Normalisation of deviance

Summary

This webinar, hosted by Trish Caron, Director of the IME Safety Center, delves into the concept of 'normalization of deviance', a phenomenon where warning signs are ignored due to complacency. Using the Columbia space shuttle disaster as a case study, the presentation explores how repeated deviations from safety protocols can become normalized, leading to catastrophic outcomes. It also examines historical incidents across various industries to highlight the dangers of this phenomenon and emphasizes the importance of recognizing and addressing deviance to prevent future tragedies.

Takeaways

• 🚀 The concept of 'normalization of deviance' was introduced by sociologist Diane Vaughan, highlighting the dangers of ignoring warning signs due to complacency or false assumptions of safety.
• 🔍 The Columbia Space Shuttle disaster serves as a case study for normalization of deviance, where foam insulation damage during launch was initially a concern but later became an accepted risk, leading to catastrophic failure.
• 📈 NASA's history of debris strikes on shuttles shows a pattern of increasing acceptance of risk, with incidents like the Atlantis shuttle's near burn-through event and the Columbia disaster illustrating the dangers of complacency.
• 🛠️ The Challenger disaster in 1986 also exemplifies normalization of deviance, where known design flaws in the O-rings were deemed acceptable risks, leading to the explosion and loss of the crew.
• 🔥 The BP Texas City refinery explosion and the Deepwater Horizon disaster both demonstrate how deviations from standard procedures and confirmation bias can lead to major accidents.
• 🌋 The Pike River coal mine disaster in New Zealand shows how normalization of high methane levels led to a fatal explosion, despite clear warning signs being ignored.
• 🛳️ The Costa Concordia cruise ship disaster highlights how routine deviations from safety protocols, such as performing salutes too close to shore, can become normalized and lead to tragedy.
• 🔍 The importance of monitoring and maintaining safety instruments was emphasized, as failed or ignored instruments can lead to critical information being overlooked, as seen in the Columbia disaster.
• 🤔 The webinar discusses the need for organizations to focus on proving systems and actions are safe, rather than assuming they are safe until proven otherwise, to prevent complacency and normalization of deviance.
• 📊 The discussion on measuring safety performance by the absence of incidents can embed normalization of deviance, as the lack of reported incidents is not necessarily evidence of a safe workplace, but could indicate ignored warning signs.

Q & A

What is the main topic of the IME Safety Center webinar presented by Trish Caron?

The main topic of the webinar is the concept of 'normalization of deviance,' which refers to the phenomenon where warning signs are ignored or become unnoticed over time, leading to potential safety risks.

Who introduced the term 'normalization of deviance' and in what context?

Sociologist Diane Warren introduced the term 'normalization of deviance' in her 1996 book 'The Challenger Launch Decision,' which was about the Challenger space shuttle disaster.

What is the significance of the Columbia space shuttle case study in the webinar?

The Columbia space shuttle case study is used to highlight the factors around normalization of deviance, as it is a well-documented incident where such behavior led to the tragic loss of the shuttle and its crew.

What was the role of foam insulation in the Columbia space shuttle disaster?

The foam insulation from the external tank broke away during launch and struck the left wing of the orbiter, damaging the thermal protection system, which ultimately led to the shuttle's disintegration upon re-entry.

How did NASA's response to debris strikes evolve over time, as illustrated by the case studies?

Initially, debris strikes were considered a safety of flight issue, but over time they became an accepted risk and were normalized within the organization, leading to a shift in focus from addressing the issue to merely analyzing the probability of damage.

What was the initial design specification for the Space Shuttle program and how did it differ from the reality?

The initial design specification for the Space Shuttle was to provide routine access to space with around 50 flights per year. However, by 1989, it was only conducting 24 flights a year due to budget overruns and capability issues.

What cultural factors within NASA contributed to the normalization of deviance?

Cultural factors included a hubris associated with past successes, a rejection of criticism and externally imposed changes, and a focus on proving systems and actions were safe rather than proving they were unsafe.

How did the Challenger and Columbia investigations reveal similar cultural issues within NASA?

Both investigations found a failure to learn from past incidents, inadequate concerns over deviation from expected performance, and a silent safety program within the human spaceflight area of NASA.

What is the importance of leading versus lagging safety performance metrics in identifying normalization of deviance?

Leading metrics focus on proactive measures and can help identify potential issues before they become normalized, whereas lagging metrics like incident counts can embed normalization of deviance by focusing on the absence of incidents as a measure of safety.

What are some strategies organizations can use to prevent the normalization of deviance, as suggested by the webinar?

Strategies include multi-tiered risk assessments, sign-off by competent technical authorities, rewarding the identification of deficiencies, and focusing on leading safety performance metrics.

How can the concept of confirmation bias contribute to the normalization of deviance?

Confirmation bias can lead individuals to seek out and interpret information in a way that confirms their pre-existing beliefs, potentially normalizing deviance by overlooking or dismissing warning signs that contradict the belief in a safe and successful operation.

Outlines

00:00

🚀 Introduction to IME Safety Center Webinar

Trish Caron, the director of the IME Safety Center, introduces the second member webinar on the topic of 'normalization of deviance.' She outlines the webinar's structure, including the opportunity for audience interaction through chat, and promises to address questions throughout and at the end. The concept of normalization of deviance is introduced, with a historical reference to Diane Warren's work and its significance in the Columbia and Challenger space shuttle disasters. The Columbia case study is highlighted to discuss the consequences of ignoring warning signs, such as equipment malfunctions that are dismissed as false alarms.

05:01

🔍 The Columbia Shuttle Disaster: A Case Study

This section delves into the Columbia shuttle disaster, detailing the mission's history, the launch delay, and the incident involving foam insulation from the external tank damaging the orbiter's thermal protection system. The report from the Columbia Accident Investigation Board is referenced, showing a pattern of foam debris strikes on space shuttles and how they were normalized over time. The narrative describes how NASA's response to these incidents evolved from active concern to acceptance, culminating in the Columbia disaster where the foam strike was not considered an anomaly due to its normalized status.

10:03

🛠️ The Challenger Incident and NASA's Cultural Acceptance of Deviance

The discussion shifts to the Challenger incident, examining the cultural acceptance of deviance within NASA that led to the tragedy. The focus is on the Challenger's o-ring failure, which was a known issue that had been normalized due to previous successful launches despite the risks. The presentation critiques NASA's safety management system, highlighting the lack of problem reporting, trend analysis, and the involvement of experts in critical decisions. It emphasizes the importance of proving safety rather than the absence of danger and reflects on the cultural hubris that contributed to the failure to learn from past incidents.

15:10

📈 Normalization of Deviance in Various Industries

This part of the script broadens the discussion to include normalization of deviance across different industries, citing examples such as the Pike River coal mine explosion, the BP Texas City refinery incident, the Deepwater Horizon disaster, and the grounding of the Costa Concordia. It emphasizes the common thread of accepting deviations from safety standards as normal operating procedures, leading to catastrophic outcomes. The summary serves as a cautionary note on the dangers of complacency and the importance of learning from warning signs.

20:10

🔧 The Dangers of Measuring Safety by Incident Absence

The script addresses the flawed approach of gauging safety performance solely by the absence of incidents, which can mask underlying issues and embed normalization of deviance. It challenges the audience to consider their own organization's methods of monitoring safety, whether they focus on the absence of failure or the presence of success. The section ends with a poll question to engage the audience in reflecting on their safety monitoring systems and their effectiveness.

25:13

🤔 Audience Engagement and Future Webinars

The script concludes with an interactive segment inviting audience questions and comments, acknowledging the earlier audio loss and reviewing some of the questions that were submitted. It also provides information on upcoming webinars, including one on the BP Texas City refinery incident with Dr. Paul Tebow and sessions on lead process safety metrics and the Pike River Mine explosion anniversary. The section encourages sharing of ideas and suggestions for improving webinars and for topics of interest.

30:20

🔄 Balancing Reward and Accountability in Safety Management

The final part of the script explores the challenging balance between rewarding success and identifying safety deficiencies. It discusses the potential unintended consequences of reward systems based on safety outputs like incident rates, which may not accurately reflect the underlying safety culture or the presence of potential risks. The conversation touches on the need to move away from lagging indicators to leading indicators, emphasizing the importance of proactive safety management.

Keywords

💡Normalization of Deviance

Normalization of deviance refers to the phenomenon where unconventional or risky practices become accepted as normal due to repeated exposure, leading to a reduced sensitivity to potential dangers. In the context of the video, this concept is central to understanding the cultural and systemic failures that led to disasters like the Columbia space shuttle incident. The script discusses how repeated foam debris strikes on the shuttles were initially a concern but over time became 'normalized', leading to a disregard for the associated risks.

💡Columbia Accident Investigation Board

The Columbia Accident Investigation Board is a committee that was formed to investigate the Space Shuttle Columbia disaster. The video script mentions this board in relation to the report published in 2003, which detailed the findings on the causes of the Columbia disaster, highlighting the role of normalization of deviance in the incident.

💡Thermal Protection System

The Thermal Protection System (TPS) on a space shuttle is designed to protect the vehicle from the intense heat experienced during re-entry into Earth's atmosphere. In the script, it is mentioned that foam insulation broke away from the external tank and damaged the TPS on the Columbia shuttle, leading to catastrophic consequences. This system's importance and the failure to address repeated foam strikes underscore the normalization of deviance.

💡STS-107

STS-107 refers to the Space Shuttle mission编号, which was the mission during which the Columbia disaster occurred. The script uses this term to discuss the specific events and decisions that led to the tragedy, emphasizing the mission's long duration and the various delays that occurred before its launch.

💡Foam Debris Strikes

Foam debris strikes are incidents where foam insulation from the external tank of the space shuttle breaks off and hits the shuttle during launch. The script provides a history of these strikes, noting that they were initially considered a safety issue but eventually became normalized as an acceptable risk, contributing to the disaster in the case of Columbia's STS-107 mission.

💡Safety Culture

Safety culture encompasses the values, attitudes, and practices that determine the effectiveness of an organization's approach to safety. The video script discusses the safety culture at NASA, highlighting how a lack of proper safety culture and failure to learn from previous incidents contributed to the normalization of deviance and subsequent disasters.

💡Risk Analysis

Risk analysis is the process of evaluating the likelihood and consequences of potential hazards. In the script, it is mentioned that NASA conducted risk analysis on the debris strikes but failed to take appropriate action, instead normalizing the risk as acceptable, which is a key aspect of the normalization of deviance.

💡Confirmation Bias

Confirmation bias is the tendency to favor information that confirms one's existing beliefs or hypotheses. The script discusses this concept in the context of the Macondo well blowout, where test results were misinterpreted to confirm the belief that the cement job was secure, illustrating the danger of confirmation bias in safety-critical decisions.

💡Lead and Lag Metrics

Lead metrics are indicators that suggest future performance, while lag metrics reflect past performance. The script emphasizes the importance of lead metrics in safety management, cautioning against the reliance on the absence of incidents (lag metrics) as proof of safety, which can mask underlying issues that normalization of deviance might have caused.

💡High-Reliability Organizations

High-reliability organizations are those that consistently operate in complex, hazardous environments with a strong focus on safety and reliability. The script implies that NASA and other organizations involved in the incidents discussed should strive to be high-reliability organizations by addressing and learning from the normalization of deviance.

💡Morton Thiokol

Morton Thiokol is the manufacturer of the o-rings that were implicated in the Challenger Space Shuttle disaster. The script refers to Morton Thiokol engineers' concerns about the o-rings' performance in cold temperatures, which were initially considered a deviance but eventually became normalized, leading to the tragic explosion of the Challenger.

Highlights

Introduction of Trish Caron, Director of the IME Safety Center, and her background in engineering and process safety.

Definition of 'normalization of deviance' as a concept introduced by sociologist Diane Vaughan, relating to ignoring warning signs due to desensitization.

The role of normalization of deviance in the Columbia Space Shuttle disaster, with a detailed case study of the incident.

Historical data on foam debris strikes on space shuttles, indicating a pattern of accepted risk over safety.

Challenger incident's influence on the understanding of normalization of deviance within NASA's culture.

Cultural analysis of NASA showing a pattern of ignoring safety warnings and a failure to learn from past incidents.

The impact of budget pressures and staff reductions on safety protocols and the normalization of deviance.

Discussion on the importance of distinguishing between proving systems and actions are unsafe versus proving they are safe.

Examples of normalization of deviance from various industries, including the BP Texas City refinery and the Deepwater Horizon rig.

The concept of confirmation bias in safety management and its role in misinterpreting warning signs.

The Pike River coal mine disaster and the normalization of methane levels as a production issue rather than a safety one.

The challenge of balancing rewarding success with identifying and addressing safety deficiencies within organizations.

The idea of celebrating 'red' on the scorecard, which refers to acknowledging and addressing deficiencies in safety systems.

Importance of leading indicators in safety performance measurement over lagging indicators to prevent normalization of deviance.

Strategies for identifying when deviance may become normalized within an organization and the effectiveness of these systems.

Upcoming webinars on safety topics, including the BP Texas City refinery incident and the Pike River Mine explosion.

Transcripts

hello and welcome to the IME Safety

Center webinar this is the second member

webinar we have hosted and we plan to

host many more in the future

my name is Trish Caron and on the

director of the ikm Safety Center

I joined IQ me to lead development of

the IQ in January 2014 prior to that I

had a career working in engineering

operations and Process Safety in the oil

and gas and chemical industries the

topic for this webinar is normalization

of deviance

as we progress through the webinar

you'll be able to ask questions or make

comments by typing in the chat box on

the right hand side of your screen

please make sure you select entire

audience so everyone can see your

comments we will endeavor to answer your

questions both during and at the

conclusion of the presentation so what

is normalization of deviance the concept

of normalization of deviance was raised

by sociologist Diane Warren in her 1996

book the Challenger launch decision

following this and the Columbia incident

she was then invited to join the

Columbia accident investigation board

the concept of normalization of deviance

is basically not taking heed of warning

signs because you just don't notice them

this warning signs anymore for example

you may have a piece of equipment that's

constantly in an alarm state you either

stop noticing the alarm or justify that

it's okay because it's a false alarm

rather than address what's causing it

you may miss the real alarm by always

assuming it's false we're going to talk

a little bit about the columbia space

shuttle as a case study here and this

case study has been chosen to highlight

the factors around normalization of

deviance as it's a very clearly

documented incident in the Columbia

accident investigation board report

which was published in 2003 Columbia was

on its 28th flight and

113 space shuttle mission it was

designated space transportation system

sts-107 it was a long mission of 16 days

in orbit sts-107 was initially scheduled

for launch in May 2000 but this was

delayed until January 2003 for various

reasons shuttle launches can be delayed

over time and they basically maintain

that original designation so in this

instance for example sts-112 flew before

sts-107 during the launch when the

external tank disconnected from the

orbiter foam insulation broke away from

what's called the bipod ramp and struck

the left wing of the orbiter during the

investigation into the incident it was

determined this foam damaged the thermal

protection on the orbiter the thermal

protection is designed to protect the

orbiter during the extreme heat build-up

that occurs on re-entry into the Earth's

atmosphere this table taken from the

Columbia accident investigation board

report volume 1 shows a history of major

foam debris strikes on space shuttles

there were 14 instances in all when

significant damage occurred or there was

a large foam loss looking at mission

sts-27 are with Atlantis the Atlantis

orbiter suffered a near burn through

event when it lost a thermal tiles due

to excessive foam debris strikes on

mission STS 35 this appears to be when

NASA started to define debris hits as a

reuse or turnaround issue rather than

just a safety of flight issue mission

STS 50 appears to be when debris strikes

become an accepted risk in the

organization STS 56 is when strikes are

now considered commonplace and

acceptable mission sts-112 also suffered

a significant debris strike

in this instance it was not even

considered to be an anomaly because

there are now the situation where phone

strikes are expected on launch when

finally mission sts-107 in January of

2003 with the Columbia launch occurred

the Columbia broke up on re-entry after

suffering tile damage from the foam

debris impact and to burn through events

which led to the orbiter becoming

unstable the shuttle program was delayed

in its early phases due to issues with

the thermal tiles in fact as they were

developing the design of the orbiter

that took a very long time to install

the tiles and they would often fall off

after installation and have to be

reinstalled this led to new adhesives

being developed to ensure that the tiles

actually stayed in place damage to the

thermal tiles was initially a concern to

NASA and they started to develop a

method for repairing the tiles in orbit

but this was unsuccessful and eventually

they cancelled these efforts they were

also unable to stop the throne shedding

issue so interestingly rather than

focusing on making the orbiter more

resistant to impact strikes they

actually put a lot of effort into

analyzing the probability of damage they

then didn't do anything with this risk

analysis they basically just analyzed it

the repair program as well as a visual

inspection of the orbiter after launch

was reinitiated following the Columbia

loss the visual inspections are or were

achieved in the last launches of the

shuttle system either via satellite

ground-based imagery or if the orbiter

was docking at the International Space

Station it was observed by the space

station crews visually before docking to

see whether there was any damage to be

concerned about and therefore

potentially repair whilst in orbit this

image here

shows you the space shuttle in its

entirety so the Space Shuttle term

refers to the orbiter the external tank

and the solid rocket boosters the orange

tank in the middle is the external tank

and the small red circle at the top is

where the bipod ramp is this is where

the phone breaks off when the shuttle

actually launches and the external tank

separates the red circle down towards

the bottom is the debris strike region

where the Columbia was actually struck

with the foam that had broken away and

this is actually Columbia on its launch

pad prior to launch

in 2003 the Space Shuttle design project

started in earnest in 1972 it was

initially designed to be a routine form

of transport to orbit with around 50

flights per year and commercial

contracts to launch satellites to assist

with its funding however by 1989 it was

only conducting 24 flights a year the

budgeting for the system was overrun and

it was not generating the expected

revenue due to capability issues the

shuttle however was declared operational

in 1982 and ready to provide economic

and routine access to space this was

more for political purposes because the

system was proving difficult to operate

with more maintenance required between

flights than had been expected rather

than leading the 10 working days

projected in 1975 to process a return to

orbiter for its next flight by the end

of 1985 an average of 67 days had

elapsed before a shuttle was ready for

launch the original design specification

also did not include protection from

debris strikes

therefore the occurrence of a debris

strike was a violation or deviance from

the specification in fact even as the

shuttle orbits earth whilst in orbit it

actually orbits in a reverse and

upside-down direction to protect its

sensitive areas so that it doesn't

suffer debris impacts from anything

in the Earth's orbit as well

normalization of deviance in NASA

predated the Columbia incident there are

striking similarities with the cultural

acceptance of deviation but extended

back to the challenger incident

Challenger or mission STS 51 L had been

delayed several times and pressure was

mounting for launch there was also a lot

of media focus and the space shuttle

program was striving to become more

relevant so some of you may remember

that space shuttle Challenger actually

had a middle school teacher on board

because they were going to try and raise

the profile of the space program by

engaging with students and schools all

over America the schedule was put a head

of engineering considerations that the

ambient temperature was outside previous

experience and the o-rings became

brittle in lower temperatures the chief

engineer was actually told to take his

engineering had often put his management

on to make a launch decision when the

engineers from the o-ring manufacturer

raised concerns about the temperature of

launch the NASA safety program was

infective and remained silent the onus

was on the contract engineers to prove

that it was unsafe rather than a focus

on proving it was safe

prior to STS 51 L when the o-ring began

behaving in unexpected ways rather than

testing the joint NASA and Morton

Thiokol the manufacturer came to see the

deviation as an acceptable flight risk a

violation of design that could be

tolerated

the Challenger investigation also found

that the safety management system in

particular elements involving problem

reporting trend analysis interpretation

of criticality and involvement of

experts in critical decisions were all

severely lacking thinking about your own

organizations do you focus on proving

systems and actions are unsafe or

proving they are safe and it's a very

important distinction between those two

while there were recommendations to

address the cultural issues following

Challenger the human spaceflight area of

NASA remained largely unaffected human

spaceflight was the area responsible for

managing the shuttle program this led to

inadequate concerns over deviation from

expected performance silent safety

program and schedule pressure being

entrenched in the organization this was

compounded by budget pressure and a

reduction in staffing that had occurred

during all of this culturally there's a

hubris associated with success

regardless of the Challenger incident

itself this was the organization that

had put a man on the moon and developed

the space shuttle program miss then it

was not possible for them to believe

failure could occur in their culture the

culture rejected criticism

recommendations and externally imposed

changes the findings of both Challenger

and Columbia investigations are similar

from a cultural perspective very clearly

a failure to learn there some thermal

protection areas are so fragile file

they can be damaged with a fingernail

engineers were quoted as saying that if

they had known the external tank was

going to produce the debris shower that

occurred on launch they would have had a

very difficult time clearing Columbia

for launch over the life of the program

up to sts-107 orbiters landed with an

average of 143 divots on upper and lower

surfaces with 31 of these everything

over one inch in one dimension efforts

were made to modify the foam and bipod

connectors but when this proved too

difficult the word ik c s-- eventually

the damage was seen as merely a delay in

preparation for the next flight rather

than a safety of slight issue for the

current flight because after all the

previous orbiters had all returned

safely

sts-112 which flew a few months before

sts-107 suffered a bipod ramp foam

shedding incident which resulted in a

three inch by 4 inch dodge in the foam

on one of the solid rocket boosters this

was a very big warning signal that was

normalized it was not even recognized as

an in-flight and long link with each

successful landing engineers and

managers regard the phone shedding and

inevitable and unlikely to impact on

safety that is it had become an

acceptable risk as the acceptance of

debris strikes increased the one in

which they were handled changed

significantly after the discovery of a

debris strike on flight day two of

sts-27 are with Atlantis in 1988 the

crew was immediately directed to inspect

the orbiter using its space arm while so

able to view some of the damage they

weren't actually able to see that there

was a missing tile the location of where

the tile was lost was fortunately a much

thicker aluminum plate which prevented a

total burn through though the orbiter

skin that was damaged on return to the

atmosphere the engineers were surprised

at the extent of the damage when that

shuttle actually landed 707 impacts with

298 of them greater than 1 inch and a

missing tile as the commander had said

it looked like she'd been lasted with a

shotgun 14 years later when a debris

strike was discovered on flight day 2 of

sts-107 with Columbia shuttle program

management declined to inform the crew

or have them inspect the orbiter for

damage they declined multiple requests

for on-orbit imaging to inspect the

tiles on the orbiter and ultimately they

discounted the possibility of a burn

through interestingly debris strikes

continued to be an issue for the shell

program up until its final mission this

photo shows some thermal tile damage

from the final shuttle mission STS

one three five with Atlantis the orbiter

Atlantis is on display at Kennedy Space

Center in the condition she landed in

and this sort of damage is very evidence

if you ever have the opportunity to see

one of the shuttles on display it was

standard protocol for high-resolution

footage of launches to be examined for

anomalies the team reviewing the footage

were concerned there may have been

damage to the thermal tiles due to the

debris strike multiple requests were

made to inspect the orbiter during the

mission the first was a request for the

crew to do a visual inspection that

request to the engineering Directorate

was never answered three separate

requests were made over several days to

obtain high-resolution footage of the

orbiter in orbit to determine if there's

any damages concern each of these

requests was eventually rejected as

being unnecessary without images the

debris assessment team could only

estimate using mathematical models which

were actually not designed for that

purpose to postulate potential damage it

was estimated that there may be

localized heat damage but they could not

definitively say structural damage would

occur more batters are monitored with an

exclusion zone while in orbit on

slightly two of the mission an

additional object appeared in orbit with

the orbiter for almost an hour this was

detected via the exclusion zone

monitoring it was not possible to

conclusively determine what it was that

the size and shape was consistent with a

reinforced carbon-carbon panel fragment

it was possible that this was when the

damaged tile fell off the orbiter the

crew were informed of the debris strike

on flight day 8 and they were told it

was not a concern and they had nothing

to worry about the only reason they were

actually informed is because they were

about to do media interviews on flight

down May 10 and it had become public

knowledge throughout the u.s. that there

was some concern about a debris strike

so they were informed so that they

weren't surprised in an interview when

they were asked about it

foam impacts have been normalized there

are maintenance turnaround issue rather

than a threat to safety was an

identified and acceptable risk not a

flight safety issue we can consider that

this is actually similar to the Pike

River coal mine explosion where

excessive methane levels were seen to be

a production related issue rather than a

safety one high levels had been accepted

the Columbia Auditor was unique she was

the first orbiter to be launched and she

had additional instrumentation to

validate performance and design over her

life of 28 missions the additional

instrumentation began to fail as it was

installed for design validation it was

not maintained or repaired on failure

failed instrumentation meant results

could not be relied upon even though the

results were logged unexpected results

from the sensors in her left wing were

assumed to experience though they may

have been an indication of the impending

breakup it's worth considering how your

facilities are instrumented what are

your instruments telling you are you

measuring the right things what are you

doing with the data how are your

instruments being maintained is data

being ignored because it might be

spurious or from instruments that are

considered no longer necessary there

have been several incidents where

evidence of normalization of deviance

have contributed to the outcome a

selection across different industries

have been chosen here the Challenger

Space Shuttle in 1986 when the Space

Shuttle exploded 73 seconds after launch

with the loss of all seven crew the

greatly coal mine flood in 1996 when an

underground mines flooded when they

broke through to some disused and

flooded mine tunnels there were four

fatalities in 2005 the BP Texas City

refinery with the overfilling if the

raffinate splitter tower resulting in a

loss of containment and subsequent

explosion and 15 felonies

in Macondo in 2010 with the well blowout

resulting in 11 fatalities significant

oil filler on the sinking of the reed

the Pike River coal mine in 2010 29

miners died when they were trapped in

the underground mine after a series of

explosions due to methane buildup DuPont

toxic chemical releases in 2010

resulting in one fatality at the Bell

West Virginia site and something a

little war left field the Costa

Concordia in 2012 the grounding and

sinking of the passenger ship with the

loss of 32 lives let's go into these in

a bit more detail to highlight the

normalization of deviance that occurred

so a little bit more on the Challenger

Space Shuttle the o-rings in the socket

rock solid rocket boosters were designed

to create a pressure seal to contain the

solid rocket motors over a series of

previous flights it was noted that the

o-rings were being eroded during the

launch process this became a known

design flaw it was also known that the

o-rings performed worse when it became

brittle under colder ambient conditions

this design flaw became acceptable to

NASA as there had been no negative

consequences of the known issue at the

time of launching challenger the ambient

temperature was lower than previous

launches the Morton Thiokol engineers

who designed the o-rings were concerned

that this was outside of their known

experience where actually recommended

against launch in the predicted weather

conditions however the deviance of

earrings being eroded had been so

normalized in the organization that the

decision to launch was made the risk was

deemed acceptable because nothing bad

had happened to previously the results

as we know was the destruction of the

orbiter and the loss of the entire crew

shortly after launch the greatly mine

near Newcastle in New South Wales was

located in an area rich with black coal

calories had been present in the region

since the eighteen hundreds

initially the mine it greatly was quite

some distance away from old abandoned

tunnels which

over the years had flooded 1994 the

decision was made to expand the greatly

mind and drawings of the old tunnels are

obtained these were unfortunately

incorrect and as a result the abandoned

tunnels were 100 meters closer than

thought in the weeks leading up to the

incident warning signs began to appear

that the miners were getting closer to

the abandoned tunnels

however these warnings were ultimately

dismissed the district was typically a

wet one

however Gretna 9 was always considered

to be a drier mine in fact it did not

have pumps installed when the miners

started to report seepage and

accumulation of water it should have

been a warning that they may have been

getting closer to flooded tunnel forced

over the two weeks leading up to the

flood there were reports of nuisance

water in one report the question was

actually asked were not close to the old

mine are we the increased presence of

water was normalized as the coal seam

just giving out a considerable amount of

water the presence of water in this

increasing quantity was deviant but was

normalized as nothing to be concerned

about BP Texas City refinery the AH

summarization unit was being restarted

after a shutdown the procedure required

pumping of raffinate through the

splitter tower however it was common

practice to deviate from the procedure

and block flow out of the tower this was

done to avoid losing liquid level in the

tower during startup which may have

damaged equipped equipment the previous

experience by the operators was that

they could get sudden drops from the

level in the tower so they adapted the

way they started it to compensate

compounding this issue was the

acceptability to start the tower even

though there were reported malfunctions

with the level gauges and pressure

control valve on the tower another

deviation from procedures was the lack

of additional staff during startup of

the isomerization unit as required by BP

safety guidelines

the tower overflowed to a blowdown drum

rather than to a flair system this was

despite numerous recommendations to

install the flare system the blowdown

zone was a deviation from current

accepted engineering design and had

resulted in numerous releases to

atmosphere of flammable liquids in the

past the Deepwater Horizon drill rig had

just completed drilling the Macondo well

and was preparing to leave the area this

process included completing the cement

ceiling of the well and removal of heavy

drilling mud from the riser provided the

cement ceiling was successful removing

the mud would not result in any safety

issues once the cement ceiling had been

completed it was declared a success by

the engineers undertaking it this

declaration set up the expectation that

all subsequent tests which showed had

been a success the focus of well

integrity tests then shifted to confirm

that it was sealed rather than to

investigate whether it was sealed yet

again a very subtle difference in

thought however in this instance the

cement ceiling had been unsuccessful and

the well was not sealed this highlight

of the concept of confirmation bias as

well where people have the subconscious

preference to look for information that

confirms their beliefs rather than

refutes them normalization of deviance

came into play during the confirmation

bias that occurred with the Lovell

integrity testing warning signs showing

that cement ceiling was unsuccessful

were justified away the explanations

that did not call into doubt the

integrity with the nations that did not

call into doubt the integrity of the

cement ceiling this can be a challenge

in interpreting the warning signs some

explanations of them may be benign but

if a confirmation bias has already

established that there is success the

deviation may be normalized

the Pike River coal mine was an

underground mine and it shipped its

first coal in February 2010 so there's a

time of the explosion in November 2010

it was still a very new mine it did

however have some very unusual design

features the main ventilation fan was

located underground rather than above

which is the conventional design this

difference contributed to the

ventilation system deficiencies which

meant it was not able to handle the

level of methane being liberated by the

mining process employed this was

exacerbated by the hydro mining which

was liberating higher levels of methane

in this particular mine the performance

of the ventilation system seen as an

Operations issue that impacted

production and not safety this was

because the accumulation of methane

triggered production stoppages because

of the focus on production some methane

detectives were actually bypassed to

prevent these stoppages although the

levels of methane were manually recorded

on a shift or shift basis but no action

was taken when these readings

consistently showed excessive levels the

deviance of high methane levels was

normalized and mining continued it's not

known what the ignition source was for

the initial explosion and after many

years despite the attempts to recover

the remains of the miners their bodies

remain in the mine the decision to cease

attempting to extract them was made in

December 2014

in 2010 the Daponte

Bell West Virginia facilities suffered a

series of significant incidents the CSB

chose to investigate them over the

concern that three very significant

incidents could occur over a two day

period the first release was of methyl

chloride by a ruptured bursting disc

this then allow the substance to leak

back into the building for five days

through a poorly designed vent before it

was discovered

the bursting disc had sensors connected

to it

however from experience they were

unreliable so the alarms were just

assumed to be false or a nuisance prior

to this incident though new more

reliable sensors had been installed this

hadn't been communicated to the

operators and they hadn't been trained

on the new sensors so the alarms were

still assumed to be false the alarms

were normalized the second release was

of oleum from the sample line through

corroded pipe work though they had

identified corrosion a year earlier

after a different leak and made

recommendations for thickness monitoring

program it had not been implemented at

the time of this incident the third

release was when a hose containing

phosgene burst spraying an operator

phosgene is a highly toxic substance

that attacks the mucous membranes of the

body and though the worker initially

seemed okay he did go to hospital for

observation and later died in hospital

the phosgene was extracted from a

canister into the process via a

stainless steel braided teflon lined

hose given the permeability of teflon to

fourth gene the hoses were to be

replaced every thirty days however at

the time of the incident they had not

been changed for approximately seven

months this was because the maintenance

system which prompted the change out had

been changed and the new system was not

sending reminders the normalization of

deviance however occurred when earlier

that day and now the phosgene hose had

failed in service this provided a

warning signal to the operators but no

checks were done on the other

phosgene hoses it was assumed that

everything was still okay so there was

no checks and no reply estimate other

hoses prior to this incident occurring

the Costa Concordia cruise ship this

ship struck rocks and eventually sank

when it sailed at high speed too close

to an island in a maneuver called a

salute the reason for a salute is

usually to give passengers MP I believe

we're now back online apologies for that

interruption I'm not sure what happened

with the audio what I might do is just

go back a couple of incidents I'm not

sure at which point we actually dropped

out I believe it was the DuPont facility

so I'm going to go back to the start of

the DuPont incident again and my

apologies for that technical glitch the

CSB chose to investigate the Bell

facility I have a concern that three

significant incidents could occur over a

two day period the first release was of

methyl chloride via a ruptured bursting

disk this then followed the substance

allowed the substance to leak back into

the building for approximately five days

to a poorly designed vent prior to it

being discovered the bursting disc had

sensors connected to it whoever it is

they were unreliable so alarms were

assumed to be false or nuisance prior to

the incident though new more reliable

sensors had been installed but the

alarms were still assumed to be false

these alarms were normalized the second

release was of oleum from a sample line

through through corroded pipe work

better had identified the corrosion a

year earlier after a different league

and made recommendations for thickness

monitoring program this had not been

implemented at the time the incident

occurred the third release was when a

hose containing phosgene burst spraying

an operator phosgene attacks and mucous

membranes for the body and it is a

highly toxic substance

although the worker initially seemed

okay he later died in hospital the

she was extracted from a canister into

the process via stainless steel braided

Teflon lined hoses given the

permeability of teflon to phosgene the

hoses were to be replaced every 30 days

however at the time of the incident they

had not been changed for approximately

seven months this was because the

maintenance system which prompted their

change out had been changed and the new

system was not providing reminders the

normalization of deviance however

occurred when earlier that day another

phosgene hose failed in service this

warning sign did not trigger checking

and replacing of the other hoses onto

the Costa Concordia the Costa Concordia

cruise ship struck rocks and eventually

sank when it failed at high speed to

close to an island in a maneuver called

a salute the reason for their salute is

usually to thrill passengers and people

on shore and how close the ship is

according to the prosecution of the

captain of the Costa Concordia over the

previous few months in Italy there does

appear to have been a history of Costas

ship performing salutes

over many many years this deviant

activity may have been normalized in the

company culture the captain was charged

with a range of offences including

manslaughter and deserting his post

after he left the ship while the

evacuation was still underway in

February 2012 he was found guilty and

sentenced to 16 years however in Italy

the verdict is not considered final

until after all his appeals are over

these appeals are still ongoing

measuring safety performance and success

by recording the number of incidents

that occur can embed normalization of

deviance logically the absence of one

thing is not proof of the presence of

another a lack of incidence is not

evidence that the workplace is safe

there may be a situation where the lack

of reported incidents is evidence of

normalization of deviance

and nothing has gone wrong yet it does

not mean that nothing will go wrong in

the future consider how you monitor

safety performance in your own

organization are you measuring success

by the absence of failure or actually by

the presence of success this is where

the lead metrics are so important we're

about to do a poll question now so

shortly a window will pop up on your

screen and you'll be able to select a

response to the question do you have

systems in place to identify when

deviants may become normalized you'll be

able to select yes no or don't know and

we cannot tell who is submitted each

answer as you answer the poll some

questions for you to consider do your

engineers make clear requests of what

they thereafter

how do people making the decisions

ensure they understand the consequences

of those decisions how a dissenting

views handled do you assume previous

successes are a justification to keep

going or do you prove it a safe is the

absence of failure seen as proof of

success so it looks like we have a few

people still coming in with that poll so

give it a couple more seconds

okay so let's take a look at these

results so we actually seen 25% of you

saying that yes you do have systems in

place to identify when deviance may have

become normalized and seventy-five

percent saying no so thank you for that

feedback so those of you that answered

the 25% that answered that you do have

systems in place to identify when

deviance has become normalized I've got

another question for you then and that

is how effective have these systems been

so I'll give you a chance to answer

those questions again so questions to

consider as you answer this time does a

system address confirmation bias

for example now images of the shuttle

were requested because they were

convinced they did not need them they

looked for data to justify their opinion

rather than challenging him this was

also seen in Macondo the results of the

well integrity testing were

misinterpreted in justifying that the

cement job was secure because it thought

it had to be a good cement job

so so far as that Paul comes in we're

seeing a lot of people saying that where

they did have processes in place they're

mostly effective though some don't quite

know at this stage so I'll just give

this poll another few seconds okay well

close that off there so what we're

seeing here is that for those of you

that said you did have systems in place

to identify aliens about 75% of you are

saying that you believe those systems

are effective at about 25 percent I'm

sure so I think that's an interesting

picture to see how well we think some of

our systems are are working in fact so

this now actually concludes the

technical aspect of the presentation so

I'd like to now move to any questions or

comments that you may have so

understanding that we did have a period

of time there where we lost audio

apparently and so I'm just going to go

back through a couple of the questions

and comments that were put in was there

a document documented link between tiles

disengaging or falling off and a major

accident there was certainly the

documented link from the perspective

that the Atlantis shuttle had had an ear

burn through event and it was purely by

chance that the tile that fell off came

from a region where the whole of the

aircraft was actually much thicker so it

suffered significant heat damage but it

didn't have a total burn through and

loss of structural integrity

what those systems are for the 25% that

had system so that's actually a really

good question for those of you that did

have those systems in place now you're

able to actually just jot down in that

chat box for us exactly what the what

sort of systems you're using so that we

can try and understand what others are

using and share that learning so you

know what are your learnings about how

to share and guard against normalization

of deviance in your organization's and

how well is that working for you so do

we have any suggestions from people

around that sort of information or any

other questions at all or comments

so what I might do then is move on to

talk about some of the upcoming webinars

that we have and if you have any

questions or comments or suggestions

around how the how people's areas work

you can then put them through so I've

just seen we've had some comments come

through and I've just lost them on my

screen somehow so I'll get to that's get

those back in a second on the 23rd of

March this year we have a webinar coming

up talking about the BP Texas City

refinery that actually marks its 10th

anniversary we've been fortunate enough

to secure dr. Paul Tebow to discuss that

particular incident Paul was actually a

member of the Baker panel which was the

panel that was developed to review the

cultural aspects of the US refineries

following that particular incident

following that Wilbur have another one

in June where we're actually going to be

talking about the lead process safety

metrics project that we've been working

on in the Safety Center and where we've

got to and then in November on the

anniversary of the Pike River Mine

explosion the fifth anniversary we'll

have a session talking about that as

well in terms of the ideas and comments

that people have come through with

things such as multi-tiered risk

assessments of deviations is one area

that a one model that people are using

and sign off by competent technical

authorities to ensure that they're

getting broad input into particular

topics

and other questions come through would

it be correct to say that people may not

have been able to construct the Columbia

disaster before the incident in any

hazard study that's an interesting

question and I would perhaps suggest

that they would have been able to given

the previous history that they had and

given certainly Columbia was by no means

the first major debris strike that that

had and also as I said with the Atlantis

shuttle that had launched several years

earlier there were certainly great

concern at that launch that they could

have an issue where they had thermal

damage sufficient that that shuttle may

not have been able to return and that's

certainly very clearly seen by the fact

that as soon as they immediately

discovered that they had some foam

shedding issues that they straightaway

had the crew inspect the shuttle which

as I mentioned is quite different to the

response to Columbia they had got to the

point in Columbia where they just

believed it was not possible to have the

issue as opposed to looking back into

their own history and seeing that they

had very clear warning signs that had

occurred and even the previous launch

where a significant chunk was taken out

of one over the solid rocket boosters by

the debris shower that occurred I'd

certainly recommend people read or take

a quick look at least through some of

the executive summary of the Columbia

report it's a very very interesting

report and it's not purely technical

based on the idea of a flight and how

those flight structures work it is

really more around the cultural

deficiencies that occurred within that

organization and how it has subsequently

changed it's a very interesting study of

a culture where there is no concept of

failure occurring and they had that in a

series of different different incidents

because they they could not conceive

failure given some of the six

that they had had in the past I'd also

recommend if anyone gets the chance to

visit a place like Kennedy Space Center

it is a very very interesting place to

visit to see the development of their

engineering over many many years but

also there are still elements of that

same culture around not being able to

conceive that something could go wrong

given the history that they had no we

don't appear to have any more questions

or comments coming through so apologies

once again for that loss of audio during

the presentation and I hope I managed to

go back to the right point so you could

hear the rest of it this webinar is

being recorded so it will be available

for viewing in your organization's after

this event and that will be available

through the Safety Center website at WWE

Safety Center org and in the supporters

area on the menu you can click straight

through to the webinars and you'll be

able to see it there and view it also if

you have any future comments around

webinars please contact us at Safety

Center and IQ me org if you have any

ideas of how to improve these obviously

with technology this is an important one

but also for the benefit or particular

topics that you'd like looked at or if

you'd like to be added to our e-mail

notification list so you get notified

directly I just had one last question

come through asking what time will the

BP Texas City session be off the top of

my head from memory at the moment I

believe it's about 10:00 a.m. Melbourne

time which is 7:00 a.m. earth time and

part of that is to be able to match in

the time zone so that Paul can join us

for that discussion I have

just seeing one more question come

through sorry that I have missed how

does the industry find that balance

between rewarding success versus

rewarding identification of deficiencies

in safety systems and deviation on the

basis of design that is a very very good

question does anyone have any thoughts

that would like to actually send through

to to assist with that that question I

think it is a very challenging balance

to go through and I think it's all part

of ensuring that you've established an

appropriate culture in an organization

to make sure that you do have people

accountable for what occurs you do need

to reward and celebrate success to a

certain degree in my experience but you

also need to make sure that there's a

real focus on where issues are occurring

that we're not hiding them or failing to

see them more to the point as we

endeavor to improve what's going on does

anyone else have any other thoughts

about how to balance that rewarding

success versus deficiencies another very

interesting way I've seen it referred to

is a comment around celebrating the red

on the scorecard and challenging the

green so really sending the message out

there that you're interested in

understanding and you want to see what

the deficiencies are and challenge when

no deficiencies are found because no

system that a human is involved with is

free of deficiencies

okay we haven't got any more comments

come through at this point in time on

questions ruff just another one Hopkins

has a good theory reward frontline

people for reporting incidents and

senior managers for safety outputs EDG

incident rates is that from Hopkins new

book that's just come out in his

discussions around reward systems for

bonus structures etc and how they

potentially drive unintended behaviors

and consequences in an organization okay

now I've got that answer through know he

believes that was out of the disastrous

decisions book which was the Macondo

review that Hopkins did thank you for

that so there's there is certainly some

some interesting areas I think I I have

some concerns around the idea of the

rewarding of management for the safety

outputs being the injury rates because

that comes back to that very topic of

looking at whether we are measuring the

success of something by the absence of

something else so the absence of

injuries or leaks does not mean that

we're not about to have one or that

we're not about to see something go

wrong quite significantly so I think we

need to to be very careful and and start

to move away from the idea of rewarding

people for lagging indicator results I

think we need to be moving far more

towards the leading space to ensure that

we actually see what's going on at that

point

okay thank you all very much for your

attendance I certainly hope that you

fall on this webinar both interesting

and thought-provoking just got another

comment come through sorry I think

you're right in rewarding the red

warning signs and completing RCA on the

warning signs before things go wrong and

I think that's a very very good good

comment it's around how do we then

strike that balance from the busyness

that we all exists in to make sure that

we give those areas the appropriate

attention and understand that the

warning sign has existed and appeared

and also that we review it to understand

how we can address it because there is

definitely a balance that does have to

come through around how we can actually

manage our day to day business because

we all still have jobs to do we all

still need to understand these things

and work through them so thank you very

much for that comment as I mentioned

this recording will be on the I kms

Safety Center website so I would like to

sign off there and thank you all very

much for your participation today thank

you