the bigger the better. But futures are inherently uncertain and goals generally are not so. The counter intuitive argument suggests the most effective way to address future performance is to focus on worst case outcomes. Burkeman observes that “...rigid goals may encourage employees to cut ethical corners” and “Focusing on one goal at the expense of all other factors also can distort a corporate mission or an individual life…” and result in “...the ‘overpursuit’ of goals…” Case in point, yellow jerseys.

This raises some interesting points for nuclear safety. First we would remind our readers of Snowden’s Cynefin decision context framework, specifically his “complex” space which is indicative of where nuclear safety decisions reside. In this environment there are many interacting causes and effects, making it difficult or impossible to pursue specific goals along defined paths. Clearly an uncertain landscape. As Simon French argues: “Decision support will be more focused on exploring judgement and issues, and on developing broad strategies that are flexible enough to accommodate changes as the situation evolves.”** This would suggest the pursuit of specific, aspirational goals may be misguided or counterproductive.

Second, safety performance goals are hard to identify anyway. Is it the absence of bad outcomes? Or the maintenance of, say, a “strong” safety culture - whatever that is. One indication of the elusiveness of safety goals is their absence as targets in incentive programs. So there is probably little likelihood of overemphasizing safety performance as a goal. But is the same true for operational type goals such as capacity factor, refuel outage durations, and production costs? Can an overly strong focus on such short term goals, often associated with stretching performance, lead to overpursuit? What if large financial incentives are attached to the achievement of the goals?

The answer is not: “Safety is our highest priority”. More likely it is an approach that considers the complexity and uncertainty of nuclear operating space and the potential for hard goals to cut both ways. It might value how a management team prosecutes its responsibilities more than the outcome itself.

* O. Burkeman, “The Power of Negative Thinking,” Wall Street Journal online (Dec. 7, 2012).

** S. French, “Cynefin: repeatability, science and values,” Newsletter of the European Working Group “Multiple Criteria Decision Aiding,” series 3, no. 17 (Spring 2008) p. 2. We posted on Cynefin and French's paper here.

Drift Into Failure by Sydney Dekker

Sydney Dekker's Drift Into Failure* is a noteworthy effort to provide new insights into how accidents and other bad outcomes occur in large organizations. He begins by describing two competing world views, the essentially mechanical view of the world spawned by Newton and Descartes (among others), and a view based on complexity in socio-technical organizations and a systems approach. He shows how each world view biases the search for the “truth” behind how accidents and incidents occur.

Newtonian-Cartesian (N-C) Vision

Issac Newton and Rene Descartes were leading thinkers during the dawn of the Age of Reason. Newton used the language of mathematics to describe the world while Descartes relied on the inner process of reason. Both believed there was a single reality that could be investigated, understood and explained through careful analysis and thought—complete knowledge was possible if investigators looked long and hard enough. The assumptions and rules that started with them, and were extended by others over time, have been passed on and most of us accept them, uncritically, as common sense, the most effective way to look at the world.

The N-C world is ruled by invariant cause-and-effect; it is, in fact, a machine. If something bad happens, then there was a unique cause or set of causes. Investigators search for these broken components, which could be physical or human. It is assumed that a clear line exists between the broken part(s) and the overall behavior of the system. The explicit assumption of determinism leads to an implicit assumption of time reversibility—because system performance can be predicted from time A if we know the starting conditions and the functional relationships of all components, then we can start from a later time B (the bad outcome) and work back to the true causes. (p. 84) Root cause analysis and criminal investigations are steeped in this world view.

In this view, decision makers are expected to be rational people who “make decisions by systematically and consciously weighing all possible outcomes along all relevant criteria.” (p. 3) Bad outcomes are caused by incompetent or worse, corrupt decision makers. Fixes include more communications, training, procedures, supervision, exhortations to try harder and criminal charges.

Dekker credits Newton et al for giving man the wherewithal to probe Nature's secrets and build amazing machines. However, Newtonian-Cartesian vision is not the only way to view the world, especially the world of complex, socio-technical systems. For that a new model, with different concepts and operating principles, is required.

The Complex System

Characteristics

The sheer number of parts does not make a system complex, only complicated. A truly complex system is open (it interacts with its environment), has components that act locally and don't know the full effects of their actions, is constantly making decisions to maintain performance and adapt to changing circumstances, and has non-linear interactions (small events can cause large results) because of multipliers and feedback loops. Complexity is a result of the ever-changing relationships between components. (pp.138-144)

Adding to the myriad information confronting a manager or observer, system performance is often optimized at the edge of chaos, where competitors are perpetually vying for relative advantage at an affordable cost.** The system is constantly balancing its efforts between exploration (which will definitely incur costs but may lead to new advantages) and exploitation (which reaps benefits of current advantages but will likely dissipate over time). (pp. 164-165)

The most important feature of a complex system is that it adapts to its environment over time in order to survive. And its environment is characterized by resource scarcity and competition. There is continuous pressure to maintain production and increase efficiency (and their visible artifacts: output, costs, profits, market share, etc) and less visible outputs, e.g., safety, will receive less attention. After all, “Though safety is a (stated) priority, operational systems do not exist to be safe. They exist to provide a service or product . . . .” (p. 99) And the cumulative effect of multiple adaptive decisions can be an erosion of safety margins and a changed response of the entire system. Such responses may be beneficial or harmful—a drift into failure.

Drift by a complex system exhibits several characteristics. First, as mentioned above, it is driven by environmental factors. Second, drift occurs in small steps so changes can be hardly noticed, and even applauded if they result in local performance improvement; “. . . successful outcomes keep giving the impression that risk is under control” (p. 106) as a series of small decisions whittle away at safety margins. Third, these complex systems contain unruly technology (think deepwater drilling) where uncertainties exist about how the technology may be ultimately deployed and how it may fail. Fourth, there is significant interaction with a key environmental player, the regulator, and regulatory capture can occur, resulting in toothless oversight.

“Drifting into failure is not so much about breakdowns or malfunctioning of components, as it is about an organization not adapting effectively to cope with the complexity of its own structure and environment.” (p. 121) Drift and occasionally accidents occur because of ordinary system functioning, normal people going about their regular activities making ordinary decisions “against a background of uncertain technology and imperfect information.” Accidents, like safety, can be viewed as an emergent system property, i.e., they are the result of system relationships but cannot be predicted by examining any particular system component.

Managers' roles

Managers should not try to transform complex organizations into merely complicated ones, even if it's possible. Complexity is necessary for long-term survival as it maximizes organizational adaptability. The question is how to manage in a complex system. One key is increasing the diversity of personnel in the organization. More diversity means less group think and more creativity and greater capacity for adaptation. In practice, this means validation of minority opinions and encouragement of dissent, reflecting on the small decisions as they are made, stopping to ponder why some technical feature or process is not working exactly as expected and creating slack to reduce the chances of small events snowballing into large failures. With proper guidance, organizations can drift their way to success.

Accountability

Amoral and criminal behavior certainly exist in large organizations but bad outcomes can also result from normal system functioning. That's why the search for culprits (bad actors or broken parts) may not always be appropriate or adequate. This is a point Dekker has explored before, in Just Culture (briefly reviewed here) where he suggests using accountability as a means to understand the system-based contributors to failure and resolve those contributors in a manner that will avoid recurrence.

Application to Nuclear Safety Culture

A commercial nuclear power plant or fleet is probably not a complete complex system. It interacts with environmental factors but in limited ways; it's certainly not directly exposed to the Wild West competition of say, the cell phone industry. Group think and normalization of deviance*** is a constant threat. The technology is reasonably well-understood but changes, e.g., uprates based on more software-intensive instrumentation and control, may be invisibly sanding away safety margin. Both the industry and the regulator would deny regulatory capture has occurred but an outside observer may think the relationship is a little too cozy. Overall, the fit is sufficiently good that students of safety culture should pay close attention to Dekker's observations.

In contrast, the Hanford Waste Treatment Plant (Vit Plant) is almost certainly a complex system and this book should be required reading for all managers in that program.

Conclusion

Drift Into Failure is not a quick read. Dekker spends a lot of time developing his theory, then circling back to further explain it or emphasize individual pieces. He reviews incidents (airplane crashes, a medical error resulting in patient death, software problems, public water supply contamination) and descriptions of organization evolution (NASA, international drug smuggling, “conflict minerals” in Africa, drilling for oil, terrorist tactics, Enron) to illustrate how his approach results in broader and arguably more meaningful insights than the reports of official investigations. Standing on the shoulders of others, especially Diane Vaughan, Dekker gives us a rich model for what might be called the “banality of normalization of deviance.” 

* S. Dekker, Drift Into Failure: From Hunting Broken Components to Understanding Complex Systems (Burlington VT: Ashgate 2011).

** See our Sept. 4, 2012 post onCynefin for another description of how the decisions an organization faces can suddenly slip from the Simple space to the Chaotic space.

*** We have posted many times about normalization of deviance, the corrosive organizational process by which the yesterday's “unacceptable” becomes today's “good enough.”

The Mouse Runs Up the Clock (at Massey Energy)

We are all familiar with the old nursery rhyme: “Hickory, dickory, dock, the mouse ran up the clock.”  This may be an apt description for the rising waters of federal criminal prosecution in the Massey coal mine explosion investigation.  As reported in the Nov. 28, 2012 Wall Street Journal,* the former president of one of the Massey operating units unrelated to the Upper Big Branch mine has agreed to plead guilty to felony conspiracy charges including directing employees to violate safety laws.  The former president is cooperating with prosecutors (in other words, look out above) and as noted in the Journal article, “The expanded probe ‘strongly suggests’ prosecutors are ‘looking at top management’…"   Earlier this year, a former superintendent at the Upper Big Branch pleaded guilty to conspiracy charges. 

Federal prosecutors allege that safety rules were routinely violated to maximize profits.  As stated in the Criminal Information against the former president, “Mine safety and health laws were routinely violated at the White Buck Mines and at other coal mines owned by Massey, in part because of a belief that consistently following those laws would decrease coal production.” (Criminal Information, p. 4)**  The Information goes on to state:  “Furthermore, the issuance of citations and orders by MSHA [Mine Safety and Health Administration], particularly certain kinds of serious citations and orders, moved the affected mine closer to being classified as a mine with a pattern or potential pattern of violations.  That classification would have resulted in increased scrutiny of the affected mine by MSHA…” (Crim. Info. p.5)  Thus it is alleged that not only production priorities - the core objective of many businesses - but even the potential for increased scrutiny by a regulatory authority was sufficient to form the basis for a conspiracy. 

Every day managers and executives in high risk businesses make decisions to sustain and/or improve production and to minimize the exposure of the operation to higher levels of regulatory scrutiny.  The vast majority of those decisions are legitimate and don’t compromise safety or inhibit regulatory functions.  Extreme examples that do violate safety and legal requirements, such as the Massey case, are easy to spot.  But one might begin to wonder what exactly is the boundary separating legitimate pursuit of these objectives and decisions or actions that might (later) be interpreted as having the intent to compromise safety or regulation?  How important is perception to drawing the boundary - where the context can frame a decision or action in markedly different colors?  Suppose in the Massey situation, the former president instead of providing advance warnings and (apparently) explicitly tolerating safety violations, had limited the funding of safety activities, or just squeezed total budgets?  Same or different? 

*  K. Maher, "Mine-Safety Probe Expands," Wall Street Journal online (Nov. 28, 2012) may only be available only to subscribers.

**  U.S. District Court Southern District of West Virgina, “Criminal Information for Conspiracy to Defraud the United States: United States of America v. David C. Hughart” (Nov. 28, 2012).

BP/Deepwater Horizon: Upping the Stakes

Anyone who thought safety culture and safety decision making was an institutional artifact, or mostly a matter of regulatory enforcement, might want to take a close look at what is happening on the BP/Deepwater Horizon front these days. Three BP employees have been criminally indicted - and two of those indictments bear directly on safety in operational decisions. The indictments of the well-site leaders, the most senior BP personnel on the platform, accuses them of causing the deaths of 11 crewmen aboard the Deepwater Horizon rig in April 2010 through gross negligence, primarily by misinterpreting a crucial pressure test that should have alerted them that the well was in trouble.*

The crux of the matter relates to the interpretation of a pressure test to determine whether the well had been properly sealed prior to being temporarily abandoned. Apparently BP’s own investigation found that the men had misinterpreted the test results.

The indictment states, “The Well Site Leaders were responsible for...ensuring that well drilling operations were performed safely in light of the intrinsic danger and complexity of deepwater drilling.” (Indictment p.3)

The following specific actions are cited as constituting gross negligence: “...failed to phone engineers onshore to advise them ...that the well was not secure; failed to adequately account for the abnormal readings during the testing; accepted a nonsensical explanation for the abnormal readings, again without calling engineers onshore to consult…” (Indictment p.7)

The willingness of federal prosecutors to advance these charges should (and perhaps are intended to) send a chill down every manager’s spine in high risk industries. While gross negligence is a relatively high standard, and may or may not be provable in the BP case, the actions cited in the indictment may not sound all that extraordinary - failure to consult with onshore engineers, failure to account for “abnormal” readings, accepting a “nonsensical” explanation. Whether this amounts to “reckless” or willful disregard for a known risk is a matter for the legal system. As an article in the Wall Street Journal notes, “There were no federal rules about how to conduct such a test at the time. That has since changed; federal regulators finalized new drilling rules last week that spell out test procedures.”**

The indictment asserts that the men violated the “standard of care” applicable to the deepwater oil exploration industry. One might ponder what federal prosecutors think the “standard of care” is for the nuclear power generation industry.
 
Clearly the well site leaders made a serious misjudgment - one that turned out to have catastrophic consequences. But then consider the statement by the Assistant Attorney General, that the accident was caused by “BP’s culture of privileging profit over prudence.” (WSJ article)   Are there really a few simple, direct causes of this accident or is this an example of a highly complex system failure? Where does culpability for culture lie?  Stay tuned.


* U.S. District Court Eastern District of Louisiana, “Superseding Indictment for Involuntary Manslaughter, Seaman's Manslaughter and Clean Water Act: United States of America v. Robert Kaluza and Donald Vidrine,” Criminal No. 12-265.

** T. Fowler and R. Gold, “Engineers Deny Charges in BP Spill,” Wall Street Journal online (Nov. 18, 2012).

Practice Makes Perfect

In this post we call attention to a recent article from The Wall Street Journal* that highlights an aspect of safety culture “learning” that may not be appreciated with approaches currently in vogue in the nuclear industry.  The gist of the article is that, just as practice is useful in mastering complex, physically challenging activities, it may also have value in honing the skills inherent in complex socio-technical issues.

“Research has established that fast, simple feedback is almost always more effective at shaping behavior than is a more comprehensive response well after the fact. Better to whisper "Please use a more formal tone with clients, Steven" right away than to lecture Steven at length on the wherefores and whys the next morning.”

Our sense is current efforts to instill safety culture norms and values tend toward after-the-fact lectures and “death by PowerPoint” approaches.  As the article correctly points out, it is “shaping behavior” that should be the goal and is something that benefits from feedback, and “An explicit request can normalize the idea of ‘using’ rather than passively "taking" feedback.”

It’s not a long article so we hope readers will just go ahead and click on the link below.

*  Lemov, D., “Practice Makes Perfect—And Not Just for Jocks and Musicians,” Wall Street Journal online (Oct. 26, 2012).

Nuclear Safety Culture Research

This is a subject that has been on our minds for some time.  Many readers may have eagerly jumped to this post to learn about the latest on research into nuclear safety culture (NSC) issues.  Sorry, you will be disappointed just as we were.  The painful and frankly inexplicable conclusion is that there is virtually no research in this area.  How come?

There is the oft-quoted 2002 comment by then ACRS Chairman, Dr. George Apostolakis:

"For the last 20 to 25 years this agency [the NRC] has started research projects on organizational-managerial issues that were abruptly and rudely stopped because, if you do that, the argument goes, regulations follow. So we don't understand these issues because we never really studied them."*

A principal focus of this blog has been to bring to the attention of our readers relevant information from academic and research sources.  We cover a wide range of topics where we see a connection to nuclear safety culture.  Thus we continually monitor additions to the science of NSC through papers, presentations, books, etc.  In doing so we have come to realize, there is and has been very little relevant research specifically addressing nuclear safety culture.  Even a search of secondary sources; i.e., the references contained in primary research documents, indicates a near vacuum of NSC-specific research.  This is in contrast to the oil and chemical industries and the U.S. manned space program.  In an August 2, 2010 post we described research by  Dr. Stian Antonsen of the Norwegian University of Science and Technology on “..whether it is possible to ‘predict’ if an organization is prone to having major accidents on the basis of safety culture assessments” [short answer: No].

Returning to the September 2012 DOE Nuclear Safety Workshop (see our Oct. 8, 2012 post), where nuclear safety culture was a major agenda item, we observe the only reference in all the presentations to actual research was from the results of an academic study of 17 offshore platform accidents to identify “cultural causal factors”. (See Mark Griffon’s presentation, slide 17.)

With regard to the manned space program, recall the ambitious MIT study to develop a safety culture simulation model for NASA and various independent studies, perhaps most notably Diane Vaughan's The Challenger Launch Decision.  We have posted on each of these.

One study we did locate that is on topic is an empirical analysis of the use of safety culture surveys in the Millstone engineering organization performed by Professor John Carroll of MIT.  He found that “their [surveys'] use for assessing and measuring safety culture...is problematic…”**  It strikes us as curious that the nuclear industry which has so strongly embraced culture surveys hasn’t followed that with basic research to establish the legitimacy and limits of their application.

To further test the waters for applicable research we reviewed the research plans for major nuclear organizations.  The NRC Strategic Plan Fiscal Years 2008-2013 (Updated 2012)*** cites two goals in this area, neither of which address substantive nuclear safety culture issues:

Promote awareness of the importance of a strong safety culture and individual accountability of those engaged in regulated activities. (p.9)

Ensure dissemination of the Safety Culture Policy Statement to all of the regulated community. [Supports Safety Implementation Strategy 7] (p.12)

DOE’s 2010 Nuclear Energy Research and Development Roadmap identifies the following “major challenges”:

- Aging and degradation of system structures and components, such as reactor core internals, reactor pressure vessels, concrete, buried pipes, and cables.
- Fuel reliability and performance issues.
- Obsolete analog instrumentation and control technologies.
- Design and safety analysis tools based on 1980s vintage knowledge bases and computational capabilities.****

The goals of these nuclear research programs speak for themselves.  Now compare to the following from the Chemical Safety Board Strategic Plan:

“Safety Culture continues to be cited in investigations across many industry sectors including the Presidential Commission Report on Deepwater Horizon, the Fukushima Daiichi incident, and the Defense Nuclear Facilities Safety Board’s recommendation for the Hanford Waste Treatment and Immobilization Plant. A potential study would consider issues such as how safety culture is defined, what makes an effective safety culture, and how to evaluate safety culture.”*****

And this from the VTT Technical Research Centre of Finland, the largest energy sector research unit in Northern Europe.

Man, Organisation and Society – in this area, safety management in a networked operating environment, and the practices for developing nuclear safety competence and safety culture have a key role in VTT's research. The nuclear specific know-how and the combination of competencies in behavioural sciences and fields of technology made possible by VTT's multidisciplinary expertise are crucial to supporting the safe use of nuclear power.#

We invite our readers to bring to our attention any NSC-specific research of which they may be aware.


*  J. Mangels and J. Funk, “Davis-Besse workers' repair job hardest yet,” Cleveland Plain Dealer (Dec. 29, 2002).  Retrieved Oct. 29, 2012.

**    J.S. Carroll, "Safety Culture as an Ongoing Process: Culture Surveys as Opportunities for Inquiry and Change," work paper (undated) p.23, later published in Work and Stress 12 (1998), pp. 272-284.

***  NRC "Strategic Plan: Fiscal Years 2008–2013" (Feb. 2012) published as NUREG-1614, Vol. 5.

****  DOE, "Nuclear Energy Research and Development Roadmap" (April 2010) pp. 17-18. 

*****  CSB, "2012-2016 US Chemical Safety Board Strategic Plan" (June 2012) p. 17.
  
#  “Nuclear power plant safety research at VTT,” Public Service Review: European Science and Technology 15 (July 13, 2012).  Retrieved Oct. 29, 2012.

Communicating Change

One of our readers suggested we look at Communicating Change* by T.J. and Sandar Larkin.  The Larkins are consultants so I was somewhat skeptical of finding any value for safety culture but they have significant experience and cite enough third-party references (think: typical Wikipedia item) to give the book some credibility. 

The book presents three principles for effectively communicating change, i.e., delivering a top-down message that ultimately results in better performance or acceptance of necessary innovations, workplace disruptions or future unknowns.

Transmit the message through the first-line supervisors.  They will be the ones who have to explain the message and implement the changes on a day-to-day basis after the executives board their plane and leave.  Senior management initiatives to communicate directly with workers undermines supervisors’ influence.

Communicate face-to-face.  Do not rely on newsletters, videos, mass e-mail and other one-way communication techniques; the message is too easily ignored or misunderstood.  Face-to-face, from the boss, may be even more important in the age of social media where people can be awash in a sea of (often conflicting) information.

Make changes relevant to each work area, i.e., give the supervisor the information, training and tools necessary to explain exactly what will change for the local work group, e.g., different performance standards, methods, equipment, etc.

That’s it, although the book goes on for almost 250 pages to justify the three key principles and explain how they might be implemented.  (The book is full of examples and how-to instructions.)

Initially I thought this approach was too simplistic, i.e., it wouldn’t help anyone facing the challenge of trying to change safety-related behavior.  But simple can cut through the clutter of well-meaning but complicated change programs, one size fits all media and training, and repetitive assessments.

This book is not the complete answer but it does provide a change agent with some perspective on how one might go about getting the individual contributors (trade, technical or professional) at the end of the food chain to understand, respond to and eventually internalize required behavioral changes. 

Please contact us if you have a suggestion for a resource that you’d like us to review.


 *  T. Larkin and S. Larkin, Communicating Change: Winning Employee Support for New Business Goals (New York: McGraw-Hill, 1994).