Latest / Safe As Podcast / E83: Why Smart Managers Ignore Deadly Warning Signs: Gretley & Moura Mine Disasters

Transcript

E83: Why Smart Managers Ignore Deadly Warning Signs: Gretley & Moura Mine Disasters · Safe As Podcast

• 0:00
  What do some of the worst disasters have in common?
• 0:02
  It's not acts of God, bad luck, what just a careless mistake for
• 0:06
  Andrew Hopkins. It's an organisation convincing
• 0:09
  itself that disaster it fears most can't happen here.
• 0:13
  A common factor in both the mayor and greatly mine disasters
• 0:16
  was that management believed the mine was protected from the
• 0:19
  hazard in question and therefore it can't happen here.
• 0:22
  Good everyone welcome to safe as I'm Doctor Ben Hutchinson.
• 0:25
  We're exploring 2 studies today from Andrew Hopkins.
• 0:28
  So the first, obviously Hopkins 2000 A Culture of denial
• 0:32
  Sociological similarities between the Mara and greatly
• 0:35
  mine Disasters published in Journal of Occupational Health
• 0:38
  and Safety, Australia and New Zealand.
• 0:40
  Using a lot of direct quotes, here is Hopkins explains it
• 0:43
  better than I can. This paper compares the
• 0:45
  underlying sociological and organisational factors behind
• 0:48
  both the Mara and greatly mine disasters.
• 0:50
  I'm not going to go into them in too much depth.
• 0:52
  You can look them up if you're interested.
• 0:53
  First, Hopkins says that while every disaster has its own
• 0:56
  unique set of events, it does not follow that every disaster
• 0:59
  requires a unique explanation. Research, including Barry
• 1:02
  Turner's work and much research since, has shown that some
• 1:06
  phenomena underlie most, if not all, disasters.
• 1:09
  For instance, Turner highlighted that misinformation always plays
• 1:13
  a critical role. There's a mixture of both active
• 1:16
  and latent conditions, and according to some, all disasters
• 1:20
  can be traced to management system failure.
• 1:22
  Both accident inquiries remarked that management in both cases
• 1:25
  believe this event couldn't happen at their mind.
• 1:27
  Hence, a common factor in both disasters was that mine
• 1:31
  management mistakenly believed that the mine was protected from
• 1:34
  the hazard in question. In mining, coal exposed to air
• 1:37
  can heat up slowly spontaneous combustion and if not properly
• 1:41
  ventilated can reach the ignition point of methane.
• 1:44
  At Mara there was an operating belief that spontaneous
• 1:47
  combustion took at least six months to develop the so called
• 1:50
  incubation period. So if work was completed before
• 1:53
  the six months there was thought to be little risk of ignition.
• 1:56
  And while this belief was widespread in industry, it was
• 1:59
  without foundation. It spread by word of mouth and
• 2:01
  had no substantiating evidence. Instead, for Hopkins it was in
• 2:05
  fact a mistaken belief and the mower explosion occurred within
• 2:09
  the supposed incubation period. Importantly, management took the
• 2:13
  mistaken view that the mine was safe from spontaneous combustion
• 2:16
  because they were still within that six month window greatly.
• 2:20
  A known risk was mining near an old abandoned mine that had been
• 2:23
  flooded. Maps were obtained and work was
• 2:25
  planned at what was believed to be a safe distance from the old
• 2:29
  workings. However, because of a drafting
• 2:31
  error made by the department, the maps were inaccurate and
• 2:34
  according to the inquiry, management didn't verify the
• 2:37
  accuracy of the maps as the official inquiry found it had a
• 2:40
  responsibility to do that simply accepted the plans at face
• 2:44
  value. Hopkins argues that management
• 2:45
  of both minds were aware of the hazards and believed they had
• 2:49
  taken appropriate action to protect themselves, but in his
• 2:51
  view they accepted the validity of information acquired from
• 2:55
  others without any attempt to verify it's accuracy.
• 2:58
  Critically, they accept this information on face value when
• 3:00
  the safety of their operations dependent critically on this
• 3:04
  information. Next, Hopkins unpacks what he
• 3:05
  calls warnings ignored. Hopkins argues that warning
• 3:08
  signs of both minds before the disasters were dismissed or
• 3:11
  ignored. He suggests that the
• 3:13
  rationalisation for ignoring or dismissing these warning signs
• 3:16
  stem from factors like the normalisation of deviance and ad
• 3:19
  hoc criteria used to explain away unexpected findings.
• 3:23
  The rate of carbon monoxide, or CEO, is a sign of spontaneous
• 3:27
  combustion. The greater the rise of CEO
• 3:29
  production, the higher the risk of ignition.
• 3:31
  At that time, the rule of thumb was that CEO over 10 litres a
• 3:35
  minute required investigation, while over 20 litres a minute
• 3:38
  indicated considerable danger. The rate before the accident was
• 3:42
  above 10, but below 20 for some weeks prior to the accident.
• 3:46
  Yet it wasn't acted on. A rationalisation from mine
• 3:49
  management was that a new mining method was leaving considerable
• 3:52
  loose colony area, so high SCO production, at least slow and
• 3:57
  steady rises, was to be expected.
• 3:58
  Hopkins then draws on Vaughan's work on the normalisation of
• 4:02
  deviants, discussing how performance issues with the O
• 4:04
  rings were identified over several launches.
• 4:07
  But because these defects in the O rings hadn't totally failed,
• 4:11
  over time their malfunctioning was re conceptualised as normal
• 4:15
  and the risk of total failure came to be judged as acceptable
• 4:19
  low. He suggests a similar effect was
• 4:21
  at Playa greatly, where signs of water accumulation were
• 4:24
  discounted through other rationalisations.
• 4:27
  Next, he looks at this idea of adult criteria.
• 4:29
  So people apparently dismissed warning signs using this adult
• 4:33
  criteria, such as to arbitrarily raise the threshold of what
• 4:36
  could count as a danger signal, and then to argue that the
• 4:39
  observed signs had not crossed this arbitrary threshold.
• 4:42
  Arbitrary. In hindsight, of course, at
• 4:44
  Nara, the prevailing view was that the slow and steady rises
• 4:48
  in CEO were normal, whereas a rapid rise was the real warning
• 4:52
  sign. Hopkins says this logic was
• 4:53
  confused, since an exponential rise in CEO isn't a warning sign
• 4:58
  of potential danger, it's an indicator that a fire is already
• 5:01
  raging. Greatly had a similar mechanism
• 5:03
  at play, where ad hoc criteria rationalised water accumulation.
• 5:07
  In that case, the water was explained away as a mere trickle
• 5:11
  rather than water squirting out. By defining this ad hoc criteria
• 5:14
  of what counts as a warning sign, squirting water versus a
• 5:17
  trickle, the manager had implicitly defined a new test
• 5:21
  for danger. Water squirting out of the face
• 5:23
  under high pressure is an indicator of danger, a trickle
• 5:26
  is not. Nevertheless, no justification
• 5:28
  was provided for this new test. Next, Hopkins discusses the role
• 5:31
  of intermittent warnings, which many warnings are an example of.
• 5:35
  Mara was where the CEO rate was measured at 19 litres a minute,
• 5:39
  just under that magic 20 litres a minute threshold for danger.
• 5:43
  Because the reading was so close, because the warnings were
• 5:46
  intermittent, the reading was challenged as false.
• 5:50
  Next, Hopkins ties these rationalisations together in
• 5:53
  what he calls the culture of denial.
• 5:56
  He writes new evidence appears reliable and informative if it's
• 6:00
  consistent with one's initial beliefs.
• 6:02
  Contrary evidence tends to be dismissed as unreliable,
• 6:05
  erroneous or unrepresentative. People may experience an uneasy
• 6:09
  state when beliefs and evidence are inconsistent.
• 6:12
  Called cognitive dissonance, this requires one to adjust
• 6:15
  either the belief or the evidence, Hopkins notes.
• 6:18
  Where the belief is strong, it's the evidence which is adjusted.
• 6:22
  He argues that both minds adjusted the evidence to align
• 6:25
  with their false belief of safety, this apparent culture of
• 6:29
  denial. This enabled management to deny
• 6:31
  that there was any immediate danger, no matter the evidence.
• 6:35
  Next, we'll move on to another study from Hopkins.
• 6:38
  This is unpacking some of the findings from the Esso trial
• 6:41
  from 2002, titled Lessons from Longford, the trial published in
• 6:45
  Journal of Occupational Health and Safety, Australia and New
• 6:48
  Zealand. In the trial, Esso tried to
• 6:50
  persuade the judge of their otherwise very good safety
• 6:53
  record. Notably, though, they relied on
• 6:56
  lost time injuries. In Hopkins words, Ltis are a
• 7:00
  dubious measure of safety. They're influenced primarily by
• 7:03
  recording practises like whose injuries are counted, and by
• 7:07
  injury management strategies like keeping injured workers at
• 7:10
  work, photocopying stuff, and they generally represent high
• 7:14
  frequency, low consequence matters.
• 7:16
  By contrast, major hazard events like explosions tend to be rare
• 7:21
  and may not generate Ltis for many years.
• 7:24
  In Hopkins words, a focus on Ltis tends to divert attention
• 7:28
  away from the management of major hazards.
• 7:30
  And this happened at Logford. They're so proudly explained how
• 7:32
  they went 1.7 million hours without an LTI.
• 7:36
  And while this wasn't their only focus or measure, it highlights
• 7:39
  a focus on routine injuries over major hazard events.
• 7:43
  Hopkins also explains that effective risk control means
• 7:45
  adopting control measures linked to specific hazards.
• 7:48
  Many major accidents occur when controls that were supposed to
• 7:52
  be in place were not like the permit to work system of Piper
• 7:55
  Alpha, so ongoing safety depends on regular assurance that these
• 8:00
  critical controls are working as expected.
• 8:02
  Organisations must adopt indicators that measure control
• 8:05
  effectiveness, and there also must be measures of how
• 8:09
  effectively the management system is monitoring and
• 8:11
  maintaining these controls. Hopkins provides a table of
• 8:15
  example indicators, not as best practise but as illustrative
• 8:19
  examples, and notes that LTI is incapable of assuring those
• 8:23
  elements. Next they unpacked the safety
• 8:25
  management system. It was covered a bit in the
• 8:26
  Royal Commission but also in the trial, had a lot of criticism
• 8:29
  directed at the SMS directly quoting the Commission.
• 8:33
  The safety management system was said to be repetitive, circular
• 8:37
  and to contain unnecessary cross referencing.
• 8:39
  Much of its language was impenetrable and importantly,
• 8:42
  the Commission gained A distinct impression that there was a
• 8:45
  tendency for the administration of this safety management system
• 8:48
  to take on a life of its own, divorce from operations in the
• 8:51
  field. So importantly, people were
• 8:53
  managing the system and its documents over the practical
• 8:56
  functioning of the plant and it's major hazards.
• 8:59
  In the trial, it was remarked that one cannot simply discharge
• 9:03
  one's duty by creating a monumental paper structure and
• 9:06
  then not implementing it. Hopkin draws on earlier major
• 9:08
  hazard guidance from an Australian safety regulator,
• 9:11
  noting two ways that SMS can fail.
• 9:13
  One, a virtual safety management system, one that contains the
• 9:17
  right management elements and the correct control measures,
• 9:20
  but doesn't reflect how those control measures are managed.
• 9:23
  Reality that's sort of conventional workers, imagined
• 9:26
  workers and 2A misguided safety management system, one with the
• 9:29
  right management system elements but managing the wrong control
• 9:32
  measures, those not linked to major incidents.
• 9:34
  So the virtual SMS is a paper system which fails at the
• 9:37
  implementation stage, while a system which focuses on Ltis as
• 9:41
  its primary measure of safety is misguided.
• 9:44
  Further, there were critical issues with alarm management at
• 9:47
  Longford. Control room operators could
• 9:49
  receive hundreds, even thousands of process upset alarms each
• 9:53
  day, then even nuisance alarms, with no real impact.
• 9:56
  But in cancelling these, no distinction was made between
• 9:59
  nuisance alarms and critical alarms.
• 10:01
  Hence critical alarms could be ignored or cancelled without due
• 10:05
  attention. The trial also unpacked critical
• 10:07
  procedures. Now, not all procedures had to
• 10:09
  be documented, but if they were critical, they probably should
• 10:13
  have been. The prosecution's position was
• 10:15
  you might not need written procedures in a milk bar if you
• 10:17
  spill some milk, but you do need them in a volatile and flammable
• 10:20
  gas plant with complex procedures.
• 10:22
  Problematically, ESO had no written procedures for dealing
• 10:26
  with cold temperature hazards, the very issue involved in that
• 10:30
  accident, and because there were no procedures, there were no
• 10:33
  specific training informing workers about this hazard.
• 10:36
  SO did provide generalised training for operators, but it
• 10:39
  was said to lack the quality and focus needed for safety critical
• 10:42
  procedures. Therefore, for Hopkins, this
• 10:45
  procedure provides guidance on where organisations should focus
• 10:48
  training attention on the critical procedures necessary
• 10:51
  for risk reduction. Finally, also in the trial had a
• 10:54
  tendency to blame the principal operator involved in the
• 10:57
  accident. The operator was said to have
• 10:59
  had the necessary information and failed to take actions due
• 11:02
  to individual factors. This wasn't accepted in
• 11:04
  sentencing by the judge who noted.
• 11:06
  The truth is there was only one entity responsible for lack of
• 11:09
  knowledge on that day, Esso IT and IT alone should have
• 11:14
  properly trained the operators and supervisors not only in
• 11:18
  production, which it did, but also in safety.
• 11:22
  IT and IT alone failed to do so. The operator and the employees
• 11:26
  did not fail. So what can we make of the
• 11:27
  findings? Hopkins provides the following
• 11:29
  suggestions for countering these accident logics and cultures of
• 11:33
  denial. There's limited value in trying
• 11:35
  to change the various beliefs making up the culture of denial,
• 11:38
  because even though some might be corrected or changed, others
• 11:42
  would very likely develop in their place, and such beliefs
• 11:45
  are in any case almost inevitable.
• 11:48
  Instead, one method is to limit the discretion exercised by
• 11:51
  decision makers, whereby decision making must be
• 11:55
  structured by introducing imperatives to action in certain
• 11:58
  circumstances which rule out the option of doing nothing.
• 12:01
  Also, after identifying the major hazards and action plans,
• 12:04
  these plans must involve the usual hierarch elements,
• 12:07
  identification, risk assessment, etc, but also how they should
• 12:11
  deal with the possibility that crucial information on which
• 12:14
  safety of the enterprise depends may be incorrect.
• 12:16
  Also, the plans must identify warning signs which will be
• 12:20
  treated as triggers to action and what actions must be taken
• 12:23
  and by whom. And when management are to take
• 12:26
  no action, Hopkins suggests they should record these decisions in
• 12:29
  writing along with the reason. In all, Hopkins argues for
• 12:32
  structured decision making so that certain warning signs are
• 12:36
  identified in action and so systems rule out the option of
• 12:39
  doing nothing. Disasters are often, in
• 12:41
  hindsight, preceded by warnings, but warnings don't protect
• 12:45
  anyone by themselves. What matters is whether the
• 12:47
  organisation has built a system that can better process signal
• 12:51
  from noise, makes it easy to follow an acceptable process,
• 12:55
  and makes it hard to explain warnings away.
• 12:57
  Because, as the culture of denial said, yes, the expression
• 13:00
  it won't happen here is among the most dangerous myths around.
• 13:04
  That's it. On Safe As.
• 13:05
  Please subscribe and like and comment directly on the videos
• 13:09
  on YouTube and link in the show notes to support the channel.