Under pressure…

Many books are devoted to the “new paradigm” of safety, “Safety-II”… (too few are available in French). Gareth Lock’s has the great merit of being rich in inspiring, gripping stories that illustrate the principles of these new approaches very concretely. Stories from the world of diving that will of course fascinate amateur and professional practitioners, but also all those who, in these days of such an unusual autumn, sometimes feel as if they too were in the depths, in the dark…

When it comes to accidents and their prevention, there are a multitude of approaches and practices. But beyond the methods – which can give rise to fierce debates between specialists, particularly in academia – one can firmly consider that there are two “paradigms” here: two views of the world and of human relationships.

The first is the classic approach: the one that believes it can achieve “zero accidents”, “zero risk”. It is the paradigm of the absolute rationalisation of the world, of man’s mastery over the world around him.

This view relies on ever more numerous and detailed procedures, and on ever more rigorous implementation of them. On the search for “culprits”, too. Because accidents are supposedly always caused by “human error”. So people are constrained. They are also excluded as far as possible (forgetting in passing that systems, even “self-learning” ones, are always created at some point by people, with their biases, weaknesses and errors…). In this frame of reference, the “human factor” is a threat…

Of course, this constant pursuit of high standards and safety, and its results in many fields, bear witness to the power of our engineering cultures. This knowledge and rigour made the development of our industrial societies possible – we must not forget it. But when it comes to safety, and to grasping the ultra-complex systems of our socio-technical modernity, this approach comes up against limits that must be accepted. It is a matter of modesty, when hubris remains an important driver for many decision-makers.

Safety-I / Safety-II

The other paradigm has developed in the world of safety since the late 1980s, with HROs (high reliability organisations) and Resilience Engineering. For some illustrations, see Christian Morel’s books on “absurd decisions”.

The perceived weakness of these approaches – particularly in the face of engineers’ rigorous approaches and of our “zero risk” society, which applies criminal proceedings to accidents – is that they rely on approaches deemed “sociological”… “Soft” sciences against the usual “hard” sciences. When it comes to bringing about radical change in industrial or regulatory worlds, that is quite a handicap to start with…

And indeed, they can be described that way, since they integrate the human factor, with its biases and emotions… But they do so in order to take into account, in the light of major accidents, the challenges of our complex socio-technical systems.

It is worth noting that these years also saw the emergence, in many fields, of theories of “chaos” and “complexity”… A convergence of approaches, or at least of interests.

And while HROs were modest approaches, emphasising in particular the need to communicate better, to work better together, and to provide redundant resources rather than seeking “lean” organisations, Resilience Engineering proposed engineering approaches, a priori more reassuring for fields of action accustomed to greater rationality.

And this new approach, “Safety-II”, has convinced professionals in fields where safety is not just a matter of performance, but of life and death: nuclear safety, firefighting, oil platforms, underwater military operations…

One of the attractions of this book is that it is written by a practitioner of real risks. A former serviceman, a professional diver… So these are not just academic theories, even backed by examples that some might judge biased, given how hard it is to accept the proposed paradigm shift. Here are lived stories, told minute by minute, with real storytelling talent.

By presenting many key concepts, it thus helps to convince, by example, of the full value of the new paradigm of safety – and therefore of risk management.

Amateur and professional divers will be delighted. Others will shiver as they read the many case studies, in which you find yourself alongside the divers, in the dark depths. Real darkness, but of course transposable to the more cognitive darkness that the arrival of winter – among other things… – confronts us with.

Sully, or the limits of any procedure in a perilous situation

The book begins by recalling the “Sully” episode: the handling of the failure of both engines of an Airbus just after take-off from New York in 2009…

If you have not seen the film with Tom Hanks, don’t wait: it is a superb illustration of “the hell of procedures” and of the importance of the human factor.

As Gareth Lock points out, “the problem with checklists (and procedures) is that they do not match the situations that crews and operators have to face”…

Because to deal with the situation, Sully drew of course on his technical skills, those of a very experienced pilot, but also – and above all – on his “non-technical” skills: situation assessment, decision-making, communication with everyone, assertiveness but also recognition of everyone’s weaknesses, under the stress of events.

“Non-technical” skills (or soft skills) that recur throughout the book, and which are naturally lacking in “technical” (or “bureaucratic”) approaches.

And the film also illustrates the questions raised by “Just Culture” (one of the themes of Safety-II) because, despite the happy outcome of the accident (no deaths, a few minor injuries), Sully faced an investigation – since his decisions had led to the loss of the aircraft…

Hindsight bias

“Hindsight bias” is one of the key concepts to remember in these new approaches.

Many accidents (and, more broadly, past events) are analysed in the light of current knowledge. “They should have known”…

It is a very widespread psychological bias, don’t you think? One we probably often give in to, by reflex. But which we can suppress, with more or less ease. It is also an organisational bias… because for various reasons – financial liability as much as authority and institutional stability – it is simpler to look for responsibility, or better still guilt, than to admit that the system was not infallible. Or better still, that if it was not infallible, its designers must be considered guilty…

Whereas Safety-I considers that one must not fail, Safety-II accepts failure and accidents, but looks for ways “to fail safely”.

And here we are, of course, at the heart of the concept of “resilience” – a word so often heard in recent months…

Because Safety-I seeks “resistance”. It builds walls, ever higher, ever stronger… But is naturally overwhelmed when the “wave” is higher or more powerful, or seeps through the cracks, or goes round the Maginot lines…

While Safety-II seeks to preserve the continuity of the system, even when it is submerged; life after the accident; resilience.

The pillar or the network?

In the “new safety” paradigm, the challenge is therefore less to resist danger – considering that there will always be a danger “stronger” than the defences – than to design systems that can adapt after the shock (adaptive capacity building).

And the cases collected by Gareth Lock illustrate these approaches.

In the world of diving – which confronts practitioners with a hostile environment, since there is no oxygen – all the “rational” elements are brought together to guarantee everyone’s safety. Professional qualification procedures, hierarchical organisational rules, checklists to make sure equipment works properly, redundant equipment… And yet you will shudder as you read these stories, which might deserve, for teaching purposes, a more visual reconstruction…

Because despite these components of a solid pillar of safety, accidents happen… And so we see that the responses owe more to “more of the same” and bureaucratic obstinacy than to agile practice, relying on others and on a global approach.

And on renewed trust in people: because “human error” (what an awful term, loaded with an a priori value judgement) is considered in Safety-II not as the cause of system failure, but as the symptom of wider organisational and cultural dysfunctions… A real paradigm shift, isn’t it?

Of course, one of the reluctances to seek cohesion and learning from errors (fundamentals of “Just Culture”) is the “necessary” punishment of faults. This is a key question for these approaches, pivoting on the question of the “deliberate” error. A complex subject for organisations, obviously…

But is “human error” the cause of organisational failure, or its symptom? Whom should we condemn? The operator or the organisation? And what if we should condemn no one, but simply work to make the system more resilient tomorrow?

Developing peripheral vision

A term traditionally used in “Safety-II” is “situational awareness”… Reading these words, the classic rationalist may, one senses, feel a little queasy…

More particularly soft approaches… expanded awareness, global awareness… All this must have been invented in the 1980s and 90s by survivors of the 1970s… hippies with brains damaged by chemical experiments… Or at least by “psychologists”, not by engineers (which is true, at least as regards the origin of the concept among psychologists).

So let us propose an alternative. For example, adopting one of the recommendations given to soldiers in combat: develop your peripheral vision, both to identify unexpected threats and to avoid attracting the enemy’s attention, and therefore increasing the danger… Better?

Whatever the term chosen, the point is not to focus on the immediate danger but to broaden one’s perceptions “at the same time”, to consider the other consequences of decisions taken in a hurry, in a silo. To recognise that, under stress, we react according to known biases, with weaknesses. And to force oneself, despite the obsessive threat, to manage the crisis as a whole: not as an emergency, which lasts only a few minutes or days, but as a crisis, which settles in over time.

Managing an emergency may indeed justify directive, one-off management, which inevitably destroys cohesion and trust. Managing a crisis requires collective work and lasting social cohesion, based on trust. One must choose between the two, and the timescale is a key parameter in this complex decision.

Accepting uncertainty

For making decisions in situations of immediate danger, several avenues are proposed by Safety-II approaches and by Gareth Lock’s book.

One of them is accepting uncertainty. Risk should not always be treated as a calculation, however complicated. Because you can only measure what you know. Which, by definition, is not the case in complex situations, with unpredictable situations emerging by nature or through a combination of aggregated factors (one plus one sometimes makes something other than two…).

In the face of risk, one can make “logical” decisions based on statistics. In the face of uncertainty, where some risks are unknown, one can only rely on intuition – a concept that also rests on personal experience and learning – “soft” skills.

What is terrible, but human, is that we always try to reassure ourselves with numbers… which give us “certainties”, even when the situation is complex, and therefore uncertain.

This is the paradox of the Christmas turkey… With each passing day, the probability that the farmer will feed it increases, since he does so every day… And it is when the probability is highest in the statistical series considered (it has been fed 99 days out of 100) that Christmas Eve arrives…

Relying on intuition?

The perception of risk is therefore not just a matter of numbers; it is also a matter of experience, environment, emotions…

So the book’s reference to the work of Gary Klein and his “naturalistic decision-making” is welcome. All the more so since, until now, this approach had not yet been formally taken into account in Resilience Engineering work. Until now, since the association that drives Safety-II devoted a webinar to these combined approaches in early November…

Relying on intuition is more complex than it seems.

Because intuition is fed by experience – as is well known in military “drill” – which makes it possible to steer “automatically” between several scenarios whose outcome, or at least the next few “moves”, one knows.

But beyond intuition, when one is in the unpredictability of a complex situation, one must also draw on Daniel Kahneman’s “System 2”, notably by taking the time to develop collective critical thinking. The strength of the collective, of team spirit, rather than authoritarian “leadership” or bureaucratic action… Team spirit and trust rather than the culture of imposition and systematic mistrust that, it is said, characterises the world of “Absurdistan”…

Agreeing to rely on this “intuition” also means recognising all its limits in situations of major stress, or simply, and preparing for them.

An example? Answer quickly: “if a ball and a bat cost 11 euros, and the bat costs 10 euros more than the ball, how much does the ball cost?” Then check… it is quite likely that your mental reflexes took over…

And under stress, as Daniel Kahneman reminds us: “What you see is all there is”.

So, in a diving incident as at the heart of the critical events we are experiencing, many biases impose themselves on our “rational” thinking, in particular: a limited view of the environment, possible imminent danger, complexity due to technical and human factors… fear…

If you were asked the same question under immediate threat, what would you answer?

Psychological safety, too

Faced with these constraints, the Safety-I “rationalists” and supporters of infallible bureaucracy recommend “pulling yourself together”… sometimes that is possible.

Whereas Safety-II practitioners recommend calling on the group, on team spirit.

Because we are all subject – including “the best of us” – to emotions, sometimes repressed but always influential. So the only possible regulation is that of the group. Provided this “group” can speak freely. This is at the heart of approaches to “psychological safety”.

Psychological safety is the ability to speak freely. So it is also the feeling of really being part of a team, from which one expects more solidarity and listening than threats or constraints. Because fear impairs the ability to analyse situations, to perceive and to decide. It also prevents people from speaking up, when doing so is a risk, at least a moral one.

Creating psychological safety in a team is therefore crucial for facing crisis situations.

How, then, can one imagine a brutal crisis being managed effectively by a team in which trust does not exist, and whose members are driven by competition, or by control, fear, verticality? In a context of competition (electoral, for example) and under the threat of legal proceedings, or at least of pride wounded in the media, the question of collective trust may arise.

But when it is a matter of life and death in operations, for oneself and for others, it is an indispensable condition for success, which goes beyond egos.

One of the benefits of psychological safety is the quality of communication and exchanges. People speak, and they listen. Other factors come into play here. The verbal, of course, with the necessary clarification of intent and feelings, beyond barriers of language and culture. The non-verbal too – and the constraints of “remote working” put this question at the heart of current events.

The past, too. If relationships are bad or trust has been broken, communication – including, of course, in a crisis – will not be of good quality. If you have time to rebuild trust, that is a prerequisite. But in an emergency, you may not be, for these reasons, the right messenger – and you must then consider “handing over”.

Close to “psychological safety”, the book also discusses the effects of authority gradients… and again the importance of being able to speak up. Here we find the drawbacks of power “over” (the Weberian bureaucratic approach), whereas one must think in terms of “power with” (Hannah Arendt’s approach). There is therefore, of course, a chapter devoted to “leadership”, but combined with a very original “followership” – even if the reference to Arendt is missing here, since her reflections on power, “leaders” and “followers” are foundational. Bearing in mind that “followership” also means the ability to speak up, to improve collective performance and safety.

In any case, Lock offers a very fine phrase on leadership: “leadership is not about being ‘in charge’… It is about taking care of those who are ‘in charge’, developing and motivating them in a way that meets the needs of the team members, so that they can achieve the team’s goals”.

Building on what works, and on those who contribute to it

At the heart of Resilience Engineering is the “debrief” – “lessons learned”, or RETEX in French military operations. But this debrief is not the exclusive search for what did not work as planned…

Here again, we have biases…

Human evolution has pushed us, for millennia, to focus on what did not work, in order to prevent further accidents. In everyday life, don’t you sometimes answer “I have nothing to say” when asked what you thought of the perfect execution of an exercise, a piano piece, a dance move, by one of your children? And of course in the professional world too.

When you could answer (and perhaps you do) “that was perfect!”, or even “that moment was very well done”.

Because by looking only for failures, we do not learn from what worked well – which is nonetheless essential to a “resilience” approach. And we put the other person in a position of accusation, mistrust and fear… which does not contribute to collective resilience either.

All the more so because, in the Safety-I paradigm – applying rules rather than resilience – containment and imposition are always favoured (more of the same) over extension: learning also from what works, and relying on those who contribute to the shared objective.

Finally, mobilising the group – and its support for a common project – can never be achieved through an overly detailed procedure, but only around a shared objective (of safety, in this specific case). The more detail you add, the more the “details” are likely to be challenged, because they are unsuitable, or infantilising and therefore disrespectful… This is what complex change management methods call “min specs”, minimum specifications… Any resemblance to a current situation is, of course, entirely coincidental.

Finally, as we conclude, a word of warning: once you have tasted these new approaches, you may not be able to do without them… and your view of crisis management will, depending on your starting point, be either confirmed or radically changed. You will have tipped over into the “new paradigm”…

In Gareth Lock’s book, at the end of each chapter, you will find references to many authoritative books in the field, in an academic or more narrative style, which will allow those who wish to extend their “dive” into these new approaches…

And then there is another way of extending this reading: talking about it together! Don’t hesitate…

Gareth Lock, “Under Pressure: Diving Deeper with Human Factors”, The Human Diver, 2019