Normalisation of deviance
Summary
TLDRThis webinar, hosted by Trish Caron, Director of the IME Safety Center, delves into the concept of 'normalization of deviance', a phenomenon where warning signs are ignored due to complacency. Using the Columbia space shuttle disaster as a case study, the presentation explores how repeated deviations from safety protocols can become normalized, leading to catastrophic outcomes. It also examines historical incidents across various industries to highlight the dangers of this phenomenon and emphasizes the importance of recognizing and addressing deviance to prevent future tragedies.
Takeaways
- 🚀 The concept of 'normalization of deviance' was introduced by sociologist Diane Vaughan, highlighting the dangers of ignoring warning signs due to complacency or false assumptions of safety.
- 🔍 The Columbia Space Shuttle disaster serves as a case study for normalization of deviance, where foam insulation damage during launch was initially a concern but later became an accepted risk, leading to catastrophic failure.
- 📈 NASA's history of debris strikes on shuttles shows a pattern of increasing acceptance of risk, with incidents like the Atlantis shuttle's near burn-through event and the Columbia disaster illustrating the dangers of complacency.
- 🛠️ The Challenger disaster in 1986 also exemplifies normalization of deviance, where known design flaws in the O-rings were deemed acceptable risks, leading to the explosion and loss of the crew.
- 🔥 The BP Texas City refinery explosion and the Deepwater Horizon disaster both demonstrate how deviations from standard procedures and confirmation bias can lead to major accidents.
- 🌋 The Pike River coal mine disaster in New Zealand shows how normalization of high methane levels led to a fatal explosion, despite clear warning signs being ignored.
- 🛳️ The Costa Concordia cruise ship disaster highlights how routine deviations from safety protocols, such as performing salutes too close to shore, can become normalized and lead to tragedy.
- 🔍 The importance of monitoring and maintaining safety instruments was emphasized, as failed or ignored instruments can lead to critical information being overlooked, as seen in the Columbia disaster.
- 🤔 The webinar discusses the need for organizations to focus on proving systems and actions are safe, rather than assuming they are safe until proven otherwise, to prevent complacency and normalization of deviance.
- 📊 The discussion on measuring safety performance by the absence of incidents can embed normalization of deviance, as the lack of reported incidents is not necessarily evidence of a safe workplace, but could indicate ignored warning signs.
Q & A
What is the main topic of the IME Safety Center webinar presented by Trish Caron?
-The main topic of the webinar is the concept of 'normalization of deviance,' which refers to the phenomenon where warning signs are ignored or become unnoticed over time, leading to potential safety risks.
Who introduced the term 'normalization of deviance' and in what context?
-Sociologist Diane Warren introduced the term 'normalization of deviance' in her 1996 book 'The Challenger Launch Decision,' which was about the Challenger space shuttle disaster.
What is the significance of the Columbia space shuttle case study in the webinar?
-The Columbia space shuttle case study is used to highlight the factors around normalization of deviance, as it is a well-documented incident where such behavior led to the tragic loss of the shuttle and its crew.
What was the role of foam insulation in the Columbia space shuttle disaster?
-The foam insulation from the external tank broke away during launch and struck the left wing of the orbiter, damaging the thermal protection system, which ultimately led to the shuttle's disintegration upon re-entry.
How did NASA's response to debris strikes evolve over time, as illustrated by the case studies?
-Initially, debris strikes were considered a safety of flight issue, but over time they became an accepted risk and were normalized within the organization, leading to a shift in focus from addressing the issue to merely analyzing the probability of damage.
What was the initial design specification for the Space Shuttle program and how did it differ from the reality?
-The initial design specification for the Space Shuttle was to provide routine access to space with around 50 flights per year. However, by 1989, it was only conducting 24 flights a year due to budget overruns and capability issues.
What cultural factors within NASA contributed to the normalization of deviance?
-Cultural factors included a hubris associated with past successes, a rejection of criticism and externally imposed changes, and a focus on proving systems and actions were safe rather than proving they were unsafe.
How did the Challenger and Columbia investigations reveal similar cultural issues within NASA?
-Both investigations found a failure to learn from past incidents, inadequate concerns over deviation from expected performance, and a silent safety program within the human spaceflight area of NASA.
What is the importance of leading versus lagging safety performance metrics in identifying normalization of deviance?
-Leading metrics focus on proactive measures and can help identify potential issues before they become normalized, whereas lagging metrics like incident counts can embed normalization of deviance by focusing on the absence of incidents as a measure of safety.
What are some strategies organizations can use to prevent the normalization of deviance, as suggested by the webinar?
-Strategies include multi-tiered risk assessments, sign-off by competent technical authorities, rewarding the identification of deficiencies, and focusing on leading safety performance metrics.
How can the concept of confirmation bias contribute to the normalization of deviance?
-Confirmation bias can lead individuals to seek out and interpret information in a way that confirms their pre-existing beliefs, potentially normalizing deviance by overlooking or dismissing warning signs that contradict the belief in a safe and successful operation.
Outlines
🚀 Introduction to IME Safety Center Webinar
Trish Caron, the director of the IME Safety Center, introduces the second member webinar on the topic of 'normalization of deviance.' She outlines the webinar's structure, including the opportunity for audience interaction through chat, and promises to address questions throughout and at the end. The concept of normalization of deviance is introduced, with a historical reference to Diane Warren's work and its significance in the Columbia and Challenger space shuttle disasters. The Columbia case study is highlighted to discuss the consequences of ignoring warning signs, such as equipment malfunctions that are dismissed as false alarms.
🔍 The Columbia Shuttle Disaster: A Case Study
This section delves into the Columbia shuttle disaster, detailing the mission's history, the launch delay, and the incident involving foam insulation from the external tank damaging the orbiter's thermal protection system. The report from the Columbia Accident Investigation Board is referenced, showing a pattern of foam debris strikes on space shuttles and how they were normalized over time. The narrative describes how NASA's response to these incidents evolved from active concern to acceptance, culminating in the Columbia disaster where the foam strike was not considered an anomaly due to its normalized status.
🛠️ The Challenger Incident and NASA's Cultural Acceptance of Deviance
The discussion shifts to the Challenger incident, examining the cultural acceptance of deviance within NASA that led to the tragedy. The focus is on the Challenger's o-ring failure, which was a known issue that had been normalized due to previous successful launches despite the risks. The presentation critiques NASA's safety management system, highlighting the lack of problem reporting, trend analysis, and the involvement of experts in critical decisions. It emphasizes the importance of proving safety rather than the absence of danger and reflects on the cultural hubris that contributed to the failure to learn from past incidents.
📈 Normalization of Deviance in Various Industries
This part of the script broadens the discussion to include normalization of deviance across different industries, citing examples such as the Pike River coal mine explosion, the BP Texas City refinery incident, the Deepwater Horizon disaster, and the grounding of the Costa Concordia. It emphasizes the common thread of accepting deviations from safety standards as normal operating procedures, leading to catastrophic outcomes. The summary serves as a cautionary note on the dangers of complacency and the importance of learning from warning signs.
🔧 The Dangers of Measuring Safety by Incident Absence
The script addresses the flawed approach of gauging safety performance solely by the absence of incidents, which can mask underlying issues and embed normalization of deviance. It challenges the audience to consider their own organization's methods of monitoring safety, whether they focus on the absence of failure or the presence of success. The section ends with a poll question to engage the audience in reflecting on their safety monitoring systems and their effectiveness.
🤔 Audience Engagement and Future Webinars
The script concludes with an interactive segment inviting audience questions and comments, acknowledging the earlier audio loss and reviewing some of the questions that were submitted. It also provides information on upcoming webinars, including one on the BP Texas City refinery incident with Dr. Paul Tebow and sessions on lead process safety metrics and the Pike River Mine explosion anniversary. The section encourages sharing of ideas and suggestions for improving webinars and for topics of interest.
🔄 Balancing Reward and Accountability in Safety Management
The final part of the script explores the challenging balance between rewarding success and identifying safety deficiencies. It discusses the potential unintended consequences of reward systems based on safety outputs like incident rates, which may not accurately reflect the underlying safety culture or the presence of potential risks. The conversation touches on the need to move away from lagging indicators to leading indicators, emphasizing the importance of proactive safety management.
Mindmap
Keywords
💡Normalization of Deviance
💡Columbia Accident Investigation Board
💡Thermal Protection System
💡STS-107
💡Foam Debris Strikes
💡Safety Culture
💡Risk Analysis
💡Confirmation Bias
💡Lead and Lag Metrics
💡High-Reliability Organizations
💡Morton Thiokol
Highlights
Introduction of Trish Caron, Director of the IME Safety Center, and her background in engineering and process safety.
Definition of 'normalization of deviance' as a concept introduced by sociologist Diane Vaughan, relating to ignoring warning signs due to desensitization.
The role of normalization of deviance in the Columbia Space Shuttle disaster, with a detailed case study of the incident.
Historical data on foam debris strikes on space shuttles, indicating a pattern of accepted risk over safety.
Challenger incident's influence on the understanding of normalization of deviance within NASA's culture.
Cultural analysis of NASA showing a pattern of ignoring safety warnings and a failure to learn from past incidents.
The impact of budget pressures and staff reductions on safety protocols and the normalization of deviance.
Discussion on the importance of distinguishing between proving systems and actions are unsafe versus proving they are safe.
Examples of normalization of deviance from various industries, including the BP Texas City refinery and the Deepwater Horizon rig.
The concept of confirmation bias in safety management and its role in misinterpreting warning signs.
The Pike River coal mine disaster and the normalization of methane levels as a production issue rather than a safety one.
The challenge of balancing rewarding success with identifying and addressing safety deficiencies within organizations.
The idea of celebrating 'red' on the scorecard, which refers to acknowledging and addressing deficiencies in safety systems.
Importance of leading indicators in safety performance measurement over lagging indicators to prevent normalization of deviance.
Strategies for identifying when deviance may become normalized within an organization and the effectiveness of these systems.
Upcoming webinars on safety topics, including the BP Texas City refinery incident and the Pike River Mine explosion.
Transcripts
hello and welcome to the IME Safety
Center webinar this is the second member
webinar we have hosted and we plan to
host many more in the future
my name is Trish Caron and on the
director of the ikm Safety Center
I joined IQ me to lead development of
the IQ in January 2014 prior to that I
had a career working in engineering
operations and Process Safety in the oil
and gas and chemical industries the
topic for this webinar is normalization
of deviance
as we progress through the webinar
you'll be able to ask questions or make
comments by typing in the chat box on
the right hand side of your screen
please make sure you select entire
audience so everyone can see your
comments we will endeavor to answer your
questions both during and at the
conclusion of the presentation so what
is normalization of deviance the concept
of normalization of deviance was raised
by sociologist Diane Warren in her 1996
book the Challenger launch decision
following this and the Columbia incident
she was then invited to join the
Columbia accident investigation board
the concept of normalization of deviance
is basically not taking heed of warning
signs because you just don't notice them
this warning signs anymore for example
you may have a piece of equipment that's
constantly in an alarm state you either
stop noticing the alarm or justify that
it's okay because it's a false alarm
rather than address what's causing it
you may miss the real alarm by always
assuming it's false we're going to talk
a little bit about the columbia space
shuttle as a case study here and this
case study has been chosen to highlight
the factors around normalization of
deviance as it's a very clearly
documented incident in the Columbia
accident investigation board report
which was published in 2003 Columbia was
on its 28th flight and
113 space shuttle mission it was
designated space transportation system
sts-107 it was a long mission of 16 days
in orbit sts-107 was initially scheduled
for launch in May 2000 but this was
delayed until January 2003 for various
reasons shuttle launches can be delayed
over time and they basically maintain
that original designation so in this
instance for example sts-112 flew before
sts-107 during the launch when the
external tank disconnected from the
orbiter foam insulation broke away from
what's called the bipod ramp and struck
the left wing of the orbiter during the
investigation into the incident it was
determined this foam damaged the thermal
protection on the orbiter the thermal
protection is designed to protect the
orbiter during the extreme heat build-up
that occurs on re-entry into the Earth's
atmosphere this table taken from the
Columbia accident investigation board
report volume 1 shows a history of major
foam debris strikes on space shuttles
there were 14 instances in all when
significant damage occurred or there was
a large foam loss looking at mission
sts-27 are with Atlantis the Atlantis
orbiter suffered a near burn through
event when it lost a thermal tiles due
to excessive foam debris strikes on
mission STS 35 this appears to be when
NASA started to define debris hits as a
reuse or turnaround issue rather than
just a safety of flight issue mission
STS 50 appears to be when debris strikes
become an accepted risk in the
organization STS 56 is when strikes are
now considered commonplace and
acceptable mission sts-112 also suffered
a significant debris strike
in this instance it was not even
considered to be an anomaly because
there are now the situation where phone
strikes are expected on launch when
finally mission sts-107 in January of
2003 with the Columbia launch occurred
the Columbia broke up on re-entry after
suffering tile damage from the foam
debris impact and to burn through events
which led to the orbiter becoming
unstable the shuttle program was delayed
in its early phases due to issues with
the thermal tiles in fact as they were
developing the design of the orbiter
that took a very long time to install
the tiles and they would often fall off
after installation and have to be
reinstalled this led to new adhesives
being developed to ensure that the tiles
actually stayed in place damage to the
thermal tiles was initially a concern to
NASA and they started to develop a
method for repairing the tiles in orbit
but this was unsuccessful and eventually
they cancelled these efforts they were
also unable to stop the throne shedding
issue so interestingly rather than
focusing on making the orbiter more
resistant to impact strikes they
actually put a lot of effort into
analyzing the probability of damage they
then didn't do anything with this risk
analysis they basically just analyzed it
the repair program as well as a visual
inspection of the orbiter after launch
was reinitiated following the Columbia
loss the visual inspections are or were
achieved in the last launches of the
shuttle system either via satellite
ground-based imagery or if the orbiter
was docking at the International Space
Station it was observed by the space
station crews visually before docking to
see whether there was any damage to be
concerned about and therefore
potentially repair whilst in orbit this
image here
shows you the space shuttle in its
entirety so the Space Shuttle term
refers to the orbiter the external tank
and the solid rocket boosters the orange
tank in the middle is the external tank
and the small red circle at the top is
where the bipod ramp is this is where
the phone breaks off when the shuttle
actually launches and the external tank
separates the red circle down towards
the bottom is the debris strike region
where the Columbia was actually struck
with the foam that had broken away and
this is actually Columbia on its launch
pad prior to launch
in 2003 the Space Shuttle design project
started in earnest in 1972 it was
initially designed to be a routine form
of transport to orbit with around 50
flights per year and commercial
contracts to launch satellites to assist
with its funding however by 1989 it was
only conducting 24 flights a year the
budgeting for the system was overrun and
it was not generating the expected
revenue due to capability issues the
shuttle however was declared operational
in 1982 and ready to provide economic
and routine access to space this was
more for political purposes because the
system was proving difficult to operate
with more maintenance required between
flights than had been expected rather
than leading the 10 working days
projected in 1975 to process a return to
orbiter for its next flight by the end
of 1985 an average of 67 days had
elapsed before a shuttle was ready for
launch the original design specification
also did not include protection from
debris strikes
therefore the occurrence of a debris
strike was a violation or deviance from
the specification in fact even as the
shuttle orbits earth whilst in orbit it
actually orbits in a reverse and
upside-down direction to protect its
sensitive areas so that it doesn't
suffer debris impacts from anything
in the Earth's orbit as well
normalization of deviance in NASA
predated the Columbia incident there are
striking similarities with the cultural
acceptance of deviation but extended
back to the challenger incident
Challenger or mission STS 51 L had been
delayed several times and pressure was
mounting for launch there was also a lot
of media focus and the space shuttle
program was striving to become more
relevant so some of you may remember
that space shuttle Challenger actually
had a middle school teacher on board
because they were going to try and raise
the profile of the space program by
engaging with students and schools all
over America the schedule was put a head
of engineering considerations that the
ambient temperature was outside previous
experience and the o-rings became
brittle in lower temperatures the chief
engineer was actually told to take his
engineering had often put his management
on to make a launch decision when the
engineers from the o-ring manufacturer
raised concerns about the temperature of
launch the NASA safety program was
infective and remained silent the onus
was on the contract engineers to prove
that it was unsafe rather than a focus
on proving it was safe
prior to STS 51 L when the o-ring began
behaving in unexpected ways rather than
testing the joint NASA and Morton
Thiokol the manufacturer came to see the
deviation as an acceptable flight risk a
violation of design that could be
tolerated
the Challenger investigation also found
that the safety management system in
particular elements involving problem
reporting trend analysis interpretation
of criticality and involvement of
experts in critical decisions were all
severely lacking thinking about your own
organizations do you focus on proving
systems and actions are unsafe or
proving they are safe and it's a very
important distinction between those two
while there were recommendations to
address the cultural issues following
Challenger the human spaceflight area of
NASA remained largely unaffected human
spaceflight was the area responsible for
managing the shuttle program this led to
inadequate concerns over deviation from
expected performance silent safety
program and schedule pressure being
entrenched in the organization this was
compounded by budget pressure and a
reduction in staffing that had occurred
during all of this culturally there's a
hubris associated with success
regardless of the Challenger incident
itself this was the organization that
had put a man on the moon and developed
the space shuttle program miss then it
was not possible for them to believe
failure could occur in their culture the
culture rejected criticism
recommendations and externally imposed
changes the findings of both Challenger
and Columbia investigations are similar
from a cultural perspective very clearly
a failure to learn there some thermal
protection areas are so fragile file
they can be damaged with a fingernail
engineers were quoted as saying that if
they had known the external tank was
going to produce the debris shower that
occurred on launch they would have had a
very difficult time clearing Columbia
for launch over the life of the program
up to sts-107 orbiters landed with an
average of 143 divots on upper and lower
surfaces with 31 of these everything
over one inch in one dimension efforts
were made to modify the foam and bipod
connectors but when this proved too
difficult the word ik c s-- eventually
the damage was seen as merely a delay in
preparation for the next flight rather
than a safety of slight issue for the
current flight because after all the
previous orbiters had all returned
safely
sts-112 which flew a few months before
sts-107 suffered a bipod ramp foam
shedding incident which resulted in a
three inch by 4 inch dodge in the foam
on one of the solid rocket boosters this
was a very big warning signal that was
normalized it was not even recognized as
an in-flight and long link with each
successful landing engineers and
managers regard the phone shedding and
inevitable and unlikely to impact on
safety that is it had become an
acceptable risk as the acceptance of
debris strikes increased the one in
which they were handled changed
significantly after the discovery of a
debris strike on flight day two of
sts-27 are with Atlantis in 1988 the
crew was immediately directed to inspect
the orbiter using its space arm while so
able to view some of the damage they
weren't actually able to see that there
was a missing tile the location of where
the tile was lost was fortunately a much
thicker aluminum plate which prevented a
total burn through though the orbiter
skin that was damaged on return to the
atmosphere the engineers were surprised
at the extent of the damage when that
shuttle actually landed 707 impacts with
298 of them greater than 1 inch and a
missing tile as the commander had said
it looked like she'd been lasted with a
shotgun 14 years later when a debris
strike was discovered on flight day 2 of
sts-107 with Columbia shuttle program
management declined to inform the crew
or have them inspect the orbiter for
damage they declined multiple requests
for on-orbit imaging to inspect the
tiles on the orbiter and ultimately they
discounted the possibility of a burn
through interestingly debris strikes
continued to be an issue for the shell
program up until its final mission this
photo shows some thermal tile damage
from the final shuttle mission STS
one three five with Atlantis the orbiter
Atlantis is on display at Kennedy Space
Center in the condition she landed in
and this sort of damage is very evidence
if you ever have the opportunity to see
one of the shuttles on display it was
standard protocol for high-resolution
footage of launches to be examined for
anomalies the team reviewing the footage
were concerned there may have been
damage to the thermal tiles due to the
debris strike multiple requests were
made to inspect the orbiter during the
mission the first was a request for the
crew to do a visual inspection that
request to the engineering Directorate
was never answered three separate
requests were made over several days to
obtain high-resolution footage of the
orbiter in orbit to determine if there's
any damages concern each of these
requests was eventually rejected as
being unnecessary without images the
debris assessment team could only
estimate using mathematical models which
were actually not designed for that
purpose to postulate potential damage it
was estimated that there may be
localized heat damage but they could not
definitively say structural damage would
occur more batters are monitored with an
exclusion zone while in orbit on
slightly two of the mission an
additional object appeared in orbit with
the orbiter for almost an hour this was
detected via the exclusion zone
monitoring it was not possible to
conclusively determine what it was that
the size and shape was consistent with a
reinforced carbon-carbon panel fragment
it was possible that this was when the
damaged tile fell off the orbiter the
crew were informed of the debris strike
on flight day 8 and they were told it
was not a concern and they had nothing
to worry about the only reason they were
actually informed is because they were
about to do media interviews on flight
down May 10 and it had become public
knowledge throughout the u.s. that there
was some concern about a debris strike
so they were informed so that they
weren't surprised in an interview when
they were asked about it
foam impacts have been normalized there
are maintenance turnaround issue rather
than a threat to safety was an
identified and acceptable risk not a
flight safety issue we can consider that
this is actually similar to the Pike
River coal mine explosion where
excessive methane levels were seen to be
a production related issue rather than a
safety one high levels had been accepted
the Columbia Auditor was unique she was
the first orbiter to be launched and she
had additional instrumentation to
validate performance and design over her
life of 28 missions the additional
instrumentation began to fail as it was
installed for design validation it was
not maintained or repaired on failure
failed instrumentation meant results
could not be relied upon even though the
results were logged unexpected results
from the sensors in her left wing were
assumed to experience though they may
have been an indication of the impending
breakup it's worth considering how your
facilities are instrumented what are
your instruments telling you are you
measuring the right things what are you
doing with the data how are your
instruments being maintained is data
being ignored because it might be
spurious or from instruments that are
considered no longer necessary there
have been several incidents where
evidence of normalization of deviance
have contributed to the outcome a
selection across different industries
have been chosen here the Challenger
Space Shuttle in 1986 when the Space
Shuttle exploded 73 seconds after launch
with the loss of all seven crew the
greatly coal mine flood in 1996 when an
underground mines flooded when they
broke through to some disused and
flooded mine tunnels there were four
fatalities in 2005 the BP Texas City
refinery with the overfilling if the
raffinate splitter tower resulting in a
loss of containment and subsequent
explosion and 15 felonies
in Macondo in 2010 with the well blowout
resulting in 11 fatalities significant
oil filler on the sinking of the reed
the Pike River coal mine in 2010 29
miners died when they were trapped in
the underground mine after a series of
explosions due to methane buildup DuPont
toxic chemical releases in 2010
resulting in one fatality at the Bell
West Virginia site and something a
little war left field the Costa
Concordia in 2012 the grounding and
sinking of the passenger ship with the
loss of 32 lives let's go into these in
a bit more detail to highlight the
normalization of deviance that occurred
so a little bit more on the Challenger
Space Shuttle the o-rings in the socket
rock solid rocket boosters were designed
to create a pressure seal to contain the
solid rocket motors over a series of
previous flights it was noted that the
o-rings were being eroded during the
launch process this became a known
design flaw it was also known that the
o-rings performed worse when it became
brittle under colder ambient conditions
this design flaw became acceptable to
NASA as there had been no negative
consequences of the known issue at the
time of launching challenger the ambient
temperature was lower than previous
launches the Morton Thiokol engineers
who designed the o-rings were concerned
that this was outside of their known
experience where actually recommended
against launch in the predicted weather
conditions however the deviance of
earrings being eroded had been so
normalized in the organization that the
decision to launch was made the risk was
deemed acceptable because nothing bad
had happened to previously the results
as we know was the destruction of the
orbiter and the loss of the entire crew
shortly after launch the greatly mine
near Newcastle in New South Wales was
located in an area rich with black coal
calories had been present in the region
since the eighteen hundreds
initially the mine it greatly was quite
some distance away from old abandoned
tunnels which
over the years had flooded 1994 the
decision was made to expand the greatly
mind and drawings of the old tunnels are
obtained these were unfortunately
incorrect and as a result the abandoned
tunnels were 100 meters closer than
thought in the weeks leading up to the
incident warning signs began to appear
that the miners were getting closer to
the abandoned tunnels
however these warnings were ultimately
dismissed the district was typically a
wet one
however Gretna 9 was always considered
to be a drier mine in fact it did not
have pumps installed when the miners
started to report seepage and
accumulation of water it should have
been a warning that they may have been
getting closer to flooded tunnel forced
over the two weeks leading up to the
flood there were reports of nuisance
water in one report the question was
actually asked were not close to the old
mine are we the increased presence of
water was normalized as the coal seam
just giving out a considerable amount of
water the presence of water in this
increasing quantity was deviant but was
normalized as nothing to be concerned
about BP Texas City refinery the AH
summarization unit was being restarted
after a shutdown the procedure required
pumping of raffinate through the
splitter tower however it was common
practice to deviate from the procedure
and block flow out of the tower this was
done to avoid losing liquid level in the
tower during startup which may have
damaged equipped equipment the previous
experience by the operators was that
they could get sudden drops from the
level in the tower so they adapted the
way they started it to compensate
compounding this issue was the
acceptability to start the tower even
though there were reported malfunctions
with the level gauges and pressure
control valve on the tower another
deviation from procedures was the lack
of additional staff during startup of
the isomerization unit as required by BP
safety guidelines
the tower overflowed to a blowdown drum
rather than to a flair system this was
despite numerous recommendations to
install the flare system the blowdown
zone was a deviation from current
accepted engineering design and had
resulted in numerous releases to
atmosphere of flammable liquids in the
past the Deepwater Horizon drill rig had
just completed drilling the Macondo well
and was preparing to leave the area this
process included completing the cement
ceiling of the well and removal of heavy
drilling mud from the riser provided the
cement ceiling was successful removing
the mud would not result in any safety
issues once the cement ceiling had been
completed it was declared a success by
the engineers undertaking it this
declaration set up the expectation that
all subsequent tests which showed had
been a success the focus of well
integrity tests then shifted to confirm
that it was sealed rather than to
investigate whether it was sealed yet
again a very subtle difference in
thought however in this instance the
cement ceiling had been unsuccessful and
the well was not sealed this highlight
of the concept of confirmation bias as
well where people have the subconscious
preference to look for information that
confirms their beliefs rather than
refutes them normalization of deviance
came into play during the confirmation
bias that occurred with the Lovell
integrity testing warning signs showing
that cement ceiling was unsuccessful
were justified away the explanations
that did not call into doubt the
integrity with the nations that did not
call into doubt the integrity of the
cement ceiling this can be a challenge
in interpreting the warning signs some
explanations of them may be benign but
if a confirmation bias has already
established that there is success the
deviation may be normalized
the Pike River coal mine was an
underground mine and it shipped its
first coal in February 2010 so there's a
time of the explosion in November 2010
it was still a very new mine it did
however have some very unusual design
features the main ventilation fan was
located underground rather than above
which is the conventional design this
difference contributed to the
ventilation system deficiencies which
meant it was not able to handle the
level of methane being liberated by the
mining process employed this was
exacerbated by the hydro mining which
was liberating higher levels of methane
in this particular mine the performance
of the ventilation system seen as an
Operations issue that impacted
production and not safety this was
because the accumulation of methane
triggered production stoppages because
of the focus on production some methane
detectives were actually bypassed to
prevent these stoppages although the
levels of methane were manually recorded
on a shift or shift basis but no action
was taken when these readings
consistently showed excessive levels the
deviance of high methane levels was
normalized and mining continued it's not
known what the ignition source was for
the initial explosion and after many
years despite the attempts to recover
the remains of the miners their bodies
remain in the mine the decision to cease
attempting to extract them was made in
December 2014
in 2010 the Daponte
Bell West Virginia facilities suffered a
series of significant incidents the CSB
chose to investigate them over the
concern that three very significant
incidents could occur over a two day
period the first release was of methyl
chloride by a ruptured bursting disc
this then allow the substance to leak
back into the building for five days
through a poorly designed vent before it
was discovered
the bursting disc had sensors connected
to it
however from experience they were
unreliable so the alarms were just
assumed to be false or a nuisance prior
to this incident though new more
reliable sensors had been installed this
hadn't been communicated to the
operators and they hadn't been trained
on the new sensors so the alarms were
still assumed to be false the alarms
were normalized the second release was
of oleum from the sample line through
corroded pipe work though they had
identified corrosion a year earlier
after a different leak and made
recommendations for thickness monitoring
program it had not been implemented at
the time of this incident the third
release was when a hose containing
phosgene burst spraying an operator
phosgene is a highly toxic substance
that attacks the mucous membranes of the
body and though the worker initially
seemed okay he did go to hospital for
observation and later died in hospital
the phosgene was extracted from a
canister into the process via a
stainless steel braided teflon lined
hose given the permeability of teflon to
fourth gene the hoses were to be
replaced every thirty days however at
the time of the incident they had not
been changed for approximately seven
months this was because the maintenance
system which prompted the change out had
been changed and the new system was not
sending reminders the normalization of
deviance however occurred when earlier
that day and now the phosgene hose had
failed in service this provided a
warning signal to the operators but no
checks were done on the other
phosgene hoses it was assumed that
everything was still okay so there was
no checks and no reply estimate other
hoses prior to this incident occurring
the Costa Concordia cruise ship this
ship struck rocks and eventually sank
when it sailed at high speed too close
to an island in a maneuver called a
salute the reason for a salute is
usually to give passengers MP I believe
we're now back online apologies for that
interruption I'm not sure what happened
with the audio what I might do is just
go back a couple of incidents I'm not
sure at which point we actually dropped
out I believe it was the DuPont facility
so I'm going to go back to the start of
the DuPont incident again and my
apologies for that technical glitch the
CSB chose to investigate the Bell
facility I have a concern that three
significant incidents could occur over a
two day period the first release was of
methyl chloride via a ruptured bursting
disk this then followed the substance
allowed the substance to leak back into
the building for approximately five days
to a poorly designed vent prior to it
being discovered the bursting disc had
sensors connected to it whoever it is
they were unreliable so alarms were
assumed to be false or nuisance prior to
the incident though new more reliable
sensors had been installed but the
alarms were still assumed to be false
these alarms were normalized the second
release was of oleum from a sample line
through through corroded pipe work
better had identified the corrosion a
year earlier after a different league
and made recommendations for thickness
monitoring program this had not been
implemented at the time the incident
occurred the third release was when a
hose containing phosgene burst spraying
an operator phosgene attacks and mucous
membranes for the body and it is a
highly toxic substance
although the worker initially seemed
okay he later died in hospital the
she was extracted from a canister into
the process via stainless steel braided
Teflon lined hoses given the
permeability of teflon to phosgene the
hoses were to be replaced every 30 days
however at the time of the incident they
had not been changed for approximately
seven months this was because the
maintenance system which prompted their
change out had been changed and the new
system was not providing reminders the
normalization of deviance however
occurred when earlier that day another
phosgene hose failed in service this
warning sign did not trigger checking
and replacing of the other hoses onto
the Costa Concordia the Costa Concordia
cruise ship struck rocks and eventually
sank when it failed at high speed to
close to an island in a maneuver called
a salute the reason for their salute is
usually to thrill passengers and people
on shore and how close the ship is
according to the prosecution of the
captain of the Costa Concordia over the
previous few months in Italy there does
appear to have been a history of Costas
ship performing salutes
over many many years this deviant
activity may have been normalized in the
company culture the captain was charged
with a range of offences including
manslaughter and deserting his post
after he left the ship while the
evacuation was still underway in
February 2012 he was found guilty and
sentenced to 16 years however in Italy
the verdict is not considered final
until after all his appeals are over
these appeals are still ongoing
measuring safety performance and success
by recording the number of incidents
that occur can embed normalization of
deviance logically the absence of one
thing is not proof of the presence of
another a lack of incidence is not
evidence that the workplace is safe
there may be a situation where the lack
of reported incidents is evidence of
normalization of deviance
and nothing has gone wrong yet it does
not mean that nothing will go wrong in
the future consider how you monitor
safety performance in your own
organization are you measuring success
by the absence of failure or actually by
the presence of success this is where
the lead metrics are so important we're
about to do a poll question now so
shortly a window will pop up on your
screen and you'll be able to select a
response to the question do you have
systems in place to identify when
deviants may become normalized you'll be
able to select yes no or don't know and
we cannot tell who is submitted each
answer as you answer the poll some
questions for you to consider do your
engineers make clear requests of what
they thereafter
how do people making the decisions
ensure they understand the consequences
of those decisions how a dissenting
views handled do you assume previous
successes are a justification to keep
going or do you prove it a safe is the
absence of failure seen as proof of
success so it looks like we have a few
people still coming in with that poll so
give it a couple more seconds
okay so let's take a look at these
results so we actually seen 25% of you
saying that yes you do have systems in
place to identify when deviance may have
become normalized and seventy-five
percent saying no so thank you for that
feedback so those of you that answered
the 25% that answered that you do have
systems in place to identify when
deviance has become normalized I've got
another question for you then and that
is how effective have these systems been
so I'll give you a chance to answer
those questions again so questions to
consider as you answer this time does a
system address confirmation bias
for example now images of the shuttle
were requested because they were
convinced they did not need them they
looked for data to justify their opinion
rather than challenging him this was
also seen in Macondo the results of the
well integrity testing were
misinterpreted in justifying that the
cement job was secure because it thought
it had to be a good cement job
so so far as that Paul comes in we're
seeing a lot of people saying that where
they did have processes in place they're
mostly effective though some don't quite
know at this stage so I'll just give
this poll another few seconds okay well
close that off there so what we're
seeing here is that for those of you
that said you did have systems in place
to identify aliens about 75% of you are
saying that you believe those systems
are effective at about 25 percent I'm
sure so I think that's an interesting
picture to see how well we think some of
our systems are are working in fact so
this now actually concludes the
technical aspect of the presentation so
I'd like to now move to any questions or
comments that you may have so
understanding that we did have a period
of time there where we lost audio
apparently and so I'm just going to go
back through a couple of the questions
and comments that were put in was there
a document documented link between tiles
disengaging or falling off and a major
accident there was certainly the
documented link from the perspective
that the Atlantis shuttle had had an ear
burn through event and it was purely by
chance that the tile that fell off came
from a region where the whole of the
aircraft was actually much thicker so it
suffered significant heat damage but it
didn't have a total burn through and
loss of structural integrity
what those systems are for the 25% that
had system so that's actually a really
good question for those of you that did
have those systems in place now you're
able to actually just jot down in that
chat box for us exactly what the what
sort of systems you're using so that we
can try and understand what others are
using and share that learning so you
know what are your learnings about how
to share and guard against normalization
of deviance in your organization's and
how well is that working for you so do
we have any suggestions from people
around that sort of information or any
other questions at all or comments
so what I might do then is move on to
talk about some of the upcoming webinars
that we have and if you have any
questions or comments or suggestions
around how the how people's areas work
you can then put them through so I've
just seen we've had some comments come
through and I've just lost them on my
screen somehow so I'll get to that's get
those back in a second on the 23rd of
March this year we have a webinar coming
up talking about the BP Texas City
refinery that actually marks its 10th
anniversary we've been fortunate enough
to secure dr. Paul Tebow to discuss that
particular incident Paul was actually a
member of the Baker panel which was the
panel that was developed to review the
cultural aspects of the US refineries
following that particular incident
following that Wilbur have another one
in June where we're actually going to be
talking about the lead process safety
metrics project that we've been working
on in the Safety Center and where we've
got to and then in November on the
anniversary of the Pike River Mine
explosion the fifth anniversary we'll
have a session talking about that as
well in terms of the ideas and comments
that people have come through with
things such as multi-tiered risk
assessments of deviations is one area
that a one model that people are using
and sign off by competent technical
authorities to ensure that they're
getting broad input into particular
topics
and other questions come through would
it be correct to say that people may not
have been able to construct the Columbia
disaster before the incident in any
hazard study that's an interesting
question and I would perhaps suggest
that they would have been able to given
the previous history that they had and
given certainly Columbia was by no means
the first major debris strike that that
had and also as I said with the Atlantis
shuttle that had launched several years
earlier there were certainly great
concern at that launch that they could
have an issue where they had thermal
damage sufficient that that shuttle may
not have been able to return and that's
certainly very clearly seen by the fact
that as soon as they immediately
discovered that they had some foam
shedding issues that they straightaway
had the crew inspect the shuttle which
as I mentioned is quite different to the
response to Columbia they had got to the
point in Columbia where they just
believed it was not possible to have the
issue as opposed to looking back into
their own history and seeing that they
had very clear warning signs that had
occurred and even the previous launch
where a significant chunk was taken out
of one over the solid rocket boosters by
the debris shower that occurred I'd
certainly recommend people read or take
a quick look at least through some of
the executive summary of the Columbia
report it's a very very interesting
report and it's not purely technical
based on the idea of a flight and how
those flight structures work it is
really more around the cultural
deficiencies that occurred within that
organization and how it has subsequently
changed it's a very interesting study of
a culture where there is no concept of
failure occurring and they had that in a
series of different different incidents
because they they could not conceive
failure given some of the six
that they had had in the past I'd also
recommend if anyone gets the chance to
visit a place like Kennedy Space Center
it is a very very interesting place to
visit to see the development of their
engineering over many many years but
also there are still elements of that
same culture around not being able to
conceive that something could go wrong
given the history that they had no we
don't appear to have any more questions
or comments coming through so apologies
once again for that loss of audio during
the presentation and I hope I managed to
go back to the right point so you could
hear the rest of it this webinar is
being recorded so it will be available
for viewing in your organization's after
this event and that will be available
through the Safety Center website at WWE
Safety Center org and in the supporters
area on the menu you can click straight
through to the webinars and you'll be
able to see it there and view it also if
you have any future comments around
webinars please contact us at Safety
Center and IQ me org if you have any
ideas of how to improve these obviously
with technology this is an important one
but also for the benefit or particular
topics that you'd like looked at or if
you'd like to be added to our e-mail
notification list so you get notified
directly I just had one last question
come through asking what time will the
BP Texas City session be off the top of
my head from memory at the moment I
believe it's about 10:00 a.m. Melbourne
time which is 7:00 a.m. earth time and
part of that is to be able to match in
the time zone so that Paul can join us
for that discussion I have
just seeing one more question come
through sorry that I have missed how
does the industry find that balance
between rewarding success versus
rewarding identification of deficiencies
in safety systems and deviation on the
basis of design that is a very very good
question does anyone have any thoughts
that would like to actually send through
to to assist with that that question I
think it is a very challenging balance
to go through and I think it's all part
of ensuring that you've established an
appropriate culture in an organization
to make sure that you do have people
accountable for what occurs you do need
to reward and celebrate success to a
certain degree in my experience but you
also need to make sure that there's a
real focus on where issues are occurring
that we're not hiding them or failing to
see them more to the point as we
endeavor to improve what's going on does
anyone else have any other thoughts
about how to balance that rewarding
success versus deficiencies another very
interesting way I've seen it referred to
is a comment around celebrating the red
on the scorecard and challenging the
green so really sending the message out
there that you're interested in
understanding and you want to see what
the deficiencies are and challenge when
no deficiencies are found because no
system that a human is involved with is
free of deficiencies
okay we haven't got any more comments
come through at this point in time on
questions ruff just another one Hopkins
has a good theory reward frontline
people for reporting incidents and
senior managers for safety outputs EDG
incident rates is that from Hopkins new
book that's just come out in his
discussions around reward systems for
bonus structures etc and how they
potentially drive unintended behaviors
and consequences in an organization okay
now I've got that answer through know he
believes that was out of the disastrous
decisions book which was the Macondo
review that Hopkins did thank you for
that so there's there is certainly some
some interesting areas I think I I have
some concerns around the idea of the
rewarding of management for the safety
outputs being the injury rates because
that comes back to that very topic of
looking at whether we are measuring the
success of something by the absence of
something else so the absence of
injuries or leaks does not mean that
we're not about to have one or that
we're not about to see something go
wrong quite significantly so I think we
need to to be very careful and and start
to move away from the idea of rewarding
people for lagging indicator results I
think we need to be moving far more
towards the leading space to ensure that
we actually see what's going on at that
point
okay thank you all very much for your
attendance I certainly hope that you
fall on this webinar both interesting
and thought-provoking just got another
comment come through sorry I think
you're right in rewarding the red
warning signs and completing RCA on the
warning signs before things go wrong and
I think that's a very very good good
comment it's around how do we then
strike that balance from the busyness
that we all exists in to make sure that
we give those areas the appropriate
attention and understand that the
warning sign has existed and appeared
and also that we review it to understand
how we can address it because there is
definitely a balance that does have to
come through around how we can actually
manage our day to day business because
we all still have jobs to do we all
still need to understand these things
and work through them so thank you very
much for that comment as I mentioned
this recording will be on the I kms
Safety Center website so I would like to
sign off there and thank you all very
much for your participation today thank
you
Weitere ähnliche Videos ansehen
Theory & Deviance: Crash Course Sociology #19
Deviance: Crash Course Sociology #18
Lost Youth (Viewer Discretion Is Advised) | WorkSafeBC
Space Shuttle Challenger Disaster: Major Malfunction | Retro Report | The New York Times
Algebra 6.1 - Absolute Value
MILAGRE do RIO HUDSON: O HERÓI TRATADO COMO VILÃO...
5.0 / 5 (0 votes)