Erik Hollnagel

Barriers And Accident Prevention

efficiency-thoroughness trade-off : why things that go right sometimes go wrong

The ETTO principle

Resilience engineering has consistently argued that safety is more than the absence of failures. Since the first book was published in 2006, several book chapters and papers have demonstrated the advantage in going behind 'human error' and beyond the failure concept, just as a number of serious accidents have accentuated the need for it. But there has not yet been a comprehensive method for doing so; the Functional Resonance Analysis Method (FRAM) fulfils that need. Whereas commonly used methods explain events by interpreting them in terms of an already existing model, the FRAM is used to model the functions that are needed for everyday performance to succeed. This model can then be used to explain specific events, by showing how functions can be coupled and how the variability of everyday performance sometimes may lead to unexpected and out-of-scale outcomes - either good or bad. The FRAM is based on four principles: equivalence of failures and successes, approximate adjustments, emergence, and functional resonance. As the FRAM is a method rather than a model, it makes no assumptions about how the system under investigation is structured or organised, nor about possible causes and cause-effect relations. Instead of looking for failures and malfunctions, the FRAM explains outcomes in terms of how functions become coupled and how everyday performance variability may resonate. This book presents a detailed and tested method that can be used to model how complex and dynamic socio-technical systems work, to understand why things sometimes go wrong but also why they normally succeed.

Modelling Complex Socio-technical Systems

FRAM: The Functional Resonance Analysis Method

Accidents are preventable, but only if they are correctly described and understood. Since the mid-1980s accidents have come to be seen as the consequence of complex interactions rather than simple threads of causes and effects. Yet progress in accident models has not been matched by advances in methods. The author's work in several fields (aviation, power production, traffic safety, healthcare) made it clear that there is a practical need for constructive methods and this book presents the experiences and the state-of-the-art. The focus of the book is on accident prevention rather than accident analysis and unlike other books, has a proactive rather than reactive approach. The emphasis on design rather than analysis is a trend also found in other fields. Features of the book include: -A classification of barrier functions and barrier systems that will enable the reader to appreciate the diversity of barriers and to make informed decisions for system changes. -A perspective on how the understanding of accidents (the accident model) largely determines how the analysis is done and what can be achieved. The book critically assesses three types of accident models (sequential, epidemiological, systemic) and compares their strengths and weaknesses. -A specific accident model that captures the full complexity of systemic accidents. One consequence is that accidents can be prevented through a combination of performance monitoring and barrier functions, rather than through the elimination or encapsulation of causes. -A clearly described methodology for barrier analysis and accident prevention. Written in an accessible style, Barriers and Accident Prevention is designed to provide a stimulating and practical guide for industry professionals familiar with the general ideas of accidents and human error. The book is directed at those involved with accident analysis and system safety, such as managers of safety departments, risk and safety consultants, human factors professionals, and accident investigators. It is applicable to all major application areas such as aviation, ground transportation, maritime, process industries, healthcare and hospitals, communication systems, and service providers.

Barriers and Accident Prevention

Accident investigation and risk assessment have for decades focused on the human factor, particularly 'human error'. Countless books and papers have been written about how to identify, classify, eliminate, prevent and compensate for it. This bias towards the study of performance failures, leads to a neglect of normal or 'error-free' performance and the assumption that as failures and successes have different origins there is little to be gained from studying them together. Erik Hollnagel believes this assumption is false and that safety cannot be attained only by eliminating risks and failures. The ETTO Principle looks at the common trait of people at work to adjust what they do to match the conditions - to what has happened, to what happens, and to what may happen. It proposes that this efficiency-thoroughness trade-off (ETTO) - usually sacrificing thoroughness for efficiency - is normal. While in some cases the adjustments may lead to adverse outcomes, these are due to the very same processes that produce successes, rather than to errors and malfunctions. The ETTO Principle removes the need for specialised theories and models of failure and 'human error' and offers a viable basis for effective and just approaches to both reactive and proactive safety management.

Why Things That Go Right Sometimes Go Wrong

The ETTO Principle: Efficiency-Thoroughness Trade-Off

While a quick response can save you in a time of crisis, avoiding a crisis remains the best defense. When dealing with complex industrial systems, it has become increasingly obvious that preparedness requires a sophisticated understanding of human factors as they relate to the functional characteristics of socio-technology systems. Edited by industrial safety expert Erik Hollnagel and featuring commentary from leaders in the field, Safer Complex Industrial Environments: A Human Factors Approach examines the latest research on the contemporary human factors approach and methods currently in practice. Drawing on examples mainly from the nuclear industry, the book presents a contemporary view on human factors in complex industrial systems. The contributors contrast the traditional view of human factors as a liability with the contemporary view that recognizes human factor as also an asset without which the safe and efficient performance of complex industrial systems would be impossible. It describes how this view has developed in parallel to the increasing complexity and intractability of socio-technical systems and partly as a consequence of that. The book also demonstrates how this duality of the human factor can be reconciled by recognizing that the human and organizational functions that can be the cause of adverse events are also the very foundation for safety. Building on this, the book introduces theories and methods that can be used to describe human and collective performance in a complex socio-technical environment. It explores how contemporary human factors can be used to go beyond failure analysis to actively make complex industrial environments safer.

A Human Factors Approach

Safer Complex Industrial Environments

Jeffrey Braithwaite

Health care is everywhere under tremendous pressure with regard to efficiency, safety, and economic viability - to say nothing of having to meet various political agendas - and has responded by eagerly adopting techniques that have been useful in other industries, such as quality management, lean production, and high reliability. This has on the whole been met with limited success because health care as a non-trivial and multifaceted system differs significantly from most traditional industries. In order to allow health care systems to perform as expected and required, it is necessary to have concepts and methods that are able to cope with this complexity. Resilience engineering provides that capacity because its focus is on a system’s overall ability to sustain required operations under both expected and unexpected conditions rather than on individual features or qualities. Resilience engineering’s unique approach emphasises the usefulness of performance variability, and that successes and failures have the same aetiology. This book contains contributions from acknowledged international experts in health care, organisational studies and patient safety, as well as resilience engineering. Whereas current safety approaches primarily aim to reduce or eliminate the number of things that go wrong, Resilient Health Care aims to increase and improve the number of things that go right. Just as the WHO argues that health is more than the absence of illness, so does Resilient Health Care argue that safety is more than the absence of risk and accidents. This can be achieved by making use of the concrete experiences of resilience engineering, both conceptually (ways of thinking) and practically (ways of acting).

Resilient Health Care

This Handbook serves as a single source for theories, models, and methods related to cognitive task design. It provides the scientific and theoretical basis required by industrial and academic researchers, as well as the practical and methodological guidance needed by practitioners who face problems of building safe and effective human-technology s

Handbook of Cognitive Task Design

Robert L. Wears

Health systems everywhere are expected to meet increasing public and political demands for accessible, high-quality care. Policy-makers, managers, and clinicians use their best efforts to improve efficiency, safety, quality, and economic viability. One solution has been to mimic approaches that have been shown to work in other domains, such as quality management, lean production, and high reliability. In the enthusiasm for such solutions, scant attention has been paid to the fact that health care as a multifaceted system differs significantly from most traditional industries. Solutions based on linear thinking in engineered systems do not work well in complicated, multi-stakeholder non-engineered systems, of which health care is a leading example. A prerequisite for improving health care and making it more resilient is that the nature of everyday clinical work be well understood. Yet the focus of the majority of policy or management solutions, as well as that of accreditation and regulation, is work as it ought to be (also known as ‘work-as-imagined’). The aim of policy-makers and managers, whether the priority is safety, quality, or efficiency, is therefore to make everyday clinical work - or work-as-done - comply with work-as-imagined. This fails to recognise that this normative conception of work is often oversimplified, incomplete, and outdated. There is therefore an urgent need to better understand everyday clinical work as it is done. Despite the common focus on deviations and failures, it is undeniable that clinical work goes right far more often than it goes wrong, and that we only can make it better if we understand how this happens. This second volume of Resilient Health Care continues the line of thinking of the first book, but takes it further through a range of chapters from leading international thinkers on resilience and health care. Where the first book provided the rationale and basic concepts of RHC, the Resilience of Everyday Clinical Work breaks new ground by analysing everyday work situations in primary, secondary, and tertiary care to identify and describe the fundamental strategies that clinicians everywhere have developed and use with a fluency that belies the demands to be resolved and the dilemmas to be balanced. Because everyday clinical work is at the heart of resilience, it is essential to appreciate how it functions, and to understand its characteristics.

The Resilience of Everyday Clinical Work

Resilient Health Care, Volume 2

Sidney Dekker

Christopher P. Nemeth

Preparation and Restoration addresses issues such as the nature of resilience; the similarities and differences between resilience and traditional ideas of system performance; how systems cope with varying demands and sometimes succeed and sometimes fail; how an organization's ways of preparing before critical events can enable or impede restoration; the trade-offs that are needed for systems to operate and survive; instances of brittle or resilient systems; how work practices affect resilience; the relationship between resilience and safety; and what improves or erodes resilience.

Preparation and restoration

Resilience Engineering Perspectives

Nancy Leveson

David D. Woods

For Resilience Engineering, 'failure' is the result of the adaptations necessary to cope with the complexity of the real world, rather than a malfunction. Human performance must continually adjust to current conditions and, because resources and time are finite, such adjustments are always approximate. Featuring contributions from leading international figures in human factors and safety, Resilience Engineering provides thought-provoking insights into system safety as an aggregate of its various components - subsystems, software, organizations, human behaviours - and the way in which they interact.

Concepts and Precepts

Resilience Engineering

Safety-I is defined as the freedom from unacceptable harm. The purpose of traditional safety management is therefore to find ways to ensure this ‘freedom’. But as socio-technical systems steadily have become larger and less tractable, this has become harder to do. Resilience engineering pointed out from the very beginning that resilient performance - an organisation’s ability to function as required under expected and unexpected conditions alike – required more than the prevention of incidents and accidents. This developed into a new interpretation of safety (Safety-II) and consequently a new form of safety management. Safety-II changes safety management from protective safety and a focus on how things can go wrong, to productive safety and a focus on how things can and do go well. For Safety-II, the aim is not just the elimination of hazards and the prevention of failures and malfunctions but also how best to develop an organisation’s potentials for resilient performance – the way it responds, monitors, learns, and anticipates. That requires models and methods that go beyond the Safety-I toolbox. This book introduces a comprehensive approach for the management of Safety-II, called the Resilience Assessment Grid (RAG). It explains the principles of the RAG and how it can be used to develop the resilience potentials. The RAG provides four sets of diagnostic and formative questions that can be tailored to any organisation. The questions are based on the principles of resilience engineering and backed by practical experience from several domains. Safety-II in Practice is for both the safety professional and academic reader. For the professional, it presents a workable method (RAG) for the management of Safety-II, with a proven track record. For academic and student readers, the book is a concise and practical presentation of resilience engineering.

Developing the Resilience Potentials

Safety-II in Practice

Safety has traditionally been defined as a condition where the number of adverse outcomes was as low as possible (Safety-I). From a Safety-I perspective, the purpose of safety management is to make sure that the number of accidents and incidents is kept as low as possible, or as low as is reasonably practicable. This means that safety management must start from the manifestations of the absence of safety and that - paradoxically - safety is measured by counting the number of cases where it fails rather than by the number of cases where it succeeds. This unavoidably leads to a reactive approach based on responding to what goes wrong or what is identified as a risk - as something that could go wrong. Focusing on what goes right, rather than on what goes wrong, changes the definition of safety from ’avoiding that something goes wrong’ to ’ensuring that everything goes right’. More precisely, Safety-II is the ability to succeed under varying conditions, so that the number of intended and acceptable outcomes is as high as possible. From a Safety-II perspective, the purpose of safety management is to ensure that as much as possible goes right, in the sense that everyday work achieves its objectives. This means that safety is managed by what it achieves (successes, things that go right), and that likewise it is measured by counting the number of cases where things go right. In order to do this, safety management cannot only be reactive, it must also be proactive. But it must be proactive with regard to how actions succeed, to everyday acceptable performance, rather than with regard to how they can fail, as traditional risk analysis does. This book analyses and explains the principles behind both approaches and uses this to consider the past and future of safety management practices. The analysis makes use of common examples and cases from domains such as aviation, nuclear power production, process management and health care. The final chapters explain the theoret

Erik Hollnagel

Books

Your next favorite book is out there