One of the Berkeley high reliability researchers on why the organizations he studied worked to possibility rather than probability, why their people owned their procedures, and why he tells would-be HROs he doesn’t know how you become one.
Paul Schulman is Professor Emeritus of Government at Mills College and a senior research associate at the Center for Catastrophic Risk Management at the University of California, Berkeley. He joined Todd La Porte’s high reliability organizations (HRO) research group at Berkeley as its fieldwork moved from aircraft carriers into the Diablo Canyon nuclear plant, air traffic control and, later, the electrical grid. With Emery Roe, he co-authored High Reliability Management and Reliability and Risk. In this conversation with SafetyDifferently.com editor Chris McCullough, Paul describes the people he calls reliability professionals, explains why “managing the unexpected” gets those organizations wrong, and argues that HRO has been taken up as a fad far more often than it has been practised, and what the world’s most reliable organizations do differently, from one of the researchers who watched them work.
Read the papers: The Origins, Impacts and Future of High Reliability Organizations Research: A Reflective Essay (with Todd R. LaPorte), Moving Beyond “Safety”: Revising the Concept to Upgrade the Art and Science of Safety Management, and Suggested Findings from High Reliability Organizations Research: On the Exceptionality of High Reliability and Safety.
A Political Scientist in the Control Room
Chris McCullough: First off, we’re going to get your superhero origin story. How did you end up spending so much time on carrier flight decks and in nuclear plant control rooms?
Paul Schulman: Okay. Well, by the way, I didn’t spend all the time on a carrier. Todd La Porte started that. I was just an assistant professor at the University of Tennessee, and Todd came out to see me based on a manuscript I had written. I decided to move to Berkeley, so I quit at Tennessee, took a job at Mills College nearby, and joined the HRO group at Cal.
When I started, they had finished the carrier work, but we started with Diablo Canyon. That was our big push. Then we went into the FAA and air traffic control. And then with another colleague, I branched into high-voltage grid management and the California Independent System Operator. We spent seven years, on and off, interviewing people there, and then I branched out to other technical systems.
I was always interested in technology. I got my PhD in political science, but I was always interested in organizations, especially ones that had to manage complex technical systems. My first book was on the space program. So I was very happy to join Todd’s team.
Our approach to this research was a little different. We spent a lot of time in these organizations. They got to know us very well. And the other thing we said was, “We’re learning from you guys. We know you have a reputation.” Obviously, the carrier flight decks did. Diablo Canyon, after a rocky start, had a really good reputation for safety management. And the FAA. At one point, the FAA and Boeing were the gold standard for high-level safety management. That’s no longer the case. So that’s how I got into it: my interest in technology and Todd recruiting me into his HRO group.
Chris: A lot of organizational research mostly only studies failure. What pulled you toward studying things that went right?
Paul: Well, things were going right, but we were really interested in the character of those technical systems, where the failures could be catastrophic. We wondered: things seem to be going right, yet their technologies are riskier than those of many other organizations that organization theorists study. So we thought, let’s go and see how, if at all, they’re different. And boy, did we find differences! In fact, Todd wrote this piece called “Working in Practice but Not in Theory.” Theory did not account for what we were seeing in these organizations.
Chris: I have a new bumper sticker: working in practice, but not in theory. I like that.
Paul: That’s right. And just in the last few months I’ve been working on a project with the California Public Utilities Commission, which is trying to figure out how to regulate for safety culture. As somebody once said, that’s like trying to regulate, how did they put it, a pie thrown against a wall that is slowly seeping down. There’s so much abstraction. Somebody wrote an article about trying to regulate the abstract. So it’s a real challenge for the Public Utilities Commission. And I have just finished a little essay for them. It’s a strange title: “On the Exceptionality of Safety.”
Chris: I’m curious. I’m really curious.
The Chemist Who Had to Know What That Sound Was
Paul: I’ve been reading a lot of neuroscience stuff. If you look at human cognitive processes and many forms of human behaviour, they’re not really well suited to managing complex technical systems safely on an ongoing basis. First off, sustained, focused attention is difficult. It’s hard for us to focus for long periods. People tend to routinize tasks so they don’t have to think about them while they’re doing them, at least not consciously. That’s not a great approach. When you routinize a task, your awareness and concentration are lower than they would otherwise be.
Chris: Is the routinization a substitute for that attention, or is it compensating for it? Forgive me if that seems like a silly question.
Paul: No, it’s a good question. Conscious thought takes a lot of energy, so people choose something easier. And the other thing is, people are not great at maintaining particular goals with consistent and deliberate actions. They tend to drift onto other goals. They have multiple, conflicting goals.
So I’ve been looking at what I saw in our HROs from a different perspective: I met exceptional people. One day I went in to talk to a chemist, a guy in the chemistry department. I introduced myself, and he looked up and said, “Oh, what’s that sound? I never heard that sound before.” And he ran, literally ran, out of the office, leaving me alone for 20 minutes. He came back and said, “I’m really sorry. I had to know what that sound was.”
Thinking this through, I realized he could have just sat there and said, “I’ll take care of it after this interview.” He could have said, “Somebody else will go and see what it is.” But he couldn’t have failed to get up, track that sound down, and still be the person he wanted to be. He had identified himself as a safety professional. That was who he was. And we saw people who were almost to the point of obsession.
Chris: So was that concern or curiosity on his part?
Paul: I think he was very curious because of the concern.
Chris: Okay, fair enough.
Paul: And we met people like that all over the place, who were not your normal people, in the sense that their sense of identity was tied into not just their job description but system reliability beyond their job description. We called them reliability professionals. My colleague and I wrote a book on it. We coined the term “reliability and safety professionals” because that’s what they did.
There was a guy I was talking to at a conference who was the manager of an Edison plant, an electric power generating plant in New York. He said, “You know, the guys in my control room have to wear ties, because we want them to think of themselves as professionals and not as just hired hands.” So he got that. It seems arbitrary, but he realized that it mattered.
So in a variety of respects, I’m telling these people at the Public Utilities Commission: you can tell people in an organization what they need to do for safety, and there are a whole bunch of safety culture traits and attributes that are spelled out. But if they don’t internalize this stuff, they will not be as effective at reliable safety and performance as we want them to be.
Chris: So it’s not what they do; it’s who they become.
Paul: I think so. That’s very good. At least in our impressions, that turned out to be really important, and it separated those organizations. These people will speak up if they see something they think is dubious. They will speak out publicly. One safety culture trait is that people on the job raise concerns. That’s easy to say. But there’s a lot of research that’s been done on this. These organizations are not blank tablets. Many units already have their own subcultures, and many of them don’t favour speaking out. And there are other features of those subcultures that can be difficult relative to the traits you want to see in a safety culture.
So I’m trying to tell these people at the PUC, and they don’t like it: this is a bigger issue than you think. You cannot just offer a prescription and tell people, “Here’s how you have to behave.” The organizations we saw had that sense of identity. In that sense, they were exceptional organizations.
Chris: So how do they convey that identity? In their behaviour?
Paul: It’s like the guy who jumps up and leaves. You see that identity in what he did.
Chris: Did they ever convey it intentionally, like it was part of their strategy or a tactic or anything like that?
Paul: That’s just how they behave. You can recognize them. When we went into a new organization, we would describe these people. I’d say they look beyond just their job descriptions. They’re constantly consumed with things that could be problematic, and they’re very inventive. They play the what-if game. You’re doing a work planning session, thinking about something you’re going to do, and they’re the ones who say, “Well, what if we lost power just when we were doing this? What would happen if there were a quake?” They think in those terms.
Not Managing the Unexpected. Enlarging What They Expect.
Paul: There’s a book that two colleagues of mine wrote called Managing the Unexpected. They tried to use our HRO research. “Oh, they’re managing the unexpected.” That’s bull.
Chris: You push back on that, don’t you?
Paul: They are not. If they were managing the unexpected, they wouldn’t be highly reliable. If the whole world were unexpected, that wouldn’t be the foundation. What they do is they enlarge expectancies.
Chris: I was going to ask you about that. Tell me more.
Paul: When they’re playing this what-if game, they actually score points if they can think of all sorts of convoluted things that could happen that could be problematic. That’s what they do. They’re constantly formulating scenarios. They work not to probability, but to possibility. That was one of the big differences we saw in HROs.
A lot of organizations, of course, have risk assessments all over the place. To them, the risk assessment says, “Look, we know the risks,” and it gives them what I think is false confidence in their safety and operational security. Not these people. They don’t operate on probability, because probability can easily be wrong. They don’t necessarily know all the consequences. They don’t know the likelihoods. They may not have considered all the likelihoods. So they’re trying to manage the possibility, especially when they’re dealing with catastrophic things that could happen. That makes them a lot different than the people who always say, “Well, we got the risk assessment down. Don’t worry about it.” I found it really interesting.
Chris: Is that speaking to the concept of chronic unease?
Paul: Oh, chronic unease. Yeah, in a way.
“We’re Learning From You Guys”
Chris: So you went in as learners, not consultants, which is something for a gentleman with as many letters behind his name as you have. How did people react to that?
Paul: That is one reason we got information that other people were surprised to tell us. First off, we were there a lot. And we said, “We want to understand why you’re so good,” which right away is something that flatters them. Most of the time, when people come in, they think, “They’re going to tell us what to do. They’re the creature of management. They’re going to look for failures on our part.” It took them a long time to figure out what the hell we were. Who are these people?
We would ask basic questions. “How does this work?” We made sure they realized we were not going to prescribe stuff for them. We were going to learn from them. Ultimately, that worked very well. And because we were there often, they got interested in what we were doing, and they talked to us about things you wouldn’t necessarily tell a consultant.
Chris: You would ask the question, “What’s a good day and what’s a bad day?” Why that question, and what did it actually open up?
Paul: First off, it was a way of getting into their heads about what they might be worried about, what sort of problems they have, and on the other hand, what things are good from their perspective. So we got a sense of their internal worries, but also what matters to them. What makes it a good day?
Later, we did a project with a colleague looking at the Cascadia subduction zone off the coast of Washington and Oregon. These are huge tectonic plates. Every 300 years or so, there have been catastrophic, major quakes. They would be around 9.2 on the conventional Richter scale, and there’s evidence of massive tidal waves that reached all the way up the Cascades. So we’re interviewing these emergency management types about this possibility. We asked what had been a really difficult thing for them, and they talked about ice storms and wildfires and other things. But they told us that once we get a quake of that magnitude, all their plans will be useless. All infrastructure will probably be knocked out.
So I used to ask them, “How do you know if you’re doing a good job?” The younger people, who didn’t have much experience, said, “If I’m following the protocol, I’m doing a good job.” The more experienced people said, “If I’m thinking well, if I’m coming up with a lot of options, inventing options, improvising things, that’s when I’m doing well.” Different.
So asking someone what a good day is shows how they value and think about what they’re doing, from a slightly different perspective. And it turned out to work very well, because they wanted us to know what was a good day and what was a bad one.
Chris: Yes, and they got to talk about their procedures, their values and what they value as results as well.
The Things That Cannot Happen
Chris: Walk me through precluded events and the precursor zone, in as plain language as you can for our readers. And any example that stuck with you.
Paul: Well, one thing is, these organizations, in a way, had a real advantage from the standpoint of managing safety. Some things were so catastrophic if they happened. A collision of commercial aircraft under air traffic control. There’s a rumour that every air traffic controller who had a collision on their watch committed suicide. I don’t know if that’s really true. But they know what can’t happen. Something like that could end the organization. Not only will outsiders be killed; people in the organization might be killed. If there were a tremendous radiation leak out of the reactor in a power plant, a lot of people’s lives are at stake.
So in a way, they could tell what the very worst things are, the priorities, the things that cannot happen. They want to organize themselves around those things, and they’re very analytic about it. “Okay, let’s just think about this. What are the conditions that could make those things more likely?” And it’s not just technical conditions. If they’re operating outside of technical specifications, clearly that shouldn’t be. But then, from their pessimistic perspective, they started thinking about more things. They’d say, “If there’s noise in the control room, people might make a mistake. People might hear something wrongly. So we have to make sure there’s not too much noise in the control room, and there’s not too many people in the control room.” They had a whole bunch of things, not just technical states but organizational states, that they felt could, in a causal chain, make the worst thing a little more likely. Those are what we call precursors. They looked for these precursors everywhere.
Chris: So it’s almost like taking a bow tie and applying it to the organization itself.
Paul: I think so.
Chris: That is interesting.
Paul: Much bigger, much wider. And they were constantly thinking about new issues. “Here’s what we’re doing here, but that scaffold design is not exactly as safe as it could be. Let’s think about what we could do to make it better.” Or, “We lost contact with this group. That shouldn’t happen, and we want to make sure we have more robust communications.”
But also, there was a guy from the Nuclear Regulatory Commission. The NRC has two resident inspectors at every plant it regulates. This guy was from the nuclear navy, and when I was interviewing him, he said to me, “You know, these people, they’re so damn friendly all the time. I give them an order, I want it done right away, but they’re having conversations.” He didn’t get that friendliness meant they could share information. They could raise an issue with someone and not be completely rebuffed. So the kind of social culture they had was important. If people weren’t speaking to each other, or if they were constantly angry at each other, they would address it and figure out how to change it.
Chris: It reminds me of Paul O’Neill at Alcoa. When they built the new headquarters, they installed escalators instead of relying on elevators, so everyone had a better chance of running into each other and having conversations.
Paul: Yeah. So there are these precursors, and then they have what I call the precursor zone. They don’t want to drift. I’ve written about this, and others have, including Sidney Dekker: drift into failure. Because it takes a lot to have people focused, attentive, communicating with each other, and there are a lot of times when that will begin to weaken. It can decay. These organizations are very sensitive to that. They’re always on the lookout.
Like this guy I talked to in another unit. They had a problem with people, particularly visiting people doing work during an outage. There were two symmetrical reactors, and the control room had symmetrical sections, so people would accidentally go into the wrong unit when they were supposed to turn a valve or do something. That was no good. They decided part of it was that people were too busy and not thinking clearly. So they came up with a whole requirement: before you do any work, you have to write out, “I am in Reactor One to do this,” and you’ve got to have it countersigned.
People got really ticked off. “What the hell? They think we’re so stupid we don’t know?” And the guy said, when they put that out, the number of wrong-unit errors virtually vanished, to zero. They were ticked off, but that made them more attentive to the whole process.
But then he said that, after a while, the wrong-unit errors started coming back. He said, “I know why that’s coming back. They’ll go up to somebody and say, ‘Hey, sign this, will you please?’ And he countersigns without even thinking. They’re not taking it seriously.” And the guy told me, “Now we’re going to have to find some other way to rekindle the fervour.”
The People Who Used the Procedures Owned Them
Chris: You said that you never saw people ignoring procedures. Was it really that clean? What made the procedures worth following?
Paul: Okay. Well, this is one of those things about going back to working in practice and not in theory. You’d think, oh my God, if they’re just constantly working by procedures, talk about mindlessness. But here’s the thing I discovered, particularly at Diablo Canyon. I went through all the procedures that were online. I looked at all of them. There were three thousand three hundred and three, or something like that. And I noticed every one of those procedures had been revised at some point. The average was something like three revisions. So I’m thinking about that. How does this happen? Then I asked people about the process.
Almost every revision was initiated by someone who used the procedure and said, “You know, this actually doesn’t work well. It’s wrong, it’s ambiguous,” or “I have a better way.” And they go through a process. The plant safety review committee would look it over and often change the procedure. So, ironically, the people who used the procedures owned them. They felt these were their procedures. In most organizations I’ve been in, I go in, and I say, “What does the procedure say?” and nobody pays any attention to that. Here, everybody paid attention to the procedures because they owned them.
Chris: Okay, so the procedures were better because they had input from the workers who used them. And the workers who used them paid more attention because they knew they’d helped perfect them.
Paul: That’s right. And you know something else? They knew why the procedures existed. In a lot of organizations, there’s a procedure, and it’s, “I don’t know why the hell it’s there, but it’s there.” They don’t even understand the procedure’s intent. Not in the organizations we looked at. They obviously knew the intent.
Chris: Okay, that’s a success. Speaking of another success, a supervisor told you, “You gave us the perspective and the words to explain it.” What did that mean to you?
Paul: I was extremely pleased by that. They knew they were good, but we introduced concepts like precursors, talked about resolving ambiguities, and they began to see that the language said exactly what they meant. In other words, it helped them explain and understand more sharply what they actually do. They took what they did for granted.
The Last Medical Conference He Was Ever Invited To
Chris: You had a section titled “Be Careful What You Wish For.” When did you first see HRO being sold as a product, and how did that feel?
Paul: Oh, that’s what consultants do if you’re not careful. What happened was, there were a lot of limitations to what we did. For one thing, we didn’t even know how these organizations became HROs. How did you come by these precursors? How did these reliability and safety professionals end up spread all over the place? How did that happen? We didn’t know. But we knew this was something special. And then we began to see it get fashionable. Everybody said, “We want to be highly reliable.”
For several months, I don’t know how long, I was invited to medical conferences. They said, “Here’s a guy who can tell us how we can be high-reliability organizations in medicine.” Finally, I had to tell them. I said, “You know, one of the things these HROs had was not only their own dread of the precluded events, but the public’s dread.” That was really important, because it meant they got money—budgets for safety, for redundant generators, for all kinds of things. The public’s dread of accidents provided a political foundation.
Chris: So public dread gives these organizations some stable support. What happens to an organization that has no dread working in its favour?
Paul: Now you’re getting me. What I said was the following. These were special organizations in terms of the public dread. But first off, no patient wants to dread their physician’s activities. Everybody wants to trust their physician. And by the way, there are medical errors all the time. They die with the patient. It isn’t seen as a catastrophe when somebody dies because of a medical error.
And the other thing I told them: the technology isn’t the same. In nuclear power plants, they had a mature technology. It was well understood. “You guys, you don’t even know what impact a particular course of treatment is going to have on different patients. The variation in the patients is so high.” And so I said, “The starting point is, you have to convince people that when they go into a medical facility, it’s out to kill them.”
By the way, that was the last time I was ever invited to a medical conference. They didn’t like it. But what I was saying was, you have to think about why these were special organizations and what it took. You can’t just say, “We want to be an HRO.”
I know why people wanted to be an HRO. It was fashionable. In management, fads sweep through, and everyone wanted to say, “Oh, well, we’re an HRO.” Even the people in Texas who had this horrible explosion in their plant, which was pitifully managed, were saying, “We are an HRO.” Not in the least. People noted, “God, that literature you wrote has been taken up exponentially.” And I began to realize, and so did Todd: yeah, it’s being taken up, but not followed. It’s been taken up because it’s a fad. More people cite it, but they don’t practise it because, for some organizations, it’s probably not possible.
Chris: So are the original HROs a dying breed?
Paul: Yes, I think so, for several reasons. We’ve written about this too, and I think you said you read that paper. First, the technology isn’t mature. Organizations are dealing with immature technologies, many of them new, and, in effect, I wrote this, beta-testing them for the developer because the developer hasn’t taken the time to run all the tests.
Chris: That is a really interesting way to put it.
Paul: Because they want to market the damn thing quickly.
Chris: Minimum viable product. Let’s get it out. Let’s ship.
Paul: Yeah. So right away, they’re not dealing with mature systems. And secondly, if you start talking about, say, medicine: my wife is a nurse, and she worked in a hospital where there were lots of needle sticks, which is not good if you’re dealing with a disease and you stick yourself with the patient’s needle. Then you spread the disease. So I said, “Well, what do they do about it?” Well, they caution people to be careful. I said, “You know, if they were worried about something like that in an HRO, they would have two inspectors watching every needle stick, watching to make sure it doesn’t happen.” They don’t do that, because they don’t have the time, and people don’t want to spend the money it takes.
Milk Trucks, Levees and the Plan That Doesn’t Cover It
Chris: Another question for you. Explain contingent redesign for someone who has never heard of that term.
Paul: Contingent redesign, and a lot of this comes from what we saw in the emergency management area, is what you have to think through when you’re surprised. You encounter something you didn’t expect, something not in the plans, not in the book of what you have to do and when.
Chris: The failure of imagination.
Paul: Yes. Then you have to think about redesigning things, improvising things, creating options. When these guys in emergency management were talking about what they did, that’s what they did. For example, there’s an earthquake and the water supply is out. They commandeered milk trucks to deliver water to neighbourhoods. Well, that’s an interesting idea. And you have to think about reorganizing who’s in charge and who you want to talk to.
A woman wrote a wonderful book. It was her dissertation, and she’s Dutch. Her name is Dianka Zuiderwijk, and she wrote this book, Reliable beyond Design: The Role of Operational Actors in Dealing with Increasing Uncertainty in Complex Temporary Technical Organizations. She discussed the need for a temporary form of organization, which is what we wrote about in connection with interconnected infrastructures. In the event of a major natural disaster, they would now be interrelated in ways they weren’t before.
For example, there’s a levee, and power lines run along it. The levee is maintained and operated as its own thing. Oh, and roads too. Roads are on top of the levee, but the levee doesn’t pay much attention to them. If the levee leaks, it suddenly becomes incredibly dependent on the roads. Because if it can’t get trucks to bring in the material needed to fill the holes, it’s in big trouble.
Chris: So they’ve created a brittle system.
Paul: You have that in many infrastructures. Suddenly, telecoms are a big deal for the electric grid because it has to figure out what’s going on and communicate, and that becomes really important in a way they didn’t realize before. So what happens is, and I phrase it this way, you have to create an infrastructure for inter-infrastructure restoration of service. You have to have people know each other. They have to know who to call. They have to know how to apportion responsibilities, how to micro-coordinate.
Chris: There is no such thing as a single failure anymore. That’s wild.
Clawing Control Back From the Machine
Chris: Of the design errors you list, such as no path back to manual control, or AI that hides its logic, what worries you most right now?
Paul: Well, I’ve been thinking about this AI business, and I must say I’m befuddled. One thing I have to say is, I don’t think we yet have the imagination to assess, with any degree of reliability, both ends of it: how bad it could be, what the risk would be, or exactly what the accomplishments of AI could be. So we’re a little bit in the dark here. There’s fuzziness. We haven’t thought through all the possibilities, positive or negative.
But the idea that people would lose understanding of what the AI system is doing, and why, runs directly counter to what the HROs were about. With their pessimism, they always wanted to be able to claw it back, however impressive the automated system was, so operators could manually take over if they needed to. And I don’t want AI systems where that possibility isn’t there. I think, from the standpoint of safety as we understood it, that is compromised.
Chris: We’ve seen that a lot when technology goes wild, from the 1987 market crash to probably about a hundred different movies on that subject.
Paul: And don’t forget, one of the things we saw in our HROs was that a control operator, a department head, could shut down that system if he wasn’t confident it was safe. Veto powers were distributed around. Better to stop functioning than to function with the possibility of a precluded event.
Chris: Speaking of veto, a lot of companies have stop-work authority on paper. What made the veto real in the organizations you studied?
Paul: Well, what made it real was that the regulator imposed it. For example, the NRC gave operators that power. It was legally their authority. It was legally in their job description. So that was one thing. And the other was, you had these people who had internalized their responsibility. Can I give just one quick example?
Chris: Absolutely, please do.
Paul: At the Diablo Canyon plant, they have two units. One of them was down for an overhaul. One NRC inspector said, “You know, there’s this instrument air system.” It runs the sensors and gives the control room the data on pressures and temperatures and all this other stuff, and some compressed air system does it. He said, “I want you to shut it down in this unit, the one that’s being overhauled, and check out whether it’s got vulnerabilities or whatever.”
So they gave that responsibility to a new engineer, a young guy. I interviewed him and asked, “So you’re going to shut down the instrument air system?” He said, “I’m not doing it. I want to make sure there’s no common-mode connection between the instrument air system of Unit One and Unit Two, which is still operating.”
I said, “Well, don’t they have specs? Can’t you look at the design?” He said, “You know something? In this plant, they were so worried about getting it set up that many times, what you see in operation doesn’t match the specs. I am not going to shut down the instrument air system until I have walked down, myself, personally, the entire system in this plant and made sure that it is not connected to Unit Two.”
Well, think about that. And the fact is, with those kinds of people distributed around, a CEO who decides, “You know something, it’s too expensive to have this safety, so we’re going to cut back on that,” knows he’s going to get resistance from those people in his organization, these obsessive reliability and safety professionals. That’s one reason why.
“We Don’t Even Know How to Create a Safety Culture”
Chris: So if an organization or a company wants to start playing the what-if game tomorrow, what would make it work and what would kill it?
Paul: I have to say, that’s what the people at the PUC keep telling me. “Hey, we’ve got to have the safety culture regulation in place. We’ve got to have it in place in a couple of months.” And I said, “You know, we don’t even know how to create a safety culture. It’s a trial-and-error process.” They want it right away. But you can’t simply rush it.
How do people come to internalize it? First, I go back to this issue. Don’t forget, some units have subcultures that punish people who speak up. None of their colleagues will like it. They’ll be hostile. Their manager will go after them. So there are some negative things. The other thing is, some people are thinking, “It’ll hurt my career if I speak up on this. I really want to impress the managers, so I don’t want to say this is terrible suddenly.” You have to think about the bigger picture. The people at the PUC say, “Hey, here are the traits, here are the attributes.”
Chris: Go ahead and pretend.
Paul: Yes, that’s what they want to do. And I’m saying to them, you have to think about this. You have to explore what the cultures already are. Then you have to think about training. You have to think about training in the formation of teams, because a lot of these reliability people work in teams and they’re comfortable in teams. And you also have to train people in their jobs about the bigger picture and how the system works, so it’s not just, “Hey, I just turn these knobs. When I see a light, I turn the knob. That’s all I do.” You don’t want that.
Chris: So HRO doesn’t come in a box.
Paul: That’s a wonderful way to put it. It does not come in a box. And pretending it does is a safety risk in itself.
Chris: Now, in the early HROs, if I can call them your HROs, safety wasn’t traded off against cost or speed. Many practitioners say that production always wins in practice. I disagree myself, but how did those organizations hold that line?
Paul: It’s pretty easy, because all they had to do was wave the catastrophe that could happen over people’s heads, and the public’s. They can say, “Okay, you’re cutting back. Let’s make sure the public knows what we’re doing. Let’s testify at the committee, whatever. We ourselves are not comfortable with this.” And by the way, when those people in their HROs say, “I’m not comfortable with this,” you’ve got to pay attention. Most of the time, a CEO or a manager says, “I don’t give a damn if you’re comfortable. Just do it.” No. You have to pay attention.
Think about the impact it had when Bill Gates and others said they’re really worried about AI. That caught fire in the media. So with these people, if you risk crossing what, in their professional understanding of who they are, is somewhere you shouldn’t cross…
“I Don’t Know How You Become an HRO”
Chris: So somebody calls you up and says, “We want to become an HRO.” What do you say to them?
Paul: The first thing I have to say, honestly, is I don’t know how you become an HRO, because we never studied that process. We don’t know. Now, in some organizations, I know in retrospect, there was, like, a vice president for nuclear at PG&E who said, “By God, we’re going to do this,” and was one of these obsessive-type people. In other organizations, it also took a really strong-minded person.
We studied this airline company in Norway where there was a guy who did a study of how airplanes were landing at various airports. Norway has mountainous areas, with airports built in the middle of mountains, and he wanted to study exactly how they did it. He charted it out and said many of them were taking ridiculous risks. So he went to those pilots, and he said, “Why did you land under those conditions? We don’t want you to land like that, and we’re going to get rid of you if you are a cowboy.” He scared everybody, and that had an impact.
But in many organizations, that won’t work. It’s going to take time. And the other thing it’s going to take, and I tell them this: regulating for safety culture is an R&D project. You’re going to have to research and develop this. You’re going to make mistakes. You’re going to have to figure out how to do it. The first regulators in Europe, Statoil and the various companies they regulated, and the NRC in this country, didn’t start with regulations. They started with, “Here’s what we’d like to do. Let’s work with you and see how this might make sense and what changes we want.” They had ideas for how these changes might happen, but they held off on formally regulating safety culture for years.
Chris: So how does an organization know that they’ve hit the standard of being an HRO?
Paul: The first thing they know, and this is because they’re an HRO, is, “We’ve got to watch ourselves all the time.” They do not say, “We’re an HRO now, so we don’t have to worry about this anymore.” A real HRO is worried about it all the time. Once they’re worrying about it all the time, then I think, oh, you really could be an HRO, because you’re on the lookout for decay and drift. That’s a really important thing.
Chris: So one of the signs of being an HRO is not thinking that you are one.
Paul: Not trusting that you will always be one.
Chris: I like that. Not trusting that you will always be one. We have another bumper sticker.
Paul: By the way, these HROs are perishable. As I mentioned earlier, I never would have believed Boeing and the FAA wouldn’t continue as HROs. But by God, they haven’t. All it took was Boeing merging with another company that cared about its stock price and other things. And it took Congress cutting the FAA budget, so it doesn’t have the inspection force to oversee the new systems being developed. They’re more complicated than ever.
A Partisan of the Neglected Perspective
Chris: Is there anything else we didn’t get to that you would like to talk about?
Paul: Well, one thing I wanted to talk to you about, since you’re interested in safety managers. I wrote this little piece and presented it to an organization called Safety on the Edge. They have conferences, and they asked me. I called it “Beyond Safety,” moving beyond safety, because safety is one of the most poorly defined concepts. I’ll send it to you.
Chris: Please do.
Paul: I said one of the important things is that safety managers are going to have to have a new role. First, for many organizations, that role will involve negotiating with people outside the organization. If you need to restore service, you need to be able, as a safety officer, to ensure the foundations are in place for interorganizational redesign and response. That’s one role. Second, you will have to be prepared to argue with CEOs and even board chairpersons about which cuts really threaten safety, from the standpoint of some of these HRO properties. That’s going to be important, I think.
So they’re going to have to be maybe much broader in their scope. They’re going to have to be about reliability. Let’s put it that way. Reliability first. It has to be their identity, who they are: to be a partisan of the neglected perspective on safety issues.
Chris: Well, thank you for that. I had a lot of fun listening to you, and I am very impressed with your breadth and depth of knowledge on this. It’s been a pleasure. Thank you once again.
Paul: Me too. I really enjoyed it, and I hope to have you as a colleague I can run ideas by, listen to, and learn from. You’re increasing my invisible college here.
Chris: I love it. Thank you again for all your time.
Paul: Grazie, Chris. Take care.
Leave a Reply