The Nimrod Review - Official Documents

The Nimrod Review
18.19
18.20
18.21
18.22
Models
464
High Reliability theorists believe that properly designed and well-managed organisations can safely operate
the most hazardous technologies31 through: (i) the prioritisation of safety and reliability as a goal by political
elites and the organisation’s leadership; (ii) high levels of redundancy in personnel and technical safety
measures (permitting back up or overlap to compensate for failures); (iii) the development of a “high reliability
culture” in de-centralised and continually practised operations; and (iv) sophisticated forms of trial-and-error
learning. 32
Normal Accident theorists, however, consider much of the above to be an illusion. They regard serious
accidents in organisations managing hazardous technologies as inevitable over time33 because: (i) they have
no faith that the ‘goals’ of leaders of elites and organisations can permeate complex organisations entirely; (ii)
they place little faith in ‘redundancies’ which often add to the complexity of a system; (iii) they believe that,
in a complex system, neither strict centralisation nor de-centralisation of authority can ensure safety; and (iv)
they argue that significant restrictions are placed on ‘organisational learning’, not least because ‘secrecy’,
both inside complex organisations and between linked organisations, limits the overall organisation’s ability
to learn and implement lessons from others and also from historical experience. 34
In my view, there is value in both philosophies, but neither has a monopoly on veracity. The pessimism of
Normal Accident theory must give way to rigorous and pro-active safety management during one’s tenure of
responsibility. The optimism of High Reliability must yield to human fallibility and the truth that “…the one
hazard for which there is no technological remedy: the insidious concatenation of latent human failures that
are an inevitable part of any large organisation.” 35
We cannot expect to eliminate human error, technical failures and organisational pathogens altogether, but
we can hope to create systems so that they are more resistant to their adverse effects. Greater resilience
(unlike zero defects) is an achievable goal. 36 To achieve the goal of greater resilience, however, it is necessary
for safety to be an essential part of an organisation’s core business and not simply an add-on. 37 It is an
essential long term fitness plan.
‘Swiss Cheese’ model
18.23
James Reason’s well-known ‘Swiss Cheese’ model is a simple, but clever, illustration of how accidents happen
(see Figure 18.1 below). The slices of Emmental represent various defences, barrier and safeguards and the
holes and weakness that can develop through which an accident trajectory is able to pass. The holes are
in continual motion, moving from place to place, opening and shutting. When a series of holes line up, an
accident trajectory can pass all the way through and cause an accident event.
31 Scott D Sagan, The Limits of Safety, 1993, page 28.
32 Ibid, page 17.
33 Ibid, page 28.
34 Ibid, pages 37-43.
35 See James Reason, Human Error, 1990, page 250.
36 James Reason, The Human Contribution, 2008, page 261.
37 James Reason, Managing The Risks of Organisational Accidents, 1997, page 114.